videodraft 0.15.0 → 0.15.1

package/dist/client.d.ts

@@ -36,13 +36,21 @@ interface ConnectionSessionStore {
      * Persist a freshly minted token for this scope and return the token that
      * now owns the scope. Two processes racing on an empty scope both mint;
      * the first writer wins and the second gets the winner's token back, so
-     * one directory never ends up split across two sessions.
+     * one directory never ends up split across two sessions. Returns null
+     * when the token could NOT be persisted (read-only config dir): the
+     * caller must then go stateless — sending an unpersisted token would
+     * create a fresh AI Studio session per invocation, when the documented
+     * degraded mode is the shared server-side fallback.
      */
-    save(token: string): string;
+    save(token: string): string | null;
     /** Replace the scope's token unconditionally (server re-mint). */
     replace(token: string): void;
-    /** Forget the current token; the next call re-initialises. */
-    reset(): void;
+    /**
+     * Forget the current token; the next call re-initialises. Returns whether
+     * the deletion actually ran — false means the scope lock could not be
+     * taken (or the filesystem refused) and the record may still exist.
+     */
+    reset(): boolean;
     /** Where this scope's record lives (for `sessions current`). */
     describe(): {
         scope: string;
@@ -64,7 +72,12 @@ interface SessionScopeInput {
 /** Stable label for this scope; what the record is keyed by. */
 declare function sessionScope(input: SessionScopeInput): string;
 declare function createConnectionSessionStore(input: SessionScopeInput): ConnectionSessionStore;
-/** Drop every stored connection session (all scopes) for this config dir. */
+/**
+ * Drop every stored connection session (all scopes) for this config dir.
+ * Each record is removed under its per-scope lock — the same protocol as
+ * the single-scope reset — so a concurrent touch/replace that already read
+ * the old record cannot recreate it right after the sweep deletes it.
+ */
 declare function resetAllConnectionSessions(env?: NodeJS.ProcessEnv): number;
 
 /**

package/dist/client.js

@@ -214,7 +214,7 @@ async function withLock(lockName, fn, env = process.env) {
 // src/core/session.ts
 import fs2 from "fs";
 import path2 from "path";
-import { createHash } from "crypto";
+import { createHash, randomBytes } from "crypto";
 var SESSION_IDLE_MS = 12 * 60 * 60 * 1e3;
 var MCP_SESSION_HEADER = "Mcp-Session-Id";
 function sessionsDir(env) {
@@ -268,19 +268,6 @@ function writeRecord(file, record) {
   fs2.writeFileSync(tmp, JSON.stringify(record, null, 2), { mode: 384 });
   fs2.renameSync(tmp, file);
 }
-function claimRecord(file, record) {
-  fs2.mkdirSync(path2.dirname(file), { recursive: true, mode: 448 });
-  try {
-    fs2.writeFileSync(file, JSON.stringify(record, null, 2), {
-      mode: 384,
-      flag: "wx"
-    });
-    return true;
-  } catch (err) {
-    if (err?.code === "EEXIST") return false;
-    throw err;
-  }
-}
 function isLive(record, nowMs) {
   const idle = nowMs - Date.parse(record.lastUsedAt);
   return Number.isFinite(idle) && idle <= SESSION_IDLE_MS;
@@ -296,33 +283,61 @@ function sleepSync(ms) {
 }
 function acquireReclaimLock(file) {
   const lock = `${file}.lock`;
+  const owner = `${process.pid}:${randomBytes(6).toString("hex")}`;
   try {
-    fs2.writeFileSync(lock, String(process.pid), { mode: 384, flag: "wx" });
-    return true;
+    fs2.mkdirSync(path2.dirname(lock), { recursive: true, mode: 448 });
+    fs2.writeFileSync(lock, owner, { mode: 384, flag: "wx" });
+    return owner;
   } catch (err) {
-    if (err?.code !== "EEXIST") return false;
+    if (err?.code !== "EEXIST") throw err;
     try {
       const age = Date.now() - fs2.statSync(lock).mtimeMs;
-      if (age <= RECLAIM_LOCK_STALE_MS) return false;
+      if (age <= RECLAIM_LOCK_STALE_MS) return null;
       const claimed = `${lock}.break.${process.pid}`;
       fs2.renameSync(lock, claimed);
       fs2.rmSync(claimed, { force: true });
-      fs2.writeFileSync(lock, String(process.pid), {
-        mode: 384,
-        flag: "wx"
-      });
-      return true;
+      fs2.writeFileSync(lock, owner, { mode: 384, flag: "wx" });
+      return owner;
     } catch {
-      return false;
+      return null;
     }
   }
 }
-function releaseReclaimLock(file) {
+function releaseReclaimLock(file, owner) {
+  const lock = `${file}.lock`;
   try {
-    fs2.rmSync(`${file}.lock`, { force: true });
+    if (fs2.readFileSync(lock, "utf8") !== owner) return;
+    fs2.rmSync(lock, { force: true });
   } catch {
   }
 }
+function withScopeLock(file, fn) {
+  const deadline = Date.now() + RECLAIM_LOCK_STALE_MS + RECLAIM_WAIT_MS;
+  let owner;
+  try {
+    owner = acquireReclaimLock(file);
+    while (!owner && Date.now() < deadline) {
+      sleepSync(RECLAIM_POLL_MS);
+      owner = acquireReclaimLock(file);
+    }
+  } catch {
+    return false;
+  }
+  if (!owner) return false;
+  const lockPath = `${file}.lock`;
+  const stillOwner = () => {
+    try {
+      return fs2.readFileSync(lockPath, "utf8") === owner;
+    } catch {
+      return false;
+    }
+  };
+  try {
+    return fn(stillOwner);
+  } finally {
+    releaseReclaimLock(file, owner);
+  }
+}
 function createConnectionSessionStore(input) {
   const env = input.env ?? process.env;
   const now = input.now ?? Date.now;
@@ -345,58 +360,76 @@ function createConnectionSessionStore(input) {
     load() {
       const record = readRecord(file);
       if (!record || !isLive(record, now())) return null;
-      if (acquireReclaimLock(file)) {
+      const quickDeadline = Date.now() + 5 * RECLAIM_POLL_MS;
+      let owner;
+      try {
+        owner = acquireReclaimLock(file);
+        while (!owner && Date.now() < quickDeadline) {
+          sleepSync(RECLAIM_POLL_MS);
+          owner = acquireReclaimLock(file);
+        }
+      } catch {
+        return record.token;
+      }
+      if (owner) {
         try {
           const current = readRecord(file);
-          if (current && current.token === record.token) {
-            writeRecord(file, {
-              ...current,
-              lastUsedAt: new Date(now()).toISOString()
-            });
+          if (!current || !isLive(current, now())) return null;
+          try {
+            const lockPath = `${file}.lock`;
+            if (fs2.readFileSync(lockPath, "utf8") === owner) {
+              writeRecord(file, {
+                ...current,
+                lastUsedAt: new Date(now()).toISOString()
+              });
+            }
+          } catch {
           }
-        } catch {
+          return current.token;
         } finally {
-          releaseReclaimLock(file);
+          releaseReclaimLock(file, owner);
         }
       }
-      return record.token;
+      return null;
     },
     save(token) {
       try {
-        if (claimRecord(file, fresh(token))) return token;
-        const winner = readRecord(file);
-        if (winner && isLive(winner, now())) return winner.token;
-        if (acquireReclaimLock(file)) {
-          try {
-            const current = readRecord(file);
-            if (current && isLive(current, now())) return current.token;
-            writeRecord(file, fresh(token));
-            return token;
-          } finally {
-            releaseReclaimLock(file);
-          }
-        }
-        const deadline = Date.now() + RECLAIM_WAIT_MS;
-        while (Date.now() < deadline) {
+        let result = null;
+        const ran = withScopeLock(file, (stillOwner) => {
           const current = readRecord(file);
-          if (current && isLive(current, now())) return current.token;
-          sleepSync(RECLAIM_POLL_MS);
-        }
-        return token;
+          if (current && isLive(current, now())) {
+            result = current.token;
+            return true;
+          }
+          if (!stillOwner()) return false;
+          writeRecord(file, fresh(token));
+          result = token;
+          return true;
+        });
+        return ran ? result : null;
       } catch {
-        return token;
+        return null;
       }
     },
     replace(token) {
       try {
-        writeRecord(file, fresh(token));
+        withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          writeRecord(file, fresh(token));
+          return true;
+        });
       } catch {
       }
     },
     reset() {
       try {
-        fs2.rmSync(file, { force: true });
+        return withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          fs2.rmSync(file, { force: true });
+          return true;
+        });
       } catch {
+        return false;
       }
     },
     describe() {
@@ -417,8 +450,17 @@ function resetAllConnectionSessions(env = process.env) {
   try {
     for (const name of fs2.readdirSync(dir)) {
       if (!name.endsWith(".json")) continue;
-      fs2.rmSync(path2.join(dir, name), { force: true });
-      removed += 1;
+      const file = path2.join(dir, name);
+      try {
+        if (withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          fs2.rmSync(file, { force: true });
+          return true;
+        })) {
+          removed += 1;
+        }
+      } catch {
+      }
     }
   } catch {
   }
@@ -462,7 +504,12 @@ var VideoDraftClient = class {
     if (!this.session || this.sessionId !== void 0) return;
     if (!this.handshake) {
       this.handshake = (async () => {
-        const stored = this.session.load();
+        let stored = null;
+        try {
+          stored = this.session.load();
+        } catch {
+          stored = null;
+        }
         if (stored) {
           this.sessionId = stored;
           return;

package/dist/index.js

@@ -24,8 +24,8 @@ function readVersionFromDisk() {
   }
 }
 function resolveVersion() {
-  if ("0.15.0") {
-    return "0.15.0";
+  if ("0.15.1") {
+    return "0.15.1";
   }
   return readVersionFromDisk();
 }
@@ -663,7 +663,7 @@ async function revokeToken(baseUrl, token, fetchImpl = fetch) {
 // src/core/session.ts
 import fs3 from "fs";
 import path2 from "path";
-import { createHash } from "crypto";
+import { createHash, randomBytes } from "crypto";
 var SESSION_IDLE_MS = 12 * 60 * 60 * 1e3;
 var MCP_SESSION_HEADER = "Mcp-Session-Id";
 function sessionsDir(env) {
@@ -717,19 +717,6 @@ function writeRecord(file, record) {
   fs3.writeFileSync(tmp, JSON.stringify(record, null, 2), { mode: 384 });
   fs3.renameSync(tmp, file);
 }
-function claimRecord(file, record) {
-  fs3.mkdirSync(path2.dirname(file), { recursive: true, mode: 448 });
-  try {
-    fs3.writeFileSync(file, JSON.stringify(record, null, 2), {
-      mode: 384,
-      flag: "wx"
-    });
-    return true;
-  } catch (err) {
-    if (err?.code === "EEXIST") return false;
-    throw err;
-  }
-}
 function isLive(record, nowMs) {
   const idle = nowMs - Date.parse(record.lastUsedAt);
   return Number.isFinite(idle) && idle <= SESSION_IDLE_MS;
@@ -745,33 +732,61 @@ function sleepSync(ms) {
 }
 function acquireReclaimLock(file) {
   const lock = `${file}.lock`;
+  const owner = `${process.pid}:${randomBytes(6).toString("hex")}`;
   try {
-    fs3.writeFileSync(lock, String(process.pid), { mode: 384, flag: "wx" });
-    return true;
+    fs3.mkdirSync(path2.dirname(lock), { recursive: true, mode: 448 });
+    fs3.writeFileSync(lock, owner, { mode: 384, flag: "wx" });
+    return owner;
   } catch (err) {
-    if (err?.code !== "EEXIST") return false;
+    if (err?.code !== "EEXIST") throw err;
     try {
       const age = Date.now() - fs3.statSync(lock).mtimeMs;
-      if (age <= RECLAIM_LOCK_STALE_MS) return false;
+      if (age <= RECLAIM_LOCK_STALE_MS) return null;
       const claimed = `${lock}.break.${process.pid}`;
       fs3.renameSync(lock, claimed);
       fs3.rmSync(claimed, { force: true });
-      fs3.writeFileSync(lock, String(process.pid), {
-        mode: 384,
-        flag: "wx"
-      });
-      return true;
+      fs3.writeFileSync(lock, owner, { mode: 384, flag: "wx" });
+      return owner;
     } catch {
-      return false;
+      return null;
     }
   }
 }
-function releaseReclaimLock(file) {
+function releaseReclaimLock(file, owner) {
+  const lock = `${file}.lock`;
   try {
-    fs3.rmSync(`${file}.lock`, { force: true });
+    if (fs3.readFileSync(lock, "utf8") !== owner) return;
+    fs3.rmSync(lock, { force: true });
   } catch {
   }
 }
+function withScopeLock(file, fn) {
+  const deadline = Date.now() + RECLAIM_LOCK_STALE_MS + RECLAIM_WAIT_MS;
+  let owner;
+  try {
+    owner = acquireReclaimLock(file);
+    while (!owner && Date.now() < deadline) {
+      sleepSync(RECLAIM_POLL_MS);
+      owner = acquireReclaimLock(file);
+    }
+  } catch {
+    return false;
+  }
+  if (!owner) return false;
+  const lockPath = `${file}.lock`;
+  const stillOwner = () => {
+    try {
+      return fs3.readFileSync(lockPath, "utf8") === owner;
+    } catch {
+      return false;
+    }
+  };
+  try {
+    return fn(stillOwner);
+  } finally {
+    releaseReclaimLock(file, owner);
+  }
+}
 function createConnectionSessionStore(input) {
   const env = input.env ?? process.env;
   const now = input.now ?? Date.now;
@@ -794,58 +809,76 @@ function createConnectionSessionStore(input) {
     load() {
       const record = readRecord(file);
       if (!record || !isLive(record, now())) return null;
-      if (acquireReclaimLock(file)) {
+      const quickDeadline = Date.now() + 5 * RECLAIM_POLL_MS;
+      let owner;
+      try {
+        owner = acquireReclaimLock(file);
+        while (!owner && Date.now() < quickDeadline) {
+          sleepSync(RECLAIM_POLL_MS);
+          owner = acquireReclaimLock(file);
+        }
+      } catch {
+        return record.token;
+      }
+      if (owner) {
         try {
           const current = readRecord(file);
-          if (current && current.token === record.token) {
-            writeRecord(file, {
-              ...current,
-              lastUsedAt: new Date(now()).toISOString()
-            });
+          if (!current || !isLive(current, now())) return null;
+          try {
+            const lockPath = `${file}.lock`;
+            if (fs3.readFileSync(lockPath, "utf8") === owner) {
+              writeRecord(file, {
+                ...current,
+                lastUsedAt: new Date(now()).toISOString()
+              });
+            }
+          } catch {
           }
-        } catch {
+          return current.token;
         } finally {
-          releaseReclaimLock(file);
+          releaseReclaimLock(file, owner);
         }
       }
-      return record.token;
+      return null;
     },
     save(token) {
       try {
-        if (claimRecord(file, fresh(token))) return token;
-        const winner = readRecord(file);
-        if (winner && isLive(winner, now())) return winner.token;
-        if (acquireReclaimLock(file)) {
-          try {
-            const current = readRecord(file);
-            if (current && isLive(current, now())) return current.token;
-            writeRecord(file, fresh(token));
-            return token;
-          } finally {
-            releaseReclaimLock(file);
-          }
-        }
-        const deadline = Date.now() + RECLAIM_WAIT_MS;
-        while (Date.now() < deadline) {
+        let result = null;
+        const ran = withScopeLock(file, (stillOwner) => {
           const current = readRecord(file);
-          if (current && isLive(current, now())) return current.token;
-          sleepSync(RECLAIM_POLL_MS);
-        }
-        return token;
+          if (current && isLive(current, now())) {
+            result = current.token;
+            return true;
+          }
+          if (!stillOwner()) return false;
+          writeRecord(file, fresh(token));
+          result = token;
+          return true;
+        });
+        return ran ? result : null;
       } catch {
-        return token;
+        return null;
       }
     },
     replace(token) {
       try {
-        writeRecord(file, fresh(token));
+        withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          writeRecord(file, fresh(token));
+          return true;
+        });
       } catch {
       }
     },
     reset() {
       try {
-        fs3.rmSync(file, { force: true });
+        return withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          fs3.rmSync(file, { force: true });
+          return true;
+        });
       } catch {
+        return false;
       }
     },
     describe() {
@@ -866,8 +899,17 @@ function resetAllConnectionSessions(env = process.env) {
   try {
     for (const name of fs3.readdirSync(dir)) {
       if (!name.endsWith(".json")) continue;
-      fs3.rmSync(path2.join(dir, name), { force: true });
-      removed += 1;
+      const file = path2.join(dir, name);
+      try {
+        if (withScopeLock(file, (stillOwner) => {
+          if (!stillOwner()) return false;
+          fs3.rmSync(file, { force: true });
+          return true;
+        })) {
+          removed += 1;
+        }
+      } catch {
+      }
     }
   } catch {
   }
@@ -911,7 +953,12 @@ var VideoDraftClient = class {
     if (!this.session || this.sessionId !== void 0) return;
     if (!this.handshake) {
       this.handshake = (async () => {
-        const stored = this.session.load();
+        let stored = null;
+        try {
+          stored = this.session.load();
+        } catch {
+          stored = null;
+        }
         if (stored) {
           this.sessionId = stored;
           return;
@@ -1199,6 +1246,9 @@ var VideoDraftClient = class {
   }
 };
 
+// src/cli/context.ts
+import { createHash as createHash2 } from "crypto";
+
 // src/auth/token-provider.ts
 var EXPIRY_SKEW_MS = 6e4;
 function isExpiring(profile) {
@@ -1312,6 +1362,14 @@ function sessionArg(command, opts) {
   }
   return opts.session;
 }
+function sessionProfileKey(profileName, explicitToken) {
+  if (profileName) return `profile:${profileName}`;
+  if (explicitToken) {
+    const fp = createHash2("sha256").update(explicitToken).digest("hex").slice(0, 16);
+    return `token:${fp}`;
+  }
+  return "default";
+}
 function connectionSessionEnabled(env = process.env) {
   const v = env.VIDEODRAFT_NO_SESSION?.trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -1342,7 +1400,10 @@ function buildContext(command) {
   });
   const session = connectionSessionEnabled() ? createConnectionSessionStore({
     baseUrl: auth.baseUrl,
-    profile: auth.profileName ?? "default"
+    profile: sessionProfileKey(
+      auth.profileName,
+      flags.token ?? process.env.VIDEODRAFT_API_KEY
+    )
   }) : void 0;
   const client = new VideoDraftClient({
     tokenProvider: auth.tokenProvider,
@@ -1887,25 +1948,33 @@ ${section.toUpperCase()}
     "Show the connection session this directory's standalone generations are filed under"
   ).action(async function() {
     const ctx = buildContext(this);
-    const info = ctx.session?.describe();
-    const record = info?.record ?? null;
-    const active = Boolean(record) && !info?.expired;
-    const sessionId = active ? info?.sessionId ?? null : null;
-    let created = false;
-    if (sessionId) {
+    const knownIds = /* @__PURE__ */ new Set();
+    let listed = false;
+    if (ctx.session) {
       try {
-        const listed = await ctx.client.callTool(
-          "list_ai_studio_sessions",
-          { limit: 200 }
-        );
-        const rows = listed?.sessions ?? [];
-        created = rows.some(
-          (row) => (row?.id ?? row?.session_id) === sessionId
-        );
+        for (let offset = 0; offset < 2e3; ) {
+          const page = await ctx.client.callTool(
+            "list_ai_studio_sessions",
+            { limit: 200, offset }
+          );
+          const pageRows = page?.sessions ?? [];
+          for (const row of pageRows) {
+            const id = row?.id ?? row?.session_id;
+            if (typeof id === "string") knownIds.add(id);
+          }
+          if (pageRows.length < 200) break;
+          offset += pageRows.length;
+        }
+        listed = true;
       } catch {
-        created = false;
+        listed = false;
       }
     }
+    const info = ctx.session?.describe();
+    const record = info?.record ?? null;
+    const active = Boolean(record) && !info?.expired;
+    const sessionId = active ? info?.sessionId ?? null : null;
+    const created = Boolean(sessionId) && listed && knownIds.has(sessionId);
     const result = {
       enabled: Boolean(ctx.session),
       scope: info?.scope ?? null,
@@ -1936,21 +2005,24 @@ ${result.url ? `${result.url}
     const ctx = buildContext(this);
     const opts = this.opts();
     let removed = 0;
+    let declined = false;
     if (opts.all) {
       removed = resetAllConnectionSessions();
     } else if (ctx.session) {
       const had = Boolean(ctx.session.describe().record);
-      ctx.session.reset();
-      removed = had ? 1 : 0;
+      const ran = ctx.session.reset();
+      removed = had && ran ? 1 : 0;
+      declined = had && !ran;
     }
     const result = {
       reset: removed,
+      declined,
       scope: opts.all ? "all" : ctx.session?.describe().scope ?? null
     };
     emit(ctx.out, result, () => {
       process.stdout.write(
         removed > 0 ? `Reset ${removed} connection session${removed === 1 ? "" : "s"}; the next generation starts a new AI Studio session.
-` : "Nothing to reset.\n"
+` : declined ? "Could not reset: the session store is locked or unwritable; the session may still be in use.\n" : "Nothing to reset.\n"
       );
     });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "videodraft",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Official VideoDraft CLI — create AI videos, images and audio from your terminal. Agent-friendly: --json everywhere, stable exit codes, async job polling.",
   "license": "MIT",
   "type": "module",