#1950 shipped FileSecretStore without cross-process mutual exclusion, by decision: an earlier revision hand-rolled a `mkdir` election with an owner stamp, a heartbeat and a stale-takeover, and three consecutive review rounds found a real race in it. The last one is not closable with what Node exposes — claiming a stale lock atomically needs compare-and-swap on a directory entry (`renameat2(RENAME_EXCHANGE)`) — so it was replaced with optimistic verify-and-retry and the residual documented. #2082 settles that as "borrow, don't hand-roll". `proper-lockfile` is what npm itself locks with, and stale-takeover is precisely the problem it has already solved: it re-stats the lock directory after claiming it and gives the lock up when the mtime is not the one it wrote, so the loser of a takeover race releases instead of proceeding. - core/auth/node/file-lock.ts: `withSecretFileLock`. `realpath: false` so a file can be locked into existence (the very first `set` has no `secrets.json`, and the library's default resolves through `fs.realpath`); a warning in place of the library's `onCompromised`, which throws from a timer and would take the session down; and a degrade-with-one-warning path rather than a throw when no lock can be taken — this store exists for boxes missing the usual mechanism (#1848, #1905) and must not gain a new way to be unavailable. - FileSecretStore.mutate holds it across the whole read-modify-write. The optimistic verify stays underneath and is not redundant: a lock is advisory between the processes that take it, so the verify covers a writer outside this codebase and covers the degrade path. The in-process queue stays too, and gains a second job — proper-lockfile is not reentrant, so serializing per path keeps ELOCKED meaning "another process". - absorbFileSecretsIntoKeyring takes the same lock around orphan adoption and the atomic claim, behind a lock-free `readdir` fast path so the common startup (keychain available, no file ever written) neither creates a lock directory nor warns about one it could not create. proper-lockfile is a root `dependency` per the placement rule, and is named in all three bundler `external` lists: tsup externalizes what the *client's* manifest declares, so a root-only CJS package was being inlined into the ESM bundles, leaving esbuild's `Dynamic require of "path" is not supported` shim that killed `--cli` at import time. That rule was undocumented; it is now in AGENTS.md beside the placement rule that creates it, and mirrored into .github/copilot-instructions.md. Tests: 7 new in file-lock.test.ts driving a real second process (the existing suite structurally cannot — `serialize` orders in-process callers before the lock sees them), plus two for the migration fast path. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTHVxSu8AUgHRLvo1ntZ8H Signed-off-by: cliffhall <cliff@futurescale.com>
138 lines
6 KiB
TypeScript
138 lines
6 KiB
TypeScript
import { defineConfig, type Options } from "tsup";
|
|
import { readFile } from "node:fs/promises";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
const repoRoot = path.resolve(dirname, "../..");
|
|
|
|
/**
|
|
* `ink-form` hardcodes a misspelled hint under an incomplete form — "you have
|
|
* not competed yet" — with no prop to override it. It is upstream's string
|
|
* (`ink-form/lib/SubmitButton.js`), last published in 2024, but it renders in
|
|
* the Inspector's tool/prompt/resource test forms, so we correct it on the way
|
|
* into the bundle. Reported upstream as lukasbach/ink-form#14; drop this patch
|
|
* if a release ever carries the fix.
|
|
*
|
|
* This is only possible because `ink-form` is inlined (see `noExternal` below).
|
|
*/
|
|
export const INK_FORM_INCOMPLETE_HINT = {
|
|
typo: "There are still required inputs you have not competed yet.",
|
|
fixed: "There are still required inputs you have not completed yet.",
|
|
};
|
|
|
|
/**
|
|
* Applies the correction above, throwing if the string is no longer there.
|
|
*
|
|
* Failing loudly is the point: a silent no-op would let an `ink-form` upgrade
|
|
* (or a fixed upstream, or a reworded label) quietly retire this patch with
|
|
* nobody noticing it had stopped applying — or, worse, leave a patch here for a
|
|
* string that no longer exists. If this throws, check whether upstream fixed
|
|
* the typo; if so, delete this patch rather than re-targeting it.
|
|
*/
|
|
export function fixInkFormIncompleteHint(source: string, file: string): string {
|
|
if (!source.includes(INK_FORM_INCOMPLETE_HINT.typo)) {
|
|
throw new Error(
|
|
`${file} no longer contains the ink-form label this build patches ` +
|
|
`(${JSON.stringify(INK_FORM_INCOMPLETE_HINT.typo)}). If upstream fixed ` +
|
|
`the typo, remove fixInkFormIncompleteHint from tsup.config.ts.`,
|
|
);
|
|
}
|
|
return source.replaceAll(
|
|
INK_FORM_INCOMPLETE_HINT.typo,
|
|
INK_FORM_INCOMPLETE_HINT.fixed,
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Which module the patch above is applied to.
|
|
*
|
|
* Exported so the tests can check it against the *resolved* path of the real
|
|
* `ink-form` module — a filter that stops matching is the one way this patch
|
|
* can silently no-op, since `fixInkFormIncompleteHint` would then never run.
|
|
*/
|
|
export const INK_FORM_SUBMIT_BUTTON = /ink-form[\\/]lib[\\/]SubmitButton\.js$/;
|
|
|
|
// The plugin type is derived from tsup rather than imported from `esbuild`:
|
|
// `esbuild` is tsup's transitive dependency, not a declared one of this client,
|
|
// so a direct import typechecks only while npm happens to hoist it.
|
|
type EsbuildPlugin = NonNullable<Options["esbuildPlugins"]>[number];
|
|
|
|
export const inkFormLabelPatch: EsbuildPlugin = {
|
|
name: "ink-form-label-patch",
|
|
setup(build) {
|
|
build.onLoad(
|
|
{ filter: INK_FORM_SUBMIT_BUTTON },
|
|
async ({ path: file }) => ({
|
|
contents: fixInkFormIncompleteHint(await readFile(file, "utf8"), file),
|
|
loader: "js",
|
|
}),
|
|
);
|
|
},
|
|
};
|
|
|
|
export default defineConfig({
|
|
entry: ["index.ts"],
|
|
format: ["esm"],
|
|
outDir: "build",
|
|
clean: true,
|
|
// No source maps in the published bundle — they roughly double the on-disk
|
|
// size and aren't needed at runtime (debug via `npm run dev` on the source).
|
|
sourcemap: false,
|
|
target: "node22",
|
|
platform: "node",
|
|
// Every package here renders React components, so it MUST share the one React
|
|
// instance the bundle imports. Bundling is what guarantees that: an inlined
|
|
// package's `import "react"` is emitted into build/index.js, so it resolves
|
|
// from *this* directory exactly like the bundle's own, and no consumer install
|
|
// layout can point it elsewhere (#1952).
|
|
//
|
|
// Left external, npm is free to place a package beside a *different* React,
|
|
// because it places one beside a version satisfying that package's own peer
|
|
// range — looser than ours in every case here. `ink-form` and
|
|
// `ink-scroll-view` accept ">=18", so a consumer's React 18 satisfies them
|
|
// while the Inspector's React 19 nests underneath: two React copies, and the
|
|
// first hook they call reads a null dispatcher ("Cannot read properties of
|
|
// null (reading 'useState')") the moment a tool test form or a scroll view
|
|
// mounts. That is the reported crash, and inlining them is its fix.
|
|
//
|
|
// `__tests__/tsupConfig.test.ts` guards this list.
|
|
noExternal: [/^@inspector\/core/, "ink-form", "ink-scroll-view"],
|
|
external: [
|
|
// `react` is deliberately external — the single instance every inlined
|
|
// package above resolves to, from this build directory.
|
|
"react",
|
|
// `ink` is external by a deliberate trade-off, NOT because a ">=19" peer
|
|
// makes it safe — it does not, and that claim was wrong here once already.
|
|
// Bundling it works (verified) but costs ~1.4MB, since react-reconciler and
|
|
// yoga-layout come with it, plus a `createRequire` banner for the inlined
|
|
// CJS. The smaller tarball won.
|
|
//
|
|
// What makes that tolerable is the root manifest's `react: ^19.0.0`: being
|
|
// open to the whole major lets npm satisfy our React and a consumer's
|
|
// pinned one with a single copy, so an external `ink` resolves *ours*. Narrow
|
|
// that range and this exemption turns back into the #1952 crash, one level
|
|
// up — `__tests__/tsupConfig.test.ts` guards it.
|
|
"ink",
|
|
"open",
|
|
"commander",
|
|
"pino",
|
|
"@modelcontextprotocol/client",
|
|
"@modelcontextprotocol/core",
|
|
"@napi-rs/keyring",
|
|
// Root-declared (see the repo's dependency-placement rule) and CJS, which
|
|
// is the combination that bites: tsup externalizes what the *client's*
|
|
// package.json declares, so a root-only dependency is bundled unless named
|
|
// here — and inlining a CJS module into an ESM bundle leaves esbuild's
|
|
// `Dynamic require of "path" is not supported` shim, which throws at
|
|
// import time and takes the whole binary down before it parses a flag.
|
|
"proper-lockfile",
|
|
],
|
|
esbuildPlugins: [inkFormLabelPatch],
|
|
esbuildOptions(options) {
|
|
options.alias = {
|
|
"@inspector/core": path.join(repoRoot, "core"),
|
|
};
|
|
options.jsx = "automatic";
|
|
},
|
|
});
|