PaperClipAI/packages/adapters/codex-local/src/server/codex-auth-seed-write.ts

import { open, rename, rm } from "node:fs/promises";
import path from "node:path";
import { randomUUID } from "node:crypto";
import { withDirectoryMergeLock } from "@paperclipai/adapter-utils/workspace-restore-merge";
import { USE_SOURCE_EXIT, decideCodexAuthMerge } from "./codex-auth-merge-decision.js";

// The one atomic credential writer. It stages the source bytes into a private
// (0600) temp next to the destination, runs the shared decision predicate, and
// on a use-source decision renames the temp over the destination. The rename is
// an atomic same-directory swap that preserves mode 0600. The whole write runs
// under the directory merge lock, so a concurrent restore, copy-back, or
// promotion can never interleave. The per-identity cache slot and the
// device-login company home both use this writer, so the staged-rename and lock
// logic lives in one place. It never logs token bytes; the caller passes the
// fixed status lines.

export type WriteCredentialSeedOrNewerOutcome = "written" | "kept";

export interface WriteCredentialSeedOrNewerInput {
  /** The source credential bytes to (maybe) install. */
  sourceBytes: Buffer;
  /** The absolute destination path to (maybe) overwrite. */
  destinationPath: string;
  /** Fill an absent destination from a usable subscription source. */
  seedIfDestAbsent: boolean;
  /** A non-leaking progress sink. It receives only the two fixed status lines. */
  log: (line: string) => void | Promise<void>;
  /** The fixed status line for a use-source write. It carries no secret data. */
  writtenLine: string;
  /** The fixed status line for a keep-destination decision. */
  keptLine: string;
  /** A safe, non-secret prefix for the staged temp file name. */
  tempPrefix: string;
  /** The caller name that prefixes a predicate error. */
  errorLabel: string;
}

/**
 * Writes `sourceBytes` over `destinationPath` when the shared predicate returns a
 * use-source decision, else keeps the destination. Seeds an absent destination
 * only when `seedIfDestAbsent` is set and the source is a usable subscription
 * credential. The staged temp is always removed, so a failure never leaves a
 * partial file.
 */
export async function writeCredentialSeedOrNewer(
  input: WriteCredentialSeedOrNewerInput,
): Promise<WriteCredentialSeedOrNewerOutcome> {
  const destinationDir = path.dirname(input.destinationPath);
  return withDirectoryMergeLock(destinationDir, async () => {
    const stagedTempPath = path.join(
      destinationDir,
      `.${input.tempPrefix}-${process.pid}-${randomUUID()}.tmp`,
    );
    // `wx` + explicit mode create the temp private (0600) and fail if it already
    // exists, so the writer never writes through a pre-existing symlink.
    const handle = await open(stagedTempPath, "wx", 0o600);
    try {
      await handle.writeFile(input.sourceBytes);
      await handle.close();
      const decision = await decideCodexAuthMerge(stagedTempPath, input.destinationPath, {
        seedIfDestAbsent: input.seedIfDestAbsent,
        errorLabel: input.errorLabel,
      });
      if (decision === USE_SOURCE_EXIT) {
        await rename(stagedTempPath, input.destinationPath);
        await input.log(input.writtenLine);
        return "written";
      }
      await input.log(input.keptLine);
      return "kept";
    } finally {
      await handle.close().catch(() => undefined);
      await rm(stagedTempPath, { force: true }).catch(() => undefined);
    }
  });
}