pi-mono/packages
robopipi[bot] 081a6e87f6
fix(coding-agent): share the auth.json lock across symlinked paths (#11787)
`FileAuthStorageBackend` locked `auth.json` with proper-lockfile and
`realpath: false`, so the lock directory was `<path as given>.lock`.
Reads and writes follow symlinks to the same real file, but each path
alias got its own lock. For example, an agent dir whose `auth.json` is a
symlink to a shared file used a different lock than the real file. Two
pi processes could then enter the credential-modification section at the
same time and refresh the same OAuth token concurrently.

This change drops `realpath: false` from the sync and async lock calls,
so proper-lockfile resolves the path and every alias of the file uses
one lock. Resolving the path needs the file to exist, which is already
the case: `ensureFileExists()` runs before either lock is taken.

The same `realpath: false` pattern is also in `settings-manager.ts`,
`trust-manager.ts`, and `package-manager-cli.ts`. This change leaves
those alone.

## Testing

- I added a test to `test/auth-storage.test.ts`. It holds the lock on
the real `auth.json`, then checks that a backend opened through a
symlink alias waits in `withLockAsync` until aborted, and gets `ELOCKED`
from `withLock`. Neither path runs the mutation. Without the fix the
test fails because the async call enters the lock; with the fix it
passes.
- `node ../../node_modules/vitest/dist/cli.js --run test/auth-storage
test/settings`: 151 tests pass.
- `npm run check` passes.
- With the reproduction script from the issue, current main prints
`symlink alias: ENTERED`; with this change it prints `symlink alias:
BLOCKED`. The same-path control prints `BLOCKED` in both cases.

Fixes #11655

Requested by @badlogic

Co-authored-by: triagent <triagent@localhost>
Co-authored-by: Mario Zechner <contact@badlogicgames.com>
2026-11-04 09:57:47 +01:00
..
agent Anthropic message threads (#11545) 2026-11-03 14:07:57 +01:00
ai fix(ai): add glm-5.3 to qwen-token-plan-individual models (#11785) 2026-11-04 09:54:48 +01:00
chord docs(chord): slice 9 spec, telemetry with spans across hosts 2026-11-04 07:46:53 +00:00
codemode Add [Unreleased] section for next cycle 2026-11-02 11:38:21 +01:00
coding-agent fix(coding-agent): share the auth.json lock across symlinked paths (#11787) 2026-11-04 09:57:47 +01:00
durable feat(chord): Chord v2 is the package's root 2026-11-02 22:36:55 +00:00
env fix(env): kill what a process program left running when it exits 2026-11-03 14:17:21 +01:00
evals Release v1.5.0 2026-11-02 11:38:21 +01:00
mcp fix(mcp): recognize CR-only line endings in Streamable HTTP SSE (#11775) 2026-11-04 09:18:01 +01:00
schema fix(schema): apply a relative root $id only once when resolving references (#11726) 2026-11-03 23:14:11 +01:00
telemetry Add [Unreleased] section for next cycle 2026-11-02 11:38:21 +01:00
tui fix(tui): detect Alacritty for OSC 8 hyperlinks without TERM_PROGRAM (#11777) 2026-11-04 09:26:27 +01:00