| 32 | }; |
| 33 | |
| 34 | const currentToken = (): string => { |
| 35 | let st: ReturnType<typeof statSync>; |
| 36 | try { |
| 37 | st = statSync(tokenPath); |
| 38 | } catch { |
| 39 | // File temporarily unavailable — keep serving the last known token. |
| 40 | return cache.token; |
| 41 | } |
| 42 | // Detect a rewrite by mtime OR inode. `writePrivateFile` does an atomic |
| 43 | // rename, which always yields a new inode (POSIX) and a fresh mtime |
| 44 | // (Windows/NTFS, where `ino` is always 0). Checking both makes the reload |
| 45 | // robust even on filesystems with coarse (1s) mtime resolution. |
| 46 | if (st.mtimeMs === cache.mtimeMs && st.ino === cache.ino) { |
| 47 | return cache.token; |
| 48 | } |
| 49 | // Changed: re-read, but refuse a too-permissive file and never let an |
| 50 | // empty/partial read clobber the last good token. |
| 51 | // Skip the check on Windows: fs.stat mode is synthesised from the |
| 52 | // read-only attribute and does not reflect real ACLs, so it would always |
| 53 | // appear too permissive and prevent legitimate token reloads. |
| 54 | if (process.platform !== 'win32' && (st.mode & 0o077) !== 0) { |
| 55 | return cache.token; |
| 56 | } |
| 57 | try { |
| 58 | const token = readFileSync(tokenPath, 'utf8').trim(); |
| 59 | if (token.length > 0) { |
| 60 | cache = { token, mtimeMs: st.mtimeMs, ino: st.ino }; |
| 61 | } |
| 62 | } catch { |
| 63 | // keep last known token |
| 64 | } |
| 65 | return cache.token; |
| 66 | }; |
| 67 | |
| 68 | return { |
| 69 | tokenPath, |