Lines 1-30javascript
2 * EngramPort — Cloud Run OIDC token mint.
4 * Ports the five Python fixes from
5 * C:\Users\j_dev\genesis\mcp-servers\personal-engramport\server.py
6 * into TypeScript so the hosted (or local) EngramPort can clear Cloud Run's
7 * auth gate when calling Eidetic V3.
9 * 1. Absolute path resolution for gcloud (probe well-known install paths,
10 * env override via GCLOUD_CMD_PATH, PATH fallback).
11 * 2. Async subprocess via child_process.spawn with Promise + timeout,
12 * SIGTERM then SIGKILL escalation.
13 * 3. Inline Promise mutex serializes concurrent mints, with
14 * double-checked locking against caches.
15 * 4. GCLOUD_ACCOUNT identity pin via --account flag; JWT email decoded
16 * after mint and logged for diagnostic visibility.
17 * 5. stdin: 'ignore' (gcloud cannot block on inherited stdin); cross-process
18 * disk cache at ~/.engramport/oidc_token.json (50min default TTL);
19 * prewarmToken() CLI populates the cache from a working shell.
21 * No --audiences flag — required by SA creds, rejected by user creds. The
22 * plain user token's audience (gcloud OAuth client ID) is accepted by
23 * Cloud Run when the identity has roles/run.invoker.
25import { spawn } from "child_process";
26import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
27import { homedir } from "os";
28import { dirname, join, sep } from "path";
29// ── Config (read once at module load) ─────────────────────────────────────────
30const GCLOUD_ACCOUNT = process.env.GCLOUD_ACCOUNT || "";
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist/auth.jsView on unpkg · L10