@agentage/cli 0.27.0 → 0.28.0

package/dist/commands/auth/setup.js

@@ -50,7 +50,7 @@ const disconnect = async (deps) => {
         return;
     }
     await deps.revoke(links(auth.siteFqdn).auth, auth.tokens.accessToken);
-    deleteAuth();
+    await deleteAuth();
     console.log('Disconnected - local credentials removed.');
 };
 // Validate the stored session instead of trusting mere token presence. Returns true to short-circuit

package/dist/lib/auth/api.js

@@ -29,11 +29,13 @@ export const refreshOrThrow = async (auth, links) => {
     };
     auth.tokens = tokens; // the caller retries its request with this in-memory copy
     // Persist under the lock, folding the new tokens onto the freshly-read state so a concurrent
-    // writer's other fields (clientId, siteFqdn) are not clobbered by a stale in-memory copy.
+    // writer's other fields (clientId, siteFqdn) are not clobbered by a stale in-memory copy. A null
+    // re-read means a sign-out won the race: skip the write rather than resurrect it (issue #236).
     await mutateAuth((current) => {
-        const base = current ?? auth;
-        base.tokens = tokens;
-        return base;
+        if (!current)
+            return null;
+        current.tokens = tokens;
+        return current;
     });
 };
 // Boolean shim for the request paths that just want "refresh once, then retry": any failure

package/dist/lib/fs/config.d.ts

@@ -17,5 +17,5 @@ export declare const getConfigDir: () => string;
 export declare const ensureConfigDir: () => string;
 export declare const readAuth: () => AuthState | null;
 export declare const saveAuth: (state: AuthState) => void;
-export declare const deleteAuth: () => void;
+export declare const deleteAuth: () => Promise<void>;
 export declare const mutateAuth: (fn: (current: AuthState | null) => AuthState | null | void) => Promise<AuthState | null>;

package/dist/lib/fs/config.js

@@ -33,10 +33,15 @@ export const saveAuth = (state) => {
     chmodSync(tmp, 0o600);
     renameSync(tmp, path);
 };
-export const deleteAuth = () => {
+// Sign-out under the same lock mutateAuth takes (issue #236), so a concurrent token refresh can
+// never slip its re-read+save between this existence check and the unlink.
+export const deleteAuth = async () => {
+    ensureConfigDir();
     const path = authPath();
-    if (existsSync(path))
-        unlinkSync(path);
+    await withFileLock(path, () => {
+        if (existsSync(path))
+            unlinkSync(path);
+    });
 };
 // Cross-process-safe read-modify-write on auth.json (issue #231). Under the advisory lock, re-read
 // FRESH from disk, apply `fn`, then atomic-save - so a foreground sign-in and a background token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentage/cli",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "The agentage CLI - connect this machine to agentage from the terminal",
   "type": "module",
   "main": "./dist/index.js",
@@ -41,14 +41,14 @@
   },
   "dependencies": {
     "@agentage/memory-core": "^0.5.0",
-    "@agentage/server-memory": "^0.3.0",
+    "@agentage/server-memory": "^0.4.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "chalk": "^6.0.0",
     "commander": "^15.0.0",
     "open": "^11.0.0"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "0.116.0",
+    "@anthropic-ai/sdk": "0.117.1",
     "@playwright/test": "latest",
     "@types/node": "latest",
     "@typescript-eslint/eslint-plugin": "latest",