@anyslate/cli 0.4.0 → 0.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anyslate/cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "AnySlate CLI - lifecycle hooks, git/CI capture, and manual checkpoints for AI memory. Validates its connection at login, diagnoses itself with `anyslate doctor`, backs off and circuit-breaks rather than retrying, and fails open without failing silent.",
   "type": "module",
   "bin": {

package/src/auth.mjs

@@ -113,15 +113,59 @@ export function hasOauthCredentials(oauth) {
  * @returns {Promise<{ok: true, tokenEndpoint: string, resource: string}
  *   | {ok: false, code: string, message: string}>}
  */
-async function refreshEndpoints({ oauth, root, fetchImpl }) {
+async function refreshEndpoints({ oauth, root, fetchImpl, timeoutMs }) {
   if (oauth?.root === root && oauth?.token_endpoint && oauth?.resource) {
     return { ok: true, tokenEndpoint: oauth.token_endpoint, resource: oauth.resource };
   }
-  const found = await discover({ root, fetchImpl });
+  const found = await discover({ root, fetchImpl, timeoutMs });
   if (!found.ok) return found;
   return { ok: true, tokenEndpoint: found.tokenEndpoint, resource: found.resource };
 }
 
+/**
+ * Prefer a peer's already-persisted OAuth session over minting a new one.
+ *
+ * Refresh tokens are single-use server-side. Concurrent hooks (each a fresh
+ * process) that both redeem the same refresh token leave the loser with
+ * `invalid_grant` even though a usable access token is already on disk —
+ * and historically that loser opened the circuit breaker and told the user
+ * to re-login. Reading disk again closes that hole.
+ *
+ * @param {{env: NodeJS.ProcessEnv, staleToken?: string|null, now?: number,
+ *          startingRefresh?: string|null}} opts
+ * @returns {{ok: true, token: string, rotated: false, oauth: object}|null}
+ */
+export function readPeerRefreshedCredentials({ env, staleToken = null, now = Date.now(), startingRefresh = null }) {
+  const disk = readConfigFile(env);
+  const oauth = disk.oauth && typeof disk.oauth === 'object' ? disk.oauth : null;
+  if (!oauth?.access_token) return null;
+
+  // A peer rotated when the refresh token on disk changed, or when the access
+  // token differs from the one we are replacing.
+  const refreshMoved =
+    startingRefresh && oauth.refresh_token && oauth.refresh_token !== startingRefresh;
+  const accessMoved = staleToken ? oauth.access_token !== staleToken : false;
+  if (!refreshMoved && !accessMoved && staleToken) return null;
+
+  // Accept any not-hard-expired peer token. Requiring the full 5-minute skew
+  // would reject a peer refresh that landed seconds ago for no good reason.
+  if (isExpired(oauth, now)) return null;
+  if (staleToken && oauth.access_token === staleToken && !refreshMoved) return null;
+
+  return { ok: true, token: oauth.access_token, rotated: false, oauth };
+}
+
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** Default lock wait when the caller does not override (interactive commands). */
+const LOCK_WAIT_DEFAULT = 10_000;
+
+/** Milliseconds left before an absolute deadline, or null when unbounded. */
+export function remainingMs(deadline, now = Date.now()) {
+  if (deadline == null || !Number.isFinite(deadline)) return null;
+  return Math.max(0, deadline - now);
+}
+
 /**
  * Perform one refresh, under the lock, persisting the rotated token.
  *
@@ -133,18 +177,41 @@ async function refreshEndpoints({ oauth, root, fetchImpl }) {
  * very token that just 401'd, and the retry fails identically.
  *
  * `lockWaitMs` exists for the hook path. The default 10s wait is fine for a
- * user-initiated command but is 10s of a lifecycle hook standing in front of
- * the user's editor, and a machine whose refreshes are all failing is exactly
- * the machine where every hook queues behind the last one.
+ * user-initiated command but is too long for a lifecycle hook standing in
+ * front of the user's editor.
+ *
+ * When the lock is NOT held (wait timed out), we poll disk for a peer refresh
+ * instead of racing the single-use refresh token. Only if nothing usable
+ * appears do we attempt the network refresh — and on `invalid_grant` we
+ * re-check disk one last time before declaring the session dead.
+ *
+ * `deadline` (epoch ms) caps lock wait, unlocked peer-poll, discovery, and the
+ * refresh HTTP call so a hook's advertised budget cannot be exceeded before
+ * the MCP call even starts. When omitted, behaviour matches the unbounded
+ * interactive path (15s per HTTP call).
  *
  * @param {{env: NodeJS.ProcessEnv, root: string, fetchImpl?: typeof fetch, now?: number,
- *          staleToken?: string|null, lockWaitMs?: number}} opts
+ *          staleToken?: string|null, lockWaitMs?: number, deadline?: number|null}} opts
  * @returns {Promise<{ok: true, token: string, rotated: boolean, oauth: object}
  *   | {ok: false, code: string, message: string}>}
  */
-export async function refreshCredentials({ env, root, fetchImpl = fetch, now, staleToken = null, lockWaitMs }) {
+export async function refreshCredentials({
+  env,
+  root,
+  fetchImpl = fetch,
+  now,
+  staleToken = null,
+  lockWaitMs,
+  deadline = null,
+}) {
+  const lockCap = remainingMs(deadline);
+  const effectiveLockWait =
+    lockCap == null
+      ? lockWaitMs
+      : Math.min(typeof lockWaitMs === 'number' ? lockWaitMs : LOCK_WAIT_DEFAULT, lockCap);
+
   return withRefreshLock(
-    async () => {
+    async ({ held }) => {
       // Re-read INSIDE the lock. While we queued, a sibling hook may have done
       // the whole refresh already — redeeming our (now-replaced) refresh token
       // would fail and, worse, would overwrite theirs.
@@ -169,18 +236,107 @@ export async function refreshCredentials({ env, root, fetchImpl = fetch, now, st
         };
       }
 
-      const endpoints = await refreshEndpoints({ oauth, root, fetchImpl });
+      const startingRefresh = oauth.refresh_token;
+
+      // Unlocked callers must not stampede the token endpoint. Poll briefly
+      // for a peer that held the lock; if one lands, we are done. Poll time is
+      // taken from the SHARED deadline (not an extra lockWait on top).
+      if (!held) {
+        const rem = remainingMs(deadline);
+        const pollMs =
+          rem == null
+            ? Math.min(typeof lockWaitMs === 'number' ? lockWaitMs : 2_000, 1_500)
+            : Math.min(rem, 500);
+        const pollDeadline = Date.now() + pollMs;
+        while (Date.now() < pollDeadline) {
+          await sleepMs(50);
+          const peer = readPeerRefreshedCredentials({
+            env,
+            staleToken: staleToken ?? oauth.access_token,
+            now,
+            startingRefresh,
+          });
+          if (peer) return peer;
+        }
+      }
+
+      // Re-read after the poll — a peer may have finished in the last tick.
+      const latest = readConfigFile(env);
+      const latestOauth = latest.oauth && typeof latest.oauth === 'object' ? latest.oauth : oauth;
+      if (
+        latestOauth?.access_token &&
+        latestOauth.access_token !== (staleToken ?? oauth.access_token) &&
+        !isExpiring(latestOauth, REFRESH_SKEW_MS, now)
+      ) {
+        return { ok: true, token: latestOauth.access_token, rotated: false, oauth: latestOauth };
+      }
+      if (!latestOauth?.refresh_token) {
+        return {
+          ok: false,
+          code: 'no_refresh_token',
+          message: `anyslate: the stored OAuth session has no refresh token and its access token has expired. ${RELOGIN_HINT}`,
+        };
+      }
+
+      const httpTimeout = remainingMs(deadline) ?? 15_000;
+      if (httpTimeout <= 0) {
+        const peer = readPeerRefreshedCredentials({
+          env,
+          staleToken: staleToken ?? oauth.access_token,
+          now,
+          startingRefresh,
+        });
+        if (peer) return peer;
+        return {
+          ok: false,
+          code: 'refresh_timeout',
+          message: `anyslate: timed out before the OAuth refresh could run. ${RELOGIN_HINT}`,
+        };
+      }
+
+      const endpoints = await refreshEndpoints({
+        oauth: latestOauth,
+        root,
+        fetchImpl,
+        timeoutMs: httpTimeout,
+      });
       if (!endpoints.ok) return endpoints;
 
+      const refreshTimeout = remainingMs(deadline) ?? httpTimeout;
+      if (refreshTimeout <= 0) {
+        const peer = readPeerRefreshedCredentials({
+          env,
+          staleToken: staleToken ?? oauth.access_token,
+          now,
+          startingRefresh,
+        });
+        if (peer) return peer;
+        return {
+          ok: false,
+          code: 'refresh_timeout',
+          message: `anyslate: timed out before the OAuth refresh could run. ${RELOGIN_HINT}`,
+        };
+      }
+
       const res = await refreshAccessToken({
         tokenEndpoint: endpoints.tokenEndpoint,
-        refreshToken: oauth.refresh_token,
-        clientId: oauth.client_id,
+        refreshToken: latestOauth.refresh_token,
+        clientId: latestOauth.client_id,
         resource: endpoints.resource,
         fetchImpl,
         now,
+        timeoutMs: refreshTimeout,
       });
       if (!res.ok) {
+        // Loser of a refresh race: peer already rotated and persisted. Prefer
+        // their tokens over "run anyslate login" + circuit-breaker pause.
+        const peer = readPeerRefreshedCredentials({
+          env,
+          staleToken: staleToken ?? oauth.access_token,
+          now,
+          startingRefresh,
+        });
+        if (peer) return peer;
         return {
           ok: false,
           code: res.code || 'refresh_failed',
@@ -192,10 +348,10 @@ export async function refreshCredentials({ env, root, fetchImpl = fetch, now, st
       // the instant the server answered; a crash between here and the next
       // write would lose the only usable credential.
       const next = {
-        ...oauth,
+        ...latestOauth,
         access_token: res.tokens.access_token,
         // A response that omits refresh_token means "keep the one you have".
-        refresh_token: res.tokens.refresh_token || oauth.refresh_token,
+        refresh_token: res.tokens.refresh_token || latestOauth.refresh_token,
         expires_at: res.tokens.expires_at,
         token_endpoint: endpoints.tokenEndpoint,
         resource: endpoints.resource,
@@ -212,7 +368,7 @@ export async function refreshCredentials({ env, root, fetchImpl = fetch, now, st
       }
       return { ok: true, token: next.access_token, rotated: true, oauth: next };
     },
-    { env, waitMs: lockWaitMs },
+    { env, waitMs: effectiveLockWait },
   );
 }
 
@@ -227,11 +383,11 @@ export async function refreshCredentials({ env, root, fetchImpl = fetch, now, st
  * with `warning` set, so the caller can say so.
  *
  * @param {{cfg: object, env: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, force?: boolean,
- *          now?: number, lockWaitMs?: number}} opts
+ *          now?: number, lockWaitMs?: number, deadline?: number|null}} opts
  * @returns {Promise<{ok: true, token: string, mode: 'env'|'oauth'|'static', refreshed: boolean, warning?: string}
  *   | {ok: false, code: string, message: string, mode: string}>}
  */
-export async function resolveBearer({ cfg, env, fetchImpl = fetch, force = false, now, lockWaitMs }) {
+export async function resolveBearer({ cfg, env, fetchImpl = fetch, force = false, now, lockWaitMs, deadline = null }) {
   if (cfg?.sources?.mcpToken === 'env' && cfg.mcpToken) {
     return { ok: true, token: cfg.mcpToken, mode: 'env', refreshed: false };
   }
@@ -250,6 +406,7 @@ export async function resolveBearer({ cfg, env, fetchImpl = fetch, force = false
       now,
       staleToken: force ? (oauth.access_token ?? null) : null,
       lockWaitMs,
+      deadline,
     });
     if (refreshed.ok) {
       return { ok: true, token: refreshed.token, mode: 'oauth', refreshed: refreshed.rotated };
@@ -303,6 +460,11 @@ export async function resolveBearer({ cfg, env, fetchImpl = fetch, force = false
 export async function callToolWithAuth({ cfg, env, toolName, args, fetchImpl, timeoutMs, retry, lockWaitMs }) {
   const policy = { ...DEFAULT_RETRY, ...(retry ?? {}) };
 
+  // When the caller names a timeout (hooks: 5s), treat it as a WALL budget for
+  // refresh + MCP call combined — not "15s refresh then 5s call". Interactive
+  // commands leave timeoutMs undefined and keep the unbounded refresh path.
+  const deadline = typeof timeoutMs === 'number' && timeoutMs > 0 ? Date.now() + timeoutMs : null;
+
   // Cheapest possible check first: an open breaker resolves no credential,
   // opens no socket, and mints no token. That is the entire point — the
   // incident cost ~50 requests a minute for days precisely because a client
@@ -325,7 +487,7 @@ export async function callToolWithAuth({ cfg, env, toolName, args, fetchImpl, ti
     return { ok: false, status: 0, data: ceilingNotice(slot), raw: null, rateCapped: true, rateSlot: slot };
   }
 
-  const first = await resolveBearer({ cfg, env, fetchImpl, lockWaitMs });
+  const first = await resolveBearer({ cfg, env, fetchImpl, lockWaitMs, deadline });
   if (!first.ok) {
     const breaker = recordCallFailure({ cfg, env, kind: 'auth', code: first.code, detail: first.code });
     return {
@@ -353,7 +515,27 @@ export async function callToolWithAuth({ cfg, env, toolName, args, fetchImpl, ti
 
   while (attempt < hardCap) {
     attempt += 1;
-    res = await callTool({ apiUrl: cfg.apiUrl, token, toolName, args, fetchImpl, timeoutMs });
+    const callTimeout = remainingMs(deadline) ?? timeoutMs;
+    if (deadline != null && (callTimeout == null || callTimeout <= 0)) {
+      res = {
+        ok: false,
+        status: 0,
+        data: `anyslate: timed out after ${timeoutMs}ms (spent on credential refresh).`,
+        raw: null,
+        networkError: true,
+        authMode: mode,
+      };
+      if (warning) res.authWarning = warning;
+      break;
+    }
+    res = await callTool({
+      apiUrl: cfg.apiUrl,
+      token,
+      toolName,
+      args,
+      fetchImpl,
+      timeoutMs: callTimeout,
+    });
     res.authMode = mode;
     if (warning) res.authWarning = warning;
     if (retried) res.authRetried = true;
@@ -368,7 +550,7 @@ export async function callToolWithAuth({ cfg, env, toolName, args, fetchImpl, ti
     // per hook instead of one.
     if (kind === 'auth' && mode === 'oauth' && !refreshSpent) {
       refreshSpent = true;
-      const second = await resolveBearer({ cfg, env, fetchImpl, force: true, lockWaitMs });
+      const second = await resolveBearer({ cfg, env, fetchImpl, force: true, lockWaitMs, deadline });
       if (!second.ok) {
         res.authError = true;
         res.authRefreshFailed = second.message;

package/src/commands/hook.mjs

@@ -39,19 +39,21 @@ import { makeIo } from '../io.mjs';
 const ALLOWED = new Set(['session-start', 'post-tool-use', 'stop']);
 
 /**
- * Total budget for the two requests a submission costs (initialize +
- * tools/call). Deliberately far below the 15s every other command gets: a hook
- * runs in front of a human, and a slow server must not become a slow editor.
- * `ANYSLATE_HOOK_TIMEOUT_MS` raises it for pathologically slow links.
+ * Total budget for credential refresh + the two requests a submission costs
+ * (initialize + tools/call). Deliberately far below the 15s every other
+ * command gets: a hook runs in front of a human, and a slow server must not
+ * become a slow editor. `ANYSLATE_HOOK_TIMEOUT_MS` raises it for pathologically
+ * slow links. Auth (lock wait / peer poll / refresh HTTP) shares this budget
+ * with the MCP call — it is not stacked on top.
  */
 export const HOOK_TIMEOUT_MS = 5_000;
 
 /**
- * How long a hook will queue behind another process's token refresh. The shared
- * default is 10s, which on a machine where every refresh is failing means every
- * hook waits the full ten seconds to learn nothing.
+ * How long a hook will queue behind another process's token refresh. Kept well
+ * below HOOK_TIMEOUT_MS so an unlocked loser still has time for a short peer
+ * poll + refresh HTTP + the activity_submit call inside the same wall budget.
  */
-export const HOOK_LOCK_WAIT_MS = 2_000;
+export const HOOK_LOCK_WAIT_MS = 1_500;
 
 /** @param {NodeJS.ProcessEnv} env */
 function hookTimeoutMs(env) {