@bivy/bivy 0.11.0 → 0.11.1-staging.395

package/dist/agents/claude-code/runtime.js

@@ -972,12 +972,16 @@ class ClaudeSession {
      * node lost the race for — the same cross-consumer race codex-auth.ts notes).
      * Emits a "Refreshing credentials…" notice only when it actually restarts.
      */
-    async restartWithFreshCredential() {
+    async restartWithFreshCredential(rejectedToken) {
         if (this.reloading)
             return false;
         this.reloading = true;
         try {
-            const credEnv = await this.resolveCredentialEnv().catch(() => ({}));
+            // On a provider 401, identify the bearer that failed so the resolver can
+            // refresh it immediately even if its expiry claims it is still valid.
+            // The resolver compares this under the vault lock, making concurrent
+            // failures converge on one rotation.
+            const credEnv = await this.resolveCredentialEnv(rejectedToken).catch(() => ({}));
             const nextToken = authTokenFromEnv(credEnv);
             if (!nextToken || nextToken === this.spawnedToken)
                 return false;
@@ -1018,14 +1022,14 @@ class ClaudeSession {
      * empty object when no vault is wired or no credential is configured, so the
      * SDK falls back to its own auth (ambient env / `claude` CLI login).
      */
-    async resolveCredentialEnv() {
+    async resolveCredentialEnv(rejectedToken) {
         const store = this.runtimeOptions.credentials;
         if (!store)
             return {};
         const provider = this.runtimeOptions.credentialProvider?.trim() || "anthropic";
         let cred;
         try {
-            cred = await store.getCredential(provider, { workspace: this.cwd });
+            cred = await store.getCredential(provider, { workspace: this.cwd, ...(rejectedToken ? { rejectedToken } : {}) });
         }
         catch {
             return {};
@@ -1042,27 +1046,13 @@ class ClaudeSession {
     async consume(q) {
         try {
             for await (const message of q)
-                this.handle(message);
+                await this.handle(message);
         }
         catch (error) {
             this.streaming = false;
             const raw = error instanceof Error ? error.message : String(error);
-            // Mid-flight credential reload: a long-lived query bakes its OAuth token in
-            // at spawn, so a turn that outlives the token fails here with a 401 even
-            // though the vault holds a freshly-refreshed one. Re-spawn once with the
-            // fresh credential and re-drive the interrupted prompt so the turn continues
-            // instead of dying. Bounded to one attempt per turn (reloadedThisTurn), only
-            // when a prompt is actually in flight, and only when the vault produced a
-            // *different* token (else restartWithFreshCredential returns false and we
-            // fall through to surfacing the error — no retry loop on a dead credential).
-            if (isAnthropicAuthError(raw) && !this.reloadedThisTurn && this.inFlightPrompt !== undefined) {
-                this.reloadedThisTurn = true;
-                if (await this.restartWithFreshCredential()) {
-                    this.streaming = true;
-                    this.input.push({ type: "user", message: { role: "user", content: this.inFlightPrompt }, parent_tool_use_id: null });
-                    return; // the re-spawned query's consume() now drives the turn to completion.
-                }
-            }
+            if (await this.recoverFromAuthError(raw))
+                return;
             // Emit session.error (the toast path) — agent_end's `error` field is not
             // surfaced by the client, so without this a thrown SDK error (e.g. a 401)
             // stopped the turn silently. Auth failures get sign-in guidance appended.
@@ -1071,6 +1061,20 @@ class ClaudeSession {
             this.emit({ type: "agent_end", error: raw });
         }
     }
+    /** Recover a provider 401 regardless of whether the SDK throws it, emits it as
+     * assistant text, or puts it in an error result. The latter is how revoked
+     * OAuth tokens commonly arrive, so only handling consume()'s catch would leave
+     * the turn stopped until the user sent another message. */
+    async recoverFromAuthError(raw) {
+        if (!isAnthropicAuthError(raw) || this.reloadedThisTurn || this.inFlightPrompt === undefined)
+            return false;
+        this.reloadedThisTurn = true;
+        if (!(await this.restartWithFreshCredential(this.spawnedToken)))
+            return false;
+        this.streaming = true;
+        this.input.push({ type: "user", message: { role: "user", content: this.inFlightPrompt }, parent_tool_use_id: null });
+        return true;
+    }
     beginMessage() {
         if (this.startedMessage)
             return;
@@ -1102,7 +1106,7 @@ class ClaudeSession {
             this.emit({ type: "tool_image", toolUseId, toolName, mimeType: image.mimeType, data: image.data });
         }
     }
-    handle(message) {
+    async handle(message) {
         switch (message?.type) {
             case "stream_event": {
                 const event = message.event;
@@ -1129,6 +1133,12 @@ class ClaudeSession {
                 // not the human — never persist or surface them as chat.
                 if (hasMetaFlag(message))
                     break;
+                // Claude Code sometimes reports auth failures as an ordinary assistant
+                // text message rather than throwing. Intercept it before it is persisted
+                // or shown, refresh, and transparently continue the same prompt.
+                const assistantText = extractText(message.message);
+                if (assistantText && await this.recoverFromAuthError(assistantText))
+                    break;
                 const model = message.message?.model;
                 if (model)
                     this.currentModel = toModelInfo({ id: model });
@@ -1233,6 +1243,9 @@ class ClaudeSession {
                 break;
             }
             case "result": {
+                const resultError = message.subtype && message.subtype !== "success" ? String(message.result ?? message.subtype) : "";
+                if (resultError && await this.recoverFromAuthError(resultError))
+                    break;
                 this.streaming = false;
                 this.startedMessage = false;
                 this.currentText = "";

package/dist/credentials/resolver.js

@@ -95,10 +95,12 @@ export class NodeCredentialResolver {
         // under the store lock).
         let token = typeof cred.access === "string" ? cred.access : "";
         const expires = Number(cred.expires) || 0;
-        if (!token || expires <= Date.now() + OAUTH_REFRESH_SKEW_MS) {
+        if (!token || expires <= Date.now() + OAUTH_REFRESH_SKEW_MS || context?.rejectedToken === token) {
             // Refresh the SELECTED record (its label), not just the provider default —
-            // so a second account on the same provider is left untouched.
-            const refreshed = await this.oauth.refresh(id, selection.record.label).catch(() => undefined);
+            // so a second account on the same provider is left untouched. A provider
+            // 401 forces refresh even before expiry; the rejected-token guard is
+            // re-checked under the OAuth store lock to avoid duplicate rotations.
+            const refreshed = await this.oauth.refresh(id, selection.record.label, context?.rejectedToken).catch(() => undefined);
             if (refreshed)
                 token = refreshed;
         }

package/dist/runtime/credentials.js

@@ -15,7 +15,7 @@ import { createCredentialStore as createResolver, NodeCredentialResolver, buildA
 import { testCredential } from "../credentials/api.js";
 export { NodeCredentialResolver, buildAgentCredentialEnv, apiKeyEnvVar };
 function oauthAdapter(credsDir) {
-    return { refresh: (provider, label) => refreshModelOAuth(credsDir, provider, label) };
+    return { refresh: (provider, label, rejectedAccess) => refreshModelOAuth(credsDir, provider, label, rejectedAccess) };
 }
 /** Build the shared credential resolver, binding the node reference/OAuth adapters. */
 export function createCredentialStore(credsDir) {

package/dist/runtime/oauth/model-oauth.js

@@ -338,7 +338,7 @@ async function refreshTokens(provider, current) {
  * token — the single-flight guarantee. Returns undefined if the provider has no
  * stored OAuth credential or isn't natively supported.
  */
-export async function refreshModelOAuthState(credsDir, providerId, label = DEFAULT_LABEL) {
+export async function refreshModelOAuthState(credsDir, providerId, label = DEFAULT_LABEL, rejectedAccess) {
     const provider = getModelOAuthProvider(providerId);
     if (!provider)
         return { state: "reconnect_required", error: "Provider does not support OAuth refresh" };
@@ -349,9 +349,14 @@ export async function refreshModelOAuthState(credsDir, providerId, label = DEFAU
             if (!current || current.type !== "oauth")
                 return current;
             found = true;
-            if (Number(current.expires) > Date.now())
+            const expired = Number(current.expires) <= Date.now();
+            // Normal reads refresh on expiry. A 401 may revoke an otherwise unexpired
+            // access token, so refresh that exact rejected token too. If another
+            // process already replaced it while we waited for the lock, keep the
+            // replacement instead of rotating its refresh token again.
+            if (!expired && (!rejectedAccess || current.access !== rejectedAccess))
                 return current;
-            wasExpired = true;
+            wasExpired = expired;
             const fresh = await refreshTokens(provider, current);
             return { type: "oauth", access: fresh.access, refresh: fresh.refresh, expires: fresh.expires, refreshedAt: fresh.refreshedAt, ...(fresh.accountId ? { accountId: fresh.accountId } : {}) };
         });
@@ -364,8 +369,8 @@ export async function refreshModelOAuthState(credsDir, providerId, label = DEFAU
         return { state: reconnect ? "reconnect_required" : "transient_failure", error: error instanceof Error ? error.message : String(error) };
     }
 }
-export async function refreshModelOAuth(credsDir, providerId, label = DEFAULT_LABEL) {
-    const result = await refreshModelOAuthState(credsDir, providerId, label);
+export async function refreshModelOAuth(credsDir, providerId, label = DEFAULT_LABEL, rejectedAccess) {
+    const result = await refreshModelOAuthState(credsDir, providerId, label, rejectedAccess);
     if (result.state === "transient_failure")
         throw new Error(result.error ?? "OAuth refresh temporarily failed");
     if (result.state === "reconnect_required" && result.error !== "No OAuth credential is stored")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.11.0",
+  "version": "0.11.1-staging.395",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",