@corbat-tech/coco 2.25.6 → 2.25.7

package/dist/cli/index.js

@@ -21110,7 +21110,7 @@ async function authenticateMcpOAuth(params) {
   const resource = canonicalizeResourceUrl(params.resourceUrl);
   const store = await loadStore2();
   const stored = store.tokens[getResourceKey(resource)];
-  if (stored && !isTokenExpired2(stored)) {
+  if (stored && !params.forceRefresh && !isTokenExpired2(stored)) {
     return stored.accessToken;
   }
   if (!process.stdout.isTTY) {
@@ -21135,7 +21135,7 @@ async function authenticateMcpOAuth(params) {
     authorizationMetadata = await discoverAuthorizationServerMetadata(resource);
   }
   authorizationServer = authorizationServer ?? authorizationMetadata.issuer ?? new URL(resource).origin;
-  if (stored && isTokenExpired2(stored) && stored.refreshToken && stored.clientId) {
+  if (stored && stored.refreshToken && stored.clientId && (params.forceRefresh || isTokenExpired2(stored))) {
     try {
       const refreshed = await refreshAccessToken2({
         tokenEndpoint: authorizationMetadata.token_endpoint,
@@ -21280,18 +21280,22 @@ var init_http = __esm({
         }
         return true;
       }
-      async ensureOAuthToken(wwwAuthenticateHeader) {
-        if (this.oauthToken) {
+      async ensureOAuthToken(wwwAuthenticateHeader, options) {
+        if (this.oauthToken && !options?.forceRefresh) {
           return this.oauthToken;
         }
         if (this.oauthInFlight) {
           return this.oauthInFlight;
         }
         const serverName = this.config.name ?? this.config.url;
+        if (options?.forceRefresh) {
+          this.oauthToken = void 0;
+        }
         this.oauthInFlight = authenticateMcpOAuth({
           serverName,
           resourceUrl: this.config.url,
-          wwwAuthenticateHeader
+          wwwAuthenticateHeader,
+          forceRefresh: options?.forceRefresh
         }).then((token) => {
           this.oauthToken = token;
           return token;
@@ -21315,14 +21319,14 @@ var init_http = __esm({
           }
           return response;
         }
-        await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+        await this.ensureOAuthToken(response.headers.get("www-authenticate"), { forceRefresh: true });
         response = await doFetch();
         return response;
       }
       looksLikeAuthErrorMessage(message) {
         if (!message) return false;
         const msg = message.toLowerCase();
-        const hasStrongAuthSignal = msg.includes("unauthorized") || msg.includes("unauthorised") || msg.includes("authentication") || msg.includes("oauth") || msg.includes("access token") || msg.includes("bearer") || msg.includes("not authenticated") || msg.includes("not logged") || msg.includes("login") || msg.includes("generate") && msg.includes("token");
+        const hasStrongAuthSignal = msg.includes("unauthorized") || msg.includes("unauthorised") || msg.includes("authentication") || msg.includes("oauth") || msg.includes("access token") || msg.includes("invalid_token") || msg.includes("invalid token") || msg.includes("token expired") || msg.includes("bearer") || msg.includes("not authenticated") || msg.includes("not logged") || msg.includes("login") || msg.includes("generate") && msg.includes("token");
         const hasVendorHint = msg.includes("gemini cli") || msg.includes("jira") || msg.includes("confluence") || msg.includes("atlassian");
         const hasWeakAuthSignal = msg.includes("authenticate") || msg.includes("token") || msg.includes("authorization");
         return hasStrongAuthSignal || // Vendor-specific hints alone are not enough; require an auth-related token too.
@@ -21396,7 +21400,9 @@ var init_http = __esm({
             }
             const data = await response.json();
             if (this.shouldAttemptOAuth() && this.isJsonRpcAuthError(data)) {
-              await this.ensureOAuthToken(response.headers.get("www-authenticate"));
+              await this.ensureOAuthToken(response.headers.get("www-authenticate"), {
+                forceRefresh: true
+              });
               const retryResponse = await this.sendRequestWithOAuthRetry(
                 "POST",
                 JSON.stringify(message),