@crouton-kit/crouter 0.3.55 → 0.3.57

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.ts

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   createAssistantMessageEventStream,
@@ -65,9 +66,10 @@ type AttemptResult = {
 // (connection reset, socket errors, timeouts, plain 500/502/504, or 503 with NO
 // retry-after) is not evidence the credential itself is bad -- it gets a short in-place
 // retry on the same credential, never a cooldown. Everything else is fatal. Bare
-// `usage`/`quota` substrings were dropped from the message match: they are false-positive
-// magnets (e.g. "usage" appears in normal assistant text) that used to cool down healthy
-// subscriptions for 5 minutes on any transient blip.
+// `usage`/`quota` substrings stay out of the message match: they are false-positive
+// magnets (e.g. "usage" appears in normal assistant text), while the precise
+// terminal usage-limit signals above still cool the credential down and rotate to the
+// next one.
 type ProviderErrorClassification = {
   kind: "rate_limit" | "transient" | "fatal";
   status?: number;
@@ -120,12 +122,17 @@ export function __setSleepForTest(fn: typeof defaultSleep | undefined): void {
   activeSleep = fn ?? defaultSleep;
 }
 
+// Parse `status=400` from pi-ai's plain Error message so genuine invalid_grant reaches
+// cooldown / reauth / fallback; the typed status field is still honored for tests and other
+// callers that provide one.
 function isInvalidRefreshTokenError(error: unknown): boolean {
   const value = error as { status?: unknown; errorMessage?: unknown; message?: unknown } | undefined;
-  const status = typeof value?.status === "number" ? value.status : Number.NaN;
+  const typedStatus = typeof value?.status === "number" ? value.status : undefined;
   const message = [value?.errorMessage, value?.message, error instanceof Error ? error.message : ""]
     .filter((part): part is string => typeof part === "string" && part.length > 0)
     .join(" ");
+  const messageStatusMatch = message.match(/\bstatus[=:]\s*(\d+)/i);
+  const status = typedStatus ?? (messageStatusMatch ? Number(messageStatusMatch[1]) : Number.NaN);
   return status === 400 && /invalid_grant|refresh token .*invalid|refresh token .*not found/i.test(message);
 }
 
@@ -192,8 +199,16 @@ function retryAfterMs(headers: Record<string, string>): number | undefined {
   return parseRetryAfterHeader(headers["retry-after"]);
 }
 
-type RefreshedCredential = Pick<SubscriptionCredential, "refresh" | "access" | "expires">;
-type LoginCredential = Pick<SubscriptionCredential, "refresh" | "access" | "expires">;
+type RefreshedCredential = { refresh: string; access: string; expires: number };
+type LoginCredential = { refresh: string; access: string; expires: number };
+
+// The default slot's live value only ever exists inside auth.json (see
+// `refreshDefaultSlotCredential`) -- once a credential has been through refresh/reauth for
+// this turn, `.access` is guaranteed populated (whether it came from the pool's own stored
+// value for a non-default account, or was just read/refreshed out of auth.json for the
+// default slot). Downstream stream-attempt code relies on `.access` being present rather
+// than re-deriving "is this the default slot" logic at every call site.
+type ResolvedCredential = SubscriptionCredential & { access: string };
 
 async function defaultRefreshForProvider(providerId: ManagedProviderId, refreshToken: string): Promise<RefreshedCredential> {
   return providerId === ANTHROPIC_PROVIDER_ID ? refreshAnthropicToken(refreshToken) : refreshOpenAICodexToken(refreshToken);
@@ -225,16 +240,66 @@ function openBrowser(url: string): void {
   }
 }
 
-async function refreshCredentialIfNeeded(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<SubscriptionCredential> {
-  if (credential.expires > Date.now()) return credential;
+type AuthCredentialRecord = { type?: string; refresh?: string; access?: string; expires?: number; [key: string]: unknown };
+type AuthFileData = Record<string, AuthCredentialRecord>;
+
+// The default slot (`label === providerId`) reads and refreshes its live value from pi's
+// auth.json (design §1/§3). This delegates the whole read -> check-expiry -> refresh ->
+// write transaction to pi's `FileAuthStorageBackend.withLockAsync`, which holds a real
+// cross-process file lock, re-reads `current` under the lock on every acquisition, and
+// releases in a `finally` even if the callback throws. A second caller that reaches the
+// lock after a refresh winner sees the rotated `access`/`expires` and returns that value
+// without calling the network refresh on the stale token. We deliberately do NOT route
+// through pi's public `getApiKey` because it wraps pi-ai's `getOAuthApiKey`, which
+// collapses the refresh failure into a generic message; calling our own
+// `activeRefreshForProvider` inside the callback keeps the real error intact so
+// `isInvalidRefreshTokenError` can classify the failure (cooldown -> reauth ->
+// cross-provider-fallback) exactly as it does for non-default accounts.
+async function refreshDefaultSlotCredential(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+  const backend = new FileAuthStorageBackend();
+  const access = await backend.withLockAsync(async (current) => {
+    const data: AuthFileData = current ? JSON.parse(current) : {};
+    const cred = data[providerId];
+    // Only an OAuth-typed record is the default slot's refreshable credential: an
+    // api_key record (or no record at all) has no refresh token to refresh, so it is never
+    // treated as fresh or refreshable here.
+    if (cred?.type === "oauth" && cred.access && typeof cred.expires === "number" && Date.now() < cred.expires) {
+      return { result: cred.access };
+    }
+    if (cred?.type !== "oauth" || !cred.refresh) {
+      throw new Error(`${getProviderLabel(providerId)} is not authenticated — run \`crtr sys setup\` (or /provider-sub ${providerId} add)`);
+    }
+    const refreshed = await activeRefreshForProvider(providerId, cred.refresh);
+    data[providerId] = { ...cred, type: "oauth", refresh: refreshed.refresh, access: refreshed.access, expires: refreshed.expires };
+    return { result: refreshed.access, next: `${JSON.stringify(data, null, 2)}\n` };
+  });
+  return { ...credential, access };
+}
+
+async function persistDefaultSlotCredential(providerId: ManagedProviderId, credential: RefreshedCredential): Promise<void> {
+  const backend = new FileAuthStorageBackend();
+  await backend.withLockAsync(async (current) => {
+    const data: AuthFileData = current ? JSON.parse(current) : {};
+    data[providerId] = { type: "oauth", ...credential };
+    return { result: undefined, next: `${JSON.stringify(data, null, 2)}\n` };
+  });
+}
+
+async function refreshCredentialIfNeeded(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+  if (credential.label === providerId) return refreshDefaultSlotCredential(providerId, credential);
+  if (!credential.refresh || !credential.access || credential.expires === undefined) {
+    throw new Error(`${getProviderLabel(providerId)} subscription "${credential.label}" is missing its credential value`);
+  }
+  if (credential.expires > Date.now()) return credential as ResolvedCredential;
   const refreshed = await activeRefreshForProvider(providerId, credential.refresh);
-  const next = {
-    ...credential,
-    refresh: refreshed.refresh,
-    access: refreshed.access,
-    expires: refreshed.expires,
-  };
-  return upsertSubscription(providerId, next).find((entry) => entry.label === next.label) ?? next;
+  const next: SubscriptionCredential = { ...credential, refresh: refreshed.refresh, access: refreshed.access, expires: refreshed.expires };
+  return (upsertSubscription(providerId, next).find((entry) => entry.label === next.label) ?? next) as ResolvedCredential;
+}
+
+/** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including the default-slot
+ * `withLockAsync` path) without duplicating its logic. */
+export async function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential> {
+  return refreshCredentialIfNeeded(providerId, credential);
 }
 
 async function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential> {
@@ -248,11 +313,19 @@ export function __setLoginForProviderForTest(fn: typeof defaultLoginForProvider
   activeLoginForProvider = fn ?? defaultLoginForProvider;
 }
 
-async function reauthenticateCredential(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<SubscriptionCredential | undefined> {
+async function reauthenticateCredential(providerId: ManagedProviderId, credential: SubscriptionCredential): Promise<ResolvedCredential | undefined> {
   const ctx = runtimeContext;
   if (!ctx?.hasUI) return undefined;
   ctx.ui.notify(`${getProviderLabel(providerId)} subscription "${credential.label}" needs re-authentication. Opening OAuth login...`, "warn");
   const authenticated = await activeLoginForProvider(providerId, ctx);
+  if (credential.label === providerId) {
+    // Same single owner as the refresh path: persist the reauthenticated value to
+    // auth.json through the same locked FileAuthStorageBackend seam the refresh path uses.
+    await persistDefaultSlotCredential(providerId, authenticated);
+    const pool = markSubscriptionSuccess(providerId, credential.label, Date.now());
+    const meta = pool.find((entry) => entry.label === credential.label) ?? credential;
+    return { ...meta, access: authenticated.access };
+  }
   const next: SubscriptionCredential = {
     ...credential,
     refresh: authenticated.refresh,
@@ -262,7 +335,7 @@ async function reauthenticateCredential(providerId: ManagedProviderId, credentia
     lastAttemptAt: Date.now(),
     lastRateLimitedAt: credential.lastRateLimitedAt,
   };
-  return upsertSubscription(providerId, next).find((entry) => entry.label === next.label) ?? next;
+  return (upsertSubscription(providerId, next).find((entry) => entry.label === next.label) ?? next) as ResolvedCredential;
 }
 
 function defaultStreamForProvider(model: Model<any>, context: Context, options: SimpleStreamOptions | undefined): AssistantMessageEventStream {
@@ -293,7 +366,7 @@ async function streamProviderAttempt(
   model: Model<any>,
   context: Context,
   options: SimpleStreamOptions | undefined,
-  credential: SubscriptionCredential,
+  credential: ResolvedCredential,
   outer: AssistantMessageEventStream,
 ): Promise<AttemptResult> {
   for (let attempt = 1; ; attempt++) {
@@ -465,14 +538,14 @@ async function runManagedProvider(
   const available = rawPool.filter((entry) => !entry.rateLimitedUntil || entry.rateLimitedUntil <= Date.now());
 
   for (const credential of available) {
-    let freshCredential: SubscriptionCredential;
+    let freshCredential: ResolvedCredential;
     try {
       freshCredential = await refreshCredentialIfNeeded(providerId, credential);
     } catch (error) {
       const attemptAt = Date.now();
       markSubscriptionAttempt(providerId, credential.label, attemptAt);
       if (isInvalidRefreshTokenError(error)) {
-        let reauthenticated: SubscriptionCredential | undefined;
+        let reauthenticated: ResolvedCredential | undefined;
         try {
           reauthenticated = await reauthenticateCredential(providerId, credential);
         } catch (loginError) {
@@ -718,21 +791,35 @@ export default async function (pi: ExtensionAPI): Promise<void> {
         }
         const label = rest.join(" ") || (await ctx.ui.input(`${getProviderLabel(providerId)} subscription label`, providerId));
         if (!label) return;
-        if (pool.some((entry) => entry.label.toLowerCase() === label.toLowerCase())) {
+        // The default label (`label === providerId`) is the OAuth-login-linked default slot,
+        // whose live value lives exclusively in auth.json (design §1/§3). Accepting it bypasses
+        // the duplicate-label check because the metadata-only pool entry for it may already exist,
+        // and the value never gets written into the pool: `writeSubscriptionPool` strips any
+        // `label === providerId` value on write so the login credential stays in auth.json.
+        const isDefaultLabel = label.toLowerCase() === providerId.toLowerCase();
+        if (!isDefaultLabel && pool.some((entry) => entry.label.toLowerCase() === label.toLowerCase())) {
           ctx.ui.notify(`${getProviderLabel(providerId)} subscription already exists: ${label}`, "error");
           return;
         }
         try {
-          const cred = await loginProvider(providerId, ctx);
-          upsertSubscription(providerId, {
-            label,
-            refresh: cred.refresh,
-            access: cred.access,
-            expires: cred.expires,
-            rateLimitedUntil: 0,
-            lastAttemptAt: 0,
-            lastRateLimitedAt: 0,
-          });
+          const cred = await activeLoginForProvider(providerId, ctx);
+          if (isDefaultLabel) {
+            // Same single-owner write as `reauthenticateCredential`'s default branch: persist
+            // to auth.json through the same locked FileAuthStorageBackend seam; the
+            // metadata-only pool entry is (re)created on next read.
+            await persistDefaultSlotCredential(providerId, cred);
+            markSubscriptionSuccess(providerId, providerId, Date.now());
+          } else {
+            upsertSubscription(providerId, {
+              label,
+              refresh: cred.refresh,
+              access: cred.access,
+              expires: cred.expires,
+              rateLimitedUntil: 0,
+              lastAttemptAt: 0,
+              lastRateLimitedAt: 0,
+            });
+          }
           logRotation(`added ${getProviderLabel(providerId)} subscription "${label}"`);
           ctx.ui.notify(`Added ${getProviderLabel(providerId)} subscription: ${label}`, "info");
           updateRotationStatus(ctx);

package/dist/builtin-pi-packages/pi-crtr-extensions/lib/subscription-state.ts

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import type { OAuthCredentials, ThinkingLevel } from "@earendil-works/pi-ai";
+import type { ThinkingLevel } from "@earendil-works/pi-ai";
+import { FileAuthStorageBackend } from "@earendil-works/pi-coding-agent";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 export const ANTHROPIC_PROVIDER_ID = "anthropic";
@@ -11,11 +12,16 @@ export type ManagedProviderId = typeof ANTHROPIC_PROVIDER_ID | typeof OPENAI_COD
 export type LadderProviderId = "anthropic" | "openai";
 export type ModelStrength = "ultra" | "strong" | "medium" | "light";
 
+// The default label's slot (`label === providerId`) is the OAuth-login-linked credential --
+// its live value (`refresh`/`access`/`expires`) is owned exclusively by pi's auth.json (see
+// provider-rotation.ts's `refreshDefaultSlotCredential`/`reauthenticateCredential`), so those
+// fields are absent on that entry. Any OTHER explicitly-added account (`/provider-sub add`,
+// label !== providerId) keeps the full value here, unchanged.
 export type SubscriptionCredential = {
   label: string;
-  refresh: string;
-  access: string;
-  expires: number;
+  refresh?: string;
+  access?: string;
+  expires?: number;
   rateLimitedUntil: number;
   lastAttemptAt: number;
   lastRateLimitedAt: number;
@@ -48,10 +54,7 @@ export type FallbackTarget = {
 
 type ModelLadderConfig = Partial<Record<ModelStrength, string>>;
 type ModelLaddersConfig = Partial<Record<LadderProviderId, ModelLadderConfig>>;
-type AuthFile = Record<string, OAuthCredentials & { type?: string }>;
-
 const AGENT_DIR = join(homedir(), ".pi", "agent");
-const AUTH_FILE = join(AGENT_DIR, "auth.json");
 const ROTATION_CONFIG_FILE = join(AGENT_DIR, "provider-rotation.json");
 const CROUTER_CONFIG_FILE = join(homedir(), ".crouter", "config.json");
 const DEFAULT_FALLBACK_STRENGTH: ModelStrength = "strong";
@@ -105,16 +108,14 @@ function normalizeTiming(value: unknown): number {
 
 function normalizeCredential(value: Partial<SubscriptionCredential> & { label?: string }): SubscriptionCredential | undefined {
   const label = typeof value.label === "string" ? value.label.trim() : "";
+  if (!label) return undefined;
   const refresh = typeof value.refresh === "string" ? value.refresh.trim() : "";
   const access = typeof value.access === "string" ? value.access.trim() : "";
-  if (!label || !refresh || !access) return undefined;
   const expires = Number(value.expires);
   const rateLimitedUntil = Number(value.rateLimitedUntil);
   return {
     label,
-    refresh,
-    access,
-    expires: Number.isFinite(expires) ? expires : 0,
+    ...(refresh && access ? { refresh, access, expires: Number.isFinite(expires) ? expires : 0 } : {}),
     rateLimitedUntil: Number.isFinite(rateLimitedUntil) ? rateLimitedUntil : 0,
     lastAttemptAt: normalizeTiming(value.lastAttemptAt),
     lastRateLimitedAt: normalizeTiming(value.lastRateLimitedAt),
@@ -126,53 +127,53 @@ function normalizeCredentials(values: unknown): SubscriptionCredential[] {
   return values.map((entry) => normalizeCredential(entry as Partial<SubscriptionCredential> & { label?: string })).filter((entry): entry is SubscriptionCredential => Boolean(entry));
 }
 
-function readAuthCredentials(): AuthFile {
-  return readJsonFile<AuthFile>(AUTH_FILE) ?? {};
-}
-
 function getCurrentModelRef(model?: { provider: string; id: string }): ModelRef | undefined {
   return isManagedProvider(model?.provider) ? { providerId: model.provider, modelId: model.id } : undefined;
 }
 
-function seedSubscriptionsFromAuth(providerId: ManagedProviderId): SubscriptionCredential[] {
-  const credential = readAuthCredentials()[providerId];
-  if (!credential) return [];
-  const seeded = normalizeCredential({
-    label: providerId,
-    refresh: credential.refresh,
-    access: credential.access,
-    expires: credential.expires,
-    rateLimitedUntil: 0,
-    lastAttemptAt: 0,
-    lastRateLimitedAt: 0,
+type AuthFileData = Record<string, { type?: string }>;
+
+function readAuthCredential(providerId: ManagedProviderId): { type?: string } | undefined {
+  return new FileAuthStorageBackend().withLock((current) => {
+    if (!current) return { result: undefined };
+    const data = JSON.parse(current) as AuthFileData;
+    return { result: data[providerId] };
   });
-  return seeded ? [seeded] : [];
-}
-
-function syncDefaultSubscriptionFromAuth(providerId: ManagedProviderId, pool: SubscriptionCredential[]): SubscriptionCredential[] {
-  const [seeded] = seedSubscriptionsFromAuth(providerId);
-  if (!seeded) return pool;
-  if (pool.length === 0) return [seeded];
-
-  // `/login` ambiently writes the freshly authenticated credential to auth.json.
-  // If it matches a pool entry by token, sync that entry in place; otherwise it's
-  // re-auth on the selected/default slot (index 0) whose tokens rotated enough
-  // that they no longer match, so update that slot rather than appending a new
-  // entry. Adding a genuinely additional account is an explicit action only:
-  // `/provider-sub <provider> add <label>`.
-  const sameCredential = pool.findIndex((entry) => entry.refresh === seeded.refresh || entry.access === seeded.access);
-  const targetIndex = sameCredential === -1 ? 0 : sameCredential;
-  const current = pool[targetIndex];
-  if (current.refresh === seeded.refresh && current.access === seeded.access && current.expires === seeded.expires) return pool;
-  const next = [...pool];
-  next[targetIndex] = {
-    ...current,
-    refresh: seeded.refresh,
-    access: seeded.access,
-    expires: seeded.expires,
-    rateLimitedUntil: 0,
-  };
-  return writeSubscriptionPool(providerId, next);
+}
+
+// Seeds a METADATA-ONLY pool entry for the default label (`label === providerId`)
+// whenever an OAuth-login-linked credential exists for it in auth.json, regardless of
+// whether the pool already holds OTHER explicit accounts. The auth.json seed read goes
+// through FileAuthStorageBackend's real lock so a held auth.json lock or parse failure is
+// surfaced instead of silently pretending the default credential is absent. Gated
+// specifically on an OAUTH auth.json record (`type === "oauth"`) rather than the presence
+// of any credential, because an api_key credential has no refresh token -- a
+// metadata-only "default" slot seeded for one would be a slot `refreshDefaultSlotCredential`
+// can never actually refresh. No token is ever copied into the pool: the value lives
+// exclusively in auth.json.
+function ensureDefaultSubscriptionMetadata(providerId: ManagedProviderId, pool: SubscriptionCredential[]): SubscriptionCredential[] {
+  if (pool.some((entry) => entry.label === providerId)) return pool;
+  const authCred = readAuthCredential(providerId);
+  if (authCred?.type !== "oauth") return pool;
+  const seeded = normalizeCredential({ label: providerId, rateLimitedUntil: 0, lastAttemptAt: 0, lastRateLimitedAt: 0 });
+  return seeded ? [...pool, seeded] : pool;
+}
+
+// The default label's value lives exclusively in auth.json, so its pool entry must never
+// carry `refresh`/`access`/`expires`; this strips those fields on every read and write,
+// self-healing any pool file that has them physically present on disk. `changed` tells
+// the caller whether anything was actually stripped, so `readSubscriptionPool` can
+// persist the metadata-only result immediately rather than leaving a stale copy on disk
+// until some unrelated write.
+function scrubDefaultValue(providerId: ManagedProviderId, pool: SubscriptionCredential[]): { pool: SubscriptionCredential[]; changed: boolean } {
+  let changed = false;
+  const next = pool.map((entry) => {
+    if (entry.label !== providerId || (entry.refresh === undefined && entry.access === undefined && entry.expires === undefined)) return entry;
+    changed = true;
+    const { refresh: _refresh, access: _access, expires: _expires, ...meta } = entry;
+    return meta;
+  });
+  return { pool: next, changed };
 }
 
 export function isManagedProvider(providerId: string | undefined): providerId is ManagedProviderId {
@@ -185,16 +186,15 @@ export function getProviderLabel(providerId: ManagedProviderId): string {
 
 export function readSubscriptionPool(providerId: ManagedProviderId): SubscriptionCredential[] {
   const poolFile = PROVIDERS[providerId].poolFile;
-  const normalized = normalizeCredentials(readJsonFile<unknown>(poolFile));
-  if (normalized.length > 0) return syncDefaultSubscriptionFromAuth(providerId, normalized);
-
-  const seeded = seedSubscriptionsFromAuth(providerId);
-  if (seeded.length > 0) writeSubscriptionPool(providerId, seeded);
-  return seeded;
+  const raw = normalizeCredentials(readJsonFile<unknown>(poolFile));
+  const { pool: scrubbed, changed: wasScrubbed } = scrubDefaultValue(providerId, raw);
+  const withDefaultSlot = ensureDefaultSubscriptionMetadata(providerId, scrubbed);
+  if (wasScrubbed || withDefaultSlot !== scrubbed) return writeSubscriptionPool(providerId, withDefaultSlot);
+  return withDefaultSlot;
 }
 
 export function writeSubscriptionPool(providerId: ManagedProviderId, next: SubscriptionCredential[]): SubscriptionCredential[] {
-  const normalized = normalizeCredentials(next);
+  const normalized = scrubDefaultValue(providerId, normalizeCredentials(next)).pool;
   writeJsonFile(PROVIDERS[providerId].poolFile, normalized);
   return normalized;
 }