@desplega.ai/agent-swarm 1.73.1 → 1.73.2

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Swarm API",
-    "version": "1.73.1",
+    "version": "1.73.2",
     "description": "Multi-agent orchestration API for Claude Code, Codex, and Gemini CLI. Enables task distribution, agent communication, and service discovery.\n\nMCP tools are documented separately in [MCP.md](./MCP.md)."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@desplega.ai/agent-swarm",
-  "version": "1.73.1",
+  "version": "1.73.2",
   "description": "Multi-agent orchestration for Claude Code, Codex, Gemini CLI, and other AI coding assistants",
   "license": "MIT",
   "author": "desplega.sh <contact@desplega.sh>",

package/src/oauth/ensure-token.ts

@@ -26,11 +26,35 @@ function getOAuthConfig(provider: string): OAuthProviderConfig | null {
  * If the token is expiring soon, attempt to refresh it.
  * Call this before any API interaction with an OAuth-protected service.
  *
+ * Reactive variant — never throws. Refresh failures are logged so a single
+ * dead-token incident doesn't tear down an unrelated request path. Use
+ * {@link ensureTokenOrThrow} from keepalive contexts where you want a dead
+ * refresh token to surface as an alert.
+ *
  * @param bufferMs - How far ahead to check for expiry. Default 5 min (reactive use).
  *                   Keepalive callers should pass a larger value (e.g. 13h) to force
  *                   a proactive refresh well before the token actually expires.
  */
 export async function ensureToken(provider: string, bufferMs?: number): Promise<void> {
+  try {
+    await ensureTokenOrThrow(provider, bufferMs);
+  } catch (err) {
+    console.error(
+      `[OAuth] Failed to refresh ${provider} token:`,
+      err instanceof Error ? err.message : err,
+    );
+  }
+}
+
+/**
+ * Strict variant of {@link ensureToken}: throws on refresh failure of a
+ * configured provider so callers (keepalive, alerting) can react.
+ *
+ * Stays silent (no throw) when the provider isn't configured or no refresh
+ * token is stored — those are "not connected" states, not failures, and
+ * shouldn't page anyone.
+ */
+export async function ensureTokenOrThrow(provider: string, bufferMs?: number): Promise<void> {
   if (!isTokenExpiringSoon(provider, bufferMs)) return;
 
   const config = getOAuthConfig(provider);
@@ -42,13 +66,6 @@ export async function ensureToken(provider: string, bufferMs?: number): Promise<
     return;
   }
 
-  try {
-    await refreshAccessToken(config, tokens.refreshToken);
-    console.log(`[OAuth] ${provider} token refreshed successfully`);
-  } catch (err) {
-    console.error(
-      `[OAuth] Failed to refresh ${provider} token:`,
-      err instanceof Error ? err.message : err,
-    );
-  }
+  await refreshAccessToken(config, tokens.refreshToken);
+  console.log(`[OAuth] ${provider} token refreshed successfully`);
 }

package/src/oauth/keepalive.ts

@@ -1,26 +1,36 @@
-import { ensureToken } from "./ensure-token";
+import { ensureTokenOrThrow } from "./ensure-token";
 
 const TWELVE_HOURS_MS = 12 * 60 * 60 * 1000;
 const THIRTEEN_HOURS_MS = 13 * 60 * 60 * 1000;
 const SLACK_ALERTS_CHANNEL = process.env.SLACK_ALERTS_CHANNEL || "C08JCRURPBV";
 
+const KEEPALIVE_PROVIDERS = ["linear", "jira"] as const;
+
 let keepaliveInterval: ReturnType<typeof setInterval> | null = null;
 
 /**
  * Proactively refresh OAuth tokens on a schedule to prevent expiry.
  * If refresh fails, posts a Slack notification so someone can re-auth manually.
+ *
+ * Why both Linear and Jira: Atlassian rotates refresh tokens and expires them
+ * after 90 days of inactivity, so a swarm that doesn't touch Jira for a long
+ * stretch will silently lose the ability to refresh. Touching the token every
+ * 12h keeps the refresh token alive and surfaces a dead one as an alert
+ * instead of a runtime 401.
  */
 async function runKeepalive(): Promise<void> {
-  console.log("[OAuth Keepalive] Running scheduled token refresh for linear...");
-  try {
-    await ensureToken("linear", THIRTEEN_HOURS_MS);
-    console.log("[OAuth Keepalive] linear token check completed successfully");
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error(`[OAuth Keepalive] Failed to refresh linear token: ${message}`);
-    await notifySlack(
-      `⚠️ *OAuth Keepalive Failed*\nProvider: \`linear\`\nError: ${message}\n\nManual re-authorization may be required.`,
-    );
+  for (const provider of KEEPALIVE_PROVIDERS) {
+    console.log(`[OAuth Keepalive] Running scheduled token refresh for ${provider}...`);
+    try {
+      await ensureTokenOrThrow(provider, THIRTEEN_HOURS_MS);
+      console.log(`[OAuth Keepalive] ${provider} token check completed successfully`);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`[OAuth Keepalive] Failed to refresh ${provider} token: ${message}`);
+      await notifySlack(
+        `⚠️ *OAuth Keepalive Failed*\nProvider: \`${provider}\`\nError: ${message}\n\nManual re-authorization may be required.`,
+      );
+    }
   }
 }
 

package/src/tests/ensure-token.test.ts

@@ -7,7 +7,7 @@ import {
   storeOAuthTokens,
   upsertOAuthApp,
 } from "../be/db-queries/oauth";
-import { ensureToken } from "../oauth/ensure-token";
+import { ensureToken, ensureTokenOrThrow } from "../oauth/ensure-token";
 
 const TEST_DB_PATH = "./test-ensure-token.sqlite";
 
@@ -202,3 +202,35 @@ describe("ensureToken", () => {
     expect(fetchSpy).not.toHaveBeenCalled();
   });
 });
+
+describe("ensureTokenOrThrow", () => {
+  test("throws when refresh fails for a configured provider (so keepalive can alert)", async () => {
+    storeOAuthTokens("test-provider", {
+      accessToken: "old-token",
+      refreshToken: "refresh-token",
+      expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
+    });
+
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response('{"error":"invalid_grant"}', {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        }),
+      ),
+    );
+
+    await expect(ensureTokenOrThrow("test-provider")).rejects.toThrow(/Token refresh failed/);
+  });
+
+  test("stays silent (no throw) when no refresh token is stored", async () => {
+    deleteOAuthTokens("test-provider");
+
+    // "Not connected" should not page anyone
+    await expect(ensureTokenOrThrow("test-provider")).resolves.toBeUndefined();
+  });
+
+  test("stays silent (no throw) when provider is not configured", async () => {
+    await expect(ensureTokenOrThrow("nonexistent-provider")).resolves.toBeUndefined();
+  });
+});