@evident-ai/cli 3.2.1-dev.fa69368 → 3.3.1-dev.4a86610

package/dist/index.js

@@ -212,51 +212,80 @@ var api = {
 
 // src/lib/keychain.ts
 var SERVICE_NAME = "evident-cli";
-var keytarWarned = false;
-async function getKeytar() {
+var PROBE_SERVICE_NAME = "evident-cli-probe";
+var keychainWarned = false;
+function warnUnavailable(err) {
+  if (!keychainWarned) {
+    keychainWarned = true;
+    console.warn(
+      `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+var keychain;
+async function probeKeychain() {
   try {
-    const keytar = await import("keytar");
+    const keytar = await import("@napi-rs/keyring/keytar.js");
     if (typeof keytar.setPassword !== "function") {
       return null;
     }
+    await keytar.findCredentials(PROBE_SERVICE_NAME);
     return keytar;
   } catch (err) {
-    if (!keytarWarned) {
-      keytarWarned = true;
-      console.warn(
-        `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
+    warnUnavailable(err);
     return null;
   }
 }
+function resolveKeychain() {
+  if (!keychain) {
+    keychain = probeKeychain();
+  }
+  return keychain;
+}
 function keychainAccount() {
   return getApiUrlConfig();
 }
+function storeInFileFallback(credentials2) {
+  setCredentials({
+    token: credentials2.token,
+    user: credentials2.user,
+    expiresAt: credentials2.expiresAt
+  });
+}
 async function storeToken(credentials2) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
-    await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
-  } else {
-    setCredentials({
-      token: credentials2.token,
-      user: credentials2.user,
-      expiresAt: credentials2.expiresAt
-    });
+    try {
+      await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
+      return;
+    } catch (err) {
+      warnUnavailable(err);
+    }
   }
+  storeInFileFallback(credentials2);
 }
 async function getToken() {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
     const account = keychainAccount();
-    const stored = await keytar.getPassword(SERVICE_NAME, account);
-    if (stored) {
-      try {
-        return JSON.parse(stored);
-      } catch {
-        await keytar.deletePassword(SERVICE_NAME, account);
-        return null;
+    try {
+      const stored = await keytar.getPassword(SERVICE_NAME, account);
+      if (stored) {
+        try {
+          return JSON.parse(stored);
+        } catch {
+          try {
+            await keytar.deletePassword(SERVICE_NAME, account);
+          } catch (err) {
+            console.warn(
+              `Failed to clear invalid keychain entry for ${account}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+          return null;
+        }
       }
+    } catch (err) {
+      warnUnavailable(err);
     }
   }
   const creds = getCredentials();
@@ -273,7 +302,7 @@ function toError(err) {
   return err instanceof Error ? err : new Error(String(err));
 }
 async function deleteToken(options = {}) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   const failures = [];
   if (keytar) {
     if (options.all) {
@@ -286,14 +315,25 @@ async function deleteToken(options = {}) {
       await Promise.all(
         accounts.map(async (entry) => {
           try {
-            await keytar.deletePassword(SERVICE_NAME, entry.account);
+            const deleted = await keytar.deletePassword(SERVICE_NAME, entry.account);
+            if (!deleted) {
+              failures.push({
+                type: "delete",
+                account: entry.account,
+                error: new Error("deletePassword resolved false")
+              });
+            }
           } catch (err) {
             failures.push({ type: "delete", account: entry.account, error: toError(err) });
           }
         })
       );
     } else {
-      await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      try {
+        await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      } catch (err) {
+        warnUnavailable(err);
+      }
     }
   }
   if (options.all) {
@@ -1052,6 +1092,7 @@ var MAX_FILE_SYNC_DIRECTORIES = 16;
 
 // ../../packages/types/src/logging/index.ts
 var CORRELATION_ID_HEADER = "x-evident-correlation-id";
+var FORWARD_FAILURE_REASON_HEADER = "X-Evident-Failure-Reason";
 function log(level, event, fields) {
   const method = level === "debug" ? "log" : level;
   try {
@@ -2645,6 +2686,17 @@ var StreamForwarder = class {
 };
 
 // src/lib/tunnel/connection.ts
+var FAILURE_REASON_HEADER_LC = FORWARD_FAILURE_REASON_HEADER.toLowerCase();
+var TunnelUpgradeRejectedError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+};
+function classifyUpgradeRejection(headers) {
+  const value = headers[FAILURE_REASON_HEADER_LC];
+  return value === "do_code_updated" ? "do_code_updated" : "unknown";
+}
 var MAX_RECONNECT_DELAY = 3e4;
 var BASE_RECONNECT_DELAY = 500;
 function getReconnectDelay(attempt) {
@@ -2689,6 +2741,7 @@ function connectTunnel(options) {
     onError,
     onResponse,
     onInfo,
+    onWarning,
     onDrainPing
   } = options;
   const tunnelUrl = getTunnelUrlConfig();
@@ -2708,8 +2761,11 @@ function connectTunnel(options) {
       reject(new Error("Connection timeout"));
     }, 3e4);
     let upgradeRejection = null;
+    let upgradeRejectionReason = null;
     ws.on("unexpected-response", (_req, res) => {
       clearTimeout(connectionTimeout);
+      const reason = classifyUpgradeRejection(res.headers);
+      upgradeRejectionReason = reason;
       const chunks = [];
       res.on("data", (chunk) => chunks.push(chunk));
       res.on("end", () => {
@@ -2723,8 +2779,14 @@ function connectTunnel(options) {
         }
         const statusLine = `HTTP ${res.statusCode}${res.statusMessage ? ` ${res.statusMessage}` : ""}`;
         upgradeRejection = detail ? `${statusLine}: ${detail}` : statusLine;
-        onError?.(`Tunnel refused by relay (${upgradeRejection})`);
-        reject(new Error(`Tunnel handshake rejected: ${upgradeRejection}`));
+        if (reason === "do_code_updated") {
+          onWarning?.("Relay redeployed \u2014 reconnecting");
+        } else {
+          onError?.(`Tunnel refused by relay (${upgradeRejection})`);
+        }
+        reject(
+          new TunnelUpgradeRejectedError(`Tunnel handshake rejected: ${upgradeRejection}`, reason)
+        );
       });
     });
     ws.on("open", () => {
@@ -2770,8 +2832,14 @@ function connectTunnel(options) {
     ws.on("error", (error2) => {
       clearTimeout(connectionTimeout);
       const detail = upgradeRejection ?? describeSocketError(error2, url);
-      onError?.(`Connection error: ${detail}`);
-      reject(upgradeRejection ? new Error(upgradeRejection) : new Error(detail));
+      if (upgradeRejectionReason === "do_code_updated") {
+        onWarning?.("Relay redeployed \u2014 reconnecting");
+      } else {
+        onError?.(`Connection error: ${detail}`);
+      }
+      reject(
+        upgradeRejectionReason !== null ? new TunnelUpgradeRejectedError(detail, upgradeRejectionReason) : new Error(detail)
+      );
     });
     ws.on("close", (code, reason) => {
       const reasonStr = reason.toString() || upgradeRejection || (code === 1006 ? "abnormal closure" : "No reason provided");
@@ -2847,7 +2915,8 @@ var RunnerConnection = class {
           onError: (error2) => events.onError?.(error2),
           onResponse: () => events.onResponse?.(),
           onDrainPing: () => events.onDrainPing?.(),
-          onInfo: (message) => events.onInfo?.(message)
+          onInfo: (message) => events.onInfo?.(message),
+          onWarning: (message) => events.onWarning?.(message)
         });
         return;
       } catch (error2) {
@@ -2858,7 +2927,12 @@ var RunnerConnection = class {
         }
         const delay = getReconnectDelay(this.reconnectAttempt);
         events.onReconnecting?.(this.reconnectAttempt);
-        events.onError?.(`Connection failed, retrying in ${Math.round(delay / 1e3)}s...`);
+        const retryMessage = `Connection failed, retrying in ${Math.round(delay / 1e3)}s...`;
+        if (error2 instanceof TunnelUpgradeRejectedError && error2.reason === "do_code_updated") {
+          events.onWarning?.(retryMessage);
+        } else {
+          events.onError?.(retryMessage);
+        }
         await this.sleep(delay);
       }
     }
@@ -7889,6 +7963,13 @@ async function run(options) {
           logActivity(state, { type: "error", error: error2 });
           if (state.interactive) displayStatus(state);
         },
+        // `warn`, not `info`: `forwardRunnerActivity`'s FORWARDED_LEVELS floor is
+        // {'warn','error'}, so an `info` entry would never leave the machine and
+        // an operator couldn't correlate a reconnect storm with a relay deploy.
+        onWarning: (message) => {
+          logActivity(state, { type: "info", level: "warn", message });
+          if (state.interactive) displayStatus(state);
+        },
         // Web traffic is proxied transparently; note opencode is live and stamp
         // proxied activity so the idle loop treats interactive proxy use as work.
         // Fires per forwarded response head (incl. every SSE open) and excludes