@goodandready/dsh-github-ops 0.2.3 → 0.2.4

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 Notable changes to `@goodandready/dsh-github-ops`.
 
+## 0.2.4
+
+### Fixed
+- Fixed GitHub client cache holding onto stale credentials when rotated with a token of the exact same length: cache key now incorporates a non-reversible sha256 token fingerprint (#38).
+
 ## 0.2.3
 
 ### Added

package/lib/auth.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 // Access resolution across the sources a GitHub user actually has.
 //
 // Order (tokenSource: "auto"): the DSH credentials service, then the environment variable of
@@ -69,3 +70,66 @@ export async function resolveAccess({ credentials, tokenEnv, tokenSource = 'auto
   }
   return { value: '', source: '', guidance: NO_ACCESS_GUIDANCE }
 }
+/**
+ * Deterministic non-reversible token fingerprint for client cache keys:
+ * differentiates tokens of identical length without leaking token content into logs or keys.
+ */
+export function tokenFingerprint(value) {
+  if (!value || typeof value !== 'string') return ''
+  return createHash('sha256').update(value).digest('hex').slice(0, 16)
+}
+
+/**
+ * Cache key for shared GitHub client instances.
+ * Incorporates the token fingerprint (not length) so rotation between equal-length tokens
+ * creates a new client and uses the new Bearer immediately.
+ */
+export function clientCacheKey(access, cfg = {}) {
+  return [
+    access?.source || '',
+    tokenFingerprint(access?.value),
+    cfg?.baseUrl || '',
+    cfg?.timeoutMs || '',
+    cfg?.cacheTtlMs || '',
+    cfg?.maxRetries ?? '',
+  ].join('|')
+}
+
+/**
+ * Manages the shared GitHub client instance:
+ * caches the client while the key matches; recreates it when the token or config changes.
+ */
+export function createClientHolder({ createClient, signalProvider } = {}) {
+  let sharedClient = null
+  let sharedKey = ''
+
+  return {
+    get(access, cfg = {}) {
+      if (!access || !access.value) {
+        throw new Error(`GitHub access is not configured: ${access?.guidance || NO_ACCESS_GUIDANCE}`)
+      }
+      const key = clientCacheKey(access, cfg)
+      if (!sharedClient || sharedKey !== key) {
+        if (typeof createClient !== 'function') {
+          throw new Error('createClient factory must be a function')
+        }
+        sharedClient = createClient({
+          token: access.value,
+          baseUrl: cfg.baseUrl || 'https://api.github.com',
+          timeoutMs: Number(cfg.timeoutMs) || 30000,
+          cacheTtlMs: Number.isFinite(Number(cfg.cacheTtlMs)) ? Number(cfg.cacheTtlMs) : 60000,
+          maxRetries: Number.isFinite(Number(cfg.maxRetries)) ? Number(cfg.maxRetries) : 2,
+          signalProvider,
+        })
+        sharedKey = key
+      }
+      return sharedClient
+    },
+    currentKey: () => sharedKey,
+    currentClient: () => sharedClient,
+    reset: () => {
+      sharedClient = null
+      sharedKey = ''
+    },
+  }
+}

package/lib/index.js

@@ -15,7 +15,7 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 
 import { createGitHubClient, parseRepoSpec, describeError, GitHubError } from './github.js'
-import { resolveAccess, NO_ACCESS_GUIDANCE } from './auth.js'
+import { resolveAccess, NO_ACCESS_GUIDANCE, createClientHolder } from './auth.js'
 import { resolveRepoContext } from './repo-context.js'
 import { presentationFor } from './present.js'
 import { createRecords, startReviewJob } from './jobs.js'
@@ -233,39 +233,20 @@ export function apply(ctx, rawConfig) {
   }
 
   // One client per configuration: the read cache lives in it, and the signal for the
-  // current tool call arrives through the async context.
-  let sharedClient = null
-  let sharedKey = ''
+  // current tool call arrives through the async context. Token rotation immediately recreates
+  // the client even when the new token has the exact same length.
+  const clientHolder = createClientHolder({
+    createClient: createGitHubClient,
+    signalProvider: () => {
+      const store = callContext.getStore()
+      return store && store.signal ? store.signal : undefined
+    },
+  })
 
   async function client() {
     const cfg = liveConfig()
     const access = await resolveToken()
-    if (!access.value) {
-      throw new Error(`GitHub access is not configured: ${access.guidance || NO_ACCESS_GUIDANCE}`)
-    }
-    const key = [
-      access.source,
-      access.value.length,
-      cfg.baseUrl || '',
-      cfg.timeoutMs || '',
-      cfg.cacheTtlMs || '',
-      cfg.maxRetries ?? '',
-    ].join('|')
-    if (!sharedClient || sharedKey !== key) {
-      sharedClient = createGitHubClient({
-        token: access.value,
-        baseUrl: cfg.baseUrl || 'https://api.github.com',
-        timeoutMs: Number(cfg.timeoutMs) || 30000,
-        cacheTtlMs: Number.isFinite(Number(cfg.cacheTtlMs)) ? Number(cfg.cacheTtlMs) : 60000,
-        maxRetries: Number.isFinite(Number(cfg.maxRetries)) ? Number(cfg.maxRetries) : 2,
-        signalProvider: () => {
-          const store = callContext.getStore()
-          return store && store.signal ? store.signal : undefined
-        },
-      })
-      sharedKey = key
-    }
-    return sharedClient
+    return clientHolder.get(access, cfg)
   }
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",