@gravity-rail/cli 0.53.1 → 0.55.0

package/README.md

@@ -40,6 +40,15 @@ own confidential client. Both kinds of profile refresh normally; nothing needs t
 be re-authorized when a server gains the pinned client, though the next
 `gr login` on that profile will switch to it.
 
+Access tokens refresh automatically. When several `gr` commands on one machine
+need a refresh at the same time, one of them exchanges the refresh token while
+the others wait briefly and reuse the result, so parallel runs no longer sign
+each other out. A refresh that fails for a temporary reason (network error,
+timeout, or server error) keeps your stored credentials and exits with an
+error; retry the command. Only when the server rejects the stored refresh token
+is that one profile cleared, and `gr login` (or `gr auth login --name <profile>`)
+signs it back in.
+
 ### Multi-account profiles
 
 Like `aws --profile` / `gh auth switch`, the public CLI supports multiple named accounts:
@@ -308,6 +317,7 @@ not forwarded, as it may contain sensitive data. Use `resume.chatUuid` /
 | `calendars`      | Scheduling — calendars, events, event types, availability, Google sync  |
 | `qualifications` | Skills evaluation — requirements, submissions, scoring                  |
 | `queries`        | Unified Query Engine — fields, validate, preview, run, syntax reference |
+| `data-reports`   | Form Reports — preview a report as the Agent would run it               |
 
 ### Global (no workspace)
 

package/dist/{account-verify-phone-ABHHHGCC.js → account-verify-phone-4ZN7NJGW.js}

@@ -2,8 +2,8 @@ import {
   confirmAccountPhoneVerify,
   requireAuth,
   startAccountPhoneVerify
-} from "./chunk-FQMZ2EBF.js";
-import "./chunk-FSY2BM4J.js";
+} from "./chunk-WCMXS5CL.js";
+import "./chunk-BQ3WBHSA.js";
 import "./chunk-3T7A5PSF.js";
 
 // src/commands/account-verify-phone.ts
@@ -38,4 +38,4 @@ async function promptLine(question) {
 export {
   accountVerifyPhoneCommand
 };
-//# sourceMappingURL=account-verify-phone-ABHHHGCC.js.map
+//# sourceMappingURL=account-verify-phone-4ZN7NJGW.js.map

package/dist/{chunk-FSY2BM4J.js → chunk-BQ3WBHSA.js}

@@ -230,6 +230,76 @@ function getEnvironmentConfig(env, options = {}) {
 import { createServer } from "http";
 import { createHash, randomBytes } from "crypto";
 import { exec } from "child_process";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+import lockfile from "proper-lockfile";
+
+// package.json
+var package_default = {
+  name: "@gravity-rail/cli",
+  version: "0.55.0",
+  description: "Gravity Rail CLI \u2014 manage workspaces from the command line",
+  type: "module",
+  bin: {
+    gr: "./dist/gr.js"
+  },
+  exports: {
+    ".": {
+      types: "./dist/lib.d.ts",
+      import: "./dist/lib.js"
+    },
+    "./lib": {
+      types: "./dist/lib.d.ts",
+      import: "./dist/lib.js"
+    },
+    "./cli-utils": {
+      types: "./dist/cli-utils.d.ts",
+      import: "./dist/cli-utils.js"
+    }
+  },
+  files: [
+    "dist"
+  ],
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://developer.gravityrail.com"
+  },
+  homepage: "https://developer.gravityrail.com",
+  keywords: [
+    "gravity-rail",
+    "cli",
+    "healthcare",
+    "workspace"
+  ],
+  engines: {
+    node: ">=18"
+  },
+  scripts: {
+    build: "tsup",
+    "generate:skill-docs": "tsx scripts/generate-skill-docs.ts",
+    clean: "rm -rf dist",
+    typecheck: "tsc --noEmit",
+    test: "jest --forceExit",
+    "test:ci": "jest --forceExit --passWithNoTests --coverage --coverageReporters=json-summary --coverageReporters=text-summary"
+  },
+  dependencies: {
+    "@gravity-rail/sdk": "workspace:^",
+    "js-yaml": "^5.4.3",
+    "proper-lockfile": "^4.1.2"
+  },
+  devDependencies: {
+    "@gravity-rail/sandbox": "workspace:*",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.6.4",
+    "@types/proper-lockfile": "^4.1.4",
+    jest: "^30.5.2",
+    "ts-jest": "29.4.9",
+    tsup: "^8.5.1",
+    typescript: "^6.0.3",
+    undici: "6.28.1"
+  }
+};
 
 // src/cli-utils/credentials-manager.ts
 import {
@@ -582,6 +652,15 @@ var CredentialsManager = class {
 
 // src/cli-utils/auth.ts
 var ACCESS_TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+var TOKEN_REQUEST_USER_AGENT = `gravityrail-cli/${package_default.version}`;
+var REFRESH_REQUEST_TIMEOUT_MS = 15e3;
+var REFRESH_LOCK_RETRIES = { retries: 23, factor: 2, minTimeout: 100, maxTimeout: 1e3 };
+var REFRESH_LOCK_FAILED = "Could not lock the credential store to refresh the access token (another gr process may still be refreshing). Stored credentials were kept; retry the command.";
+var REFRESH_REQUEST_FAILED = "Token refresh did not complete (network error or timeout). Stored credentials were kept; retry the command.";
+var REFRESH_FAILED = "Token refresh failed. Stored credentials were kept; retry the command, and log in again if it keeps failing.";
+var REFRESH_SUPERSEDED = "Token refresh was rejected, but the stored credentials changed meanwhile and were kept. Retry the command.";
+var REFRESH_BAD_RESPONSE = "Token refresh returned an unusable response. Stored credentials were kept; retry the command.";
+var REFRESH_SAVE_FAILED = "Token refresh succeeded, but the new credentials could not be saved. Retry the command, and log in again if it keeps failing.";
 function stderr(msg) {
   process.stderr.write(msg + "\n");
 }
@@ -604,7 +683,7 @@ function validateTokenResponse(tokenData) {
   if (tokenData.expires_in != null) {
     const raw = Number(tokenData.expires_in);
     if (!Number.isFinite(raw) || raw < 60 || raw > 31536e3) {
-      stderr(`  Warning: unusual expires_in value (${tokenData.expires_in}), using default`);
+      stderr("  Warning: unusual expires_in value in the token response, using default");
     } else {
       expiresIn = raw;
     }
@@ -825,7 +904,8 @@ async function performOAuthFlow(options) {
       method: "POST",
       headers: {
         ...auth.headers,
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": TOKEN_REQUEST_USER_AGENT
       },
       body: new URLSearchParams({
         grant_type: "authorization_code",
@@ -862,53 +942,150 @@ async function performOAuthFlow(options) {
     return { accessToken, credentials: creds };
   }
 }
-async function refreshAccessToken(envConfig, creds, credentialsManager, env, profile) {
-  if (!creds.refreshToken || !creds.clientId) {
+function parseOAuthErrorCode(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object") {
+      const code = parsed.error;
+      if (typeof code === "string") return code;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function isFreshEnough(creds) {
+  return !creds.expiresAt || new Date(creds.expiresAt).getTime() > Date.now() + ACCESS_TOKEN_EXPIRY_BUFFER_MS;
+}
+async function acquireRefreshLock(credentialsPath) {
+  try {
+    const cacheDir = dirname2(credentialsPath);
+    if (!existsSync3(cacheDir)) {
+      mkdirSync2(cacheDir, { recursive: true, mode: 448 });
+    }
+    return await lockfile.lock(credentialsPath, {
+      realpath: false,
+      retries: REFRESH_LOCK_RETRIES,
+      // The library default throws from a timer, which would crash the
+      // command. Losing the lock mid-refresh is worth a warning, not that.
+      // The library has already dropped its in-process record of the lock
+      // by the time this runs, so the `release()` in `refreshAccessToken`'s
+      // `finally` is refused (ENOTACQUIRED) and can never remove a lock
+      // another process has since taken.
+      onCompromised: () => {
+        stderr(
+          "  Warning: lost the credential refresh lock; another gr process may refresh at the same time"
+        );
+      }
+    });
+  } catch {
+    throw new Error(REFRESH_LOCK_FAILED);
+  }
+}
+async function refreshAccessToken(envConfig, _creds, credentialsManager, env, profile) {
+  const profileName = credentialsManager.resolveProfileName(profile, env);
+  const release = await acquireRefreshLock(credentialsManager.getCredentialsFilePath(env));
+  try {
+    return await refreshUnderLock(envConfig, credentialsManager, env, profileName);
+  } finally {
+    await release().catch(() => void 0);
+  }
+}
+async function refreshUnderLock(envConfig, credentialsManager, env, profileName) {
+  const stored = credentialsManager.load(env, profileName);
+  if (stored?.accessToken && isFreshEnough(stored)) {
+    return stored;
+  }
+  if (!stored?.refreshToken || !stored.clientId) {
     stderr("  Cannot refresh: missing credentials (re-login required)");
     return null;
   }
-  const profileName = credentialsManager.resolveProfileName(profile, env);
-  const tokenUrl = `${envConfig.apiUrl}/api/v2/oauth/token`;
-  const auth = tokenRequestAuth(creds.clientId, creds.clientSecret);
+  const presentedRefreshToken = stored.refreshToken;
+  const auth = tokenRequestAuth(stored.clientId, stored.clientSecret);
+  let response;
   try {
-    const response = await fetch(tokenUrl, {
+    response = await fetch(`${envConfig.apiUrl}/api/v2/oauth/token`, {
       method: "POST",
       headers: {
         ...auth.headers,
-        "Content-Type": "application/x-www-form-urlencoded"
+        "Content-Type": "application/x-www-form-urlencoded",
+        "User-Agent": TOKEN_REQUEST_USER_AGENT
       },
       body: new URLSearchParams({
         grant_type: "refresh_token",
-        refresh_token: creds.refreshToken,
+        refresh_token: presentedRefreshToken,
         ...auth.params
-      })
+      }),
+      // Bounds the request and the body reads below. Never retried: a
+      // second POST of the same token is itself a reuse.
+      //
+      // Known residual: an abort only stops *this* side. If the server
+      // commits the rotation after the deadline, the response carrying the
+      // successor is lost and the stored token is spent; the next refresh
+      // of it is a genuine invalid_grant and clears the profile. The client
+      // cannot recover an unseen successor; the deadline is long enough
+      // that this needs a token endpoint stalled for 15 s, not a slow one.
+      signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS)
     });
-    if (!response.ok) {
-      const body = await response.text();
-      const isExpiredRefresh = isOAuthError(body, "invalid_grant");
-      if (isExpiredRefresh) {
-        stderr("  Refresh token expired, re-login required");
-      } else {
-        stderr(`  Token refresh failed (${response.status}), clearing credentials`);
+  } catch {
+    throw new Error(REFRESH_REQUEST_FAILED);
+  }
+  if (!response.ok) {
+    let body;
+    try {
+      body = await response.text();
+    } catch {
+      throw new Error(REFRESH_REQUEST_FAILED);
+    }
+    if (response.status === 400 && parseOAuthErrorCode(body) === "invalid_grant") {
+      const current = credentialsManager.load(env, profileName);
+      if (!current) {
+        stderr("  The server rejected the stored refresh token; re-login required");
+        return null;
       }
-      credentialsManager.clear(env, profileName);
+      if (current.refreshToken === presentedRefreshToken) {
+        credentialsManager.clear(env, profileName);
+        stderr("  The server rejected the stored refresh token; re-login required");
+        return null;
+      }
+      throw new Error(REFRESH_SUPERSEDED);
+    }
+    if (parseOAuthErrorCode(body) === "invalid_client") {
+      stderr("  The server no longer recognises this profile's OAuth client; re-login required");
       return null;
     }
-    const tokenData = await response.json();
-    const { accessToken, refreshToken, expiresIn } = validateTokenResponse(tokenData);
-    const updated = {
-      ...creds,
-      accessToken,
-      refreshToken: refreshToken ?? creds.refreshToken,
-      expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-    };
-    credentialsManager.save(env, updated, profileName);
-    return updated;
-  } catch (err) {
-    stderr(`  Token refresh error: ${err instanceof Error ? err.message : "unknown"}`);
-    credentialsManager.clear(env, profileName);
+    throw new Error(REFRESH_FAILED);
+  }
+  let tokens;
+  try {
+    tokens = validateTokenResponse(await response.json());
+  } catch {
+    throw new Error(REFRESH_BAD_RESPONSE);
+  }
+  const latest = credentialsManager.load(env, profileName);
+  if (!latest) {
+    stderr("  Cannot refresh: missing credentials (re-login required)");
     return null;
   }
+  if (latest.clientId !== stored.clientId || latest.refreshToken !== presentedRefreshToken) {
+    if (latest.accessToken && isFreshEnough(latest)) {
+      return latest;
+    }
+    throw new Error(REFRESH_SUPERSEDED);
+  }
+  const updated = {
+    ...latest,
+    accessToken: tokens.accessToken,
+    // A server may omit `refresh_token` when it does not rotate; the
+    // presented token then stays valid.
+    refreshToken: tokens.refreshToken ?? presentedRefreshToken,
+    expiresAt: new Date(Date.now() + tokens.expiresIn * 1e3).toISOString()
+  };
+  try {
+    credentialsManager.save(env, updated, profileName);
+  } catch {
+    throw new Error(REFRESH_SAVE_FAILED);
+  }
+  return updated;
 }
 async function resolveNonInteractiveAuth(options) {
   const { env, envConfig, credentialsManager, profile } = options;
@@ -1443,6 +1620,7 @@ export {
   CALLBACK_PATH,
   REDIRECT_URI,
   WorktreeConfigError,
+  isRecord,
   parsePublishedTarget,
   classifyCheckout,
   getEnvironmentConfig,
@@ -1470,4 +1648,4 @@ export {
   getTextDelta,
   getErrorMessage
 };
-//# sourceMappingURL=chunk-FSY2BM4J.js.map
+//# sourceMappingURL=chunk-BQ3WBHSA.js.map