@great-arrow/cli 0.1.49 → 0.1.51

package/dist/index.js

@@ -9399,7 +9399,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.49";
+var CLI_VERSION = "0.1.51";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -10414,14 +10414,14 @@ async function storedPairOtherThan(ours) {
     debugSwallow("refresh.reread", err);
   }
   if (stored?.kind !== "oauth") return null;
+  if (stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
+    throw networkError(
+      "The stored session changed while renewing it.",
+      "Retry the command with the current session."
+    );
+  }
   return stored.credential.refreshToken === ours.refreshToken ? null : stored.credential;
 }
-async function rotatedByAnotherProcess(ours) {
-  const theirs = await storedPairOtherThan(ours);
-  if (!theirs) return null;
-  if (Date.now() >= theirs.accessExpiresAt - REFRESH_SKEW_MS) return null;
-  return theirs;
-}
 async function resolveAuth() {
   const config = await loadConfig();
   const configApiUrl = config.api_url || DEFAULT_API_URL;
@@ -10512,20 +10512,37 @@ async function ensureFreshAccessToken(credential) {
 }
 async function doRefresh(credential) {
   const held = await acquireRefreshLock();
+  let current = credential;
   try {
-    const theirs = await rotatedByAnotherProcess(credential);
-    if (theirs) return theirs;
+    const theirs = await storedPairOtherThan(credential);
+    if (theirs) {
+      current = theirs;
+      if (Date.now() < current.accessExpiresAt - REFRESH_SKEW_MS)
+        return current;
+    }
+    if (!held) {
+      throw networkError(
+        "Session renewal is already in progress.",
+        "Retry shortly; your saved session has been kept."
+      );
+    }
     const refreshed = await refreshTokens({
-      apiUrl: credential.apiUrl,
-      clientId: credential.clientId,
-      refreshToken: credential.refreshToken
+      apiUrl: current.apiUrl,
+      clientId: current.clientId,
+      refreshToken: current.refreshToken
     });
     await saveOAuthCredential(refreshed);
     return refreshed;
   } catch (err) {
     if (err instanceof RefreshRejected) {
-      const theirs = await storedPairOtherThan(credential);
-      if (theirs) return theirs;
+      const theirs = await storedPairOtherThan(current);
+      if (theirs) {
+        if (Date.now() < theirs.accessExpiresAt) return theirs;
+        throw networkError(
+          "Another process updated the session during renewal.",
+          "Retry shortly; your saved session has been kept."
+        );
+      }
       await clearStoredCredential();
       throw sessionExpired();
     }
@@ -10543,12 +10560,13 @@ var EXIT_SESSION_EXPIRED = 2;
 var EXIT_NOT_OAUTH = 3;
 function authCommand() {
   const cmd = new Command("auth").description("Authentication helpers");
-  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options) => {
+  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options, actionCommand) => {
     try {
       const t = await getFreshOAuthAccessToken();
       writeCliLocator();
+      const jsonOutput = options.json || actionCommand.optsWithGlobals().json;
       process.stdout.write(
-        options.json ? `${JSON.stringify(t)}
+        jsonOutput ? `${JSON.stringify(t)}
 ` : `${t.accessToken}
 `
       );
@@ -11958,6 +11976,29 @@ import { readFileSync } from "node:fs";
 
 // src/lib/work-status.ts
 import { execFile as execFile2, execFileSync as execFileSync2 } from "node:child_process";
+
+// ../../src/lib/work-risk/push-state.ts
+var REMOTE_BRANCH_REF_PREFIX = "refs/remotes/origin/";
+var REMOTE_BRANCH_TIPS_FORMAT = "%(refname)%09%(objectname)";
+function parseRemoteBranchTips(raw) {
+  const tips = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const [refname, sha] = line.split("	");
+    if (!refname?.startsWith(REMOTE_BRANCH_REF_PREFIX) || !sha) continue;
+    const branch = refname.slice(REMOTE_BRANCH_REF_PREFIX.length);
+    if (!branch || branch === "HEAD") continue;
+    tips.set(branch, sha.trim());
+  }
+  return tips;
+}
+function remoteHasHead(branch, head, tips, isAncestor2) {
+  const tip = tips.get(branch);
+  if (!tip) return false;
+  if (tip === head) return true;
+  return isAncestor2(head, tip);
+}
+
+// src/lib/work-status.ts
 var LOCAL_COMMAND_TIMEOUT_MS = 2e4;
 function run(command, args, cwd) {
   try {
@@ -12070,9 +12111,31 @@ function auditLocalBranches(root) {
       root
     ).split("\n").filter(Boolean)
   );
+  const tipsResult = git(
+    [
+      "for-each-ref",
+      `--format=${REMOTE_BRANCH_TIPS_FORMAT}`,
+      "refs/remotes/origin"
+    ],
+    root
+  );
+  const tips = parseRemoteBranchTips(
+    tipsResult.status === 0 ? tipsResult.stdout : ""
+  );
   return raw.split("\n").filter(Boolean).flatMap((line) => {
     const parsed = parseLocalBranchLine(line, exact, unmerged);
-    return parsed ? [parsed] : [];
+    if (!parsed) return [];
+    return [
+      {
+        ...parsed,
+        remoteHasHead: remoteHasHead(
+          parsed.branch,
+          parsed.head,
+          tips,
+          (ancestor, descendant) => isAncestor(ancestor, descendant, root)
+        )
+      }
+    ];
   });
 }
 function parseLocalBranchLine(line, exact, unmerged) {
@@ -12131,7 +12194,7 @@ function classifyWorktree(audit) {
   if (audit.path.includes("/.claude/worktrees/")) return "agent-harness";
   if (audit.mergedToMain) return "cleanup-ready";
   if (audit.upstreamGone) return "upstream-gone";
-  if (!audit.upstream) return "local-rescue";
+  if (!audit.remoteHasHead) return "local-rescue";
   return "active-unmerged";
 }
 async function auditWorktrees(root, localBranches) {
@@ -12159,6 +12222,7 @@ async function auditWorktrees(root, localBranches) {
         mergedToMain: branch?.mergedToMain ?? false,
         upstream: branch?.upstream ?? null,
         upstreamGone: branch?.upstreamGone ?? false,
+        remoteHasHead: branch?.remoteHasHead ?? false,
         behindMain: branch?.behindMain ?? 0,
         aheadMain: branch?.aheadMain ?? 0,
         countsExact: branch?.countsExact ?? false
@@ -12178,6 +12242,7 @@ function auditDetachedLocalBranches(localBranches, checkedOutBranches) {
       countsExact,
       upstream,
       upstreamGone,
+      remoteHasHead: remoteHasHead2,
       committedAt
     }) => ({
       branch,
@@ -12186,12 +12251,13 @@ function auditDetachedLocalBranches(localBranches, checkedOutBranches) {
       behindMain,
       aheadMain,
       countsExact,
-      // `upstream` is what separates "never left this disk" from "pushed,
-      // just has no PR yet" — the single bit that decides whether work can
-      // actually be lost. It was computed and then dropped here, so the
-      // server classified both as one undifferentiated "stranded".
+      // `remoteHasHead` is what separates "never left this disk" from
+      // "pushed, just has no PR yet" — the single bit that decides whether
+      // work can actually be lost. `upstream` alone cannot: a task branch
+      // could carry origin/main as its upstream without ever being pushed.
       upstream,
       upstreamGone,
+      remoteHasHead: remoteHasHead2,
       // Without this the grace window read `ageMs = Infinity` for every
       // branch, so a branch was "stranded" from its first second.
       committedAt

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {