@great-arrow/cli 0.1.50 → 0.1.52

package/dist/index.js

@@ -9327,6 +9327,7 @@ function mapErrorToExitCode(error) {
   return 2 /* NETWORK_ERROR */;
 }
 var FAILURE_HINTS = {
+  permission: "Review this connection's scopes and workspace permissions at /account/connections.",
   auth: "Run `gad login`, then reconnect the client: /mcp \u2192 great-arrow \u2192 reconnect.",
   network: "Check this machine's connectivity (VPN, proxy, DNS), then try again.",
   timeout: "The request timed out. Check connectivity and retry; if it persists, see https://www.greatarrow.ai/status.",
@@ -9337,9 +9338,11 @@ var FAILURE_HINTS = {
 function classifyRequestFailure(error) {
   const message = error instanceof Error ? error.message : String(error ?? "unknown error");
   let kind = "unknown";
-  if (error instanceof CliError && error.code === 1 /* AUTH_ERROR */) {
+  if (/\b403\b/.test(message)) {
+    kind = "permission";
+  } else if (error instanceof CliError && error.code === 1 /* AUTH_ERROR */) {
     kind = "auth";
-  } else if (/\b(401|403)\b/.test(message)) {
+  } else if (/\b401\b/.test(message)) {
     kind = "auth";
   } else if (/HTTP 5\d\d|Server error/i.test(message)) {
     kind = "server";
@@ -9399,7 +9402,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.50";
+var CLI_VERSION = "0.1.52";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -10414,14 +10417,14 @@ async function storedPairOtherThan(ours) {
     debugSwallow("refresh.reread", err);
   }
   if (stored?.kind !== "oauth") return null;
+  if (stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
+    throw networkError(
+      "The stored session changed while renewing it.",
+      "Retry the command with the current session."
+    );
+  }
   return stored.credential.refreshToken === ours.refreshToken ? null : stored.credential;
 }
-async function rotatedByAnotherProcess(ours) {
-  const theirs = await storedPairOtherThan(ours);
-  if (!theirs) return null;
-  if (Date.now() >= theirs.accessExpiresAt - REFRESH_SKEW_MS) return null;
-  return theirs;
-}
 async function resolveAuth() {
   const config = await loadConfig();
   const configApiUrl = config.api_url || DEFAULT_API_URL;
@@ -10512,20 +10515,37 @@ async function ensureFreshAccessToken(credential) {
 }
 async function doRefresh(credential) {
   const held = await acquireRefreshLock();
+  let current = credential;
   try {
-    const theirs = await rotatedByAnotherProcess(credential);
-    if (theirs) return theirs;
+    const theirs = await storedPairOtherThan(credential);
+    if (theirs) {
+      current = theirs;
+      if (Date.now() < current.accessExpiresAt - REFRESH_SKEW_MS)
+        return current;
+    }
+    if (!held) {
+      throw networkError(
+        "Session renewal is already in progress.",
+        "Retry shortly; your saved session has been kept."
+      );
+    }
     const refreshed = await refreshTokens({
-      apiUrl: credential.apiUrl,
-      clientId: credential.clientId,
-      refreshToken: credential.refreshToken
+      apiUrl: current.apiUrl,
+      clientId: current.clientId,
+      refreshToken: current.refreshToken
     });
     await saveOAuthCredential(refreshed);
     return refreshed;
   } catch (err) {
     if (err instanceof RefreshRejected) {
-      const theirs = await storedPairOtherThan(credential);
-      if (theirs) return theirs;
+      const theirs = await storedPairOtherThan(current);
+      if (theirs) {
+        if (Date.now() < theirs.accessExpiresAt) return theirs;
+        throw networkError(
+          "Another process updated the session during renewal.",
+          "Retry shortly; your saved session has been kept."
+        );
+      }
       await clearStoredCredential();
       throw sessionExpired();
     }
@@ -10904,7 +10924,14 @@ var GadClient = class {
     }
     const status = response.status;
     const body = await response.text().catch(() => "");
-    if (status === 401 || status === 403) {
+    if (status === 403) {
+      throw new CliError(
+        "Permission denied (HTTP 403).",
+        1 /* AUTH_ERROR */,
+        "Check this connection's scopes and workspace permissions at /account/connections."
+      );
+    }
+    if (status === 401) {
       throw authError(
         `Authentication failed (HTTP ${status}).`,
         "Run 'gad login' to re-authenticate, or check your GAD_TOKEN."
@@ -14193,7 +14220,8 @@ function codexTransportFields(body) {
 
 // src/lib/mcp-doctor.ts
 var MCP_FAILURE_MESSAGE = {
-  auth: "MCP rejected this machine's credential (401/403)",
+  auth: "MCP rejected this machine's credential (401)",
+  permission: "MCP denied this connection's scopes or workspace access (403)",
   network: "Could not reach the MCP endpoint",
   timeout: "The MCP endpoint did not answer in time",
   server: "The MCP endpoint returned a server error",
@@ -14202,6 +14230,7 @@ var MCP_FAILURE_MESSAGE = {
 };
 var MCP_STATUS_WORD = {
   auth: "unauthenticated",
+  permission: "forbidden",
   network: "unreachable",
   timeout: "timeout",
   server: "server error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {