@hienlh/ppm 0.8.20 → 0.8.22

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.8.22] - 2026-03-24
+
+### Fixed
+- **OAuth pre-flight token refresh**: Check token freshness before each SDK query and refresh proactively if expired or expiring within 60s
+- **Auto-refresh on startup**: Run token refresh check immediately on server start instead of waiting 5 minutes for first interval
+- **OAuth auto-refresh on auth failure**: Automatically refresh expired OAuth token and retry when SDK returns `authentication_failed`, instead of just showing error to user
+
+## [0.8.21] - 2026-03-24
+
+### Fixed
+- **OAuth auto-refresh on auth failure**: Automatically refresh expired OAuth token and retry when SDK returns `authentication_failed`, instead of just showing error to user
+
 ## [0.8.20] - 2026-03-24
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.8.20",
+  "version": "0.8.22",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/scripts/patch-sdk.mjs

@@ -46,11 +46,14 @@ if (content.includes("waiting for drain")) {
     const arg = drainMatch[1];
     const logger = drainMatch[2];
 
-    // Replace backpressure line: await drain instead of just logging
+    // Replace backpressure line:
+    // - Non-Windows: await drain event (pipe buffers are large, drain fires reliably)
+    // - Windows: skip drain — Bun+Windows pipe drain event is unreliable (may never fire
+    //   in PowerShell). OS still buffers data; subprocess reads when ready.
     const newLine =
       `if(!this.processStdin.write(${arg})){` +
-      `${logger}("[ProcessTransport] Write buffer full, waiting for drain");` +
-      `await new Promise(_dr=>this.processStdin.once("drain",_dr))}`;
+      `${logger}("[ProcessTransport] Write buffer full, "+(process.platform==="win32"?"skipping drain (Windows)":"waiting for drain"));` +
+      `if(process.platform!=="win32")await new Promise(_dr=>this.processStdin.once("drain",_dr))}`;
 
     content = content.replace(oldLine, newLine);
 
@@ -162,6 +165,9 @@ if (content.includes("__ppm_manual_readline__")) {
         `_buf="";_done=true;_notify()` +
       `});` +
       `this.processStdout.on("error",(e)=>{_err=e;_done=true;_notify()});` +
+      // Bun on Windows may not auto-switch to flowing mode when "data" listener is added.
+      // Explicit resume() ensures data events fire.
+      `this.processStdout.resume();` +
       `try{` +
         `while(true){` +
           `while(_lines.length>0){` +

package/src/providers/claude-agent-sdk.ts

@@ -545,7 +545,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
       // Account-based auth injection (multi-account mode)
       // Fallback to existing env (ANTHROPIC_API_KEY) when no accounts configured.
       const accountsEnabled = accountSelector.isEnabled();
-      const account = accountsEnabled ? accountSelector.next() : null;
+      let account = accountsEnabled ? accountSelector.next() : null;
       if (accountsEnabled && !account) {
         // All accounts in DB but none usable
         const reason = accountSelector.lastFailReason;
@@ -557,7 +557,12 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         yield { type: "done" as const, sessionId, resultSubtype: "error_auth" };
         return;
       }
+      // Pre-flight: ensure OAuth token is fresh before sending to SDK
       if (account) {
+        const fresh = await accountService.ensureFreshToken(account.id);
+        if (fresh) {
+          account = fresh;
+        }
         console.log(`[sdk] Using account ${account.id} (${account.email ?? "no-email"})`);
         yield { type: "account_info" as const, accountId: account.id, accountLabel: account.label ?? account.email ?? "Unknown" };
       }
@@ -641,8 +646,10 @@ export class ClaudeAgentSdkProvider implements AIProvider {
 
       // Retry logic: if SDK returns error_during_execution with 0 turns on first event,
       // it's a transient subprocess failure — retry once before surfacing the error.
+      // Also handles authentication_failed by refreshing OAuth token and retrying.
       const MAX_RETRIES = 1;
       let retryCount = 0;
+      let authRetried = false;
 
       retryLoop: while (true) {
       let sdkEventCount = 0;
@@ -816,6 +823,52 @@ export class ClaudeAgentSdkProvider implements AIProvider {
             // Dump full SDK message for debugging
             console.error(`[sdk] session=${sessionId} cwd=${effectiveCwd} assistant error: ${assistantError} (isFirst=${isFirstMessage} retry=${retryCount})`);
             console.error(`[sdk] assistant message dump: ${JSON.stringify(msg).slice(0, 2000)}`);
+
+            // OAuth token expired — refresh and retry once before showing error
+            if (assistantError === "authentication_failed" && account && !authRetried) {
+              authRetried = true;
+              try {
+                await accountService.refreshAccessToken(account.id);
+                console.log(`[sdk] session=${sessionId} OAuth token refreshed for ${account.id} — retrying`);
+                // Re-build env with refreshed token
+                const refreshedAccount = accountService.getWithTokens(account.id);
+                if (refreshedAccount) {
+                  const retryEnv = this.buildQueryEnv(meta.projectPath, refreshedAccount);
+                  const q = query({
+                    prompt: message,
+                    options: {
+                      sessionId: undefined,
+                      resume: undefined,
+                      cwd: effectiveCwd,
+                      systemPrompt: systemPromptOpt,
+                      settingSources: ["user", "project"],
+                      env: retryEnv,
+                      settings: { permissions: { allow: [], deny: [] } },
+                      allowedTools,
+                      permissionMode,
+                      allowDangerouslySkipPermissions: isBypass,
+                      ...(permissionHooks && { hooks: permissionHooks }),
+                      ...(providerConfig.model && { model: providerConfig.model }),
+                      ...(providerConfig.effort && { effort: providerConfig.effort }),
+                      maxTurns: providerConfig.max_turns ?? 100,
+                      ...(providerConfig.max_budget_usd && { maxBudgetUsd: providerConfig.max_budget_usd }),
+                      ...(providerConfig.thinking_budget_tokens != null && {
+                        thinkingBudgetTokens: providerConfig.thinking_budget_tokens,
+                      }),
+                      canUseTool,
+                      includePartialMessages: true,
+                    } as any,
+                  });
+                  this.activeQueries.set(sessionId, q);
+                  eventSource = q;
+                  continue retryLoop;
+                }
+              } catch (refreshErr) {
+                console.error(`[sdk] session=${sessionId} OAuth refresh failed:`, refreshErr);
+                accountSelector.onAuthError(account.id);
+              }
+            }
+
             const errorHints: Record<string, string> = {
               authentication_failed: "API authentication failed. Check your account credentials in Settings → Accounts.",
               billing_error: "Billing error on this account. Check your subscription status.",

package/src/services/account.service.ts

@@ -116,6 +116,29 @@ class AccountService {
     }
   }
 
+  /**
+   * Ensure the access token for an OAuth account is still fresh.
+   * If it's expired or about to expire (within 60s), refresh it proactively.
+   * Returns the refreshed account with fresh tokens, or null if refresh failed.
+   */
+  async ensureFreshToken(id: string): Promise<AccountWithTokens | null> {
+    const acc = this.getWithTokens(id);
+    if (!acc) return null;
+    // Only OAuth tokens need refresh
+    if (!acc.accessToken.startsWith("sk-ant-oat")) return acc;
+    if (!acc.expiresAt) return acc;
+    const nowS = Math.floor(Date.now() / 1000);
+    if (acc.expiresAt - nowS > 60) return acc; // still fresh
+    try {
+      console.log(`[accounts] Pre-flight refresh for ${acc.email ?? id} (expires in ${acc.expiresAt - nowS}s)`);
+      await this.refreshAccessToken(id);
+      return this.getWithTokens(id);
+    } catch (e) {
+      console.error(`[accounts] Pre-flight refresh failed for ${id}:`, e);
+      return null;
+    }
+  }
+
   /** Find existing account by email or profile UUID */
   private findDuplicate(email?: string | null, profileData?: OAuthProfileData | null): Account | null {
     if (!email && !profileData?.account?.uuid) return null;
@@ -586,7 +609,7 @@ class AccountService {
     const CHECK_INTERVAL_MS = 5 * 60_000;
     const REFRESH_BUFFER_S = 5 * 60;
 
-    this.refreshTimer = setInterval(async () => {
+    const refreshExpiring = async () => {
       const accounts = this.list();
       const nowS = Math.floor(Date.now() / 1000);
       for (const acc of accounts) {
@@ -600,7 +623,11 @@ class AccountService {
           console.error(`[accounts] Auto-refresh failed for ${acc.id}:`, e);
         }
       }
-    }, CHECK_INTERVAL_MS);
+    };
+
+    // Run immediately on startup, then every 5 minutes
+    refreshExpiring().catch(() => {});
+    this.refreshTimer = setInterval(refreshExpiring, CHECK_INTERVAL_MS);
 
     if (typeof this.refreshTimer === "object" && this.refreshTimer !== null && "unref" in this.refreshTimer) {
       (this.refreshTimer as NodeJS.Timeout).unref();