@hienlh/ppm 0.8.21 → 0.8.22

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.8.22] - 2026-03-24
+
+### Fixed
+- **OAuth pre-flight token refresh**: Check token freshness before each SDK query and refresh proactively if expired or expiring within 60s
+- **Auto-refresh on startup**: Run token refresh check immediately on server start instead of waiting 5 minutes for first interval
+- **OAuth auto-refresh on auth failure**: Automatically refresh expired OAuth token and retry when SDK returns `authentication_failed`, instead of just showing error to user
+
 ## [0.8.21] - 2026-03-24
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.8.21",
+  "version": "0.8.22",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/providers/claude-agent-sdk.ts

@@ -545,7 +545,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
       // Account-based auth injection (multi-account mode)
       // Fallback to existing env (ANTHROPIC_API_KEY) when no accounts configured.
       const accountsEnabled = accountSelector.isEnabled();
-      const account = accountsEnabled ? accountSelector.next() : null;
+      let account = accountsEnabled ? accountSelector.next() : null;
       if (accountsEnabled && !account) {
         // All accounts in DB but none usable
         const reason = accountSelector.lastFailReason;
@@ -557,7 +557,12 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         yield { type: "done" as const, sessionId, resultSubtype: "error_auth" };
         return;
       }
+      // Pre-flight: ensure OAuth token is fresh before sending to SDK
       if (account) {
+        const fresh = await accountService.ensureFreshToken(account.id);
+        if (fresh) {
+          account = fresh;
+        }
         console.log(`[sdk] Using account ${account.id} (${account.email ?? "no-email"})`);
         yield { type: "account_info" as const, accountId: account.id, accountLabel: account.label ?? account.email ?? "Unknown" };
       }

package/src/services/account.service.ts

@@ -116,6 +116,29 @@ class AccountService {
     }
   }
 
+  /**
+   * Ensure the access token for an OAuth account is still fresh.
+   * If it's expired or about to expire (within 60s), refresh it proactively.
+   * Returns the refreshed account with fresh tokens, or null if refresh failed.
+   */
+  async ensureFreshToken(id: string): Promise<AccountWithTokens | null> {
+    const acc = this.getWithTokens(id);
+    if (!acc) return null;
+    // Only OAuth tokens need refresh
+    if (!acc.accessToken.startsWith("sk-ant-oat")) return acc;
+    if (!acc.expiresAt) return acc;
+    const nowS = Math.floor(Date.now() / 1000);
+    if (acc.expiresAt - nowS > 60) return acc; // still fresh
+    try {
+      console.log(`[accounts] Pre-flight refresh for ${acc.email ?? id} (expires in ${acc.expiresAt - nowS}s)`);
+      await this.refreshAccessToken(id);
+      return this.getWithTokens(id);
+    } catch (e) {
+      console.error(`[accounts] Pre-flight refresh failed for ${id}:`, e);
+      return null;
+    }
+  }
+
   /** Find existing account by email or profile UUID */
   private findDuplicate(email?: string | null, profileData?: OAuthProfileData | null): Account | null {
     if (!email && !profileData?.account?.uuid) return null;
@@ -586,7 +609,7 @@ class AccountService {
     const CHECK_INTERVAL_MS = 5 * 60_000;
     const REFRESH_BUFFER_S = 5 * 60;
 
-    this.refreshTimer = setInterval(async () => {
+    const refreshExpiring = async () => {
       const accounts = this.list();
       const nowS = Math.floor(Date.now() / 1000);
       for (const acc of accounts) {
@@ -600,7 +623,11 @@ class AccountService {
           console.error(`[accounts] Auto-refresh failed for ${acc.id}:`, e);
         }
       }
-    }, CHECK_INTERVAL_MS);
+    };
+
+    // Run immediately on startup, then every 5 minutes
+    refreshExpiring().catch(() => {});
+    this.refreshTimer = setInterval(refreshExpiring, CHECK_INTERVAL_MS);
 
     if (typeof this.refreshTimer === "object" && this.refreshTimer !== null && "unref" in this.refreshTimer) {
       (this.refreshTimer as NodeJS.Timeout).unref();