@hienlh/ppm 0.8.21 → 0.8.23

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.8.23] - 2026-03-24
+
+### Fixed
+- **Stop disabling accounts on background refresh failure**: Startup and background auto-refresh no longer disable accounts when refresh fails — only actual query-time failures disable accounts. Prevents all accounts being disabled after server restart.
+- **Better refresh error logging**: Log response body from Anthropic when token refresh fails (was only logging status code)
+
+## [0.8.22] - 2026-03-24
+
+### Fixed
+- **OAuth pre-flight token refresh**: Check token freshness before each SDK query and refresh proactively if expired or expiring within 60s
+- **Auto-refresh on startup**: Run token refresh check immediately on server start instead of waiting 5 minutes for first interval
+- **OAuth auto-refresh on auth failure**: Automatically refresh expired OAuth token and retry when SDK returns `authentication_failed`, instead of just showing error to user
+
 ## [0.8.21] - 2026-03-24
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.8.21",
+  "version": "0.8.23",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/providers/claude-agent-sdk.ts

@@ -545,7 +545,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
       // Account-based auth injection (multi-account mode)
       // Fallback to existing env (ANTHROPIC_API_KEY) when no accounts configured.
       const accountsEnabled = accountSelector.isEnabled();
-      const account = accountsEnabled ? accountSelector.next() : null;
+      let account = accountsEnabled ? accountSelector.next() : null;
       if (accountsEnabled && !account) {
         // All accounts in DB but none usable
         const reason = accountSelector.lastFailReason;
@@ -557,7 +557,12 @@ export class ClaudeAgentSdkProvider implements AIProvider {
         yield { type: "done" as const, sessionId, resultSubtype: "error_auth" };
         return;
       }
+      // Pre-flight: ensure OAuth token is fresh before sending to SDK
       if (account) {
+        const fresh = await accountService.ensureFreshToken(account.id);
+        if (fresh) {
+          account = fresh;
+        }
         console.log(`[sdk] Using account ${account.id} (${account.email ?? "no-email"})`);
         yield { type: "account_info" as const, accountId: account.id, accountLabel: account.label ?? account.email ?? "Unknown" };
       }

package/src/services/account.service.ts

@@ -116,6 +116,29 @@ class AccountService {
     }
   }
 
+  /**
+   * Ensure the access token for an OAuth account is still fresh.
+   * If it's expired or about to expire (within 60s), refresh it proactively.
+   * Returns the refreshed account with fresh tokens, or null if refresh failed.
+   */
+  async ensureFreshToken(id: string): Promise<AccountWithTokens | null> {
+    const acc = this.getWithTokens(id);
+    if (!acc) return null;
+    // Only OAuth tokens need refresh
+    if (!acc.accessToken.startsWith("sk-ant-oat")) return acc;
+    if (!acc.expiresAt) return acc;
+    const nowS = Math.floor(Date.now() / 1000);
+    if (acc.expiresAt - nowS > 60) return acc; // still fresh
+    try {
+      console.log(`[accounts] Pre-flight refresh for ${acc.email ?? id} (expires in ${acc.expiresAt - nowS}s)`);
+      await this.refreshAccessToken(id, false);
+      return this.getWithTokens(id);
+    } catch (e) {
+      console.error(`[accounts] Pre-flight refresh failed for ${id}:`, e);
+      return null;
+    }
+  }
+
   /** Find existing account by email or profile UUID */
   private findDuplicate(email?: string | null, profileData?: OAuthProfileData | null): Account | null {
     if (!email && !profileData?.account?.uuid) return null;
@@ -479,7 +502,12 @@ class AccountService {
     };
   }
 
-  async refreshAccessToken(accountId: string): Promise<void> {
+  /**
+   * Refresh an OAuth access token using the stored refresh token.
+   * @param disableOnFail - if true, disable the account when refresh fails (default: true).
+   *   Background/startup refresh should pass false to avoid disabling accounts prematurely.
+   */
+  async refreshAccessToken(accountId: string, disableOnFail = true): Promise<void> {
     const account = this.getWithTokens(accountId);
     if (!account) throw new Error(`Account ${accountId} not found`);
     const res = await fetch(OAUTH_TOKEN_URL, {
@@ -492,14 +520,19 @@ class AccountService {
       }),
     });
     if (!res.ok) {
-      this.setDisabled(accountId);
-      throw new Error(`Token refresh failed for account ${accountId}: ${res.status}`);
+      const errorBody = await res.text().catch(() => "");
+      console.error(`[accounts] Refresh failed for ${accountId}: ${res.status} ${errorBody}`);
+      if (disableOnFail) {
+        this.setDisabled(accountId);
+      }
+      throw new Error(`Token refresh failed for account ${accountId}: ${res.status} ${errorBody}`);
     }
     const data = await res.json() as {
       access_token: string;
       refresh_token?: string;
       expires_in: number;
     };
+    console.log(`[accounts] Token refreshed for ${account.email ?? accountId} (expires_in=${data.expires_in}s, new_refresh=${!!data.refresh_token})`);
     this.updateTokens(
       accountId,
       data.access_token,
@@ -586,7 +619,7 @@ class AccountService {
     const CHECK_INTERVAL_MS = 5 * 60_000;
     const REFRESH_BUFFER_S = 5 * 60;
 
-    this.refreshTimer = setInterval(async () => {
+    const refreshExpiring = async () => {
       const accounts = this.list();
       const nowS = Math.floor(Date.now() / 1000);
       for (const acc of accounts) {
@@ -595,12 +628,16 @@ class AccountService {
         if (acc.expiresAt - nowS > REFRESH_BUFFER_S) continue;
         console.log(`[accounts] Auto-refreshing token for ${acc.email ?? acc.id}`);
         try {
-          await this.refreshAccessToken(acc.id);
+          await this.refreshAccessToken(acc.id, false);
         } catch (e) {
           console.error(`[accounts] Auto-refresh failed for ${acc.id}:`, e);
         }
       }
-    }, CHECK_INTERVAL_MS);
+    };
+
+    // Run immediately on startup, then every 5 minutes
+    refreshExpiring().catch(() => {});
+    this.refreshTimer = setInterval(refreshExpiring, CHECK_INTERVAL_MS);
 
     if (typeof this.refreshTimer === "object" && this.refreshTimer !== null && "unref" in this.refreshTimer) {
       (this.refreshTimer as NodeJS.Timeout).unref();