@hienlh/ppm 0.8.46 → 0.8.48

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.8.48] - 2026-03-25
+
+### Fixed
+- **Account auth errors**: Use cooldown instead of permanent disable on `authentication_failed` / 401 — auth issues can be transient (subscription lapse, org changes, API hiccups)
+- **SDK refresh safety**: Pass `disableOnFail=false` in SDK error handlers — prevents `refreshAccessToken` from disabling accounts as side effect during auto-retry
+
+## [0.8.47] - 2026-03-25
+
+### Fixed
+- **Usage polling**: Use `ensureFreshToken()` in background usage poll — prevents 401 from expired tokens causing auto-fetch to always fail
+- **Temp accounts**: Don't auto-disable temporary accounts (no refresh token) when token expires — they now expire naturally and get cleaned up after 7 days
+- **Account export**: `refreshBeforeExport` no longer disables accounts as a side effect on refresh failure
+
 ## [0.8.46] - 2026-03-25
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.8.46",
+  "version": "0.8.48",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/providers/claude-agent-sdk.ts

@@ -611,7 +611,7 @@ export class ClaudeAgentSdkProvider implements AIProvider {
             if (assistantError === "authentication_failed" && account && !authRetried) {
               authRetried = true;
               try {
-                await accountService.refreshAccessToken(account.id);
+                await accountService.refreshAccessToken(account.id, false);
                 console.log(`[sdk] session=${sessionId} OAuth token refreshed for ${account.id} — retrying`);
                 // Re-build env with refreshed token
                 const refreshedAccount = accountService.getWithTokens(account.id);
@@ -628,7 +628,9 @@ export class ClaudeAgentSdkProvider implements AIProvider {
                 }
               } catch (refreshErr) {
                 console.error(`[sdk] session=${sessionId} OAuth refresh failed:`, refreshErr);
-                accountSelector.onAuthError(account.id);
+                // Cooldown instead of permanent disable — auth issues can be transient
+                // (subscription lapse, org changes, API hiccups)
+                accountSelector.onRateLimit(account.id);
               }
             }
 
@@ -699,10 +701,11 @@ export class ClaudeAgentSdkProvider implements AIProvider {
             } else if (errCode === 401) {
               // Try refresh once
               try {
-                await accountService.refreshAccessToken(account.id);
+                await accountService.refreshAccessToken(account.id, false);
                 console.log(`[sdk] 401 on account ${account.id} — token refreshed`);
               } catch {
-                accountSelector.onAuthError(account.id);
+                // Cooldown instead of permanent disable — auth issues can be transient
+                accountSelector.onRateLimit(account.id);
               }
             } else {
               accountSelector.onSuccess(account.id);

package/src/services/account.service.ts

@@ -571,7 +571,7 @@ class AccountService {
       if (!acc.accessToken.startsWith("sk-ant-oat")) continue;
       if (!acc.expiresAt) continue;
       try {
-        await this.refreshAccessToken(acc.id);
+        await this.refreshAccessToken(acc.id, false);
       } catch {
         // Best-effort — skip accounts whose refresh token is already invalid
       }

package/src/services/claude-usage.service.ts

@@ -174,7 +174,8 @@ async function fetchAllAccountUsages(): Promise<void> {
     if (acc.status === "disabled") continue;
     // Skip expired temporary accounts (no refresh token)
     if (!accountService.hasRefreshToken(acc.id) && acc.expiresAt && acc.expiresAt < nowS) continue;
-    const withTokens = accountService.getWithTokens(acc.id);
+    // Ensure token is fresh before calling usage API (prevents 401 from expired tokens)
+    const withTokens = await accountService.ensureFreshToken(acc.id);
     if (!withTokens) continue;
     const token = withTokens.accessToken;
     // Only OAuth tokens have usage endpoint