@hienlh/ppm 0.9.75 → 0.9.76

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.9.76] - 2026-04-09
+
+### Fixed
+- **Concurrent token refresh race**: Multiple sessions starting near-simultaneously all refreshed the same token. Removed redundant in-memory freshness check — `ensureFreshToken()` now re-reads from DB, so concurrent sessions see the already-refreshed token.
+
 ## [0.9.75] - 2026-04-09
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hienlh/ppm",
-  "version": "0.9.75",
+  "version": "0.9.76",
   "description": "Personal Project Manager — mobile-first web IDE with AI assistance",
   "author": "hienlh",
   "license": "MIT",

package/src/providers/claude-agent-sdk.ts

@@ -688,18 +688,9 @@ export class ClaudeAgentSdkProvider implements AIProvider {
           const expiresIn = account.expiresAt ? account.expiresAt - nowS : null;
           console.log(`[sdk] Using account ${account.id} (${account.email ?? "no-email"}) token_expires_in=${expiresIn}s`);
 
-          // Check if token needs refresh
-          const isOAuth = account.accessToken.startsWith("sk-ant-oat");
-          const needsRefresh = isOAuth && account.expiresAt && (account.expiresAt - nowS <= 3600);
-
-          if (!needsRefresh) {
-            // Token fresh or API key — proceed
-            yield { type: "account_info" as const, accountId: account.id, accountLabel };
-            break;
-          }
-
-          // Token expiring — attempt refresh
-          yield { type: "status_update" as const, phase: "refreshing" as const, message: `Refreshing token for ${accountLabel}...`, accountLabel };
+          // ensureFreshToken re-reads DB (picks up concurrent refreshes) and
+          // only refreshes if truly needed — safe to call unconditionally.
+          yield { type: "status_update" as const, phase: "refreshing" as const, message: `Checking token for ${accountLabel}...`, accountLabel };
           const fresh = await accountService.ensureFreshToken(account.id);
 
           if (fresh) {