@implicit-ai/relay 0.0.3 → 0.0.6

package/dist/cli.js

@@ -25,24 +25,35 @@ function detectClaudeCodeInstalled() {
   }
 }
 function detectClaudeAuth() {
-  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) {
-    return { method: "oauth" };
+  const available = [];
+  if (hasOAuthCredentials()) available.push("oauth");
+  if (process.env.ANTHROPIC_API_KEY) available.push("api_key");
+  const preferApiKey = process.env.IMPLICIT_USE_API_KEY === "1";
+  let method;
+  if (preferApiKey && available.includes("api_key")) {
+    method = "api_key";
+  } else if (available.includes("oauth")) {
+    method = "oauth";
+  } else if (available.includes("api_key")) {
+    method = "api_key";
+  } else {
+    method = "none";
   }
-  if (process.env.ANTHROPIC_API_KEY) {
-    return { method: "api_key" };
+  let apiKeyOverridden = false;
+  if (method === "oauth" && process.env.ANTHROPIC_API_KEY) {
+    delete process.env.ANTHROPIC_API_KEY;
+    apiKeyOverridden = true;
   }
+  return { method, available, apiKeyOverridden };
+}
+function hasOAuthCredentials() {
+  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) return true;
   if (process.platform === "darwin") {
     const keychainServices = ["Claude Code-credentials", "claude.ai"];
     for (const service of keychainServices) {
       try {
-        const result = execaSync("security", [
-          "find-generic-password",
-          "-s",
-          service
-        ]);
-        if (result.exitCode === 0) {
-          return { method: "oauth" };
-        }
+        const result = execaSync("security", ["find-generic-password", "-s", service]);
+        if (result.exitCode === 0) return true;
       } catch {
       }
     }
@@ -52,13 +63,11 @@ function detectClaudeAuth() {
     if (fs.existsSync(credentialsPath)) {
       const raw = fs.readFileSync(credentialsPath, "utf-8");
       const parsed = JSON.parse(raw);
-      if (parsed !== null && typeof parsed === "object") {
-        return { method: "oauth" };
-      }
+      if (parsed !== null && typeof parsed === "object") return true;
     }
   } catch {
   }
-  return { method: "none" };
+  return false;
 }
 function printAuthGuidance() {
   console.log("Claude Code auth not found. To set up authentication:");
@@ -988,10 +997,13 @@ function truncateString(value, maxChars) {
 
 // src/lib/ably-transport.ts
 import Ably from "ably";
-import pino from "pino";
+import pino2 from "pino";
 
 // src/lib/auth-session.ts
+import { createHash } from "crypto";
 import { createClient, isAuthRetryableFetchError } from "@supabase/supabase-js";
+import pino from "pino";
+var log = pino({ name: "auth-session" });
 var SUPABASE_CONFIGS = {
   production: {
     url: "https://fqvwludchxxqfpvjzktf.supabase.co",
@@ -1003,6 +1015,10 @@ var SUPABASE_CONFIGS = {
   }
 };
 var REFRESH_SAFETY_MARGIN_MS = 6e4;
+function tokenFingerprint(token) {
+  if (!token) return "none";
+  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
 var NeedsRePairingError = class extends Error {
   constructor() {
     super("Your session has expired. Run `implicit pair` to re-authenticate.");
@@ -1015,16 +1031,50 @@ var TransientAuthError = class extends Error {
     this.name = "TransientAuthError";
   }
 };
+var inFlightRefresh = null;
 async function getFreshAccessToken() {
+  if (inFlightRefresh) {
+    log.debug("getFreshAccessToken: joining in-flight refresh");
+    return inFlightRefresh;
+  }
+  inFlightRefresh = doGetFreshAccessToken().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+async function doGetFreshAccessToken() {
   const auth = loadAuth();
   if (!auth || !auth.refreshToken) {
+    log.warn(
+      { hasAuth: !!auth, hasRefreshToken: !!auth?.refreshToken },
+      "getFreshAccessToken: no stored auth or missing refresh token \u2014 re-pair required"
+    );
     throw new NeedsRePairingError();
   }
-  if (Date.now() < auth.expiresAt - REFRESH_SAFETY_MARGIN_MS) {
+  const now = Date.now();
+  const env = auth.env ?? "production";
+  const rtFp = tokenFingerprint(auth.refreshToken);
+  const expiresInMs = auth.expiresAt - now;
+  const baseCtx = {
+    env,
+    userId: auth.userId,
+    refreshTokenFp: rtFp,
+    accessTokenExpiresAt: new Date(auth.expiresAt).toISOString(),
+    accessTokenExpiresInMs: expiresInMs
+  };
+  if (now < auth.expiresAt - REFRESH_SAFETY_MARGIN_MS) {
+    log.debug(baseCtx, "getFreshAccessToken: returning cached access token");
     return auth.accessToken;
   }
-  const { url, anonKey } = SUPABASE_CONFIGS[auth.env ?? "production"];
-  const supabase = createClient(url, anonKey);
+  log.info(baseCtx, "getFreshAccessToken: token within safety margin \u2014 calling supabase.refreshSession");
+  const { url, anonKey } = SUPABASE_CONFIGS[env];
+  const supabase = createClient(url, anonKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+      detectSessionInUrl: false
+    }
+  });
   let result;
   try {
     result = await supabase.auth.refreshSession({
@@ -1032,31 +1082,72 @@ async function getFreshAccessToken() {
     });
   } catch (err) {
     if (isAuthRetryableFetchError(err) || isNetworkLikeError(err)) {
+      log.warn(
+        { ...baseCtx, errMessage: err instanceof Error ? err.message : String(err) },
+        "refreshSession threw transient error \u2014 preserving auth"
+      );
       throw new TransientAuthError(
         `Network error refreshing session: ${err instanceof Error ? err.message : String(err)}`
       );
     }
+    log.error(
+      {
+        ...baseCtx,
+        errName: err instanceof Error ? err.name : "?",
+        errMessage: err instanceof Error ? err.message : String(err),
+        errStatus: err?.status ?? "?",
+        errCode: err?.code ?? "?"
+      },
+      "refreshSession threw non-retryable error \u2014 re-throwing (will NOT clear auth)"
+    );
     throw err;
   }
   const { data, error } = result;
   if (error) {
     if (isAuthRetryableFetchError(error) || isNetworkLikeError(error)) {
+      log.warn(
+        { ...baseCtx, errMessage: error.message },
+        "refreshSession returned transient error \u2014 preserving auth"
+      );
       throw new TransientAuthError(`Network error refreshing session: ${error.message}`);
     }
+    log.error(
+      {
+        ...baseCtx,
+        errStatus: error.status ?? "?",
+        errCode: error.code ?? "?",
+        errName: error.name ?? "?",
+        errMessage: error.message ?? "?"
+      },
+      "refreshSession rejected refresh_token \u2014 clearing auth, re-pair required"
+    );
     clearAuth();
     throw new NeedsRePairingError();
   }
   if (!data.session) {
+    log.error(baseCtx, "refreshSession returned no session \u2014 clearing auth, re-pair required");
     clearAuth();
     throw new NeedsRePairingError();
   }
+  const newExpiresAt = (data.session.expires_at ?? Math.floor(Date.now() / 1e3) + 3600) * 1e3;
   const newAuth = {
     ...auth,
     accessToken: data.session.access_token,
     refreshToken: data.session.refresh_token,
-    expiresAt: (data.session.expires_at ?? Math.floor(Date.now() / 1e3) + 3600) * 1e3
+    expiresAt: newExpiresAt
   };
   saveAuth(newAuth);
+  log.info(
+    {
+      env,
+      userId: auth.userId,
+      oldRefreshTokenFp: rtFp,
+      newRefreshTokenFp: tokenFingerprint(data.session.refresh_token),
+      rotated: rtFp !== tokenFingerprint(data.session.refresh_token),
+      newAccessTokenExpiresAt: new Date(newExpiresAt).toISOString()
+    },
+    "refreshSession succeeded \u2014 auth saved"
+  );
   return data.session.access_token;
 }
 function isNetworkLikeError(err) {
@@ -1099,7 +1190,7 @@ async function fetchAblyToken(opts) {
 }
 
 // src/lib/ably-transport.ts
-var log = pino({ name: "ably-transport" });
+var log2 = pino2({ name: "ably-transport" });
 var AblyTransport = class {
   railwayUrl;
   userId;
@@ -1111,6 +1202,8 @@ var AblyTransport = class {
   firstConnectDone = false;
   /** Guards against re-registering connection state listeners on reconnect. */
   connectionListenersWired = false;
+  /** Guards against re-registering channel state listeners across attach attempts. */
+  channelListenersWired = false;
   reconnectHandlers = [];
   errorHandlers = [];
   connectionStateHandlers = [];
@@ -1130,13 +1223,30 @@ var AblyTransport = class {
       this.realtime = null;
       this.channel = null;
     }
+    let authCallbackInvocations = 0;
     this.realtime = new Ably.Realtime({
       authCallback: async (_tokenParams, callback) => {
+        const invocation = ++authCallbackInvocations;
+        log2.info({ invocation, userId: this.userId }, "Ably authCallback fired");
         try {
           const tokenDetails = await fetchAblyToken({ railwayUrl, getAccessToken: this.getAccessToken });
+          log2.info(
+            { invocation, ablyTokenExpires: tokenDetails.expires ? new Date(tokenDetails.expires).toISOString() : "?" },
+            "Ably authCallback succeeded"
+          );
           callback(null, tokenDetails);
         } catch (err) {
-          if (err instanceof NeedsRePairingError) {
+          const isRepair = err instanceof NeedsRePairingError;
+          log2.error(
+            {
+              invocation,
+              isRepair,
+              errName: err instanceof Error ? err.name : "?",
+              errMessage: err instanceof Error ? err.message : String(err)
+            },
+            "Ably authCallback failed"
+          );
+          if (isRepair) {
             for (const h of this.errorHandlers) h(err.message);
           }
           callback(err instanceof Error ? err.message : String(err), null);
@@ -1146,42 +1256,93 @@ var AblyTransport = class {
     if (!this.connectionListenersWired) {
       this.connectionListenersWired = true;
       this.realtime.connection.on("connected", () => {
-        log.info("connection state: connected");
+        log2.info({ connectionId: this.realtime?.connection.id, connectionKey: this.realtime?.connection.key }, "connection state: connected");
         this._isConnected = true;
         if (this.firstConnectDone) {
-          log.info({ handlers: this.reconnectHandlers.length }, "reconnected \u2014 firing handlers");
+          log2.info({ handlers: this.reconnectHandlers.length }, "reconnected \u2014 firing handlers");
           for (const h of this.reconnectHandlers) h();
         }
         this.firstConnectDone = true;
         for (const h of this.connectionStateHandlers) h("connected");
       });
       this.realtime.connection.on("disconnected", (stateChange) => {
-        log.warn({ reason: stateChange?.reason?.message }, "connection state: disconnected");
+        log2.warn({ reason: stateChange?.reason?.message }, "connection state: disconnected");
         this._isConnected = false;
         for (const h of this.connectionStateHandlers) h("disconnected");
       });
       this.realtime.connection.on("failed", (stateChange) => {
         const msg = stateChange?.reason?.message ?? "Ably connection failed";
-        log.error({ reason: msg }, "connection state: failed");
+        log2.error({ reason: msg }, "connection state: failed");
         this._isConnected = false;
         for (const h of this.errorHandlers) h(msg);
         for (const h of this.connectionStateHandlers) h("failed");
       });
       this.realtime.connection.on("suspended", (stateChange) => {
         const msg = stateChange?.reason?.message ?? "Ably connection suspended";
-        log.warn({ reason: msg }, "connection state: suspended");
+        log2.warn({ reason: msg }, "connection state: suspended");
         this._isConnected = false;
         for (const h of this.errorHandlers) h(msg);
         for (const h of this.connectionStateHandlers) h("suspended");
       });
       this.realtime.connection.on("closed", () => {
-        log.info("connection state: closed");
+        log2.info("connection state: closed");
         this._isConnected = false;
         for (const h of this.connectionStateHandlers) h("closed");
       });
     }
     this.channel = this.realtime.channels.get(this.channelName);
-    await this.channel.attach();
+    if (!this.channelListenersWired) {
+      this.channelListenersWired = true;
+      const ch = this.channel;
+      ch.on("attached", (stateChange) => {
+        log2.info(
+          {
+            channel: this.channelName,
+            resumed: stateChange?.resumed,
+            hasBacklog: stateChange?.hasBacklog
+          },
+          "channel state: attached"
+        );
+      });
+      ch.on("failed", (stateChange) => {
+        log2.error(
+          { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
+          "channel state: failed"
+        );
+      });
+      ch.on("detached", (stateChange) => {
+        log2.warn(
+          { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
+          "channel state: detached"
+        );
+      });
+      ch.on("suspended", (stateChange) => {
+        log2.warn(
+          { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
+          "channel state: suspended"
+        );
+      });
+      ch.on("update", (stateChange) => {
+        log2.info(
+          {
+            channel: this.channelName,
+            current: stateChange?.current,
+            previous: stateChange?.previous,
+            reason: stateChange?.reason?.message
+          },
+          "channel state: update"
+        );
+      });
+    }
+    log2.info({ channel: this.channelName }, "attaching channel");
+    try {
+      await this.channel.attach();
+      log2.info({ channel: this.channelName, state: this.channel.state }, "attach() resolved");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log2.error({ channel: this.channelName, err: message }, "attach() rejected");
+      throw err;
+    }
     for (const { event, handler } of this.pendingSubscriptions) {
       this.channel.subscribe(event, (msg) => {
         handler(msg.data);
@@ -1240,8 +1401,15 @@ var AblyTransport = class {
   // --- Presence ---
   async presenceEnter(data) {
     if (!this.channel) throw new Error("AblyTransport: not connected \u2014 call connect() first");
-    log.info({ data }, "entering presence");
-    await this.channel.presence.enter(data);
+    log2.info({ data, channelState: this.channel.state }, "entering presence");
+    try {
+      await this.channel.presence.enter(data);
+      log2.info({ channel: this.channelName }, "presence.enter() resolved");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log2.error({ channel: this.channelName, err: message }, "presence.enter() rejected");
+      throw err;
+    }
   }
   async presenceLeave() {
     if (!this.channel) return;
@@ -1264,7 +1432,7 @@ var AblyTransport = class {
     }
     this.channel.presence.subscribe("enter", (msg) => {
       const clientId = msg.clientId ?? "unknown";
-      log.info({ clientId }, "presence enter");
+      log2.info({ clientId }, "presence enter");
       handler({ clientId, data: msg.data ?? {} });
     });
   }
@@ -1275,21 +1443,21 @@ var AblyTransport = class {
     }
     this.channel.presence.subscribe("leave", (msg) => {
       const clientId = msg.clientId ?? "unknown";
-      log.info({ clientId }, "presence leave");
+      log2.info({ clientId }, "presence leave");
       handler({ clientId, data: msg.data ?? {} });
     });
   }
   // --- History ---
   async fetchHistory(limit) {
     if (!this.channel) throw new Error("AblyTransport: not connected");
-    log.info({ limit }, "fetching channel history");
+    log2.info({ limit }, "fetching channel history");
     const result = await this.channel.history({ limit, direction: "backwards" });
     const messages = (result.items ?? []).map((msg) => ({
       event: msg.name ?? "",
       data: msg.data ?? {},
       timestamp: msg.timestamp ?? 0
     }));
-    log.info({ count: messages.length }, "history fetched");
+    log2.info({ count: messages.length }, "history fetched");
     return messages;
   }
 };
@@ -1324,7 +1492,17 @@ async function connect(options) {
     printAuthGuidance();
     process.exit(1);
   }
-  if (!isHeadless) console.log(`  \u2713 Claude auth detected (${claudeAuth.method})`);
+  if (!isHeadless) {
+    console.log(`  \u2713 Claude auth detected (${claudeAuth.method})`);
+    if (claudeAuth.apiKeyOverridden) {
+      console.log(
+        "    \u21B3 ANTHROPIC_API_KEY found but ignored \u2014 using Claude Pro/Max OAuth."
+      );
+      console.log(
+        "      Set IMPLICIT_USE_API_KEY=1 to bill via API instead."
+      );
+    }
+  }
   let auth = options.token ? authFromAccessToken(options.token, env) : loadAuth();
   if (!auth) {
     if (isHeadless) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@implicit-ai/relay",
-  "version": "0.0.3",
+  "version": "0.0.6",
   "description": "Control Claude Code from your phone with Implicit",
   "type": "module",
   "bin": {