@implicit-ai/relay 0.0.4 → 0.0.6

package/dist/cli.js

@@ -997,10 +997,13 @@ function truncateString(value, maxChars) {
 
 // src/lib/ably-transport.ts
 import Ably from "ably";
-import pino from "pino";
+import pino2 from "pino";
 
 // src/lib/auth-session.ts
+import { createHash } from "crypto";
 import { createClient, isAuthRetryableFetchError } from "@supabase/supabase-js";
+import pino from "pino";
+var log = pino({ name: "auth-session" });
 var SUPABASE_CONFIGS = {
   production: {
     url: "https://fqvwludchxxqfpvjzktf.supabase.co",
@@ -1012,6 +1015,10 @@ var SUPABASE_CONFIGS = {
   }
 };
 var REFRESH_SAFETY_MARGIN_MS = 6e4;
+function tokenFingerprint(token) {
+  if (!token) return "none";
+  return createHash("sha256").update(token).digest("hex").slice(0, 12);
+}
 var NeedsRePairingError = class extends Error {
   constructor() {
     super("Your session has expired. Run `implicit pair` to re-authenticate.");
@@ -1024,16 +1031,50 @@ var TransientAuthError = class extends Error {
     this.name = "TransientAuthError";
   }
 };
+var inFlightRefresh = null;
 async function getFreshAccessToken() {
+  if (inFlightRefresh) {
+    log.debug("getFreshAccessToken: joining in-flight refresh");
+    return inFlightRefresh;
+  }
+  inFlightRefresh = doGetFreshAccessToken().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+async function doGetFreshAccessToken() {
   const auth = loadAuth();
   if (!auth || !auth.refreshToken) {
+    log.warn(
+      { hasAuth: !!auth, hasRefreshToken: !!auth?.refreshToken },
+      "getFreshAccessToken: no stored auth or missing refresh token \u2014 re-pair required"
+    );
     throw new NeedsRePairingError();
   }
-  if (Date.now() < auth.expiresAt - REFRESH_SAFETY_MARGIN_MS) {
+  const now = Date.now();
+  const env = auth.env ?? "production";
+  const rtFp = tokenFingerprint(auth.refreshToken);
+  const expiresInMs = auth.expiresAt - now;
+  const baseCtx = {
+    env,
+    userId: auth.userId,
+    refreshTokenFp: rtFp,
+    accessTokenExpiresAt: new Date(auth.expiresAt).toISOString(),
+    accessTokenExpiresInMs: expiresInMs
+  };
+  if (now < auth.expiresAt - REFRESH_SAFETY_MARGIN_MS) {
+    log.debug(baseCtx, "getFreshAccessToken: returning cached access token");
     return auth.accessToken;
   }
-  const { url, anonKey } = SUPABASE_CONFIGS[auth.env ?? "production"];
-  const supabase = createClient(url, anonKey);
+  log.info(baseCtx, "getFreshAccessToken: token within safety margin \u2014 calling supabase.refreshSession");
+  const { url, anonKey } = SUPABASE_CONFIGS[env];
+  const supabase = createClient(url, anonKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+      detectSessionInUrl: false
+    }
+  });
   let result;
   try {
     result = await supabase.auth.refreshSession({
@@ -1041,31 +1082,72 @@ async function getFreshAccessToken() {
     });
   } catch (err) {
     if (isAuthRetryableFetchError(err) || isNetworkLikeError(err)) {
+      log.warn(
+        { ...baseCtx, errMessage: err instanceof Error ? err.message : String(err) },
+        "refreshSession threw transient error \u2014 preserving auth"
+      );
       throw new TransientAuthError(
         `Network error refreshing session: ${err instanceof Error ? err.message : String(err)}`
       );
     }
+    log.error(
+      {
+        ...baseCtx,
+        errName: err instanceof Error ? err.name : "?",
+        errMessage: err instanceof Error ? err.message : String(err),
+        errStatus: err?.status ?? "?",
+        errCode: err?.code ?? "?"
+      },
+      "refreshSession threw non-retryable error \u2014 re-throwing (will NOT clear auth)"
+    );
     throw err;
   }
   const { data, error } = result;
   if (error) {
     if (isAuthRetryableFetchError(error) || isNetworkLikeError(error)) {
+      log.warn(
+        { ...baseCtx, errMessage: error.message },
+        "refreshSession returned transient error \u2014 preserving auth"
+      );
       throw new TransientAuthError(`Network error refreshing session: ${error.message}`);
     }
+    log.error(
+      {
+        ...baseCtx,
+        errStatus: error.status ?? "?",
+        errCode: error.code ?? "?",
+        errName: error.name ?? "?",
+        errMessage: error.message ?? "?"
+      },
+      "refreshSession rejected refresh_token \u2014 clearing auth, re-pair required"
+    );
     clearAuth();
     throw new NeedsRePairingError();
   }
   if (!data.session) {
+    log.error(baseCtx, "refreshSession returned no session \u2014 clearing auth, re-pair required");
     clearAuth();
     throw new NeedsRePairingError();
   }
+  const newExpiresAt = (data.session.expires_at ?? Math.floor(Date.now() / 1e3) + 3600) * 1e3;
   const newAuth = {
     ...auth,
     accessToken: data.session.access_token,
     refreshToken: data.session.refresh_token,
-    expiresAt: (data.session.expires_at ?? Math.floor(Date.now() / 1e3) + 3600) * 1e3
+    expiresAt: newExpiresAt
   };
   saveAuth(newAuth);
+  log.info(
+    {
+      env,
+      userId: auth.userId,
+      oldRefreshTokenFp: rtFp,
+      newRefreshTokenFp: tokenFingerprint(data.session.refresh_token),
+      rotated: rtFp !== tokenFingerprint(data.session.refresh_token),
+      newAccessTokenExpiresAt: new Date(newExpiresAt).toISOString()
+    },
+    "refreshSession succeeded \u2014 auth saved"
+  );
   return data.session.access_token;
 }
 function isNetworkLikeError(err) {
@@ -1108,7 +1190,7 @@ async function fetchAblyToken(opts) {
 }
 
 // src/lib/ably-transport.ts
-var log = pino({ name: "ably-transport" });
+var log2 = pino2({ name: "ably-transport" });
 var AblyTransport = class {
   railwayUrl;
   userId;
@@ -1141,13 +1223,30 @@ var AblyTransport = class {
       this.realtime = null;
       this.channel = null;
     }
+    let authCallbackInvocations = 0;
     this.realtime = new Ably.Realtime({
       authCallback: async (_tokenParams, callback) => {
+        const invocation = ++authCallbackInvocations;
+        log2.info({ invocation, userId: this.userId }, "Ably authCallback fired");
         try {
           const tokenDetails = await fetchAblyToken({ railwayUrl, getAccessToken: this.getAccessToken });
+          log2.info(
+            { invocation, ablyTokenExpires: tokenDetails.expires ? new Date(tokenDetails.expires).toISOString() : "?" },
+            "Ably authCallback succeeded"
+          );
           callback(null, tokenDetails);
         } catch (err) {
-          if (err instanceof NeedsRePairingError) {
+          const isRepair = err instanceof NeedsRePairingError;
+          log2.error(
+            {
+              invocation,
+              isRepair,
+              errName: err instanceof Error ? err.name : "?",
+              errMessage: err instanceof Error ? err.message : String(err)
+            },
+            "Ably authCallback failed"
+          );
+          if (isRepair) {
             for (const h of this.errorHandlers) h(err.message);
           }
           callback(err instanceof Error ? err.message : String(err), null);
@@ -1157,36 +1256,36 @@ var AblyTransport = class {
     if (!this.connectionListenersWired) {
       this.connectionListenersWired = true;
       this.realtime.connection.on("connected", () => {
-        log.info({ connectionId: this.realtime?.connection.id, connectionKey: this.realtime?.connection.key }, "connection state: connected");
+        log2.info({ connectionId: this.realtime?.connection.id, connectionKey: this.realtime?.connection.key }, "connection state: connected");
         this._isConnected = true;
         if (this.firstConnectDone) {
-          log.info({ handlers: this.reconnectHandlers.length }, "reconnected \u2014 firing handlers");
+          log2.info({ handlers: this.reconnectHandlers.length }, "reconnected \u2014 firing handlers");
           for (const h of this.reconnectHandlers) h();
         }
         this.firstConnectDone = true;
         for (const h of this.connectionStateHandlers) h("connected");
       });
       this.realtime.connection.on("disconnected", (stateChange) => {
-        log.warn({ reason: stateChange?.reason?.message }, "connection state: disconnected");
+        log2.warn({ reason: stateChange?.reason?.message }, "connection state: disconnected");
         this._isConnected = false;
         for (const h of this.connectionStateHandlers) h("disconnected");
       });
       this.realtime.connection.on("failed", (stateChange) => {
         const msg = stateChange?.reason?.message ?? "Ably connection failed";
-        log.error({ reason: msg }, "connection state: failed");
+        log2.error({ reason: msg }, "connection state: failed");
         this._isConnected = false;
         for (const h of this.errorHandlers) h(msg);
         for (const h of this.connectionStateHandlers) h("failed");
       });
       this.realtime.connection.on("suspended", (stateChange) => {
         const msg = stateChange?.reason?.message ?? "Ably connection suspended";
-        log.warn({ reason: msg }, "connection state: suspended");
+        log2.warn({ reason: msg }, "connection state: suspended");
         this._isConnected = false;
         for (const h of this.errorHandlers) h(msg);
         for (const h of this.connectionStateHandlers) h("suspended");
       });
       this.realtime.connection.on("closed", () => {
-        log.info("connection state: closed");
+        log2.info("connection state: closed");
         this._isConnected = false;
         for (const h of this.connectionStateHandlers) h("closed");
       });
@@ -1196,7 +1295,7 @@ var AblyTransport = class {
       this.channelListenersWired = true;
       const ch = this.channel;
       ch.on("attached", (stateChange) => {
-        log.info(
+        log2.info(
           {
             channel: this.channelName,
             resumed: stateChange?.resumed,
@@ -1206,25 +1305,25 @@ var AblyTransport = class {
         );
       });
       ch.on("failed", (stateChange) => {
-        log.error(
+        log2.error(
           { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
           "channel state: failed"
         );
       });
       ch.on("detached", (stateChange) => {
-        log.warn(
+        log2.warn(
           { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
           "channel state: detached"
         );
       });
       ch.on("suspended", (stateChange) => {
-        log.warn(
+        log2.warn(
           { channel: this.channelName, reason: stateChange?.reason?.message, code: stateChange?.reason?.code },
           "channel state: suspended"
         );
       });
       ch.on("update", (stateChange) => {
-        log.info(
+        log2.info(
           {
             channel: this.channelName,
             current: stateChange?.current,
@@ -1235,13 +1334,13 @@ var AblyTransport = class {
         );
       });
     }
-    log.info({ channel: this.channelName }, "attaching channel");
+    log2.info({ channel: this.channelName }, "attaching channel");
     try {
       await this.channel.attach();
-      log.info({ channel: this.channelName, state: this.channel.state }, "attach() resolved");
+      log2.info({ channel: this.channelName, state: this.channel.state }, "attach() resolved");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log.error({ channel: this.channelName, err: message }, "attach() rejected");
+      log2.error({ channel: this.channelName, err: message }, "attach() rejected");
       throw err;
     }
     for (const { event, handler } of this.pendingSubscriptions) {
@@ -1302,13 +1401,13 @@ var AblyTransport = class {
   // --- Presence ---
   async presenceEnter(data) {
     if (!this.channel) throw new Error("AblyTransport: not connected \u2014 call connect() first");
-    log.info({ data, channelState: this.channel.state }, "entering presence");
+    log2.info({ data, channelState: this.channel.state }, "entering presence");
     try {
       await this.channel.presence.enter(data);
-      log.info({ channel: this.channelName }, "presence.enter() resolved");
+      log2.info({ channel: this.channelName }, "presence.enter() resolved");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      log.error({ channel: this.channelName, err: message }, "presence.enter() rejected");
+      log2.error({ channel: this.channelName, err: message }, "presence.enter() rejected");
       throw err;
     }
   }
@@ -1333,7 +1432,7 @@ var AblyTransport = class {
     }
     this.channel.presence.subscribe("enter", (msg) => {
       const clientId = msg.clientId ?? "unknown";
-      log.info({ clientId }, "presence enter");
+      log2.info({ clientId }, "presence enter");
       handler({ clientId, data: msg.data ?? {} });
     });
   }
@@ -1344,21 +1443,21 @@ var AblyTransport = class {
     }
     this.channel.presence.subscribe("leave", (msg) => {
       const clientId = msg.clientId ?? "unknown";
-      log.info({ clientId }, "presence leave");
+      log2.info({ clientId }, "presence leave");
       handler({ clientId, data: msg.data ?? {} });
     });
   }
   // --- History ---
   async fetchHistory(limit) {
     if (!this.channel) throw new Error("AblyTransport: not connected");
-    log.info({ limit }, "fetching channel history");
+    log2.info({ limit }, "fetching channel history");
     const result = await this.channel.history({ limit, direction: "backwards" });
     const messages = (result.items ?? []).map((msg) => ({
       event: msg.name ?? "",
       data: msg.data ?? {},
       timestamp: msg.timestamp ?? 0
     }));
-    log.info({ count: messages.length }, "history fetched");
+    log2.info({ count: messages.length }, "history fetched");
     return messages;
   }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@implicit-ai/relay",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Control Claude Code from your phone with Implicit",
   "type": "module",
   "bin": {