@indigoai-us/hq-cli 5.108.7 → 5.108.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +2 -0
- package/dist/lib/mesh/live/daemon/run.js +8 -7
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -64,17 +64,18 @@ export async function runMeshDaemon(deps = {}) {
|
|
|
64
64
|
}
|
|
65
65
|
writeDaemonState(dir, defaultDaemonState(lockDeps.pid, now));
|
|
66
66
|
log(dir, `daemon started pid=${lockDeps.pid}`);
|
|
67
|
-
let token;
|
|
68
67
|
// Opt into machine-credential minting when the box has creds (systemd exports
|
|
69
68
|
// HQ_MACHINE_CREDS_FILE). On a person laptop with no machine creds this falls
|
|
70
69
|
// through to the person login cache inside ensureCognitoToken.
|
|
70
|
+
//
|
|
71
|
+
// Resolve the token on EVERY use. ensureCognitoToken reads the on-disk cache
|
|
72
|
+
// and refreshes/mints when the token is near expiry, so this is cheap; a
|
|
73
|
+
// process-lifetime memo (the previous behaviour) handed a Cognito token that
|
|
74
|
+
// expires after ~1h to every vend/flush forever, so the second credential
|
|
75
|
+
// renewal (~96 min in) and everything after it failed with HTTP 401 and the
|
|
76
|
+
// daemon went dark once its IoT credentials expired.
|
|
71
77
|
const defaultGetToken = async () => ensureCognitoToken({ interactive: false, tokenSource: "machine" });
|
|
72
|
-
const getToken = deps.getToken ??
|
|
73
|
-
(async () => {
|
|
74
|
-
if (!token)
|
|
75
|
-
token = await defaultGetToken();
|
|
76
|
-
return token;
|
|
77
|
-
});
|
|
78
|
+
const getToken = deps.getToken ?? defaultGetToken;
|
|
78
79
|
const flushFn = deps.flush ??
|
|
79
80
|
(async () => {
|
|
80
81
|
const t = await getToken();
|