@llamaventures/cli 2.5.1 → 2.5.2

package/CHANGELOG.md

@@ -6,6 +6,16 @@ this project adheres to [Semantic Versioning](https://semver.org).
 
 ## [Unreleased]
 
+### Fixed
+
+- Renew rejected OAuth access credentials even when the cached expiry is still
+  in the future; concurrent requests reuse one renewed credential.
+- Request browser sign-in when authorization expires or is revoked, and retain
+  the selected OAuth identity instead of falling back to another credential.
+- Validate callback state on denial and escape browser callback error text.
+- Document automatic renewal and the server's fixed 90-day authorization policy.
+
+
 ## [2.5.1] - 2026-09-28
 
 ### Fixed

package/README.md

@@ -6,6 +6,13 @@ CLI 2 replaces the split Deal command surface with exactly four actions. Core
 owns database writes, Drive provisioning, audit Events, provenance, and
 idempotency. Agents never touch PostgreSQL directly.
 
+Sign in with `llama auth login`: approve access in your browser; the CLI stores
+credentials in the OS credential store when available and renews them automatically.
+New CLI browser authorizations last up to 90 days, then require another browser
+sign-in. Logout, administrator revocation, or account deactivation can end access
+sooner. On systems without a credential store, credentials are stored in a local
+file readable only by your user.
+
 ## Install or upgrade
 
 ```bash

package/README.zh-CN.md

@@ -5,6 +5,11 @@
 CLI 2 不再保留分裂的 Deal 命令。Core 负责数据库写入、Google Drive
 文件夹、Event、provenance 和幂等；Agent 不直接操作 PostgreSQL。
 
+运行 `llama auth login`，在浏览器中确认授权。CLI 优先使用系统钥匙串保存凭证，
+并自动续期；新 CLI 浏览器授权最多持续 90 天，之后需要重新在浏览器登录。
+退出登录、管理员撤销或账号停用可提前终止访问。没有系统钥匙串时，凭证保存在
+仅当前用户可读的本地文件中。
+
 ## 安装或升级
 
 ```bash

package/lib/build-manifest.json

@@ -1,8 +1,8 @@
 {
   "format": "llama.cli-build.v1",
   "packageName": "@llamaventures/cli",
-  "packageVersion": "2.5.1",
-  "sourceSha": "217090ff9e72abff0a7b9b220016f5638b3d925f",
+  "packageVersion": "2.5.2",
+  "sourceSha": "9acf49a35f9f08b75d844df906cf0744281e9870",
   "sourceKind": "github",
   "sourceDirty": false,
   "coreApiContract": {

package/lib/client.mjs

@@ -459,7 +459,8 @@ export async function getAuthHeaders() {
   try {
     const { getValidAccessToken } = await import("./oauth-refresh.mjs");
     oauthAccess = await getValidAccessToken();
-  } catch {
+  } catch (error) {
+    if (/^Error\[OAUTH_(REAUTH_REQUIRED|REFRESH_FAILED)\]/.test(error?.message ?? "")) throw error;
     // OAuth modules failed to load (e.g. keyring native binding missing
     // on this platform) — fall through to gcloud / PAT silently.
   }
@@ -470,7 +471,7 @@ export async function getAuthHeaders() {
     if (bearer) headers["Authorization"] = `Bearer ${bearer}`;
   }
   const token = getToken();
-  if (token) headers["X-Llama-Token"] = token;
+  if (token && !oauthAccess) headers["X-Llama-Token"] = token;
   return headers;
 }
 
@@ -630,8 +631,9 @@ async function requestWithRetry(method, endpoint, body, opts, allowRetry) {
     let refreshed = null;
     try {
       const { forceRefresh } = await import("./oauth-refresh.mjs");
-      refreshed = await forceRefresh();
-    } catch {
+      refreshed = await forceRefresh(authHeaders.Authorization?.replace(/^Bearer /, ""));
+    } catch (error) {
+      if (/^Error\[OAUTH_(REAUTH_REQUIRED|REFRESH_FAILED)\]/.test(error?.message ?? "")) throw error;
       refreshed = null;
     }
     if (refreshed) {
@@ -700,8 +702,9 @@ async function requestSseWithRetry(method, endpoint, body, opts, allowRetry) {
     let refreshed = null;
     try {
       const { forceRefresh } = await import("./oauth-refresh.mjs");
-      refreshed = await forceRefresh();
-    } catch {
+      refreshed = await forceRefresh(authHeaders.Authorization?.replace(/^Bearer /, ""));
+    } catch (error) {
+      if (/^Error\[OAUTH_(REAUTH_REQUIRED|REFRESH_FAILED)\]/.test(error?.message ?? "")) throw error;
       refreshed = null;
     }
     if (refreshed) {

package/lib/oauth-flow.mjs

@@ -63,7 +63,9 @@ function openBrowser(url) {
     args = [url];
   }
   try {
-    spawn(cmd, args, { detached: true, stdio: "ignore" }).unref();
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {}); // The printed URL remains available for manual sign-in.
+    child.unref();
   } catch {
     // Best-effort — if we can't open the browser, the user can copy the
     // URL from stderr. The loopback server keeps listening either way.
@@ -79,6 +81,9 @@ function respondHtml(res, ok, message) {
   const title = ok ? "Llama CLI — Signed in" : "Llama CLI — Sign-in failed";
   res.statusCode = ok ? 200 : 400;
   res.setHeader("Content-Type", "text/html; charset=utf-8");
+  const safeMessage = message.replace(/[&<>"']/g, (c) => ({
+    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
+  })[c]);
   res.end(`<!doctype html>
 <html><head><meta charset="utf-8"><title>${title}</title>
 <style>
@@ -90,7 +95,7 @@ function respondHtml(res, ok, message) {
   h1 { margin: 0 0 12px; font-size: 18px; color: ${color}; }
   p  { margin: 0; color: #57534e; font-size: 14px; }
 </style></head><body>
-<div class="card"><h1>${title}</h1><p>${message}</p></div>
+<div class="card"><h1>${title}</h1><p>${safeMessage}</p></div>
 </body></html>`);
 }
 
@@ -103,11 +108,11 @@ function respondHtml(res, ok, message) {
  *
  * @param {Object} opts
  * @param {string} opts.baseUrl   AS issuer (e.g. https://command.llamaventures.vc)
- * @param {string} opts.scope     Space-separated scope request (e.g. "read write")
+ * @param {string} opts.scope     Space-separated scopes, such as read and write
  * @param {string} opts.resource  RFC 8707 audience the access token will bind to
  * @returns {Promise<Object>}     {access_token, refresh_token, expires_in, scope, token_type, redirect_uri}
  */
-export async function pkceLoopbackFlow({ baseUrl, scope, resource }) {
+export async function pkceLoopbackFlow({ baseUrl, scope, resource, launchBrowser = openBrowser }) {
   const verifier = generateVerifier();
   const challenge = challengeFor(verifier);
   const state = base64url(randomBytes(16));
@@ -143,18 +148,18 @@ export async function pkceLoopbackFlow({ baseUrl, scope, resource }) {
       const error = url.searchParams.get("error");
       const errorDescription = url.searchParams.get("error_description") ?? "";
 
-      if (error) {
-        respondHtml(res, false, `${error}: ${errorDescription}`);
+      if (respState !== state) {
+        respondHtml(res, false, "state parameter mismatch (CSRF defense)");
         clearTimeout(timeoutId);
         server.close();
-        reject(new Error(`Error[OAUTH_DENIED]: ${error} — ${errorDescription}`));
+        reject(new Error("Error[OAUTH_BAD_STATE]: state mismatch — possible CSRF or stale callback"));
         return;
       }
-      if (respState !== state) {
-        respondHtml(res, false, "state parameter mismatch (CSRF defense)");
+      if (error) {
+        respondHtml(res, false, `${error}: ${errorDescription}`);
         clearTimeout(timeoutId);
         server.close();
-        reject(new Error("Error[OAUTH_BAD_STATE]: state mismatch — possible CSRF or stale callback"));
+        reject(new Error(`Error[OAUTH_DENIED]: ${error} — ${errorDescription}`));
         return;
       }
       if (!code) {
@@ -165,7 +170,7 @@ export async function pkceLoopbackFlow({ baseUrl, scope, resource }) {
         return;
       }
 
-      respondHtml(res, true, "You can close this window and return to the terminal.");
+      respondHtml(res, true, "Authorization received. Return to the terminal to confirm sign-in completed.");
       clearTimeout(timeoutId);
       server.close();
       resolve(code);
@@ -186,7 +191,7 @@ export async function pkceLoopbackFlow({ baseUrl, scope, resource }) {
 
   console.error(`Opening browser to ${baseUrl} for sign-in...`);
   console.error(`(If the browser does not open, visit this URL manually:\n  ${authorizeUrl.toString()}\n)`);
-  openBrowser(authorizeUrl.toString());
+  launchBrowser(authorizeUrl.toString());
 
   const code = await codePromise;
 

package/lib/oauth-refresh.mjs

@@ -13,75 +13,77 @@
 import { LLAMA_CLI_CLIENT_ID } from "./oauth-flow.mjs";
 import { readBundle, withRefreshLock, writeBundle } from "./oauth-storage.mjs";
 
-const ACCESS_TOKEN_SKEW_MS = 30_000; // refresh proactively 30s before expiry
+const ACCESS_TOKEN_SKEW_MS = 30_000;
 
-/**
- * Returns the current access token if non-expired, else attempts
- * refresh. Returns null if no bundle is stored, refresh fails, or the
- * refresh token itself is expired/revoked (caller should fall through
- * to the next auth method or surface NO_AUTH).
- */
-export async function getValidAccessToken() {
-  const bundle = await readBundle();
-  if (!bundle?.access_token) return null;
-  if (bundle.expires_at - Date.now() > ACCESS_TOKEN_SKEW_MS) {
-    return bundle.access_token;
+// The manager keeps credential I/O separate so renewal can be verified without
+// accessing a user's keychain or sending requests to a production issuer.
+export function createOAuthTokenManager({ readBundle, writeBundle, withRefreshLock, fetch }) {
+  async function getValidAccessToken() {
+    const bundle = await readBundle();
+    if (!bundle?.access_token) return null;
+    if (bundle.expires_at - Date.now() > ACCESS_TOKEN_SKEW_MS) return bundle.access_token;
+    return refreshUnderLock();
   }
-  // Near or past expiry — refresh under lock.
-  return refreshUnderLock();
-}
-
-/**
- * Force a refresh regardless of expiry. Used by client.mjs on a 401
- * with an OAuth bundle present (the access token may have been revoked
- * server-side, in which case the refresh might still work).
- */
-export async function forceRefresh() {
-  return refreshUnderLock();
-}
-
-async function refreshUnderLock() {
-  return withRefreshLock(async () => {
-    // Re-read inside the lock — another shell may have refreshed already.
-    const fresh = await readBundle();
-    if (!fresh?.refresh_token) return null;
-    if (fresh.expires_at - Date.now() > ACCESS_TOKEN_SKEW_MS) {
-      // Another shell already refreshed; we're good.
-      return fresh.access_token;
-    }
-    return performRefresh(fresh);
-  });
-}
-
-async function performRefresh(bundle) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: bundle.refresh_token,
-    client_id: bundle.client_id ?? LLAMA_CLI_CLIENT_ID,
-    resource: bundle.resource,
-  }).toString();
 
-  const res = await fetch(`${bundle.issuer}/api/oauth/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body,
-  });
-  if (!res.ok) {
-    // Refresh failed — most likely refresh expired or grant was revoked.
-    // Don't delete the bundle automatically; the user might want to
-    // inspect it or `llama auth logout` themselves to clear it.
-    return null;
+  async function forceRefresh(rejectedAccessToken) {
+    const rejected = rejectedAccessToken ?? (await readBundle())?.access_token;
+    return refreshUnderLock(rejected);
   }
-  const json = await res.json().catch(() => null);
-  if (!json?.access_token || !json?.refresh_token) return null;
 
-  const newBundle = {
-    ...bundle,
-    access_token: json.access_token,
-    refresh_token: json.refresh_token,
-    expires_at: Date.now() + (json.expires_in ?? 3600) * 1000,
-    scope: json.scope ?? bundle.scope,
-  };
-  await writeBundle(newBundle);
-  return newBundle.access_token;
+  async function refreshUnderLock(rejectedAccessToken) {
+    return withRefreshLock(async () => {
+      const fresh = await readBundle();
+      if (!fresh?.refresh_token) return null;
+      // Reuse a token renewed by another process, but never retry the token
+      // the API just rejected merely because its local expiry is in the future.
+      if (fresh.expires_at - Date.now() > ACCESS_TOKEN_SKEW_MS &&
+          (!rejectedAccessToken || fresh.access_token !== rejectedAccessToken)) {
+        return fresh.access_token;
+      }
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: fresh.refresh_token,
+        client_id: fresh.client_id ?? LLAMA_CLI_CLIENT_ID,
+        resource: fresh.resource,
+      }).toString();
+      let res;
+      try {
+        // @core-api-operation POST /api/oauth/token
+        res = await fetch(`${fresh.issuer}/api/oauth/token`, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body,
+        });
+      } catch {
+        throw new Error("Error[OAUTH_REFRESH_FAILED]: Could not reach the authorization server. Retry the command.");
+      }
+      const json = await res.json().catch(() => null);
+      if (!res.ok) {
+        if (json?.error === "invalid_grant") {
+          throw new Error("Error[OAUTH_REAUTH_REQUIRED]: Authorization expired or was revoked. Run `llama auth login` to sign in again in your browser.");
+        }
+        throw new Error(`Error[OAUTH_REFRESH_FAILED]: Could not renew authorization (HTTP ${res.status}). Retry the command.`);
+      }
+      if (!json?.access_token || !json?.refresh_token) {
+        throw new Error("Error[OAUTH_REFRESH_FAILED]: Invalid token response. Retry the command.");
+      }
+      const newBundle = {
+        ...fresh,
+        access_token: json.access_token,
+        refresh_token: json.refresh_token,
+        expires_at: Date.now() + (json.expires_in ?? 3600) * 1000,
+        scope: json.scope ?? fresh.scope,
+      };
+      await writeBundle(newBundle);
+      return newBundle.access_token;
+    });
+  }
+  return { getValidAccessToken, forceRefresh };
 }
+
+const manager = createOAuthTokenManager({
+  readBundle, writeBundle, withRefreshLock,
+  fetch: globalThis.fetch.bind(globalThis),
+});
+export const getValidAccessToken = manager.getValidAccessToken;
+export const forceRefresh = manager.forceRefresh;

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@llamaventures/cli",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "description": "CLI + MCP server for the Llama Ventures investment workbench (command.llamaventures.vc).",
   "type": "module",
   "scripts": {
-    "test": "npm run test:agent-routing && npm run test:contract",
+    "test": "npm run test:auth && npm run test:agent-routing && npm run test:contract",
     "test:agent-routing": "node scripts/verify-agent-routing.mjs",
     "test:contract": "node --test scripts/feedback.test.mjs scripts/content-read.test.mjs scripts/build-manifest.test.mjs scripts/core-api-call-sites.test.mjs scripts/deal-actions-cli.test.mjs scripts/deal-actions.test.mjs scripts/deal-memory-actions-cli.test.mjs scripts/deal-memory-actions.test.mjs scripts/mcp-four-action-surface.test.mjs scripts/page-schema-cli.test.mjs scripts/page-schema.test.mjs scripts/server-compatibility.test.mjs scripts/verify-core-api-contract.test.mjs && node scripts/verify-core-api-contract.mjs",
     "verify:artifact": "node scripts/verify-release-artifact.mjs",
     "verify:release": "npm test && npm run verify:artifact && node scripts/verify-tarball-clean.mjs",
     "prepack": "node scripts/prepare-build-manifest.mjs",
-    "postpack": "node scripts/cleanup-build-manifest.mjs"
+    "postpack": "node scripts/cleanup-build-manifest.mjs",
+    "test:auth": "node --test scripts/oauth-refresh.test.mjs scripts/oauth-flow.test.mjs"
   },
   "bin": {
     "llama": "bin/llama.mjs",