@mindexec/cli 0.2.421 → 0.2.422

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.421",
+  "version": "0.2.422",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/server.js

@@ -699,6 +699,7 @@ async function writeStableAuthSessionPayload(content) {
     }
 
     await writePrivateTextFile(stablePath, payload);
+    clearRemoteRegistryAuthRefreshBackoff('auth-session-write');
     return stablePath;
 }
 
@@ -3677,6 +3678,15 @@ const REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS = Math.max(500, Number(process.env.
 const REMOTE_REGISTRY_FOLLOWER_MISSING_SESSION_FAST_RETRY_COUNT = Math.max(
     1,
     Number(process.env.MINDEXEC_REMOTE_REGISTRY_MISSING_SESSION_FAST_RETRY_COUNT || 5) || 5);
+const REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_BASE_MS = Math.max(
+    5000,
+    Number(process.env.MINDEXEC_REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_BASE_MS || 30000) || 30000);
+const REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_MAX_MS = Math.max(
+    REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_BASE_MS,
+    Number(process.env.MINDEXEC_REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_MAX_MS || 300000) || 300000);
+const REMOTE_REGISTRY_AUTH_REFRESH_LOG_REPEAT_MS = Math.max(
+    10000,
+    Number(process.env.MINDEXEC_REMOTE_REGISTRY_AUTH_REFRESH_LOG_REPEAT_MS || 60000) || 60000);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_STOP_COUNT = Math.max(2, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_STOP_COUNT || 8) || 8);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_GRACE_MS = Math.max(500, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_GRACE_MS || 60000) || 60000);
 const REMOTE_REGISTRY_INACTIVE_TARGET_RECOVERY_MS = Math.max(
@@ -3724,6 +3734,13 @@ let remoteRegistryFollowerConsecutiveMissingSession = 0;
 let remoteRegistryFollowerConsecutiveInactiveTarget = 0;
 let remoteRegistryFollowerInactiveTargetFirstAt = 0;
 let remoteRegistrySessionRefreshPromise = null;
+let remoteRegistryAuthRefreshBackoff = {
+    key: '',
+    until: 0,
+    failureCount: 0,
+    lastError: '',
+    lastLogAt: 0
+};
 let remoteRegistryRealtimeSocket = null;
 let remoteRegistryRealtimeSessionKey = '';
 let remoteRegistryRealtimeTopic = '';
@@ -6270,6 +6287,98 @@ function parseSupabaseSessionForRegistry(content) {
     };
 }
 
+function getRemoteRegistryAuthRefreshKey(session) {
+    const refreshToken = String(session?.refreshToken || '').trim();
+    if (!refreshToken) {
+        return '';
+    }
+
+    const digest = crypto.createHash('sha256').update(refreshToken).digest('hex').slice(0, 24);
+    return `${safeRemoteAgentField(session?.userId || '', 80)}|${digest}|${Number(session?.expiresAtMs || 0)}`;
+}
+
+function clearRemoteRegistryAuthRefreshBackoff(reason = 'cleared') {
+    if (!remoteRegistryAuthRefreshBackoff?.key) {
+        return false;
+    }
+
+    remoteRegistryAuthRefreshBackoff = {
+        key: '',
+        until: 0,
+        failureCount: 0,
+        lastError: '',
+        lastLogAt: 0
+    };
+    if (VERBOSE_REMOTE_AGENT_LOGS) {
+        logEvent('remote', `registry auth refresh backoff cleared ${formatKeyValue('reason', reason)}`, 'remote');
+    }
+    return true;
+}
+
+function getRemoteRegistryAuthRefreshBackoff(session) {
+    const key = getRemoteRegistryAuthRefreshKey(session);
+    if (!key) {
+        return { blocked: false, key: '' };
+    }
+
+    if (remoteRegistryAuthRefreshBackoff.key !== key) {
+        return { blocked: false, key };
+    }
+
+    const now = Date.now();
+    const until = Number(remoteRegistryAuthRefreshBackoff.until || 0);
+    if (until > now) {
+        return {
+            blocked: true,
+            key,
+            retryInMs: Math.max(0, until - now),
+            error: remoteRegistryAuthRefreshBackoff.lastError || 'auth-refresh-backoff',
+            failureCount: Number(remoteRegistryAuthRefreshBackoff.failureCount || 0)
+        };
+    }
+
+    return { blocked: false, key };
+}
+
+function recordRemoteRegistryAuthRefreshFailure(session, error, reason = 'registry') {
+    const key = getRemoteRegistryAuthRefreshKey(session);
+    const now = Date.now();
+    const previousCount = remoteRegistryAuthRefreshBackoff.key === key
+        ? Number(remoteRegistryAuthRefreshBackoff.failureCount || 0)
+        : 0;
+    const failureCount = previousCount + 1;
+    const backoffMs = Math.min(
+        REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_MAX_MS,
+        REMOTE_REGISTRY_AUTH_REFRESH_BACKOFF_BASE_MS * Math.max(1, Math.pow(2, Math.min(4, failureCount - 1))));
+    const message = error?.message || String(error || 'auth-refresh-failed');
+    const lastLogAt = remoteRegistryAuthRefreshBackoff.key === key
+        ? Number(remoteRegistryAuthRefreshBackoff.lastLogAt || 0)
+        : 0;
+    const shouldLog = lastLogAt <= 0 ||
+        now - lastLogAt >= REMOTE_REGISTRY_AUTH_REFRESH_LOG_REPEAT_MS ||
+        remoteRegistryAuthRefreshBackoff.lastError !== message;
+
+    remoteRegistryAuthRefreshBackoff = {
+        key,
+        until: now + backoffMs,
+        failureCount,
+        lastError: message,
+        lastLogAt: shouldLog ? now : lastLogAt
+    };
+
+    if (shouldLog) {
+        logWarn(
+            'remote',
+            `registry auth refresh failed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('error', message)} ${formatKeyValue('retryInMs', backoffMs)}`);
+    }
+
+    return {
+        retryInMs: backoffMs,
+        failureCount,
+        error: message
+    };
+}
+
 async function refreshSupabaseSessionForRegistry(config, sessionPayload, reason = 'registry') {
     const currentSession = parseSupabaseSessionForRegistry(sessionPayload?.content);
     if (!currentSession?.refreshToken) {
@@ -6283,6 +6392,14 @@ async function refreshSupabaseSessionForRegistry(config, sessionPayload, reason
         return await remoteRegistrySessionRefreshPromise;
     }
 
+    const backoff = getRemoteRegistryAuthRefreshBackoff(currentSession);
+    if (backoff.blocked === true) {
+        return {
+            ok: false,
+            reason: `auth-refresh-backoff:${Math.ceil(Number(backoff.retryInMs || 0) / 1000)}s`
+        };
+    }
+
     remoteRegistrySessionRefreshPromise = (async () => {
         const url = new URL('/auth/v1/token', config.url);
         url.searchParams.set('grant_type', 'refresh_token');
@@ -6321,6 +6438,7 @@ async function refreshSupabaseSessionForRegistry(config, sessionPayload, reason
             `registry auth refreshed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('expiresInMs', Math.max(0, session.expiresAtMs - Date.now()))}`,
             'remote');
 
+        clearRemoteRegistryAuthRefreshBackoff('auth-refresh-success');
         return {
             ok: true,
             reason: 'refreshed',
@@ -6387,16 +6505,14 @@ async function readFreshSupabaseSessionForRegistry(config, reason = 'registry')
             refreshError: refreshed.reason || 'auth-refresh-skipped'
         };
     } catch (error) {
-        logWarn(
-            'remote',
-            `registry auth refresh failed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('error', error?.message || String(error || ''))}`);
+        const failure = recordRemoteRegistryAuthRefreshFailure(session, error, reason);
         return {
             found: true,
             payload: sessionPayload,
             session,
             refreshed: false,
             expired: session.expiresAtMs > 0 && session.expiresAtMs <= Date.now(),
-            refreshError: error?.message || String(error || '')
+            refreshError: failure.error
         };
     }
 }