@nodii/dev 0.6.1 → 0.6.3

package/dist/oauth.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
-import { open, rm, stat } from "node:fs/promises";
-import { platform } from "node:os";
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rm, stat, utimes } from "node:fs/promises";
+import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 import { CliError, configPath, readConfig, writeConfig } from "./core.js";
 
@@ -29,6 +30,7 @@ export function requestedScope(scope) {
 
 const service = "dev.nodii.cli.oauth";
 const account = (clientId) => `refresh:${clientId}`;
+const accessAccount = (clientId) => `access:${clientId}`;
 const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
 function run(command, args, { input } = {}) {
@@ -43,42 +45,83 @@ function run(command, args, { input } = {}) {
   });
 }
 
-export async function storeRefreshToken(clientId, token, os = platform()) {
+async function keychainStore(name, secret, os) {
   if (os === "darwin") {
-    await run("security", ["add-generic-password", "-U", "-a", account(clientId), "-s", service, "-w", token]);
+    if (!/^[A-Za-z0-9_.:-]+$/.test(name)) throw new CliError("KEYCHAIN_UNAVAILABLE", "The OAuth client id has characters the Keychain helper cannot take; nothing was stored.", 2);
+    // Through `security -i` on stdin, so the secret never appears in argv
+    // (visible to `ps`). The interactive parser splits on whitespace and reads
+    // quotes, so a secret outside a token's own alphabet falls back to argv
+    // rather than being dropped (it may be a refresh token just rotated).
+    if (/^[A-Za-z0-9._~+/=-]+$/.test(secret)) await run("security", ["-i"], { input: `add-generic-password -U -a ${name} -s ${service} -w ${secret}\n` });
+    else await run("security", ["add-generic-password", "-U", "-a", name, "-s", service, "-w", secret]);
     return "macOS Keychain";
   }
   if (os === "linux") {
     try {
-      await run("secret-tool", ["store", "--label=nodii-dev OAuth", "service", service, "account", account(clientId)], { input: token });
+      await run("secret-tool", ["store", "--label=nodii-dev OAuth", "service", service, "account", name], { input: secret });
       return "Secret Service";
     } catch {}
   }
   throw new CliError("KEYCHAIN_UNAVAILABLE", "OAuth refresh tokens require macOS Keychain or Linux Secret Service. No credential was stored; re-run login when a keychain is available.", 2);
 }
 
+async function keychainLoad(name, os) {
+  if (os === "darwin") return (await run("security", ["find-generic-password", "-a", name, "-s", service, "-w"])).trim();
+  if (os === "linux") return (await run("secret-tool", ["lookup", "service", service, "account", name])).trim();
+  throw new Error("no keychain");
+}
+
+async function keychainDelete(name, os) {
+  try {
+    if (os === "darwin") await run("security", ["delete-generic-password", "-a", name, "-s", service]);
+    else if (os === "linux") await run("secret-tool", ["clear", "service", service, "account", name]);
+  } catch {}
+}
+
+export async function storeRefreshToken(clientId, token, os = platform()) {
+  return keychainStore(account(clientId), token, os);
+}
+
 export async function loadRefreshToken(clientId, os = platform()) {
   try {
-    if (os === "darwin") return (await run("security", ["find-generic-password", "-a", account(clientId), "-s", service, "-w"])).trim();
-    if (os === "linux") return (await run("secret-tool", ["lookup", "service", service, "account", account(clientId)])).trim();
+    const token = await keychainLoad(account(clientId), os);
+    if (token) return token;
   } catch {}
   throw new CliError("OAUTH_LOGIN_REQUIRED", "OAuth credentials are unavailable; run `nodii-dev login` again.", 2);
 }
 
 export async function deleteRefreshToken(clientId, os = platform()) {
+  await keychainDelete(account(clientId), os);
+}
+
+// The access token is cached beside the refresh token so that every nodii-dev
+// process on the machine shares one: without it each command rotated the
+// refresh token, and N lanes rotated it N times as often.
+export async function loadAccessToken(clientId, os = platform()) {
   try {
-    if (os === "darwin") await run("security", ["delete-generic-password", "-a", account(clientId), "-s", service]);
-    else if (os === "linux") await run("secret-tool", ["clear", "service", service, "account", account(clientId)]);
-  } catch {}
+    const cached = JSON.parse(Buffer.from(await keychainLoad(accessAccount(clientId), os), "base64url").toString("utf8"));
+    return typeof cached?.token === "string" && Number.isFinite(cached.expiresAt) ? cached : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function storeAccessToken(clientId, cached, os = platform()) {
+  try { await keychainStore(accessAccount(clientId), Buffer.from(JSON.stringify(cached)).toString("base64url"), os); } catch {}
 }
 
-async function oauthPost(authUrl, path, fields, fetchImpl = fetch) {
+export async function deleteAccessToken(clientId, os = platform()) {
+  await keychainDelete(accessAccount(clientId), os);
+}
+
+async function oauthPost(authUrl, path, fields, fetchImpl = fetch, timeoutMs = REFRESH_TIMEOUT_MS) {
   let response;
   try {
     response = await fetchImpl(`${authUrl.replace(/\/$/, "")}${path}`, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams(fields),
+      signal: AbortSignal.timeout(timeoutMs),
     });
   } catch (error) {
     throw new CliError("AUTH_UNREACHABLE", `Cannot reach nodii-auth: ${error.message}`, 1);
@@ -112,7 +155,20 @@ function openBrowser(url) {
   child.unref();
 }
 
-export async function deviceLogin({ clientId, authUrl = DEFAULT_AUTH_URL, edgeUrl = DEFAULT_EDGE_URL, tenantHint = PLATFORM_TENANT, noBrowser = false, scope, fetchImpl = fetch, output = console.log }) {
+/**
+ * The agent registration a new login keeps. Dev binds an agent to the person,
+ * the app and the installation, so signing in again as the same person through
+ * the same installation keeps it; anything else starts unregistered.
+ */
+export function keptAgent(previous, { clientId, person, installationId, edgeUrl }) {
+  if (!previous?.agentId || !person) return null;
+  if (previous.clientId !== clientId || previous.person !== person) return null;
+  if ((previous.installationId ?? null) !== (installationId ?? null)) return null;
+  if (edgeUrl && previous.edgeUrl && previous.edgeUrl.replace(/\/$/, "") !== edgeUrl.replace(/\/$/, "")) return null;
+  return previous.agentId;
+}
+
+export async function deviceLogin({ clientId, authUrl = DEFAULT_AUTH_URL, edgeUrl = DEFAULT_EDGE_URL, tenantHint = PLATFORM_TENANT, noBrowser = false, scope, fetchImpl = fetch, output = console.log, previous = null, lock = withRefreshLock }) {
   const requested = requestedScope(scope);
   const start = await oauthPost(authUrl, "/oauth/device/authorize", {
     client_id: clientId, tenant_hint: tenantHint, ...(requested ? { scope: requested } : {}),
@@ -123,61 +179,284 @@ export async function deviceLogin({ clientId, authUrl = DEFAULT_AUTH_URL, edgeUr
   if (!noBrowser && process.stdout.isTTY) openBrowser(d.verification_uri_complete ?? d.verification_uri);
   const token = await pollDeviceToken({ authUrl, clientId, deviceCode: d.device_code, interval: d.interval, expiresIn: d.expires_in, fetchImpl });
   if (!token.refresh_token) throw new CliError("OAUTH_REFRESH_MISSING", "nodii-auth did not return a refresh token.", 1);
-  const storage = await storeRefreshToken(clientId, token.refresh_token);
+  const storage = await lock(async () => {
+    const stored = await storeRefreshToken(clientId, token.refresh_token);
+    await deleteAccessToken(clientId);
+    return stored;
+  }, { clientId });
   const claims = decodeClaims(token.access_token);
-  await writeConfig({ authProvider: "oauth", authUrl, edgeUrl, clientId, tenantHint, agentId: null, person: claims.sub ?? null, installationId: claims.metadata?.oauth_app_installation_id ?? claims.oauth_app_installation_id ?? null });
-  return { storage, claims };
+  const person = claims.sub ?? null;
+  const installationId = claims.metadata?.oauth_app_installation_id ?? claims.oauth_app_installation_id ?? null;
+  const agentId = keptAgent(previous, { clientId, person, installationId, edgeUrl });
+  await writeConfig({ authProvider: "oauth", authUrl, edgeUrl, clientId, tenantHint, agentId, person, installationId });
+  return { storage, claims, agentId };
 }
 
 export function decodeClaims(token) {
   try { return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8")); } catch { return {}; }
 }
 
-export async function withRefreshLock(fn, { sleep = wait } = {}) {
-  const path = join(dirname(configPath()), "oauth-refresh.lock");
-  for (let attempt = 0; attempt < 300; attempt++) {
+// ONE lock per OAuth client per user, beside the Keychain item it guards. It
+// used to live next to the config file, so two processes with different
+// NODII_DEV_CONFIG_PATH values shared the credential but not the lock.
+export function refreshLockPath(clientId = DEFAULT_CLIENT_ID) {
+  return join(homedir(), ".config/nodii-dev", `oauth-refresh-${String(clientId).replace(/[^A-Za-z0-9_.-]/g, "_")}.lock`);
+}
+
+const LOCK_STALE_MS = 30_000;
+const LOCK_LIVE_STALE_MS = 120_000;
+const LOCK_BEAT_MS = 5_000;
+const LOCK_WAIT_MS = 90_000;
+const RECLAIM_STALE_MS = 10_000;
+
+function ownerPid(owner) {
+  const pid = Number.parseInt(owner, 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (error) { return error.code === "EPERM"; }
+}
+
+async function readOwner(path) {
+  try { return await readFile(path, "utf8"); } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+
+async function lockAge(path) {
+  try { return Date.now() - (await stat(path)).mtimeMs; } catch (error) { if (error.code === "ENOENT") return null; throw error; }
+}
+
+// A lock is reclaimable at once when its holder's pid is gone; when the file
+// names no pid yet (being written, or left by 0.6.2) after `staleMs` without a
+// touch; and from a live holder only after LOCK_LIVE_STALE_MS — far longer than
+// any refresh, so a holder that slept with the laptop is not robbed on waking.
+function reclaimable(owner, age, staleMs) {
+  const pid = ownerPid(owner);
+  if (pid !== null && !pidAlive(pid)) return true;
+  return age > Math.max(staleMs, pid === null ? staleMs : LOCK_LIVE_STALE_MS);
+}
+
+// Reclaims are serialized through `<lock>.reclaim`, taken with O_EXCL: two
+// waiters that both judged the same dead lock cannot both delete — the second
+// would otherwise delete the lock the first had just re-created.
+async function reclaim(path, seen, staleMs) {
+  const guard = `${path}.reclaim`;
+  const mine = `${process.pid}:${randomUUID()}`;
+  let handle;
+  try {
+    handle = await open(guard, "wx", 0o600);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const holder = await readOwner(guard);
+    const age = await lockAge(guard);
+    if (holder !== null && age !== null && age > RECLAIM_STALE_MS && (await readOwner(guard)) === holder) await rm(guard, { force: true });
+    return;
+  }
+  try {
+    try { await handle.writeFile(mine); } finally { await handle.close(); }
+    const owner = await readOwner(path);
+    const age = await lockAge(path);
+    if (owner === seen && age !== null && reclaimable(owner, age, staleMs) && (await readOwner(guard)) === mine) await rm(path, { force: true });
+  } finally {
+    if ((await readOwner(guard)) === mine) await rm(guard, { force: true });
+  }
+}
+
+async function acquire(path, { sleep, waitMs, staleMs }) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const owner = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    let handle;
     try {
-      const handle = await open(path, "wx", 0o600);
-      try { return await fn(); } finally { await handle.close(); await rm(path, { force: true }); }
+      handle = await open(path, "wx", 0o600);
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
-      try {
-        if (Date.now() - (await stat(path)).mtimeMs > 60_000) {
-          await rm(path, { force: true });
-          continue;
-        }
-      } catch (statError) {
-        if (statError.code !== "ENOENT") throw statError;
-      }
-      await sleep(100);
+      const seen = await readOwner(path);
+      const age = await lockAge(path);
+      if (seen !== null && age !== null && reclaimable(seen, age, staleMs)) await reclaim(path, seen, staleMs);
+      else await sleep(50 + Math.floor(Math.random() * 100));
+      continue;
     }
+    try { await handle.writeFile(owner); } finally { await handle.close(); }
+    const beat = setInterval(async () => {
+      try { if ((await readOwner(path)) === owner) await utimes(path, new Date(), new Date()); } catch {}
+    }, Math.max(250, Math.min(LOCK_BEAT_MS, Math.floor(staleMs / 3))));
+    beat.unref();
+    return {
+      held: async () => (await readOwner(path)) === owner,
+      release: async () => {
+        clearInterval(beat);
+        if ((await readOwner(path)) === owner) await rm(path, { force: true });
+      },
+    };
+  }
+  throw new CliError("OAUTH_REFRESH_BUSY", "Timed out waiting for another nodii-dev token refresh; the saved sign-in was kept. Retry the command.", 1);
+}
+
+// 0.6.2 and earlier locked `oauth-refresh.lock` beside the config file. While
+// both versions may run on one machine, this release takes that lock too
+// (always after its own, so the order is fixed). 0.6.2 reclaims it after 60 s
+// without a touch, which the heartbeat prevents.
+export const legacyRefreshLockPath = () => join(dirname(configPath()), "oauth-refresh.lock");
+
+/**
+ * Run `fn` holding the cross-process refresh lock. The holder writes its owner
+ * id into the file and touches it every few seconds; a waiter reclaims the
+ * lock only from a holder that exited or went quiet, one reclaimer at a time,
+ * and a holder only ever removes its own lock file. `fn` receives `held()`, to
+ * confirm the lock is still its own before acting on the shared credential.
+ */
+export async function withRefreshLock(fn, { clientId, path = refreshLockPath(clientId), legacyPath = path === refreshLockPath(clientId) ? legacyRefreshLockPath() : null,
+  sleep = wait, waitMs = LOCK_WAIT_MS, staleMs = LOCK_STALE_MS } = {}) {
+  const locks = [await acquire(path, { sleep, waitMs, staleMs })];
+  try {
+    if (legacyPath && legacyPath !== path) locks.push(await acquire(legacyPath, { sleep, waitMs, staleMs: Math.max(staleMs, 60_000) }));
+    const held = async () => (await Promise.all(locks.map((l) => l.held()))).every(Boolean);
+    return await fn({ held });
+  } finally {
+    for (const l of locks.reverse()) await l.release();
   }
-  throw new CliError("OAUTH_REFRESH_BUSY", "Timed out waiting for another nodii-dev token refresh.", 1);
 }
 
+// What a refresh answer means for the stored credential. Only the server saying
+// the GRANT is dead (RFC 6749 § 5.2 invalid_grant: expired, revoked, replayed)
+// ends the sign-in. Everything else — 429, 5xx, a timeout, no network, an HTML
+// error page from a proxy or CDN, a 2xx without tokens — says nothing about the
+// grant, so the credential is kept.
+const DEAD_GRANT_ERRORS = new Set(["invalid_grant", "expired_token", "token_revoked"]);
+const RETRYABLE_STATUS = new Set([408, 425, 429, 500, 502, 503, 504]);
+export const REFRESH_TIMEOUT_MS = 10_000;
+const REFRESH_ATTEMPTS = 4;
+const RETRY_AFTER_CAP_MS = 5_000;
+// The whole refresh, retries included, fits well inside the lock's wait
+// (LOCK_WAIT_MS) so a waiter behind it sees the real outcome, not BUSY.
+export const REFRESH_BUDGET_MS = 25_000;
+// No request starts with less than this left: one cut off after the server
+// rotated the token would lose the new token and replay the old one next run.
+const MIN_ATTEMPT_MS = 5_000;
+
+export function classifyRefresh(result) {
+  if (result.ok && result.body.access_token && result.body.refresh_token) return "ok";
+  if (result.status >= 400 && result.status < 500 && DEAD_GRANT_ERRORS.has(result.body.error)) return "dead";
+  if (result.status === 0 || result.ok || RETRYABLE_STATUS.has(result.status) || result.status >= 500 || !result.json) return "retry";
+  return "refused";
+}
+
+async function postRefresh(authUrl, clientId, refreshToken, fetchImpl, timeoutMs) {
+  let response;
+  try {
+    response = await fetchImpl(`${authUrl.replace(/\/$/, "")}/oauth/token`, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ grant_type: "refresh_token", client_id: clientId, refresh_token: refreshToken }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    return { ok: false, status: 0, body: {}, json: false, reason: error?.name === "TimeoutError" ? "timeout" : "unreachable" };
+  }
+  let raw = "";
+  try { raw = await response.text(); } catch {}
+  let body = {};
+  let json = false;
+  try { const parsed = JSON.parse(raw); if (parsed && typeof parsed === "object") { body = parsed; json = true; } } catch {}
+  const retryAfter = Number.parseInt(response.headers?.get?.("retry-after") ?? "", 10);
+  return { ok: response.ok, status: response.status, body, json, retryAfterMs: Number.isFinite(retryAfter) ? retryAfter * 1000 : undefined };
+}
+
+const describe = (result) => result.status === 0 ? (result.reason === "timeout" ? "timed out" : "nodii-auth unreachable") : `HTTP ${result.status}${result.json && typeof result.body.error === "string" ? ` ${result.body.error}` : ""}`;
+
 export class OAuthAuthProvider {
   #accessToken;
   #expiresAt = 0;
   #refreshPromise;
-  constructor({ fetchImpl = fetch, loadToken = loadRefreshToken, storeToken = storeRefreshToken, deleteToken = deleteRefreshToken, lock = withRefreshLock } = {}) {
-    Object.assign(this, { fetchImpl, loadToken, storeToken, deleteToken, lock });
+  constructor({ fetchImpl = fetch, loadToken = loadRefreshToken, storeToken = storeRefreshToken, deleteToken = deleteRefreshToken, lock = withRefreshLock,
+    loadAccess, storeAccess, deleteAccess, sleep = wait, timeoutMs = REFRESH_TIMEOUT_MS, budgetMs = REFRESH_BUDGET_MS } = {}) {
+    // Injected token storage (tests) gets no shared access cache unless one is
+    // injected too, so a test never reads or writes the real Keychain.
+    const realStorage = loadToken === loadRefreshToken;
+    Object.assign(this, { fetchImpl, loadToken, storeToken, deleteToken, lock, sleep, timeoutMs, budgetMs,
+      loadAccess: loadAccess ?? (realStorage ? loadAccessToken : async () => null),
+      storeAccess: storeAccess ?? (realStorage ? storeAccessToken : async () => {}),
+      deleteAccess: deleteAccess ?? (realStorage ? deleteAccessToken : async () => {}) });
+  }
+  #usable(cached) {
+    if (!cached || Date.now() >= cached.expiresAt - 60_000) return false;
+    this.#accessToken = cached.token;
+    this.#expiresAt = cached.expiresAt;
+    return true;
   }
   async accessToken() {
     if (this.#accessToken && Date.now() < this.#expiresAt - 30_000) return this.#accessToken;
-    this.#refreshPromise ??= this.lock(async () => {
+    this.#refreshPromise ??= (async () => {
       const config = await readConfig();
-      const refresh = await this.loadToken(config.clientId);
-      const result = await oauthPost(config.authUrl, "/oauth/token", { grant_type: "refresh_token", client_id: config.clientId, refresh_token: refresh }, this.fetchImpl);
-      if (!result.ok || !result.body.refresh_token) {
+      // Another process may have refreshed already: its access token is shared.
+      if (this.#usable(await this.loadAccess(config.clientId))) return this.#accessToken;
+      return this.lock(async ({ held } = {}) => {
+        // Re-checked under the lock: a process that held it before us has just
+        // rotated the refresh token and cached the access token it got.
+        if (this.#usable(await this.loadAccess(config.clientId))) return this.#accessToken;
+        return this.#refresh(config, held ?? (async () => true));
+      }, { clientId: config.clientId });
+    })().finally(() => { this.#refreshPromise = undefined; });
+    return this.#refreshPromise;
+  }
+  async #attempt(config, refresh, deadline, held) {
+    const floor = Math.min(MIN_ATTEMPT_MS, this.timeoutMs);
+    let result;
+    for (let attempt = 1; ; attempt++) {
+      if (result && deadline - Date.now() < floor) return { kind: classifyRefresh(result), result, attempts: attempt - 1 };
+      // Never present the refresh token without the lock: a second holder
+      // would present the same one, and the server revokes the chain on reuse.
+      if (!(await held())) throw new CliError("OAUTH_REFRESH_BUSY", "Lost the refresh lock to another nodii-dev process; the saved sign-in was kept. Retry the command.", 1);
+      result = await postRefresh(config.authUrl, config.clientId, refresh, this.fetchImpl, Math.max(floor, Math.min(this.timeoutMs, deadline - Date.now())));
+      const kind = classifyRefresh(result);
+      if (kind !== "retry" || attempt >= REFRESH_ATTEMPTS) return { kind, result, attempts: attempt };
+      const backoff = 500 * 2 ** (attempt - 1) + Math.floor(Math.random() * 250);
+      const pause = Math.min(Math.max(backoff, result.retryAfterMs ?? 0), RETRY_AFTER_CAP_MS);
+      if (Date.now() + pause + floor > deadline) return { kind, result, attempts: attempt };
+      await this.sleep(pause);
+    }
+  }
+  async #refresh(config, held) {
+    const deadline = Date.now() + this.budgetMs;
+    let refresh = await this.loadToken(config.clientId);
+    let outcome = await this.#attempt(config, refresh, deadline, held);
+    if (outcome.kind === "dead" || outcome.kind === "refused") {
+      // The stored token may have moved while this one was refused (a login,
+      // or a 0.6.2 process outside this lock). One more try with it.
+      const current = await this.loadToken(config.clientId).catch(() => null);
+      if (current && current !== refresh && deadline - Date.now() >= Math.min(MIN_ATTEMPT_MS, this.timeoutMs)) {
+        refresh = current;
+        outcome = await this.#attempt(config, refresh, deadline, held);
+      }
+    }
+    const { kind, result, attempts } = outcome;
+    if (kind === "dead") {
+      // Clear only the token the server rejected, never one stored since.
+      const current = await this.loadToken(config.clientId).catch(() => null);
+      const cleared = current === refresh;
+      if (cleared) {
         await this.deleteToken(config.clientId);
-        throw new CliError("OAUTH_LOGIN_REQUIRED", "OAuth refresh failed and the saved credential was cleared; run `nodii-dev login` again.", 2);
+        await this.deleteAccess(config.clientId);
       }
-      await this.storeToken(config.clientId, result.body.refresh_token);
-      this.#accessToken = result.body.access_token;
-      this.#expiresAt = Date.now() + result.body.expires_in * 1000;
-      return this.#accessToken;
-    }).finally(() => { this.#refreshPromise = undefined; });
-    return this.#refreshPromise;
+      throw new CliError("OAUTH_LOGIN_REQUIRED", `nodii-auth no longer accepts this sign-in (invalid_grant: expired, revoked or replayed)${cleared ? " and the saved credential was cleared" : ""}; run \`nodii-dev login\` again.`, 2);
+    }
+    if (kind === "retry")
+      throw new CliError("OAUTH_REFRESH_UNAVAILABLE", `Could not refresh the sign-in (${describe(result)}) after ${attempts} attempt${attempts === 1 ? "" : "s"}; the saved credential was kept. Retry the command shortly.`, 1);
+    if (kind === "refused")
+      throw new CliError("OAUTH_REFRESH_FAILED", `nodii-auth refused the refresh (${describe(result)}); the saved credential was kept.`, 1);
+    const body = result.body;
+    for (let attempt = 1; ; attempt++) {
+      try { await this.storeToken(config.clientId, body.refresh_token); break; } catch (error) {
+        if (attempt >= 3) throw error;
+        await this.sleep(200 * attempt);
+      }
+    }
+    this.#accessToken = body.access_token;
+    this.#expiresAt = Date.now() + Number(body.expires_in ?? 0) * 1000;
+    await this.storeAccess(config.clientId, { token: this.#accessToken, expiresAt: this.#expiresAt });
+    return this.#accessToken;
   }
   async headers() {
     const config = await readConfig();
@@ -185,11 +464,16 @@ export class OAuthAuthProvider {
   }
 }
 
-export async function revokeOAuth(config, fetchImpl = fetch) {
-  const token = await loadRefreshToken(config.clientId);
-  try {
-    await oauthPost(config.authUrl, "/oauth/revoke", { token, token_type_hint: "refresh_token", client_id: config.clientId }, fetchImpl);
-  } finally {
-    await deleteRefreshToken(config.clientId);
-  }
+export async function revokeOAuth(config, fetchImpl = fetch, lock = withRefreshLock) {
+  // Under the refresh lock, so a refresh in flight cannot store a new token
+  // after logout has cleared the old one.
+  await lock(async () => {
+    try {
+      const token = await loadRefreshToken(config.clientId);
+      await oauthPost(config.authUrl, "/oauth/revoke", { token, token_type_hint: "refresh_token", client_id: config.clientId }, fetchImpl);
+    } finally {
+      await deleteRefreshToken(config.clientId);
+      await deleteAccessToken(config.clientId);
+    }
+  }, { clientId: config.clientId });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {