@oka-core/reason 0.2.22 → 0.2.23

package/dist/auth.d.ts

@@ -14,11 +14,30 @@ export declare function extractJwtExp(token: string): number | null;
 export declare function loadEnvFile(dir: string): void;
 /**
  * Refresh the access token using a stored refresh_token.
+ *
  * Calls `POST ${authServer}/api/token?grant_type=refresh_token`.
- * On success, updates ~/.oka/credentials.json and returns the new access token.
- * On failure, returns null (caller should fall through to unauthenticated).
+ * On success: updates ~/.oka/credentials.json (rotating the
+ * refresh_token if the server returned a new one) and returns the
+ * new access token.
+ * On hard failure (`invalid_grant` / `invalid_request` — the
+ * refresh token is dead): DELETES the stored refresh_token so the
+ * next call surfaces "no credentials" cleanly instead of looping on
+ * the same dead value. Returns null.
+ * On soft failure (network error, 5xx, timeout): leaves credentials
+ * untouched so a later attempt can retry. Returns null.
+ *
+ * Stderr-logged at every branch so the operator running the MCP
+ * host (or `wrangler tail` / `journalctl`) sees WHY a refresh failed
+ * instead of just "Authentication failed" two layers up the stack.
  */
 export declare function refreshAccessToken(authServerUrl?: string): Promise<string | null>;
+/**
+ * Wipe the stored refresh_token / access_token (preserves `api_key`
+ * if present) so the next auth-resolution call surfaces "no
+ * credentials" instead of looping on a server-rejected refresh
+ * token. Called from `refreshAccessToken` on hard failures.
+ */
+export declare function clearStoredRefreshToken(): void;
 /**
  * Attempt token refresh with deduplication.
  * Multiple concurrent callers share the same in-flight request.

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD,wBAAgB,qBAAqB,IAAI,iBAAiB,GAAG,IAAI,CAOhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAa/D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1D;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA0B7C;AAOD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOnD;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAuBtC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBhE;AASD,qBAAa,eAAe;IAC1B,OAAO,CAAC,YAAY,CAA8C;IAElE;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAsCtC;;OAEG;IACH,OAAO,CAAC,eAAe;YAeT,iBAAiB;IAQ/B,OAAO,CAAC,UAAU;IAOlB,OAAO,IAAI,IAAI;CAGhB;AAuGD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,aAAa,CAAC,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAsCtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD,wBAAgB,qBAAqB,IAAI,iBAAiB,GAAG,IAAI,CAOhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAa/D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1D;AAID,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA0B7C;AAOD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoFxB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAY9C;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOnD;AAID;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAuBtC;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBhE;AASD,qBAAa,eAAe;IAC1B,OAAO,CAAC,YAAY,CAA8C;IAElE;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAsCtC;;OAEG;IACH,OAAO,CAAC,eAAe;YAeT,iBAAiB;IAQ/B,OAAO,CAAC,UAAU;IAOlB,OAAO,IAAI,IAAI;CAGhB;AAuGD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,aAAa,CAAC,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAsCtB"}

package/dist/auth.js

@@ -83,35 +83,104 @@ export function loadEnvFile(dir) {
 let refreshInFlight = null;
 /**
  * Refresh the access token using a stored refresh_token.
+ *
  * Calls `POST ${authServer}/api/token?grant_type=refresh_token`.
- * On success, updates ~/.oka/credentials.json and returns the new access token.
- * On failure, returns null (caller should fall through to unauthenticated).
+ * On success: updates ~/.oka/credentials.json (rotating the
+ * refresh_token if the server returned a new one) and returns the
+ * new access token.
+ * On hard failure (`invalid_grant` / `invalid_request` — the
+ * refresh token is dead): DELETES the stored refresh_token so the
+ * next call surfaces "no credentials" cleanly instead of looping on
+ * the same dead value. Returns null.
+ * On soft failure (network error, 5xx, timeout): leaves credentials
+ * untouched so a later attempt can retry. Returns null.
+ *
+ * Stderr-logged at every branch so the operator running the MCP
+ * host (or `wrangler tail` / `journalctl`) sees WHY a refresh failed
+ * instead of just "Authentication failed" two layers up the stack.
  */
 export async function refreshAccessToken(authServerUrl) {
     const stored = loadStoredCredentials();
-    if (!stored?.refresh_token)
+    if (!stored?.refresh_token) {
+        console.warn("[oka-auth] refresh skipped: no refresh_token stored — run `mcp__oka__login`");
         return null;
+    }
     const server = authServerUrl ?? DEFAULT_AUTH_SERVER;
+    let res;
     try {
-        const res = await fetch(`${server}/api/token?grant_type=refresh_token`, {
+        res = await fetch(`${server}/api/token?grant_type=refresh_token`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ refresh_token: stored.refresh_token }),
             signal: AbortSignal.timeout(10_000),
         });
-        if (!res.ok)
-            return null;
-        const data = (await res.json());
-        // storeCredentials will extract the real JWT exp automatically
-        storeCredentials({
-            access_token: data.access_token,
-            refresh_token: data.refresh_token ?? stored.refresh_token,
-            expires_at: Math.floor(Date.now() / 1000) + data.expires_in, // overridden by JWT exp in storeCredentials
+    }
+    catch (err) {
+        // Network error / abort / DNS failure — keep credentials, retry later.
+        console.warn(`[oka-auth] refresh network error: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    if (!res.ok) {
+        // 4xx with a known OAuth error code means the refresh_token is
+        // permanently dead (rotated by another client, revoked server-
+        // side, or never valid in the first place — e.g. the 12-char
+        // junk that DeviceAuthPage used to write when no real refresh
+        // token was in scope). Wipe the dead token so subsequent calls
+        // surface a clean "no credentials" instead of looping on the
+        // same bad value forever and producing the same opaque
+        // "Authentication failed" the user reported.
+        //
+        // `res.json` may not even exist on a mocked / stubbed Response,
+        // so we wrap the entire read so a test fixture that omits it
+        // still falls through to "unknown error" cleanly.
+        const body = await (async () => {
+            try {
+                return (await res.json());
+            }
+            catch {
+                return {};
+            }
+        })();
+        const fatal = res.status >= 400 &&
+            res.status < 500 &&
+            (body.error === "invalid_grant" || body.error === "invalid_request");
+        if (fatal) {
+            console.warn(`[oka-auth] refresh rejected (${body.error ?? res.status}: ${body.error_description ?? "no description"}) — clearing stored refresh_token`);
+            clearStoredRefreshToken();
+        }
+        else {
+            console.warn(`[oka-auth] refresh failed: HTTP ${res.status} ${body.error ?? ""} ${body.error_description ?? ""}`.trim());
+        }
+        return null;
+    }
+    const data = (await res.json());
+    // storeCredentials will extract the real JWT exp automatically
+    storeCredentials({
+        access_token: data.access_token,
+        refresh_token: data.refresh_token ?? stored.refresh_token,
+        expires_at: Math.floor(Date.now() / 1000) + data.expires_in, // overridden by JWT exp in storeCredentials
+    });
+    return data.access_token;
+}
+/**
+ * Wipe the stored refresh_token / access_token (preserves `api_key`
+ * if present) so the next auth-resolution call surfaces "no
+ * credentials" instead of looping on a server-rejected refresh
+ * token. Called from `refreshAccessToken` on hard failures.
+ */
+export function clearStoredRefreshToken() {
+    const stored = loadStoredCredentials();
+    if (!stored)
+        return;
+    const { api_key } = stored;
+    const next = api_key ? { api_key } : {};
+    try {
+        writeFileSync(CREDENTIALS_PATH, JSON.stringify(next, null, 2), {
+            mode: 0o600,
         });
-        return data.access_token;
     }
     catch {
-        return null;
+        /* swallow — we're already in an error path */
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oka-core/reason",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "MCP server for institutional knowledge capture, semantic search, and consolidation",
   "private": false,
   "publishConfig": {