@ottocode/sdk 0.1.221 → 0.1.223

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ottocode/sdk",
-	"version": "0.1.221",
+	"version": "0.1.223",
 	"description": "AI agent SDK for building intelligent assistants - tree-shakable and comprehensive",
 	"author": "nitishxyz",
 	"license": "MIT",

package/src/auth/src/openai-oauth.ts

@@ -194,11 +194,27 @@ export async function authorizeOpenAI(): Promise<OpenAIOAuthResult> {
 		server.listen(OPENAI_CALLBACK_PORT, '127.0.0.1', () => resolve());
 	});
 
+	const OAUTH_TIMEOUT_MS = 5 * 60 * 1000;
+	let timeoutId: ReturnType<typeof setTimeout> | undefined;
+
+	const timeoutPromise = new Promise<string>((_resolve, reject) => {
+		timeoutId = setTimeout(() => {
+			server.close();
+			reject(new Error('OAuth callback timeout - authorization took too long'));
+		}, OAUTH_TIMEOUT_MS);
+	});
+
+	const callbackWithTimeout = () =>
+		Promise.race([callbackPromise, timeoutPromise]).finally(() => {
+			if (timeoutId) clearTimeout(timeoutId);
+		});
+
 	return {
 		url: authUrl,
 		verifier: pkce.verifier,
-		waitForCallback: () => callbackPromise,
+		waitForCallback: callbackWithTimeout,
 		close: () => {
+			if (timeoutId) clearTimeout(timeoutId);
 			server.close();
 		},
 	};

package/src/core/src/tools/builtin/patch/apply.ts

@@ -704,8 +704,8 @@ async function applyAddOperation(
 		oldStart: 0,
 		oldLines: 0,
 		newStart: 1,
-		newLines: lines.length,
-		additions: lines.length,
+		newLines: operation.lines.length,
+		additions: operation.lines.length,
 		deletions: 0,
 	};
 

package/src/providers/src/openai-oauth-client.ts

@@ -7,33 +7,53 @@ import os from 'node:os';
 const CODEX_BASE_URL = 'https://chatgpt.com/backend-api/codex';
 const CODEX_RESPONSES_URL = 'https://chatgpt.com/backend-api/codex/responses';
 
+const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
+const TOKEN_REFRESH_MAX_RETRIES = 2;
+const TOKEN_REFRESH_RETRY_DELAY_MS = 1000;
+
 export type OpenAIOAuthConfig = {
 	oauth: OAuth;
 	projectRoot?: string;
+	sessionId?: string;
 };
 
+function sleep(ms: number) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 async function refreshAndPersist(
 	oauth: OAuth,
 	projectRoot?: string,
 ): Promise<OAuth> {
-	const newTokens = await refreshOpenAIToken(oauth.refresh);
-	const updated: OAuth = {
-		type: 'oauth',
-		access: newTokens.access,
-		refresh: newTokens.refresh,
-		expires: newTokens.expires,
-		accountId: oauth.accountId,
-		idToken: newTokens.idToken,
-	};
-	await setAuth('openai', updated, projectRoot, 'global');
-	return updated;
+	let lastError: Error | undefined;
+	for (let attempt = 0; attempt <= TOKEN_REFRESH_MAX_RETRIES; attempt++) {
+		try {
+			const newTokens = await refreshOpenAIToken(oauth.refresh);
+			const updated: OAuth = {
+				type: 'oauth',
+				access: newTokens.access,
+				refresh: newTokens.refresh,
+				expires: newTokens.expires,
+				accountId: oauth.accountId,
+				idToken: newTokens.idToken,
+			};
+			await setAuth('openai', updated, projectRoot, 'global');
+			return updated;
+		} catch (err) {
+			lastError = err instanceof Error ? err : new Error(String(err));
+			if (attempt < TOKEN_REFRESH_MAX_RETRIES) {
+				await sleep(TOKEN_REFRESH_RETRY_DELAY_MS * (attempt + 1));
+			}
+		}
+	}
+	throw lastError ?? new Error('Token refresh failed');
 }
 
 async function ensureValidToken(
 	oauth: OAuth,
 	projectRoot?: string,
 ): Promise<{ oauth: OAuth; access: string; accountId?: string }> {
-	if (oauth.access && oauth.expires > Date.now()) {
+	if (oauth.access && oauth.expires > Date.now() + TOKEN_EXPIRY_BUFFER_MS) {
 		return { oauth, access: oauth.access, accountId: oauth.accountId };
 	}
 
@@ -46,7 +66,7 @@ async function ensureValidToken(
 		};
 	} catch {
 		console.error(
-			'[openai-oauth] Token refresh failed, falling back to expired token',
+			'[openai-oauth] Token refresh failed after retries, falling back to current token',
 		);
 		return { oauth, access: oauth.access, accountId: oauth.accountId };
 	}
@@ -67,6 +87,7 @@ function buildHeaders(
 	init: RequestInit | undefined,
 	accessToken: string,
 	accountId?: string,
+	sessionId?: string,
 ): Headers {
 	const headers = new Headers(init?.headers);
 	headers.delete('Authorization');
@@ -80,6 +101,9 @@ function buildHeaders(
 	if (accountId) {
 		headers.set('ChatGPT-Account-Id', accountId);
 	}
+	if (sessionId) {
+		headers.set('session_id', sessionId);
+	}
 	return headers;
 }
 
@@ -101,7 +125,12 @@ export function createOpenAIOAuthFetch(config: OpenAIOAuthConfig) {
 					: input.url;
 		const targetUrl = rewriteUrl(originalUrl);
 
-		const headers = buildHeaders(init, validated.access, validated.accountId);
+		const headers = buildHeaders(
+			init,
+			validated.access,
+			validated.accountId,
+			config.sessionId,
+		);
 
 		const response = await fetch(targetUrl, {
 			...init,
@@ -130,6 +159,7 @@ export function createOpenAIOAuthFetch(config: OpenAIOAuthConfig) {
 					init,
 					currentOAuth.access,
 					currentOAuth.accountId,
+					config.sessionId,
 				);
 
 				return fetch(targetUrl, {