@stemtrooper/learningcode 0.4.0 → 0.4.2

package/README.md

@@ -174,8 +174,8 @@ You do not have a token yet, or it is not cached. Run `learningcode --login` to
 enter a new one. If you never had one, ask your teacher.
 
 **`Token rejected (401)`**
-The token is wrong, or it was rotated and the old one no longer works.
-`learningcode --login`.
+The token was probably rotated, which revokes the previous one. Run `/spark-login`
+to confirm, then `learningcode --login` to enter the new one.
 
 **`AI off — ask your teacher` / `AI disabled for your account`**
 Spark has AI switched off for your account — usually a timetable window or a

package/bin/learningcode.mjs

@@ -288,6 +288,9 @@ async function main() {
 					"it may not be a Spark token.\n",
 			);
 		}
+		// Keep Pi's stored credential and the environment in step. See the note
+		// beside saveProviderKey below.
+		await saveProviderKey(dir, PROVIDER_ID, token);
 		if (resolved.shouldCache) await writeCachedToken(dir, token);
 	} else if (explicitToken) {
 		process.stderr.write(
@@ -320,11 +323,12 @@ async function main() {
 
 	const childEnv = { ...process.env };
 
-	// Pi reads provider credentials from auth.json before the environment, and
-	// auth.json is keyed per provider. Storing the key under opencode-go alone
-	// authenticates Go while leaving Zen credential-less, so its 111 pay-per-use
-	// models never register. Zen and Go otherwise share OPENCODE_API_KEY, so
-	// leaving the env var in place would expose both.
+	// Pi prefers a stored credential in auth.json over the `$SPARK_API_KEY` the
+	// provider config names, so leaving the token only in the environment lets the
+	// two drift apart: Pi authenticates with whatever auth.json holds while the
+	// /quota and /seats commands read the environment, and a stale entry then shows
+	// up as a 401 on those two but not on completions. Writing the token to
+	// auth.json as well makes every path use the same value whichever Pi prefers.
 	const goKey = process.env.LEARNINGCODE_GO_KEY || process.env.OPENCODE_API_KEY;
 	if (goKey && process.env.LEARNINGCODE_ALLOW_ZEN !== "1") {
 		await saveProviderKey(dir, GO_PROVIDER, goKey);

package/lib/token.mjs

@@ -101,7 +101,10 @@ export async function resolveToken(agentDir, explicit) {
 	if (fromEnv) return { token: fromEnv.trim(), source: "environment" };
 
 	const cached = await readCachedToken(agentDir);
-	if (cached) return { token: cached, source: "cached" };
+	// A cached value that is not a Spark token is worse than no cache: it would be
+	// sent to Spark, rejected, and reported as a 401 that looks like a revoked
+	// token. Fall through and ask instead.
+	if (cached && isSparkToken(cached)) return { token: cached, source: "cached" };
 
 	const entered = await promptSecret(
 		"Paste your Spark API token (Bench > Issue / rotate token): ",
@@ -111,9 +114,23 @@ export async function resolveToken(agentDir, explicit) {
 }
 
 export function looksLikeToken(token) {
-	return token.startsWith(TOKEN_PREFIX);
+	return isSparkToken(token);
 }
 
+/**
+ * Whether a value could be a Spark token at all. Spark mints them as
+ * `spark_live_<secret>`, so anything else in the cache slot came from somewhere
+ * else and must not be sent to Spark.
+ *
+ * The length of the secret is deliberately not checked: Spark chooses it, and
+ * tightening this to today's value would start rejecting valid tokens the day
+ * that changes. Requiring something after the prefix is the safe minimum.
+ */
+export const isSparkToken = (token) =>
+	typeof token === "string" &&
+	token.startsWith(TOKEN_PREFIX) &&
+	token.length > TOKEN_PREFIX.length;
+
 /** True when a token can be found without asking the student anything. */
 export async function hasToken(agentDir, explicit) {
 	if (explicit) return true;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@stemtrooper/learningcode",
-	"version": "0.4.0",
+	"version": "0.4.2",
 	"description": "TLC Spark coding agent for students: Pi wired to the Spark OpenAI-compatible endpoint with per-student tokens, quota and seat-queue awareness.",
 	"type": "module",
 	"license": "MIT",