@synkro-sh/cli 1.4.60 → 1.4.61

package/dist/bootstrap.js

@@ -911,63 +911,93 @@ function decodeJwtExp(jwt: string): number {
 }
 
 export async function refreshJwt(jwt: string): Promise<string> {
-  try {
-    const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
-    const rt = creds.refresh_token;
-    if (!rt) return jwt;
+  const creds = JSON.parse(readFileSync(CREDS_PATH, 'utf-8'));
+  const rt = creds.refresh_token;
+  if (!rt) return jwt;
 
-    const resp = await fetch(GATEWAY_URL + '/api/auth/refresh', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ refresh_token: rt }),
-      signal: AbortSignal.timeout(4000),
-    });
-    const data = await resp.json() as any;
-    const newAt = data.access_token;
-    if (!newAt) return jwt;
-
-    const newRt = data.refresh_token || rt;
-    const existing = (() => {
-      try { return JSON.parse(readFileSync(CREDS_PATH, 'utf-8')); } catch { return {}; }
-    })();
-    const updated = { ...existing, access_token: newAt, refresh_token: newRt };
-    const tmp = CREDS_PATH + '.synkro.tmp';
-    writeFileSync(tmp, JSON.stringify(updated, null, 2));
-    renameSync(tmp, CREDS_PATH);
-    return newAt;
-  } catch {
+  const resp = await fetch(GATEWAY_URL + '/api/auth/refresh', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ refresh_token: rt }),
+    signal: AbortSignal.timeout(4000),
+  });
+
+  if (!resp.ok) {
+    log('refresh failed: HTTP ' + resp.status);
     return jwt;
   }
+
+  const data = await resp.json() as any;
+  const newAt = data.access_token;
+  if (!newAt) return jwt;
+
+  const newRt = data.refresh_token || rt;
+  const existing = (() => {
+    try { return JSON.parse(readFileSync(CREDS_PATH, 'utf-8')); } catch { return {}; }
+  })();
+  const updated = { ...existing, access_token: newAt, refresh_token: newRt };
+  const tmp = CREDS_PATH + '.synkro.tmp';
+  writeFileSync(tmp, JSON.stringify(updated, null, 2));
+  renameSync(tmp, CREDS_PATH);
+  return newAt;
+}
+
+function jwtIsExpired(jwt: string): boolean {
+  const exp = decodeJwtExp(jwt);
+  return exp - Math.floor(Date.now() / 1000) < 60;
+}
+
+function lockIsStale(lockfile: string, maxAgeMs = 8000): boolean {
+  try {
+    const stat = require('node:fs').statSync(lockfile);
+    return Date.now() - stat.mtimeMs > maxAgeMs;
+  } catch {
+    return false;
+  }
 }
 
 export async function ensureFreshJwt(jwt: string): Promise<string> {
   if (!jwt) return jwt;
-  const exp = decodeJwtExp(jwt);
-  const now = Math.floor(Date.now() / 1000);
-  if (exp - now >= 60) return jwt;
+  if (!jwtIsExpired(jwt)) return jwt;
 
   const lockfile = CREDS_PATH + '.lock';
+
+  // Clean stale lock left by a killed hook
+  if (existsSync(lockfile) && lockIsStale(lockfile)) {
+    try { unlinkSync(lockfile); } catch {}
+  }
+
   let fd = -1;
   try {
     fd = openSync(lockfile, FS_CONSTANTS.O_WRONLY | FS_CONSTANTS.O_CREAT | FS_CONSTANTS.O_EXCL, 0o644);
   } catch {
-    // Another process holds the lock \u2014 wait for it to finish and re-read
-    for (let i = 0; i < 10; i++) {
-      await new Promise(r => setTimeout(r, 300));
+    // Another process is refreshing \u2014 wait for it
+    for (let i = 0; i < 8; i++) {
+      await new Promise(r => setTimeout(r, 500));
       if (!existsSync(lockfile)) break;
     }
+    // Stale lock after full wait \u2014 force-remove
+    if (existsSync(lockfile) && lockIsStale(lockfile)) {
+      try { unlinkSync(lockfile); } catch {}
+    }
+    // Re-read \u2014 the winner should have written a fresh JWT
     const fresh = loadJwt();
-    return fresh || jwt;
+    if (fresh && !jwtIsExpired(fresh)) return fresh;
+    // Winner's refresh failed \u2014 try to acquire lock ourselves
+    try {
+      fd = openSync(lockfile, FS_CONSTANTS.O_WRONLY | FS_CONSTANTS.O_CREAT | FS_CONSTANTS.O_EXCL, 0o644);
+    } catch {
+      return fresh || jwt;
+    }
   }
 
   try {
-    // Re-check \u2014 another hook may have just refreshed while we waited
+    // Re-check \u2014 another hook may have written fresh creds while we waited for lock
     const freshJwt = loadJwt();
-    if (freshJwt) {
-      const freshExp = decodeJwtExp(freshJwt);
-      if (freshExp - Math.floor(Date.now() / 1000) >= 60) return freshJwt;
-    }
+    if (freshJwt && !jwtIsExpired(freshJwt)) return freshJwt;
     return await refreshJwt(jwt);
+  } catch {
+    return jwt;
   } finally {
     try { closeSync(fd); } catch {}
     try { unlinkSync(lockfile); } catch {}
@@ -5137,7 +5167,7 @@ function writeConfigEnv(opts) {
     `SYNKRO_CREDENTIALS_PATH=${shellQuoteSingle(credsPath)}`,
     `SYNKRO_TIER=${shellQuoteSingle(safeTier)}`,
     `SYNKRO_INFERENCE=${shellQuoteSingle(safeInference)}`,
-    `SYNKRO_VERSION=${shellQuoteSingle("1.4.60")}`
+    `SYNKRO_VERSION=${shellQuoteSingle("1.4.61")}`
   ];
   if (safeSynkroBin) lines.push(`SYNKRO_CLI_BIN=${shellQuoteSingle(safeSynkroBin)}`);
   if (safeUserId) lines.push(`SYNKRO_USER_ID=${shellQuoteSingle(safeUserId)}`);