@topolo/cli 0.4.4 → 0.4.5

package/dist/index.js

@@ -3817,6 +3817,46 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
     return cred;
   }
 }
+async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
+  const config = await readConfig();
+  const profile = profileForEnvironment(config, environment);
+  const context = profile.contexts?.[key];
+  const credential = context?.credential;
+  if (!credential || credential.kind !== "access_token") return credential ?? null;
+  const oauthClientId = context.oauthClientId ?? profile.oauthClientId;
+  if (!credential.refreshToken || !oauthClientId) return credential;
+  const now = Math.floor(Date.now() / 1e3);
+  if (!options.force && credential.expiresAt && credential.expiresAt - REFRESH_SKEW_SECONDS > now) return credential;
+  try {
+    const oauth = new TopoloOAuth2({
+      serviceUrls: resolveServiceUrls(profile.serviceUrls, environment)
+    });
+    const tokens = await oauth.refreshToken({
+      clientId: oauthClientId,
+      refreshToken: credential.refreshToken
+    });
+    const refreshed = {
+      kind: "access_token",
+      accessToken: tokens.access_token,
+      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: credential.refreshToken },
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+    };
+    await writeConfig(writeProfileConfig(config, environment, {
+      ...profile.activeContext === key ? { credential: refreshed } : {},
+      contexts: {
+        ...profile.contexts ?? {},
+        [key]: {
+          ...context,
+          credential: refreshed,
+          oauthClientId
+        }
+      }
+    }));
+    return refreshed;
+  } catch {
+    return credential;
+  }
+}
 function resolveAgentName(configAgentName) {
   return process.env.TOPOLO_AGENT_NAME ?? configAgentName;
 }
@@ -11181,6 +11221,10 @@ function hasSameAccessToken(left, right) {
   const rightCredential = right;
   return leftCredential?.kind === "access_token" && rightCredential?.kind === "access_token" && leftCredential.accessToken === rightCredential.accessToken;
 }
+function identityMatchesContext(me, context) {
+  if (context.contextType === "personal") return me.activeType === "personal";
+  return me.activeType === "organization" && me.activeOrgId === context.organizationId;
+}
 function registerContextCommand(program2) {
   const context = program2.command("context").description("Show and switch the active context (personal or an organization)");
   context.command("ls", { isDefault: true }).alias("list").description("List the contexts you can act in and which is active").option("--json", "Output JSON", true).option("--no-json", "Output human-readable text").action(async (opts) => {
@@ -11276,24 +11320,38 @@ function registerContextCommand(program2) {
       const key = contextKey(resolved.contextType, resolved.organizationId);
       const existing = profile.contexts?.[key];
       let newCredential;
-      try {
-        newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
-      } catch (error) {
-        if (!isAuthenticationFailure(error)) throw error;
-        const refreshed = await refreshCredentialIfNeeded(environment, { force: true });
-        if (!refreshed || hasSameAccessToken(cred, refreshed)) {
-          throw new Error(
-            `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
-          );
+      if (existing?.credential && profile.activeContext !== key) {
+        const storedCredential = await refreshContextCredentialIfNeeded(environment, key);
+        if (storedCredential) {
+          try {
+            const storedIdentity = await fetchMe(storedCredential, serviceUrls);
+            if (identityMatchesContext(storedIdentity, resolved)) {
+              newCredential = storedCredential;
+            }
+          } catch {
+          }
+        }
+      }
+      if (!newCredential) {
+        try {
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
+        } catch (error) {
+          if (!isAuthenticationFailure(error)) throw error;
+          const refreshed = await refreshCredentialIfNeeded(environment, { force: true });
+          if (!refreshed || hasSameAccessToken(cred, refreshed)) {
+            throw new Error(
+              `The active credential could not be refreshed. Run \`topolo --env ${environment} auth login\` to sign in again.`
+            );
+          }
+          cred = refreshed;
+          newCredential = await exchangeForContext(cred, serviceUrls, {
+            type: resolved.contextType,
+            id: resolved.organizationId
+          });
         }
-        cred = refreshed;
-        newCredential = await exchangeForContext(cred, serviceUrls, {
-          type: resolved.contextType,
-          id: resolved.organizationId
-        });
       }
       resolved.credential = newCredential;
       resolved.oauthClientId = existing?.oauthClientId ?? profile.oauthClientId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topolo/cli",
-  "version": "0.4.4",
+  "version": "0.4.5",
   "description": "Command-line interface for Topolo developers, operators, and agents, with internal first-party scaffolding available under the topolo platform namespace.",
   "type": "module",
   "bin": {