@yagni-app/code-staging 0.3.0-staging.1061.1 → 0.3.0-staging.1064.1

package/dist/extension/crashReport.js

@@ -125,8 +125,6 @@ export function makeCrashReporter(opts) {
             if (crashReportsDisabled(env))
                 return;
             const token = opts.getToken();
-            if (!token)
-                return;
             const sanitized = sanitizeCrashError(error, { env, repoRoot });
             const payload = {
                 client: isDesktopSurface() ? "desktop" : "cli",
@@ -148,7 +146,7 @@ export function makeCrashReporter(opts) {
                     method: "POST",
                     headers: {
                         "content-type": "application/json",
-                        authorization: `Bearer ${token}`,
+                        ...(token ? { authorization: `Bearer ${token}` } : {}),
                     },
                     body: JSON.stringify(payload),
                     signal: controller.signal,

package/dist/extension/index.d.ts

@@ -63,6 +63,12 @@ export interface RegisterYagniDeps {
     tokenProvider?: TokenProvider;
     /** The spool flush (R4 write half), injectable so tests never touch disk. */
     flushSpool?: (opts: SpoolClientOpts) => Promise<FlushOutcome>;
+    /**
+     * Non-fatal auth-event reporter (YAG-500 Fix E). Defaults to
+     * `makeCrashReporter` gated on `!evalMode`; inject a spy in tests to assert
+     * the report is fired with `context: "auth-failure"` and the refresh outcome.
+     */
+    authReporter?: (error: unknown, context?: string) => Promise<void>;
     env?: NodeJS.ProcessEnv;
 }
 /**

package/dist/extension/index.js

@@ -30,7 +30,7 @@ import { registerDecisionCommands } from "./decisions.js";
 import { makeDecisionCapture } from "./decisionCapture.js";
 import { registerAmbientRecall } from "./recall.js";
 import { resilientFetch } from "./resilientFetch.js";
-import { installUncaughtExceptionMonitor } from "./crashReport.js";
+import { installUncaughtExceptionMonitor, makeCrashReporter } from "./crashReport.js";
 import { flushSpool as defaultFlushSpool } from "./spool.js";
 import { makeAuthedFetch, makeTokenProvider } from "./tokenProvider.js";
 import { attributionHeaders, fetchCatalog as defaultFetchCatalog, fetchContextBrief as defaultFetchContextBrief, getToken, getTokenExpiresAt as defaultGetTokenExpiresAt, getWorkspaceId as defaultGetWorkspaceId, isDriverCaller, resolveBaseUrl, tokenExpiryNotice, } from "./config.js";
@@ -113,6 +113,19 @@ export async function registerYagni(pi, deps = {}) {
     if (!evalMode) {
         installUncaughtExceptionMonitor({ baseUrl, getToken: getTokenFn, env: deps.env });
     }
+    // YAG-500 Fix E: non-fatal auth-event reporter for 401s on the model path.
+    // Reuses the crash endpoint (/api/yagni-code/crash) with a distinct context
+    // so auth failures are visible in Sentry/backend logs. Gated on !evalMode
+    // like every other external side effect; injectable for tests.
+    const authReporter = deps.authReporter ??
+        (!evalMode
+            ? makeCrashReporter({ baseUrl, getToken: getTokenFn, fetchImpl: deps.fetchImpl, env: deps.env })
+            : async () => { });
+    // YAG-500 Fix A+C: the model-path 401 recovery outcome, set by the
+    // message_end handler so it can produce the right user-facing message. The
+    // after_provider_response event does NOT fire on a 401 (the OpenAI SDK throws
+    // before onResponse is reached), so message_end is the only seam.
+    let lastAuthRecovery = null;
     const fullCatalog = await fetchCatalog({ baseUrl, getToken: getTokenFn, fetchImpl: authedFetch });
     // Lock the interactive session to the `advanced` tier only. The backend
     // catalog returns all tiers, but only `advanced` is registered with the
@@ -435,7 +448,7 @@ export async function registerYagni(pi, deps = {}) {
     // renders. The message text deliberately matches neither pi's overflow nor
     // retryable-error patterns: a deterministic empty response should not burn
     // auto-retries or trigger compaction — the user decides what to do next.
-    pi.on("message_end", (event, ctx) => {
+    pi.on("message_end", async (event, ctx) => {
         const msg = event.message;
         if (msg.role !== "assistant")
             return;
@@ -450,6 +463,71 @@ export async function registerYagni(pi, deps = {}) {
         // post-replacement message, and dropping the marker would defeat the very
         // recovery this error exists to trigger.
         if (msg.stopReason === "error" && msg.errorMessage) {
+            // YAG-500: a 401 from the model proxy means the session token expired
+            // (or was revoked). Unlike tool 401s (handled by makeAuthedFetch), the
+            // model completion path has no 401-retry seam — pi's retryProviderRequest
+            // treats 401 as non-retryable, and after_provider_response never fires
+            // (the SDK throws before onResponse is reached). So message_end is the
+            // only place to detect it and trigger recovery. The regex matches
+            // "yagni login" (the backend's auth-error message) but NOT
+            // "request_too_large" (YAG-460's overflow marker).
+            const isAuthError = /yagni login/i.test(msg.errorMessage)
+                && !/request_too_large|context_too_large/i.test(msg.errorMessage);
+            if (isAuthError) {
+                lastAuthRecovery = null;
+                let rotated = false;
+                try {
+                    rotated = await tokenProvider.refresh();
+                }
+                catch {
+                    rotated = false;
+                }
+                lastAuthRecovery = rotated ? "refreshed" : "failed";
+                const explanation = rotated
+                    ? "Your session token expired but was refreshed automatically. Re-send your prompt to continue."
+                    : "Your session token expired and could not be refreshed. Run `yagni login`, then re-send your prompt. If the issue persists, restart YAGNI Code.";
+                if (ctx.hasUI) {
+                    try {
+                        ctx.ui.notify(explanation, rotated ? "info" : "error");
+                    }
+                    catch {
+                        // Surfacing the problem must never break the session itself.
+                    }
+                }
+                // YAG-500 Fix E: fire a non-fatal crash report so auth failures are
+                // visible in Sentry/backend logs. Reuses the crash endpoint with a
+                // distinct context. Fire-and-forget, fail-soft. The crash endpoint is
+                // now public (no token required), so the report lands even when the
+                // session token is expired and refresh failed — the most critical
+                // failure signal is no longer silently dropped.
+                void authReporter(new Error(`auth_401 on model path; refresh=${rotated ? "succeeded" : "failed"}`), "auth-failure").catch(() => { });
+                // YAG-500 Fix F: local diagnostics log under YAGNI_DEBUG.
+                if (isDebug(env)) {
+                    try {
+                        const logPath = join(codeStateHome(null, env), "logs", "auth-events.log");
+                        mkdirSync(dirname(logPath), { recursive: true });
+                        appendFileSync(logPath, JSON.stringify({
+                            ts: new Date().toISOString(),
+                            status: 401,
+                            refresh: rotated ? "succeeded" : "failed",
+                        }) + "\n", "utf8");
+                    }
+                    catch {
+                        // A diagnostic must never break the session.
+                    }
+                }
+                return { message: { ...msg, errorMessage: explanation } };
+            }
+            // YAG-460: the backend proxy answers an oversized conversation with an
+            // OpenAI-format 413 whose type is `request_too_large`. pi's own overflow
+            // detection matches that marker and runs full recovery — compact, then
+            // auto-retry the failed turn — so this branch must NOT call ctx.compact()
+            // (it would race the built-in recovery and lose the retry). Its only job
+            // is UX: replace the raw `413: {"error":{...}}` JSON with a readable
+            // message and tell the user what is happening. The rewritten text KEEPS
+            // the `request_too_large` marker verbatim: pi's _checkCompaction reads the
+            // post-replacement message, and dropping the marker would defeat the very
+            // recovery this error exists to trigger.
             const isContextTooLarge = /request_too_large|context_too_large/i.test(msg.errorMessage);
             if (!isContextTooLarge)
                 return;

package/dist/extension/tokenProvider.js

@@ -130,7 +130,7 @@ export function makeTokenProvider(deps) {
             });
         }, delay);
     }
-    function applyRotation(rotation) {
+    function applyRotation(rotation, skipPersist = false) {
         token = rotation.token;
         if (rotation.expiresAt)
             expiresAt = rotation.expiresAt;
@@ -139,13 +139,45 @@ export function makeTokenProvider(deps) {
         env.YAGNI_TOKEN = rotation.token;
         if (rotation.expiresAt)
             env.YAGNI_TOKEN_EXPIRES_AT = rotation.expiresAt;
+        if (!skipPersist) {
+            try {
+                persistProfile(rotation);
+            }
+            catch {
+                /* fail-soft */
+            }
+        }
+        armProactiveTimer();
+    }
+    /**
+     * Read the token from the launcher's profile file on disk. Used as a fallback
+     * when the server-side refresh fails (the old token is also invalid for
+     * /auth/refresh): an external `yagni login` writes a fresh token to the same
+     * file, so re-reading it can recover a session that the server refresh cannot.
+     * Returns null when the file is missing, unreadable, or carries the same token
+     * already in memory.
+     */
+    function readTokenFromDisk() {
+        const profilePath = env.YAGNI_PROFILE_PATH?.trim();
+        if (!profilePath)
+            return null;
         try {
-            persistProfile(rotation);
+            const parsed = JSON.parse(readFileSync(profilePath, "utf8"));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return null;
+            const obj = parsed;
+            const diskToken = typeof obj.token === "string" ? obj.token : undefined;
+            if (!diskToken || diskToken === token)
+                return null;
+            return {
+                token: diskToken,
+                expiresAt: typeof obj.expiresAt === "string" ? obj.expiresAt : undefined,
+                workspaceId: typeof obj.workspaceId === "string" ? obj.workspaceId : undefined,
+            };
         }
         catch {
-            /* fail-soft */
+            return null;
         }
-        armProactiveTimer();
     }
     async function doRefresh() {
         const current = token;
@@ -161,8 +193,17 @@ export function makeTokenProvider(deps) {
                 body: "{}",
                 signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS),
             });
-            if (!res.ok)
+            if (!res.ok) {
+                // Server refresh failed (the old token is also invalid for /auth/refresh).
+                // Fall back to the profile file on disk: an external `yagni login` may
+                // have written a fresh token there that this running session hasn't seen.
+                const disk = readTokenFromDisk();
+                if (disk) {
+                    applyRotation(disk, true);
+                    return true;
+                }
                 return false;
+            }
             const data = (await res.json());
             if (!data || typeof data.token !== "string" || data.token.length === 0)
                 return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "0.3.0-staging.1061.1",
+  "version": "0.3.0-staging.1064.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -38,5 +38,5 @@
     "@earendil-works/pi-tui": "0.84.1",
     "typebox": "^1.3.11"
   },
-  "yagniSourceSha": "44711af698e076c2e718fdd813f4e8ab4b875a0a"
+  "yagniSourceSha": "e38a99de02a31e45c61d006943113caf8817e0bd"
 }