arisa 5.2.21 → 5.2.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "5.2.21",
+  "version": "5.2.22",
   "description": "Telegram + Pi Agent modular assistant",
   "type": "module",
   "main": "src/index.js",

package/src/core/agent/auth-flow.js

@@ -33,6 +33,15 @@ export function getPiAuthIssue(error) {
   return null;
 }
 
+export function buildPiRequestFailureMessage(error) {
+  const message = getErrorMessage(error);
+  const limited = /usage limit|quota|rate[ _-]?limit|too many requests|insufficient[_ ]credits|credits? (?:exhausted|depleted)/i.test(message);
+  const title = limited
+    ? "The provider's usage quota or request limit was reached. Retry when capacity is available; signing in again does not restore quota."
+    : "Pi request could not be completed. This does not establish an authentication failure.";
+  return `${title}\nDetails: ${message}`;
+}
+
 export async function getPiAuthStatus(config, chatId = null) {
   const runtime = await createPiRuntime({
     provider: config.pi.provider,

package/src/transport/telegram/telegram-auth-controller.js

@@ -1,6 +1,7 @@
 import {
   buildPiAuthRecoveryBlockedMessage,
   buildPiAuthTelegramMessage,
+  buildPiRequestFailureMessage,
   getErrorMessage,
   getPiAuthIssue,
   getPiAuthStatus
@@ -37,12 +38,16 @@ export function createTelegramAuthController({
   }
 
   function rememberValidationFailure(error) {
-    const detected = rememberIssue(error) || {
-      kind: "validation-failed",
-      message: getErrorMessage(error)
-    };
-    issue = detected;
-    return detected;
+    // Quota, network and server failures must never latch the Telegram auth gate.
+    issue = getPiAuthIssue(error);
+    return issue;
+  }
+
+  async function buildValidationFailureMessage(chatId, error) {
+    const detected = rememberValidationFailure(error);
+    return detected
+      ? buildPiAuthTelegramMessage({ config, chatId, issue: detected })
+      : buildPiRequestFailureMessage(error);
   }
 
   async function notifyIssueIfNeeded(chatId, error) {
@@ -62,15 +67,14 @@ export function createTelegramAuthController({
   async function finishRenewal(chatId, renewal) {
     try {
       await renewal.promise;
-      await agentManager.validateAgent();
-      agentManager.clearSessionCache(chatId);
       issue = null;
+      agentManager.clearSessionCache(chatId);
+      await agentManager.validateAgent();
       logger?.log("telegram", `Pi auth renewal completed for chat ${chatId}`);
       await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, verified: true }));
     } catch (error) {
-      const detected = rememberValidationFailure(error);
-      logger?.error("telegram", `Pi auth renewal failed for chat ${chatId}: ${getErrorMessage(error)}`);
-      await api.sendMessage(chatId, await buildPiAuthTelegramMessage({ config, chatId, issue: detected })).catch((notifyError) => {
+      logger?.error("telegram", `Pi auth renewal or validation failed for chat ${chatId}: ${getErrorMessage(error)}`);
+      await api.sendMessage(chatId, await buildValidationFailureMessage(chatId, error)).catch((notifyError) => {
         logger?.error("telegram", `auth renewal failure notice failed for chat ${chatId}: ${getErrorMessage(notifyError)}`);
       });
     } finally {
@@ -141,7 +145,9 @@ export function createTelegramAuthController({
     if (!authorization.ok) return;
 
     const status = await getPiAuthStatus(config, ctx.chat.id);
-    if (status.hasApiKey || !status.supportsOAuth) {
+    const canValidateStoredAuth = status.hasStoredAuth && !issue && !renewals.has(chatKey(ctx.chat.id));
+    // A stored OAuth login may still be valid even when the provider has no quota.
+    if (status.hasApiKey || !status.supportsOAuth || canValidateStoredAuth) {
       await withTyping(ctx, async () => {
         try {
           await agentManager.validateAgent();
@@ -149,8 +155,7 @@ export function createTelegramAuthController({
           issue = null;
           await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, verified: true }));
         } catch (error) {
-          const detected = rememberValidationFailure(error);
-          await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+          await ctx.reply(await buildValidationFailureMessage(ctx.chat.id, error));
         }
       });
       return;
@@ -162,8 +167,7 @@ export function createTelegramAuthController({
         ? "Starting Pi login from Telegram..."
         : "Pi login is already in progress. Paste the redirect URL or code here when you have it.");
     } catch (error) {
-      const detected = rememberValidationFailure(error);
-      await ctx.reply(await buildPiAuthTelegramMessage({ config, chatId: ctx.chat.id, issue: detected }));
+      await ctx.reply(await buildValidationFailureMessage(ctx.chat.id, error));
     }
   }
 

package/test/telegram-auth-controller.test.js

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { ModelRuntime } from "@earendil-works/pi-coding-agent";
+import { createTelegramAuthController } from "../src/transport/telegram/telegram-auth-controller.js";
+
+function setup(t, { stored = true, apiKey = "", failure = null, loginFailure = null } = {}) {
+  const messages = [];
+  const calls = { login: 0, validate: 0, clear: 0 };
+  t.mock.method(ModelRuntime, "create", async () => ({
+    setRuntimeApiKey: async () => {},
+    getProviderAuthStatus: () => ({ configured: stored, source: "stored" }),
+    getProvider: () => ({ auth: { oauth: {} } }),
+    async login() {
+      calls.login++;
+      if (loginFailure) throw loginFailure;
+      return { type: "oauth", access: "test-only" };
+    }
+  }));
+  const controller = createTelegramAuthController({
+    config: { pi: { provider: "openai-codex", model: "test-model", apiKey } },
+    api: { sendMessage: async (_chatId, text) => messages.push(text) },
+    agentManager: {
+      async validateAgent() {
+        calls.validate++;
+        if (failure) throw failure;
+      },
+      clearSessionCache() { calls.clear++; }
+    }
+  });
+  const command = () => controller.handleCommand({
+    chat: { id: 123 }, reply: async (text) => messages.push(text)
+  }, { authorize: async () => ({ ok: true }), withTyping: async (_ctx, fn) => fn() });
+  return { controller, messages, calls, command };
+}
+
+for (const apiKey of ["", "test-key"]) {
+  for (const message of [
+    "Codex error: The usage limit has been reached",
+    "429 Too many requests",
+    "insufficient_quota",
+    "request timed out",
+    "503 service unavailable"
+  ]) {
+    test(`validation preserves usable auth after ${message} (${apiKey ? "API key" : "OAuth"})`, async (t) => {
+      const { controller, calls, command, messages } = setup(t, { apiKey, failure: new Error(message) });
+      await command();
+      assert.equal(controller.getIssue(), null);
+      assert.equal(calls.login, 0);
+      assert.equal(calls.clear, 0);
+      assert.match(messages[0], new RegExp(message));
+      assert.doesNotMatch(messages[0], /Send \/auth|Run \/auth|Update the key|not ready/);
+      await command();
+      assert.equal(calls.validate, 2);
+      assert.equal(calls.login, 0);
+    });
+  }
+}
+
+test("/auth validates stored OAuth credentials instead of starting a device login", async (t) => {
+  const { controller, calls, command, messages } = setup(t);
+  await command();
+  assert.equal(calls.validate, 1);
+  assert.equal(calls.login, 0);
+  assert.equal(controller.getIssue(), null);
+  assert.match(messages[0], /authentication is working/);
+});
+
+test("real token invalidation remains blocking and permits OAuth recovery", async (t) => {
+  const { controller, command, calls, messages } = setup(t, { failure: new Error("auth token revoked") });
+  await command();
+  assert.equal(controller.getIssue()?.kind, "invalidated-token");
+  assert.match(messages[0], /Run \/auth/);
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(controller.getIssue()?.kind, "invalidated-token");
+});
+
+test("successful OAuth renewal followed by quota failure clears a stale auth block", async (t) => {
+  const { controller, command, calls, messages } = setup(t, {
+    failure: new Error("Codex error: The usage limit has been reached")
+  });
+  controller.rememberIssue(new Error("auth token expired"));
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(calls.clear, 1);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(controller.hasActiveRenewal(123), false);
+  assert.match(messages.join("\n"), /signing in again does not restore quota/);
+  await command();
+  assert.equal(calls.login, 1);
+  assert.equal(calls.validate, 2);
+});
+
+test("missing credentials still initiate login", async (t) => {
+  const { controller, command, calls } = setup(t, { stored: false });
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.login, 1);
+  assert.equal(calls.validate, 1);
+  assert.equal(controller.getIssue(), null);
+});
+
+test("transient OAuth login failure does not create an authentication block", async (t) => {
+  const { controller, command, calls, messages } = setup(t, {
+    stored: false, loginFailure: new Error("request timed out")
+  });
+  await command();
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(calls.validate, 0);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(controller.hasActiveRenewal(123), false);
+  assert.match(messages.join("\n"), /does not establish an authentication failure/);
+});
+
+test("ordinary prompt quota errors never latch the auth issue", async (t) => {
+  const { controller, messages } = setup(t);
+  assert.equal(await controller.notifyIssueIfNeeded(123, new Error("Codex error: The usage limit has been reached")), false);
+  assert.equal(controller.getIssue(), null);
+  assert.equal(messages.length, 0);
+  assert.equal(await controller.notifyIssueIfNeeded(123, new Error("No auth found")), true);
+  assert.equal(controller.getIssue()?.kind, "missing-auth");
+});