auxilo-mcp 0.9.27 → 0.9.28

package/mcp-server.js

@@ -198,7 +198,7 @@ async function postBulkChunks(headers, decisions) {
 }
 
 const server = new Server(
-  { name: 'auxilo', version: '0.9.27' },
+  { name: 'auxilo', version: '0.9.28' },
   {
     capabilities: { tools: {} },
     instructions: `You are connected to Auxilo, a knowledge marketplace where AI agents buy and sell operational learnings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auxilo-mcp",
-  "version": "0.9.27",
+  "version": "0.9.28",
   "mcpName": "io.github.silent-architects/auxilo",
   "description": "MCP server for Auxilo. Your agent stops solving the same problem twice: auto-extracted learnings, free self-unlocks, and earnings when other agents unlock yours.",
   "main": "mcp-server.js",

package/scripts/providers/claude-code.js

@@ -516,6 +516,10 @@ function wrapperIdentity(wrapper, cliVersion) {
     ...(observed === null && { identity_unresolved: models.length ? 'ambiguous' : 'missing' }) };
 }
 
+// Exact production CLI wording (verified 2026-09-27..10-01). Add another alternative only for
+// another CONFIRMED real CLI message, never a guessed synonym.
+const OAUTH_EXPIRED_PATTERN = /Failed to authenticate:\s*OAuth session expired and could not be refreshed/i;
+
 function runCliMode(opts, mode) {
   const spawn = typeof opts.spawnSyncImpl === 'function' ? opts.spawnSyncImpl : spawnSync;
   const bin = typeof opts.claudeBin === 'string' ? opts.claudeBin : resolveClaudeBin(opts);
@@ -552,6 +556,14 @@ function runCliMode(opts, mode) {
   if ((!decoded.wrapper && authPattern.test(stdout)) || authPattern.test(String(res.stderr || ''))) {
     return { ...fail('cli-unauthenticated', authReason), ...(authStatus === 'logged-in' && { authDiscrepancy: true }) };
   }
+  // EXT-0806c: an expired, unrefreshable OAuth session exits nonzero with this exact CLI
+  // message on either stream. Nonzero exit only, and stdout only when no result wrapper
+  // decoded, so a successful run whose own text discusses an auth bug never matches. Like
+  // the check above it is a post-spawn outcome: no `refusal`, so it never permits fallback.
+  if (Number.isInteger(res.status) && res.status !== 0
+    && ((!decoded.wrapper && OAUTH_EXPIRED_PATTERN.test(stdout)) || OAUTH_EXPIRED_PATTERN.test(String(res.stderr || '')))) {
+    return { ...fail('cli-unauthenticated', authReason), ...(authStatus === 'logged-in' && { authDiscrepancy: true }) };
+  }
   if (res.status !== 0) return fail('model-error', 'local model exited unsuccessfully');
   if (decoded.malformed) return fail('model-error', mode === 'judge' ? 'local judge returned malformed JSON wrapper' : 'local model returned malformed JSON wrapper');
   if (decoded.unsuccessful) return fail('model-error', 'local model returned no successful result');
@@ -676,4 +688,5 @@ module.exports = {
   getClaudeCliVersion,
   looksLikeUnsupportedSettingSourcesFlag,
   _resetSettingSourcesCacheForTests,
+  OAUTH_EXPIRED_PATTERN,
 };

package/scripts/providers/index.js

@@ -366,6 +366,7 @@ async function runModel(opts = {}) {
   const order = [record.route, ...AUTOMATIC_PROVIDER_ORDER.filter(id =>
     (id !== record.route || record.route === 'byo-key') && (id !== 'byo-key' || configuredByo))];
   const attempts = [];
+  let firstFailure = null;
   for (const id of order) {
     if (id !== store.record.route) {
       const updated = store.mutate(routeMetadata(id, opts, 'auto'));
@@ -394,6 +395,7 @@ async function runModel(opts = {}) {
       if (standalone) result = { ...result, ...finishJob(context) };
       return result;
     }
+    if (!attempts.length) firstFailure = result;
     attempts.push(id + '=' + (NON_RETRYABLE_FOR_THIS_PROVIDER.has(result.reasonCode) ? result.reasonCode : 'unavailable'));
     if (result.refusal !== 'pre-invocation' || !store.canFallback()) {
       const release = store.hold('pinned-route-unusable');
@@ -405,7 +407,13 @@ async function runModel(opts = {}) {
   const released = store.hold('pinned-route-unusable');
   context.hold = released.hold || 'pinned-route-unusable';
   if (!configuredByo && !attempts.some(attempt => attempt.startsWith('byo-key='))) attempts.push('byo-key=provider-not-configured');
-  return { ok: false, text: '', usage: null, authStatus: 'unknown', reasonCode: 'no-usable-provider',
+  // EXT-0806c: a generic 'no-usable-provider' reads as UNKNOWN downstream and never alerts. When the
+  // first-choice provider was refused for an unauthenticated CLI, the chain already knows the
+  // actionable cause, so surface it; the attempts list stays in `reason`. Read from the first
+  // attempt's result object, never from the attempts strings.
+  const unauthenticated = Boolean(firstFailure) && firstFailure.reasonCode === 'cli-unauthenticated';
+  return { ok: false, text: '', usage: null, authStatus: unauthenticated ? 'logged-out' : 'unknown',
+    reasonCode: unauthenticated ? 'cli-unauthenticated' : 'no-usable-provider',
     reason: 'no usable extraction provider (tried: ' + attempts.join('; ') + ')', hold: context.hold };
 }
 

package/scripts/runner.js

@@ -364,10 +364,11 @@ async function finalizeExtractionRun(outcomes, opts = {}) {
     : loadExtractionSkipState(opts);
   if (rows.length === 0) return state;
 
-  // A completed real result or a concrete model/API failure proves the local
-  // model was attempted. Either resets both visibility streaks.
-  const resetsAuthStreak = rows.some((row) => !isSkippedExtraction(row)
-    || row.reasonCode === 'model-error');
+  // Only a completed real extraction (a row that is not a skipped extraction)
+  // resets both visibility streaks. A 'model-error' skip is counted as an
+  // unknown skip, never a reset: an expired-OAuth outage once classified as
+  // model-error reset its own alarm on every sweep (EXT-0806c).
+  const resetsAuthStreak = rows.some((row) => !isSkippedExtraction(row));
   if (resetsAuthStreak) {
     const reset = {
       ...zeroExtractionSkipState(),
@@ -383,8 +384,7 @@ async function finalizeExtractionRun(outcomes, opts = {}) {
   const hasUnauthenticated = rows.some((row) => isSkippedExtraction(row)
     && row.reasonCode === 'cli-unauthenticated');
   if (!hasUnauthenticated) {
-    const hasUnknown = rows.some((row) => isSkippedExtraction(row)
-      && row.reasonCode !== 'model-error');
+    const hasUnknown = rows.some((row) => isSkippedExtraction(row));
     if (!hasUnknown) return state;
     const unknown = {
       ...state,
@@ -1066,6 +1066,8 @@ function installDigest() {
 
 // ─── Status (B14) ───────────────────────────────────────────────────────────
 
+const EXTRACTION_STALE_MS = 48 * 60 * 60 * 1000;
+
 function renderExtractionStatus(opts = {}) {
   const state = normalizeExtractionSkipState(opts.state) || zeroExtractionSkipState();
   const ledger = opts.ledger && typeof opts.ledger === 'object' ? opts.ledger : {};
@@ -1086,19 +1088,28 @@ function renderExtractionStatus(opts = {}) {
 
   const timestamp = ledger.lastRealExtractionAt;
   if (typeof timestamp === 'string' && isCanonicalIsoTimestamp(timestamp)) {
+    const rawNow = typeof opts.now === 'function' ? opts.now() : opts.now;
+    const nowMs = rawNow === undefined ? Date.now()
+      : rawNow instanceof Date ? rawNow.getTime()
+        : typeof rawNow === 'string' ? Date.parse(rawNow) : Number(rawNow);
+    const ageMs = nowMs - Date.parse(timestamp);
+    if (Number.isFinite(ageMs) && ageMs > EXTRACTION_STALE_MS) {
+      return `Extraction: STALE (no real extraction for ${Math.floor(ageMs / 3600000)}h, last ${timestamp}). ` +
+        'Run `claude auth login` and check extract.log';
+    }
     return `Extraction: OK (last real extraction ${timestamp})`;
   }
   return 'Extraction: OK (last real extraction unavailable)';
 }
 
-function currentExtractionStatusLine(ledger) {
+function currentExtractionStatusLine(ledger, now) {
   const state = loadExtractionSkipState();
   let authStatus = 'unknown';
   try {
     const { checkClaudeAuthStatus } = require('./extract-local.js');
     authStatus = checkClaudeAuthStatus();
   } catch { /* missing/broken local CLI state is UNKNOWN, never authenticated */ }
-  return renderExtractionStatus({ state, ledger, authStatus });
+  return renderExtractionStatus({ state, ledger, authStatus, now });
 }
 
 async function printStatus() {
@@ -1146,7 +1157,7 @@ async function printStatus() {
   console.log(`Pending queue: ${pendingCount} file(s)`);
 
   // 7. Extraction health — durable skip state plus the authoritative CLI auth probe.
-  console.log(currentExtractionStatusLine(ledger));
+  console.log(currentExtractionStatusLine(ledger, Date.now()));
 }
 
 // ─── Scrub + Verify ─────────────────────────────────────────────────────────