botmux 3.16.1 → 3.17.0

package/dist/.runtime-build-id

@@ -1 +1 @@
-d4b7507a1749c82ef2b8bab3ad68ba68d3f2c9b27e5a07cd5ae98479feaaf683
+14c156c655efc61ed07f4a086355ded6d7394ff614c0288ec130fecb1fd25290

package/dist/adapters/backend/riff-backend.d.ts

@@ -25,6 +25,28 @@ export interface RiffBackendConfig {
     jwt?: string;
     /** Name of env var containing the JWT token (default: RIFF_JWT). */
     jwtEnv?: string;
+    /**
+     * Command to refresh the ByteCloud JWT when the keychain holds no live token.
+     * When neither `config.jwt` nor the env token is set and `readBytecloudKeychainJwt`
+     * returns null (every candidate expired / within the safety window / absent),
+     * riff task creation would fail with a 401 that aborts the whole turn. Before
+     * giving up, we run this command ONCE (debounced) to let the owning CLI
+     * (bytedcli / kaboo-cli) refresh credentials and rewrite the keychain, then
+     * re-read. bytedcli is the ByteCloud JWT owner: `bytedcli auth
+     * get-bytecloud-jwt-token --force-refresh` refreshes via its Auth SDK and
+     * writes the token to `~/.local/share/bytedcli/data/bytecloud-auth/…`, which is
+     * already a `bytecloudKeychainCandidates` path.
+     *
+     * Shape: [binary, ...args]. When unset, resolves in order:
+     *   1. env `BOTMUX_RIFF_JWT_REFRESH_CMD` (space-split, e.g. `bytedcli auth get-bytecloud-jwt-token --force-refresh`)
+     *   2. a `bytedcli` binary found on PATH → `bytedcli auth get-bytecloud-jwt-token --force-refresh`
+     *   3. otherwise no auto-refresh (fail-closed to the old behaviour — a 401).
+     * We intentionally do NOT default to `npx @bytedance-dev/bytedcli@latest`: an
+     * uncached/`@latest` npx resolve can block ~30s per call, far too slow for a
+     * synchronous pre-request refresh. Deployments wanting npx must set the env
+     * explicitly (and ideally pin the version).
+     */
+    jwtRefreshCmd?: string[];
     /** Sandbox resource pool selected for newly-created tasks. Riff defaults to
      *  BOE when omitted; follow-ups inherit the parent task's sandbox. */
     sandboxCluster?: RiffSandboxCluster;
@@ -183,6 +205,62 @@ export declare function decodeJwtExp(jwt: string): number | null;
  */
 export declare const JWT_EXPIRY_SAFETY_WINDOW_SEC = 30;
 export declare function readBytecloudKeychainJwt(home?: string, env?: NodeJS.ProcessEnv, nowMs?: number, platform?: NodeJS.Platform): string | null;
+/**
+ * Locate a `bytedcli` binary on PATH (used to build the default JWT-refresh
+ * command). Returns the bare name `bytedcli` when found so execFileSync resolves
+ * it via PATH, or null when absent. Injectable env/platform for testing.
+ *
+ * We look for a real installed binary rather than defaulting to
+ * `npx @bytedance-dev/bytedcli@latest`: an uncached / `@latest` npx resolve can
+ * block ~30s, which is unacceptable on the synchronous pre-request path. If
+ * bytedcli is not installed we simply do not auto-refresh (fail-closed to the
+ * prior behaviour — the request may 401, exactly as before this change).
+ */
+export declare function findBytedcliBinary(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string | null;
+/**
+ * Resolve the JWT-refresh command: explicit config → env
+ * `BOTMUX_RIFF_JWT_REFRESH_CMD` (space-split) → a PATH-resident bytedcli →
+ * null (no auto-refresh). See RiffBackendConfig.jwtRefreshCmd for the rationale.
+ */
+export declare function resolveJwtRefreshCmd(configured: string[] | undefined, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string[] | null;
+/** Minimum gap between speculative JWT refresh attempts. When the keychain
+ *  holds no live token, a reconnect/follow-up loop would otherwise trigger a
+ *  refresh on EVERY getJwt() call; we cap proactive refreshes at one per window
+ *  and let the shared keychain re-read serve the rest. Also caps the cost of a
+ *  refresh command that keeps failing (e.g. bytedcli not logged in). A refresh
+ *  driven by an actual server 401 bypasses this window (see `force`). */
+export declare const JWT_REFRESH_DEBOUNCE_MS = 60000;
+/** How long a single refresh command may run before we give up. Once the
+ *  refresh is asynchronous (below) this no longer blocks the event loop — it
+ *  only bounds one awaited child process — so we keep it generous: a cold
+ *  bytedcli token fetch can take a few seconds, and a session that cannot get a
+ *  JWT has nothing useful to do anyway. */
+export declare const JWT_REFRESH_TIMEOUT_MS = 30000;
+export declare function __resetJwtRefreshDebounceForTest(): void;
+export interface RefreshBytecloudJwtOpts {
+    /** Injectable async runner (defaults to a real execFile). */
+    runner?: (bin: string, args: string[]) => Promise<void>;
+    /** Injectable clock for the debounce window (defaults to Date.now()). */
+    nowMs?: number;
+    /** Bypass the debounce window. Set only when an actual server 401/403 proved
+     *  the current token is bad — a rejection is authoritative evidence worth one
+     *  more attempt even inside the window. Never set for speculative refreshes. */
+    force?: boolean;
+}
+/**
+ * Run the JWT-refresh command once, ASYNCHRONOUSLY. Never throws: a missing
+ * command, a non-zero exit, or a timeout all resolve to `false` (the caller then
+ * falls back to whatever the keychain holds — i.e. the pre-change behaviour).
+ * Resolves true only when a command actually ran to completion.
+ *
+ * Async + injectable (runner / now / force) so it never blocks the event loop
+ * (critical on the daemon-side orphan-cancel path) and the debounce / coalesce /
+ * fail-closed paths are unit-testable without spawning a real process.
+ *
+ * COALESCE: if a refresh is already in flight, ride it instead of spawning a
+ * second bytedcli — concurrent getJwt() callers share one refresh.
+ */
+export declare function refreshBytecloudJwt(cmd: string[] | null, opts?: RefreshBytecloudJwtOpts): Promise<boolean>;
 /**
  * RiffBackend — bridges botmux's SessionBackend interface to riff's HTTP API.
  *
@@ -287,7 +365,12 @@ export declare class RiffBackend implements SessionBackend {
      *  worker forwards it to the daemon so the follow-up lineage survives a
      *  daemon restart (currentTaskId otherwise lives only in this process). */
     onTaskId(cb: (taskId: string | null) => void): void;
-    /** Resolve JWT dynamically — re-reads env/keychain each call so auto-refresh works. */
+    /** Resolve JWT dynamically — re-reads env/keychain each call so auto-refresh
+     *  works. Async because a keychain miss may trigger a (non-blocking) CLI
+     *  refresh. `opts.allowRefresh=false` skips the refresh entirely (daemon-side
+     *  orphan-cancel: a best-effort teardown must never freeze the daemon on a
+     *  host-identity refresh). `opts.forceRefresh=true` bypasses the debounce
+     *  window (an actual server 401 proved the token bad). */
     private getJwt;
     private resolveJwt;
     private readJwtFromBytecloudKeychain;

package/dist/adapters/backend/riff-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"riff-backend.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/riff-backend.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,SAAS,EACV,MAAM,YAAY,CAAC;AAqCpB;;;;;;;GAOG;AACH,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,6CAA8C,CAAC;AAClF,eAAO,MAAM,qBAAqB,wBAAyB,CAAC;AAC5D,MAAM,MAAM,kBAAkB,GAAG,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAatE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;mDAC+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6DACyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;0EACsE;IACtE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;0DAEsD;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;gFAEgF;AAChF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAQ1D;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,kBAAkB,CAE7E;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB;;iFAE6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7D;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAgC,GACpE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA2BlD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,GAAE,OAAO,4BAA2D,GAC5E;IAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAYrD;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAsCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,EAAE,CAoEV;AA4BD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAavD;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,MAAmB,EAC1B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAsBf;AAqFD;;;;;;;;;;;;;GAaG;AACH,qBAAa,WAAY,YAAW,cAAc;IAChD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAyC;IACvD,OAAO,CAAC,MAAM,CAAuE;IACrF,OAAO,CAAC,WAAW,CAAwC;IAC3D,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,sFAAsF;IACtF,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,MAAM,CAAS;IACvB;8EAC0E;IAC1E,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB;;gFAE4E;IAC5E,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAK;IACjC;;;;;;;;;;;;;;;;;;gFAkB4E;IAC5E,OAAO,CAAC,qBAAqB,CAAuB;IACpD,kDAAkD;IAClD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,iBAAiB,CAAU;IACnC,6CAA6C;IAC7C,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,mBAAmB,CAAU;IACrC;;;;;yCAKqC;IACrC,OAAO,CAAC,sBAAsB,CAAU;IACxC;+EAC2E;IAC3E,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,cAAc,CAAiC;IACvD,OAAO,CAAC,aAAa,CAA8B;IACnD;;6EAEyE;IACzE,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,sBAAsB,CAAqD;IACnF,OAAO,CAAC,2BAA2B,CAAqD;IACxF;;8DAE0D;IAC1D,OAAO,CAAC,UAAU,CAAoC;gBAE1C,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM;IASxD,2EAA2E;IAC3E,WAAW,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAK5C,4EAA4E;IAC5E,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhC;;+EAE2E;IAC3E,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAKnD,uFAAuF;IACvF,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,4BAA4B;IAIpC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI;IAK5D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1C,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIxC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAItE,IAAI,IAAI,IAAI;IAaN,cAAc,IAAI,OAAO,CAAC,oBAAoB,CAAC;IA+H/C,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B1C,oBAAoB,IAAI,IAAI;IAQtB,qBAAqB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0C7D,mBAAmB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA4CjE,oBAAoB,IAAI,IAAI;IAO5B,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,oBAAoB,IAAI,MAAM;IAI9B,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMpD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAiBhB,mFAAmF;IACnF,OAAO,CAAC,QAAQ;IAMhB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAevB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAoEnB,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,QAAQ;YAKF,UAAU;YA4DV,QAAQ;IA0BtB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;YAUF,eAAe;YAsDf,cAAc;IAM5B;;;;;;;OAOG;YACW,aAAa;IAuB3B;;;uCAGmC;IACnC,OAAO,CAAC,UAAU;YAIJ,UAAU;YAeV,mBAAmB;YA0BnB,UAAU;IA0GxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,cAAc;IA8HtB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAgBvB,oFAAoF;IACpF,OAAO,CAAC,mBAAmB;IAW3B,yFAAyF;YAC3E,oBAAoB;IAsBlC,OAAO,CAAC,SAAS;YAUH,kBAAkB;CA0DjC"}
+{"version":3,"file":"riff-backend.d.ts","sourceRoot":"","sources":["../../../src/adapters/backend/riff-backend.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,SAAS,EACV,MAAM,YAAY,CAAC;AAqCpB;;;;;;;GAOG;AACH,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,6CAA8C,CAAC;AAClF,eAAO,MAAM,qBAAqB,wBAAyB,CAAC;AAC5D,MAAM,MAAM,kBAAkB,GAAG,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAatE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;mDAC+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6DACyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;0EACsE;IACtE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;0DAEsD;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;gFAEgF;AAChF,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAQ1D;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,kBAAkB,CAE7E;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB;;iFAE6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7D;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,GAAG,IAAgC,GACpE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA2BlD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,GAAE,OAAO,4BAA2D,GAC5E;IAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAYrD;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED;gFACgF;AAChF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,EAAE,CAoEV;AA4BD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAavD;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,wBAAgB,wBAAwB,CACtC,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE,MAAmB,EAC1B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAsBf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,GAAG,IAAI,CAaf;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,EAAE,GAAG,IAAI,CAUjB;AAED;;;;;yEAKyE;AACzE,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;;2CAI2C;AAC3C,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAY7C,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAED,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;oFAEgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,EACpB,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,OAAO,CAAC,CAsBlB;AA6FD;;;;;;;;;;;;;GAaG;AACH,qBAAa,WAAY,YAAW,cAAc;IAChD,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAyC;IACvD,OAAO,CAAC,MAAM,CAAuE;IACrF,OAAO,CAAC,WAAW,CAAwC;IAC3D,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,sFAAsF;IACtF,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,MAAM,CAAS;IACvB;8EAC0E;IAC1E,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAS;IACzB;;gFAE4E;IAC5E,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,oBAAoB,CAAK;IACjC;;;;;;;;;;;;;;;;;;gFAkB4E;IAC5E,OAAO,CAAC,qBAAqB,CAAuB;IACpD,kDAAkD;IAClD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,iBAAiB,CAAU;IACnC,6CAA6C;IAC7C,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,mBAAmB,CAAU;IACrC;;;;;yCAKqC;IACrC,OAAO,CAAC,sBAAsB,CAAU;IACxC;+EAC2E;IAC3E,OAAO,CAAC,kBAAkB,CAAuB;IACjD,OAAO,CAAC,iBAAiB,CAAuB;IAChD,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,eAAe,CAA8C;IACrE,OAAO,CAAC,cAAc,CAAiC;IACvD,OAAO,CAAC,aAAa,CAA8B;IACnD;;6EAEyE;IACzE,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,qBAAqB,CAAuB;IACpD,OAAO,CAAC,sBAAsB,CAAqD;IACnF,OAAO,CAAC,2BAA2B,CAAqD;IACxF;;8DAE0D;IAC1D,OAAO,CAAC,UAAU,CAAoC;gBAE1C,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM;IASxD,2EAA2E;IAC3E,WAAW,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAK5C,4EAA4E;IAC5E,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhC;;+EAE2E;IAC3E,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAKnD;;;;;8DAK0D;IAC1D,OAAO,CAAC,MAAM;YAIA,UAAU;IA+CxB,OAAO,CAAC,4BAA4B;IAIpC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI;IAK5D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkC5B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI1C,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAIxC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAItE,IAAI,IAAI,IAAI;IAaN,cAAc,IAAI,OAAO,CAAC,oBAAoB,CAAC;IA+H/C,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B1C,oBAAoB,IAAI,IAAI;IAQtB,qBAAqB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA0C7D,mBAAmB,IAAI,OAAO,CAAC,2BAA2B,CAAC;IA4CjE,oBAAoB,IAAI,IAAI;IAO5B,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,oBAAoB,IAAI,MAAM;IAI9B,eAAe,IAAI,MAAM;IAIzB,WAAW,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAMpD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAiBhB,mFAAmF;IACnF,OAAO,CAAC,QAAQ;IAMhB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAevB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAoEnB,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,QAAQ;YAKF,UAAU;YA4DV,QAAQ;IA0BtB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;YAUF,eAAe;YA4Ef,cAAc;IAM5B;;;;;;;OAOG;YACW,aAAa;IAuB3B;;;uCAGmC;IACnC,OAAO,CAAC,UAAU;YAIJ,UAAU;YAeV,mBAAmB;YA0BnB,UAAU;IA0GxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,cAAc;IA8HtB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAgBvB,oFAAoF;IACpF,OAAO,CAAC,mBAAmB;IAW3B,yFAAyF;YAC3E,oBAAoB;IAsBlC,OAAO,CAAC,SAAS;YAUH,kBAAkB;CA0DjC"}

package/dist/adapters/backend/riff-backend.js

@@ -1,7 +1,8 @@
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { execFileSync } from 'node:child_process';
+import { join, delimiter } from 'node:path';
+import { execFileSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
 import { createHash } from 'node:crypto';
 import { logger } from '../../utils/logger.js';
 import { escapeXmlTagLikeTokens } from '../../utils/xml.js';
@@ -166,7 +167,7 @@ export function deriveRiffReposFromDirs(dirs, deriveOne = deriveRiffRepoFromWork
 export async function cancelRiffTaskById(cfg, taskId) {
     const attempt = async () => {
         const headers = { 'Content-Type': 'application/json' };
-        const jwt = new RiffBackend(cfg, 'orphan-cancel')['resolveJwt']();
+        const jwt = await new RiffBackend(cfg, 'orphan-cancel')['resolveJwt']({ allowRefresh: false });
         if (jwt)
             headers['x-jwt-token'] = jwt;
         const resp = await fetch(`${cfg.baseUrl}/api/task-cancel`, {
@@ -229,6 +230,12 @@ function aimeDataHome(env) {
         return null;
     return join(workspace, sanitizeAimeUser(user), '.local', 'share');
 }
+/** True when BOTH AIME vars are set (trimmed non-empty), i.e. bytedcli swaps its
+ *  storage root to the AIME workspace. In that runtime we must not trigger a
+ *  host-identity JWT refresh — see resolveJwt's fail-closed skip. */
+function isFullAimeRuntime(env) {
+    return aimeDataHome(env) !== null;
+}
 /**
  * The keychain candidates for a ByteCloud tool's `bytecloud-auth/` store, across
  * the CLIs botmux users log into (kaboo-cli / aiden-cli / cjadk / bytedcli).
@@ -426,6 +433,129 @@ export function readBytecloudKeychainJwt(home = homedir(), env = process.env, no
     }
     return bestLive?.jwt ?? opaqueFallback;
 }
+/**
+ * Locate a `bytedcli` binary on PATH (used to build the default JWT-refresh
+ * command). Returns the bare name `bytedcli` when found so execFileSync resolves
+ * it via PATH, or null when absent. Injectable env/platform for testing.
+ *
+ * We look for a real installed binary rather than defaulting to
+ * `npx @bytedance-dev/bytedcli@latest`: an uncached / `@latest` npx resolve can
+ * block ~30s, which is unacceptable on the synchronous pre-request path. If
+ * bytedcli is not installed we simply do not auto-refresh (fail-closed to the
+ * prior behaviour — the request may 401, exactly as before this change).
+ */
+export function findBytedcliBinary(env = process.env, platform = process.platform) {
+    const pathVar = env.PATH ?? env.Path ?? '';
+    if (!pathVar)
+        return null;
+    const names = platform === 'win32' ? ['bytedcli.cmd', 'bytedcli.exe', 'bytedcli'] : ['bytedcli'];
+    for (const dir of pathVar.split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const name of names) {
+            try {
+                if (existsSync(join(dir, name)))
+                    return 'bytedcli';
+            }
+            catch { /* ignore unreadable PATH entry */ }
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the JWT-refresh command: explicit config → env
+ * `BOTMUX_RIFF_JWT_REFRESH_CMD` (space-split) → a PATH-resident bytedcli →
+ * null (no auto-refresh). See RiffBackendConfig.jwtRefreshCmd for the rationale.
+ */
+export function resolveJwtRefreshCmd(configured, env = process.env, platform = process.platform) {
+    if (configured && configured.length > 0)
+        return configured;
+    const fromEnv = env.BOTMUX_RIFF_JWT_REFRESH_CMD?.trim();
+    if (fromEnv) {
+        const parts = fromEnv.split(/\s+/).filter(Boolean);
+        if (parts.length > 0)
+            return parts;
+    }
+    const bin = findBytedcliBinary(env, platform);
+    if (bin)
+        return [bin, 'auth', 'get-bytecloud-jwt-token', '--force-refresh'];
+    return null;
+}
+/** Minimum gap between speculative JWT refresh attempts. When the keychain
+ *  holds no live token, a reconnect/follow-up loop would otherwise trigger a
+ *  refresh on EVERY getJwt() call; we cap proactive refreshes at one per window
+ *  and let the shared keychain re-read serve the rest. Also caps the cost of a
+ *  refresh command that keeps failing (e.g. bytedcli not logged in). A refresh
+ *  driven by an actual server 401 bypasses this window (see `force`). */
+export const JWT_REFRESH_DEBOUNCE_MS = 60_000;
+/** How long a single refresh command may run before we give up. Once the
+ *  refresh is asynchronous (below) this no longer blocks the event loop — it
+ *  only bounds one awaited child process — so we keep it generous: a cold
+ *  bytedcli token fetch can take a few seconds, and a session that cannot get a
+ *  JWT has nothing useful to do anyway. */
+export const JWT_REFRESH_TIMEOUT_MS = 30_000;
+/** Process-wide last-attempt timestamp (ms). Shared across RiffBackend instances
+ *  because the orphan-cancel path builds a throwaway instance per call — a
+ *  per-instance clock there would never debounce. `-Infinity` means "never
+ *  attempted", so the first call always runs regardless of the clock's
+ *  magnitude. Reset helper for tests. */
+let lastJwtRefreshAtMs = Number.NEGATIVE_INFINITY;
+/** In-flight refresh, shared process-wide so concurrent callers COALESCE onto a
+ *  single child process instead of each spawning their own bytedcli. `null`
+ *  between attempts. */
+let inFlightJwtRefresh = null;
+export function __resetJwtRefreshDebounceForTest() {
+    lastJwtRefreshAtMs = Number.NEGATIVE_INFINITY;
+    inFlightJwtRefresh = null;
+}
+/**
+ * Run the JWT-refresh command once, ASYNCHRONOUSLY. Never throws: a missing
+ * command, a non-zero exit, or a timeout all resolve to `false` (the caller then
+ * falls back to whatever the keychain holds — i.e. the pre-change behaviour).
+ * Resolves true only when a command actually ran to completion.
+ *
+ * Async + injectable (runner / now / force) so it never blocks the event loop
+ * (critical on the daemon-side orphan-cancel path) and the debounce / coalesce /
+ * fail-closed paths are unit-testable without spawning a real process.
+ *
+ * COALESCE: if a refresh is already in flight, ride it instead of spawning a
+ * second bytedcli — concurrent getJwt() callers share one refresh.
+ */
+export function refreshBytecloudJwt(cmd, opts = {}) {
+    const { runner = defaultJwtRefreshRunner, nowMs = Date.now(), force = false } = opts;
+    if (!cmd || cmd.length === 0)
+        return Promise.resolve(false);
+    // Coalesce first: a forced caller still rides an in-flight refresh rather than
+    // racing a second child — the running one will rewrite the keychain either way.
+    if (inFlightJwtRefresh)
+        return inFlightJwtRefresh;
+    // Debounce: cap the cost of a refresh that keeps failing. A forced (401-driven)
+    // refresh bypasses the window — the token was provably rejected.
+    if (!force && nowMs - lastJwtRefreshAtMs < JWT_REFRESH_DEBOUNCE_MS)
+        return Promise.resolve(false);
+    lastJwtRefreshAtMs = nowMs;
+    const [bin, ...args] = cmd;
+    const run = (async () => {
+        try {
+            await runner(bin, args);
+            return true;
+        }
+        catch (err) {
+            logger.warn(`[riff] JWT refresh command failed: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    })();
+    inFlightJwtRefresh = run;
+    return run.finally(() => { if (inFlightJwtRefresh === run)
+        inFlightJwtRefresh = null; });
+}
+const execFileAsync = promisify(execFile);
+/** Default refresh runner: async execFile with a bounded timeout. stdout/stderr
+ *  are discarded — the command's SIDE EFFECT (rewriting the keychain) is what
+ *  matters; we re-read the keychain afterwards rather than parse its output. */
+async function defaultJwtRefreshRunner(bin, args) {
+    await execFileAsync(bin, args, { timeout: JWT_REFRESH_TIMEOUT_MS });
+}
 function defaultRunGit(cwd) {
     return (args) => {
         try {
@@ -596,11 +726,17 @@ export class RiffBackend {
         if (this.currentTaskId)
             cb(this.currentTaskId);
     }
-    /** Resolve JWT dynamically — re-reads env/keychain each call so auto-refresh works. */
-    getJwt() {
-        return this.resolveJwt();
-    }
-    resolveJwt() {
+    /** Resolve JWT dynamically — re-reads env/keychain each call so auto-refresh
+     *  works. Async because a keychain miss may trigger a (non-blocking) CLI
+     *  refresh. `opts.allowRefresh=false` skips the refresh entirely (daemon-side
+     *  orphan-cancel: a best-effort teardown must never freeze the daemon on a
+     *  host-identity refresh). `opts.forceRefresh=true` bypasses the debounce
+     *  window (an actual server 401 proved the token bad). */
+    getJwt(opts = {}) {
+        return this.resolveJwt(opts);
+    }
+    async resolveJwt(opts = {}) {
+        const { allowRefresh = true, forceRefresh = false } = opts;
         if (this.config.jwt)
             return this.config.jwt;
         const envKey = this.config.jwtEnv ?? 'RIFF_JWT';
@@ -609,10 +745,37 @@ export class RiffBackend {
             return fromEnv;
         // Fallback: try ByteCloud Auth SDK keychain (kaboo-cli / aiden-cli / cjadk / bytedcli)
         const fromKeychain = this.readJwtFromBytecloudKeychain();
-        if (fromKeychain) {
+        // A forced refresh (post-401) intentionally ignores an existing keychain
+        // token: the server just rejected whatever we had, so re-reading the same
+        // store without refreshing first would hand back the same bad token.
+        if (fromKeychain && !forceRefresh) {
             logger.info(`[riff] JWT loaded from ByteCloud keychain`);
             return fromKeychain;
         }
+        // No live keychain token (or a forced post-401 refresh) — every candidate is
+        // expired, within the safety window, or absent. This is exactly the "token
+        // expired mid-task" / "expired at startup" case (the JWT is re-read per
+        // request). Before giving up to a 401 that would abort the turn, ask the
+        // owning CLI to refresh (non-blocking async, coalesced, non-fatal), then
+        // re-read once. Skipped when allowRefresh=false (daemon-side orphan-cancel)
+        // and inside a full AIME runtime (fail-closed identity boundary — we never
+        // trigger a host-identity refresh there; the AIME store is refreshed inside
+        // AIME).
+        if (allowRefresh && !isFullAimeRuntime(process.env)) {
+            const cmd = resolveJwtRefreshCmd(this.config.jwtRefreshCmd);
+            if (await refreshBytecloudJwt(cmd, { force: forceRefresh })) {
+                const refreshed = this.readJwtFromBytecloudKeychain();
+                if (refreshed) {
+                    logger.info(`[riff] JWT refreshed via ByteCloud CLI and reloaded from keychain`);
+                    return refreshed;
+                }
+            }
+        }
+        // Forced refresh found nothing new — fall back to the (rejected) keychain
+        // token rather than null: a stale token is no worse than no token, and the
+        // caller already knows it 401'd.
+        if (fromKeychain)
+            return fromKeychain;
         logger.warn(`[riff] JWT not found in config, env ${envKey}, or ByteCloud keychain; API calls will fail`);
         return null;
     }
@@ -1249,11 +1412,31 @@ export class RiffBackend {
             body = JSON.stringify(payload);
         }
         // Resolve JWT last — right before the request — so the safety-window
-        // freshness check reflects the token that actually goes on the wire.
-        const jwt = this.getJwt();
-        if (jwt)
-            headers['x-jwt-token'] = jwt;
-        const resp = await fetch(url, { method: 'POST', headers, body, signal: AbortSignal.timeout(this.createTimeoutMs) });
+        // freshness check reflects the token that actually goes on the wire. `body`
+        // (string or FormData) is re-extractable per fetch, so the retry below can
+        // reuse it.
+        const post = (jwt) => {
+            const h = { ...headers };
+            if (jwt)
+                h['x-jwt-token'] = jwt;
+            return fetch(url, { method: 'POST', headers: h, body, signal: AbortSignal.timeout(this.createTimeoutMs) });
+        };
+        const firstJwt = await this.getJwt();
+        let resp = await post(firstJwt);
+        // One retry on an auth rejection. A 401/403 is authoritative proof the token
+        // was bad (expired mid-flight / stale at startup), so it justifies forcing a
+        // JWT refresh that bypasses the debounce window. We retry ONLY when the
+        // refresh produced a genuinely different token — otherwise the second POST
+        // would just replay the same rejected credential (this also naturally
+        // no-ops inside a full AIME runtime, where the host refresh is skipped).
+        // Other statuses (400/5xx) are not auth problems and are not retried.
+        if (resp.status === 401 || resp.status === 403) {
+            const freshJwt = await this.getJwt({ forceRefresh: true });
+            if (freshJwt && freshJwt !== firstJwt) {
+                logger.warn(`[riff] task create/follow-up got HTTP ${resp.status}; retrying once with a refreshed JWT`);
+                resp = await post(freshJwt);
+            }
+        }
         if (!resp.ok)
             throw new Error(`HTTP ${resp.status}: ${await resp.text()}`);
         const result = (await resp.json());
@@ -1316,7 +1499,7 @@ export class RiffBackend {
     async cancelTask(taskId) {
         const url = `${this.config.baseUrl}/api/task-cancel`;
         const headers = { 'Content-Type': 'application/json' };
-        const jwt = this.getJwt();
+        const jwt = await this.getJwt();
         if (jwt)
             headers['x-jwt-token'] = jwt;
         const resp = await fetch(url, {
@@ -1361,7 +1544,7 @@ export class RiffBackend {
     async streamTask(taskId) {
         const url = `${this.config.baseUrl}/api2/task-stream?id=${encodeURIComponent(taskId)}`;
         const headers = {};
-        const jwt = this.getJwt();
+        const jwt = await this.getJwt();
         if (jwt)
             headers['x-jwt-token'] = jwt;
         this.abortController = new AbortController();
@@ -1680,7 +1863,7 @@ export class RiffBackend {
         try {
             const url = `${this.config.baseUrl}/api/task-detail?id=${encodeURIComponent(taskId)}`;
             const headers = {};
-            const jwt = this.getJwt();
+            const jwt = await this.getJwt();
             if (jwt)
                 headers['x-jwt-token'] = jwt;
             const resp = await fetch(url, { headers, signal: AbortSignal.timeout(8000) });
@@ -1712,7 +1895,7 @@ export class RiffBackend {
         try {
             const url = `${this.config.baseUrl}/api/task-detail?id=${encodeURIComponent(taskId)}`;
             const headers = {};
-            const jwt = this.getJwt();
+            const jwt = await this.getJwt();
             if (jwt)
                 headers['x-jwt-token'] = jwt;
             const resp = await fetch(url, { headers, signal: AbortSignal.timeout(8000) });