bunnyquery 1.0.5 → 1.0.7

package/bunnyquery.js

@@ -34,9 +34,12 @@
 
     // ---- MCP OAuth constants (mirrors src/code/mcp_oauth.ts) ---------------
     // The embed has no build-time env, so we always point at the production
-    // MCP host. Override BunnyQuery.MCP_BASE_URL before init() to swap.
+    // MCP host. Override BunnyQuery.MCP_BASE_URL before init() to swap, or
+    // pass `true` as the third arg to BunnyQuery.init() to target the dev
+    // host (mcp-dev.broadwayinc.computer).
     const DEFAULTS = {
         MCP_BASE_URL: 'https://mcp.broadwayinc.computer',
+        MCP_DEV_BASE_URL: 'https://mcp-dev.broadwayinc.computer',
         MCP_NAME: 'BunnyQuery',
         DEFAULT_CLAUDE_MODEL: 'claude-sonnet-4-6',
         DEFAULT_OPENAI_MODEL: 'gpt-5.4',
@@ -58,6 +61,11 @@
     const TOKEN_KEY = STORAGE_PREFIX + 'mcp_token';
     const STATE_KEY = STORAGE_PREFIX + 'mcp_state';
 
+    // Resolve the active MCP base URL each time it's needed so a runtime
+    // override of `BunnyQuery.MCP_BASE_URL` (e.g. via the `dev` flag on
+    // init()) is reflected in subsequent send/auth calls.
+    const _mcpBaseUrl = () => (global.BunnyQuery && global.BunnyQuery.MCP_BASE_URL) || DEFAULTS.MCP_BASE_URL;
+
     // ----- helpers ----------------------------------------------------------
     const $ = (tag, attrs, children) => {
         const el = document.createElement(tag);
@@ -376,7 +384,7 @@
                     {
                         type: 'url',
                         name: DEFAULTS.MCP_NAME,
-                        url: DEFAULTS.MCP_BASE_URL,
+                        url: _mcpBaseUrl(),
                         authorization_token: '$ACCESS_TOKEN',
                     },
                 ],
@@ -422,7 +430,7 @@
                     {
                         type: 'mcp',
                         server_label: DEFAULTS.MCP_NAME,
-                        server_url: DEFAULTS.MCP_BASE_URL,
+                        server_url: _mcpBaseUrl(),
                         require_approval: 'never',
                         headers: { Authorization: 'Bearer $ACCESS_TOKEN' },
                     },
@@ -484,6 +492,50 @@
         return 'Request failed. Please try again.';
     }
 
+    // Detect MCP / upstream "your access token is no longer valid" failures
+    // so we can transparently re-mint the MCP token from the live skapi
+    // session and retry the call once. Patterns observed in the wild:
+    //   - skapi-js inside the MCP server throws "Token has expired"
+    //     (surfaces here as part of err.message or response body text)
+    //   - MCP returns OAuth-style error codes: invalid_token / expired_token
+    //   - Proxy wraps it with INVALID_REQUEST + 401
+    function _isAuthExpiredError(input) {
+        if (!input) return false;
+        const blobs = [];
+        const push = (v) => { if (typeof v === 'string' && v) blobs.push(v); };
+        if (typeof input === 'string') push(input);
+        else {
+            push(input.message);
+            push(input.code);
+            if (input.error) {
+                push(input.error.message);
+                push(input.error.code);
+                push(input.error.type);
+            }
+            if (input.body) {
+                push(input.body.message);
+                if (input.body.error) {
+                    push(input.body.error.message);
+                    push(input.body.error.code);
+                    push(input.body.error.type);
+                }
+            }
+            if (typeof input.status === 'number' && input.status === 401) return true;
+            if (typeof input.status_code === 'number' && input.status_code === 401) return true;
+        }
+        const hay = blobs.join(' | ').toLowerCase();
+        if (!hay) return false;
+        return (
+            hay.includes('token has expired') ||
+            hay.includes('token is expired') ||
+            hay.includes('expired_token') ||
+            hay.includes('invalid_token') ||
+            hay.includes('unauthorized') ||
+            hay.includes('not authorized') ||
+            (hay.includes('invalid_request') && hay.includes('token'))
+        );
+    }
+
     // Mirror of agent.vue's isErrorResponseBody — detects provider/proxy
     // error payloads that should render as a red error bubble even when
     // no exception was thrown.
@@ -576,7 +628,7 @@
 
             this.readOnly = !!(info.opt && info.opt.freeze_database);
 
-            this.oauth = new McpOAuth(BunnyQuery.MCP_BASE_URL || DEFAULTS.MCP_BASE_URL);
+            this.oauth = new McpOAuth(_mcpBaseUrl());
 
             this.messages = [];
             this.attachments = [];
@@ -585,6 +637,7 @@
             this.sending = false;
             this.uploading = false;
             this.pendingTimer = null;
+            this._pollingPending = false;
             this._loadingOlder = false;
 
             this.refs = {};
@@ -593,11 +646,17 @@
             this._bootstrap();
         }
 
-        static async init(skapi, elementId) {
+        static async init(skapi, elementId, dev) {
             const container = typeof elementId === 'string'
                 ? document.getElementById(elementId)
                 : elementId;
             if (!container) throw new Error(`BunnyQuery: container "${elementId}" not found`);
+            // When `dev` is truthy, route every MCP call (Claude tool URL,
+            // OpenAI tool URL, and OAuth) to the dev host. Setting the
+            // static here makes the change visible to any subsequent
+            // BunnyQuery instance on the page; pass `false` (or omit) to
+            // pin back to production.
+            BunnyQuery.MCP_BASE_URL = dev ? DEFAULTS.MCP_DEV_BASE_URL : DEFAULTS.MCP_BASE_URL;
             const info = await skapi.__connection;
             console.log('[BunnyQuery] initializing with info', info);
             return new BunnyQuery(skapi, info, container);
@@ -1075,12 +1134,24 @@
 
         // ---- history ------------------------------------------------------
         async _loadFirstHistoryPage() {
+            const fetchPage = () => getChatHistory(
+                this.skapi,
+                { service: this.serviceId, owner: this.ownerId, platform: this.platform },
+                { ascending: false }
+            );
             try {
-                const res = await getChatHistory(
-                    this.skapi,
-                    { service: this.serviceId, owner: this.ownerId, platform: this.platform },
-                    { ascending: false }
-                );
+                let res;
+                try {
+                    res = await fetchPage();
+                } catch (err) {
+                    if (_isAuthExpiredError(err)) {
+                        this.oauth.clearToken();
+                        await this.oauth.exchangeSession(this.skapi.session);
+                        res = await fetchPage();
+                    } else {
+                        throw err;
+                    }
+                }
                 this.startKeyHistory = res && res.startKeyHistory;
                 const list = this._filterByClearHorizon((res && res.list) || []);
                 // If the clear horizon has filtered the entire first page,
@@ -1124,46 +1195,57 @@
             }
         }
 
+        // Polling state machine. Invariant: at most ONE of the following
+        // is true at any moment — (a) `pendingTimer` is armed, or (b)
+        // `_pollingPending` is true (fetch in flight). Any call to
+        // `_schedulePendingPoll` while either is true is a no-op; the
+        // in-flight cycle's `finally` will continue the loop.
+        //
+        // This replaces an earlier clear-and-rearm pattern that, under
+        // overlapping callers (`_sendMessage`, `_loadFirstHistoryPage`,
+        // and the poll's own `finally`), could leave two timers
+        // concurrently armed. Each tick's `finally` then scheduled
+        // another, and the effective polling rate kept compounding —
+        // the chat looked like it was polling faster and faster.
         _schedulePendingPoll() {
-            if (this.pendingTimer) clearTimeout(this.pendingTimer);
-            if (!this._anyPending()) return;
-            // Bail if a poll is already in flight — its `finally` will
-            // schedule the next one. Without this guard, any caller that
-            // fires while we're awaiting `getChatHistory` (e.g. another
-            // _sendMessage, _loadFirstHistoryPage, or our own previous
-            // tick whose timer already elapsed) would spawn a second
-            // concurrent poller, and each subsequent cycle would compound
-            // — making the polling appear faster and faster.
+            if (this.pendingTimer != null) return;
             if (this._pollingPending) return;
-            this.pendingTimer = setTimeout(async () => {
+            if (!this._anyPending()) return;
+            this.pendingTimer = setTimeout(() => {
                 this.pendingTimer = null;
-                this._pollingPending = true;
-                try {
-                    const res = await getChatHistory(
-                        this.skapi,
-                        { service: this.serviceId, owner: this.ownerId, platform: this.platform },
-                        { ascending: false }
-                    );
-                    const fresh = mapHistoryToMessages(
-                        this._filterByClearHorizon((res && res.list) || []),
-                        this.platform
-                    );
-                    // Keep older messages whose ids are not on the freshly
-                    // fetched first page. The fresh page is appended last so
-                    // it always reflects the latest server state.
-                    const freshIds = new Set(fresh.filter((m) => m.id).map((m) => m.id));
-                    const older = this.messages.filter((m) => m.id && !freshIds.has(m.id));
-                    this.messages = older.concat(fresh);
-                    this._renderMessages();
-                } catch (err) {
-                    console.error('[BunnyQuery] pending poll failed', err);
-                } finally {
-                    this._pollingPending = false;
-                    this._schedulePendingPoll();
-                }
+                this._runPendingPoll();
             }, DEFAULTS.PENDING_POLL_INTERVAL_MS);
         }
 
+        async _runPendingPoll() {
+            // Defensive: if somehow re-entered, drop the duplicate.
+            if (this._pollingPending) return;
+            this._pollingPending = true;
+            try {
+                const res = await getChatHistory(
+                    this.skapi,
+                    { service: this.serviceId, owner: this.ownerId, platform: this.platform },
+                    { ascending: false }
+                );
+                const fresh = mapHistoryToMessages(
+                    this._filterByClearHorizon((res && res.list) || []),
+                    this.platform
+                );
+                // Keep older messages whose ids are not on the freshly
+                // fetched first page. The fresh page is appended last so
+                // it always reflects the latest server state.
+                const freshIds = new Set(fresh.filter((m) => m.id).map((m) => m.id));
+                const older = this.messages.filter((m) => m.id && !freshIds.has(m.id));
+                this.messages = older.concat(fresh);
+                this._renderMessages();
+            } catch (err) {
+                console.error('[BunnyQuery] pending poll failed', err);
+            } finally {
+                this._pollingPending = false;
+                this._schedulePendingPoll();
+            }
+        }
+
         // ---- attachments --------------------------------------------------
         _onAttachFromInput(e) {
             const files = Array.from(e.target.files || []);
@@ -1348,13 +1430,42 @@ The same pattern applies to other formats: \`\`\`my-data.json, \`\`\`index.html,
                     model: this.model || undefined,
                 };
 
-                const result = this.platform === 'claude'
-                    ? await buildClaudeRequest(this.skapi, args)
-                    : await buildOpenAIRequest(this.skapi, args);
+                const argsBuilder = () => (this.platform === 'claude'
+                    ? buildClaudeRequest(this.skapi, args)
+                    : buildOpenAIRequest(this.skapi, args));
+
+                let result;
+                try {
+                    result = await argsBuilder();
+                } catch (err) {
+                    if (_isAuthExpiredError(err)) {
+                        // The MCP-side skapi session expired. Re-mint a fresh
+                        // MCP token bundle from the live host skapi session
+                        // (skapi-js auto-refreshes its own tokens), then retry
+                        // the call once.
+                        try {
+                            this.oauth.clearToken();
+                            await this.oauth.exchangeSession(this.skapi.session);
+                        } catch (reauthErr) {
+                            throw reauthErr;
+                        }
+                        result = await argsBuilder();
+                    } else {
+                        throw err;
+                    }
+                }
 
                 // The proxy may resolve with an error-shaped body instead of
                 // throwing; surface that as an error bubble with the
                 // upstream message rather than dropping it.
+                if (isErrorResponseBody(result) && _isAuthExpiredError(result)) {
+                    try {
+                        this.oauth.clearToken();
+                        await this.oauth.exchangeSession(this.skapi.session);
+                        result = await argsBuilder();
+                    } catch (_reauthErr) { /* fall through to normal error rendering */ }
+                }
+
                 if (isErrorResponseBody(result)) {
                     const errMsg = getErrorMessage(result);
                     const last = this.messages[this.messages.length - 1];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "BunnyQuery AI chat client",
   "main": "bunnyquery.js",
   "files": [