copillm 0.3.0-beta.3 → 0.3.0-beta.4

package/dist/cli/packageInfo.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
 const FALLBACK_PACKAGE_INFO = {
     name: "copillm",
-    version: "0.3.0-beta.3"
+    version: "0.3.0-beta.4"
 };
 export function getPackageInfo() {
     const envName = cleanPackageValue(process.env.COPILLM_PACKAGE_NAME);

package/dist/server/debugInfo.js

@@ -1,9 +1,18 @@
 import { setTimeout as defaultSleep } from "node:timers/promises";
+import { createHash } from "node:crypto";
 import { githubUserUrl } from "../config/upstream.js";
 import { isRetryableStatus, isRetryableTransportError, retryDelayMs } from "./upstream/retryPolicy.js";
 const CACHE_TTL_MS = 5 * 60 * 1_000;
 const DEFAULT_MAX_ATTEMPTS = 3;
-let cached = null;
+// Cache keyed by a hash of the GitHub token. It MUST be per-token: different
+// tokens identify different GitHub accounts, and a token-blind cache returns
+// one account's identity for another's — which silently broke multi-account
+// `auth login` (a second login appeared to be the same account and overwrote
+// the first). Hashing avoids retaining raw tokens as map keys.
+const cache = new Map();
+function cacheKey(token) {
+    return createHash("sha256").update(token).digest("hex");
+}
 /**
  * Fetch the GitHub user summary with bounded retries on transient failures.
  *
@@ -20,8 +29,10 @@ let cached = null;
  */
 export async function getGithubUserSummary(githubToken, options = {}) {
     const now = Date.now();
-    if (cached && now - cached.fetchedAt < CACHE_TTL_MS) {
-        return cached.summary;
+    const key = cacheKey(githubToken);
+    const hit = cache.get(key);
+    if (hit && now - hit.fetchedAt < CACHE_TTL_MS) {
+        return hit.summary;
     }
     const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
     const sleepImpl = options.sleepImpl ?? ((ms) => defaultSleep(ms));
@@ -60,7 +71,7 @@ export async function getGithubUserSummary(githubToken, options = {}) {
                 html_url: typeof payload.html_url === "string" ? payload.html_url : null,
                 plan_name: typeof payload.plan?.name === "string" ? payload.plan.name : null
             };
-            cached = { fetchedAt: Date.now(), summary };
+            cache.set(key, { fetchedAt: Date.now(), summary });
             return summary;
         }
         // Non-OK. 401/403/404 are terminal — fast-fail. Other retryable statuses
@@ -79,7 +90,7 @@ export async function getGithubUserSummary(githubToken, options = {}) {
     throw lastError ?? new Error("GitHub user lookup exhausted retries without error context.");
 }
 export function clearGithubUserCache() {
-    cached = null;
+    cache.clear();
 }
 export class GithubUserFetchError extends Error {
     status;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copillm",
-  "version": "0.3.0-beta.3",
+  "version": "0.3.0-beta.4",
   "description": "Local Copilot proxy CLI (OpenAI/Anthropic-compatible)",
   "license": "MIT",
   "type": "module",