edsger 0.72.2 → 0.72.3

package/dist/supabase/client.d.ts

@@ -19,5 +19,16 @@ export declare function getSupabase(): SupabaseClient;
  * usable for direct-SDK calls.
  */
 export declare function hasSupabaseSession(): boolean;
+/**
+ * Wait for the most recent setSession to finish applying, then report whether
+ * the client actually holds a usable user session.
+ *
+ * Returns false when the synced token was stale/expired and supabase-js
+ * dropped the session — in that state REST calls run as `anon` (auth.uid() is
+ * NULL) and any insert into an RLS table with `WITH CHECK (auth.uid() =
+ * user_id)` is rejected. Writers should gate the direct-SDK path on this and
+ * fall back to the MCP edge function (service-role) when it returns false.
+ */
+export declare function ensureSupabaseSession(): Promise<boolean>;
 /** Reset module state. Test-only. */
 export declare function resetSupabaseClient(): void;

package/dist/supabase/client.js

@@ -14,6 +14,8 @@ const AUTH_FILE = join(homedir(), '.edsger', 'auth.json');
 let _client = null;
 let _watcherInstalled = false;
 let _lastAppliedAccessToken;
+/** The in-flight setSession promise, awaited by ensureSupabaseSession(). */
+let _sessionReady = null;
 /**
  * Get (or lazily create) the shared SupabaseClient.
  *
@@ -39,7 +41,11 @@ export function getSupabase() {
             detectSessionInUrl: false,
         },
     });
-    void _client.auth.setSession({
+    // Capture the setSession promise so writers can await it (via
+    // ensureSupabaseSession) before issuing inserts. Without this, the first
+    // REST call can race ahead of setSession and go out as `anon` (no user
+    // JWT), tripping the `auth.uid() = user_id` RLS check.
+    _sessionReady = _client.auth.setSession({
         access_token: accessToken,
         refresh_token: refreshToken ?? '',
     });
@@ -54,6 +60,32 @@ export function getSupabase() {
 export function hasSupabaseSession() {
     return Boolean(getSupabaseUrl() && getSupabaseAnonKey() && getAccessToken());
 }
+/**
+ * Wait for the most recent setSession to finish applying, then report whether
+ * the client actually holds a usable user session.
+ *
+ * Returns false when the synced token was stale/expired and supabase-js
+ * dropped the session — in that state REST calls run as `anon` (auth.uid() is
+ * NULL) and any insert into an RLS table with `WITH CHECK (auth.uid() =
+ * user_id)` is rejected. Writers should gate the direct-SDK path on this and
+ * fall back to the MCP edge function (service-role) when it returns false.
+ */
+export async function ensureSupabaseSession() {
+    if (!hasSupabaseSession()) {
+        return false;
+    }
+    try {
+        const client = getSupabase();
+        if (_sessionReady) {
+            await _sessionReady;
+        }
+        const { data } = await client.auth.getSession();
+        return Boolean(data.session?.access_token);
+    }
+    catch {
+        return false;
+    }
+}
 function installAuthWatcher() {
     if (_watcherInstalled) {
         return;
@@ -70,7 +102,7 @@ function installAuthWatcher() {
                 return;
             }
             _lastAppliedAccessToken = nextAccess;
-            void _client.auth.setSession({
+            _sessionReady = _client.auth.setSession({
                 access_token: nextAccess,
                 refresh_token: nextRefresh ?? '',
             });
@@ -87,4 +119,5 @@ export function resetSupabaseClient() {
     _client = null;
     _watcherInstalled = false;
     _lastAppliedAccessToken = undefined;
+    _sessionReady = null;
 }

package/dist/system/session-manager.js

@@ -10,7 +10,7 @@ import { hostname } from 'os';
 import { callMcpEndpoint } from '../api/mcp-client.js';
 import { getUserId } from '../auth/auth-store.js';
 import { getVersion } from '../constants.js';
-import { getSupabase, hasSupabaseSession } from '../supabase/client.js';
+import { ensureSupabaseSession, getSupabase, hasSupabaseSession, } from '../supabase/client.js';
 import { initLogSync, logInfo, logWarning, stopLogSync, } from '../utils/logger.js';
 let currentSessionId = null;
 let heartbeatTimer;
@@ -63,7 +63,13 @@ export async function registerSession(options) {
     const invocation = process.argv.slice(2).join(' ') || undefined;
     try {
         const userId = getUserId();
-        if (hasSupabaseSession() && userId) {
+        // ensureSupabaseSession() awaits the in-flight setSession and confirms the
+        // client holds a live user session — so a token that hasn't applied yet
+        // (race) or was dropped (stale → anon) doesn't silently write as anon and
+        // trip the cli_sessions RLS check. The desktop refreshes the token into
+        // auth.json before spawning the CLI, so this should hold for app-spawned
+        // runs; the MCP branch stays for the legacy no-Supabase-session path.
+        if (userId && (await ensureSupabaseSession())) {
             const row = {
                 session_id: sessionId,
                 user_id: userId,

package/dist/utils/logger.js

@@ -1,7 +1,7 @@
 import { callMcpEndpoint } from '../api/mcp-client.js';
 import { getUserId } from '../auth/auth-store.js';
 import { getVersion } from '../constants.js';
-import { getSupabase, hasSupabaseSession } from '../supabase/client.js';
+import { ensureSupabaseSession, getSupabase } from '../supabase/client.js';
 export const colors = {
     reset: '\x1b[0m',
     bright: '\x1b[1m',
@@ -49,13 +49,16 @@ export async function flushLogs() {
         return;
     }
     const batch = _logBuffer.splice(0);
+    const sessionId = _logSyncSessionId;
     try {
         const userId = getUserId();
-        if (hasSupabaseSession() && userId) {
+        if (userId && (await ensureSupabaseSession())) {
             // Direct-SDK path. user_id is set explicitly per row to satisfy the
-            // cli_logs RLS check (auth.uid() = user_id).
+            // cli_logs RLS check (auth.uid() = user_id). Gating on a confirmed
+            // session keeps a stale token (→ anon) from writing as anon and tripping
+            // RLS — desktop refreshes the token into auth.json before spawning.
             const rows = batch.slice(0, 200).map((log) => ({
-                session_id: _logSyncSessionId,
+                session_id: sessionId,
                 user_id: userId,
                 level: log.level,
                 message: log.message,
@@ -68,7 +71,7 @@ export async function flushLogs() {
         }
         else {
             await callMcpEndpoint('cli_logs/batch', {
-                session_id: _logSyncSessionId,
+                session_id: sessionId,
                 logs: batch,
             });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "edsger",
-  "version": "0.72.2",
+  "version": "0.72.3",
   "type": "module",
   "bin": {
     "edsger": "dist/index.js"