gipity 1.0.412 → 1.0.413

package/dist/auth.js

@@ -166,6 +166,15 @@ export async function refreshTokenIfNeeded(force = false) {
     const fresh = (a) => Date.now() <= new Date(a.expiresAt).getTime() - buffer;
     if (!force && fresh(auth))
         return; // fast path: token still good, no lock needed
+    // The specific access token the caller saw (the one the server just rejected on the
+    // force path). A locally-"fresh" token EQUAL to this can't be trusted - it's exactly
+    // what got a 401 - but a DIFFERENT fresh token means a sibling successfully rotated
+    // while we waited, and we should adopt it instead of re-refreshing with the (now
+    // single-use-consumed) refresh token. Without this, N concurrent relay dispatches
+    // that all 401 at once serialize on the lock, the first refreshes, and every other
+    // one re-tries the consumed token and hard-fails with "Session expired".
+    const rejectedAccess = auth.accessToken;
+    const adoptable = (a) => !!a && fresh(a) && (!force || a.accessToken !== rejectedAccess);
     // If the refresh token itself has expired, re-login is genuinely required; leave the
     // expired auth in place so the caller's existing 401 path prompts `gipity login`.
     const refreshExp = decodeJwtExp(auth.refreshToken);
@@ -175,10 +184,10 @@ export async function refreshTokenIfNeeded(force = false) {
     const release = await acquireRefreshLock();
     try {
         // Re-check under the lock: a sibling may have refreshed while we waited. Under
-        // force we skip this adopt — a locally-"fresh" token is exactly what the server
-        // just rejected, so we must actually refresh rather than re-adopt it.
+        // force we adopt only a token DIFFERENT from the one that was just rejected (a
+        // sibling's freshly-rotated token), never the rejected one itself.
         const held = readAuthFresh();
-        if (!force && held && fresh(held)) {
+        if (adoptable(held)) {
             cached = held;
             return;
         }
@@ -186,7 +195,7 @@ export async function refreshTokenIfNeeded(force = false) {
         const apiBase = resolveApiBase();
         for (let attempt = 1; attempt <= 3; attempt++) {
             const cur = readAuthFresh(); // a sibling may have just refreshed for us
-            if (!force && cur && fresh(cur)) {
+            if (adoptable(cur)) {
                 cached = cur;
                 return;
             }
@@ -218,7 +227,7 @@ export async function refreshTokenIfNeeded(force = false) {
             // sibling's fresh token just landed; otherwise stop and let the caller re-login.
             if (res.status === 401 || res.status === 403) {
                 const after = readAuthFresh();
-                if (after && fresh(after)) {
+                if (adoptable(after)) {
                     cached = after;
                     return;
                 }

package/dist/commands/relay.js

@@ -13,6 +13,7 @@ import { confirm } from '../utils.js';
 import { bold, brand, dim, success, error as clrError, muted, } from '../colors.js';
 import * as state from '../relay/state.js';
 import * as daemon from '../relay/daemon.js';
+import { revokeRelayAgentToken } from '../relay/agent-token.js';
 import { UnsupportedPlatformError } from '../relay/installers.js';
 import { pairDevice, startDaemon, installAutostart, removeAutostart } from '../relay/setup.js';
 import { registerInstallCommands } from './relay-install.js';
@@ -268,6 +269,12 @@ relayCommand
         console.error(clrError(`Server revoke failed: ${err?.message || err}`));
         console.error(muted('Local token cleared anyway. Visit the web CLI to confirm the server-side revoke.'));
     }
+    // Also revoke the relay's agent token (minted for spawned children).
+    // Best-effort: on failure it stays visible in `gipity token list`.
+    const agentTokenRevoked = await revokeRelayAgentToken();
+    if (!agentTokenRevoked && state.getAgentToken()) {
+        console.error(muted('Could not revoke the relay agent token - check `gipity token list`.'));
+    }
     state.clearDevice();
     // Remove the OS autostart unit too. Otherwise the login service relaunches
     // `relay run`, which - finding no device but a valid login - silently

package/dist/relay/agent-token.js

@@ -0,0 +1,75 @@
+/**
+ * Long-lived agent API token for relay-spawned children.
+ *
+ * The daemon itself authenticates with its device token, but the children it
+ * spawns (`gipity sync`, `gipity claude -p`) used to fall back to the shared
+ * session in ~/.gipity/auth.json - and with up to 6 concurrent dispatches,
+ * sibling processes raced each other on the session's SINGLE-USE refresh
+ * token, intermittently failing with "Session expired" mid-dispatch.
+ *
+ * Instead, the daemon holds a long-lived gip_at_* agent API token (minted
+ * once, stored in relay.json 0600 next to the device token) and exports it
+ * to every child as GIPITY_TOKEN. The CLI's auth layer prefers an env token
+ * over the session, so children authenticate statelessly - no refresh, no
+ * lock, no race. If minting fails (e.g. daemon started at boot with an
+ * expired session), we return null and children fall back to the session
+ * path, which is exactly the old behavior.
+ */
+import { hostname } from 'os';
+import { post, del } from '../api.js';
+import { resolveApiBase } from '../config.js';
+import * as state from './state.js';
+/** Validate a stored token against the API. Only a definitive 401 counts as
+ *  invalid - transient failures (network, 5xx) must not discard a good token
+ *  and trigger a re-mint storm. */
+async function tokenValid(token) {
+    try {
+        const res = await fetch(`${resolveApiBase()}/users/me`, {
+            headers: { 'Authorization': `Bearer ${token}` },
+        });
+        return res.status !== 401;
+    }
+    catch {
+        return true; // network blip - assume still valid
+    }
+}
+/**
+ * Return the relay's agent token, minting one if absent or revoked. Minting
+ * uses the caller's normal session auth (the daemon process is logged in),
+ * so it can fail when the session is dead - callers treat null as "children
+ * use session auth" (graceful degradation to the old behavior).
+ */
+export async function ensureRelayAgentToken() {
+    const existing = state.getAgentToken();
+    if (existing) {
+        if (await tokenValid(existing.token))
+            return existing.token;
+        state.setAgentToken(null, null); // revoked/expired - drop and re-mint
+    }
+    try {
+        const name = `Relay on ${state.getDevice()?.name ?? hostname()}`;
+        const res = await post('/auth/agent-tokens', { name });
+        state.setAgentToken(res.data.token, res.data.shortGuid);
+        return res.data.token;
+    }
+    catch {
+        return null;
+    }
+}
+/** Best-effort server-side revocation of the relay's agent token (used when
+ *  the device is unpaired). Local state is cleared by clearDevice() either
+ *  way; a failed server call just leaves a dead-weight token the user can
+ *  still see and revoke with `gipity token list` / `revoke`. */
+export async function revokeRelayAgentToken() {
+    const existing = state.getAgentToken();
+    if (!existing?.guid)
+        return false;
+    try {
+        await del(`/auth/agent-tokens/${encodeURIComponent(existing.guid)}`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=agent-token.js.map

package/dist/relay/daemon.js

@@ -15,6 +15,7 @@ import { IngestQueue } from './ingest-queue.js';
 import { DeltaAccumulator, DeltaBatcher } from './stream-delta.js';
 import { randomUUID } from 'crypto';
 import { deviceFetch, bridgeAbort as bridgeAbortImpl } from './device-http.js';
+import { ensureRelayAgentToken } from './agent-token.js';
 import { redactEntries, redactString, normalizeSecrets } from './redact.js';
 import { getMachineId } from './machine-id.js';
 // Re-exported so the existing `relay-bridge-abort.test.ts` keeps working.
@@ -84,6 +85,19 @@ async function registerDevice() {
 // so routine runs don't spam the log, but `gipity relay run --verbose`
 // surfaces every dispatch decision for live troubleshooting.
 let verboseMode = process.env.GIPITY_RELAY_VERBOSE === '1';
+// Agent token exported to spawned children as GIPITY_TOKEN (see agent-token.ts).
+// Resolved once at daemon startup; null = fall back to shared session auth.
+let relayAgentToken = null;
+/** Environment for relay-spawned `gipity` children. Adds GIPITY_TOKEN when the
+ *  daemon holds an agent token so children authenticate statelessly instead of
+ *  racing siblings on the session's single-use refresh token. */
+function childEnv(extra = {}) {
+    return {
+        ...process.env,
+        ...(relayAgentToken ? { GIPITY_TOKEN: relayAgentToken } : {}),
+        ...extra,
+    };
+}
 function setVerbose(on) { verboseMode = verboseMode || on; }
 // ANSI helpers - only colorize when stderr is a TTY.
 const TTY = !!process.stderr.isTTY;
@@ -239,6 +253,18 @@ export async function run(opts = {}) {
     process.on('exit', releasePid);
     // Also release on our shutdown signals (exit handler sometimes doesn't fire).
     ctx.abort.signal.addEventListener('abort', releasePid, { once: true });
+    // Long-lived agent token for spawned children (gipity sync / gipity claude).
+    // With it, children authenticate via GIPITY_TOKEN - stateless, no refresh -
+    // instead of racing sibling processes on the session's single-use refresh
+    // token. Minting needs a live session; on failure children fall back to
+    // session auth (the old behavior), so the daemon still runs.
+    relayAgentToken = await ensureRelayAgentToken();
+    if (relayAgentToken) {
+        log('info', 'agent token ready - spawned children use GIPITY_TOKEN');
+    }
+    else {
+        log('warn', 'no agent token (mint failed or session dead) - children fall back to session auth');
+    }
     log('info', 'relay started', { device: device.guid, name: device.name, pid: process.pid });
     // Run all loops concurrently; exit when any returns (or abort fires).
     // Cancellation poller runs alongside the dispatch loop so user-initiated
@@ -1131,7 +1157,7 @@ async function spawnSync(cwd, timeoutMs, onSpawn) {
     return new Promise((resolve, reject) => {
         const child = spawnCommand(cmd, ['sync', '--json'], {
             cwd,
-            env: process.env,
+            env: childEnv(),
             stdio: ['ignore', 'pipe', 'pipe'],
         });
         // Hand the child to the caller so it can register the sync in `running`,
@@ -1187,7 +1213,7 @@ export async function spawnGipityClaude(args, cwd, d, queue, meta) {
     // feed the ephemeral live-typing channel (see stream-delta.ts); whole
     // assistant/tool events still arrive unchanged for the persistent path.
     const fullArgs = [...args, '--output-format', 'stream-json', '--verbose', '--include-partial-messages'];
-    const env = { ...process.env, GIPITY_CONVERSATION_GUID: d.conversation_guid };
+    const env = childEnv({ GIPITY_CONVERSATION_GUID: d.conversation_guid });
     return new Promise((resolve, reject) => {
         const child = spawnCommand(cmd, fullArgs, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
         // `exited` fires when the child fully unwinds (exit event). Callers

package/dist/relay/state.js

@@ -38,6 +38,8 @@ export function loadState() {
             paused: Boolean(raw.paused),
             relay_enabled: typeof raw.relay_enabled === 'boolean' ? raw.relay_enabled : undefined,
             onboard_shown: Boolean(raw.onboard_shown),
+            agent_token: typeof raw.agent_token === 'string' ? raw.agent_token : null,
+            agent_token_guid: typeof raw.agent_token_guid === 'string' ? raw.agent_token_guid : null,
         };
     }
     catch {
@@ -73,8 +75,18 @@ export function setDevice(device) {
     mutate(s => { s.device = device; });
 }
 export function clearDevice() {
-    // Forget the device → also clear pause flag (scoped to the device).
-    mutate(s => { s.device = null; s.paused = false; });
+    // Forget the device → also clear the pause flag and the agent token
+    // (both scoped to the device). Server-side token revocation is the
+    // caller's job (best-effort, see revokeRelayAgentToken).
+    mutate(s => { s.device = null; s.paused = false; s.agent_token = null; s.agent_token_guid = null; });
+}
+// ─── Agent token (exported to spawned children as GIPITY_TOKEN) ────────
+export function getAgentToken() {
+    const s = loadState();
+    return s.agent_token ? { token: s.agent_token, guid: s.agent_token_guid ?? null } : null;
+}
+export function setAgentToken(token, guid) {
+    mutate(s => { s.agent_token = token; s.agent_token_guid = guid; });
 }
 // ─── Pause ─────────────────────────────────────────────────────────────
 export function isPaused() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gipity",
-  "version": "1.0.412",
+  "version": "1.0.413",
   "description": "The full-stack platform tuned for AI agents. Database, storage, auth, functions, deploy, and drop-in kits - all agent-tuned. Pair with Claude Code or use standalone.",
   "bin": {
     "gipity": "dist/updater/shim.js",