githits 0.3.0 → 0.3.1

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "GitHits plugins for Claude Code - code examples from global open source",
-    "version": "0.3.0"
+    "version": "0.3.1"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

package/.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   AuthConfigError,
+  AuthStorageLockTimeoutError,
   AuthStoragePolicyError,
   AuthenticationError,
   CLIENT_UPDATE_REQUIRED_REASON,
@@ -48,15 +49,59 @@ import {
   shouldRunUpdateCheck,
   startTelemetrySpan,
   withTelemetrySpan
-} from "./shared/chunk-5mk9k2gv.js";
+} from "./shared/chunk-0s7mxdt3.js";
 import {
   __require,
   version
-} from "./shared/chunk-gxya097b.js";
+} from "./shared/chunk-m1xx8hzw.js";
 
 // src/cli.ts
 import { Command } from "commander";
 
+// src/shared/require-auth.ts
+class AuthRequiredError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthRequiredError";
+  }
+}
+function requireAuth(deps, context) {
+  if (deps.hasValidToken)
+    return;
+  const suffix = context ? ` ${context}` : "";
+  console.log(`Authentication required${suffix}.
+`);
+  if (deps.mcpUrl !== "https://mcp.githits.com") {
+    console.log(`  Environment: ${deps.mcpUrl}`);
+    console.log(`  You're using a custom environment.
+`);
+  }
+  console.log("To authenticate:");
+  console.log(`  githits login
+`);
+  console.log("Or set GITHITS_API_TOKEN environment variable.");
+  console.log(`
+Need help? support@githits.com`);
+  throw new AuthRequiredError(`Authentication required${suffix}`);
+}
+
+// src/cli/errors.ts
+function handleCliError(error, deps) {
+  if (error instanceof AuthRequiredError) {
+    deps.exit(1);
+  }
+  if (isUserFacingError(error)) {
+    deps.stderr.write(`${error.message}
+
+`);
+    deps.exit(1);
+  }
+  throw error;
+}
+function isUserFacingError(error) {
+  return error instanceof AuthConfigError || error instanceof AuthStorageLockTimeoutError || error instanceof AuthStoragePolicyError;
+}
+
 // src/cli/update-check.ts
 function startUpdateCheckTask(service) {
   const controller = new AbortController;
@@ -522,7 +567,8 @@ function classify(error2) {
     return {
       code: "AUTH_REQUIRED",
       message: error2.message,
-      retryable: false
+      retryable: false,
+      details: { action: "Run `githits login`, then retry this tool call." }
     };
   }
   if (error2 instanceof CodeNavigationNetworkError) {
@@ -2483,7 +2529,8 @@ function classify2(error2) {
     return {
       code: "AUTH_REQUIRED",
       message: error2.message,
-      retryable: false
+      retryable: false,
+      details: { action: "Run `githits login`, then retry this tool call." }
     };
   }
   if (error2 instanceof PackageIntelligenceNetworkError) {
@@ -3807,32 +3854,6 @@ function buildHeader3(envelope, useColors) {
   const prefix = envelope.registry && envelope.name ? `${envelope.registry}:${envelope.name}${envelope.version ? `@${envelope.version}` : ""}` : "documentation";
   return `${colorize(`${prefix} ${badge}`, "bold", useColors)}${title ? ` - ${title}` : ""}`;
 }
-// src/shared/require-auth.ts
-class AuthRequiredError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "AuthRequiredError";
-  }
-}
-function requireAuth(deps, context) {
-  if (deps.hasValidToken)
-    return;
-  const suffix = context ? ` ${context}` : "";
-  console.log(`Authentication required${suffix}.
-`);
-  if (deps.mcpUrl !== "https://mcp.githits.com") {
-    console.log(`  Environment: ${deps.mcpUrl}`);
-    console.log(`  You're using a custom environment.
-`);
-  }
-  console.log("To authenticate:");
-  console.log(`  githits login
-`);
-  console.log("Or set GITHITS_API_TOKEN environment variable.");
-  console.log(`
-Need help? support@githits.com`);
-  throw new AuthRequiredError(`Authentication required${suffix}`);
-}
 // src/shared/unified-search-request.ts
 var DEFAULT_UNIFIED_SEARCH_LIMIT = 10;
 function buildUnifiedSearchParams(input) {
@@ -5056,7 +5077,7 @@ grep run. --symbol-field hydrates enclosing symbol metadata (appears under each
 match in --verbose output; full payload in --json).`;
 function registerCodeGrepCommand(pkgCommand) {
   return pkgCommand.command("grep").summary("Deterministic text grep over indexed dependency source").description(PKG_GREP_DESCRIPTION).argument("[spec-or-pattern]", "Spec mode: package spec (e.g. npm:express). Repo mode (with --repo-url): the pattern.").argument("[pattern-or-prefix]", "Spec mode: the pattern. Repo mode: optional path-prefix.").argument("[path-prefix]", "Spec mode only: optional path-prefix. Ignored with --repo-url.").option("--repo-url <url>", "Repository URL addressing (requires --git-ref)").option("--git-ref <ref>", "Tag, commit, branch, or HEAD. Required with --repo-url.").option("--path <path>", "Exact file path to grep").option("--glob <glob>", "Glob scope (repeatable)", collectRepeatable, []).option("--ext <ext>", "Extension filter without leading dot (repeatable)", collectRepeatable, []).option("--regex", "Interpret the pattern as RE2 regex").option("--case-sensitive", "Enable ASCII case-sensitive matching").option("-C, --context <n>", "Context lines before and after each match (0-10)").option("-B, --before-context <n>", "Context lines before each match (0-10)").option("-A, --after-context <n>", "Context lines after each match (0-10)").option("--exclude-docs", "Skip files classified as documentation").option("--exclude-tests", "Skip files classified as tests").option("--limit <n>", "Max matches to return on this page (1-1000, default 50)").option("--per-file-limit <n>", "Cap matches per file within this page (0-1000, 0 = unlimited)").option("--cursor <cursor>", "Opaque nextCursor from a previous grep result").option("--symbol-field <field>", `Repeatable; surfaces in --json and under each --verbose match. ${GREP_REPO_SYMBOL_FIELDS_NOTE}`, collectRepeatable, []).option("--wait <ms>", `Indexing wait timeout (0-${MAX_WAIT_TIMEOUT_MS}, default ${DEFAULT_WAIT_TIMEOUT_MS})`).option("-v, --verbose", "Render grouped output with file headers").option("--json", "Emit the JSON envelope").action(async (arg1, arg2, arg3, options) => {
-    const { createContainer: createContainer2 } = await import("./shared/chunk-1gqfte6e.js");
+    const { createContainer: createContainer2 } = await import("./shared/chunk-zg5dnven.js");
     const deps = await createContainer2();
     await pkgGrepAction(arg1, arg2, arg3, options, {
       codeNavigationService: deps.codeNavigationService,
@@ -5575,7 +5596,7 @@ function registerExampleCommand(program) {
   });
 }
 async function loadContainer() {
-  const { createContainer: createContainer2 } = await import("./shared/chunk-1gqfte6e.js");
+  const { createContainer: createContainer2 } = await import("./shared/chunk-zg5dnven.js");
   return createContainer2();
 }
 // src/commands/feedback.ts
@@ -6364,14 +6385,11 @@ async function preflightAuthPersistence(authStorage, mcpUrl) {
     createdAt: new Date(0).toISOString()
   };
   try {
-    await authStorage.saveClient(probeUrl, probeClient);
-    await authStorage.saveTokens(probeUrl, probeTokens);
-    await authStorage.clearTokens(probeUrl);
-    await authStorage.clearClient(probeUrl);
+    await authStorage.saveAuthSession(probeUrl, probeClient, probeTokens);
+    await authStorage.clearAuthSession(probeUrl);
     return null;
   } catch (error2) {
-    await authStorage.clearTokens(probeUrl).catch(() => {});
-    await authStorage.clearClient(probeUrl).catch(() => {});
+    await authStorage.clearAuthSession(probeUrl).catch(() => {});
     const message = error2 instanceof Error ? error2.message : String(error2);
     return {
       status: "failed",
@@ -6425,7 +6443,6 @@ async function loginFlow(options, deps) {
           redirectUri,
           registeredAt: new Date().toISOString()
         };
-        await authStorage.saveClient(mcpUrl, client);
       }
       port = options.port;
     } else {
@@ -6447,7 +6464,6 @@ async function loginFlow(options, deps) {
       redirectUri,
       registeredAt: new Date().toISOString()
     };
-    await authStorage.saveClient(mcpUrl, client);
   }
   const { verifier, challenge, state } = authService.generatePkceParams();
   const authUrl = authService.buildAuthUrl({
@@ -6512,7 +6528,7 @@ async function loginFlow(options, deps) {
     };
   }
   const expiresAt = new Date(Date.now() + tokenResponse.expiresIn * 1000).toISOString();
-  await authStorage.saveTokens(mcpUrl, {
+  await authStorage.saveAuthSession(mcpUrl, client, {
     accessToken: tokenResponse.accessToken,
     refreshToken: tokenResponse.refreshToken,
     expiresAt,
@@ -6803,17 +6819,7 @@ function registerLanguagesCommand(program) {
 async function logoutAction(deps) {
   const { authStorage, mcpUrl } = deps;
   const auth = await authStorage.loadTokens(mcpUrl);
-  let firstError;
-  try {
-    await authStorage.clearTokens(mcpUrl);
-  } catch (error2) {
-    firstError = error2;
-  }
-  try {
-    await authStorage.clearClient(mcpUrl);
-  } catch (error2) {
-    firstError ??= error2;
-  }
+  await authStorage.clearAuthSession(mcpUrl);
   if (!auth) {
     console.log(`Not currently logged in.
 `);
@@ -6823,8 +6829,6 @@ async function logoutAction(deps) {
 `);
     console.log(`  Environment: ${mcpUrl}`);
   }
-  if (firstError)
-    throw firstError;
 }
 var LOGOUT_DESCRIPTION = `Remove stored credentials.
 
@@ -6870,8 +6874,9 @@ function classify3(operation, error2) {
   if (error2 instanceof AuthenticationError) {
     return {
       error: error2.message,
-      code: "UNAUTHENTICATED",
-      retryable: false
+      code: "AUTH_REQUIRED",
+      retryable: false,
+      details: { action: "Run `githits login`, then retry this tool call." }
     };
   }
   const message = error2 instanceof Error ? error2.message : "Unknown error";
@@ -7318,17 +7323,15 @@ function buildPackageChangelogSuccessPayload(report, options) {
     }
     return lean;
   });
-  if (report.source == null) {
-    throw new Error("Changelog envelope builder received a null source — should have been promoted to NOT_FOUND at the service boundary.");
-  }
   const envelope = {
-    source: report.source,
     mode: options.mode,
     entries: {
       count: items.length,
       items
     }
   };
+  if (report.source)
+    envelope.source = report.source;
   if (options.registry)
     envelope.registry = options.registry;
   if (options.name)
@@ -7407,7 +7410,7 @@ function appendBodyLines(lines, body, options) {
 }
 function buildSummaryLine(envelope, options) {
   const identity = envelope.registry && envelope.name ? `${envelope.name} · ${envelope.registry}` : envelope.repoUrl ?? "(unknown)";
-  const sourceLabel = humanizeSource(envelope.source);
+  const sourceLabel = envelope.source ? humanizeSource(envelope.source) : "package versions";
   const modeLabel = envelope.mode === "range" ? rangeLabel(envelope) : latestLabel(envelope);
   const countLabel = `${envelope.entries.count} ${plural2("entry", "entries", envelope.entries.count)}`;
   const parts = [identity, `source: ${sourceLabel}`, modeLabel, countLabel];
@@ -7476,7 +7479,7 @@ var schema6 = {
   git_ref: z7.string().optional().describe("Git branch or tag for CHANGELOG.md source (no effect on GitHub Releases or HexDocs). Defaults to the repository's default branch."),
   include_bodies: z7.boolean().optional().describe("When false, each entry in `entries.items[]` omits its `body` field. Default true. Set false when you only need the version / date / URL timeline — drops 10 KB+ per entry on large release notes.")
 };
-var DESCRIPTION6 = "Release notes for a package or GitHub repo, newest-first. Default " + "latest mode returns the ten most recent entries (`limit` 1–50). " + "With `from_version`, returns every entry in the " + "`[from_version, to_version]` range (range mode, no count cap). " + "Address via `registry` + `package_name` or `repo_url` (mutually " + 'exclusive). Response: `source` (`"releases"` / `"changelog_file"` ' + '/ `"hexdocs"`), `mode` (`"latest"` or `"range"`), ' + "`entries: { count, items }` with full markdown bodies. Set " + "`include_bodies: false` for a version / date / URL timeline only. " + "Supports npm, PyPI, Hex, Crates, vcpkg, Zig, NuGet, Maven, " + "Packagist; returns `NOT_FOUND` when a package has no changelog " + "source.";
+var DESCRIPTION6 = "Release notes for a package or GitHub repo, newest-first. Default " + "latest mode returns the ten most recent entries (`limit` 1–50). " + "With `from_version`, returns every entry in the " + "`[from_version, to_version]` range (range mode, no count cap). " + "Address via `registry` + `package_name` or `repo_url` (mutually " + 'exclusive). Response includes optional `source` (`"releases"` / ' + '`"changelog_file"` / `"hexdocs"`) when a concrete changelog source ' + 'exists, `mode` (`"latest"` or `"range"`), ' + "`entries: { count, items }` with full markdown bodies. Set " + "`include_bodies: false` for a version / date / URL timeline only. " + "Package-version entries without changelog text succeed with `source` " + "omitted; no-source plus no entries returns `NOT_FOUND`. Supports npm, " + "PyPI, Hex, Crates, vcpkg, Zig, NuGet, Maven, Packagist.";
 function createPackageChangelogTool(service) {
   return {
     name: "pkg_changelog",
@@ -8663,7 +8666,7 @@ function requireSearchService(deps) {
   return deps.codeNavigationService;
 }
 async function loadContainer2() {
-  const { createContainer: createContainer2 } = await import("./shared/chunk-1gqfte6e.js");
+  const { createContainer: createContainer2 } = await import("./shared/chunk-zg5dnven.js");
   return createContainer2();
 }
 function parseTargetSpecs(specs) {
@@ -9072,15 +9075,10 @@ registerAuthStatusCommand(authCommand);
 try {
   await runWithUpdateCheckFlush(() => withTelemetrySpan("cli.parse", () => program.parseAsync()), updateCheckTask, { stderr: process.stderr, requiredUpdateRefreshTask });
 } catch (error2) {
-  if (isUserFacingError(error2)) {
-    console.error(`${error2.message}
-`);
-    process.exit(1);
-  }
-  throw error2;
-}
-function isUserFacingError(error2) {
-  return error2 instanceof AuthConfigError || error2 instanceof AuthStoragePolicyError;
+  handleCliError(error2, {
+    stderr: process.stderr,
+    exit: process.exit
+  });
 }
 function stripRootRegistrationOptions(args) {
   return args.filter((arg) => arg !== "--no-color");

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   version
-} from "./shared/chunk-gxya097b.js";
+} from "./shared/chunk-m1xx8hzw.js";
 export {
   version
 };

package/dist/shared/{chunk-5mk9k2gv.js → chunk-0s7mxdt3.js}

@@ -1,6 +1,7 @@
 import {
+  __require,
   version
-} from "./chunk-gxya097b.js";
+} from "./chunk-m1xx8hzw.js";
 
 // src/services/app-config-paths.ts
 var APP_DIR = "githits";
@@ -250,7 +251,7 @@ class AuthServiceImpl {
       const error = await response.text();
       throw new Error(`Token refresh failed: ${error}`);
     }
-    return parseTokenResponse(await response.json());
+    return parseRefreshTokenResponse(await response.json());
   }
 }
 function parseTokenResponse(data) {
@@ -264,6 +265,17 @@ function parseTokenResponse(data) {
     expiresIn: d.expires_in || 3600
   };
 }
+function parseRefreshTokenResponse(data) {
+  const d = data;
+  if (!d.access_token) {
+    throw new Error("Token response missing required fields");
+  }
+  return {
+    accessToken: d.access_token,
+    refreshToken: typeof d.refresh_token === "string" ? d.refresh_token : undefined,
+    expiresIn: d.expires_in || 3600
+  };
+}
 function successHtml(title = "Authentication successful") {
   return `<!DOCTYPE html>
 <html><head><title>GitHits CLI</title>
@@ -429,6 +441,13 @@ class AuthStorageImpl {
     await this.fs.ensureDir(this.configDir, DIR_MODE);
     await this.fs.atomicWriteFile(this.authPath, JSON.stringify(stored, null, 2));
   }
+  async saveTokensIfUnchanged(baseUrl, expected, data) {
+    const current = await this.loadTokens(baseUrl);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl, data);
+    return true;
+  }
   async clearTokens(baseUrl) {
     const stored = await this.loadAuthFile();
     if (!stored)
@@ -440,6 +459,13 @@ class AuthStorageImpl {
       await this.fs.atomicWriteFile(this.authPath, JSON.stringify(stored, null, 2));
     }
   }
+  async clearTokensIfUnchanged(baseUrl, expected) {
+    const current = await this.loadTokens(baseUrl);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl);
+    return true;
+  }
   async loadClient(baseUrl) {
     const stored = await this.loadClientFile();
     if (!stored)
@@ -466,6 +492,13 @@ class AuthStorageImpl {
     await this.fs.ensureDir(this.configDir, DIR_MODE);
     await this.fs.atomicWriteFile(this.clientPath, JSON.stringify(stored, null, 2));
   }
+  async saveAuthSession(baseUrl, client, tokens) {
+    await this.saveClient(baseUrl, client);
+    await this.saveTokens(baseUrl, tokens);
+  }
+  async clearAuthSession(baseUrl) {
+    await clearAuthSessionBestEffort(() => this.clearTokens(baseUrl), () => this.clearClient(baseUrl));
+  }
   async loadAuthFile() {
     if (!await this.fs.exists(this.authPath))
       return null;
@@ -496,6 +529,26 @@ class AuthStorageImpl {
 function normalizeBaseUrl(url) {
   return url.replace(/\/+$/, "");
 }
+function sameTokenData(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
+}
+async function clearAuthSessionBestEffort(clearTokens, clearClient) {
+  let firstError;
+  try {
+    await clearTokens();
+  } catch (error) {
+    firstError = error;
+  }
+  try {
+    await clearClient();
+  } catch (error) {
+    firstError ??= error;
+  }
+  if (firstError)
+    throw firstError;
+}
 // src/services/browser-service.ts
 import open from "open";
 
@@ -2698,10 +2751,24 @@ class KeychainAuthStorage {
     const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.setPassword(SERVICE_NAME, key, JSON.stringify(data));
   }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl2, data);
+    return true;
+  }
   async clearTokens(baseUrl2) {
     const key = `${TOKEN_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.deletePassword(SERVICE_NAME, key);
   }
+  async clearTokensIfUnchanged(baseUrl2, expected) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl2);
+    return true;
+  }
   async loadClient(baseUrl2) {
     const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     const json = this.keyring.getPassword(SERVICE_NAME, key);
@@ -2718,6 +2785,13 @@ class KeychainAuthStorage {
     const key = `${CLIENT_PREFIX}${normalizeBaseUrl(baseUrl2)}`;
     this.keyring.deletePassword(SERVICE_NAME, key);
   }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    await this.saveClient(baseUrl2, client);
+    await this.saveTokens(baseUrl2, tokens);
+  }
+  async clearAuthSession(baseUrl2) {
+    await clearAuthSessionBestEffort(() => this.clearTokens(baseUrl2), () => this.clearClient(baseUrl2));
+  }
   getStorageLocation() {
     switch (process.platform) {
       case "darwin":
@@ -2767,6 +2841,223 @@ class KeyringServiceImpl {
     }
   }
 }
+// src/services/locked-auth-storage.ts
+import { execFile } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+import { promisify } from "node:util";
+var LOCK_DIR = "auth.lock";
+var LOCK_TIMEOUT_MS = 1e4;
+var LOCK_RETRY_MS = 25;
+var ORPHANED_LOCK_MS = 5000;
+var OWNER_FILE = "owner.json";
+var execFileAsync = promisify(execFile);
+
+class AuthStorageLockTimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthStorageLockTimeoutError";
+  }
+}
+
+class LockedAuthStorage {
+  storage;
+  lockPath;
+  lockTimeoutMs;
+  isOwnerAlive;
+  currentOwner = null;
+  constructor(storage, fileSystemService, options = {}) {
+    this.storage = storage;
+    this.lockTimeoutMs = options.lockTimeoutMs ?? LOCK_TIMEOUT_MS;
+    this.isOwnerAlive = options.isOwnerAlive ?? isOriginalProcessAlive;
+    this.lockPath = fileSystemService.joinPath(getAppConfigDir(fileSystemService), LOCK_DIR);
+  }
+  loadTokens(baseUrl2) {
+    return this.storage.loadTokens(baseUrl2);
+  }
+  saveTokens(baseUrl2, data) {
+    return this.withLock(() => this.storage.saveTokens(baseUrl2, data));
+  }
+  saveTokensIfUnchanged(baseUrl2, expected, data) {
+    return this.withLock(() => this.storage.saveTokensIfUnchanged(baseUrl2, expected, data));
+  }
+  clearTokens(baseUrl2) {
+    return this.withLock(() => this.storage.clearTokens(baseUrl2));
+  }
+  clearTokensIfUnchanged(baseUrl2, expected) {
+    return this.withLock(() => this.storage.clearTokensIfUnchanged(baseUrl2, expected));
+  }
+  loadClient(baseUrl2) {
+    return this.storage.loadClient(baseUrl2);
+  }
+  saveClient(baseUrl2, data) {
+    return this.withLock(() => this.storage.saveClient(baseUrl2, data));
+  }
+  clearClient(baseUrl2) {
+    return this.withLock(() => this.storage.clearClient(baseUrl2));
+  }
+  saveAuthSession(baseUrl2, client, tokens) {
+    return this.withLock(() => this.storage.saveAuthSession(baseUrl2, client, tokens));
+  }
+  clearAuthSession(baseUrl2) {
+    return this.withLock(() => this.storage.clearAuthSession(baseUrl2));
+  }
+  getStorageLocation() {
+    return this.storage.getStorageLocation();
+  }
+  async withLock(fn) {
+    await this.acquireLock();
+    try {
+      return await fn();
+    } finally {
+      await this.releaseLock();
+    }
+  }
+  async acquireLock() {
+    const startedAt = Date.now();
+    await mkdir2(dirname2(this.lockPath), { recursive: true, mode: 448 });
+    while (true) {
+      try {
+        await mkdir2(this.lockPath, { recursive: false, mode: 448 });
+        try {
+          await this.writeOwner();
+        } catch (error) {
+          await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+            return;
+          });
+          throw error;
+        }
+        return;
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+        await this.reclaimStaleLock();
+        if (Date.now() - startedAt >= this.lockTimeoutMs) {
+          throw new AuthStorageLockTimeoutError(`Timed out waiting for GitHits auth storage lock at ${this.lockPath}. If no githits process is running, remove this directory and retry.`);
+        }
+        await sleep(LOCK_RETRY_MS);
+      }
+    }
+  }
+  async writeOwner() {
+    const owner = {
+      id: randomUUID3(),
+      pid: process.pid,
+      createdAt: new Date().toISOString(),
+      processStartedAt: await getProcessStartedAt(process.pid)
+    };
+    this.currentOwner = owner;
+    await writeFile2(this.ownerPath(), JSON.stringify(owner), { mode: 384 });
+  }
+  async reclaimStaleLock() {
+    const owner = await this.readOwner();
+    if (!owner) {
+      await this.reclaimOldOwnerlessLock();
+      return;
+    }
+    const ownerDead = !await this.isOwnerAlive(owner.pid, owner.processStartedAt);
+    if (!ownerDead)
+      return;
+    const currentOwner = await this.readOwner();
+    if (!currentOwner || currentOwner.id !== owner.id)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+  async reclaimOldOwnerlessLock() {
+    const createdAtMs = await lockCreatedAtMs(this.lockPath);
+    if (Date.now() - createdAtMs < ORPHANED_LOCK_MS)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+  async readOwner() {
+    try {
+      const raw = await readFile2(this.ownerPath(), "utf8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.id !== "string" || typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string" || !(typeof parsed.processStartedAt === "string" || parsed.processStartedAt === null)) {
+        return null;
+      }
+      return {
+        id: parsed.id,
+        pid: parsed.pid,
+        createdAt: parsed.createdAt,
+        processStartedAt: parsed.processStartedAt
+      };
+    } catch {
+      return null;
+    }
+  }
+  async releaseLock() {
+    const owner = this.currentOwner;
+    this.currentOwner = null;
+    if (!owner)
+      return;
+    const currentOwner = await this.readOwner();
+    if (!currentOwner || currentOwner.id !== owner.id)
+      return;
+    await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
+      return;
+    });
+  }
+  ownerPath() {
+    return `${this.lockPath}/${OWNER_FILE}`;
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function isOriginalProcessAlive(pid, processStartedAt) {
+  if (!isProcessAlive(pid))
+    return false;
+  if (!processStartedAt)
+    return true;
+  return await getProcessStartedAt(pid) === processStartedAt;
+}
+function isProcessAlive(pid) {
+  if (pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = error.code;
+    return code === "EPERM";
+  }
+}
+async function getProcessStartedAt(pid) {
+  try {
+    if (process.platform === "win32") {
+      const { stdout: stdout2 } = await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().ToString('o')`
+      ]);
+      return stdout2.trim() || null;
+    }
+    const { stdout } = await execFileAsync("ps", [
+      "-p",
+      String(pid),
+      "-o",
+      "lstart="
+    ]);
+    const parsed = Date.parse(stdout.trim());
+    return Number.isNaN(parsed) ? null : new Date(parsed).toISOString();
+  } catch {
+    return null;
+  }
+}
+async function lockCreatedAtMs(path) {
+  try {
+    const { stat: stat2 } = await import("node:fs/promises");
+    return (await stat2(path)).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
 // src/services/mode-aware-file-auth-storage.ts
 class AuthStoragePolicyError extends Error {
   constructor(message) {
@@ -2806,9 +3097,16 @@ class ModeAwareFileAuthStorage {
     this.assertFileMode();
     await this.storage.saveTokens(baseUrl2, data);
   }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    this.assertFileMode();
+    return this.storage.saveTokensIfUnchanged(baseUrl2, expected, data);
+  }
   clearTokens(baseUrl2) {
     return this.storage.clearTokens(baseUrl2);
   }
+  clearTokensIfUnchanged(baseUrl2, expected) {
+    return this.storage.clearTokensIfUnchanged(baseUrl2, expected);
+  }
   loadClient(baseUrl2) {
     return this.storage.loadClient(baseUrl2);
   }
@@ -2819,6 +3117,13 @@ class ModeAwareFileAuthStorage {
   clearClient(baseUrl2) {
     return this.storage.clearClient(baseUrl2);
   }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    this.assertFileMode();
+    await this.storage.saveAuthSession(baseUrl2, client, tokens);
+  }
+  clearAuthSession(baseUrl2) {
+    return this.storage.clearAuthSession(baseUrl2);
+  }
   getStorageLocation() {
     return this.storage.getStorageLocation();
   }
@@ -2864,6 +3169,13 @@ class MigratingAuthStorage {
       throw this.toPolicyError(error);
     }
   }
+  async saveTokensIfUnchanged(baseUrl2, expected, data) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!this.sameTokenData(current, expected))
+      return false;
+    await this.saveTokens(baseUrl2, data);
+    return true;
+  }
   async clearTokens(baseUrl2) {
     const primaryError = await this.clearBestEffort(() => this.primary.clearTokens(baseUrl2));
     await this.clearBestEffort(() => this.file.clearTokens(baseUrl2));
@@ -2872,6 +3184,13 @@ class MigratingAuthStorage {
       throw primaryError;
     }
   }
+  async clearTokensIfUnchanged(baseUrl2, expected) {
+    const current = await this.loadTokens(baseUrl2);
+    if (!this.sameTokenData(current, expected))
+      return false;
+    await this.clearTokens(baseUrl2);
+    return true;
+  }
   async loadClient(baseUrl2) {
     if (this.mode === "file") {
       return this.loadClientFileMode(baseUrl2);
@@ -2897,6 +3216,25 @@ class MigratingAuthStorage {
       throw primaryError;
     }
   }
+  async saveAuthSession(baseUrl2, client, tokens) {
+    if (this.mode === "file") {
+      await this.file.saveAuthSession(baseUrl2, client, tokens);
+      return;
+    }
+    try {
+      await this.primary.saveAuthSession(baseUrl2, client, tokens);
+    } catch (error) {
+      throw this.toPolicyError(error);
+    }
+  }
+  async clearAuthSession(baseUrl2) {
+    const primaryError = await this.clearBestEffort(() => this.primary.clearAuthSession(baseUrl2));
+    await this.clearBestEffort(() => this.file.clearAuthSession(baseUrl2));
+    await this.clearBestEffort(() => this.legacy.clearAuthSession(baseUrl2));
+    if (primaryError && !(primaryError instanceof KeychainUnavailableError)) {
+      throw primaryError;
+    }
+  }
   getStorageLocation() {
     return this.mode === "file" ? this.file.getStorageLocation() : this.primary.getStorageLocation();
   }
@@ -3103,6 +3441,11 @@ class MigratingAuthStorage {
     this.warnedAmbiguousPlaintext = true;
     this.onWarning("Warning: multiple plaintext auth entries exist with ambiguous timestamps; using the new config auth path and leaving the other entry intact.");
   }
+  sameTokenData(a, b) {
+    if (a === null || b === null)
+      return a === b;
+    return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
+  }
 }
 // src/services/package-intelligence-service.ts
 import { z as z3 } from "zod";
@@ -4283,12 +4626,12 @@ class PackageIntelligenceServiceImpl {
     return this.normaliseChangelogReport(data, params);
   }
   normaliseChangelogReport(data, params) {
-    const source = data.source ?? undefined;
-    if (!source) {
+    const source = data.source && data.source.trim() ? data.source : undefined;
+    const rawEntries = data.entries ?? [];
+    if (!source && rawEntries.length === 0) {
       const target = params.repoUrl ?? (params.registry && params.packageName ? `${params.registry.toLowerCase()}:${params.packageName}` : "package");
       throw new PackageIntelligenceChangelogSourceNotFoundError(`No changelog source available for ${target} (tried GitHub Releases, CHANGELOG.md, and HexDocs).`);
     }
-    const rawEntries = data.entries ?? [];
     const entries = rawEntries.map((entry) => ({
       version: entry.version ?? undefined,
       normalizedVersion: entry.normalizedVersion ?? undefined,
@@ -4629,24 +4972,62 @@ class TokenManager {
           refreshToken: tokens.refreshToken
         }));
       } catch {
+        const reloadedToken = await this.loadExternallyUpdatedToken(tokens);
+        if (reloadedToken)
+          return reloadedToken.accessToken;
         const isExpired = tokens.expiresAt ? new Date >= new Date(tokens.expiresAt) : false;
         if (isExpired) {
+          const currentStoredTokens = await this.loadExternallyUpdatedToken(tokens);
+          if (currentStoredTokens)
+            return currentStoredTokens.accessToken;
+          const cleared = await withTelemetrySpan("token-manager.clear-tokens-if-unchanged", () => this.authStorage.clearTokensIfUnchanged(this.mcpUrl, tokens));
+          if (!cleared) {
+            const currentToken = await this.authStorage.loadTokens(this.mcpUrl);
+            this.cachedToken = currentToken;
+            return currentToken?.accessToken;
+          }
           this.cachedToken = null;
-          await withTelemetrySpan("token-manager.clear-tokens", () => this.authStorage.clearTokens(this.mcpUrl));
         }
         return;
       }
       const newTokenData = {
         accessToken: response.accessToken,
-        refreshToken: response.refreshToken,
+        refreshToken: response.refreshToken ?? tokens.refreshToken,
         expiresAt: new Date(Date.now() + response.expiresIn * 1000).toISOString(),
         createdAt: new Date().toISOString()
       };
-      await withTelemetrySpan("token-manager.save-tokens", () => this.authStorage.saveTokens(this.mcpUrl, newTokenData));
+      const externallyUpdatedToken = await this.loadExternallyUpdatedToken(tokens, {
+        treatMissingAsExternalUpdate: true
+      });
+      if (externallyUpdatedToken === null)
+        return;
+      if (externallyUpdatedToken)
+        return externallyUpdatedToken.accessToken;
+      const saved = await withTelemetrySpan("token-manager.save-tokens", () => this.authStorage.saveTokensIfUnchanged(this.mcpUrl, tokens, newTokenData));
+      if (!saved) {
+        const currentToken = await this.authStorage.loadTokens(this.mcpUrl);
+        this.cachedToken = currentToken;
+        return currentToken?.accessToken;
+      }
       this.cachedToken = newTokenData;
       return response.accessToken;
     });
   }
+  async loadExternallyUpdatedToken(failedTokens, options = {}) {
+    const storedTokens = await withTelemetrySpan("token-manager.reload-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+    if (!storedTokens) {
+      if (options.treatMissingAsExternalUpdate)
+        this.cachedToken = null;
+      return options.treatMissingAsExternalUpdate ? null : undefined;
+    }
+    if (areSameTokenData(storedTokens, failedTokens))
+      return;
+    this.cachedToken = storedTokens;
+    return storedTokens;
+  }
+}
+function areSameTokenData(a, b) {
+  return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
 }
 // src/services/update-check-service.ts
 import semver from "semver";
@@ -4984,7 +5365,7 @@ function createAuthStorageForMode(fileSystemService, mode, configPath = "your Gi
   const rawKeyring = new KeyringServiceImpl;
   const keyring = process.platform === "win32" ? new ChunkingKeyringService(rawKeyring, WINDOWS_MAX_ENTRY_SIZE) : rawKeyring;
   const keychainStorage = new KeychainAuthStorage(keyring);
-  return new MigratingAuthStorage(keychainStorage, fileStorage, legacyStorage, mode, configPath, (message) => console.error(message));
+  return new LockedAuthStorage(new MigratingAuthStorage(keychainStorage, fileStorage, legacyStorage, mode, configPath, (message) => console.error(message)), fileSystemService);
 }
 async function createAuthCommandDependencies() {
   return withTelemetrySpan("container.create-auth-command", async () => {
@@ -5076,4 +5457,4 @@ async function createContainer() {
   });
 }
 
-export { AuthConfigError, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };
+export { AuthConfigError, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStorageLockTimeoutError, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };

package/dist/shared/{chunk-gxya097b.js → chunk-m1xx8hzw.js}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // package.json
-var version = "0.3.0";
+var version = "0.3.1";
 
 export { __require, version };

package/dist/shared/{chunk-1gqfte6e.js → chunk-zg5dnven.js}

@@ -2,8 +2,8 @@ import {
   createAuthCommandDependencies,
   createAuthStatusDependencies,
   createContainer
-} from "./chunk-5mk9k2gv.js";
-import"./chunk-gxya097b.js";
+} from "./chunk-0s7mxdt3.js";
+import"./chunk-m1xx8hzw.js";
 export {
   createContainer,
   createAuthStatusDependencies,

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Code examples from global open source for developers and AI assistants.",
   "mcpServers": {
     "githits": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "githits",
   "description": "CLI companion for GitHits - code examples from global open source for developers and AI assistants",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "files": [
     "dist",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"