happyskills 0.30.0 → 0.30.1

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.30.1] - 2026-04-05
+
+### Fixed
+- Fix frequent unnecessary re-login caused by transient refresh failures (network errors, Lambda/NeonDB cold starts) destroying the credentials file — now only clears credentials on permanent failures (Cognito token rejection), preserves the refresh token for transient errors so the next CLI invocation can retry
+- Add diagnostic logging to token refresh failures (`print_warn` to stderr) with actual error reason, replacing silent failure that made auth issues impossible to diagnose
+- Add single retry on transient refresh failure within the same CLI invocation
+
 ## [0.30.0] - 2026-04-03
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "0.30.0",
+	"version": "0.30.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/auth/token_store.js

@@ -3,18 +3,43 @@ const path = require('path')
 const { error: { catch_errors } } = require('puffy-core')
 const { credentials_path, config_dir } = require('../config/paths')
 
+const _is_permanent_failure = (errors) => {
+	if (!errors) return false
+	const { AuthError } = require('../utils/errors')
+	return errors.some(e => e instanceof AuthError)
+}
+
 const _try_refresh = async (refresh_token) => {
-	try {
-		const { refresh } = require('../api/auth')
-		const [errors, data] = await refresh(refresh_token)
-		if (errors || !data) return null
-		const merged = { ...data, refresh_token }
-		const [save_err] = await save_token(merged)
-		if (save_err) return null
-		return { ...merged, stored_at: new Date().toISOString() }
-	} catch {
-		return null
+	const max_attempts = 2
+	let permanent = false
+	for (let attempt = 1; attempt <= max_attempts; attempt++) {
+		try {
+			const { refresh } = require('../api/auth')
+			const [errors, data] = await refresh(refresh_token)
+			if (errors || !data) {
+				const reason = errors
+					? errors.map(e => e.message || String(e)).join('; ')
+					: 'empty response from server'
+				const { print_warn } = require('../ui/output')
+				print_warn(`Token refresh failed (attempt ${attempt}/${max_attempts}): ${reason}`)
+				permanent = _is_permanent_failure(errors)
+				if (permanent || attempt >= max_attempts) return { ok: false, permanent }
+				continue
+			}
+			const merged = { ...data, refresh_token }
+			const [save_err] = await save_token(merged)
+			if (save_err) return { ok: false, permanent: false }
+			return { ok: true, data: { ...merged, stored_at: new Date().toISOString() } }
+		} catch (err) {
+			const { print_warn } = require('../ui/output')
+			print_warn(`Token refresh exception (attempt ${attempt}/${max_attempts}): ${err.message || String(err)}`)
+			const { AuthError } = require('../utils/errors')
+			permanent = err instanceof AuthError
+			if (permanent || attempt >= max_attempts) return { ok: false, permanent }
+			continue
+		}
 	}
+	return { ok: false, permanent: false }
 }
 
 const save_token = (token_data) => catch_errors('Failed to save token', async () => {
@@ -55,10 +80,16 @@ const load_token = () => catch_errors('Failed to load token', async () => {
 		const elapsed_sec = (now - stored) / 1000
 		if (elapsed_sec >= data.expires_in) {
 			if (data.refresh_token) {
-				const refreshed = await _try_refresh(data.refresh_token)
-				if (refreshed) return refreshed
+				const result = await _try_refresh(data.refresh_token)
+				if (result.ok) return result.data
+				// Permanent failure (Cognito rejected the token) → clear the file.
+				// Transient failure (network, cold start) → preserve the file so
+				// the next invocation can retry with the still-valid refresh token.
+				if (result.permanent) await clear_token()
+			} else {
+				// No refresh token — nothing to preserve, clean up the expired file.
+				await clear_token()
 			}
-			await clear_token()
 			return null
 		}
 	}

package/src/auth/token_store.test.js

@@ -12,7 +12,7 @@ const fs = require('fs')
 // ─────────────────────────────────────────────────────────────────────────────
 
 const { save_token, load_token, clear_token, require_token } = require('./token_store')
-const { AuthError } = require('../utils/errors')
+const { AuthError, NetworkError } = require('../utils/errors')
 
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
@@ -200,3 +200,199 @@ describe('require_token', () => {
 		})
 	})
 })
+
+// ─── token refresh behavior ─────────────────────────────────────────────────
+//
+// _try_refresh is internal, but its behavior is observable through load_token:
+// when the id_token is expired and a refresh_token exists, load_token calls
+// _try_refresh which calls require('../api/auth').refresh(). We mock that
+// module in require.cache to control the refresh outcome.
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('load_token — refresh behavior', () => {
+	const auth_path = require.resolve('../api/auth')
+	let orig_auth_cache
+
+	const mock_refresh = (fn) => {
+		orig_auth_cache = require.cache[auth_path]
+		require.cache[auth_path] = {
+			id: auth_path,
+			filename: auth_path,
+			loaded: true,
+			exports: { refresh: fn }
+		}
+	}
+
+	const restore_refresh = () => {
+		if (orig_auth_cache) require.cache[auth_path] = orig_auth_cache
+		else delete require.cache[auth_path]
+	}
+
+	const write_expired_token = (dir, overrides = {}) => {
+		const token = {
+			id_token: 'expired-id-token',
+			access_token: 'expired-access-token',
+			refresh_token: 'valid-refresh-token',
+			expires_in: 1,
+			stored_at: new Date(Date.now() - 5000).toISOString(),
+			...overrides
+		}
+		fs.mkdirSync(path.join(dir, 'happyskills'), { recursive: true })
+		fs.writeFileSync(creds_file(dir), JSON.stringify(token), { mode: 0o600 })
+		return token
+	}
+
+	it('returns refreshed token when refresh succeeds', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			mock_refresh(async () => [null, {
+				id_token: 'new-id-token',
+				access_token: 'new-access-token',
+				expires_in: 3600
+			}])
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.ok(loaded, 'should return refreshed token')
+				assert.strictEqual(loaded.id_token, 'new-id-token')
+				assert.strictEqual(loaded.access_token, 'new-access-token')
+				assert.strictEqual(loaded.refresh_token, 'valid-refresh-token', 'original refresh_token preserved')
+				assert.ok(loaded.stored_at, 'stored_at should be set')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('saves refreshed tokens to disk after successful refresh', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			mock_refresh(async () => [null, {
+				id_token: 'refreshed-on-disk',
+				access_token: 'new-access',
+				expires_in: 7200
+			}])
+			try {
+				await load_token()
+				const on_disk = JSON.parse(fs.readFileSync(creds_file(dir), 'utf-8'))
+				assert.strictEqual(on_disk.id_token, 'refreshed-on-disk')
+				assert.strictEqual(on_disk.refresh_token, 'valid-refresh-token', 'refresh_token preserved on disk')
+				assert.strictEqual(on_disk.expires_in, 7200)
+				assert.ok(on_disk.stored_at, 'stored_at should be updated on disk')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('preserves credentials file on transient refresh failure (NetworkError)', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			mock_refresh(async () => [[new NetworkError('connection failed')], null])
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.strictEqual(loaded, null, 'should return null on failed refresh')
+				assert.ok(fs.existsSync(creds_file(dir)), 'credentials file should be preserved for retry')
+				// Verify the refresh_token is still intact on disk
+				const on_disk = JSON.parse(fs.readFileSync(creds_file(dir), 'utf-8'))
+				assert.strictEqual(on_disk.refresh_token, 'valid-refresh-token')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('preserves credentials file on server error (ApiError)', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			const { ApiError } = require('../utils/errors')
+			mock_refresh(async () => [[new ApiError('Internal server error', 500, 'INTERNAL_ERROR')], null])
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.strictEqual(loaded, null)
+				assert.ok(fs.existsSync(creds_file(dir)), 'credentials file should be preserved on server error')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('deletes credentials file on permanent refresh failure (AuthError)', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			mock_refresh(async () => [[new AuthError('token revoked')], null])
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.strictEqual(loaded, null)
+				assert.ok(!fs.existsSync(creds_file(dir)), 'credentials file should be deleted on permanent failure')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('does not retry on permanent failure', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			let call_count = 0
+			mock_refresh(async () => {
+				call_count++
+				return [[new AuthError('token expired')], null]
+			})
+			try {
+				await load_token()
+				assert.strictEqual(call_count, 1, 'should not retry on permanent failure')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('retries once on transient failure then succeeds', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			let call_count = 0
+			mock_refresh(async () => {
+				call_count++
+				if (call_count === 1) return [[new NetworkError('cold start')], null]
+				return [null, {
+					id_token: 'retried-id-token',
+					access_token: 'retried-access-token',
+					expires_in: 3600
+				}]
+			})
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.ok(loaded, 'should return refreshed token after retry')
+				assert.strictEqual(loaded.id_token, 'retried-id-token')
+				assert.strictEqual(call_count, 2, 'refresh should have been called twice')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+
+	it('retries once on transient failure then gives up', async () => {
+		await with_tmp(async (dir) => {
+			write_expired_token(dir)
+			let call_count = 0
+			mock_refresh(async () => {
+				call_count++
+				return [[new NetworkError('still failing')], null]
+			})
+			try {
+				const [err, loaded] = await load_token()
+				assert.strictEqual(err, null)
+				assert.strictEqual(loaded, null)
+				assert.strictEqual(call_count, 2, 'should have retried once')
+				assert.ok(fs.existsSync(creds_file(dir)), 'credentials file preserved after exhausting retries')
+			} finally {
+				restore_refresh()
+			}
+		})
+	})
+})