omnirush 0.8.4 → 0.8.6

package/src/bin.js

@@ -60,10 +60,11 @@ import {
   openBrowser,
   pollForToken,
   redactForDisplay,
-  refreshTokens,
   saveAuth,
   savePendingFlow,
   clearPendingFlow,
+  createRefresher,
+  sessionEndedMessage,
 } from "../assets/extensions/omnirush/auth.js";
 
 const require = createRequire(import.meta.url);
@@ -162,10 +163,21 @@ async function launchModels(gatewayUrl, accessToken) {
   const base = String(gatewayUrl).replace(/\/+$/, "");
   if (process.env.OMNIRUSH_STATIC_MODELS !== "1" && accessToken) {
     try {
-      const response = await fetch(`${base}/models`, {
-        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+      const get = (token) => fetch(`${base}/models`, {
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
         signal: AbortSignal.timeout(2500),
       });
+      let response = await get(accessToken);
+      if (response.status === 401) {
+        // The stored access token expired (or another process rotated):
+        // refresh now, under the shared lock, so the agent starts with a
+        // working pair on disk.
+        await response.body?.cancel().catch(() => undefined);
+        const outcome = await createRefresher({ dir: OMNI_DIR, origin: managerOrigin() })
+          .recover(accessToken)
+          .catch(() => null);
+        if (outcome?.status === "ok") response = await get(outcome.accessToken);
+      }
       if (response.ok) {
         const payload = await response.json();
         const models = catalogFromGateway(payload);
@@ -444,15 +456,24 @@ async function cmdLogout() {
   console.log(`Signed out. Credentials removed from ${OMNI_DIR}`);
 }
 
-async function fetchMeWithRefresh(auth) {
+/**
+ * GET /device/me with the current on-disk token; a 401 adopts a pair
+ * another process already rotated, or refreshes under the shared refresh
+ * lock (never a bare refresh that could race a running agent). Resolves
+ * {me} or {me: null, outcome} with the recover() verdict.
+ */
+async function fetchMeWithRefresh() {
   const origin = managerOrigin();
-  let me = await deviceMe(origin, { accessToken: auth.accessToken, fetchImpl: globalThis.fetch });
-  if (me !== null) return { me, auth };
-  // 401: single-flight refresh (rotate both), retry once.
-  const next = await refreshTokens(origin, { refreshToken: auth.refreshToken, fetchImpl: globalThis.fetch });
-  saveAuth(OMNI_DIR, next);
-  me = await deviceMe(origin, { accessToken: next.accessToken, fetchImpl: globalThis.fetch });
-  return { me, auth: next };
+  const refresher = createRefresher({ dir: OMNI_DIR, origin });
+  let token = refresher.accessToken();
+  for (let round = 0; round < 3; round++) {
+    const me = await deviceMe(origin, { accessToken: token, fetchImpl: globalThis.fetch });
+    if (me !== null) return { me };
+    const outcome = await refresher.recover(token);
+    if (outcome.status !== "ok") return { me: null, outcome };
+    token = outcome.accessToken;
+  }
+  return { me: null, outcome: { status: "dead", reason: "session", detail: "access token refused after refresh" } };
 }
 
 async function cmdWhoami() {
@@ -461,9 +482,13 @@ async function cmdWhoami() {
     console.error("Omnirush: not signed in. Run `omnirush login` first.");
     process.exit(1);
   }
-  const { me } = await fetchMeWithRefresh(auth);
+  const { me, outcome } = await fetchMeWithRefresh();
   if (!me) {
-    console.error("Omnirush: credentials rejected — run `omnirush login` again.");
+    console.error(
+      outcome?.status === "transient"
+        ? `Omnirush: cannot reach the manager to verify the session (${outcome.error}) — try again shortly.`
+        : sessionEndedMessage(outcome),
+    );
     process.exit(1);
   }
   console.log(JSON.stringify(redactForDisplay(me), null, 2));
@@ -491,21 +516,19 @@ async function cmdDoctor() {
   const auth = loadAuth(OMNI_DIR);
   if (auth) {
     try {
-      const { me } = await fetchMeWithRefresh(auth);
+      const { me, outcome } = await fetchMeWithRefresh();
       if (me) {
         const label =
           (me && typeof me === "object" && (me.device_name || me.email || me.user_id || me.id)) ||
           "device recognized";
         ok("auth", true, `signed in (${label})`);
+      } else if (outcome?.status === "transient") {
+        ok("auth", false, `cannot verify session (${outcome.error})`);
       } else {
-        ok("auth", false, "credentials rejected — run `omnirush login` again");
+        ok("auth", false, sessionEndedMessage(outcome).replace(/^Omnirush: /, ""));
       }
     } catch (e) {
-      if (e?.name === "RefreshRejectedError") {
-        ok("auth", false, "session expired — run `omnirush login` again");
-      } else {
-        ok("auth", false, `cannot verify session (${e.message})`);
-      }
+      ok("auth", false, `cannot verify session (${e.message})`);
     }
   } else {
     const pending = loadPendingFlow(OMNI_DIR);
@@ -706,6 +729,9 @@ function childEnv(auth) {
   const origin = (process.env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "") ||
     gateway.replace(/\/+$/, "").replace(/\/v1$/, ""); // provider base -> manager origin
   return {
+    // Bootstrap values only: the agent (and every sub-agent it spawns)
+    // re-reads the shared auth file in OMNIRUSH_DIR for each request, so
+    // these never go stale in a way that matters.
     OMNIRUSH_TOKEN: auth.accessToken,
     OMNIRUSH_ACCESS_TOKEN: auth.accessToken,
     OMNIRUSH_ORIGIN: origin,
@@ -790,7 +816,8 @@ async function cmdRun() {
   const piArgs = withModelDefaults([], resolveModelDefaults(process.env));
   spawnAgent(cmd, [...args, ...piArgs], {
     stdio: "inherit",
-    env: { ...process.env, ...childEnv(auth) },
+    // The pair may have rotated during launch (model catalog refresh).
+    env: { ...process.env, ...childEnv(loadAuth(OMNI_DIR) ?? auth) },
   });
 }