omnirush 0.8.5 → 0.8.6

package/assets/extensions/omnirush/collector.ts

@@ -255,7 +255,11 @@ export default function (pi: any) {
   if ((process.env.OMNIRUSH_PARENT_SESSION || "").trim()) return;
   const origin = resolveOrigin(process.env);
   const gatewayUrl = process.env.OMNIRUSH_GATEWAY_URL || gatewayUrlForOrigin(origin);
-  const accessToken = (process.env.OMNIRUSH_ACCESS_TOKEN || process.env.OMNIRUSH_TOKEN || "").trim();
+  // The shared auth file is the source of truth (another process may have
+  // rotated since launch); the launcher's environment value is a fallback.
+  const accessToken = (
+    sharedRefresher().accessToken() || process.env.OMNIRUSH_ACCESS_TOKEN || process.env.OMNIRUSH_TOKEN || ""
+  ).trim();
   const stateDir = omniDir();
   const agentDir = piAgentDir();
   const version = cliVersion();
@@ -275,19 +279,40 @@ export default function (pi: any) {
   // sota guard shares it): a 401 asks it for the token after `current`.
   let current = accessToken;
   const refreshAccessToken = async (): Promise<string | null> => {
-    const refresher = sharedRefresher();
-    const refreshed = await refresher.refresh(current).catch(() => false);
-    const next = refresher.auth?.accessToken ?? null;
-    if (!refreshed || !next) return null;
+    const outcome = await sharedRefresher().recover(current).catch(() => null);
+    if (outcome?.status !== "ok") return null;
+    const next = outcome.accessToken;
     current = next;
     archiver.setAccessToken(next);
     return next;
   };
 
+  // Uploads carry the CURRENT on-disk token, not the one this process
+  // last saw: another terminal or a sub-agent may have rotated the pair.
+  // Only requests that already carry a bearer (collect, archive API) are
+  // touched — presigned S3 part PUTs pass through unchanged.
+  const withCurrentBearer = (input: string, init?: RequestInit): Promise<Response> => {
+    const headers = new Headers(init?.headers ?? {});
+    if (/^Bearer /i.test(headers.get("authorization") ?? "")) {
+      let latest = "";
+      try {
+        latest = sharedRefresher().accessToken();
+      } catch {
+        /* keep the caller's bearer */
+      }
+      if (latest) {
+        headers.set("Authorization", `Bearer ${latest}`);
+        return globalThis.fetch(input, { ...init, headers });
+      }
+    }
+    return globalThis.fetch(input, init);
+  };
+
   const collector = new WorkspaceCollector({
     gatewayUrl,
     accessToken,
     refreshAccessToken,
+    fetch: withCurrentBearer,
     stateDir,
     log,
     // environment.app_version tells the CLI apart from the desktop app (whose
@@ -309,6 +334,7 @@ export default function (pi: any) {
     gatewayUrl,
     accessToken,
     refreshAccessToken,
+    fetch: withCurrentBearer,
     // The CLI's own state (auth, spool, archive queue) and the agent's
     // session files are never archived when they sit inside a project.
     excludedDirs: [stateDir, agentDir],

package/assets/extensions/omnirush/commands.ts

@@ -18,7 +18,7 @@
  */
 
 import { readSessionLedger, SESSION_LEDGER_FILE } from "./capture/workspace-collector";
-import { deviceMe, omniDir, resolveOrigin } from "./auth";
+import { deviceMe, omniDir, resolveOrigin, sessionEndedMessage } from "./auth";
 import { sharedRefresher } from "./refresh";
 import { formatCollectorLine, formatStatusLines } from "./status-lib";
 import {
@@ -42,27 +42,24 @@ interface MeResult {
 }
 
 /**
- * Fetch the signed-in identity + server-side usage with the broker
- * pattern: 401 triggers one single-flight refresh (both tokens rotate,
- * persisted 0600) and a single retry with the rotated token. Never
- * throws; errors come back as `error` strings safe to display.
+ * Fetch the signed-in identity + server-side usage with the current
+ * on-disk token; a 401 adopts a newer on-disk pair or refreshes under the
+ * cross-process lock and retries (auth.js). Never throws; errors come back
+ * as `error` strings safe to display.
  */
 async function fetchMe(): Promise<MeResult> {
   const origin = resolveOrigin(process.env);
   const refresher = sharedRefresher();
-  // Prefer the refresher's live token — it is already rotated after any
-  // in-flight 401 recovery — and fall back to the launcher-provided one.
-  const token = refresher.auth?.accessToken || (process.env.OMNIRUSH_TOKEN || "").trim();
+  let token = refresher.accessToken() || (process.env.OMNIRUSH_TOKEN || "").trim();
   if (!token) return { me: null, error: "not signed in — run `omnirush login` first" };
   try {
-    let me = await deviceMe(origin, { accessToken: token, fetchImpl: globalThis.fetch });
-    if (me !== null) return { me };
-    // 401: single-flight refresh, retry once with the rotated token.
-    const refreshed = await refresher.refresh(token).catch(() => false);
-    const next = refresher.auth?.accessToken;
-    if (refreshed && next && next !== token) {
-      me = await deviceMe(origin, { accessToken: next, fetchImpl: globalThis.fetch });
+    for (let round = 0; round < 3; round++) {
+      const me = await deviceMe(origin, { accessToken: token, fetchImpl: globalThis.fetch });
       if (me !== null) return { me };
+      const outcome = await refresher.recover(token);
+      if (outcome.status === "transient") return { me: null, error: `manager unreachable (${outcome.error})` };
+      if (outcome.status !== "ok") return { me: null, error: sessionEndedMessage(outcome).replace(/^Omnirush: /, "") };
+      token = outcome.accessToken;
     }
     return { me: null, error: "credentials rejected — run `omnirush login` again" };
   } catch (error) {

package/assets/extensions/omnirush/sota.ts

@@ -31,6 +31,7 @@ import fs from "node:fs";
 import { openAIResponsesApi } from "@earendil-works/pi-ai";
 import { recordGatewayUsage } from "./usage";
 import { sharedRefresher } from "./refresh";
+import { sendWithDeviceAuth, sessionEndedMessage } from "./auth";
 import {
   createSseDataScanner,
   formatSotaWarning,
@@ -202,8 +203,9 @@ async function readErrorBody(response: any): Promise<string> {
 
 /**
  * Wrap a fetch implementation so that:
- *   - 401 responses trigger one single-flight device-token refresh and a
- *     single retry with the rotated token (gateway-broker pattern),
+ *   - every attempt carries the current on-disk device token, and a 401
+ *     adopts a newer on-disk pair or refreshes under the cross-process
+ *     lock, then resends (auth.js sendWithDeviceAuth),
  *   - 429 / 5xx / network failures retry with exponential backoff + full
  *     jitter (progress lines on stderr), and
  *   - SSE response bodies stream through a pass-through tap that observes
@@ -231,47 +233,46 @@ function tapFetch(
 
     const outcome = await withRetries(
       async (attempt, ref) => {
-        let response = await doFetch();
-        debug(`provider fetch ${requestUrl} -> ${response?.status} (attempt ${attempt})`);
-        // Capture the gateway's grant/usage headers (x-omnirush-* plus
-        // the x-ratelimit-*-tokens grant pair) straight from the raw
-        // response — guaranteed availability here, independent of pi's
-        // event plumbing.
-        try {
-          recordGatewayUsage(response?.headers);
-        } catch {
-          /* usage capture must never break the request */
-        }
-        if (response?.status === 401) {
-          const tokenUsed = bearerFromInit(init) || bearerFromInit(input);
-          debug(`401 seen; bearer present: ${Boolean(tokenUsed)}`);
-          if (tokenUsed) {
-            const refresher = sharedRefresher();
-            const refreshed = await refresher.refresh(tokenUsed).catch((error: any) => {
-              debug(`refresh threw: ${error?.message ?? error}`);
-              return false;
-            });
-            const next = refresher.auth?.accessToken;
-            debug(`refresh ok: ${refreshed}, next token present: ${Boolean(next)}`);
-            if (refreshed && next) {
-              response = await doFetch(next);
-              debug(`retry-after-refresh status: ${response?.status}`);
-              try {
-                recordGatewayUsage(response?.headers);
-              } catch {
-                /* as above */
-              }
-            }
-            if (response?.status === 401) {
-              // The refresh (or the fresh-adopted token) was rejected:
-              // the session is dead. Retrying forever would spin pi's
-              // auto-retry loop silently — fail fast with the fix.
-              warnStderr(
-                "Omnirush: this device's session is no longer valid — run `omnirush login` to sign in again.",
-              );
-              process.exit(2);
-            }
+        // Every attempt carries the CURRENT on-disk token (re-read per
+        // request: another terminal or a sub-agent may have rotated the
+        // pair since this process started). A 401 adopts a newer on-disk
+        // pair or refreshes under the cross-process lock, then resends.
+        const recordUsage = (res: any) => {
+          try {
+            recordGatewayUsage(res?.headers);
+          } catch {
+            /* usage capture must never break the request */
           }
+        };
+        const { response: answered, outcome: authOutcome } = await sendWithDeviceAuth(
+          (token: string) => doFetch(token || undefined),
+          sharedRefresher(),
+          {
+            fallbackToken: bearerFromInit(init) || bearerFromInit(input),
+            onResponse: (res: any) => {
+              debug(`provider fetch ${requestUrl} -> ${res?.status} (attempt ${attempt})`);
+              recordUsage(res);
+            },
+          },
+        );
+        let response = answered;
+        if (authOutcome?.status === "dead") {
+          // The manager refused the refresh token that is on disk right
+          // now (re-read under the refresh lock): the device session is
+          // gone (revoked, expired, signed out). Retrying would spin pi's
+          // auto-retry loop silently — fail fast with the fix.
+          debug(`device session ended: ${authOutcome.reason} ${authOutcome.detail ?? ""}`);
+          warnStderr(sessionEndedMessage(authOutcome));
+          process.exit(2);
+        }
+        if (authOutcome?.status === "transient") {
+          // Could not reach the manager to refresh: not a sign-out. Retry
+          // like any other brief outage.
+          debug(`refresh unavailable: ${authOutcome.error}`);
+          response = new Response(
+            JSON.stringify({ error: { message: "Omnirush sign-in service unavailable", type: "omnirush_error", code: "auth_refresh_unavailable" } }),
+            { status: 503, headers: { "content-type": "application/json" } },
+          );
         }
         const retryAfterSec = Number(response?.headers?.get?.("retry-after")) || undefined;
         return { response, ref, retryAfterSec };
@@ -415,7 +416,15 @@ export default function (pi: any) {
       apiKey: {
         name: "Omnirush token",
         async resolve() {
-          const key = process.env.OMNIRUSH_TOKEN;
+          // The shared auth file first (always current); the launcher's
+          // environment value only as a bootstrap.
+          let key = "";
+          try {
+            key = sharedRefresher().accessToken();
+          } catch {
+            /* fall back to the environment */
+          }
+          key ||= (process.env.OMNIRUSH_TOKEN || "").trim();
           if (!key) return undefined;
           return { auth: { apiKey: key }, source: "environment" };
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omnirush",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Omnirush \u2014 free daily tokens for the most powerful coding model on earth.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,4 +41,4 @@
     "minimatch": "^10.2.6",
     "zod": "^4.6.5"
   }
-}
+}

package/src/bin.js

@@ -60,10 +60,11 @@ import {
   openBrowser,
   pollForToken,
   redactForDisplay,
-  refreshTokens,
   saveAuth,
   savePendingFlow,
   clearPendingFlow,
+  createRefresher,
+  sessionEndedMessage,
 } from "../assets/extensions/omnirush/auth.js";
 
 const require = createRequire(import.meta.url);
@@ -162,10 +163,21 @@ async function launchModels(gatewayUrl, accessToken) {
   const base = String(gatewayUrl).replace(/\/+$/, "");
   if (process.env.OMNIRUSH_STATIC_MODELS !== "1" && accessToken) {
     try {
-      const response = await fetch(`${base}/models`, {
-        headers: { Authorization: `Bearer ${accessToken}`, Accept: "application/json" },
+      const get = (token) => fetch(`${base}/models`, {
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
         signal: AbortSignal.timeout(2500),
       });
+      let response = await get(accessToken);
+      if (response.status === 401) {
+        // The stored access token expired (or another process rotated):
+        // refresh now, under the shared lock, so the agent starts with a
+        // working pair on disk.
+        await response.body?.cancel().catch(() => undefined);
+        const outcome = await createRefresher({ dir: OMNI_DIR, origin: managerOrigin() })
+          .recover(accessToken)
+          .catch(() => null);
+        if (outcome?.status === "ok") response = await get(outcome.accessToken);
+      }
       if (response.ok) {
         const payload = await response.json();
         const models = catalogFromGateway(payload);
@@ -444,15 +456,24 @@ async function cmdLogout() {
   console.log(`Signed out. Credentials removed from ${OMNI_DIR}`);
 }
 
-async function fetchMeWithRefresh(auth) {
+/**
+ * GET /device/me with the current on-disk token; a 401 adopts a pair
+ * another process already rotated, or refreshes under the shared refresh
+ * lock (never a bare refresh that could race a running agent). Resolves
+ * {me} or {me: null, outcome} with the recover() verdict.
+ */
+async function fetchMeWithRefresh() {
   const origin = managerOrigin();
-  let me = await deviceMe(origin, { accessToken: auth.accessToken, fetchImpl: globalThis.fetch });
-  if (me !== null) return { me, auth };
-  // 401: single-flight refresh (rotate both), retry once.
-  const next = await refreshTokens(origin, { refreshToken: auth.refreshToken, fetchImpl: globalThis.fetch });
-  saveAuth(OMNI_DIR, next);
-  me = await deviceMe(origin, { accessToken: next.accessToken, fetchImpl: globalThis.fetch });
-  return { me, auth: next };
+  const refresher = createRefresher({ dir: OMNI_DIR, origin });
+  let token = refresher.accessToken();
+  for (let round = 0; round < 3; round++) {
+    const me = await deviceMe(origin, { accessToken: token, fetchImpl: globalThis.fetch });
+    if (me !== null) return { me };
+    const outcome = await refresher.recover(token);
+    if (outcome.status !== "ok") return { me: null, outcome };
+    token = outcome.accessToken;
+  }
+  return { me: null, outcome: { status: "dead", reason: "session", detail: "access token refused after refresh" } };
 }
 
 async function cmdWhoami() {
@@ -461,9 +482,13 @@ async function cmdWhoami() {
     console.error("Omnirush: not signed in. Run `omnirush login` first.");
     process.exit(1);
   }
-  const { me } = await fetchMeWithRefresh(auth);
+  const { me, outcome } = await fetchMeWithRefresh();
   if (!me) {
-    console.error("Omnirush: credentials rejected — run `omnirush login` again.");
+    console.error(
+      outcome?.status === "transient"
+        ? `Omnirush: cannot reach the manager to verify the session (${outcome.error}) — try again shortly.`
+        : sessionEndedMessage(outcome),
+    );
     process.exit(1);
   }
   console.log(JSON.stringify(redactForDisplay(me), null, 2));
@@ -491,21 +516,19 @@ async function cmdDoctor() {
   const auth = loadAuth(OMNI_DIR);
   if (auth) {
     try {
-      const { me } = await fetchMeWithRefresh(auth);
+      const { me, outcome } = await fetchMeWithRefresh();
       if (me) {
         const label =
           (me && typeof me === "object" && (me.device_name || me.email || me.user_id || me.id)) ||
           "device recognized";
         ok("auth", true, `signed in (${label})`);
+      } else if (outcome?.status === "transient") {
+        ok("auth", false, `cannot verify session (${outcome.error})`);
       } else {
-        ok("auth", false, "credentials rejected — run `omnirush login` again");
+        ok("auth", false, sessionEndedMessage(outcome).replace(/^Omnirush: /, ""));
       }
     } catch (e) {
-      if (e?.name === "RefreshRejectedError") {
-        ok("auth", false, "session expired — run `omnirush login` again");
-      } else {
-        ok("auth", false, `cannot verify session (${e.message})`);
-      }
+      ok("auth", false, `cannot verify session (${e.message})`);
     }
   } else {
     const pending = loadPendingFlow(OMNI_DIR);
@@ -706,6 +729,9 @@ function childEnv(auth) {
   const origin = (process.env.OMNIRUSH_ORIGIN || "").trim().replace(/\/+$/, "") ||
     gateway.replace(/\/+$/, "").replace(/\/v1$/, ""); // provider base -> manager origin
   return {
+    // Bootstrap values only: the agent (and every sub-agent it spawns)
+    // re-reads the shared auth file in OMNIRUSH_DIR for each request, so
+    // these never go stale in a way that matters.
     OMNIRUSH_TOKEN: auth.accessToken,
     OMNIRUSH_ACCESS_TOKEN: auth.accessToken,
     OMNIRUSH_ORIGIN: origin,
@@ -790,7 +816,8 @@ async function cmdRun() {
   const piArgs = withModelDefaults([], resolveModelDefaults(process.env));
   spawnAgent(cmd, [...args, ...piArgs], {
     stdio: "inherit",
-    env: { ...process.env, ...childEnv(auth) },
+    // The pair may have rotated during launch (model catalog refresh).
+    env: { ...process.env, ...childEnv(loadAuth(OMNI_DIR) ?? auth) },
   });
 }