syndai 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to the `syndai` npm package. Versions follow semver.
 
+## 0.4.1
+
+- A running `watch`, `change` or MCP server no longer stops when `login` or a scope
+  approval in another terminal replaces its key. On a 401 the CLI reads the stored key
+  again once, and retries with it if it changed. `SYNDAI_API_KEY` is never re-read.
+
 ## 0.4.0
 
 Every published API operation, and a project's recurring runs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "syndai",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The Syndai owner CLI: say what to change, and Syndai builds it, checks it and puts it live. Also installs the Syndai MCP server into Claude Code, Cursor and Codex.",
   "type": "module",
   "bin": {

package/src/auth.js

@@ -69,6 +69,15 @@ export function createContext(io, flags, { stepUp = true } = {}) {
     getKey: async () => credential().apiKey,
     io,
     onMissingScope: stepUp ? (scope) => stepUpScope(ctx, scope) : undefined,
+    onUnauthorized: async () => {
+      // A login or step-up in another process saves a new key, then revokes this one.
+      if (!cached || cached.source === "SYNDAI_API_KEY") return false;
+      const fresh = storedCredential(io, paths);
+      if (!fresh || fresh.apiKey === cached.apiKey) return false;
+      cached = fresh;
+      me = undefined;
+      return true;
+    },
   });
   return ctx;
 }

package/src/http.js

@@ -39,11 +39,13 @@ export function interrupted() {
 /**
  * `onMissingScope(scope)` is asked once per request when a 403 names the scope it needs
  * (`required_scope`); when it answers true (a new key was approved), the request is sent
- * again with the new key.
+ * again with the new key. `onUnauthorized()` is asked once per request on a 401; when it
+ * answers true (another `syndai` process rotated the stored key), the request is sent again
+ * with the new key, so a long watch or MCP server outlives a login elsewhere.
  *
- * @param {{baseUrl: string, getKey: () => Promise<string>, io: object, onMissingScope?: (scope: string) => Promise<boolean>}} options
+ * @param {{baseUrl: string, getKey: () => Promise<string>, io: object, onMissingScope?: (scope: string) => Promise<boolean>, onUnauthorized?: () => Promise<boolean>}} options
  */
-export function createClient({ baseUrl, getKey, io, onMissingScope }) {
+export function createClient({ baseUrl, getKey, io, onMissingScope, onUnauthorized }) {
   /** Call a named route from `routes.js`. */
   function call(name, { params, ...opts } = {}) {
     const [method, path] = route(name, params);
@@ -66,6 +68,7 @@ export function createClient({ baseUrl, getKey, io, onMissingScope }) {
     const payload = body === undefined ? undefined : JSON.stringify(body);
 
     let steppedUp = false;
+    let reloaded = false;
     for (let attempt = 1; ; attempt++) {
       let res;
       let parsed;
@@ -95,6 +98,14 @@ export function createClient({ baseUrl, getKey, io, onMissingScope }) {
           continue;
         }
       }
+      if (res.status === 401 && auth && onUnauthorized && !reloaded) {
+        reloaded = true;
+        if (await onUnauthorized()) {
+          headers.authorization = `Bearer ${await getKey()}`;
+          attempt = 0;
+          continue;
+        }
+      }
       const transient =
         problem !== null &&
         (res.status >= 500 ||