Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

A background token refresh failure in a non-interactive process wipes every saved CLI session (all accounts)

未关闭
  • 哪里不对？
#8,945 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

@efegokdemir 已经在做这个了。

开始于 2026年10月19日。

  • #8946 来自 @efegokdemir —— 未关闭

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
活跃
技术栈
typescript
领域
authentication, cli

调研方向

Start with packages/cli-kit/src/private/node/session.ts, especially throwOnNoPrompt() and the refresh paths, then read packages/theme/src/cli/utilities/theme-environment/dev-server-session.ts to see how refresh failures are handled. Reproduce the reported behavior with concurrent shopify theme dev processes and inspect the shared config.json. Done means a refresh failure no longer removes unrelated saved sessions, concurrent refreshes do not overwrite valid session data, and users can see when theme dev loses its session.

由索引模型根据 Issue 内容生成。

描述

Summary

When a long-running CLI process (e.g. shopify theme dev) hits a refresh failure while running with noPrompt: true, throwOnNoPrompt() calls logout(), which removes the entire session store (sessionStore + currentSessionId) from config.json, for every account and alias. Because the theme dev auto-refresher swallows the error (outputDebug('Session could not be refreshed.')), nothing is shown to the user. The next CLI command in any terminal then asks for a full login.

On a machine that runs several CLI processes at the same time, this makes the CLI feel like it "expires" every few hours.

Environment
  • Shopify CLI 4.9.4 (Homebrew), macOS, Apple Silicon
  • Several shopify theme dev processes for different stores running at the same time, plus one-off CLI commands from scripts/other terminals, all sharing the same ~/Library/Preferences/shopify-cli-kit-nodejs/config.json
Observed
  • While two shopify theme dev processes were running, config.json ended up with only the cache key; sessionStore and currentSessionId were gone.
  • The theme dev terminals showed no error. The next command in another terminal required a full device login.
Relevant code (main @ 060e88b)
  1. throwOnNoPrompt() logs out before it throws, so one non-interactive process failing removes the sessions every other process relies on:
    https://github.com/Shopify/cli/blob/060e88b3b9d8c6ca01dfa50bbb442ce6470060e2/packages/cli-kit/src/private/node/session.ts#L298-L307
    It is reached from both needs_full_auth and InvalidGrantError during refresh:
    https://github.com/Shopify/cli/blob/060e88b3b9d8c6ca01dfa50bbb442ce6470060e2/packages/cli-kit/src/private/node/session.ts#L252-L271
  2. The theme dev auto-refresher runs every 30 minutes with noPrompt: true and swallows failures:
    https://github.com/Shopify/cli/blob/060e88b3b9d8c6ca01dfa50bbb442ce6470060e2/packages/theme/src/cli/utilities/theme-environment/dev-server-session.ts#L56-L63
  3. The session store is read, modified and written back as a whole. I couldn't find any cross-process lock around it:
    https://github.com/Shopify/cli/blob/060e88b3b9d8c6ca01dfa50bbb442ce6470060e2/packages/cli-kit/src/private/node/session.ts#L273-L284
Suspected trigger (not confirmed)

Two processes refresh at around the same time using the same refresh token, or one overwrites the store with stale tokens after the other has refreshed. If refresh tokens are rotated, the later refresh gets invalid_grant, which goes through throwOnNoPrompt(), which wipes all sessions. I couldn't confirm whether Identity rotates refresh tokens, but the "one failure clears everything" behaviour comes straight from the code above, whatever causes the refresh to fail.

Steps to reproduce (likely)
  1. shopify auth login
  2. Start shopify theme dev against two different stores in two terminals and leave them running for a few hours (past the access-token expiry, so the 30-minute auto-refresher has to refresh).
  3. Check config.json: sessionStore disappears at some point, and the next CLI command asks for a full login.
Expected
  • A refresh failure in one non-interactive process should not delete sessions for other processes or accounts. At most it should fail that process, or invalidate only the session it was using.
  • Concurrent refreshes should be serialized (file lock), or the store should be re-read before writing, so that processes don't invalidate each other's tokens.
  • When theme dev loses its session, the user should see it in the terminal instead of a debug-only log line.
Related

#5826 and #3173 report similar "randomly signed out / unable to prompt for reauthentication" symptoms. Both were closed after fixes to single-process error handling. The multi-process case doesn't seem to be covered.

主要语言
TypeScript
星标
757
派生
294
平均合并
4 天 12 小时
30 天内合并 PR
175

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

Shopify/cli 的其他 Issue

查看 Shopify/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。