fix: reload update token from file to bypass stale cache (v0.3.3)

- Implemented _get_fresh_token in backend/update.py
- Ensures scripts receive the current token even if settings are cached
- Bumped version to 0.3.3

backend/update.py

@@ -109,11 +109,28 @@ def _parse_version(value: str) -> List[int]:
     return [int(part) for part in value.split(".")]
 
 
+def _get_fresh_token(settings: Settings) -> str:
+    """Always reload token from file/env to avoid stale cache."""
+    # Env var takes precedence
+    env_token = os.getenv("SKD_UPDATE_TOKEN", "")
+    if env_token:
+        return env_token
+    # Fallback to file
+    token_file = Path(settings.update_token_file)
+    if token_file.exists():
+        try:
+            return token_file.read_text(encoding="utf-8").strip()
+        except OSError:
+            pass
+    return settings.update_token  # Fallback to cached value
+
+
 def check_update(settings: Settings) -> Dict[str, Any]:
-    if not settings.update_token:
+    token = _get_fresh_token(settings)
+    if not token:
         raise ValueError("Client is not enrolled (missing update token)")
 
-    headers = {"Authorization": f"Bearer {settings.update_token}"}
+    headers = {"Authorization": f"Bearer {token}"}
     manifest_url = (
         f"{settings.update_service_url}/v1/projects/{settings.update_project_id}/manifest"
     )
@@ -152,7 +169,8 @@ def report_status(
     error: str | None = None,
     duration_ms: int | None = None,
 ) -> None:
-    if not settings.update_token:
+    token = _get_fresh_token(settings)
+    if not token:
         return
 
     report_url = (
@@ -172,7 +190,7 @@ def report_status(
         payload["duration_ms"] = duration_ms
 
     try:
-        headers = {"Authorization": f"Bearer {settings.update_token}"}
+        headers = {"Authorization": f"Bearer {token}"}
         with httpx.Client(timeout=10.0) as client:
             client.post(report_url, json=payload, headers=headers).raise_for_status()
     except Exception:
@@ -184,7 +202,7 @@ def _run_async(script_path: Path, settings: Settings) -> None:
     env = os.environ.copy()
     env["SKD_UPDATE_SERVICE_URL"] = settings.update_service_url
     env["SKD_UPDATE_PROJECT_ID"] = settings.update_project_id
-    env["SKD_UPDATE_TOKEN"] = settings.update_token
+    env["SKD_UPDATE_TOKEN"] = _get_fresh_token(settings)
     env["SKD_UPDATE_STATUS_FILE"] = settings.update_status_file
     env["SKD_UPDATE_LOG_FILE"] = settings.update_log_file