@aexol/spectral 0.9.122 → 0.9.124

package/dist/relay/registration.d.ts

@@ -62,6 +62,13 @@ export interface RegisterResponse {
  * Returns `null` if the token isn't a parseable JWT or has no `exp`.
  */
 export declare function decodeJwtExp(jwt: string): number | null;
+/**
+ * Decode the `sub` (subject) claim from a JWT payload without signature
+ * verification. Used to compare the currently logged-in user identity against
+ * the `ownerId` stored in `machine.json` so we can detect account switches
+ * and force re-registration (which triggers the backend ownership transfer).
+ */
+export declare function decodeJwtSub(jwt: string): string | null;
 /** True when the JWT is past expiry (with skew). Treats undecodable as expired. */
 export declare function isJwtExpired(jwt: string, skewSec?: number): boolean;
 /**

package/dist/relay/registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAyF3B"}
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA0G3B"}

package/dist/relay/registration.js

@@ -49,6 +49,25 @@ export function decodeJwtExp(jwt) {
         return null;
     }
 }
+/**
+ * Decode the `sub` (subject) claim from a JWT payload without signature
+ * verification. Used to compare the currently logged-in user identity against
+ * the `ownerId` stored in `machine.json` so we can detect account switches
+ * and force re-registration (which triggers the backend ownership transfer).
+ */
+export function decodeJwtSub(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const payloadJson = Buffer.from(parts[1], "base64url").toString("utf8");
+        const payload = JSON.parse(payloadJson);
+        return typeof payload.sub === "string" ? payload.sub : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** True when the JWT is past expiry (with skew). Treats undecodable as expired. */
 export function isJwtExpired(jwt, skewSec = 60) {
     const exp = decodeJwtExp(jwt);
@@ -73,7 +92,22 @@ export async function ensureMachineRegistered(deps) {
     const skew = deps.expirySkewSec ?? 60;
     const existing = await loadMachine();
     if (existing && !isJwtExpired(existing.machineJwt, skew)) {
-        return { reused: true, record: existing };
+        // The cached machine JWT is still valid. If the caller authenticated with a
+        // user JWT (OAuth login) and the cached machine was previously owned by a
+        // different user, we must NOT short-circuit — we need to hit the register
+        // endpoint so the backend can transfer ownership (upsert ownerId).
+        // Team-API-key auth (no userJwt) keeps the existing reuse behavior.
+        let shouldReuse = true;
+        if (deps.userJwt) {
+            const currentUser = decodeJwtSub(deps.userJwt);
+            if (currentUser && currentUser !== existing.ownerId) {
+                console.log("Machine registered under a different account, re-registering to transfer ownership...");
+                shouldReuse = false;
+            }
+        }
+        if (shouldReuse) {
+            return { reused: true, record: existing };
+        }
     }
     const fetchImpl = deps.fetchImpl ?? fetch;
     const url = `${deps.backendUrl.replace(/\/$/, "")}/api/machines/register`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.122",
+  "version": "0.9.124",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,