@agent-team-foundation/first-tree-hub 0.10.11 → 0.10.13

package/dist/{bootstrap-BTKiVIYk.mjs → bootstrap-CDeXqhkQ.mjs}

@@ -693,15 +693,23 @@ function resolveAccessToken() {
 * promise so N concurrent callers resolve from a single HTTP call.
 */
 let inflightRefresh = null;
+/** Default freshness window for HTTP callers: refresh if token expires within 30s. */
+const DEFAULT_MIN_VALIDITY_MS = 3e4;
 /**
 * Ensure the persisted access token is fresh. Call before any API request
 * when using persisted credentials. Returns the (possibly refreshed) access
 * token. Service-user API keys are out of scope for this milestone.
+*
+* `opts.minValidityMs` raises the freshness bar — refresh when the cached
+* token has less than that much life left. The WS proactive-refresh path
+* passes a value that overlaps its lead window so it never receives a
+* token already inside the "about to expire" zone.
 */
-async function ensureFreshAccessToken() {
+async function ensureFreshAccessToken(opts) {
+	const minValidityMs = opts?.minValidityMs ?? DEFAULT_MIN_VALIDITY_MS;
 	const creds = loadCredentials();
 	if (!creds) throw new Error("No credentials found. Run `first-tree-hub client connect <server-url>` to sign in.");
-	if (!isTokenExpired(creds.accessToken)) return creds.accessToken;
+	if (!isTokenStale(creds.accessToken, minValidityMs)) return creds.accessToken;
 	if (inflightRefresh) return inflightRefresh;
 	inflightRefresh = (async () => {
 		const res = await fetch(`${creds.serverUrl}/api/v1/auth/refresh`, {
@@ -726,13 +734,13 @@ async function ensureFreshAccessToken() {
 }
 /** Back-compat alias retained so existing call sites keep compiling. */
 const ensureFreshAdminToken = ensureFreshAccessToken;
-function isTokenExpired(token) {
+function isTokenStale(token, minValidityMs) {
 	try {
 		const parts = token.split(".");
 		if (parts.length !== 3 || !parts[1]) return true;
 		const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
 		if (!payload.exp) return false;
-		return payload.exp * 1e3 < Date.now() + 3e4;
+		return payload.exp * 1e3 < Date.now() + minValidityMs;
 	} catch {
 		return true;
 	}

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import "../observability-DPyf745N-BSc8QNcR.mjs";
-import { $ as findStaleAliases, A as checkDatabase, B as installClientService, C as runHomeMigration, D as checkAgentConfigs, E as runMigrations, F as checkServerReachable, G as stopClientService, I as checkWebSocket, L as printResults, M as checkNodeVersion, N as checkServerConfig, O as checkBackgroundService, P as checkServerHealth, R as reconcileAgentConfigs, S as saveOnboardState, T as migrateLocalAgentDirs, U as restartClientService, V as isServiceSupported, W as startClientService, X as ClientRuntime, Y as stopPostgres, Z as handleClientOrgMismatch, _ as promptMissingFields, _t as probeCapabilities, a as declineUpdate, at as fail, b as onboardCheck, c as detectInstallMode, ct as print, d as startServer, dt as ClientOrgMismatchError, et as formatStaleReason, f as COMMAND_VERSION, ft as ClientUserMismatchError, g as promptAddAgent, gt as cleanWorkspaces, h as isInteractive, ht as SessionRegistry, i as createExecuteUpdate, it as resolveReplyToFromEnv, j as checkDocker, k as checkClientConfig, l as fetchLatestVersion, lt as setJsonMode, m as uploadClientCapabilities, mt as SdkError, nt as createOwner, o as promptUpdate, ot as success, p as reconcileLocalRuntimeProviders, pt as FirstTreeHubSDK, r as registerSaaSConnectCommand, s as PACKAGE_NAME, tt as removeLocalAgent, u as installGlobalLatest, v as formatCheckReport, vt as applyClientLoggerConfig, w as createApiNameResolver, x as onboardCreate, y as loadOnboardState, yt as configureClientLoggerForService, z as getClientServiceStatus } from "../saas-connect-D-7x9KRd.mjs";
+import { $ as findStaleAliases, A as checkDatabase, B as installClientService, C as runHomeMigration, D as checkAgentConfigs, E as runMigrations, F as checkServerReachable, G as stopClientService, I as checkWebSocket, L as printResults, M as checkNodeVersion, N as checkServerConfig, O as checkBackgroundService, P as checkServerHealth, R as reconcileAgentConfigs, S as saveOnboardState, T as migrateLocalAgentDirs, U as restartClientService, V as isServiceSupported, W as startClientService, X as ClientRuntime, Y as stopPostgres, Z as handleClientOrgMismatch, _ as promptMissingFields, _t as probeCapabilities, a as declineUpdate, at as fail, b as onboardCheck, c as detectInstallMode, ct as print, d as startServer, dt as ClientOrgMismatchError, et as formatStaleReason, f as COMMAND_VERSION, ft as ClientUserMismatchError, g as promptAddAgent, gt as cleanWorkspaces, h as isInteractive, ht as SessionRegistry, i as createExecuteUpdate, it as resolveReplyToFromEnv, j as checkDocker, k as checkClientConfig, l as fetchLatestVersion, lt as setJsonMode, m as uploadClientCapabilities, mt as SdkError, nt as createOwner, o as promptUpdate, ot as success, p as reconcileLocalRuntimeProviders, pt as FirstTreeHubSDK, r as registerSaaSConnectCommand, s as PACKAGE_NAME, tt as removeLocalAgent, u as installGlobalLatest, v as formatCheckReport, vt as applyClientLoggerConfig, w as createApiNameResolver, x as onboardCreate, y as loadOnboardState, yt as configureClientLoggerForService, z as getClientServiceStatus } from "../saas-connect-DLVGb8OH.mjs";
 import "../logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-BTKiVIYk.mjs";
+import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR, f as agentConfigSchema, g as initConfig, h as getConfigValue, i as loadCredentials, l as DEFAULT_CONFIG_DIR, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, r as ensureFreshAdminToken, s as saveAgentConfig, u as DEFAULT_DATA_DIR, w as setConfigValue, x as resetConfigMeta, y as readConfigFile } from "../bootstrap-CDeXqhkQ.mjs";
 import "../dist-DwbhZyGi.mjs";
 import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-viiZmwcn.mjs";
 import "../invitation-B1pjAyOz-BaCA9PII.mjs";
@@ -236,7 +236,7 @@ function createSdk(agentName) {
 	const { serverUrl, agentId } = resolveLocalAgent(agentName);
 	return new FirstTreeHubSDK({
 		serverUrl,
-		getAccessToken: () => ensureFreshAccessToken(),
+		getAccessToken: (opts) => ensureFreshAccessToken(opts),
 		agentId
 	});
 }
@@ -336,7 +336,7 @@ function registerAgentCommands(program) {
 			const clientId = readClientId();
 			const sdk = new FirstTreeHubSDK({
 				serverUrl,
-				getAccessToken: () => ensureFreshAccessToken()
+				getAccessToken: (opts) => ensureFreshAccessToken(opts)
 			});
 			const stale = await findStaleAliases({
 				clientId,
@@ -1221,7 +1221,7 @@ function registerClientCommands(program) {
 			});
 			const sdk = new FirstTreeHubSDK({
 				serverUrl,
-				getAccessToken: () => ensureFreshAccessToken()
+				getAccessToken: (opts) => ensureFreshAccessToken(opts)
 			});
 			agentCheck = await reconcileAgentConfigs({
 				clientId: cfg.client.id,
@@ -1394,7 +1394,7 @@ function registerClientCommands(program) {
 			try {
 				const sdk = new FirstTreeHubSDK({
 					serverUrl,
-					getAccessToken: () => ensureFreshAccessToken()
+					getAccessToken: (opts) => ensureFreshAccessToken(opts)
 				});
 				const stale = await findStaleAliases({
 					clientId,
@@ -1571,13 +1571,13 @@ function isSecretField(schema, dotPath) {
 //#region src/commands/onboard.ts
 async function promptMissing(args) {
 	if (!args.server) try {
-		const { resolveServerUrl } = await import("../bootstrap-BTKiVIYk.mjs").then((n) => n.t);
+		const { resolveServerUrl } = await import("../bootstrap-CDeXqhkQ.mjs").then((n) => n.t);
 		resolveServerUrl();
 	} catch {
 		args.server = await input({ message: "Hub server URL:" });
 		saveOnboardState(args);
 	}
-	const { loadCredentials } = await import("../bootstrap-BTKiVIYk.mjs").then((n) => n.t);
+	const { loadCredentials } = await import("../bootstrap-CDeXqhkQ.mjs").then((n) => n.t);
 	if (!loadCredentials()) throw new Error("No saved credentials. Run `first-tree-hub client connect <server-url>` before onboarding.");
 	if (!args.id) {
 		args.id = await input({ message: "Agent ID:" });

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import "./observability-DPyf745N-BSc8QNcR.mjs";
-import { A as checkDatabase, B as installClientService, C as runHomeMigration, D as checkAgentConfigs, E as runMigrations, F as checkServerReachable, G as stopClientService, H as resolveCliInvocation, I as checkWebSocket, J as isDockerAvailable, K as uninstallClientService, L as printResults, M as checkNodeVersion, N as checkServerConfig, P as checkServerHealth, Q as rotateClientIdWithBackup, U as restartClientService, V as isServiceSupported, W as startClientService, X as ClientRuntime, Y as stopPostgres, Z as handleClientOrgMismatch, _ as promptMissingFields, b as onboardCheck, d as startServer, g as promptAddAgent, h as isInteractive, j as checkDocker, k as checkClientConfig, mt as SdkError, n as deriveHubUrlFromToken, nt as createOwner, pt as FirstTreeHubSDK, q as ensurePostgres, rt as hasUser, st as blank, t as HubUrlDerivationError, ut as status, v as formatCheckReport, x as onboardCreate, z as getClientServiceStatus } from "./saas-connect-D-7x9KRd.mjs";
+import { A as checkDatabase, B as installClientService, C as runHomeMigration, D as checkAgentConfigs, E as runMigrations, F as checkServerReachable, G as stopClientService, H as resolveCliInvocation, I as checkWebSocket, J as isDockerAvailable, K as uninstallClientService, L as printResults, M as checkNodeVersion, N as checkServerConfig, P as checkServerHealth, Q as rotateClientIdWithBackup, U as restartClientService, V as isServiceSupported, W as startClientService, X as ClientRuntime, Y as stopPostgres, Z as handleClientOrgMismatch, _ as promptMissingFields, b as onboardCheck, d as startServer, g as promptAddAgent, h as isInteractive, j as checkDocker, k as checkClientConfig, mt as SdkError, n as deriveHubUrlFromToken, nt as createOwner, pt as FirstTreeHubSDK, q as ensurePostgres, rt as hasUser, st as blank, t as HubUrlDerivationError, ut as status, v as formatCheckReport, x as onboardCreate, z as getClientServiceStatus } from "./saas-connect-DLVGb8OH.mjs";
 import "./logger-core-BTmvdflj-DjW8FM4T.mjs";
-import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-BTKiVIYk.mjs";
+import { a as resolveAccessToken, n as ensureFreshAccessToken, o as resolveServerUrl, r as ensureFreshAdminToken } from "./bootstrap-CDeXqhkQ.mjs";
 import "./dist-DwbhZyGi.mjs";
 import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-viiZmwcn.mjs";
 import "./invitation-B1pjAyOz-BaCA9PII.mjs";

package/dist/{saas-connect-D-7x9KRd.mjs → saas-connect-DLVGb8OH.mjs}

@@ -1,6 +1,6 @@
 import { m as __toESM } from "./esm-CYu4tXXn.mjs";
 import { _ as withSpan, a as endWsConnectionSpan, b as require_pino, c as messageAttrs, d as rootLogger$1, g as startWsConnectionSpan, i as currentTraceId, n as applyLoggerConfig, o as getFastifyOtelPlugin, p as setWsConnectionAttrs, r as createLogger$1, t as adapterAttrs, u as observabilityPlugin, v as withWsMessageSpan, y as FIRST_TREE_HUB_ATTR } from "./observability-DPyf745N-BSc8QNcR.mjs";
-import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR$1, f as agentConfigSchema, g as initConfig, i as loadCredentials, l as DEFAULT_CONFIG_DIR, m as collectMissingPrompts, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, s as saveAgentConfig, u as DEFAULT_DATA_DIR$1, v as migrateLegacyHome, w as setConfigValue, x as resetConfigMeta } from "./bootstrap-BTKiVIYk.mjs";
+import { C as serverConfigSchema, S as resolveConfigReadonly, _ as loadAgents, b as resetConfig, c as saveCredentials, d as DEFAULT_HOME_DIR$1, f as agentConfigSchema, g as initConfig, i as loadCredentials, l as DEFAULT_CONFIG_DIR, m as collectMissingPrompts, n as ensureFreshAccessToken, o as resolveServerUrl, p as clientConfigSchema, s as saveAgentConfig, u as DEFAULT_DATA_DIR$1, v as migrateLegacyHome, w as setConfigValue, x as resetConfigMeta } from "./bootstrap-CDeXqhkQ.mjs";
 import { $ as refreshTokenSchema, A as createOrgFromMeSchema, B as imageInlineContentSchema, C as clientRegisterSchema, D as createAgentSchema, E as createAdapterMappingSchema, F as dryRunAgentRuntimeConfigSchema, G as isReservedAgentName$1, H as inboxDeliverFrameSchema$1, I as extractMentions, J as loginSchema, K as joinByInvitationSchema, L as githubCallbackQuerySchema, M as createTaskSchema, N as defaultRuntimeConfigPayload, O as createChatSchema, P as delegateFeishuUserSchema, Q as rebindAgentSchema, R as githubDevCallbackQuerySchema, S as clientCapabilitiesSchema$1, St as wsAuthFrameSchema, T as createAdapterConfigSchema, U as inboxPollQuerySchema, V as inboxAckFrameSchema, W as isRedactedEnvValue, X as notificationQuerySchema, Y as messageSourceSchema$1, Z as paginationQuerySchema, _ as adminUpdateTaskSchema, _t as updateClientCapabilitiesSchema, a as AGENT_STATUSES, at as sendToAgentSchema, b as agentRuntimeConfigPayloadSchema$1, bt as updateSystemConfigSchema, ct as sessionEventSchema$1, d as TASK_HEALTH_SIGNALS, dt as switchOrgSchema, et as runtimeStateMessageSchema, f as TASK_STATUSES, ft as taskListQuerySchema, g as adminCreateTaskSchema, gt as updateChatSchema, h as addParticipantSchema, ht as updateAgentSchema, i as AGENT_SOURCES, it as sendMessageSchema, j as createOrganizationSchema, k as createMemberSchema, l as SYSTEM_CONFIG_DEFAULTS, lt as sessionReconcileRequestSchema, m as WS_AUTH_FRAME_TIMEOUT_MS, mt as updateAgentRuntimeConfigSchema, n as AGENT_NAME_REGEX$1, nt as scanMentionTokens, o as AGENT_TYPES, ot as sessionCompletionMessageSchema, p as TASK_TERMINAL_STATUSES, pt as updateAdapterConfigSchema, q as linkTaskChatSchema, r as AGENT_SELECTOR_HEADER$1, rt as selfServiceFeishuBotSchema, s as AGENT_VISIBILITY, st as sessionEventMessageSchema, t as AGENT_BIND_REJECT_REASONS, tt as safeRedirectPath, u as TASK_CREATOR_TYPES, ut as sessionStateMessageSchema, v as agentBindRequestSchema, vt as updateMemberSchema, w as connectTokenExchangeSchema, x as agentTypeSchema$1, xt as updateTaskStatusSchema, y as agentPinnedMessageSchema$1, yt as updateOrganizationSchema, z as githubStartQuerySchema } from "./dist-DwbhZyGi.mjs";
 import { _ as recordRedemption, a as ConflictError, b as uuidv7, c as UnauthorizedError, d as findActiveByToken, f as getActiveInvitation, h as organizations, i as ClientUserMismatchError$1, l as buildInviteUrl, m as invitations, n as BadRequestError, o as ForbiddenError, p as invitationRedemptions, r as ClientOrgMismatchError$1, s as NotFoundError, t as AppError, u as ensureActiveInvitation, y as users } from "./invitation-B1pjAyOz-BaCA9PII.mjs";
 import { createRequire } from "node:module";
@@ -2064,7 +2064,7 @@ var ClientConnection = class extends EventEmitter {
 				this.reconnectAttempt = 0;
 				this.wsLogger.debug("socket opened, sending auth");
 				try {
-					const token = await this.getAccessToken();
+					const token = await this.getAccessToken({ minValidityMs: AUTH_REFRESH_LEAD_MS + 5e3 });
 					ws.send(JSON.stringify({
 						type: "auth",
 						token
@@ -2096,7 +2096,11 @@ var ClientConnection = class extends EventEmitter {
 					settle(reject, typedErr ?? /* @__PURE__ */ new Error(`WebSocket closed before ready (code ${code})`));
 					return;
 				}
-				this.wsLogger.warn({
+				if (code === 1e3) this.wsLogger.info({
+					code,
+					wasRegistered
+				}, "disconnected");
+				else this.wsLogger.warn({
 					code,
 					wasRegistered
 				}, "disconnected");
@@ -6257,7 +6261,7 @@ var ClientRuntime = class {
 			serverUrl,
 			clientId,
 			sdkVersion: options.currentVersion,
-			getAccessToken: () => ensureFreshAccessToken()
+			getAccessToken: (opts) => ensureFreshAccessToken(opts)
 		});
 		registerBuiltinHandlers();
 		this.connection.on("auth:expired", () => {
@@ -18752,7 +18756,13 @@ function resolveNpmCommand() {
 */
 function detectInstallMode(argv1 = process.argv[1] ?? "") {
 	if (!argv1) return "npx";
-	const start = dirname(resolve(argv1));
+	let resolvedArgv1;
+	try {
+		resolvedArgv1 = realpathSync(argv1);
+	} catch {
+		resolvedArgv1 = argv1;
+	}
+	const start = dirname(resolve(resolvedArgv1));
 	{
 		let dir = start;
 		for (let i = 0; i < 10; i++) {