@agentshouse/kit 0.2.1-c5d36e97b0fea → 0.2.1-c5d51f1e4ce19

package/dist/login.js

@@ -2,11 +2,16 @@ import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { hostname } from 'node:os';
 import { parseArgs } from 'node:util';
-import { post, retrying } from './api.js';
+import { HouseRefusal, post, retrying } from './api.js';
 import { placeAppGit } from './app-git.js';
-import { forgetOwnAgent, readDisconnected, readEnrolment, readOwnAgent, writeEnrolment, writeOwnAgent } from './home.js';
+import { writeCodexRule } from './clis.js';
+import { forgetDisconnected, forgetOwnAgent, readDisconnected, readEnrolment, readOwnAgent, writeEnrolment, writeOwnAgent, } from './home.js';
 import { callHouse, rpc } from './mcp.js';
-const DEFAULT_HOUSE = 'https://agents.house';
+import { refusalOf } from './refusals.js';
+import { selectRelay } from './relay.js';
+import { startService } from './service.js';
+import { placeSkillSet } from './skills.js';
+export const DEFAULT_HOUSE = 'https://agents.house';
 const OPENER = process.platform === 'darwin' ? 'open' : 'xdg-open';
 // Polling every two seconds brings the User's confirmation to the waiting Kit moments after they give it.
 const POLL_INTERVAL_MS = 2000;
@@ -15,7 +20,7 @@ function open(link) {
         .on('error', () => undefined)
         .unref();
 }
-async function accepted(house, credential) {
+export async function accepted(house, credential) {
     const checked = await callHouse(house, credential, rpc('tools/list', {}));
     if (checked.status === 200)
         return true;
@@ -23,39 +28,115 @@ async function accepted(house, credential) {
         return false;
     throw new Error(`House answered ${checked.status} when Kit checked this computer's own agent's connection: ${checked.text}`);
 }
+const USAGE = `usage: kit login [--house <origin>] [--environment <id>] [--rooms <ref>[,<ref>...] | --no-private]
+       kit login [--house <origin>] --code <code>
+  --house <origin>          the House to connect to, ${DEFAULT_HOUSE} unless one is stored
+  --environment <id>        reconnect this Environment
+  --rooms <ref>[,<ref>...]  give this Environment only these Rooms
+  --no-private              give this Environment every Room but your Private Room
+  --code <code>             connect this machine with a login code
+`;
+function gone(error) {
+    return error instanceof HouseRefusal && refusalOf(error.text)?.code === 'kit_environment_not_found';
+}
+function chosenRooms(rooms, noPrivate) {
+    if (rooms !== undefined && noPrivate)
+        throw new Error('--rooms and --no-private are two choices of Rooms; pass one');
+    if (rooms !== undefined)
+        return { rooms: { reach: 'selected', refs: rooms.split(',') } };
+    return noPrivate ? { rooms: { reach: 'all_but_private' } } : {};
+}
 export async function login(argv) {
     const { values } = parseArgs({
         args: argv,
         options: {
             house: { type: 'string' },
             environment: { type: 'string' },
+            rooms: { type: 'string' },
+            'no-private': { type: 'boolean', default: false },
+            code: { type: 'string' },
+            help: { type: 'boolean', default: false },
         },
     });
+    if (values.help) {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (values.code !== undefined && values.rooms !== undefined)
+        throw new Error('--code cannot be used with --rooms');
+    if (values.code !== undefined && values['no-private'])
+        throw new Error('--code cannot be used with --no-private');
+    if (values.code !== undefined && values.environment !== undefined)
+        throw new Error('--code cannot be used with --environment');
+    const rooms = chosenRooms(values.rooms, values['no-private']);
     const enrolled = (await readEnrolment()) ?? (await readDisconnected());
+    if (values.code !== undefined && enrolled !== null) {
+        throw new Error(`--code connects a new machine; this Kit home records Environment ${enrolled.environment}, so run kit login to reconnect it`);
+    }
+    const relay = process.env.HOUSE_KIT_RELAY || undefined;
+    selectRelay(relay);
     const house = values.house ?? enrolled?.house ?? DEFAULT_HOUSE;
     const replaces = process.env.HOUSE_KIT_REPLACES;
-    const environment = replaces === undefined ? (values.environment ?? (enrolled?.house === house ? enrolled.environment : undefined)) : undefined;
+    const remembered = replaces === undefined && values.environment === undefined && enrolled?.house === house ? enrolled.environment : undefined;
+    const environment = replaces === undefined ? (values.environment ?? remembered) : undefined;
     const ownAgent = await readOwnAgent();
-    const held = ownAgent !== null && ownAgent.house === house && (await accepted(house, ownAgent.credential));
-    const verifier = randomBytes(32).toString('base64url');
-    const started = await retrying(() => post(house, '/kit', {
-        ...(environment === undefined
-            ? { act: 'new_environment', label: hostname(), ...(replaces === undefined ? {} : { replaces }) }
-            : { act: 'existing_environment', environment_id: environment }),
-        code_challenge: createHash('sha256').update(verifier).digest('base64url'),
-        ...(held ? {} : { headless: true }),
-    }));
-    process.stdout.write(`Open this link and confirm: ${started.start_url}\n`);
-    open(started.start_url);
-    const exchanged = await retrying(() => post(house, '/kit/token', { login: started.login, code_verifier: verifier }), undefined, () => POLL_INTERVAL_MS);
-    await writeEnrolment({ house, environment: exchanged.environment, credential: exchanged.credential });
+    let held = false;
+    let exchanged;
+    if (values.code !== undefined) {
+        exchanged = await post(house, '/kit/token', { code: values.code, label: hostname() });
+    }
+    else {
+        held = ownAgent !== null && ownAgent.house === house && (await accepted(house, ownAgent.credential));
+        const verifier = randomBytes(32).toString('base64url');
+        const start = (named) => retrying(() => post(house, '/kit', {
+            label: hostname(),
+            ...(named === undefined
+                ? { act: 'new_environment', ...(replaces === undefined ? {} : { replaces }) }
+                : { act: 'existing_environment', environment_id: named }),
+            ...rooms,
+            code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+            ...(held ? {} : { headless: true }),
+        }));
+        let started;
+        try {
+            started = await start(environment);
+        }
+        catch (error) {
+            if (remembered === undefined || !gone(error))
+                throw error;
+            await forgetDisconnected();
+            process.stdout.write(`House no longer holds Environment ${remembered}; connecting this computer as a new one.\n`);
+            started = await start(undefined);
+        }
+        process.stdout.write(`Open this link and confirm: ${started.start_url}\n`);
+        open(started.start_url);
+        exchanged = await retrying(() => post(house, '/kit/token', { login: started.login, code_verifier: verifier }), undefined, () => POLL_INTERVAL_MS);
+    }
+    await placeSkillSet();
+    await writeCodexRule().catch((error) => process.stderr.write(`kit: ${error.message}\n`));
+    const relayRecord = relay === undefined ? {} : { relay };
+    await writeEnrolment({
+        house,
+        ...relayRecord,
+        environment: exchanged.environment,
+        credential: exchanged.credential,
+    });
     process.stdout.write(`Environment ${exchanged.environment} is connected to ${house}.\n`);
     if (exchanged.headless_credential !== undefined) {
-        await writeOwnAgent({ house, user: exchanged.user, credential: exchanged.headless_credential });
+        await writeOwnAgent({ house, ...relayRecord, user: exchanged.user, credential: exchanged.headless_credential });
     }
-    else if (held && ownAgent.user !== exchanged.user) {
+    else if (held && ownAgent !== null && ownAgent.user !== exchanged.user) {
         await forgetOwnAgent();
         process.stdout.write("This computer's own agent was another User's; run kit login again to connect it to you.\n");
     }
-    await placeAppGit(ownAgent, await readOwnAgent());
+    else if (held && ownAgent !== null) {
+        await writeOwnAgent({ house, ...relayRecord, user: ownAgent.user, credential: ownAgent.credential });
+    }
+    await placeAppGit(ownAgent, await readOwnAgent()).catch((error) => process.stderr.write(`kit: ${error.message}\n`));
+    try {
+        startService();
+    }
+    catch (error) {
+        process.stderr.write(`kit: ${error.message}\n`);
+    }
 }

package/dist/parts.js

@@ -2,7 +2,10 @@ export class Parts {
     parts = [];
     context = null;
     emit;
+    made = [];
+    events = 0;
     writing = null;
+    counting = null;
     planned = null;
     constructor(emit) {
         this.emit = emit;
@@ -10,32 +13,34 @@ export class Parts {
     write(type, id, text) {
         if (text === '')
             return;
-        const last = this.parts.length - 1;
-        const part = this.parts[last];
-        if (this.writing?.type === type && this.writing.id === id && part?.type === type) {
-            part.text += text;
-            this.emit({ op: 'append', index: last, text });
+        if (this.writing?.type === type && this.writing.id === id) {
+            this.parts[this.writing.index].text += text;
+            this.emit({ op: 'append', index: this.writing.index, text });
             return;
         }
-        this.start({ type, text });
-        this.writing = { type, id };
+        this.writing = { type, id, index: this.start({ type, text }) };
     }
     command() {
-        const last = this.parts.length - 1;
-        const part = this.parts[last];
-        if (part?.type !== 'commands') {
-            this.start({ type: 'commands', count: 1 });
+        if (this.counting === null) {
+            this.counting = this.start({ type: 'commands', count: 1 });
             return;
         }
+        const part = this.parts[this.counting];
         part.count++;
-        this.emit({ op: 'count', index: last, count: part.count });
+        this.emit({ op: 'count', index: this.counting, count: part.count });
     }
     start(part) {
         this.writing = null;
-        this.parts.push(part);
-        const index = this.parts.length - 1;
-        this.emit({ op: 'start', index, part });
-        return index;
+        this.counting = null;
+        return this.add(part, ++this.events);
+    }
+    reserve() {
+        this.writing = null;
+        this.counting = null;
+        return ++this.events;
+    }
+    arrive(part, reserved) {
+        this.add(part, reserved);
     }
     done(index, result) {
         const part = this.parts[index];
@@ -55,10 +60,23 @@ export class Parts {
         this.context = context;
         this.emit({ op: 'context', ...context });
     }
+    saved() {
+        return this.parts
+            .map((part, index) => ({ part, made: this.made[index] }))
+            .sort((a, b) => a.made - b.made)
+            .map(({ part }) => part);
+    }
     operations() {
         return [
             ...this.parts.map((part, index) => ({ op: 'start', index, part })),
             ...(this.context === null ? [] : [{ op: 'context', ...this.context }]),
         ];
     }
+    add(part, made) {
+        this.parts.push(part);
+        this.made.push(made);
+        const index = this.parts.length - 1;
+        this.emit({ op: 'start', index, part });
+        return index;
+    }
 }

package/dist/placement.js

@@ -0,0 +1,48 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { run } from './clis.js';
+import { kitHome } from './home.js';
+import { relayOrigin } from './relay.js';
+export function service() {
+    if (process.platform !== 'linux' || !process.env.INVOCATION_ID)
+        return null;
+    return process.env.MANAGERPID ? 'user' : 'system';
+}
+export function throughSudo() {
+    return service() === 'system' && process.getuid() !== 0;
+}
+export async function updatesItself() {
+    if (service() === null)
+        return false;
+    if (!throughSudo())
+        return true;
+    // sudo answers at once, so ten seconds only bounds a stuck sudo.
+    return (await run('sudo', ['-n', 'true'], 10_000)).status === 0;
+}
+function installed() {
+    try {
+        return readFileSync(join(kitHome(), 'placement'), 'utf8').trim();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function entries(house) {
+    const host = new URL(house).host;
+    const relay = relayOrigin();
+    if (relay === undefined)
+        return [`curl -fsSL ${host}/kit | sh`, `irm ${host}/kit.ps1 | iex`];
+    const entry = `${relay}/${host}/kit`;
+    return [`curl -fsSL ${entry} | HOUSE_KIT_RELAY=${relay} sh`, `$env:HOUSE_KIT_RELAY='${relay}'; irm ${entry}.ps1 | iex`];
+}
+export function installCommand(house) {
+    const [shell, windows] = entries(house);
+    const placement = installed();
+    if (placement === 'native')
+        return shell;
+    if (placement === 'server')
+        return `${shell} -s -- --linux`;
+    return `${shell} -s -- --container, or ${windows} on Windows`;
+}

package/dist/relay.js

@@ -1,7 +1,17 @@
+let selected;
+export function selectRelay(relay) {
+    selected = relay === undefined || relay === '' ? null : relay;
+}
+export function relayOrigin() {
+    if (selected !== undefined)
+        return selected ?? undefined;
+    const ambient = process.env.HOUSE_KIT_RELAY;
+    return ambient === undefined || ambient === '' ? undefined : ambient;
+}
 export function relayed(target) {
     const url = new URL(target);
-    const relay = process.env.HOUSE_KIT_RELAY;
-    if (relay === undefined || relay === '')
+    const relay = relayOrigin();
+    if (relay === undefined)
         return url;
     const through = new URL(`${url.host}${url.pathname}${url.search}`, `${relay}/`);
     if (url.protocol === 'wss:' || url.protocol === 'ws:')

package/dist/resident.js

@@ -7,9 +7,10 @@ import { fileURLToPath } from 'node:url';
 import { Agents } from './agents.js';
 import { house } from './api.js';
 import { received } from './bridge.js';
-import { Conversations } from './conversations.js';
+import { CONVERSATION_INPUTS, Conversations } from './conversations.js';
 import { LocalCopies } from './copies.js';
-import { agentBase, enrolled, kitHome } from './home.js';
+import { restart } from './end.js';
+import { agentBase, enrolled, forgetRestart, kitHome, restartAsked } from './home.js';
 import { killDescendants } from './scope.js';
 import { quoted } from './shell.js';
 import { SignIns } from './sign-in.js';
@@ -73,6 +74,7 @@ function connected() {
 }
 export async function resident() {
     await connected();
+    await forgetRestart();
     watch(kitHome(), () => {
         if (enrolled())
             return;
@@ -82,7 +84,7 @@ export async function resident() {
     await placeSkillSet();
     await mkdir(agentBase(), { recursive: true });
     process.env.HOUSE_KIT_RESIDENT = String(process.pid);
-    const agents = new Agents(house);
+    const agents = new Agents(house, () => changed());
     const copies = new LocalCopies(house);
     await copies.load();
     await installShim(join(kitHome(), 'shim', 'git'), 'git-main');
@@ -90,11 +92,14 @@ export async function resident() {
     await serveOwner(copies);
     let stream = null;
     let reported = false;
-    const idle = () => conversations.idle() && signIns.idle();
+    const idle = () => conversations.idle() && signIns.idle() && agents.idle();
     const changed = () => {
         if (!idle()) {
             reported = false;
         }
+        else if (restartAsked() && conversations.quiet()) {
+            restart('restarting for an updated CLI');
+        }
         else if (!reported) {
             reported = true;
             logged(house.deliver('/kit/idle', {}, idle));
@@ -122,7 +127,7 @@ export async function resident() {
         opened: () => {
             conversations.opened();
             changed();
-            logged(copies.select());
+            logged(copies.connected());
         },
         frame: (arrived) => {
             if (arrived.type === 'watching')
@@ -135,8 +140,12 @@ export async function resident() {
                     signIns.start(arrived);
                 else if (arrived.kind === 'update')
                     updates.start(arrived);
-                else
+                else if (CONVERSATION_INPUTS.has(arrived.kind))
                     conversations.input(arrived);
+                else {
+                    const refused = { refused: `This Kit does not know ${arrived.kind}; update the Kit` };
+                    logged(house.deliver(`/kit/inputs/${arrived.input_id}/ack`, refused).finally(changed));
+                }
             }
         },
     });

package/dist/service-main.js

@@ -0,0 +1,9 @@
+import { startService } from './service.js';
+try {
+    if (startService())
+        process.stdout.write('started\n');
+}
+catch (error) {
+    process.stderr.write(`kit: ${error.message}\n`);
+    process.exitCode = 1;
+}

package/dist/service.js

@@ -0,0 +1,33 @@
+import { spawnSync } from 'node:child_process';
+const UNIT = 'house-kit.service';
+// launchctl and systemctl answer at once, so ten seconds only bounds a stuck service manager.
+const MANAGER_MS = 10_000;
+function manage(command, args) {
+    return spawnSync(command, args, { encoding: 'utf8', timeout: MANAGER_MS });
+}
+function start(command, args) {
+    const started = manage(command, args);
+    if (started.status === 0)
+        return;
+    const cause = started.error?.message ?? (started.stderr.trim() || `${command} exited with ${started.status ?? 'a signal'}`);
+    throw new Error(`the House Kit service could not be started: ${cause}`);
+}
+export function startService() {
+    if (process.platform === 'darwin') {
+        const service = `gui/${process.getuid()}/house-kit`;
+        const printed = manage('launchctl', ['print', service]);
+        if (printed.status !== 0 || /^\tstate = running$/m.test(printed.stdout))
+            return false;
+        start('launchctl', ['kickstart', service]);
+        return true;
+    }
+    for (const scope of [['--user'], []]) {
+        if (manage('systemctl', [...scope, 'is-enabled', '--quiet', UNIT]).status !== 0)
+            continue;
+        if (manage('systemctl', [...scope, 'is-active', '--quiet', UNIT]).status === 0)
+            return false;
+        start('systemctl', [...scope, 'start', UNIT]);
+        return true;
+    }
+    return false;
+}

package/dist/skills.js

@@ -1,17 +1,31 @@
+import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { cp, lstat, mkdir, readdir, realpath, rm, symlink, writeFile } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, realpath, rm, symlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { parse } from 'yaml';
 import { KIT_VERSION } from './clis.js';
 import { kitHome, readConfiguration, readHome, writeHome } from './home.js';
 import { refusalOf } from './refusals.js';
-export const HOW_WE_WORK = '/rooms/private/how-we-work.md';
+const HOW_WE_WORK = '/rooms/private/how-we-work.md';
 const SKILL_SET = fileURLToPath(new URL('../skills/', import.meta.url));
 const HOW_WE_WORK_TEXT = readFileSync(new URL('../how-we-work.md', import.meta.url), 'utf8');
+const SHIPPED_HOW_WE_WORK = [
+    'ae4dda60da7b174f22dc5fa9bf07fc27c25864932a74230de4f9f509ddd91f41',
+    '0bdcd43e1603ba6673a3cae56d70bbf90657cbeefd124e91a47be2ca1cbd6c93',
+    '4106a87ec66da6f7b2a10e74d18e6559d68d5f4fe7415dae68f5c7bdb9081968',
+    'ac814a2197038f037b657bb719340395f89f319ac9fcdd386629c3fe2cec68f1',
+    '29951ee394aad9979eecfed3e5dc32c2c86e2226b6a380db5dbd4f305f4d1156',
+];
 const RECORD = 'skill-set.json';
-const CREATED = 'how-we-work-created';
+const WRITTEN = 'how-we-work.json';
 const UNWRITABLE = new Set(['room_not_found', 'operation_denied']);
+const PRESENT = new Set(['path_exists']);
+const CHANGED = new Set(['base_revision_stale', 'path_absent']);
+const UNREADABLE = /^(?:\S+: )?(?:path_not_found|room_not_found|operation_denied)\b/;
+const FAILED = /^exit: [1-9]\d*$/;
+const CUT = /^stderr: shell: output_cut (\d+) of \d+ bytes; continue with: (.+)$/;
 function skillsDirectory() {
     return join(homedir(), '.agents', 'skills');
 }
@@ -49,6 +63,14 @@ async function install() {
     await writeHome(RECORD, { version: KIT_VERSION, names });
 }
 export async function placeSkillSet() {
+    try {
+        await replaceSkillSet();
+    }
+    catch (error) {
+        process.stderr.write(`kit: the skills could not be placed: ${error.message}\n`);
+    }
+}
+async function replaceSkillSet() {
     const accepted = (await readConfiguration()).skills;
     const installed = await readHome(RECORD);
     if (accepted && installed?.version === KIT_VERSION)
@@ -62,17 +84,64 @@ export async function placeSkillSet() {
     else
         await rm(join(kitHome(), RECORD), { force: true });
 }
+function sha256(text) {
+    return createHash('sha256').update(text).digest('hex');
+}
+function cutOf(lines) {
+    const cut = CUT.exec(lines[0] ?? '');
+    return cut !== null && Buffer.byteLength(lines.slice(1).join('\n')) === Number(cut[1]) ? cut : null;
+}
+export async function readHowWeWork(bridge) {
+    let document = '';
+    for (let command = `cat ${HOW_WE_WORK}`; command !== undefined;) {
+        const read = await bridge.tool('shell', { command });
+        const text = read.content.map((content) => content.text).join('\n');
+        const lines = text.split('\n');
+        if (read.isError === true || (FAILED.test(lines[0] ?? '') && lines[1]?.startsWith('stderr: '))) {
+            const refusal = read.isError === true ? text : lines.slice(1).join('\n').replace(/^stderr: /gm, '');
+            if (UNREADABLE.test(refusal))
+                return '';
+            throw new Error(refusal);
+        }
+        const cut = cutOf(lines);
+        document += lines.slice(cut === null ? 0 : 1).join('\n');
+        command = cut?.[2];
+    }
+    return document;
+}
+async function currentRevision(bridge) {
+    const inspected = await bridge.tool('inspect', { path: HOW_WE_WORK });
+    const text = inspected.content.map((content) => content.text).join('\n');
+    if (inspected.isError === true)
+        throw new Error(text);
+    return parse(text).revisions[0].revision;
+}
+async function edit(bridge, change, kept) {
+    const edited = await bridge.tool('edit', { changes: [{ ...change, path: HOW_WE_WORK, content: HOW_WE_WORK_TEXT }] });
+    if (edited.isError !== true)
+        return 'written';
+    const text = edited.content.map((content) => content.text).join('\n');
+    const refusal = refusalOf(text);
+    if (UNWRITABLE.has(refusal?.code ?? ''))
+        return 'unwritable';
+    if (refusal?.code === 'edit_conflict' && refusal.conflicts.some((conflict) => kept.has(conflict)))
+        return 'kept';
+    throw new Error(text);
+}
 export async function createHowWeWork(bridge) {
-    if ((await readHome(RECORD)) === null || (await present(join(kitHome(), CREATED))))
+    if (!(await readConfiguration()).skills || (await readHome(RECORD))?.version === undefined)
+        return;
+    const current = sha256(HOW_WE_WORK_TEXT);
+    if ((await readHome(WRITTEN)) === current)
+        return;
+    const created = await edit(bridge, { op: 'create' }, PRESENT);
+    if (created === 'unwritable')
         return;
-    const created = await bridge.tool('edit', { changes: [{ op: 'create', path: HOW_WE_WORK, content: HOW_WE_WORK_TEXT }] });
-    if (created.isError === true) {
-        const text = created.content.map((content) => content.text).join('\n');
-        const refusal = refusalOf(text);
-        if (UNWRITABLE.has(refusal?.code ?? ''))
+    if (created === 'kept') {
+        const base = await currentRevision(bridge);
+        const held = sha256(await readHowWeWork(bridge));
+        if (held !== current && SHIPPED_HOW_WE_WORK.includes(held) && (await edit(bridge, { op: 'replace', base }, CHANGED)) === 'unwritable')
             return;
-        if (refusal?.code !== 'edit_conflict' || !refusal.conflicts.includes('path_exists'))
-            throw new Error(text);
     }
-    await writeFile(join(kitHome(), CREATED), '');
+    await writeHome(WRITTEN, current);
 }

package/dist/stream.js

@@ -1,11 +1,42 @@
 import { subscribe } from 'node:diagnostics_channel';
 import { finalRefusal, HouseRefusal, retryDelay } from './api.js';
-import { end, REPLACED, SIGN_IN_AGAIN } from './end.js';
+import { end, REPLACED, signInAgain, updateRequired } from './end.js';
 import { readEnrolment } from './home.js';
 import { relayed } from './relay.js';
+import { KIT_WIRE, tooOld } from './wire.js';
 const PATH = '/kit/stream';
-const SUBPROTOCOL = 'house.kit.stream.1';
+const SUBPROTOCOL = `house.kit.stream.${KIT_WIRE}`;
 const REFUSAL_HEADER = 'x-house-refusal';
+// House beats each stream every thirty seconds, so two silent beats mean this Kit cannot hear House.
+export const STREAM_SILENCE_MS = 60_000;
+const SYSTEM_STREAM_CLOCK = {
+    later: (delay, callback) => setTimeout(callback, delay),
+    clear: (timer) => clearTimeout(timer),
+};
+export class StreamSilence {
+    timer = null;
+    silent;
+    clock;
+    interval;
+    constructor(silent, clock = SYSTEM_STREAM_CLOCK, interval = STREAM_SILENCE_MS) {
+        this.silent = silent;
+        this.clock = clock;
+        this.interval = interval;
+    }
+    heard() {
+        this.stop();
+        this.timer = this.clock.later(this.interval, () => {
+            this.timer = null;
+            this.silent();
+        });
+    }
+    stop() {
+        if (this.timer === null)
+            return;
+        this.clock.clear(this.timer);
+        this.timer = null;
+    }
+}
 function streamUrl(house) {
     const url = new URL(PATH, house);
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
@@ -36,29 +67,49 @@ export function holdStream(handlers) {
             headers: { authorization: `Bearer ${credential}` },
         });
         let opened = false;
-        opening.onopen = () => {
-            opened = true;
-            failures = 0;
-            socket = opening;
-            handlers.opened();
-        };
-        opening.onmessage = (event) => {
-            handlers.frame(JSON.parse(String(event.data)));
-        };
-        opening.onerror = () => undefined;
-        opening.onclose = (event) => {
+        let silence = null;
+        const closed = (event) => {
+            silence?.stop();
+            silence = null;
             if (socket === opening)
                 socket = null;
             process.stderr.write(`kit: control stream closed ${event.code} ${event.reason}\n`);
             if (event.reason === 'replaced')
                 end(REPLACED);
-            if (event.reason === 'credential_rejected' || refused?.status === 401)
-                end(SIGN_IN_AGAIN);
+            if (event.reason === 'credential_rejected' || refused?.status === 401) {
+                void signInAgain(credential);
+                return;
+            }
+            if (refused !== null && tooOld(refused.text))
+                updateRequired(house);
             if (finalRefusal(refused))
                 end(refused.message);
             // A closed socket reopens in one to three seconds, spread so Kits one restart closed return apart; an opening House refused as retryable or left unanswered backs off on the jittered curve.
             setTimeout(() => void connect(), opened ? 1000 + Math.random() * 2000 : retryDelay(failures++));
         };
+        opening.onopen = () => {
+            opened = true;
+            failures = 0;
+            socket = opening;
+            silence = new StreamSilence(() => {
+                if (socket !== opening)
+                    return;
+                socket = null;
+                opening.onclose = null;
+                opening.close();
+                closed(new CloseEvent('close', { code: 1006, reason: 'heartbeat_missed' }));
+            });
+            silence.heard();
+            handlers.opened();
+        };
+        opening.onmessage = (event) => {
+            silence?.heard();
+            const frame = JSON.parse(String(event.data));
+            if (frame.type !== 'beat')
+                handlers.frame(frame);
+        };
+        opening.onerror = () => undefined;
+        opening.onclose = closed;
     };
     void connect();
     return {