@alan-ai-hq/agent-manager 0.1.104 → 0.1.105

package/dist/index.cjs

@@ -15504,7 +15504,7 @@ function describeError(error61) {
 }
 
 // src/version.ts
-var AGENT_VERSION = "0.1.104";
+var AGENT_VERSION = "0.1.105";
 
 // src/daemon-worktree.ts
 var import_node_child_process3 = require("child_process");
@@ -35724,6 +35724,8 @@ var AGENT_CONFIG_KEYS = /* @__PURE__ */ new Map([
   ["teamId", "string"],
   ["runtimeId", "string"],
   ["runtimeToken", "string"],
+  ["runtimeRenewalToken", "string"],
+  ["runtimeTokenExpiresAt", "string"],
   ["localApiPort", "number"],
   ["localApiToken", "string"],
   ["displayName", "string"]
@@ -36556,7 +36558,7 @@ function isBrowserRecordingToolName(toolName) {
 }
 
 // ../shared/dist/agent/mcp-config.js
-var ALAN_AGENT_CREDENTIAL_ENV = "ALAN_AGENT_CREDENTIAL";
+var ALAN_MCP_AUTHORIZATION_ENV = "ALAN_MCP_AUTHORIZATION";
 var ALAN_RUN_ID_ENV = "ALAN_RUN_ID";
 var MCP_CONFIG_KEY = /^[A-Za-z0-9_-]+$/;
 function isExternalMcpServerName(name) {
@@ -40806,8 +40808,12 @@ function requiredHeader(registration, name) {
   if (!value2) throw new Error(`Alan MCP ${name} header is missing`);
   return value2;
 }
-function requireManagedAgentCredential(registration) {
-  return requiredHeader(registration, "x-alan-agent-credential");
+function requireManagedAuthorization(registration) {
+  const authorization = requiredHeader(registration, "authorization");
+  if (!authorization.startsWith("Bearer ") || !authorization.slice(7).trim()) {
+    throw new Error("Alan MCP authorization header must contain a bearer token");
+  }
+  return authorization;
 }
 function requireManagedRunId(registration) {
   return requiredHeader(registration, "x-alan-run-id");
@@ -41288,7 +41294,7 @@ function buildClaudeManagedMcpArgs(registration, options = {}) {
     type: "http",
     url: registration.url,
     headers: {
-      "x-alan-agent-credential": `\${${ALAN_AGENT_CREDENTIAL_ENV}}`,
+      Authorization: `\${${ALAN_MCP_AUTHORIZATION_ENV}}`,
       "x-alan-run-id": `\${${ALAN_RUN_ID_ENV}}`
     }
   };
@@ -41310,7 +41316,7 @@ function createClaudeCliBackend(command = "claude", defaultArgs = []) {
         env: {
           ...context.env,
           ...externalMcp?.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(managedRegistration),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(managedRegistration),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(managedRegistration)
         }
       } : context;
@@ -42566,7 +42572,7 @@ function buildCodexManagedMcpArgs(registration, options = {}) {
     "-c",
     `mcp_servers.alan.url=${JSON.stringify(registration.url)}`,
     "-c",
-    `mcp_servers.alan.env_http_headers.x-alan-agent-credential=${JSON.stringify(ALAN_AGENT_CREDENTIAL_ENV)}`,
+    `mcp_servers.alan.env_http_headers.Authorization=${JSON.stringify(ALAN_MCP_AUTHORIZATION_ENV)}`,
     "-c",
     `mcp_servers.alan.env_http_headers.x-alan-run-id=${JSON.stringify(ALAN_RUN_ID_ENV)}`,
     "-c",
@@ -42613,7 +42619,7 @@ function createCodexRuntimeBackend(command = "codex", defaultArgs = []) {
         env: {
           ...context.env,
           ...externalMcp?.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(managedRegistration),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(managedRegistration),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(managedRegistration)
         }
       } : context;
@@ -43579,7 +43585,7 @@ function createCursorAgentCliBackend(command = "cursor-agent", defaultArgs = [])
         ...context,
         env: {
           ...context.env,
-          [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(context.config.alanMcp),
+          [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(context.config.alanMcp),
           [ALAN_RUN_ID_ENV]: requireManagedRunId(context.config.alanMcp)
         }
       } : context;
@@ -44735,7 +44741,7 @@ function buildKimiMcpConfig(registration, externalServers = {}) {
   mcpServers[managedMcpServerName()] = {
     url: registration.url,
     headers: {
-      "x-alan-agent-credential": requireManagedAgentCredential(registration),
+      Authorization: requireManagedAuthorization(registration),
       "x-alan-run-id": requireManagedRunId(registration)
     }
   };
@@ -44827,7 +44833,7 @@ function buildManagedOpenCodeConfigContent(existing, registration) {
         type: "remote",
         url: registration.url,
         headers: {
-          "x-alan-agent-credential": `{env:${ALAN_AGENT_CREDENTIAL_ENV}}`,
+          Authorization: `{env:${ALAN_MCP_AUTHORIZATION_ENV}}`,
           "x-alan-run-id": `{env:${ALAN_RUN_ID_ENV}}`
         },
         oauth: false,
@@ -44843,7 +44849,7 @@ function withManagedOpenCodeMcp(context) {
     ...context,
     env: {
       ...context.env,
-      [ALAN_AGENT_CREDENTIAL_ENV]: requireManagedAgentCredential(registration),
+      [ALAN_MCP_AUTHORIZATION_ENV]: requireManagedAuthorization(registration),
       [ALAN_RUN_ID_ENV]: requireManagedRunId(registration),
       OPENCODE_CONFIG_CONTENT: buildManagedOpenCodeConfigContent(
         context.env.OPENCODE_CONFIG_CONTENT,
@@ -55520,7 +55526,7 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   childProcess = null;
   _aborted = false;
   runId;
-  agentCredential;
+  runtimeToken;
   providerApiKey;
   onProviderSpawned;
   cliEnvOverrides;
@@ -55529,7 +55535,7 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
   constructor(presenter, runtime) {
     super(presenter, runtime);
     this.runId = runtime.runId?.trim() || void 0;
-    this.agentCredential = runtime.agentCredential?.trim() || void 0;
+    this.runtimeToken = runtime.runtimeToken?.trim() || void 0;
     this.providerApiKey = runtime.providerApiKey;
     this.onProviderSpawned = runtime.onProviderSpawned;
     this.cliEnvOverrides = runtime.cliEnvOverrides ?? {};
@@ -55667,8 +55673,8 @@ var CoreAgent = class _CoreAgent extends BaseMachineAgent {
     augmented.ALAN_MANAGED_RUN = "1";
     if (this.runId) augmented.ALAN_RUN_ID = this.runId;
     else delete augmented.ALAN_RUN_ID;
-    if (this.agentCredential) augmented.ALAN_AGENT_CREDENTIAL = this.agentCredential;
-    else delete augmented.ALAN_AGENT_CREDENTIAL;
+    if (this.runtimeToken) augmented.ALAN_MCP_AUTHORIZATION = `Bearer ${this.runtimeToken}`;
+    else delete augmented.ALAN_MCP_AUTHORIZATION;
     const backendKind = this.runtime.backendKind ?? "";
     const providerApiKey = this.providerApiKey ?? "";
     if (backendKind === "antigravity_cli" && providerApiKey.trim()) {
@@ -55843,14 +55849,14 @@ ${meta3.description}`);
 
 // src/managed-mcp.ts
 function buildManagedAlanMcp(input2) {
-  const agentCredential = input2.agentCredential.trim();
+  const runtimeToken = input2.runtimeToken.trim();
   const runId = input2.runId.trim();
-  if (!agentCredential) throw new Error("Alan agent credential is missing");
+  if (!runtimeToken) throw new Error("Alan runtime token is missing");
   if (!runId) throw new Error("Alan run ID is missing");
   return {
     url: new URL("/mcp", input2.apiUrl).toString(),
     headers: {
-      "x-alan-agent-credential": agentCredential,
+      Authorization: `Bearer ${runtimeToken}`,
       "x-alan-run-id": runId
     }
   };
@@ -56379,6 +56385,7 @@ async function handleAgentExecute(ctx, payload) {
     runtimeId,
     runtimeSkillManager,
     getRuntimeToken,
+    ensureRuntimeTokenForLaunch,
     eventOutbox,
     daemonSessionId,
     daemonEpoch,
@@ -56396,12 +56403,22 @@ async function handleAgentExecute(ctx, payload) {
     maintenanceReason,
     verifyActiveWorkspaceLease
   } = ctx;
-  const runtimeToken = getRuntimeToken();
   const heartbeatSeq = getHeartbeatSeq();
   const disconnectedSinceMs = getDisconnectedSinceMs();
   if (!payload?.runId || !payload.conversationId || typeof payload.content !== "string") {
     return;
   }
+  const tokenReadiness = ensureRuntimeTokenForLaunch();
+  const tokenReady = typeof tokenReadiness === "boolean" ? tokenReadiness : await tokenReadiness;
+  if (!tokenReady) {
+    socket.emit("agent.rejected", {
+      runId: payload.runId,
+      message: "This Computer could not renew its expired Alan credential. Run setup again.",
+      code: "runtime_token_expired"
+    });
+    return;
+  }
+  const runtimeToken = getRuntimeToken();
   const isTaskWorkspacePayload = Boolean(
     payload.worktreeInfo?.worktreePath || payload.worktreeInfo?.allWorktrees?.length
   );
@@ -56641,7 +56658,7 @@ async function handleAgentExecute(ctx, payload) {
   };
   const alanMcp = buildManagedAlanMcp({
     apiUrl,
-    agentCredential: runtimeToken,
+    runtimeToken,
     runId: payload.runId
   });
   if (!socket.connected) {
@@ -56811,7 +56828,7 @@ async function handleAgentExecute(ctx, payload) {
       backendKind,
       runtimeCommand,
       runId: payload.runId,
-      agentCredential: runtimeToken,
+      runtimeToken,
       providerApiKey: payload.providerApiKey,
       onProviderSpawned: (pid) => {
         const entry = activeAgents.get(payload.runId);
@@ -58201,7 +58218,7 @@ async function exchangeRuntimeSetupGrant(input2, setupSignal) {
     throw new Error(`runtime registration failed: ${response.status} ${responseBody}`);
   }
   const body = await response.json();
-  if (typeof body.runtime?.id !== "string" || typeof body.runtime.credentialGeneration !== "number" || typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeRenewalToken !== "string" || !body.runtimeRenewalToken.startsWith("alan_runtime_renew_")) {
+  if (typeof body.runtime?.id !== "string" || typeof body.runtime.credentialGeneration !== "number" || typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeRenewalToken !== "string" || !body.runtimeRenewalToken.startsWith("alan_runtime_renew_") || body.runtimeTokenExpiresAt !== void 0 && (typeof body.runtimeTokenExpiresAt !== "string" || !Number.isFinite(Date.parse(body.runtimeTokenExpiresAt)))) {
     throw new Error("runtime registration returned an invalid credential bundle");
   }
   return {
@@ -58209,7 +58226,8 @@ async function exchangeRuntimeSetupGrant(input2, setupSignal) {
     displayName: typeof body.runtime.displayName === "string" ? body.runtime.displayName : input2.displayName,
     credentialGeneration: body.runtime.credentialGeneration,
     runtimeToken: body.runtimeToken,
-    runtimeRenewalToken: body.runtimeRenewalToken
+    runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: typeof body.runtimeTokenExpiresAt === "string" ? body.runtimeTokenExpiresAt : void 0
   };
 }
 async function handoffRuntimeSetupGrant(input2) {
@@ -61479,6 +61497,12 @@ var SuspensionDetector = class {
 };
 
 // src/daemon-start.ts
+var RUNTIME_TOKEN_RENEWAL_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function runtimeTokenNeedsRenewal(expiresAt, nowMs = Date.now()) {
+  if (!expiresAt) return true;
+  const expiresAtMs = Date.parse(expiresAt);
+  return !Number.isFinite(expiresAtMs) || expiresAtMs <= nowMs + RUNTIME_TOKEN_RENEWAL_WINDOW_MS;
+}
 async function startDaemon(args) {
   bindConfigPath(args);
   const stored = readConfig();
@@ -61491,6 +61515,7 @@ async function startDaemon(args) {
   const runtimeTokenOverride = argValue(args, "--token") ?? process.env.ALAN_RUNTIME_TOKEN;
   let runtimeToken = runtimeTokenOverride ?? stored.runtimeToken;
   let runtimeRenewalToken = runtimeTokenOverride ? void 0 : stored.runtimeRenewalToken;
+  let runtimeTokenExpiresAt = runtimeTokenOverride ? void 0 : stored.runtimeTokenExpiresAt;
   const wsUrlOverride = argValue(args, "--ws-url") ?? process.env.ALAN_WS_URL;
   const endpointMismatch = wsUrlOverride ? null : checkStoredEndpointConsistency(stored, readEndpointDefaults());
   let wsUrl = wsUrlOverride ?? stored.wsUrl;
@@ -61835,14 +61860,14 @@ async function startDaemon(args) {
     if (runtimeRenewalInFlight) return runtimeRenewalInFlight;
     const attempt = runCredentialOperation(async () => {
       const renewalToken = runtimeRenewalToken;
-      if (!stored.apiUrl || !renewalToken) {
+      if (!renewalToken) {
         return false;
       }
       let response = null;
       let transportError = null;
       for (let retry = 1; retry <= 3; retry += 1) {
         try {
-          response = await fetch(`${stored.apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
+          response = await fetch(`${apiUrl}/public/runtimes/${runtimeId}/tokens/renew`, {
             method: "POST",
             headers: {
               authorization: `Bearer ${renewalToken}`,
@@ -61874,7 +61899,7 @@ async function startDaemon(args) {
         return false;
       }
       const body = await response.json();
-      if (typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_")) {
+      if (typeof body.runtimeToken !== "string" || !body.runtimeToken.startsWith("alan_runtime_") || typeof body.runtimeTokenExpiresAt !== "string" || !Number.isFinite(Date.parse(body.runtimeTokenExpiresAt))) {
         rememberConnectErrorCode("runtime_renewal_failed");
         lastConnectError = "Runtime renewal returned an invalid access token";
         pushLog("runtime-renewal-invalid-response");
@@ -61887,8 +61912,13 @@ async function startDaemon(args) {
         pushLog("runtime-renewal-superseded");
         return false;
       }
+      const replacementExpiresAt = body.runtimeTokenExpiresAt;
       try {
-        writeConfig({ ...current, runtimeToken: body.runtimeToken });
+        writeConfig({
+          ...current,
+          runtimeToken: body.runtimeToken,
+          runtimeTokenExpiresAt: replacementExpiresAt
+        });
       } catch (error61) {
         rememberConnectErrorCode("config_write_failed");
         lastConnectError = `Runtime renewal could not save its replacement: ${error61.message}`;
@@ -61896,6 +61926,7 @@ async function startDaemon(args) {
         return false;
       }
       runtimeToken = body.runtimeToken;
+      runtimeTokenExpiresAt = replacementExpiresAt;
       socket.auth = { token: body.runtimeToken };
       clearConnectErrors();
       pushLog("runtime-renewal-succeeded");
@@ -61909,6 +61940,14 @@ async function startDaemon(args) {
     });
     return attempt;
   };
+  const ensureRuntimeTokenForLaunch = () => {
+    if (!runtimeRenewalToken || !runtimeTokenNeedsRenewal(runtimeTokenExpiresAt)) return true;
+    return renewRuntimeLease().then((renewed) => {
+      if (renewed) return true;
+      if (!runtimeTokenExpiresAt) return socket.connected;
+      return Date.parse(runtimeTokenExpiresAt) > Date.now();
+    });
+  };
   let queueIdentityRestart = () => {
   };
   let runtimeSetupInFlight = null;
@@ -61935,6 +61974,7 @@ async function startDaemon(args) {
           runtimeId: bundle.runtimeId,
           runtimeToken: bundle.runtimeToken,
           runtimeRenewalToken: bundle.runtimeRenewalToken,
+          runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
           displayName: bundle.displayName
         });
         clearPendingSetupIntent();
@@ -61952,11 +61992,13 @@ async function startDaemon(args) {
         ...current,
         runtimeToken: bundle.runtimeToken,
         runtimeRenewalToken: bundle.runtimeRenewalToken,
+        runtimeTokenExpiresAt: bundle.runtimeTokenExpiresAt,
         displayName: bundle.displayName
       });
       clearPendingSetupIntent();
       runtimeToken = bundle.runtimeToken;
       runtimeRenewalToken = bundle.runtimeRenewalToken;
+      runtimeTokenExpiresAt = bundle.runtimeTokenExpiresAt;
       socket.auth = { token: bundle.runtimeToken };
       clearConnectErrors();
       const ready = new Promise((resolveReady, rejectReady) => {
@@ -62272,6 +62314,7 @@ async function startDaemon(args) {
         runtimeId,
         runtimeSkillManager,
         getRuntimeToken: () => runtimeToken,
+        ensureRuntimeTokenForLaunch,
         eventOutbox,
         daemonSessionId,
         daemonEpoch,
@@ -62725,6 +62768,7 @@ async function setupDaemon(args, options = {}) {
     runtimeId: body.runtimeId,
     runtimeToken: body.runtimeToken,
     runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
     displayName: body.displayName,
     installationId
   });
@@ -62829,6 +62873,7 @@ async function loginWithDeviceCode(args) {
         runtimeId: body.runtime.id,
         runtimeToken: body.runtimeToken,
         runtimeRenewalToken: body.runtimeRenewalToken,
+        runtimeTokenExpiresAt: body.runtimeTokenExpiresAt,
         displayName: body.runtime.displayName ?? displayName,
         installationId
       });
@@ -63046,7 +63091,8 @@ async function rotateRuntimeToken(args) {
     apiUrl,
     runtimeId,
     runtimeToken: body.runtimeToken,
-    runtimeRenewalToken: body.runtimeRenewalToken
+    runtimeRenewalToken: body.runtimeRenewalToken,
+    runtimeTokenExpiresAt: body.runtimeTokenExpiresAt
   });
   console.info("[alan-agent] Runtime token rotated", { runtimeId });
 }
@@ -63348,7 +63394,7 @@ var cursorAdapter = {
           type: "http",
           url: s.url,
           headers: s.name === "alan" ? {
-            "x-alan-agent-credential": `\${env:ALAN_AGENT_CREDENTIAL}`,
+            Authorization: `\${env:ALAN_MCP_AUTHORIZATION}`,
             "x-alan-run-id": `\${env:ALAN_RUN_ID}`
           } : s.headers
         };
@@ -63583,7 +63629,6 @@ var ALAN_SESSION_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-team-id",
   "x-allowed-tools",
   "x-alan-run-reference",
-  "x-alan-agent-credential",
   "x-alan-run-id"
 ]);
 function normalizeAlanSessionHeaders(actual, expected) {
@@ -63903,7 +63948,7 @@ function buildAlanMcpServers(apiUrl) {
       type: "http",
       url: new URL("/mcp", apiUrl).toString(),
       headers: {
-        "x-alan-agent-credential": `\${ALAN_AGENT_CREDENTIAL}`,
+        Authorization: `\${ALAN_MCP_AUTHORIZATION}`,
         "x-alan-run-id": `\${ALAN_RUN_ID}`
       }
     }
@@ -67661,7 +67706,7 @@ async function runSandbox(config2) {
       const agent = new CoreAgent(presenter, {
         backendKind: activeBackendKind,
         runId: activeRunId,
-        agentCredential: config2.sessionToken,
+        runtimeToken: config2.sessionToken,
         providerApiKey: activeProviderApiKey
       });
       currentAgent = agent;
@@ -67710,7 +67755,7 @@ async function runSandbox(config2) {
         }
         const alanMcp = buildManagedAlanMcp({
           apiUrl: config2.apiUrl,
-          agentCredential: config2.sessionToken,
+          runtimeToken: config2.sessionToken,
           runId: activeRunId
         });
         const preparedTask = await prepareSkillInvocationTask({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alan-ai-hq/agent-manager",
-  "version": "0.1.104",
+  "version": "0.1.105",
   "type": "module",
   "description": "Alan agent runtime — cloud sandbox and local daemon (alan-agent CLI)",
   "bin": {
@@ -24,8 +24,8 @@
     "tsup": "^8.5.1",
     "tsx": "^4.19.0",
     "typescript": "~5.9.3",
-    "@alan-ai/agent-core": "0.1.0",
     "@alan-ai/sandbox-runtime-spec": "0.1.0",
+    "@alan-ai/agent-core": "0.1.0",
     "@alan-ai/shared": "0.1.0"
   },
   "scripts": {