@ctrl-spc/cs 0.2.0 → 0.3.1

package/dist/package-version.js

@@ -0,0 +1,10 @@
+import { createRequire } from 'node:module';
+// Resolve relative to this module so the same lookup works from source, built
+// dist, and an installed npm package. npm always includes the package's root
+// package.json, even though the published files allowlist contains only dist.
+const packageMetadata = createRequire(import.meta.url)('../package.json');
+if (typeof packageMetadata.version !== 'string' || packageMetadata.version.length === 0) {
+    throw new Error('The installed @ctrl-spc/cs package does not declare a version.');
+}
+/** The version of the package that is actually running this process. */
+export const CLI_VERSION = packageMetadata.version;

package/dist/presence-heartbeat.js

@@ -0,0 +1,13 @@
+import { CLI_VERSION } from './package-version.js';
+/** Build the complete, path-free cliv2_agents row reported on every heartbeat. */
+export function buildPresenceHeartbeatPayload(input, seenAt = new Date()) {
+    return {
+        user_id: input.userId,
+        machine_id: input.machineId,
+        machine_name: input.machineName,
+        agents: input.agents,
+        platform: input.platform,
+        cli_version: CLI_VERSION,
+        last_seen_at: seenAt.toISOString(),
+    };
+}

package/dist/presence.js

@@ -2,7 +2,9 @@ import { platform } from 'node:os';
 import { getClient } from './supabase.js';
 import { getMachineIdentity, supersededMachineIds, clearSupersededMachineIds } from './config.js';
 import { detectAgents } from './agents.js';
+import { startToolsServer, stopToolsServer, toolsServerStatus, registerWithClaude, registerWithCodex, unregisterFromClaude, unregisterFromCodex, agentRegStatus, heartbeatOpenSessions, setToolsClient, } from './mcp.js';
 import { HEARTBEAT_INTERVAL_MS, COMMAND_POLL_INTERVAL_MS } from './env.js';
+import { buildPresenceHeartbeatPayload } from './presence-heartbeat.js';
 let presence = null;
 /** In-flight guard: startPresence yields to the event loop (network setSession)
  *  before `presence` is assigned, so a plain `if (presence)` check lets two
@@ -16,14 +18,13 @@ async function heartbeat(p) {
     try {
         const { error } = await p.client
             .from('cliv2_agents')
-            .upsert({
-            user_id: p.userId,
-            machine_id: p.identity.id,
-            machine_name: p.identity.name,
+            .upsert(buildPresenceHeartbeatPayload({
+            userId: p.userId,
+            machineId: p.identity.id,
+            machineName: p.identity.name,
             agents: p.agents,
             platform: p.platform,
-            last_seen_at: new Date().toISOString(),
-        }, { onConflict: 'user_id,machine_id' });
+        }), { onConflict: 'user_id,machine_id' });
         if (error)
             throw error;
     }
@@ -33,9 +34,41 @@ async function heartbeat(p) {
         console.warn(`heartbeat failed, will retry: ${err.message}`);
         try {
             p.client = await getClient();
+            // FIX 2: flow the rebuilt client (fresh/refreshed token) into the tools
+            // session-lifecycle heartbeat too, so a wedged token can't leave the session
+            // heartbeat 401ing forever (the CLI-v1 stale-token root cause). No-op unless
+            // the tools server is running.
+            setToolsClient(p.client);
         }
         catch { /* stay down until the next tick */ }
     }
+    // Re-attempt agent registration each heartbeat for any detected agent still
+    // idle or failed, while the tools server is up. Registration otherwise fires
+    // only ONCE at startPresence against that instant's detectAgents(): an agent
+    // installed AFTER sign-in would stay 'idle' forever (badge stuck "connecting…")
+    // and a 'failed' registration would never retry (making the "will retry" copy a
+    // lie). registerWithX's double-kick guard skips agents already 'registering',
+    // and 'registered' agents aren't retried, so this is safe to call every tick.
+    // Runs only in the presence process and stops when presence stops (this is the
+    // heartbeat, whose interval stopPresence clears).
+    // ponytail: a genuinely-unregisterable agent retries every ~10s indefinitely;
+    // add backoff if that churn ever matters.
+    const server = toolsServerStatus();
+    if (server.running) {
+        const status = agentRegStatus();
+        for (const agent of detectAgents()) {
+            if (status[agent] !== 'idle' && status[agent] !== 'failed')
+                continue;
+            if (agent === 'claude')
+                registerWithClaude(server.port);
+            else
+                registerWithCodex(server.port);
+        }
+        // D2b: while the tools server is up, keep every open work session's
+        // last_seen_at fresh so the web presence "working" chip stays lit while
+        // agents work. Best-effort/no-throw, exactly like the block above.
+        await heartbeatOpenSessions();
+    }
 }
 /** Delete cloud rows for machine ids this install has migrated off of, so an old
  *  per-install id can't linger as a duplicate "offline" row for the same box.
@@ -114,6 +147,20 @@ export async function startPresence() {
         await cleanupSupersededRows(p);
         p.hb = setInterval(() => void heartbeat(p), HEARTBEAT_INTERVAL_MS);
         p.cp = setInterval(() => void pollCommands(p), COMMAND_POLL_INTERVAL_MS);
+        // Bring up the local ctrl-spc MCP tools server and register it into Claude
+        // so any agent run on this machine has the tools with zero setup. Strictly
+        // best-effort: a tools-server or registration failure must never break the
+        // presence heartbeat above, so it's caught and warned like everything here.
+        try {
+            await startToolsServer({ client, userId, machineId: identity.id });
+            if (agents.includes('claude'))
+                registerWithClaude(toolsServerStatus().port);
+            if (agents.includes('codex'))
+                registerWithCodex(toolsServerStatus().port);
+        }
+        catch (err) {
+            console.warn(`Agent tools server did not start: ${err.message}`);
+        }
         return { machineName: identity.name, agents };
     })();
     try {
@@ -124,14 +171,29 @@ export async function startPresence() {
     }
 }
 /** Go offline. Best-effort stamps last_seen_at into the past so the web sheet
- *  reads offline immediately instead of waiting out the freshness window. */
-export async function stopPresence({ markOffline = true } = {}) {
+ *  reads offline immediately instead of waiting out the freshness window. Pass
+ *  `unregister` (logout only, never plain shutdown) to also remove the ctrl-spc
+ *  entry from each detected agent's config. */
+export async function stopPresence({ markOffline = true, unregister = false } = {}) {
     const p = presence;
     if (!p)
         return;
     presence = null;
     clearInterval(p.hb);
     clearInterval(p.cp);
+    // On logout (unregister), scrub the ctrl-spc entry from each detected agent's
+    // config so a logged-out machine leaves no dead server that would read "failed
+    // to connect" on the next agent run. Fire-and-forget best-effort — never blocks
+    // logout. On a plain SIGINT shutdown the entries are intentionally left in place
+    // (the caller passes no `unregister`); the badge just reads not-connected
+    // because the server below is torn down.
+    if (unregister) {
+        if (p.agents.includes('claude'))
+            void unregisterFromClaude();
+        if (p.agents.includes('codex'))
+            void unregisterFromCodex();
+    }
+    await stopToolsServer().catch((err) => console.warn(`Agent tools server did not stop cleanly: ${err.message}`));
     if (markOffline) {
         try {
             await p.client

package/dist/supabase.js

@@ -68,7 +68,10 @@ export async function getClient() {
         global: { fetch: retryingFetch },
     });
     client.auth.onAuthStateChange((_event, session) => {
-        if (session) {
+        // Update-only: a token refresh must never recreate session.json after
+        // `cs logout` deleted it, or the logged-out machine would re-authorize
+        // itself up to an hour later.
+        if (session && readSession()) {
             writeSession({ access_token: session.access_token, refresh_token: session.refresh_token });
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctrl-spc/cs",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "CTRL+SPC — minimal, reliable per-machine agent presence. Sign-in, auto-start, agent detection, heartbeat presence, and ping acknowledgement.",
   "engines": {
     "node": ">=22"
@@ -17,11 +17,17 @@
   },
   "scripts": {
     "build": "tsc",
-    "start": "npm run build && node dist/index.js"
+    "start": "npm run build && node dist/index.js",
+    "test": "npm run build && node --test test/*.test.mjs"
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@supabase/supabase-js": "^2.110.1"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@supabase/supabase-js": "^2.110.1",
+    "zod": "^4.4.3"
+  },
+  "overrides": {
+    "@hono/node-server": "^2.0.5"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",