@ctrl-spc/cs 0.7.14 → 0.7.16

package/dist/companion-ui.js

@@ -286,9 +286,44 @@ async function api(path, opts) {
 }
 
 async function boot() {
-  const r = await api('/api/session');
-  if (r.data && r.data.signedIn) renderHome(r.data);
-  else renderSignIn(r.data || {});
+  try {
+    const r = await api('/api/session');
+    if (!r.ok || r.data.signedIn === null || r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online')) {
+      renderSessionUnavailable(r.data.sessionError || r.data.error, r.data);
+    } else if (r.data.signedIn) renderHome(r.data);
+    else renderSignIn(r.data || {});
+  } catch (_) { renderSessionUnavailable(); }
+}
+
+function renderSessionUnavailable(message, session) {
+  session = session || {};
+  stopBadgePoll();
+  app.replaceChildren();
+  const wrap = el('div', 'auth');
+  const card = el('div', 'auth-card');
+  card.append(logo(), el('h1', 'auth-title', session.sessionRenewing ? 'Renewing session' : 'Connection unavailable'));
+  const status = el('p', 'auth-sub', session.sessionRenewing ? 'Your saved sign-in is being renewed. Your work remains saved.' : 'Your saved sign-in is preserved. Check the connection or start the local service.');
+  status.setAttribute('role', 'status'); card.append(status);
+  card.append(el('p', 'auth-sub', message || 'Sign-in could not be checked. Check your connection and try again.'));
+  const retry = el('button', 'btn btn-primary', 'Try again');
+  retry.addEventListener('click', boot);
+  card.append(retry);
+  if (session.connectionState === 'unknown') {
+    const start = el('button', 'btn', 'Start');
+    start.addEventListener('click', async function () {
+      if (start.disabled) return;
+      start.disabled = true; start.textContent = 'Starting…';
+      try { const result = await api('/api/start', {method:'POST'}); if (!result.ok) throw new Error(result.data.error || 'The local service could not start.'); await boot(); }
+      catch (error) { status.textContent = error.message || 'The local service could not start. Try again.'; start.disabled = false; start.textContent = 'Start'; }
+    });
+    card.append(start);
+  }
+  wrap.append(card);
+  app.append(wrap);
+  badgePollTimer = setInterval(function () { void api('/api/session').then(function (r) {
+    if (!card.isConnected || !r.ok || r.data.signedIn === null || r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online')) return;
+    if (r.data.signedIn) renderHome(r.data); else renderSignIn(r.data);
+  }).catch(function () {}); }, 3000);
 }
 
 /** The passive "Agent tools" badge (feature 05). Read-only: no button, no
@@ -308,6 +343,9 @@ function agentToolsBadge(state) {
   if (reason === 'connected') {
     title = 'Agent tools: connected \\u2713';
     sub = (state.agent || 'Claude') + ' \\u00b7 ' + (state.server || 'ctrl-spc');
+  } else if (reason === 'unavailable') {
+    title = 'Connection unavailable';
+    sub = state.message || 'Sign-in could not be checked. Retrying.';
   } else if (reason === 'connecting') {
     title = 'Agent tools: connecting\\u2026';
     sub = state.agent || '';
@@ -348,13 +386,21 @@ async function pollBadgeOnce() {
     const r = await api('/api/session');
     // Home may have been torn down while the fetch was in flight.
     if (!badge.isConnected) return;
-    if (!(r.data && r.data.signedIn)) { stopBadgePoll(); return; }
-    const fresh = agentToolsBadge(r.data.agentTools);
+    if (r.ok && r.data.signedIn === false) { renderSignIn(r.data); return; }
+    if (r.ok && (r.data.sessionRenewing || (r.data.signedIn && r.data.connectionState !== 'online'))) { renderSessionUnavailable(r.data.sessionError, r.data); return; }
+    const fresh = agentToolsBadge(!r.ok || r.data.signedIn === null
+      ? { reason: 'unavailable', message: r.data.sessionError }
+      : r.data.agentTools);
     fresh.id = 'agent-tools';
     fresh.style.marginBottom = 'var(--sp-5)';
     badge.replaceWith(fresh);
   } catch (e) {
-    /* transient — try again next tick */
+    if (badge.isConnected) {
+      const fresh = agentToolsBadge({ reason: 'unavailable' });
+      fresh.id = 'agent-tools';
+      fresh.style.marginBottom = 'var(--sp-5)';
+      badge.replaceWith(fresh);
+    }
   } finally {
     badgePolling = false;
   }
@@ -370,6 +416,8 @@ function renderSignIn(session) {
   app.replaceChildren();
   const wrap = el('div', 'auth');
   const card = el('div', 'auth-card');
+  if (session.sessionState === 'signed-out') { const status = el('p', 'auth-sub', 'Signed out'); status.setAttribute('role', 'status'); card.append(status); }
+  if (session.sessionState === 'rejected') { const warning = el('p', 'auth-sub', 'CTRL+SPC sign-in was rejected. Sign in here to reconnect. Provider sign-in and stopped assignments remain separate.'); warning.setAttribute('role', 'status'); card.append(warning); }
   card.append(logo());
   card.append(el('h1', 'auth-title', 'Sign in'));
   card.append(el('p', 'auth-sub', 'The board your agents report to. Sign in to link this computer to your account.'));

package/dist/companion.js

@@ -1,72 +1,31 @@
+import { isAuthSessionMissingError } from '@supabase/supabase-js';
 import { createServer } from 'node:http';
 import { timingSafeEqual } from 'node:crypto';
 import { COMPANION_PORT } from './env.js';
 import { openBrowser } from './browser.js';
-import { companionToken, getMachineIdentity, readSession, clearSession, readCodebasePaths, writeCodebasePath } from './config.js';
-import { getClient, signIn, NotLoggedIn } from './supabase.js';
-import { startPresence, stopPresence, liveClient, isPresenceRunning } from './presence.js';
+import { companionToken, getMachineIdentity, readSession, readSessionRecord, clearSession, readCodebasePaths, writeCodebasePath } from './config.js';
+import { getClient, signIn, NotLoggedIn, confirmedSessionRejection } from './supabase.js';
+import { liveClient } from './presence.js';
+import { startLocalRuntime, localRuntimeOwned, stopLocalOwnerForSignal, inspectLocalRuntime, checkLegacyUpgrade, notifySessionChanged } from './daemon-lifecycle.js';
+import { CLI_VERSION } from './package-version.js';
 import { detectAgents } from './agents.js';
-import { agentToolsBadgeState, foreignToolsServerAlive, unregisterFromClaude, unregisterFromCodex, } from './mcp.js';
+import { agentToolsBadgeState, unregisterFromClaude, unregisterFromCodex, } from './mcp.js';
 import { loadProjects, saveMapping } from './projects.js';
 import { listCodebases, addCodebase, reportLocated, removeCodebase, NotHostedRemoteError } from './codebases.js';
 import { hostedRemoteIdentity } from './git-remote.js';
 import { chooseFolder, detectGitRemote } from './folders.js';
 import { renderCompanionUi } from './companion-ui.js';
 const MAX_BODY_BYTES = 64 * 1024;
-const VERSION = '0.1.0';
-/** Whether THIS process is the one refreshing the machine's token. False once
- *  the companion has found a daemon already serving and deferred to it, so
- *  `requestClient`'s fallback stops building a rival refresher. Starts true
- *  because a companion with no daemon beside it is the common case (bare `cs`
- *  is `openCompanion()`, and `cs open` never installs autostart). */
-let companionRefreshing = true;
-/**
- * Resolves once `companionRefreshing` holds this boot's real decision.
- *
- * The server starts listening before that decision is taken: the probe inside
- * `startPresenceUnlessDaemonServes` costs up to a second, and the
- * `startPresence()` behind it costs seconds more. A browser tab left open by a
- * previous `cs open` polls `GET /api/session` every two seconds, so without
- * this it can be served during that window, while `companionRefreshing` is
- * still its `true` initializer, by a refreshing client on a machine where a
- * daemon is already rotating the token. That is the very collision the
- * deferral exists to prevent, so no authenticated request is served until the
- * decision is in.
- *
- * It is only ever a decision barrier. A failure to start presence is already
- * handled by the `onError` callback and must not become a permanently wedged
- * server, so the assignment below settles this promise on every path.
- */
+const VERSION = CLI_VERSION;
 let refreshDecided = Promise.resolve();
+let closeCompanion;
 function url(token = companionToken()) {
-    return `http://127.0.0.1:${COMPANION_PORT}/?token=${encodeURIComponent(token)}`;
+    return 'http://127.0.0.1:' + COMPANION_PORT + '/?token=' + encodeURIComponent(token);
 }
-/**
- * Come online, unless a daemon on this machine already has.
- *
- * `foreignToolsServerAlive()` probes the fixed tools-server port over loopback
- * and does NOT exclude the calling process, so this must be asked before
- * anything in this process could bind that port. Both call sites (boot and
- * `POST /api/login`) ask exactly once, at a moment where only another `cs` could
- * be answering.
- *
- * When one is: presence, the tools server, agent registration, the orchestrator
- * and the recovery sweeps are all the daemon's job, and running a second copy
- * here duplicates them on the one rotating refresh token this machine has.
- *
- * `companionRefreshing` is assigned on BOTH branches rather than left at its
- * initializer, because login runs this again: a companion that deferred to a
- * daemon and later signs in with that daemon gone must stop reading as
- * non-refreshing.
- */
+/** Only explicit open/login/start intent starts the shared local owner. */
 async function startPresenceUnlessDaemonServes(onError) {
-    if (await foreignToolsServerAlive()) {
-        companionRefreshing = false;
-        return;
-    }
-    companionRefreshing = true;
     try {
-        await startPresence();
+        await startLocalRuntime({ onStop: closeCompanion });
     }
     catch (err) {
         onError(err);
@@ -90,8 +49,7 @@ async function isOurCompanion(token) {
     }
 }
 /**
- * `cs open`: opens the Companion GUI. If a companion is already resident, just
- * points the browser at it; otherwise becomes the resident server itself.
+ * `cs open` explicitly starts the shared service and opens the resident GUI.
  */
 export async function openCompanion() {
     if (!readSession())
@@ -134,6 +92,13 @@ export async function serveCompanion({ open = false } = {}) {
             // the token via the browser) once a health probe confirms it — otherwise
             // some unrelated process holds the port and must not receive the token.
             if (await isOurCompanion(token)) {
+                if (!await inspectLocalRuntime())
+                    await checkLegacyUpgrade();
+                const start = await fetch('http://127.0.0.1:' + COMPANION_PORT + '/api/start', { method: 'POST', headers: { 'x-ctrl-spc-token': token }, signal: AbortSignal.timeout(30000) });
+                if (!start.ok) {
+                    const result = await start.json().catch(() => null);
+                    throw new Error(result?.error ?? 'The resident Companion cannot start this service. Run cs restart on this computer, then cs open.');
+                }
                 console.log(`Companion already running — ${url(token)}`);
                 if (open)
                     openBrowser(url(token));
@@ -147,15 +112,16 @@ export async function serveCompanion({ open = false } = {}) {
         }
         throw err;
     }
-    // Come online immediately if already signed in (terminal `cs login` or a
-    // prior GUI sign-in). Not signed in is fine — the GUI shows the sign-in screen.
+    closeCompanion = () => new Promise((resolve, reject) => {
+        server.close((error) => error ? reject(error) : resolve());
+        // An attached browser may still be awaiting a status request during a
+        // connection outage. Closing this GUI must also close its own active HTTP
+        // connections; they cannot keep the already-stopped runtime alive.
+        server.closeAllConnections();
+    });
+    // Local control starts before cloud sign-in. The GUI remains usable offline.
     try {
-        if (readSession()) {
-            await startPresenceUnlessDaemonServes((err) => {
-                if (!(err instanceof NotLoggedIn))
-                    console.warn(`Presence did not start: ${err.message}`);
-            });
-        }
+        await startPresenceUnlessDaemonServes((err) => console.warn(`Local service did not start: ${err.message}`));
     }
     finally {
         // Signed out, presence started, or the probe itself threw: the decision is
@@ -165,20 +131,14 @@ export async function serveCompanion({ open = false } = {}) {
     console.log(`Companion running — ${url(token)}`);
     if (open)
         openBrowser(url(token));
-    await new Promise((resolve) => {
-        let closing = false;
-        const shutdown = () => {
-            if (closing)
-                return;
-            closing = true;
-            void stopPresence().finally(() => {
-                server.close(() => resolve());
-                process.exit(0);
-            });
-        };
-        process.on('SIGINT', shutdown);
-        process.on('SIGTERM', shutdown);
-    });
+    const shutdown = () => {
+        if (localRuntimeOwned())
+            void stopLocalOwnerForSignal().catch((error) => console.error(error.message));
+        else
+            void closeCompanion?.().then(() => process.exit(0));
+    };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
 }
 // --- request handling --------------------------------------------------------
 /** Two legitimate Host values for a loopback service. Anything else is a
@@ -236,74 +196,9 @@ function agentToolsState(signedIn) {
     const installed = detectAgents().filter((a) => a === 'claude' || a === 'codex');
     return agentToolsBadgeState({ signedIn, installed });
 }
-/**
- * The client an authenticated API request is served through.
- *
- * ═══ IT REUSES PRESENCE'S CLIENT, AND THAT IS THE WHOLE POINT OF THIS
- *     FUNCTION. ═══ `getClient()` builds a BRAND NEW client every call, with
- * `autoRefreshToken: true` and an `onAuthStateChange` that writes
- * `session.json` back (`supabase.ts:61-89`). Calling it per HTTP request meant
- * `cs open` ran a whole family of refreshing, disk-writing clients beside the
- * daemon's, all on the ONE rotating refresh token the machine has. Supabase
- * rotates that token on every refresh and revokes the previous family member
- * outside a 10-second reuse window (`supabase/config.toml:171-175`), so two
- * independent refreshers race: one wins, the loser replays a superseded token,
- * GoTrue revokes the family, and the token on disk is PERMANENTLY dead rather
- * than merely stale. Investigation
- * `.bugs/20260831-supabase-health/investigations/04-refresh-token-loop.md` §3
- * names this row 6 of its rotation-collision map and calls it the most likely
- * precipitating cause of the 2026-08-30 incident, after which the daemon's
- * heartbeat spun on `400 refresh_token_not_found` roughly 360 times an hour
- * with no way to self-heal.
- *
- * So the rule `daemon.ts` and `panel3/run.ts` already state in their own
- * comments now holds here too: ONE REFRESH LOOP PER PROCESS, and one writer of
- * `session.json`. When presence is running, its client is the one that owns
- * refreshing, and the companion reads it rather than standing up a rival.
- *
- * Per process was never enough on its own, because `cs start` and `cs open` are
- * two processes over one `session.json`: the rule is ONE REFRESH LOOP PER
- * MACHINE. A companion that boots (or signs in) while a daemon is already
- * serving defers to it entirely, starting no presence of its own, and everything
- * below follows from that decision.
- *
- * ═══ AND `getClient()` REMAINS THE FALLBACK, BECAUSE NULL HERE MEANS "NO
- *     PRESENCE", NOT "SIGNED OUT". ═══ `liveClient()` is null before the first
- * sign-in, and after `stopPresence()`, and in a companion serving on a machine
- * whose presence failed to start, and in one that found a daemon already
- * serving and deferred to it. Only `getClient()` can answer the signed-in
- * question, by reading the session off disk and throwing `NotLoggedIn` when
- * there is none, so the fallback is what every caller's 401 path still hangs
- * off.
- *
- * What the fallback may NOT do is refresh while another `cs` process on this
- * machine is refreshing, which is the deferring case above: `cs start` is
- * already rotating the one token family, and a client built here with
- * `refreshing: true` would race it exactly as the per-request family did.
- * `companionRefreshing` carries the decision this process took at boot or at
- * sign-in, and `getClient({ refreshing: false })` then returns a client that was
- * never handed the refresh token, so it cannot rotate anything. It still reads
- * the session off disk and still throws `NotLoggedIn`, including when the stored
- * access token has already expired, so the 401 boundary is unchanged. A single
- * companion request building a single client is not the defect; a client per
- * request forever, beside the daemon's, is.
- *
- * ═══ READ AT CALL TIME, NEVER CACHED. ═══ `POST /api/login` signs in and then
- * takes the deferral decision above, which on the no-daemon branch starts
- * presence. A companion that resolved this once at startup would hold the
- * pre-login null for the life of the process and go on building its own clients
- * after the very moment presence became available to share. The login path also
- * reassigns `companionRefreshing`, so caching would freeze the boot decision
- * too, past a sign-in that legitimately changed it.
- *
- * Exported so the rule above is what a test holds: with no presence running it
- * falls through to `getClient()`, refreshing only when no other `cs` process on
- * this machine is, and lets `NotLoggedIn` out rather than softening it into a
- * null, which is the half of the behaviour reachable without a real session and
- * a live network.
- */
+/** Requests borrow the owner's client or read credentials without refreshing. */
 export async function requestClient() {
-    return liveClient() ?? (await getClient({ refreshing: companionRefreshing }));
+    return liveClient() ?? (await getClient({ refreshing: false }));
 }
 async function handle(req, res, token) {
     if (!allowedHost(req.headers.host)) {
@@ -342,21 +237,53 @@ async function handle(req, res, token) {
     res.writeHead(404, { 'Content-Type': 'text/plain' }).end('Not found');
 }
 async function handleApi(req, res, path, query) {
-    // Nothing here is served until this boot's refresh decision is in, so no
-    // request can be answered by a client built from the `true` initializer on a
-    // machine where a daemon is the one refreshing. See `refreshDecided`.
+    // Requests wait for the explicit startup attempt; reads never start a service.
     await refreshDecided;
+    if (req.method === 'POST' && path === '/api/start') {
+        await startLocalRuntime({ onStop: closeCompanion });
+        json(res, 200, { ok: true });
+        return;
+    }
     if (req.method === 'GET' && path === '/api/session') {
         const machine = getMachineIdentity();
         let email = null;
-        if (readSession()) {
+        let sessionError = null;
+        let record = null;
+        try {
+            record = readSessionRecord();
+        }
+        catch {
+            sessionError = 'Local sign-in storage could not be read. Your service controls remain available.';
+        }
+        const local = await inspectLocalRuntime(Date.now() + 2000).catch(() => null);
+        const renewal = local?.status?.sessionRenewing === true;
+        const connectionState = local?.status?.cloud ?? 'unknown';
+        const session = record?.state === 'signed-in' ? record.tokens : null;
+        if (session) {
             try {
-                email = (await (await requestClient()).auth.getUser()).data.user?.email ?? null;
+                const { data, error } = await (await requestClient()).auth.getUser(session.access_token);
+                if (error)
+                    throw error;
+                email = data.user?.email ?? null;
+                if (!email)
+                    throw new Error('Sign-in verification returned no account.');
+            }
+            catch (error) {
+                if (error instanceof NotLoggedIn) {
+                    sessionError = 'The local service needs to check your sign-in. Use Start in Companion if the service is stopped, then check again.';
+                }
+                else if (!confirmedSessionRejection(error) && !isAuthSessionMissingError(error)) {
+                    // getUser received an explicit stored JWT; Auth normalizes its typed session_not_found rejection to this class.
+                    sessionError = 'Sign-in could not be checked. Check your connection and try again.';
+                }
             }
-            catch { /* stale/expired session reads as signed out */ }
         }
         json(res, 200, {
-            signedIn: email !== null,
+            signedIn: sessionError ? null : email !== null,
+            sessionError,
+            sessionRenewing: renewal,
+            connectionState,
+            sessionState: record?.state ?? 'signed-out',
             email,
             machineName: machine.name,
             platform: process.platform,
@@ -375,6 +302,7 @@ async function handleApi(req, res, path, query) {
         }
         try {
             const result = await signIn(email, password);
+            await notifySessionChanged();
             await startPresenceUnlessDaemonServes((err) => {
                 console.warn(`Presence did not start after sign-in: ${err.message}`);
             });
@@ -386,30 +314,19 @@ async function handleApi(req, res, path, query) {
         return;
     }
     if (req.method === 'POST' && path === '/api/logout') {
-        // Logout also unregisters ctrl-spc from the detected agents (Phase 3), so no
-        // dead server entry is left behind for the next agent run.
-        if (isPresenceRunning()) {
-            await stopPresence({ unregister: true });
-        }
-        else {
-            /* ═══ A COMPANION THAT DEFERRED TO A DAEMON STILL HAS TO UNREGISTER. ═══
-               `stopPresence` returns early when this process holds no presence
-               (`presence.ts:603-604`), so without this branch logout would delete
-               `session.json` and leave the `ctrl-spc` entry in Claude's and Codex's
-               configs pointing at a server whose session is gone.
-      
-               Only the unregistration is copied, deliberately. The other two things
-               `stopPresence` does belong to a process that owns them, and this one
-               owns neither: the running tools server is the daemon's, and the daemon
-               still owns and heartbeats `cliv2_agents`. Stamping `stopped_at` from
-               here would mark a machine offline that is genuinely online. */
+        try {
+            await clearSession();
+            await notifySessionChanged();
             const agents = detectAgents();
             if (agents.includes('claude'))
                 void unregisterFromClaude();
             if (agents.includes('codex'))
                 void unregisterFromCodex();
         }
-        clearSession();
+        catch (error) {
+            json(res, 503, { ok: false, error: error instanceof Error ? error.message : 'Sign-out could not be confirmed.' });
+            return;
+        }
         json(res, 200, { ok: true });
         return;
     }