@fml-inc/fml 0.8.5 → 0.8.6-rc.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fml",
-  "version": "0.8.5",
+  "version": "0.8.6-rc.2",
   "description": "FML agent tools for Claude Code",
   "mcpServers": {
     "fml": {

package/README.md

@@ -25,6 +25,20 @@ npm install --global @fml-inc/fml
 fml setup
 ```
 
+For a customer-hosted deployment, pass its public backend (Convex HTTP
+actions) origin directly to login. The CLI validates and saves the URL as the
+active `custom` environment before authenticating, so later CLI and observer
+traffic uses the same deployment:
+
+```bash
+fml login https://actions.fml.example.com
+# Headless alternative:
+fml login https://actions.fml.example.com --device
+```
+
+The URL must be an HTTPS origin with no path, query, credentials, or fragment.
+Plain HTTP is accepted only for loopback development servers.
+
 Run `fml update` to check for and install a newer global package with npm. It
 reports the version installed and refreshes FML setup automatically. Stable
 releases stay on npm's `latest` channel; prerelease versions stay on `next`.
@@ -243,10 +257,11 @@ modes. An existing caller-supplied state directory retains its directory mode.
 ## Automatic updates
 
 While the observer is running it checks npm for a newer FML release about once
-an hour (with jitter) and, when one exists, applies it by running `fml update`
-in the background: `npm install --global` followed by `fml setup`, which
-restarts the observer onto the new version. Output from that background update
-is written to `update.log` in the FML log directory.
+a day (with jitter). A session-start hook also requests a check, limited to one
+session-start check per hour. When a newer release exists, the observer applies
+it by running `fml update` in the background: `npm install --global` followed by
+`fml setup`, which restarts the observer onto the new version. Output from that
+background update is written to `update.log` in the FML log directory.
 
 Auto-update is on by default. To disable it, set `FML_AUTO_UPDATE=off` and
 restart the observer so it picks up the change:
@@ -302,7 +317,7 @@ fml start                Start the local observer and continuous raw sync
 fml restart              Stop and start the local observer
 fml stop                 Stop the local observer and disable raw sync
 
-fml login                Sign in to FML
+fml login [backend-url]  Sign in to hosted FML or a customer-hosted backend
 fml logout               Clear stored credentials
 fml org [slug]           Show or select an organization
 fml env [name-or-url]    Show or select a backend environment

package/dist/{chunk-732O7ISN.js → chunk-3T5UCGBR.js}

@@ -1,6 +1,6 @@
 import {
   FML_HOOK_INBOX_DIR
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // ../../packages/panopticon/src/observer/auth.ts
 import crypto from "crypto";

package/dist/{chunk-IIGTUGO5.js → chunk-FGR7SHV7.js}

@@ -1,6 +1,6 @@
 import {
   FML_HOOK_CAPTURE_DISABLED_FILE
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // src/json-file.ts
 import { randomUUID } from "crypto";

package/dist/{chunk-VOSPLAYR.js → chunk-GQ2WVOGY.js}

@@ -1,12 +1,12 @@
 import {
   OBSERVER_SERVICE_NAME
-} from "./chunk-732O7ISN.js";
+} from "./chunk-3T5UCGBR.js";
 import {
   FML_OBSERVER_LOCK_FILE,
   FML_OBSERVER_PORT,
   FML_OBSERVER_STATE_FILE,
   Sentry
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // src/observer/state.ts
 import { randomUUID } from "crypto";
@@ -990,7 +990,7 @@ var PACKAGE_NAME = "@fml-inc/fml";
 var UPDATE_TIMEOUT_MS = 12e4;
 var SETUP_TIMEOUT_MS = 3e5;
 function getCurrentVersion() {
-  return true ? "0.8.5+446d0559" : "unknown";
+  return true ? "0.8.6-rc.2+bda7cc0a" : "unknown";
 }
 function parseVersion(version) {
   const match = SEMVER_PATTERN.exec(version);

package/dist/{chunk-ZGA57JPY.js → chunk-GST2GTOC.js}

@@ -6,7 +6,7 @@ import {
   getSiteUrlForConvexUrl,
   getSyncDestinationIdentity,
   getValidToken
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // src/hooks/sync-loop.ts
 import { createHash } from "crypto";

package/dist/{chunk-LWOINL4K.js → chunk-JEZPS7F5.js}

@@ -1,7 +1,7 @@
 import {
   resolvePackageRoot,
   runRawSyncOnce
-} from "./chunk-T3ZFT3QP.js";
+} from "./chunk-Z2LWDZ6Z.js";
 
 // src/observer/sync-cycle.ts
 import { fork } from "child_process";

package/dist/{chunk-ZBSC57CW.js → chunk-KWCFT54L.js}

@@ -454,7 +454,7 @@ function parseStoredAuthShape(parsed) {
   }
   const auth = parsed;
   const user = auth.user;
-  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
+  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.siteUrl !== void 0 && typeof auth.siteUrl !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
     return null;
   }
   return auth;
@@ -1314,7 +1314,8 @@ async function storeServiceRefreshToken(refreshToken2, opts) {
         email: "service-token",
         name: "FML service token"
       },
-      tokenType: "service"
+      tokenType: "service",
+      ...opts?.siteUrl ? { siteUrl: opts.siteUrl } : {}
     },
     envName
   );

package/dist/{chunk-P4HOUZXC.js → chunk-RZ5LWWRO.js}

@@ -7,7 +7,7 @@ import {
   getSelectedOrg,
   getSiteUrlForConvexUrl,
   getValidToken
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // src/fml-client.ts
 var LOGIN_EXPIRED_MESSAGE = "Authentication expired. Run `fml login` to sign in again, then restart Claude Code.";
@@ -79,7 +79,7 @@ function createFmlClient(token, options = {}) {
         const repo = resolveRepoFromCwd(process.cwd());
         if (repo) body.repo = repo.repo;
         if (isServiceToken) {
-          const { readTokens, SERVICE_TOKEN_LOGIN_USER_ID } = await import("./token-store-QYXUL4NG.js");
+          const { readTokens, SERVICE_TOKEN_LOGIN_USER_ID } = await import("./token-store-TEPDSK2A.js");
           const stored = readTokens(options.envName);
           const storedUserExternalId = stored?.tokenType === "service" && stored.user.id !== SERVICE_TOKEN_LOGIN_USER_ID ? stored.user.id : void 0;
           const userExternalId = process.env.FML_USER_EXTERNAL_ID ?? storedUserExternalId;

package/dist/{chunk-T3ZFT3QP.js → chunk-Z2LWDZ6Z.js}

@@ -6,7 +6,7 @@ import {
   getSiteUrlForConvexUrl,
   getSyncDestinationIdentity,
   getValidToken
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 
 // ../../packages/panopticon/src/artifact.ts
 import {

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "./chunk-P4HOUZXC.js";
+} from "./chunk-RZ5LWWRO.js";
 import {
   OBSERVER_HEARTBEAT_STALE_MS,
   execBinSync,
@@ -13,13 +13,13 @@ import {
   readObserverStateStatus,
   removeObserverStateIfOwned,
   resolveBin
-} from "./chunk-VOSPLAYR.js";
+} from "./chunk-GQ2WVOGY.js";
 import {
   readJsonFile,
   setHookCaptureDisabled,
   writeJsonFile,
   writeTextFileAtomic
-} from "./chunk-IIGTUGO5.js";
+} from "./chunk-FGR7SHV7.js";
 import {
   CODEX_HOOK_EVENTS,
   GEMINI_HOOK_EVENTS,
@@ -27,7 +27,7 @@ import {
   isObserverHealth,
   readHookInboxStatus,
   readObserverAuthToken
-} from "./chunk-732O7ISN.js";
+} from "./chunk-3T5UCGBR.js";
 import "./chunk-7V7G7NVF.js";
 import {
   claudeConfigDirectory,
@@ -37,7 +37,7 @@ import {
   initializeSyncSettings,
   resolvePackageRoot,
   runRawSyncOnce
-} from "./chunk-T3ZFT3QP.js";
+} from "./chunk-Z2LWDZ6Z.js";
 import {
   DEFAULT_PROD_URL,
   DEFAULT_TARGET_NAME,
@@ -79,7 +79,7 @@ import {
   storeServiceRefreshToken,
   writeEnvConfig,
   writeTokens
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 import "./chunk-MLKGABMK.js";
 
 // src/cli.ts
@@ -127,7 +127,7 @@ var POLL_INTERVAL_MS = 50;
 var LOG_ROTATE_BYTES = 10 * 1024 * 1024;
 var LOG_ROTATE_FILES = 3;
 function expectedObserverVersion() {
-  return true ? "0.8.5+446d0559" : "dev";
+  return true ? "0.8.6-rc.2+bda7cc0a" : "dev";
 }
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -6827,13 +6827,17 @@ async function handleFmlRestart() {
 // src/auth/oauth.ts
 import crypto from "crypto";
 import http from "http";
-async function fetchWorkosClientId(siteUrl) {
+async function fetchWorkosLoginConfig(siteUrl) {
   const response = await fetch(`${siteUrl}/api/auth/config`);
   const data = await response.json();
   if (!response.ok || data.ok === false || !data.workosClientId) {
     throw new Error(data.error ?? `HTTP ${response.status}`);
   }
-  return data.workosClientId;
+  const authUrl = new URL(data.workosAuthUrl ?? WORKOS_AUTH_URL);
+  if (authUrl.protocol !== "https:" || authUrl.username || authUrl.password || authUrl.pathname !== "/" || authUrl.search || authUrl.hash) {
+    throw new Error("FML backend returned an invalid WorkOS authorization URL");
+  }
+  return { clientId: data.workosClientId, authUrl: authUrl.origin };
 }
 async function canOpenBrowser() {
   if (process.env.FML_DEVICE_FLOW === "1") return false;
@@ -6852,13 +6856,15 @@ async function canOpenBrowser() {
   return true;
 }
 async function login(options) {
-  const clientId = await fetchWorkosClientId(options.siteUrl);
+  const { clientId, authUrl: workosAuthUrl } = await fetchWorkosLoginConfig(
+    options.siteUrl
+  );
   const codeVerifier = crypto.randomBytes(32).toString("base64url");
   const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
   const state = crypto.randomBytes(16).toString("hex");
   const { port, waitForCode, close } = await startCallbackServer(state);
   const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const authUrl = new URL(`${WORKOS_AUTH_URL}/user_management/authorize`);
+  const authUrl = new URL(`${workosAuthUrl}/user_management/authorize`);
   authUrl.searchParams.set("client_id", clientId);
   authUrl.searchParams.set("redirect_uri", redirectUri);
   authUrl.searchParams.set("response_type", "code");
@@ -6907,7 +6913,8 @@ async function login(options) {
         email: data.user.email,
         name: userName2
       },
-      workosClientId: clientId
+      workosClientId: clientId,
+      siteUrl: options.siteUrl
     },
     options.envName
   );
@@ -6994,7 +7001,7 @@ function startCallbackServer(expectedState) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function fetchWorkosClientId2(siteUrl) {
+async function fetchWorkosClientId(siteUrl) {
   const response = await fetch(`${siteUrl}/api/auth/config`);
   const data = await response.json();
   if (!response.ok || data.ok === false || !data.workosClientId) {
@@ -7079,7 +7086,7 @@ async function pollForTokens(clientId, authorization) {
   throw new Error("Device authorization timed out. Run `fml login` again.");
 }
 async function deviceLogin(options) {
-  const clientId = await fetchWorkosClientId2(options.siteUrl);
+  const clientId = await fetchWorkosClientId(options.siteUrl);
   const authorization = await requestDeviceAuthorization(clientId);
   console.log("");
   console.log("  Sign in with this code:");
@@ -7105,7 +7112,8 @@ async function deviceLogin(options) {
         email: data.user.email,
         name
       },
-      workosClientId: clientId
+      workosClientId: clientId,
+      siteUrl: options.siteUrl
     },
     options.envName
   );
@@ -7146,7 +7154,15 @@ function resolveGitHubToken() {
 }
 
 // src/commands/login.ts
-function captureLoginEnvironment() {
+function prepareLoginEnvironment(backendUrl) {
+  if (backendUrl) {
+    const convexUrl = normalizeConvexUrl(backendUrl);
+    setActiveEnvironment("custom", convexUrl);
+    return {
+      envName: "custom",
+      siteUrl: getSiteUrlForConvexUrl(convexUrl)
+    };
+  }
   const environment = getActiveEnv();
   return {
     envName: environment.name,
@@ -7285,8 +7301,8 @@ async function selectOrg(environment) {
   } catch {
   }
 }
-async function runServiceTokenLogin(refreshToken) {
-  const environment = captureLoginEnvironment();
+async function runServiceTokenLogin(refreshToken, backendUrl) {
+  const environment = prepareLoginEnvironment(backendUrl);
   const envName = environment.envName;
   if (!isValidEnvName(envName)) {
     throw new Error(
@@ -7308,9 +7324,9 @@ async function runServiceTokenLogin(refreshToken) {
     "Queries and agent activity sync will use the stored service token."
   );
 }
-async function handleServiceTokenLogin(refreshToken) {
+async function handleServiceTokenLogin(refreshToken, backendUrl) {
   try {
-    await runServiceTokenLogin(refreshToken);
+    await runServiceTokenLogin(refreshToken, backendUrl);
     process.exit(0);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -7324,12 +7340,12 @@ async function handleServiceTokenLogin(refreshToken) {
   }
 }
 async function runInteractiveLogin(opts = {}) {
-  const environment = captureLoginEnvironment();
+  const environment = prepareLoginEnvironment(opts.backendUrl);
   const envName = environment.envName;
-  const existingToken = await getValidToken({ env: envName });
+  const stored = readTokens(envName);
+  const canReuseStoredLogin = !opts.backendUrl || stored?.siteUrl === environment.siteUrl;
+  const existingToken = canReuseStoredLogin ? await getValidToken({ env: envName }) : null;
   if (existingToken) {
-    const { readTokens: readTokens2 } = await import("./token-store-QYXUL4NG.js");
-    const stored = readTokens2(envName);
     if (stored?.tokenType === "service") {
       const label = stored.user.id === SERVICE_TOKEN_LOGIN_USER_ID ? "a service token" : `${stored.user.name} (${stored.user.email})`;
       console.log(`Already logged in with ${label} on ${envName}.`);
@@ -7356,11 +7372,14 @@ async function runInteractiveLogin(opts = {}) {
 }
 async function handleLogin(opts) {
   if (opts?.serviceToken) {
-    await handleServiceTokenLogin();
+    await handleServiceTokenLogin(void 0, opts.backendUrl);
     return;
   }
   try {
-    await runInteractiveLogin({ device: opts?.device });
+    await runInteractiveLogin({
+      device: opts?.device,
+      backendUrl: opts?.backendUrl
+    });
     process.exit(0);
   } catch (err) {
     Sentry.captureException(err);
@@ -8822,7 +8841,7 @@ async function handleConfigDetail(opts) {
 // src/commands/tools.ts
 import { readFileSync } from "fs";
 import path28 from "path";
-var pluginVersion = true ? "0.8.5+446d0559" : void 0;
+var pluginVersion = true ? "0.8.6-rc.2+bda7cc0a" : void 0;
 async function getApi() {
   const api = await getAuthenticatedClient();
   if (!api) {
@@ -8979,7 +8998,7 @@ if (process.argv.length <= 2 || process.argv.includes("--help") || process.argv.
   printBanner();
 }
 var program = new Command().name("fml").description("FML CLI and agent tools").version(
-  true ? "0.8.5+446d0559" : "dev"
+  true ? "0.8.6-rc.2+bda7cc0a" : "dev"
 );
 function formatCommandInventory(cmd, prefix = "") {
   const name = prefix ? `${prefix} ${cmd.name()}` : cmd.name();
@@ -9028,11 +9047,14 @@ program.command("update").description("Update fml when a newer release is availa
 ).action(
   (opts) => handleUpdate({ nonInteractive: Boolean(opts.nonInteractive) })
 );
-program.command("login").description("Sign in to your FML account").option("--device", "Use device authorization flow (no browser needed)").option(
+program.command("login").description("Sign in to your FML account").argument(
+  "[backend-url]",
+  "Self-hosted FML backend URL (saved as the active custom environment)"
+).option("--device", "Use device authorization flow (no browser needed)").option(
   "--service-token",
   "Sign in with an org service refresh token (prompts for fml_srt_*)"
 ).action(
-  (opts) => handleLogin(opts)
+  (backendUrl, opts) => handleLogin({ ...opts, backendUrl })
 );
 program.command("logout").description("Sign out and clear stored credentials").action(() => handleLogout());
 program.command("org").description("Show or select organization").argument("[slug]", "Org slug to select").action((slug) => handleOrg(slug));

package/dist/hook-handler.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   hookCaptureIsDisabled
-} from "./chunk-IIGTUGO5.js";
+} from "./chunk-FGR7SHV7.js";
 import {
   getActiveHookDestinationBinding
-} from "./chunk-ZGA57JPY.js";
+} from "./chunk-GST2GTOC.js";
 import {
   SHELL_TOOL_NAMES,
   createHookInboxEntry,
@@ -12,7 +12,7 @@ import {
   normalizeObserverHookCapture,
   persistHookInboxEntry,
   readObserverAuthToken
-} from "./chunk-732O7ISN.js";
+} from "./chunk-3T5UCGBR.js";
 import {
   resolveRepositoryRootFromCwd,
   resolveRepositorySlugFromCwd
@@ -23,7 +23,7 @@ import {
   FML_OBSERVER_AUTH_TOKEN_FILE,
   FML_OBSERVER_ENDPOINT_FILE,
   getValidToken
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 import "./chunk-MLKGABMK.js";
 
 // src/hooks/handler.ts

package/dist/mcp/server.js

@@ -2,7 +2,7 @@
 import {
   createFmlClient,
   getAuthenticatedClient
-} from "../chunk-P4HOUZXC.js";
+} from "../chunk-RZ5LWWRO.js";
 import {
   resolveRepoFromCwd
 } from "../chunk-7V7G7NVF.js";
@@ -17,7 +17,7 @@ import {
   getValidToken,
   initSentry,
   readTokens
-} from "../chunk-ZBSC57CW.js";
+} from "../chunk-KWCFT54L.js";
 import "../chunk-MLKGABMK.js";
 
 // src/mcp/server.ts

package/dist/observer-server.js

@@ -11,11 +11,11 @@ import {
   removeObserverStateIfOwned,
   resolveBin,
   updateObserverState
-} from "./chunk-VOSPLAYR.js";
+} from "./chunk-GQ2WVOGY.js";
 import {
   createHookSyncLoop,
   getActiveHookDestinationBinding
-} from "./chunk-ZGA57JPY.js";
+} from "./chunk-GST2GTOC.js";
 import {
   OBSERVER_PROTOCOL_VERSION,
   OBSERVER_SERVICE_NAME,
@@ -30,15 +30,15 @@ import {
   parseHookInboxMetadata,
   readHookInboxStatusAsync,
   retireHookInboxEntry
-} from "./chunk-732O7ISN.js";
+} from "./chunk-3T5UCGBR.js";
 import "./chunk-7V7G7NVF.js";
 import {
   ObserverSyncCycleAbortedError,
   runObserverSyncCycleSubprocess
-} from "./chunk-LWOINL4K.js";
+} from "./chunk-JEZPS7F5.js";
 import {
   createCliRawSync
-} from "./chunk-T3ZFT3QP.js";
+} from "./chunk-Z2LWDZ6Z.js";
 import {
   FML_OBSERVER_AUTH_TOKEN_FILE,
   FML_OBSERVER_ENDPOINT_FILE,
@@ -56,7 +56,7 @@ import {
   getSyncDestinationAuthBinding,
   getValidToken,
   observerOnlyOverrideWarning
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 import "./chunk-MLKGABMK.js";
 
 // src/observer-server.ts
@@ -1200,14 +1200,17 @@ function createObserverSyncLoop(opts) {
 }
 
 // src/observer/auto-update.ts
-var AUTO_UPDATE_INTERVAL_MS = 60 * 60 * 1e3;
+var AUTO_UPDATE_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var AUTO_UPDATE_JITTER_MS = 10 * 60 * 1e3;
+var AUTO_UPDATE_SESSION_START_COOLDOWN_MS = 60 * 60 * 1e3;
 function errorMessage2(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function createAutoUpdater(dependencies) {
   let timer;
   let stopped = true;
+  let checkInFlight = false;
+  let lastSessionStartCheckAtMs;
   let generation = 0;
   const nextDelay = () => {
     if (dependencies.jitterMs <= 0) return dependencies.intervalMs;
@@ -1220,18 +1223,35 @@ function createAutoUpdater(dependencies) {
     timer = setTimeout(onTick, nextDelay());
     timer.unref();
   };
-  const onTick = async () => {
-    const tickGeneration = generation;
-    timer = void 0;
+  const runUpdateCheck = async (checkGeneration) => {
     try {
       const result = await dependencies.runCheck();
-      if (!stopped && result.newer) dependencies.spawnUpdate();
+      if (!stopped && checkGeneration === generation && result.newer) {
+        dependencies.spawnUpdate();
+      }
     } catch (error) {
-      if (!stopped) {
-        dependencies.log(
-          `[fml] Auto-update check failed: ${errorMessage2(error)}`
-        );
+      if (!stopped && checkGeneration === generation) {
+        try {
+          dependencies.log(
+            `[fml] Auto-update check failed: ${errorMessage2(error)}`
+          );
+        } catch {
+        }
       }
+    } finally {
+      checkInFlight = false;
+    }
+  };
+  const startUpdateCheck = (checkGeneration) => {
+    if (stopped || checkInFlight) return null;
+    checkInFlight = true;
+    return runUpdateCheck(checkGeneration);
+  };
+  const onTick = async () => {
+    const tickGeneration = generation;
+    timer = void 0;
+    try {
+      await startUpdateCheck(tickGeneration);
     } finally {
       if (tickGeneration === generation) schedule();
     }
@@ -1244,6 +1264,17 @@ function createAutoUpdater(dependencies) {
       stopped = false;
       schedule();
     },
+    onSessionStart() {
+      if (stopped) return;
+      const now = dependencies.nowMs();
+      if (lastSessionStartCheckAtMs !== void 0 && now - lastSessionStartCheckAtMs < dependencies.sessionStartCooldownMs) {
+        return;
+      }
+      const check = startUpdateCheck(generation);
+      if (!check) return;
+      lastSessionStartCheckAtMs = now;
+      void check;
+    },
     stop() {
       stopped = true;
       generation += 1;
@@ -1449,7 +1480,7 @@ var hookRejectionStatus = () => ({
   ...lastRejectedReason !== void 0 ? { lastRejectedReason } : {},
   ...lastRejectedTarget !== void 0 ? { lastRejectedTarget } : {}
 });
-var packageVersion = true ? "0.8.5+446d0559" : "dev";
+var packageVersion = true ? "0.8.6-rc.2+bda7cc0a" : "dev";
 var health = () => ({
   status: "ok",
   service: OBSERVER_SERVICE_NAME,
@@ -1626,8 +1657,9 @@ var captureHookRequest = (request, metadata) => {
     } catch {
     }
   }
+  let captured;
   try {
-    database.captureHookEvent({
+    captured = database.captureHookEvent({
       ...event,
       ...destination ? { destination } : {}
     });
@@ -1639,6 +1671,9 @@ var captureHookRequest = (request, metadata) => {
     );
     return terminal ? "terminal_rejected" : "retry";
   }
+  if (captured && event.eventType === "SessionStart") {
+    autoUpdater?.onSessionStart();
+  }
   hookSyncLoop?.wake();
   return "committed";
 };
@@ -1732,6 +1767,7 @@ try {
     }),
     spawnUpdate: spawnObserverUpdate,
     intervalMs: AUTO_UPDATE_INTERVAL_MS,
+    sessionStartCooldownMs: AUTO_UPDATE_SESSION_START_COOLDOWN_MS,
     jitterMs: AUTO_UPDATE_JITTER_MS,
     log: console.warn
   });

package/dist/pi/extension.js

@@ -1045,7 +1045,7 @@ function parseStoredAuthShape(parsed) {
   }
   const auth = parsed;
   const user = auth.user;
-  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
+  if (typeof auth.accessToken !== "string" || typeof auth.refreshToken !== "string" || typeof auth.expiresAt !== "number" || !Number.isFinite(auth.expiresAt) || !user || typeof user.id !== "string" || typeof user.email !== "string" || typeof user.name !== "string" || auth.orgId !== void 0 && typeof auth.orgId !== "string" || auth.orgSlug !== void 0 && typeof auth.orgSlug !== "string" || auth.workosClientId !== void 0 && typeof auth.workosClientId !== "string" || auth.siteUrl !== void 0 && typeof auth.siteUrl !== "string" || auth.tokenType !== void 0 && auth.tokenType !== "oauth" && auth.tokenType !== "service" || auth.refreshInvalidAt !== void 0 && (typeof auth.refreshInvalidAt !== "number" || !Number.isFinite(auth.refreshInvalidAt))) {
     return null;
   }
   return auth;

package/dist/sync-cycle.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   runObserverSyncCycle
-} from "./chunk-LWOINL4K.js";
-import "./chunk-T3ZFT3QP.js";
-import "./chunk-ZBSC57CW.js";
+} from "./chunk-JEZPS7F5.js";
+import "./chunk-Z2LWDZ6Z.js";
+import "./chunk-KWCFT54L.js";
 import "./chunk-MLKGABMK.js";
 
 // src/sync-cycle.ts

package/dist/{token-store-QYXUL4NG.js → token-store-TEPDSK2A.js}

@@ -10,7 +10,7 @@ import {
   setSelectedOrg,
   storeServiceRefreshToken,
   writeTokens
-} from "./chunk-ZBSC57CW.js";
+} from "./chunk-KWCFT54L.js";
 import "./chunk-MLKGABMK.js";
 export {
   SERVICE_TOKEN_LOGIN_USER_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fml-inc/fml",
-  "version": "0.8.5",
+  "version": "0.8.6-rc.2",
   "description": "FML CLI and agent tools",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",