@getpaseo/server 0.5.0-beta.5 → 0.5.0

package/dist/server/server/agent/agent-manager.d.ts

@@ -376,6 +376,7 @@ export declare class AgentManager {
     tryRunOutOfBand(agentId: string, prompt: AgentPromptInput, options?: AgentRunOptions): boolean;
     appendTimelineItem(agentId: string, item: AgentTimelineItem): Promise<void>;
     emitLiveTimelineItem(agentId: string, item: AgentTimelineItem): Promise<void>;
+    private startPendingForegroundTurn;
     streamAgent(agentId: string, prompt: AgentPromptInput, options?: AgentRunOptions): AsyncGenerator<AgentStreamEvent>;
     private finalizeForegroundTurn;
     private openActiveTurn;

package/dist/server/server/agent/agent-manager.js

@@ -9,7 +9,7 @@ import { buildArchivedAgentRecord } from "./agent-archive.js";
 import { InMemoryAgentTimelineStore, } from "./agent-timeline-store.js";
 import { AGENT_STREAM_COALESCE_DEFAULT_WINDOW_MS, AgentStreamCoalescer, } from "./agent-stream-coalescer.js";
 import { limitAgentTimelineItemContent } from "./agent-timeline-content.js";
-import { AgentRunState } from "./agent-run-state.js";
+import { AgentRunState, } from "./agent-run-state.js";
 import { invokeRewindCapability } from "./rewind/rewind.js";
 import { isSystemInjectedEnvelope } from "./agent-prompt.js";
 import { stripInternalPaseoMcpServer, withRuntimePaseoMcpServer } from "./runtime-mcp-config.js";
@@ -1397,6 +1397,31 @@ export class AgentManager {
             provider: agent.provider,
         });
     }
+    async startPendingForegroundTurn(params) {
+        const { agent, agentId, pendingRun, prompt, options } = params;
+        try {
+            const result = await agent.session.startTurn(prompt, options);
+            if (pendingRun.settled) {
+                throw new Error(`Agent ${agentId} run was canceled before its turn started`);
+            }
+            return result.turnId;
+        }
+        catch (error) {
+            if (pendingRun.settled) {
+                throw error;
+            }
+            agent.pendingReplacement = false;
+            const errorMsg = error instanceof Error ? error.message : "Failed to start turn";
+            await this.handleStreamEvent(agent, {
+                type: "turn_failed",
+                provider: agent.provider,
+                error: errorMsg,
+            });
+            this.finalizeForegroundTurn(agent);
+            this.runs.settleForegroundRun(agentId, pendingRun.token);
+            throw error;
+        }
+    }
     streamAgent(agentId, prompt, options) {
         const existingAgent = this.requireSessionAgent(agentId);
         this.logger.trace({
@@ -1428,22 +1453,13 @@ export class AgentManager {
         const streamForwarder = async function* streamForwarder() {
             let turnId;
             let turnStream = null;
-            try {
-                const result = await agent.session.startTurn(prompt, options);
-                turnId = result.turnId;
-            }
-            catch (error) {
-                agent.pendingReplacement = false;
-                const errorMsg = error instanceof Error ? error.message : "Failed to start turn";
-                await this.handleStreamEvent(agent, {
-                    type: "turn_failed",
-                    provider: agent.provider,
-                    error: errorMsg,
-                });
-                this.finalizeForegroundTurn(agent);
-                this.runs.settleForegroundRun(agentId, pendingRun.token);
-                throw error;
-            }
+            turnId = await this.startPendingForegroundTurn({
+                agent,
+                agentId,
+                pendingRun,
+                prompt,
+                options,
+            });
             if (isReplacement) {
                 agent.pendingReplacement = false;
             }
@@ -1859,6 +1875,15 @@ export class AgentManager {
             });
             await run.settledPromise;
         }
+        else if (settlement === "timed_out" && run.kind === "foreground") {
+            this.logger.warn({ agentId, kind: run.kind }, "cancelAgentRun: acknowledged pending turn still active after timeout, clearing it");
+            this.runs.settleForegroundRun(agentId, run.token);
+            if (!agent.pendingReplacement) {
+                agent.lifecycle = "idle";
+                this.touchUpdatedAt(agent);
+                this.emitState(agent);
+            }
+        }
         else if (settlement === "timed_out" && run.kind === "autonomous") {
             this.logger.warn({ agentId, kind: run.kind }, "cancelAgentRun: acknowledged turn still active after timeout, force-canceling");
             await this.dispatchSessionEvent(agent, {

package/dist/server/server/agent/agent-sdk-types.d.ts

@@ -577,6 +577,11 @@ export interface AgentSession {
     getPendingPermissions(): AgentPermissionRequest[];
     respondToPermission(requestId: string, response: AgentPermissionResponse): Promise<AgentPermissionResult | void>;
     describePersistence(): AgentPersistenceHandle | null;
+    /**
+     * Resolve once every foreground turn that predates this call can no longer run or become active.
+     * Calling while already idle is a successful no-op. Reject only when foreground ownership is
+     * still uncertain.
+     */
     interrupt(): Promise<void>;
     /** Release live runtime resources without archiving or deleting the durable native session. */
     close(): Promise<void>;

package/dist/server/server/agent/providers/codex-app-server-agent.d.ts

@@ -127,6 +127,7 @@ export declare class CodexAppServerAgentSession implements AgentSession {
     private currentThreadId;
     private currentTurnId;
     private pendingForegroundTurnIdentification;
+    private pendingForegroundStart;
     private client;
     private readonly subscribers;
     private nextTurnOrdinal;

package/dist/server/server/agent/providers/codex-app-server-agent.js

@@ -587,6 +587,11 @@ function isDefinitiveCodexSteerRejection(error) {
         /^expected active turn id `[^`]+` but found `[^`]+`$/.test(error.message) ||
         error.message === "active turn uses a different output schema");
 }
+function isCodexAlreadyIdleInterrupt(error) {
+    return (error instanceof CodexAppServerRpcError &&
+        error.code === -32600 &&
+        error.message === "no active turn to interrupt");
+}
 const CodexModelListResponseSchema = z.object({
     data: z
         .array(z.object({
@@ -2363,6 +2368,7 @@ export class CodexAppServerAgentSession {
         this.currentThreadId = null;
         this.currentTurnId = null;
         this.pendingForegroundTurnIdentification = null;
+        this.pendingForegroundStart = null;
         this.client = null;
         this.subscribers = new Set();
         this.nextTurnOrdinal = 0;
@@ -3056,9 +3062,18 @@ export class CodexAppServerAgentSession {
         });
     }
     async startTurn(prompt, options) {
-        if (this.activeForegroundTurnId) {
+        if (this.activeForegroundTurnId || this.pendingForegroundStart) {
             throw new Error("A foreground turn is already active");
         }
+        let resolveStart;
+        const pendingStart = {
+            promise: new Promise((resolve) => {
+                resolveStart = resolve;
+            }),
+            resolve: () => resolveStart(),
+            cancelRequested: false,
+        };
+        this.pendingForegroundStart = pendingStart;
         this.dismissPendingPlanApprovals("Dismissed by a new prompt");
         try {
             await this.connect();
@@ -3099,6 +3114,9 @@ export class CodexAppServerAgentSession {
                 hasDeveloperInstructions: turnStart.hasDeveloperInstructions,
                 hasCodexConfig: turnStart.hasCodexConfig,
             });
+            if (pendingStart.cancelRequested) {
+                throw new Error("Codex turn start was interrupted before reaching Codex");
+            }
             await this.client.request("turn/start", turnStart.params, TURN_START_TIMEOUT_MS);
             return { turnId };
         }
@@ -3109,6 +3127,12 @@ export class CodexAppServerAgentSession {
             this.activeClientMessageId = null;
             throw error;
         }
+        finally {
+            if (this.pendingForegroundStart === pendingStart) {
+                this.pendingForegroundStart = null;
+            }
+            pendingStart.resolve();
+        }
     }
     async steerActiveTurn(prompt, options) {
         const client = this.client;
@@ -3518,7 +3542,17 @@ export class CodexAppServerAgentSession {
         });
     }
     async interrupt() {
+        const pendingStart = this.pendingForegroundStart;
+        if (pendingStart) {
+            pendingStart.cancelRequested = true;
+            await pendingStart.promise;
+        }
         if (!this.client || !this.currentThreadId) {
+            if (!this.activeForegroundTurnId &&
+                !this.currentTurnId &&
+                !this.pendingForegroundTurnIdentification) {
+                return;
+            }
             throw new Error("Cannot interrupt Codex before the active thread is initialized");
         }
         let turnId = this.currentTurnId;
@@ -3531,13 +3565,28 @@ export class CodexAppServerAgentSession {
             pendingIdentification?.foregroundTurnId === foregroundTurnId) {
             turnId = await pendingIdentification.promise;
         }
+        if (!turnId && !this.activeForegroundTurnId && !this.currentTurnId) {
+            return;
+        }
         if (!turnId || (foregroundTurnId && this.activeForegroundTurnId !== foregroundTurnId)) {
             throw new Error("Cannot interrupt Codex before turn/started identifies the active turn");
         }
-        await this.client.request("turn/interrupt", {
-            threadId: this.currentThreadId,
-            turnId,
-        }, INTERRUPT_TIMEOUT_MS);
+        try {
+            await this.client.request("turn/interrupt", {
+                threadId: this.currentThreadId,
+                turnId,
+            }, INTERRUPT_TIMEOUT_MS);
+        }
+        catch (error) {
+            if (!isCodexAlreadyIdleInterrupt(error)) {
+                throw error;
+            }
+            this.activeForegroundTurnId = null;
+            this.activeClientMessageId = null;
+            this.currentTurnId = null;
+            this.pendingForegroundTurnIdentification?.resolve(null);
+            this.pendingForegroundTurnIdentification = null;
+        }
     }
     async close() {
         this.closed = true;

package/dist/server/services/quota-fetcher/providers/claude.d.ts

@@ -31,8 +31,6 @@ export declare class ClaudeQuotaProvider implements ProviderUsageFetcher {
     private scopedLimitsFromResponse;
     private readCredentials;
     private callClaudeApi;
-    private refreshClaudeToken;
-    private saveClaudeCredentials;
 }
 export {};
 //# sourceMappingURL=claude.d.ts.map

package/dist/server/services/quota-fetcher/providers/claude.js

@@ -8,7 +8,6 @@ import { ApiNumberSchema, fetchProviderApi, toneFromUsedPct, unavailableUsage, w
 const execFileAsync = promisify(execFile);
 const CLAUDE_KEYCHAIN_TIMEOUT_MS = 2000;
 const CLAUDE_OAUTH_BETA = "oauth-2025-04-20";
-const CLAUDE_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
 const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 const ClaudeCredentialsSchema = z.object({
     claudeAiOauth: z
@@ -51,10 +50,6 @@ const ClaudeUsageResponseSchema = z.object({
     })
         .nullish(),
 });
-const ClaudeTokenRefreshSchema = z.object({
-    access_token: z.string().optional(),
-    refresh_token: z.string().optional(),
-});
 const SCOPED_WEEKLY_KIND = "weekly_scoped";
 function buildClaudePlan(subscriptionType, rateLimitTier) {
     if (!subscriptionType)
@@ -270,26 +265,12 @@ export class ClaudeQuotaProvider {
         if (!credentials) {
             return unavailableUsage(this);
         }
-        const { oauth, filePath } = credentials;
+        const { oauth } = credentials;
         const plan = buildClaudePlan(oauth.subscriptionType, oauth.rateLimitTier);
-        let resp = await this.callClaudeApi(oauth.accessToken);
+        const resp = await this.callClaudeApi(oauth.accessToken);
         if (resp === "NEEDS_AUTH") {
-            if (!filePath || !oauth.refreshToken) {
-                return unavailableUsage(this);
-            }
-            const refreshed = await this.refreshClaudeToken(oauth.refreshToken);
-            if (!refreshed?.access_token) {
-                return unavailableUsage(this);
-            }
-            await this.saveClaudeCredentials(filePath, {
-                ...oauth,
-                accessToken: refreshed.access_token,
-                refreshToken: refreshed.refresh_token ?? oauth.refreshToken,
-            });
-            resp = await this.callClaudeApi(refreshed.access_token);
-            if (resp === "NEEDS_AUTH") {
-                return unavailableUsage(this);
-            }
+            // Read-only on credentials; the Claude CLI owns refresh. See docs/providers.md.
+            return unavailableUsage(this);
         }
         const scoped = reconcileScopedLimits(legacyScopedLimits(resp), this.scopedLimitsFromResponse(resp.limits));
         const windows = [...unscopedWindows(resp), ...scopedWindows(scoped)];
@@ -353,7 +334,7 @@ export class ClaudeQuotaProvider {
                 const creds = ClaudeCredentialsSchema.parse(JSON.parse(await fs.readFile(credPath, "utf8")));
                 const oauth = creds.claudeAiOauth;
                 if (oauth?.accessToken) {
-                    return { oauth: { ...oauth, accessToken: oauth.accessToken }, filePath: credPath };
+                    return { oauth: { ...oauth, accessToken: oauth.accessToken } };
                 }
             }
             catch {
@@ -364,7 +345,7 @@ export class ClaudeQuotaProvider {
             const creds = ClaudeCredentialsSchema.safeParse(await this.readKeychainCredentials());
             const oauth = creds.success ? creds.data.claudeAiOauth : undefined;
             if (oauth?.accessToken) {
-                return { oauth: { ...oauth, accessToken: oauth.accessToken }, filePath: null };
+                return { oauth: { ...oauth, accessToken: oauth.accessToken } };
             }
         }
         return null;
@@ -383,30 +364,5 @@ export class ClaudeQuotaProvider {
             throw new Error(`Claude usage API returned ${res.status}`);
         return ClaudeUsageResponseSchema.parse(await res.json());
     }
-    async refreshClaudeToken(refreshToken) {
-        const res = await fetchProviderApi(this.fetchApi, "https://platform.claude.com/v1/oauth/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                grant_type: "refresh_token",
-                refresh_token: refreshToken,
-                client_id: CLAUDE_CLIENT_ID,
-                scope: "user:profile user:inference user:sessions:claude_code user:mcp_servers",
-            }),
-        });
-        if (!res.ok)
-            return null;
-        return ClaudeTokenRefreshSchema.parse(await res.json());
-    }
-    async saveClaudeCredentials(credPath, oauth) {
-        try {
-            const existing = ClaudeCredentialsSchema.parse(JSON.parse(await fs.readFile(credPath, "utf8")));
-            existing.claudeAiOauth = oauth;
-            await fs.writeFile(credPath, JSON.stringify(existing, null, 2), { mode: 0o600 });
-        }
-        catch {
-            // Non-fatal; Claude Code can refresh again on its own next time.
-        }
-    }
 }
 //# sourceMappingURL=claude.js.map

package/dist/server/services/quota-fetcher/providers/codex.d.ts

@@ -16,8 +16,6 @@ export declare class CodexQuotaProvider implements ProviderUsageFetcher {
     private toUsage;
     private readCodexAuth;
     private callCodexApi;
-    private refreshCodexToken;
-    private saveCodexAuth;
 }
 export {};
 //# sourceMappingURL=codex.d.ts.map

package/dist/server/services/quota-fetcher/providers/codex.js

@@ -3,7 +3,6 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
 import { ApiNumberSchema, balanceToneFromRemaining, toneFromUsedPct, fetchProviderApi, unavailableUsage, windowFromUsedPct, } from "../usage.js";
-const CODEX_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const CodexAuthSchema = z.object({
     tokens: z
         .object({
@@ -39,10 +38,6 @@ const CodexUsageResponseSchema = z.object({
     })
         .nullish(),
 });
-const CodexTokenRefreshSchema = z.object({
-    access_token: z.string().optional(),
-    refresh_token: z.string().optional(),
-});
 function codexWindow(window) {
     if (!window)
         return null;
@@ -59,27 +54,16 @@ export class CodexQuotaProvider {
         this.fetchApi = options.fetch ?? fetch;
     }
     async fetchUsage() {
-        const authRecord = await this.readCodexAuth();
-        const auth = authRecord?.auth;
+        const auth = await this.readCodexAuth();
         const accessToken = auth?.tokens?.access_token;
-        if (!authRecord || !auth || !accessToken) {
+        if (!auth || !accessToken) {
             return unavailableUsage(this);
         }
-        const { refresh_token, account_id } = auth.tokens ?? {};
-        let resp = await this.callCodexApi(accessToken, account_id);
+        const { account_id } = auth.tokens ?? {};
+        const resp = await this.callCodexApi(accessToken, account_id);
         if (resp === "NEEDS_AUTH") {
-            if (!refresh_token) {
-                return unavailableUsage(this);
-            }
-            const refreshed = await this.refreshCodexToken(refresh_token);
-            if (!refreshed?.access_token) {
-                return unavailableUsage(this);
-            }
-            await this.saveCodexAuth(authRecord.path, auth, refreshed);
-            resp = await this.callCodexApi(refreshed.access_token, account_id);
-            if (resp === "NEEDS_AUTH") {
-                return unavailableUsage(this);
-            }
+            // Read-only on credentials; the Codex CLI owns refresh. See docs/providers.md.
+            return unavailableUsage(this);
         }
         return this.toUsage(resp);
     }
@@ -148,7 +132,7 @@ export class CodexQuotaProvider {
             try {
                 const auth = CodexAuthSchema.parse(JSON.parse(await fs.readFile(path, "utf8")));
                 if (auth.tokens?.access_token)
-                    return { auth, path };
+                    return auth;
             }
             catch {
                 continue;
@@ -176,36 +160,5 @@ export class CodexQuotaProvider {
             return "NEEDS_AUTH";
         return CodexUsageResponseSchema.parse(JSON.parse(text));
     }
-    async refreshCodexToken(refreshToken) {
-        const params = new URLSearchParams({
-            grant_type: "refresh_token",
-            client_id: CODEX_CLIENT_ID,
-            refresh_token: refreshToken,
-        });
-        const res = await fetchProviderApi(this.fetchApi, "https://auth.openai.com/oauth/token", {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body: params.toString(),
-        });
-        if (!res.ok)
-            return null;
-        return CodexTokenRefreshSchema.parse(await res.json());
-    }
-    async saveCodexAuth(authPath, original, refreshed) {
-        try {
-            const updated = {
-                ...original,
-                tokens: {
-                    ...original.tokens,
-                    access_token: refreshed.access_token ?? original.tokens?.access_token,
-                    refresh_token: refreshed.refresh_token ?? original.tokens?.refresh_token,
-                },
-            };
-            await fs.writeFile(authPath, JSON.stringify(updated, null, 2), { mode: 0o600 });
-        }
-        catch {
-            // Non-fatal; the next call can refresh again.
-        }
-    }
 }
 //# sourceMappingURL=codex.js.map

package/dist/server/services/quota-fetcher/providers/kimi.d.ts

@@ -14,11 +14,7 @@ export declare class KimiQuotaProvider implements ProviderUsageFetcher {
     private readonly homeDir?;
     constructor(options: KimiQuotaProviderOptions);
     fetchUsage(): Promise<ProviderUsage>;
-    private fetchUsageResponse;
     private callUsageApi;
-    private refreshToken;
-    private saveRefreshedCredentials;
-    private credentialsUnchangedSince;
     private readCredentials;
     private credentialPaths;
     private readCredentialFile;

package/dist/server/services/quota-fetcher/providers/kimi.js

@@ -1,12 +1,9 @@
-import { randomUUID } from "node:crypto";
 import { existsSync, promises as fs } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { join } from "node:path";
 import { z } from "zod";
 import { ApiNumberSchema, ApiOptionalStringSchema, fetchProviderApi, toneFromUsedPct, unavailableUsage, windowFromUsedPct, } from "../usage.js";
-const KIMI_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const KIMI_USAGE_URL = "https://api.kimi.com/coding/v1/usages";
-const KIMI_TOKEN_URL = "https://auth.kimi.com/api/oauth/token";
 const KimiUsageFieldsSchema = z.object({
     limit: ApiOptionalStringSchema,
     used: ApiOptionalStringSchema,
@@ -191,13 +188,6 @@ const KimiAuthSchema = z
     token_type: z.string().nullish(),
 })
     .passthrough();
-const KimiTokenRefreshSchema = z.object({
-    access_token: z.string(),
-    refresh_token: z.string().nullish(),
-    expires_in: ApiNumberSchema.nullish(),
-    scope: z.string().nullish(),
-    token_type: z.string().nullish(),
-});
 export class KimiQuotaProvider {
     constructor(options) {
         this.providerId = "kimi";
@@ -210,8 +200,9 @@ export class KimiQuotaProvider {
         const credentials = await this.readCredentials();
         if (!credentials)
             return unavailableUsage(this);
-        const res = await this.fetchUsageResponse(credentials);
+        const res = await this.callUsageApi(credentials.access_token);
         if (!res.ok) {
+            // Read-only on credentials; the Kimi CLI owns refresh. See docs/providers.md.
             this.logger.debug({ status: res.status }, "Kimi usage fetch failed");
             return unavailableUsage(this);
         }
@@ -227,24 +218,6 @@ export class KimiQuotaProvider {
             error: null,
         };
     }
-    async fetchUsageResponse(record) {
-        const { credentials, filePath } = record;
-        const res = await this.callUsageApi(credentials.access_token);
-        if (res.status !== 401 || !filePath || !credentials.refresh_token)
-            return res;
-        const latest = await this.readCredentialFile(filePath);
-        const retried = latest?.access_token && latest.access_token !== credentials.access_token
-            ? await this.callUsageApi(latest.access_token)
-            : res;
-        if (retried.status !== 401)
-            return retried;
-        const refreshTokenUsed = latest?.refresh_token ?? credentials.refresh_token;
-        const refreshed = await this.refreshToken(refreshTokenUsed);
-        if (!refreshed)
-            return retried;
-        await this.saveRefreshedCredentials({ filePath, refreshTokenUsed, refreshed });
-        return this.callUsageApi(refreshed.access_token);
-    }
     async callUsageApi(token) {
         return fetchProviderApi(this.fetchApi, KIMI_USAGE_URL, {
             headers: {
@@ -253,82 +226,15 @@ export class KimiQuotaProvider {
             },
         });
     }
-    async refreshToken(refreshToken) {
-        const body = new URLSearchParams({
-            client_id: KIMI_CLIENT_ID,
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-        });
-        const res = await fetchProviderApi(this.fetchApi, KIMI_TOKEN_URL, {
-            method: "POST",
-            headers: { "Content-Type": "application/x-www-form-urlencoded" },
-            body,
-        });
-        if (!res.ok) {
-            this.logger.debug({ status: res.status }, "Kimi token refresh failed");
-            return null;
-        }
-        const parsed = KimiTokenRefreshSchema.safeParse(await res.json());
-        return parsed.success ? parsed.data : null;
-    }
-    async saveRefreshedCredentials(options) {
-        const { filePath, refreshTokenUsed, refreshed } = options;
-        const existing = await this.readCredentialFile(filePath);
-        if (!existing)
-            return;
-        // The Kimi CLI owns this file too. If its refresh token no longer matches the one we
-        // just spent, the CLI rotated the credentials while our refresh was in flight and its
-        // copy is newer than ours — writing our merge would strand the CLI on dead tokens.
-        if (existing.refresh_token !== refreshTokenUsed) {
-            this.logger.debug("Kimi credentials rotated during refresh; keeping the file on disk");
-            return;
-        }
-        const expiresIn = refreshed.expires_in ?? existing.expires_in;
-        const merged = {
-            ...existing,
-            access_token: refreshed.access_token,
-            refresh_token: refreshed.refresh_token ?? existing.refresh_token,
-            expires_in: expiresIn,
-            expires_at: expiresIn == null ? existing.expires_at : Math.floor(Date.now() / 1000) + expiresIn,
-            scope: refreshed.scope ?? existing.scope,
-            token_type: refreshed.token_type ?? existing.token_type,
-        };
-        const tempPath = join(dirname(filePath), `.${basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
-        try {
-            await fs.writeFile(tempPath, JSON.stringify(merged, null, 2), { mode: 0o600 });
-            // writeFile above is async I/O that gives the CLI a window to rotate the file on
-            // its own. Re-read right before the rename and confirm nothing changed since the
-            // guard above — the check-then-write gap this closes is what the file-level guard
-            // couldn't cover, since it ran before the write, not right before the replace.
-            const beforeRename = await this.readCredentialFile(filePath);
-            if (!this.credentialsUnchangedSince(existing, beforeRename)) {
-                this.logger.debug("Kimi credentials rotated during refresh; discarding stale merge");
-                await fs.rm(tempPath, { force: true }).catch(() => undefined);
-                return;
-            }
-            await fs.rename(tempPath, filePath);
-        }
-        catch (error) {
-            this.logger.warn({ err: error }, "Failed to persist refreshed Kimi credentials");
-            await fs.rm(tempPath, { force: true }).catch(() => undefined);
-        }
-    }
-    credentialsUnchangedSince(baseline, candidate) {
-        return (candidate?.access_token === baseline.access_token &&
-            candidate?.refresh_token === baseline.refresh_token);
-    }
     async readCredentials() {
         const environmentToken = process.env["KIMI_TOKEN"] || process.env["KIMI_API_KEY"];
         if (environmentToken) {
-            return { credentials: { access_token: environmentToken }, filePath: null };
+            return { access_token: environmentToken };
         }
         for (const path of this.credentialPaths()) {
             const credentials = await this.readCredentialFile(path);
             if (credentials?.access_token) {
-                return {
-                    credentials: { ...credentials, access_token: credentials.access_token },
-                    filePath: path,
-                };
+                return { ...credentials, access_token: credentials.access_token };
             }
         }
         return null;

package/dist/server/web-ui/_expo/static/js/web/{desktop-attachment-bridge-28615b837fff299849f3363652b95f0f.js → desktop-attachment-bridge-d452c6e787c8d41aa2e1cfafbb6e477b.js}

@@ -1 +1 @@
-__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.createDesktopAttachmentBridge=function(){const l=(0,s.createDesktopPreviewUrlResolver)({reader:(0,s.createDesktopFileReader)(),objectUrls:(0,s.createBrowserObjectUrlMinter)()});return{copyFile:t.copyDesktopAttachmentFile,writeBase64:t.writeDesktopAttachmentBase64,writeBytes:t.writeDesktopAttachmentBytes,deleteFile:t.deleteDesktopAttachmentFile,garbageCollect:t.garbageCollectDesktopAttachmentFiles,readFileBase64:s.readDesktopFileBase64,resolvePreviewUrl:t=>l.resolve(t),releasePreviewUrl:t=>l.release(t)}};var t=r(d[0]),s=r(d[1])},4941,[4284,4285]);
+__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.createDesktopAttachmentBridge=function(){const l=(0,s.createDesktopPreviewUrlResolver)({reader:(0,s.createDesktopFileReader)(),objectUrls:(0,s.createBrowserObjectUrlMinter)()});return{copyFile:t.copyDesktopAttachmentFile,writeBase64:t.writeDesktopAttachmentBase64,writeBytes:t.writeDesktopAttachmentBytes,deleteFile:t.deleteDesktopAttachmentFile,garbageCollect:t.garbageCollectDesktopAttachmentFiles,readFileBase64:s.readDesktopFileBase64,resolvePreviewUrl:t=>l.resolve(t),releasePreviewUrl:t=>l.release(t)}};var t=r(d[0]),s=r(d[1])},4943,[4284,4285]);

package/dist/server/web-ui/_expo/static/js/web/{desktop-attachment-store-99d20cdd7788af37bc5fbd91e0bb49e6.js → desktop-attachment-store-4804f15e0899aeb03f110d60408577f6.js}

@@ -1 +1 @@
-__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.createDesktopAttachmentStore=function(n){return{storageType:"desktop-file",async save(s){const o=s.id??(0,t.generateAttachmentId)(),l=s.fileName??null;if("file_uri"===s.source.kind)return await c(n,{id:o,uri:s.source.uri,mimeType:s.mimeType,fileName:l});if("data_url"===s.source.kind){const c=(0,t.parseDataUrl)(s.source.dataUrl),p=(0,t.normalizeMimeType)(s.mimeType??c.mimeType);return await y(n,{id:o,base64:c.base64,mimeType:p,fileName:l})}if("bytes"===s.source.kind){const c=(0,t.normalizeMimeType)(s.mimeType);return await p(n,{id:o,bytes:s.source.bytes,mimeType:c,fileName:l})}const f=(0,t.normalizeMimeType)(s.mimeType??s.source.blob.type),u=await(0,t.blobToBase64)(s.source.blob);return await y(n,{id:o,base64:u,mimeType:f,fileName:l})},encodeBase64:async({attachment:t})=>(f(t),await n.readFileBase64(t.storageKey)),resolvePreviewUrl:async({attachment:t})=>(f(t),await n.resolvePreviewUrl(t)),async releasePreviewUrl({attachment:t,url:s}){f(t),await n.releasePreviewUrl({url:s})},async delete({attachment:t}){f(t),await n.deleteFile({path:t.storageKey})},async garbageCollect({referencedIds:t}){await n.garbageCollect({referencedIds:Array.from(t)})}}};var t=r(d[0]);const n={"image/png":".png","image/jpeg":".jpg","image/jpg":".jpg","image/gif":".gif","image/webp":".webp","image/avif":".avif","image/heic":".heic","image/heif":".heif","image/tiff":".tiff","image/bmp":".bmp","image/svg+xml":".svg"};function s(t){const n=t.replace(/\\/g,"/").split("/"),s=n[n.length-1];return s&&s.length>0?s:null}function o(s){const o=(0,t.getFileExtensionFromName)(s.fileName);if(o)return o;const l=(0,t.getFileExtensionFromName)(s.sourcePath);return l||(n[s.mimeType]??".img")}function l(t){return{id:t.id,mimeType:t.mimeType,storageType:"desktop-file",storageKey:t.storagePath,fileName:t.fileName??null,byteSize:t.byteSize,createdAt:Date.now()}}async function c(n,c){const y=(0,t.fileUriToPath)(c.uri),p=c.fileName??s(y),f=(0,t.normalizeMimeType)(c.mimeType),u=o({fileName:p,sourcePath:y,mimeType:f}),T=await n.copyFile({attachmentId:c.id,sourcePath:y,extension:u});return l({id:c.id,mimeType:f,storagePath:T.path,byteSize:T.byteSize,fileName:p})}async function y(t,n){const s=o({fileName:n.fileName,mimeType:n.mimeType}),c=await t.writeBase64({attachmentId:n.id,base64:n.base64,extension:s});return l({id:n.id,mimeType:n.mimeType,storagePath:c.path,byteSize:c.byteSize,fileName:n.fileName})}async function p(t,n){const s=o({fileName:n.fileName,mimeType:n.mimeType}),c=await t.writeBytes({attachmentId:n.id,bytes:n.bytes,extension:s});return l({id:n.id,mimeType:n.mimeType,storagePath:c.path,byteSize:c.byteSize,fileName:n.fileName})}function f(t){if("desktop-file"!==t.storageType)throw new Error(`Unsupported desktop attachment storage type '${t.storageType}'.`)}},4940,[4278]);
+__d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0}),e.createDesktopAttachmentStore=function(n){return{storageType:"desktop-file",async save(s){const o=s.id??(0,t.generateAttachmentId)(),l=s.fileName??null;if("file_uri"===s.source.kind)return await c(n,{id:o,uri:s.source.uri,mimeType:s.mimeType,fileName:l});if("data_url"===s.source.kind){const c=(0,t.parseDataUrl)(s.source.dataUrl),p=(0,t.normalizeMimeType)(s.mimeType??c.mimeType);return await y(n,{id:o,base64:c.base64,mimeType:p,fileName:l})}if("bytes"===s.source.kind){const c=(0,t.normalizeMimeType)(s.mimeType);return await p(n,{id:o,bytes:s.source.bytes,mimeType:c,fileName:l})}const f=(0,t.normalizeMimeType)(s.mimeType??s.source.blob.type),u=await(0,t.blobToBase64)(s.source.blob);return await y(n,{id:o,base64:u,mimeType:f,fileName:l})},encodeBase64:async({attachment:t})=>(f(t),await n.readFileBase64(t.storageKey)),resolvePreviewUrl:async({attachment:t})=>(f(t),await n.resolvePreviewUrl(t)),async releasePreviewUrl({attachment:t,url:s}){f(t),await n.releasePreviewUrl({url:s})},async delete({attachment:t}){f(t),await n.deleteFile({path:t.storageKey})},async garbageCollect({referencedIds:t}){await n.garbageCollect({referencedIds:Array.from(t)})}}};var t=r(d[0]);const n={"image/png":".png","image/jpeg":".jpg","image/jpg":".jpg","image/gif":".gif","image/webp":".webp","image/avif":".avif","image/heic":".heic","image/heif":".heif","image/tiff":".tiff","image/bmp":".bmp","image/svg+xml":".svg"};function s(t){const n=t.replace(/\\/g,"/").split("/"),s=n[n.length-1];return s&&s.length>0?s:null}function o(s){const o=(0,t.getFileExtensionFromName)(s.fileName);if(o)return o;const l=(0,t.getFileExtensionFromName)(s.sourcePath);return l||(n[s.mimeType]??".img")}function l(t){return{id:t.id,mimeType:t.mimeType,storageType:"desktop-file",storageKey:t.storagePath,fileName:t.fileName??null,byteSize:t.byteSize,createdAt:Date.now()}}async function c(n,c){const y=(0,t.fileUriToPath)(c.uri),p=c.fileName??s(y),f=(0,t.normalizeMimeType)(c.mimeType),u=o({fileName:p,sourcePath:y,mimeType:f}),T=await n.copyFile({attachmentId:c.id,sourcePath:y,extension:u});return l({id:c.id,mimeType:f,storagePath:T.path,byteSize:T.byteSize,fileName:p})}async function y(t,n){const s=o({fileName:n.fileName,mimeType:n.mimeType}),c=await t.writeBase64({attachmentId:n.id,base64:n.base64,extension:s});return l({id:n.id,mimeType:n.mimeType,storagePath:c.path,byteSize:c.byteSize,fileName:n.fileName})}async function p(t,n){const s=o({fileName:n.fileName,mimeType:n.mimeType}),c=await t.writeBytes({attachmentId:n.id,bytes:n.bytes,extension:s});return l({id:n.id,mimeType:n.mimeType,storagePath:c.path,byteSize:c.byteSize,fileName:n.fileName})}function f(t){if("desktop-file"!==t.storageType)throw new Error(`Unsupported desktop attachment storage type '${t.storageType}'.`)}},4942,[4278]);