@masons/agent-network 0.6.19 → 0.6.20

package/dist/channel-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-setup.d.ts","sourceRoot":"","sources":["../src/channel-setup.ts"],"names":[],"mappings":"AAgBA,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IAMnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuBD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,6BAA6B,IAAI,wBAAwB,CAKxE;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,GAAG,IAAI,CAejE;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,GAAG,IAAI,CAMrE;AAkED,wBAAgB,4BAA4B,IAAI,IAAI,CAGnD;AAED,eAAO,MAAM,oBAAoB,QAAqB,CAAC"}
+{"version":3,"file":"channel-setup.d.ts","sourceRoot":"","sources":["../src/channel-setup.ts"],"names":[],"mappings":"AAiBA,UAAU,wBAAwB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IAMnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuBD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,6BAA6B,IAAI,wBAAwB,CAKxE;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,GAAG,IAAI,CAejE;AAED,wBAAgB,yBAAyB,IAAI,kBAAkB,GAAG,IAAI,CAMrE;AAmED,wBAAgB,4BAA4B,IAAI,IAAI,CAGnD;AAED,eAAO,MAAM,oBAAoB,QAAqB,CAAC"}

package/dist/channel-setup.js

@@ -1,6 +1,7 @@
 import { readExistingConnectorUrl, writeCredentials, } from "./config.js";
 import { resolveConnectorUrlForSetup } from "./connector-url-boundary.js";
 import { beginBridgeHandoff, completeBridgeHandoff, DEFAULT_IDP_BASE_URL, HANDOFF_TIMEOUT_MS, SetupFlowError, } from "./handoff.js";
+import { assertHandoffDeadlineActive } from "./handoff-deadline.js";
 import { DEFAULT_API_HOST } from "./platform-client.js";
 let pendingSetup = null;
 let lastSetupStatus = null;
@@ -91,7 +92,7 @@ async function completePendingSetup(record) {
             connectorUrl: record.connectorUrl,
             token: handoff.token,
         };
-        await writeCredentials(creds, record.apiHost, record.idpBaseUrl, record.invitedBy);
+        await writeCredentials(creds, record.apiHost, record.idpBaseUrl, record.invitedBy, () => assertHandoffDeadlineActive(record.session.expiresAt));
         lastSetupStatus = {
             status: "completed",
             agentHandle: handoff.agent.handle,

package/dist/cli-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AAyFA,UAAU,eAAe;IACvB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAOD,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAgFD,wBAAsB,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmEhE"}
+{"version":3,"file":"cli-setup.d.ts","sourceRoot":"","sources":["../src/cli-setup.ts"],"names":[],"mappings":"AA0FA,UAAU,eAAe;IACvB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAOD,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAwFD,wBAAsB,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+EhE"}

package/dist/cli-setup.js

@@ -1,6 +1,7 @@
 import { readExistingConnectorUrl, writeCredentials } from "./config.js";
 import { ConnectorUrlConfigurationError, resolveConnectorUrlForSetup, } from "./connector-url-boundary.js";
 import { beginBridgeHandoff, completeBridgeHandoff, DEFAULT_IDP_BASE_URL, SetupFlowError, } from "./handoff.js";
+import { assertHandoffDeadlineActive } from "./handoff-deadline.js";
 import { DEFAULT_API_HOST, DEFAULT_CONNECTOR_URL, PlatformApiError, } from "./platform-client.js";
 async function serverBridgeHandoffFlow(apiHost, idpBaseUrl, runtime, channelInput) {
     const session = await beginBridgeHandoff({
@@ -16,16 +17,19 @@ async function serverBridgeHandoffFlow(apiHost, idpBaseUrl, runtime, channelInpu
         "Waiting for the runtime key to be issued and delivered…",
         "",
     ].join("\n"));
-    return completeBridgeHandoff(session);
+    return {
+        handoff: await completeBridgeHandoff(session),
+        expiresAt: session.expiresAt,
+    };
 }
 export async function login(ctx) {
     const apiHost = typeof ctx.cfg.apiHost === "string" ? ctx.cfg.apiHost : DEFAULT_API_HOST;
     const idpBaseUrl = typeof ctx.cfg.idpBaseUrl === "string"
         ? ctx.cfg.idpBaseUrl
         : DEFAULT_IDP_BASE_URL;
-    let handoff;
+    let completed;
     try {
-        handoff = await serverBridgeHandoffFlow(apiHost, idpBaseUrl, ctx.runtime, ctx.channelInput);
+        completed = await serverBridgeHandoffFlow(apiHost, idpBaseUrl, ctx.runtime, ctx.channelInput);
     }
     catch (err) {
         if (err instanceof SetupFlowError) {
@@ -38,6 +42,7 @@ export async function login(ctx) {
         }
         throw err;
     }
+    const { handoff } = completed;
     const existingConnectorUrl = await readExistingConnectorUrl();
     const configuredConnectorUrl = typeof ctx.cfg.connectorUrl === "string" ? ctx.cfg.connectorUrl : undefined;
     let connectorUrl;
@@ -56,6 +61,15 @@ export async function login(ctx) {
         }
         throw err;
     }
-    await writeCredentials({ connectorUrl, token: handoff.token }, apiHost, idpBaseUrl);
+    try {
+        await writeCredentials({ connectorUrl, token: handoff.token }, apiHost, idpBaseUrl, undefined, () => assertHandoffDeadlineActive(completed.expiresAt));
+    }
+    catch (err) {
+        if (err instanceof SetupFlowError) {
+            ctx.runtime.error(err.message);
+            return;
+        }
+        throw err;
+    }
     ctx.runtime.log(`✓ Connected as @${handoff.agent.handle}`);
 }

package/dist/config-fs.d.ts

@@ -1,4 +1,4 @@
 export declare function getOpenClawHome(): string;
 export declare function readConfig(): Promise<Record<string, unknown>>;
-export declare function persistConfig(config: Record<string, unknown>): Promise<void>;
+export declare function persistConfig(config: Record<string, unknown>, assertCanPersist?: () => void): Promise<void>;
 //# sourceMappingURL=config-fs.d.ts.map

package/dist/config-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-fs.d.ts","sourceRoot":"","sources":["../src/config-fs.ts"],"names":[],"mappings":"AAKA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAMD,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOnE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"config-fs.d.ts","sourceRoot":"","sources":["../src/config-fs.ts"],"names":[],"mappings":"AAKA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAMD,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOnE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,gBAAgB,CAAC,EAAE,MAAM,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/config-fs.js

@@ -16,8 +16,9 @@ export async function readConfig() {
         return {};
     }
 }
-export async function persistConfig(config) {
+export async function persistConfig(config, assertCanPersist) {
     const configPath = getConfigPath();
     await mkdir(dirname(configPath), { recursive: true });
+    assertCanPersist?.();
     await writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
 }

package/dist/config.d.ts

@@ -26,7 +26,7 @@ export interface NetworkCredentials {
     token: string;
 }
 export declare function readExistingConnectorUrl(): Promise<string | undefined>;
-export declare function writeCredentials(creds: NetworkCredentials, apiHost?: string, idpBaseUrl?: string, pendingTarget?: string): Promise<void>;
+export declare function writeCredentials(creds: NetworkCredentials, apiHost?: string, idpBaseUrl?: string, pendingTarget?: string, assertCanPersist?: () => void): Promise<void>;
 export declare function writeTargetHandle(handle: string): Promise<void>;
 export declare function clearTargetHandle(): Promise<void>;
 export declare function markProfileNeeded(): Promise<void>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAoCjD,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAsBD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhC;AAYD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyCjE;AAuCD,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAWD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAeD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAOjE;AAQD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAYD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAE1E;AASD,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAKD,wBAAgB,0BAA0B,IAAI,mBAAmB,CAOhE;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAEnE;AAgBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAExD;AAKD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAQD,wBAAgB,oBAAoB,IAAI,OAAO,CAO9C;AAcD,wBAAgB,qBAAqB,IAAI,oBAAoB,CAE5D;AAKD,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAKD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AASD,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AASD,wBAAgB,sBAAsB,IAAI,eAAe,CAOxD;AAyBD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW5E;AAmBD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAUD,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrE;AASD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD;AAYD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAUD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD;AAwCD,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAQD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1E;AAOD,MAAM,WAAW,YAAY;IAE3B,cAAc,EAAE,OAAO,CAAC;IAExB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,YAAY,EAAE,OAAO,CAAC;CACvB;AASD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA2BhE;AAOD,wBAAgB,gBAAgB,IAAI,IAAI,CAWvC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAoCjD,wBAAgB,uBAAuB,IAAI,MAAM,CAEhD;AAsBD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhC;AAYD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAyCjE;AAuCD,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAWD,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAeD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAOjE;AAQD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAYD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAE1E;AASD,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAKD,wBAAgB,0BAA0B,IAAI,mBAAmB,CAOhE;AASD,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,IAAI,CAEnE;AAgBD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAExD;AAKD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAQD,wBAAgB,oBAAoB,IAAI,OAAO,CAO9C;AAcD,wBAAgB,qBAAqB,IAAI,oBAAoB,CAE5D;AAKD,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAKD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AASD,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AASD,wBAAgB,sBAAsB,IAAI,eAAe,CAOxD;AAyBD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAQD,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW5E;AAoBD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAUD,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrE;AASD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CASvD;AAYD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOvD;AAUD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAOzD;AAwCD,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAQD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1E;AAOD,MAAM,WAAW,YAAY;IAE3B,cAAc,EAAE,OAAO,CAAC;IAExB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAE7B,YAAY,EAAE,OAAO,CAAC;CACvB;AASD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA2BhE;AAOD,wBAAgB,gBAAgB,IAAI,IAAI,CAWvC"}

package/dist/config.js

@@ -141,7 +141,7 @@ export async function readExistingConnectorUrl() {
         ? connectorUrl
         : undefined;
 }
-export async function writeCredentials(creds, apiHost, idpBaseUrl, pendingTarget) {
+export async function writeCredentials(creds, apiHost, idpBaseUrl, pendingTarget, assertCanPersist) {
     const config = await readConfig();
     const section = ensureNetworkSection(config);
     section.enabled = true;
@@ -163,7 +163,7 @@ export async function writeCredentials(creds, apiHost, idpBaseUrl, pendingTarget
     if (pendingTarget) {
         section.pendingTarget = pendingTarget;
     }
-    await persistConfig(config);
+    await persistConfig(config, assertCanPersist);
     storedApiKey = creds.token;
     if (pendingTarget) {
         storedPendingTarget = pendingTarget;

package/dist/handoff-deadline.d.ts

@@ -0,0 +1,4 @@
+export declare class SetupFlowError extends Error {
+}
+export declare function assertHandoffDeadlineActive(expiresAt: number): void;
+//# sourceMappingURL=handoff-deadline.d.ts.map

package/dist/handoff-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff-deadline.d.ts","sourceRoot":"","sources":["../src/handoff-deadline.ts"],"names":[],"mappings":"AAAA,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAG5C,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAMnE"}

package/dist/handoff-deadline.js

@@ -0,0 +1,7 @@
+export class SetupFlowError extends Error {
+}
+export function assertHandoffDeadlineActive(expiresAt) {
+    if (Date.now() >= expiresAt) {
+        throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run setup.");
+    }
+}

package/dist/handoff.d.ts

@@ -1,8 +1,7 @@
 import { type KeyObject } from "node:crypto";
+export { SetupFlowError } from "./handoff-deadline.js";
 export declare const DEFAULT_IDP_BASE_URL = "https://preview.masons.ai";
 export declare const HANDOFF_TIMEOUT_MS: number;
-export declare class SetupFlowError extends Error {
-}
 export interface BridgeHandoffResult {
     token: string;
     agent: {

package/dist/handoff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAerB,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAiBhE,eAAO,MAAM,kBAAkB,QAAgB,CAAC;AAKhD,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAY5C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAQD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAOhB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAsD/B;AAKD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAmC9B"}
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAavD,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAiBhE,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AAejD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAQD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAOhB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAsD/B;AAKD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAwC9B"}

package/dist/handoff.js

@@ -1,11 +1,11 @@
 import { createDecipheriv, constants as cryptoConstants, generateKeyPairSync, privateDecrypt, } from "node:crypto";
+import { assertHandoffDeadlineActive, SetupFlowError, } from "./handoff-deadline.js";
 import { apiFetch, PlatformNetworkError } from "./platform-client.js";
+export { SetupFlowError } from "./handoff-deadline.js";
 export const DEFAULT_IDP_BASE_URL = "https://preview.masons.ai";
 const HANDLE_REGEX = /^[a-z][a-z0-9_-]{2,14}$/;
-export const HANDOFF_TIMEOUT_MS = 5 * 60 * 1000;
+export const HANDOFF_TIMEOUT_MS = 10 * 60 * 1000;
 const HANDOFF_POLL_INTERVAL_MS = 2000;
-export class SetupFlowError extends Error {
-}
 export async function beginBridgeHandoff(options) {
     const { publicKey, privateKey } = generateKeyPairSync("rsa", {
         modulusLength: 2048,
@@ -53,7 +53,7 @@ export async function beginBridgeHandoff(options) {
     };
 }
 export async function completeBridgeHandoff(session) {
-    const envelope = await pollForCompletion(session.apiBase, session.sessionId);
+    const envelope = await pollForCompletion(session.apiBase, session.sessionId, session.expiresAt);
     let payload;
     try {
         payload = decryptBridgeEnvelope(session.privateKey, envelope);
@@ -62,6 +62,7 @@ export async function completeBridgeHandoff(session) {
         const message = err instanceof Error ? err.message : "unknown error";
         throw new SetupFlowError(`Handoff received but could not be decrypted (${message}). The link may have been tampered with — re-run setup. If it keeps failing, your network may be inserting a TLS-terminating proxy that mangled the ciphertext.`);
     }
+    assertHandoffDeadlineActive(session.expiresAt);
     if (typeof payload.token !== "string" ||
         !payload.token.startsWith("masons_rt_v1_") ||
         typeof payload.agent?.handle !== "string" ||
@@ -79,10 +80,9 @@ export async function completeBridgeHandoff(session) {
         },
     };
 }
-async function pollForCompletion(apiBase, sessionId) {
-    const start = Date.now();
+async function pollForCompletion(apiBase, sessionId, expiresAt) {
     let lastNetworkError;
-    while (Date.now() - start < HANDOFF_TIMEOUT_MS) {
+    while (Date.now() < expiresAt) {
         let res;
         try {
             res = await apiFetch(`${apiBase}/v1/cli-handoff/${encodeURIComponent(sessionId)}/poll`, { method: "GET" });
@@ -90,28 +90,38 @@ async function pollForCompletion(apiBase, sessionId) {
         catch (err) {
             if (err instanceof PlatformNetworkError) {
                 lastNetworkError = err;
-                await sleep(HANDOFF_POLL_INTERVAL_MS);
+                await sleepBeforeNextPoll(expiresAt);
                 continue;
             }
             throw err;
         }
+        if (Date.now() >= expiresAt)
+            break;
         if (res.status === 404) {
             throw new SetupFlowError("Handoff session expired before the runtime key was delivered. Re-run setup.");
         }
         if (!res.ok) {
-            await sleep(HANDOFF_POLL_INTERVAL_MS);
+            await sleepBeforeNextPoll(expiresAt);
             continue;
         }
         const body = (await res.json());
+        if (Date.now() >= expiresAt)
+            break;
         if (body.status === "completed" && body.payload) {
             return body.payload;
         }
-        await sleep(HANDOFF_POLL_INTERVAL_MS);
+        await sleepBeforeNextPoll(expiresAt);
     }
     throw new SetupFlowError(lastNetworkError
         ? `Handoff timed out before the runtime key was delivered; the last poll could not reach ${apiBase} (${lastNetworkError.message}). Re-run setup; if you're behind a proxy that blocks long-running fetches, retry on a different network.`
         : "Handoff timed out before the runtime key was delivered. Re-run setup; if you're behind a proxy that blocks long-running fetches, retry on a different network.");
 }
+async function sleepBeforeNextPoll(expiresAt) {
+    const remainingMs = expiresAt - Date.now();
+    if (remainingMs <= 0)
+        return;
+    await sleep(Math.min(HANDOFF_POLL_INTERVAL_MS, remainingMs));
+}
 function decryptBridgeEnvelope(privateKey, envelope) {
     const wrappedKey = Buffer.from(envelope.wrapped_key, "base64url");
     const iv = Buffer.from(envelope.iv, "base64url");

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const PLUGIN_VERSION = "0.6.19";
+export declare const PLUGIN_VERSION = "0.6.20";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1 +1 @@
-export const PLUGIN_VERSION = "0.6.19";
+export const PLUGIN_VERSION = "0.6.20";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@masons/agent-network",
-  "version": "0.6.19",
+  "version": "0.6.20",
   "description": "MASONS Agent Network — OpenClaw channel plugin for connecting agent runtimes to the Agent Network over MSTP.",
   "license": "MIT",
   "author": "MASONS.ai <hello@masons.ai> (https://masons.ai)",