@mindexec/cli 0.2.151 → 0.2.152

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.151",
+  "version": "0.2.152",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/scripts/remote-registry-follower-smoke.mjs

@@ -83,10 +83,17 @@ function createRegistryTarget({ endpoint, endpointCandidates, leaseId, active =
     };
 }
 
-function startFakeSupabase(getTarget) {
+function startFakeSupabase(getTarget, setTarget = null) {
     const requests = [];
     const realtimeClients = new Set();
-    const server = createServer((req, res) => {
+    const server = createServer(async (req, res) => {
+        const readBody = () => new Promise(resolve => {
+            let body = '';
+            req.on('data', chunk => {
+                body += chunk.toString();
+            });
+            req.on('end', () => resolve(body));
+        });
         const parsed = new URL(req.url || '/', 'http://127.0.0.1');
         requests.push({
             method: req.method,
@@ -107,6 +114,40 @@ function startFakeSupabase(getTarget) {
             return;
         }
 
+        if (req.method === 'POST' && parsed.pathname === '/rest/v1/rpc/set_remote_host_target') {
+            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            const body = JSON.parse(await readBody() || '{}');
+            const now = Date.now();
+            const existing = getTarget();
+            const sameLease = existing
+                && String(existing.lease_id || '') === String(body.p_lease_id || '')
+                && String(existing.host_instance_id || '') === String(body.p_host_instance_id || '');
+            const expired = !existing?.expires_at || Date.parse(existing.expires_at) <= now;
+            if (existing?.active === true && !sameLease && !expired && body.p_takeover !== true) {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify([{ ok: false, reason: 'host-target-taken' }]));
+                return;
+            }
+
+            setTarget?.({
+                user_id: USER_ID,
+                active: true,
+                endpoint: String(body.p_endpoint || ''),
+                endpoint_candidates: Array.isArray(body.p_endpoint_candidates)
+                    ? body.p_endpoint_candidates
+                    : [String(body.p_endpoint || '')].filter(Boolean),
+                pair_token: String(body.p_pair_token || ''),
+                lease_id: String(body.p_lease_id || ''),
+                node_id: String(body.p_node_id || ''),
+                host_instance_id: String(body.p_host_instance_id || ''),
+                expires_at: String(body.p_expires_at || new Date(Date.now() + 60_000).toISOString())
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify([{ ok: true, reason: 'ok' }]));
+            return;
+        }
+
         res.writeHead(404, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'not-found' }));
     });
@@ -230,7 +271,7 @@ function startFakeSupabase(getTarget) {
     });
 }
 
-function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label, supabaseUrl = '', follower = false }) {
+function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label, supabaseUrl = '', follower = false, publicHost = '' }) {
     const child = spawn(process.execPath, ['server.js'], {
         cwd: LOCAL_BRIDGE_DIR,
         stdio: ['ignore', 'pipe', 'pipe'],
@@ -243,6 +284,7 @@ function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label
             MINDEXEC_REMOTE_HUB: '1',
             REMOTE_HUB_HOST: '127.0.0.1',
             REMOTE_HUB_PORT: String(remoteHubPort),
+            REMOTE_HUB_PUBLIC_HOST: publicHost,
             REMOTE_HUB_PAIR_TOKEN: PAIR_TOKEN,
             WORKSPACE_PATH: workspacePath,
             MINDEXEC_AUTH_DATA_ROOT: authRoot,
@@ -251,6 +293,7 @@ function spawnBridge({ bridgePort, remoteHubPort, workspacePath, authRoot, label
             MINDEXEC_REMOTE_REGISTRY_FAST_RETRY_MS: '250',
             MINDEXEC_REMOTE_REGISTRY_REALTIME_RECONNECT_MS: '250',
             MINDEXEC_REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS: '100',
+            MINDEXEC_REMOTE_HOST_TARGET_RENEW_MS: '5000',
             SUPABASE_URL: supabaseUrl,
             SUPABASE_KEY,
             NO_COLOR: '1'
@@ -353,10 +396,13 @@ function killProcess(pid) {
 async function main() {
     const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'mindexec-remote-registry-smoke-'));
     let fakeSupabase = null;
+    let renewHost = null;
     let hostA = null;
     let hostB = null;
     let client = null;
 
+    const renewHostBridgePort = await findFreePort();
+    const renewHostRemotePort = await findFreePort();
     const hostABridgePort = await findFreePort();
     const hostARemotePort = await findFreePort();
     const hostBBridgePort = await findFreePort();
@@ -364,23 +410,82 @@ async function main() {
     const clientBridgePort = await findFreePort();
     const clientRemotePort = await findFreePort();
     const stalePort = await findFreePort();
+    const renewPublicHost = '192.0.2.10';
+    const renewPublicEndpoint = `${renewPublicHost}:${renewHostRemotePort}`;
     const hostAEndpoint = `127.0.0.1:${hostARemotePort}`;
     const hostBEndpoint = `127.0.0.1:${hostBRemotePort}`;
     const staleEndpoint = `127.0.0.1:${stalePort}`;
-    let currentTarget = createRegistryTarget({
-        endpoint: hostAEndpoint,
-        endpointCandidates: [staleEndpoint, hostAEndpoint],
-        leaseId: 'lease-a'
-    });
+    let currentTarget = null;
 
     try {
-        fakeSupabase = await startFakeSupabase(() => currentTarget);
+        fakeSupabase = await startFakeSupabase(
+            () => currentTarget,
+            target => {
+                currentTarget = target;
+            });
 
+        const renewHostAuth = path.join(tempRoot, 'auth-renew-host');
         const hostAAuth = path.join(tempRoot, 'auth-host-a');
         const hostBAuth = path.join(tempRoot, 'auth-host-b');
         const clientAuth = path.join(tempRoot, 'auth-client');
+        await writeSession(renewHostAuth);
         await writeSession(clientAuth);
 
+        renewHost = spawnBridge({
+            bridgePort: renewHostBridgePort,
+            remoteHubPort: renewHostRemotePort,
+            workspacePath: path.join(tempRoot, 'renew-host'),
+            authRoot: renewHostAuth,
+            label: 'renew-host',
+            supabaseUrl: fakeSupabase.url,
+            follower: true,
+            publicHost: renewPublicHost
+        });
+        await waitForBridge(renewHost);
+
+        const renewSetHost = await fetchJson(`${renewHost.baseUrl}/api/remote/host-target`, {
+            method: 'POST',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({
+                nodeId: 'remote-registry-renew-node',
+                enabled: true,
+                leaseMs: 60000
+            })
+        });
+        assert.equal(renewSetHost.ok, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.ok, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.active, true, JSON.stringify(renewSetHost.payload));
+        assert.equal(renewSetHost.payload?.hostTargetRenew?.status, 'active', JSON.stringify(renewSetHost.payload?.hostTargetRenew));
+        assert.equal(currentTarget?.endpoint, renewPublicEndpoint, JSON.stringify(currentTarget));
+        assert.equal(currentTarget?.node_id, 'remote-registry-renew-node', JSON.stringify(currentTarget));
+        await waitFor(() => {
+            const publishCount = fakeSupabase.requests.filter(request =>
+                request.method === 'POST'
+                && request.pathname === '/rest/v1/rpc/set_remote_host_target').length;
+            return publishCount >= 2 ? publishCount : null;
+        }, 8000, `host-target auto renew publish\n${renewHost.details()}`);
+        const renewStatus = await fetchJson(`${renewHost.baseUrl}/api/status`);
+        assert.equal(renewStatus.payload?.remoteHostTargetRenew?.status, 'active', JSON.stringify(renewStatus.payload?.remoteHostTargetRenew));
+        assert.equal(renewStatus.payload?.remoteHostTargetRenew?.endpoint, renewPublicEndpoint, JSON.stringify(renewStatus.payload?.remoteHostTargetRenew));
+
+        const renewClear = await fetchJson(`${renewHost.baseUrl}/api/remote/host-target`, {
+            method: 'DELETE',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({
+                nodeId: 'remote-registry-renew-node'
+            })
+        });
+        assert.equal(renewClear.ok, true, JSON.stringify(renewClear.payload));
+        assert.equal(renewClear.payload?.ok, true, JSON.stringify(renewClear.payload));
+        await renewHost.stop();
+        renewHost = null;
+
+        currentTarget = createRegistryTarget({
+            endpoint: hostAEndpoint,
+            endpointCandidates: [staleEndpoint, hostAEndpoint],
+            leaseId: 'lease-a'
+        });
+
         hostA = spawnBridge({
             bridgePort: hostABridgePort,
             remoteHubPort: hostARemotePort,
@@ -465,6 +570,7 @@ async function main() {
         if (client) await client.stop();
         if (hostB) await hostB.stop();
         if (hostA) await hostA.stop();
+        if (renewHost) await renewHost.stop();
         if (fakeSupabase) await fakeSupabase.stop();
         await rm(tempRoot, { recursive: true, force: true });
     }

package/server.js

@@ -3146,6 +3146,15 @@ const REMOTE_REGISTRY_REALTIME_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
 const REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS = Math.max(10000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS || 25000) || 25000);
 const REMOTE_REGISTRY_REALTIME_RECONNECT_MS = Math.max(1000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_RECONNECT_MS || 2500) || 2500);
 const REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS = Math.max(100, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS || 250) || 250);
+const REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
+    && !/^(0|false|no|off)$/i.test(String(process.env.MINDEXEC_REMOTE_HOST_TARGET_AUTO_RENEW || 'true'));
+const REMOTE_HOST_TARGET_LEASE_MS = Math.max(60000, Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_LEASE_MS || 120000) || 120000);
+const REMOTE_HOST_TARGET_RENEW_MS = Math.max(
+    5000,
+    Math.min(
+        Math.floor(REMOTE_HOST_TARGET_LEASE_MS / 2),
+        Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_RENEW_MS || 25000) || 25000));
+const REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS = 60000;
 let remoteAgentState = createRemoteAgentIdleState();
 let remoteAgentSyncReportState = null;
 let remoteAgentSyncReportLogKey = '';
@@ -3168,6 +3177,10 @@ let remoteRegistryRealtimeHeartbeatTimer = null;
 let remoteRegistryRealtimeReconnectTimer = null;
 let remoteRegistryRealtimeReconnectContext = null;
 let remoteRegistryRealtimeLastWakeAt = 0;
+let remoteHostTargetRenewTimer = null;
+let remoteHostTargetRenewInFlight = false;
+let remoteHostTargetRenewLogKey = '';
+let remoteHostTargetRenewLogAt = 0;
 let remoteRegistryFollowerState = {
     enabled: REMOTE_REGISTRY_FOLLOWER_ENABLED,
     status: REMOTE_REGISTRY_FOLLOWER_ENABLED ? 'idle' : 'disabled',
@@ -3201,6 +3214,20 @@ let remoteRegistryRealtimeState = {
     changes: 0,
     wakeups: 0
 };
+let remoteHostTargetRenewState = {
+    enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED,
+    status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+    reason: '',
+    nodeId: '',
+    leaseId: '',
+    hostInstanceId: '',
+    endpoint: '',
+    endpointCandidates: [],
+    expiresAt: '',
+    lastAttemptAt: '',
+    lastSuccessAt: '',
+    lastError: ''
+};
 
 function createRemoteAgentIdleState(overrides = {}) {
     return {
@@ -4499,6 +4526,23 @@ function updateRemoteRegistryFollowerState(patch = {}) {
     emitBridgeEvent('RemoteRegistryFollowerUpdated', serializeRemoteRegistryFollowerState());
 }
 
+function serializeRemoteHostTargetRenewState() {
+    return {
+        ...remoteHostTargetRenewState,
+        leaseMs: REMOTE_HOST_TARGET_LEASE_MS,
+        renewMs: REMOTE_HOST_TARGET_RENEW_MS
+    };
+}
+
+function updateRemoteHostTargetRenewState(patch = {}) {
+    remoteHostTargetRenewState = {
+        ...remoteHostTargetRenewState,
+        ...patch,
+        enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED
+    };
+    emitBridgeEvent('RemoteHostTargetRenewUpdated', serializeRemoteHostTargetRenewState());
+}
+
 function serializeRemoteRegistryRealtimeState() {
     return {
         ...remoteRegistryRealtimeState,
@@ -5094,6 +5138,328 @@ async function fetchRemoteRegistryTarget(config, session) {
     return normalizeRemoteRegistryTarget(Array.isArray(payload) ? payload[0] : payload);
 }
 
+async function callRemoteRegistryRpc(config, session, functionName, payload) {
+    const url = new URL(`/rest/v1/rpc/${functionName}`, config.url);
+    const response = await fetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            apikey: config.key,
+            Authorization: `Bearer ${session.accessToken}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(payload)
+    });
+
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        const error = new Error(`registry-rpc-${functionName}-${response.status}${text ? `:${shortenText(text, 160)}` : ''}`);
+        error.statusCode = response.status;
+        throw error;
+    }
+
+    const rpcPayload = await response.json().catch(() => null);
+    const row = Array.isArray(rpcPayload) ? rpcPayload[0] : rpcPayload;
+    return {
+        ok: row?.ok === true || row?.Ok === true,
+        reason: safeRemoteAgentField(row?.reason || row?.Reason || '', 160)
+    };
+}
+
+async function readRemoteRegistryContext() {
+    const config = readSupabaseRuntimeConfig();
+    if (!config.url || !config.key) {
+        return { ok: false, reason: 'supabase-config-missing' };
+    }
+
+    const sessionPayload = await readStableAuthSessionPayload();
+    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    if (!session) {
+        return { ok: false, reason: 'registry-not-authenticated' };
+    }
+
+    if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+        return { ok: false, reason: 'session-expired' };
+    }
+
+    return { ok: true, config, session };
+}
+
+function getRemoteHostTargetEndpointReason(endpoint) {
+    const normalized = normalizeRemoteManagerEndpoint(endpoint);
+    if (!normalized) {
+        return 'invalid-manager-endpoint';
+    }
+
+    const match = normalized.match(/^(\[[^\]]+\]|[^:\s]+):(\d{1,5})$/);
+    const host = String(match?.[1] || '').replace(/^\[|\]$/g, '').toLowerCase();
+    if (!host || host === 'localhost' || host === '::1' || host === '0:0:0:0:0:0:0:1' || /^127\./.test(host)) {
+        return 'loopback-endpoint';
+    }
+
+    if (host === '0.0.0.0' || host === '::' || host === '*') {
+        return 'wildcard-endpoint';
+    }
+
+    if (/^169\.254\./.test(host)) {
+        return 'link-local-endpoint';
+    }
+
+    return 'ok';
+}
+
+function buildRemoteHostTargetRegistryPayload(hub) {
+    const rawEndpointCandidates = normalizeRemoteManagerEndpointList(
+        hub?.hostTargetEndpointCandidates,
+        hub?.agentEndpointCandidates,
+        hub?.hostTargetEndpoint,
+        hub?.agentEndpoint);
+    const endpointCandidates = rawEndpointCandidates
+        .filter(endpoint => getRemoteHostTargetEndpointReason(endpoint) === 'ok')
+        .slice(0, 12);
+    const endpoint = endpointCandidates[0] || '';
+    const pairToken = safeRemoteAgentField(hub?.pairToken, 512);
+    const leaseId = safeRemoteAgentField(hub?.hostTargetLeaseId, 128);
+    const hostInstanceId = safeRemoteAgentField(hub?.hostTargetHostInstanceId || hub?.hostInstanceId, 128);
+    const nodeId = safeRemoteAgentField(hub?.hostTargetNodeId, 128);
+    const activatedAt = safeRemoteAgentField(hub?.hostTargetActivatedAt, 80) || new Date().toISOString();
+    const expiresAt = safeRemoteAgentField(hub?.hostTargetExpiresAt, 80) || new Date(Date.now() + REMOTE_HOST_TARGET_LEASE_MS).toISOString();
+
+    if (!pairToken || !leaseId || !hostInstanceId || !nodeId) {
+        return {
+            ok: false,
+            reason: 'missing-fields',
+            endpoint: '',
+            endpointCandidates: []
+        };
+    }
+
+    if (endpointCandidates.length === 0) {
+        const reason = rawEndpointCandidates.length === 0
+            ? safeRemoteAgentField(hub?.agentEndpointRouteReason || 'missing-endpoint-candidates', 160)
+            : getRemoteHostTargetEndpointReason(rawEndpointCandidates[0]);
+        return {
+            ok: false,
+            reason,
+            endpoint: rawEndpointCandidates[0] || '',
+            endpointCandidates: rawEndpointCandidates
+        };
+    }
+
+    return {
+        ok: true,
+        endpoint,
+        endpointCandidates,
+        leaseId,
+        hostInstanceId,
+        nodeId,
+        expiresAt,
+        payload: {
+            p_node_id: nodeId,
+            p_lease_id: leaseId,
+            p_host_instance_id: hostInstanceId,
+            p_endpoint: endpoint,
+            p_pair_token: pairToken,
+            p_manager_package: safeRemoteAgentField(hub?.managerPackage || '@mindexec/cli', 160),
+            p_manager_version: safeRemoteAgentField(hub?.managerVersion || '', 80),
+            p_agent_package: safeRemoteAgentField(hub?.agentPackage || '@mindexec/remote', 160),
+            p_activated_at: activatedAt,
+            p_expires_at: expiresAt,
+            p_endpoint_candidates: endpointCandidates
+        }
+    };
+}
+
+function logRemoteHostTargetRenew(status, reason, endpoint = '') {
+    const key = [status, reason, endpoint].join('|');
+    const now = Date.now();
+    if (key === remoteHostTargetRenewLogKey
+        && now - remoteHostTargetRenewLogAt < REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS) {
+        return;
+    }
+
+    remoteHostTargetRenewLogKey = key;
+    remoteHostTargetRenewLogAt = now;
+    logEvent(
+        'remote',
+        `host target renew ${status} ${formatKeyValue('reason', reason || '-')} ${formatKeyValue('endpoint', endpoint || '-')}`,
+        status === 'ok' ? 'remote' : 'warn');
+}
+
+function isRemoteHostTargetRenewSoftSkipReason(reason) {
+    return /^(registry-not-authenticated|session-expired|supabase-config-missing|missing-endpoint-candidates|loopback-endpoint|wildcard-endpoint|link-local-endpoint)$/i
+        .test(String(reason || '').trim());
+}
+
+async function publishLocalRemoteHostTargetToRegistry(hub, { takeover = false } = {}) {
+    const registryPayload = buildRemoteHostTargetRegistryPayload(hub);
+    if (!registryPayload.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: registryPayload.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const context = await readRemoteRegistryContext();
+    if (!context.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: context.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const row = await callRemoteRegistryRpc(
+        context.config,
+        context.session,
+        'set_remote_host_target',
+        {
+            ...registryPayload.payload,
+            p_takeover: takeover === true
+        });
+    const reason = row.reason || (row.ok ? 'ok' : 'registry-publish-failed');
+    return {
+        ok: row.ok,
+        active: row.ok,
+        reason,
+        endpoint: registryPayload.endpoint,
+        endpointCandidates: registryPayload.endpointCandidates,
+        leaseId: registryPayload.leaseId,
+        nodeId: registryPayload.nodeId,
+        hostInstanceId: registryPayload.hostInstanceId,
+        expiresAt: registryPayload.expiresAt,
+        stale: reason === 'host-target-taken'
+    };
+}
+
+function scheduleRemoteHostTargetRenew(delayMs = REMOTE_HOST_TARGET_RENEW_MS, reason = 'timer') {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || isShuttingDown) {
+        return;
+    }
+
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+
+    remoteHostTargetRenewTimer = setTimeout(() => {
+        remoteHostTargetRenewTimer = null;
+        runRemoteHostTargetRenewOnce(reason).catch(error => {
+            const message = error?.message || String(error || '');
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: 'renew-error',
+                lastAttemptAt: new Date().toISOString(),
+                lastError: message
+            });
+            logRemoteHostTargetRenew('failed', message);
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'error-retry');
+        });
+    }, Math.max(0, Number(delayMs) || 0));
+    remoteHostTargetRenewTimer?.unref?.();
+}
+
+function stopRemoteHostTargetRenew(reason = 'stopped') {
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+    updateRemoteHostTargetRenewState({
+        status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+        reason,
+        nodeId: '',
+        leaseId: '',
+        hostInstanceId: '',
+        endpoint: '',
+        endpointCandidates: [],
+        expiresAt: '',
+        lastError: ''
+    });
+}
+
+async function runRemoteHostTargetRenewOnce(trigger = 'timer', options = {}) {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || remoteHostTargetRenewInFlight) {
+        return serializeRemoteHostTargetRenewState();
+    }
+
+    remoteHostTargetRenewInFlight = true;
+    const attemptedAt = new Date().toISOString();
+    try {
+        const currentHub = remoteHub.getStatus({ includeSecrets: true });
+        if (currentHub?.hostTargetActive !== true || !currentHub.hostTargetNodeId) {
+            stopRemoteHostTargetRenew('no-local-host-target');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const renewed = remoteHub.setHostTarget({
+            enabled: true,
+            nodeId: currentHub.hostTargetNodeId,
+            leaseMs: REMOTE_HOST_TARGET_LEASE_MS
+        });
+        if (renewed?.ok !== true || renewed?.active !== true) {
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: renewed?.error || 'local-host-renew-failed',
+                nodeId: currentHub.hostTargetNodeId,
+                lastAttemptAt: attemptedAt,
+                lastError: renewed?.error || 'local-host-renew-failed'
+            });
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'local-renew-failed');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const hub = remoteHub.getStatus({ includeSecrets: true });
+        const registry = await publishLocalRemoteHostTargetToRegistry(hub, {
+            takeover: options.takeover === true
+        });
+        const status = registry.ok ? 'active' : registry.stale ? 'superseded' : 'skipped';
+        updateRemoteHostTargetRenewState({
+            status,
+            reason: registry.reason || (registry.ok ? 'ok' : 'registry-skipped'),
+            nodeId: hub.hostTargetNodeId,
+            leaseId: hub.hostTargetLeaseId,
+            hostInstanceId: hub.hostTargetHostInstanceId || hub.hostInstanceId,
+            endpoint: registry.endpoint || hub.hostTargetEndpoint,
+            endpointCandidates: registry.endpointCandidates || hub.hostTargetEndpointCandidates || [],
+            expiresAt: hub.hostTargetExpiresAt,
+            lastAttemptAt: attemptedAt,
+            lastSuccessAt: registry.ok ? new Date().toISOString() : remoteHostTargetRenewState.lastSuccessAt,
+            lastError: registry.ok || /^(registry-not-authenticated|session-expired|supabase-config-missing)$/i.test(registry.reason || '')
+                ? ''
+                : (registry.reason || 'registry-publish-failed')
+        });
+
+        if (registry.stale) {
+            remoteHub.setHostTarget({
+                enabled: false,
+                nodeId: hub.hostTargetNodeId
+            });
+            logRemoteHostTargetRenew('superseded', registry.reason, registry.endpoint);
+            stopRemoteHostTargetRenew('host-target-superseded');
+            wakeRemoteRegistryFollower('host-target-superseded').catch(() => {});
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        logRemoteHostTargetRenew(registry.ok ? 'ok' : 'skipped', registry.reason, registry.endpoint);
+        const retryDelay = registry.ok || isRemoteHostTargetRenewSoftSkipReason(registry.reason)
+            ? REMOTE_HOST_TARGET_RENEW_MS
+            : REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS;
+        scheduleRemoteHostTargetRenew(
+            retryDelay,
+            registry.ok ? 'renewed' : 'renew-skipped');
+        return serializeRemoteHostTargetRenewState();
+    } finally {
+        remoteHostTargetRenewInFlight = false;
+    }
+}
+
 async function reportRemoteRegistryFollowerSync(payload = {}) {
     const report = createRemoteAgentSyncReport(payload);
     rememberRemoteAgentSyncReport(report);
@@ -9921,6 +10287,7 @@ app.get('/api/status', async (req, res) => {
         remoteAgent: serializeRemoteAgentState(),
         remoteRegistryFollower: serializeRemoteRegistryFollowerState(),
         remoteRegistryRealtime: serializeRemoteRegistryRealtimeState(),
+        remoteHostTargetRenew: serializeRemoteHostTargetRenewState(),
         shellJobsPath: '/api/shell/jobs',
         companyCore: {
             baseUrl: companyCoreBaseUrl,
@@ -9997,20 +10364,27 @@ app.post('/api/remote/frames', (req, res) => {
 app.post('/api/remote/host-target', async (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
     try {
+        const requestedLeaseMs = Number(req.body?.leaseMs);
         const result = remoteHub.setHostTarget({
             enabled: req.body?.enabled !== false,
             nodeId: req.body?.nodeId,
-            leaseMs: req.body?.leaseMs
+            leaseMs: Math.max(
+                REMOTE_HOST_TARGET_LEASE_MS,
+                Number.isFinite(requestedLeaseMs) && requestedLeaseMs > 0 ? requestedLeaseMs : 0)
         });
         if (result?.ok === true && result?.active === true && isLocalRemoteHostTargetActive()) {
             if (isRemoteAgentProcessRunning()) {
                 await stopRemoteAgentConnection('local-host-target-active');
                 logEvent('remote', 'managed RemoteAgent held stopped while local host target is active', 'remote');
             }
+            await runRemoteHostTargetRenewOnce('set-host', { takeover: true });
+        } else if (result?.active !== true) {
+            stopRemoteHostTargetRenew('host-target-inactive');
         }
         res.json({
             ...result,
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     } catch (err) {
         logError('remote', 'remote host target update failed.', err);
@@ -10018,17 +10392,25 @@ app.post('/api/remote/host-target', async (req, res) => {
             ok: false,
             active: false,
             error: err?.message || String(err),
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     }
 });
 
 app.delete('/api/remote/host-target', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    res.json(remoteHub.setHostTarget({
+    const result = remoteHub.setHostTarget({
         enabled: false,
         nodeId: req.body?.nodeId
-    }));
+    });
+    if (result?.ok === true) {
+        stopRemoteHostTargetRenew('host-target-cleared');
+    }
+    res.json({
+        ...result,
+        hostTargetRenew: serializeRemoteHostTargetRenewState()
+    });
 });
 
 app.get('/api/remote/agent/status', (req, res) => {
@@ -11751,6 +12133,12 @@ async function shutdownBridge(signal) {
         // Ignore registry follower shutdown errors
     }
 
+    try {
+        stopRemoteHostTargetRenew('bridge-shutdown');
+    } catch {
+        // Ignore host-target renew shutdown errors
+    }
+
     try {
         closeRemoteRegistryRealtime('bridge-shutdown');
     } catch {