@mindexec/cli 0.2.185 → 0.2.187

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.185",
+  "version": "0.2.187",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/scripts/remote-registry-follower-smoke.mjs

@@ -15,6 +15,9 @@ const PAIR_TOKEN = 'remote-registry-follower-pair-token';
 const USER_ID = '11111111-2222-4333-8444-555555555555';
 const SUPABASE_KEY = 'remote-registry-follower-key';
 const ACCESS_TOKEN = 'remote-registry-follower-access-token';
+const EXPIRED_ACCESS_TOKEN = 'remote-registry-follower-expired-access-token';
+const REFRESHED_ACCESS_TOKEN = 'remote-registry-follower-refreshed-access-token';
+const REFRESH_TOKEN = 'remote-registry-follower-refresh-token';
 const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 function wait(ms) {
@@ -86,6 +89,14 @@ function createRegistryTarget({ endpoint, endpointCandidates, leaseId, active =
 function startFakeSupabase(getTarget, setTarget = null) {
     const requests = [];
     const realtimeClients = new Set();
+    const validAccessTokens = new Set([ACCESS_TOKEN]);
+    const assertRegistryAuth = req => {
+        assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+        const authorization = String(req.headers.authorization || '');
+        assert.ok(
+            validAccessTokens.has(authorization.replace(/^Bearer\s+/i, '')),
+            `unexpected registry authorization: ${authorization}`);
+    };
     const server = createServer(async (req, res) => {
         const readBody = () => new Promise(resolve => {
             let body = '';
@@ -103,8 +114,7 @@ function startFakeSupabase(getTarget, setTarget = null) {
         });
 
         if (req.method === 'GET' && parsed.pathname === '/rest/v1/remote_host_targets') {
-            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            assertRegistryAuth(req);
             res.writeHead(200, {
                 'Content-Type': 'application/json',
                 'Cache-Control': 'no-store'
@@ -115,8 +125,7 @@ function startFakeSupabase(getTarget, setTarget = null) {
         }
 
         if (req.method === 'POST' && parsed.pathname === '/rest/v1/rpc/set_remote_host_target') {
-            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            assertRegistryAuth(req);
             const body = JSON.parse(await readBody() || '{}');
             const now = Date.now();
             const existing = getTarget();
@@ -148,6 +157,31 @@ function startFakeSupabase(getTarget, setTarget = null) {
             return;
         }
 
+        if (req.method === 'POST' && parsed.pathname === '/auth/v1/token') {
+            assert.equal(parsed.searchParams.get('grant_type'), 'refresh_token');
+            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+            assert.equal(String(req.headers.authorization || ''), `Bearer ${SUPABASE_KEY}`);
+            const body = JSON.parse(await readBody() || '{}');
+            assert.equal(body.refresh_token, REFRESH_TOKEN);
+            validAccessTokens.add(REFRESHED_ACCESS_TOKEN);
+            res.writeHead(200, {
+                'Content-Type': 'application/json',
+                'Cache-Control': 'no-store'
+            });
+            res.end(JSON.stringify({
+                access_token: REFRESHED_ACCESS_TOKEN,
+                refresh_token: REFRESH_TOKEN,
+                token_type: 'bearer',
+                expires_in: 3600,
+                expires_at: Math.floor(Date.now() / 1000) + 3600,
+                user: {
+                    id: USER_ID,
+                    email: 'remote-registry-follower@example.test'
+                }
+            }));
+            return;
+        }
+
         res.writeHead(404, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'not-found' }));
     });
@@ -166,8 +200,8 @@ function startFakeSupabase(getTarget, setTarget = null) {
 
             if (message.event === 'phx_join') {
                 assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-                assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
-                assert.equal(message.payload?.access_token, ACCESS_TOKEN);
+                assert.ok(validAccessTokens.has(String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')));
+                assert.ok(validAccessTokens.has(String(message.payload?.access_token || '')));
                 assert.deepEqual(
                     message.payload?.config?.postgres_changes?.[0],
                     {
@@ -338,10 +372,14 @@ async function waitForBridge(bridge) {
     }, 30000, `bridge startup\n${bridge.details()}`);
 }
 
-function createSessionPayload() {
+function createSessionPayload(options = {}) {
+    const accessToken = options.accessToken || ACCESS_TOKEN;
+    const refreshToken = options.refreshToken || REFRESH_TOKEN;
+    const expiresAt = options.expiresAt ?? Math.floor(Date.now() / 1000) + 3600;
     return JSON.stringify({
-        access_token: ACCESS_TOKEN,
-        expires_at: Math.floor(Date.now() / 1000) + 3600,
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt,
         user: {
             id: USER_ID,
             email: 'remote-registry-follower@example.test'
@@ -349,9 +387,9 @@ function createSessionPayload() {
     });
 }
 
-async function writeSession(authRoot) {
+async function writeSession(authRoot, options = {}) {
     await mkdir(authRoot, { recursive: true });
-    await writeFile(path.join(authRoot, 'supabase-session.json'), createSessionPayload(), 'utf8');
+    await writeFile(path.join(authRoot, 'supabase-session.json'), createSessionPayload(options), 'utf8');
 }
 
 async function waitForManagedAgent(bridge, managerEndpoint, label, timeoutMs = 20000) {
@@ -435,7 +473,10 @@ async function main() {
         const hostBAuth = path.join(tempRoot, 'auth-host-b');
         const clientAuth = path.join(tempRoot, 'auth-client');
         await writeSession(renewHostAuth);
-        await writeSession(clientAuth);
+        await writeSession(clientAuth, {
+            accessToken: EXPIRED_ACCESS_TOKEN,
+            expiresAt: Math.floor(Date.now() / 1000) - 30
+        });
 
         renewHost = spawnBridge({
             bridgePort: renewHostBridgePort,
@@ -544,6 +585,17 @@ async function main() {
         assert.match(String(firstAgent.launcher || ''), /mindexec-remote-fast/i);
         assert.equal(firstAgent.manager, hostAEndpoint);
         assert.equal(firstAgent.managerCandidates?.[0], staleEndpoint, JSON.stringify(firstAgent.managerCandidates));
+        assert.ok(
+            fakeSupabase.requests.some(request =>
+                request.method === 'POST'
+                && request.pathname === '/auth/v1/token'),
+            'expected LocalBridge to refresh expired persisted Supabase session without browser involvement');
+        assert.ok(
+            fakeSupabase.requests.some(request =>
+                request.method === 'GET'
+                && request.pathname === '/rest/v1/remote_host_targets'
+                && request.authorization === `Bearer ${REFRESHED_ACCESS_TOKEN}`),
+            'expected registry read to use refreshed access token');
         await waitForConnectedDevice(hostA, 'host-a');
         const firstStatus = await fetchJson(`${client.baseUrl}/api/status`);
         assert.equal(firstStatus.payload?.remoteRegistryRealtime?.subscribed, true, JSON.stringify(firstStatus.payload?.remoteRegistryRealtime));
@@ -649,12 +701,18 @@ async function main() {
         fakeSupabase.broadcastChange('UPDATE');
 
         await waitFor(async () => {
-            const result = await fetchJson(`${client.baseUrl}/api/remote/agent/status`);
-            return result.payload?.running === false
-                && String(result.payload?.lastError || '') === 'registry-inactive'
-                ? result.payload
+            const status = await fetchJson(`${client.baseUrl}/api/status`);
+            const agent = await fetchJson(`${client.baseUrl}/api/remote/agent/status`);
+            return status.payload?.remoteRegistryFollower?.reason === 'registry-inactive-agent-kept'
+                && status.payload?.remoteRegistryFollower?.agentKept === true
+                && status.payload?.remoteRegistryFollower?.dataPlaneReady === true
+                && agent.payload?.running === true
+                && agent.payload?.ready === true
+                && String(agent.payload?.manager || '') === hostBEndpoint
+                && Number(agent.payload?.pid || 0) === Number(restartedAgent.pid || 0)
+                ? { status: status.payload.remoteRegistryFollower, agent: agent.payload }
                 : null;
-        }, 9000, `registry inactive stop\n${client.details()}`);
+        }, 9000, `registry inactive keeps ready data-plane agent\n${client.details()}`);
         const finalStatus = await fetchJson(`${client.baseUrl}/api/status`);
         assert.ok(finalStatus.payload?.remoteRegistryRealtime?.changes >= 2, JSON.stringify(finalStatus.payload?.remoteRegistryRealtime));
         assert.ok(finalStatus.payload?.remoteRegistryRealtime?.wakeups >= 2, JSON.stringify(finalStatus.payload?.remoteRegistryRealtime));

package/server.js

@@ -3388,6 +3388,7 @@ const REMOTE_REGISTRY_FOLLOWER_MISSING_SESSION_FAST_RETRY_COUNT = Math.max(
     Number(process.env.MINDEXEC_REMOTE_REGISTRY_MISSING_SESSION_FAST_RETRY_COUNT || 5) || 5);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_STOP_COUNT = Math.max(2, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_STOP_COUNT || 8) || 8);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_GRACE_MS = Math.max(500, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_GRACE_MS || 60000) || 60000);
+const REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS = Math.max(15_000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS || 120_000) || 120_000);
 const REMOTE_REGISTRY_REALTIME_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
     && !/^(0|false|no|off)$/i.test(String(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME || 'true'));
 const REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS = Math.max(10000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS || 25000) || 25000);
@@ -3426,6 +3427,7 @@ let remoteRegistryFollowerStarted = false;
 let remoteRegistryFollowerConsecutiveMissingSession = 0;
 let remoteRegistryFollowerConsecutiveInactiveTarget = 0;
 let remoteRegistryFollowerInactiveTargetFirstAt = 0;
+let remoteRegistrySessionRefreshPromise = null;
 let remoteRegistryRealtimeSocket = null;
 let remoteRegistryRealtimeSessionKey = '';
 let remoteRegistryRealtimeTopic = '';
@@ -3573,6 +3575,7 @@ function createRemoteAgentSyncReport(body = {}) {
         inactiveCount: Number(body.inactiveCount ?? body.InactiveCount ?? 0) || 0,
         inactiveElapsedMs: Number(body.inactiveElapsedMs ?? body.InactiveElapsedMs ?? 0) || 0,
         agentKept: body.agentKept === true || body.AgentKept === true,
+        dataPlaneReady: body.dataPlaneReady === true || body.DataPlaneReady === true,
         updatedAt: new Date().toISOString()
     };
 }
@@ -4089,6 +4092,12 @@ function isRemoteAgentRunningButNotReadyStale() {
         && getRemoteAgentRunningAgeMs(remoteAgentState) >= REMOTE_AGENT_READY_STALE_MS;
 }
 
+function isRemoteAgentReadyDataPlaneAlive() {
+    return isRemoteAgentRegistryOwned()
+        && remoteAgentState.ready === true
+        && remoteAgentState.needsReconnect !== true;
+}
+
 function isRemoteAgentRegistryOwned() {
     return isRemoteAgentProcessRunning()
         && /registry/i.test(String(remoteAgentState.source || ''));
@@ -4138,13 +4147,15 @@ function rememberRemoteRegistryInactiveTarget(reason = 'no-active-target') {
 
     const elapsedMs = Math.max(0, now - remoteRegistryFollowerInactiveTargetFirstAt);
     const agentRunning = isRemoteAgentRegistryOwned();
-    const confirmedInactive = remoteRegistryFollowerConsecutiveInactiveTarget >= REMOTE_REGISTRY_FOLLOWER_INACTIVE_STOP_COUNT
+    const keepReadyDataPlane = agentRunning && isRemoteAgentReadyDataPlaneAlive();
+    const confirmedInactive = !keepReadyDataPlane
+        && remoteRegistryFollowerConsecutiveInactiveTarget >= REMOTE_REGISTRY_FOLLOWER_INACTIVE_STOP_COUNT
         && elapsedMs >= REMOTE_REGISTRY_FOLLOWER_INACTIVE_GRACE_MS;
 
     if (agentRunning && !confirmedInactive) {
         logEvent(
             'remote',
-            `registry target temporarily inactive; keeping managed RemoteAgent ${formatKeyValue('reason', reason)} ${formatKeyValue('count', remoteRegistryFollowerConsecutiveInactiveTarget)} ${formatKeyValue('elapsedMs', elapsedMs)}`,
+            `registry target temporarily inactive; keeping managed RemoteAgent ${formatKeyValue('reason', reason)} ${formatKeyValue('count', remoteRegistryFollowerConsecutiveInactiveTarget)} ${formatKeyValue('elapsedMs', elapsedMs)} ${formatKeyValue('dataPlane', keepReadyDataPlane ? 'ready' : 'pending')}`,
             'remote');
     }
 
@@ -4153,7 +4164,8 @@ function rememberRemoteRegistryInactiveTarget(reason = 'no-active-target') {
         elapsedMs,
         agentRunning,
         confirmedInactive,
-        agentKept: agentRunning && !confirmedInactive
+        agentKept: agentRunning && !confirmedInactive,
+        dataPlaneReady: keepReadyDataPlane
     };
 }
 
@@ -5523,6 +5535,75 @@ function readSupabaseSessionField(source, ...keys) {
     return '';
 }
 
+function parseSupabaseSessionExpiresAtMs(value) {
+    if (value === undefined || value === null || String(value).trim() === '') {
+        return 0;
+    }
+
+    const numeric = Number(value);
+    if (Number.isFinite(numeric) && numeric > 0) {
+        return numeric > 9999999999 ? numeric : numeric * 1000;
+    }
+
+    const parsed = Date.parse(String(value));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function setSupabaseSessionKnownField(session, value, fallbackKey, ...keys) {
+    let wrote = false;
+    for (const key of keys) {
+        if (Object.prototype.hasOwnProperty.call(session, key)) {
+            session[key] = value;
+            wrote = true;
+        }
+    }
+
+    if (!wrote) {
+        session[fallbackKey] = value;
+    }
+}
+
+function buildRefreshedSupabaseSessionPayload(content, refreshedSession) {
+    const existing = JSON.parse(String(content || '{}'));
+    const accessToken = String(readSupabaseSessionField(refreshedSession, 'access_token', 'accessToken', 'AccessToken')).trim();
+    const refreshToken = String(readSupabaseSessionField(refreshedSession, 'refresh_token', 'refreshToken', 'RefreshToken')).trim()
+        || String(readSupabaseSessionField(existing, 'refresh_token', 'refreshToken', 'RefreshToken')).trim();
+    const tokenType = String(readSupabaseSessionField(refreshedSession, 'token_type', 'tokenType', 'TokenType')).trim()
+        || String(readSupabaseSessionField(existing, 'token_type', 'tokenType', 'TokenType')).trim()
+        || 'bearer';
+    const expiresInRaw = Number(readSupabaseSessionField(refreshedSession, 'expires_in', 'expiresIn', 'ExpiresIn') || 0);
+    const expiresAtFromResponse = readSupabaseSessionField(refreshedSession, 'expires_at', 'expiresAt', 'ExpiresAt');
+    const expiresAtMs = parseSupabaseSessionExpiresAtMs(expiresAtFromResponse)
+        || (Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? Date.now() + (expiresInRaw * 1000) : 0);
+    const expiresAtSeconds = expiresAtMs > 0 ? Math.floor(expiresAtMs / 1000) : 0;
+
+    if (!accessToken || !refreshToken || !expiresAtSeconds) {
+        const error = new Error('auth-refresh-response-incomplete');
+        error.statusCode = 502;
+        throw error;
+    }
+
+    setSupabaseSessionKnownField(existing, accessToken, 'access_token', 'access_token', 'accessToken', 'AccessToken');
+    setSupabaseSessionKnownField(existing, refreshToken, 'refresh_token', 'refresh_token', 'refreshToken', 'RefreshToken');
+    setSupabaseSessionKnownField(existing, tokenType, 'token_type', 'token_type', 'tokenType', 'TokenType');
+    setSupabaseSessionKnownField(existing, expiresAtSeconds, 'expires_at', 'expires_at', 'expiresAt', 'ExpiresAt');
+
+    if (Number.isFinite(expiresInRaw) && expiresInRaw > 0) {
+        setSupabaseSessionKnownField(existing, Math.floor(expiresInRaw), 'expires_in', 'expires_in', 'expiresIn', 'ExpiresIn');
+    }
+
+    const user = refreshedSession?.user || refreshedSession?.User;
+    if (user && typeof user === 'object') {
+        if (Object.prototype.hasOwnProperty.call(existing, 'User')) {
+            existing.User = user;
+        } else {
+            existing.user = user;
+        }
+    }
+
+    return JSON.stringify(existing);
+}
+
 function parseSupabaseSessionForRegistry(content) {
     let session = null;
     try {
@@ -5533,13 +5614,11 @@ function parseSupabaseSessionForRegistry(content) {
 
     const user = session?.user || session?.User || {};
     const accessToken = String(readSupabaseSessionField(session, 'access_token', 'accessToken', 'AccessToken')).trim();
+    const refreshToken = String(readSupabaseSessionField(session, 'refresh_token', 'refreshToken', 'RefreshToken')).trim();
     const userId = String(
         readSupabaseSessionField(user, 'id', 'Id')
         || readSupabaseSessionField(session, 'user_id', 'userId', 'UserId')).trim();
-    const expiresAtRaw = Number(readSupabaseSessionField(session, 'expires_at', 'expiresAt', 'ExpiresAt') || 0);
-    const expiresAtMs = Number.isFinite(expiresAtRaw) && expiresAtRaw > 0
-        ? (expiresAtRaw > 9999999999 ? expiresAtRaw : expiresAtRaw * 1000)
-        : 0;
+    const expiresAtMs = parseSupabaseSessionExpiresAtMs(readSupabaseSessionField(session, 'expires_at', 'expiresAt', 'ExpiresAt'));
 
     if (!accessToken || !userId) {
         return null;
@@ -5547,11 +5626,143 @@ function parseSupabaseSessionForRegistry(content) {
 
     return {
         accessToken,
+        refreshToken,
         userId,
         expiresAtMs
     };
 }
 
+async function refreshSupabaseSessionForRegistry(config, sessionPayload, reason = 'registry') {
+    const currentSession = parseSupabaseSessionForRegistry(sessionPayload?.content);
+    if (!currentSession?.refreshToken) {
+        return {
+            ok: false,
+            reason: 'refresh-token-missing'
+        };
+    }
+
+    if (remoteRegistrySessionRefreshPromise) {
+        return await remoteRegistrySessionRefreshPromise;
+    }
+
+    remoteRegistrySessionRefreshPromise = (async () => {
+        const url = new URL('/auth/v1/token', config.url);
+        url.searchParams.set('grant_type', 'refresh_token');
+        const response = await fetch(url.toString(), {
+            method: 'POST',
+            headers: {
+                apikey: config.key,
+                Authorization: `Bearer ${config.key}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                refresh_token: currentSession.refreshToken
+            })
+        });
+
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            const error = new Error(`auth-refresh-${response.status}${text ? `:${shortenText(text, 160)}` : ''}`);
+            error.statusCode = response.status;
+            throw error;
+        }
+
+        const refreshed = await response.json();
+        const content = buildRefreshedSupabaseSessionPayload(sessionPayload.content, refreshed);
+        await writeStableAuthSessionPayload(content);
+        const session = parseSupabaseSessionForRegistry(content);
+        if (!session) {
+            const error = new Error('auth-refresh-session-parse-failed');
+            error.statusCode = 502;
+            throw error;
+        }
+
+        logEvent(
+            'remote',
+            `registry auth refreshed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('expiresInMs', Math.max(0, session.expiresAtMs - Date.now()))}`,
+            'remote');
+
+        return {
+            ok: true,
+            reason: 'refreshed',
+            content,
+            session
+        };
+    })();
+
+    try {
+        return await remoteRegistrySessionRefreshPromise;
+    } finally {
+        remoteRegistrySessionRefreshPromise = null;
+    }
+}
+
+async function readFreshSupabaseSessionForRegistry(config, reason = 'registry') {
+    const sessionPayload = await readStableAuthSessionPayload();
+    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    if (!session) {
+        return {
+            found: sessionPayload.found,
+            payload: sessionPayload,
+            session: null,
+            refreshed: false,
+            expired: false
+        };
+    }
+
+    const now = Date.now();
+    const shouldRefresh = session.expiresAtMs > 0
+        && session.expiresAtMs <= now + REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS;
+    if (!shouldRefresh) {
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= now
+        };
+    }
+
+    try {
+        const refreshed = await refreshSupabaseSessionForRegistry(config, sessionPayload, reason);
+        if (refreshed.ok && refreshed.session) {
+            return {
+                found: true,
+                payload: {
+                    ...sessionPayload,
+                    content: refreshed.content,
+                    refreshed: true
+                },
+                session: refreshed.session,
+                refreshed: true,
+                expired: false
+            };
+        }
+
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= Date.now(),
+            refreshError: refreshed.reason || 'auth-refresh-skipped'
+        };
+    } catch (error) {
+        logWarn(
+            'remote',
+            `registry auth refresh failed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('error', error?.message || String(error || ''))}`);
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= Date.now(),
+            refreshError: error?.message || String(error || '')
+        };
+    }
+}
+
 function readRegistryTargetField(target, ...keys) {
     for (const key of keys) {
         const value = target?.[key];
@@ -5690,13 +5901,13 @@ async function readRemoteRegistryContext() {
         return { ok: false, reason: 'supabase-config-missing' };
     }
 
-    const sessionPayload = await readStableAuthSessionPayload();
-    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    const sessionState = await readFreshSupabaseSessionForRegistry(config, 'registry-context');
+    const session = sessionState.session;
     if (!session) {
         return { ok: false, reason: 'registry-not-authenticated' };
     }
 
-    if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+    if (sessionState.expired || (session.expiresAtMs && session.expiresAtMs <= Date.now())) {
         return { ok: false, reason: 'session-expired' };
     }
 
@@ -6311,8 +6522,8 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
             return serializeRemoteRegistryFollowerState();
         }
 
-        const sessionPayload = await readStableAuthSessionPayload();
-        const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+        const sessionState = await readFreshSupabaseSessionForRegistry(config, `follower-${trigger || 'timer'}`);
+        const session = sessionState.session;
         if (!session) {
             closeRemoteRegistryRealtime('registry-not-authenticated');
             remoteRegistryFollowerConsecutiveMissingSession += 1;
@@ -6358,23 +6569,39 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
         }
 
         remoteRegistryFollowerConsecutiveMissingSession = 0;
-        if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+        if (sessionState.expired || (session.expiresAtMs && session.expiresAtMs <= Date.now())) {
             closeRemoteRegistryRealtime('session-expired');
+            const agentKept = isRemoteAgentRegistryOwned() && isRemoteAgentProcessRunning();
+            const reason = agentKept
+                ? 'session-expired-agent-kept'
+                : 'session-expired';
+            const keptManager = agentKept ? safeRemoteAgentField(remoteAgentState.manager, 160) : '';
+            const keptCandidates = agentKept ? normalizeRemoteManagerEndpointList(remoteAgentState.managerCandidates, remoteAgentState.manager) : [];
             updateRemoteRegistryFollowerState({
-                status: 'skipped',
-                reason: 'session-expired',
+                status: agentKept ? 'auth-pending' : 'skipped',
+                reason,
                 authenticated: false,
                 lastAttemptAt: attemptedAt,
-                lastError: ''
+                lastError: sessionState.refreshError || '',
+                targetEndpoint: keptManager,
+                targetEndpointCandidates: keptCandidates,
+                targetLeaseId: agentKept ? safeRemoteAgentField(remoteAgentState.leaseId, 128) : '',
+                targetNodeId: agentKept ? safeRemoteAgentField(remoteAgentState.nodeId, 128) : '',
+                agentKept
             });
             await reportRemoteRegistryFollowerSync({
                 ok: true,
                 skipped: true,
-                reason: 'session-expired',
+                reason,
                 trigger,
-                authenticated: false
+                authenticated: false,
+                targetEndpoint: keptManager,
+                targetEndpointCandidates: keptCandidates,
+                targetLeaseId: agentKept ? remoteAgentState.leaseId : '',
+                targetNodeId: agentKept ? remoteAgentState.nodeId : '',
+                agentKept
             });
-            scheduleRemoteRegistryFollower(REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'session-expired');
+            scheduleRemoteRegistryFollower(agentKept ? REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS : REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'session-expired');
             return serializeRemoteRegistryFollowerState();
         }
 
@@ -6470,6 +6697,7 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
                 inactiveCount: inactive.count,
                 inactiveElapsedMs: inactive.elapsedMs,
                 agentKept: inactive.agentKept,
+                dataPlaneReady: inactive.dataPlaneReady,
                 lastError: ''
             });
             await reportRemoteRegistryFollowerSync({
@@ -6484,7 +6712,8 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
                 targetNodeId: inactive.agentKept ? remoteAgentState.nodeId : '',
                 inactiveCount: inactive.count,
                 inactiveElapsedMs: inactive.elapsedMs,
-                agentKept: inactive.agentKept
+                agentKept: inactive.agentKept,
+                dataPlaneReady: inactive.dataPlaneReady
             });
             scheduleRemoteRegistryFollower(REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'no-target');
             return serializeRemoteRegistryFollowerState();

package/wwwroot/_content/MindExecution.Shared/css/mind-map-overrides.css

@@ -3375,3 +3375,44 @@ body.mindcanvas-is-dense .css3d-resolution-wrapper.node-type-templatelauncher.se
         color: #93c5fd;
     }
 }
+
+/* Lightweight CSS3D motion path.
+   Reference graph tools are useful here because they keep node DOM cheap:
+   while the camera is moving, retain the canonical CSS3D surface but remove
+   decorative compositor-heavy effects from every CSS3D node, including
+   selected and agent-style nodes. */
+body.is-zooming .css3d-resolution-wrapper,
+body.is-panning .css3d-resolution-wrapper,
+body.is-node-dragging .css3d-resolution-wrapper,
+body.is-resizing .css3d-resolution-wrapper,
+body.mindcanvas-is-moving .css3d-resolution-wrapper,
+body.mindcanvas-is-dense .css3d-resolution-wrapper {
+    -webkit-transition: none !important;
+    transition: none !important;
+    -webkit-filter: none !important;
+    filter: none !important;
+    -webkit-box-shadow: none !important;
+    box-shadow: none !important;
+}
+
+body.is-zooming .css3d-resolution-wrapper .css3d-dynamic-node,
+body.is-panning .css3d-resolution-wrapper .css3d-dynamic-node,
+body.is-node-dragging .css3d-resolution-wrapper .css3d-dynamic-node,
+body.is-resizing .css3d-resolution-wrapper .css3d-dynamic-node,
+body.mindcanvas-is-moving .css3d-resolution-wrapper .css3d-dynamic-node,
+body.mindcanvas-is-dense .css3d-resolution-wrapper .css3d-dynamic-node,
+body.is-zooming .css3d-resolution-wrapper [id^="css3d-node-"],
+body.is-panning .css3d-resolution-wrapper [id^="css3d-node-"],
+body.is-node-dragging .css3d-resolution-wrapper [id^="css3d-node-"],
+body.is-resizing .css3d-resolution-wrapper [id^="css3d-node-"],
+body.mindcanvas-is-moving .css3d-resolution-wrapper [id^="css3d-node-"],
+body.mindcanvas-is-dense .css3d-resolution-wrapper [id^="css3d-node-"] {
+    -webkit-transition: none !important;
+    transition: none !important;
+    -webkit-filter: none !important;
+    filter: none !important;
+    -webkit-backdrop-filter: none !important;
+    backdrop-filter: none !important;
+    -webkit-box-shadow: none !important;
+    box-shadow: none !important;
+}

package/wwwroot/_content/MindExecution.Shared/js/mind-map-css3d-manager.js

@@ -795,26 +795,26 @@
                 max-height: none !important;
             }
 
-            /* Preserve agent memo chrome during camera motion so middle-button panning
-               does not visibly weaken their glow or console surfaces. */
-            body.is-zooming .css3d-resolution-wrapper:not(.selection-style-agent),
-            body.is-panning .css3d-resolution-wrapper:not(.selection-style-agent),
-            body.mindcanvas-is-moving .css3d-resolution-wrapper:not(.selection-style-agent),
-            body.mindcanvas-is-dense .css3d-resolution-wrapper:not(.selection-style-agent) {
+            /* Keep CSS3D nodes readable during camera motion, but drop expensive
+               decorative effects consistently across selected and agent-style nodes. */
+            body.is-zooming .css3d-resolution-wrapper,
+            body.is-panning .css3d-resolution-wrapper,
+            body.mindcanvas-is-moving .css3d-resolution-wrapper,
+            body.mindcanvas-is-dense .css3d-resolution-wrapper {
                 transition: none !important;
                 -webkit-transition: none !important;
                 filter: none !important;
                 -webkit-filter: none !important;
             }
 
-            body.is-zooming .css3d-resolution-wrapper:not(.selection-style-agent) .css3d-dynamic-node,
-            body.is-panning .css3d-resolution-wrapper:not(.selection-style-agent) .css3d-dynamic-node,
-            body.mindcanvas-is-moving .css3d-resolution-wrapper:not(.selection-style-agent) .css3d-dynamic-node,
-            body.mindcanvas-is-dense .css3d-resolution-wrapper:not(.selection-style-agent) .css3d-dynamic-node,
-            body.is-zooming .css3d-resolution-wrapper:not(.selection-style-agent) [id^="css3d-node-"],
-            body.is-panning .css3d-resolution-wrapper:not(.selection-style-agent) [id^="css3d-node-"],
-            body.mindcanvas-is-moving .css3d-resolution-wrapper:not(.selection-style-agent) [id^="css3d-node-"],
-            body.mindcanvas-is-dense .css3d-resolution-wrapper:not(.selection-style-agent) [id^="css3d-node-"] {
+            body.is-zooming .css3d-resolution-wrapper .css3d-dynamic-node,
+            body.is-panning .css3d-resolution-wrapper .css3d-dynamic-node,
+            body.mindcanvas-is-moving .css3d-resolution-wrapper .css3d-dynamic-node,
+            body.mindcanvas-is-dense .css3d-resolution-wrapper .css3d-dynamic-node,
+            body.is-zooming .css3d-resolution-wrapper [id^="css3d-node-"],
+            body.is-panning .css3d-resolution-wrapper [id^="css3d-node-"],
+            body.mindcanvas-is-moving .css3d-resolution-wrapper [id^="css3d-node-"],
+            body.mindcanvas-is-dense .css3d-resolution-wrapper [id^="css3d-node-"] {
                 box-shadow: none !important;
                 filter: none !important;
                 -webkit-filter: none !important;
@@ -895,10 +895,10 @@
             body.is-panning .ai-loading-row.ai-loading-row-media,
             body.mindcanvas-is-moving .ai-loading-row.ai-loading-row-media,
             body.mindcanvas-is-dense .ai-loading-row.ai-loading-row-media,
-            body.is-zooming .css3d-resolution-wrapper:not(.selection-style-agent) .map-node-memo__agent-console-panel,
-            body.is-panning .css3d-resolution-wrapper:not(.selection-style-agent) .map-node-memo__agent-console-panel,
-            body.mindcanvas-is-moving .css3d-resolution-wrapper:not(.selection-style-agent) .map-node-memo__agent-console-panel,
-            body.mindcanvas-is-dense .css3d-resolution-wrapper:not(.selection-style-agent) .map-node-memo__agent-console-panel {
+            body.is-zooming .css3d-resolution-wrapper .map-node-memo__agent-console-panel,
+            body.is-panning .css3d-resolution-wrapper .map-node-memo__agent-console-panel,
+            body.mindcanvas-is-moving .css3d-resolution-wrapper .map-node-memo__agent-console-panel,
+            body.mindcanvas-is-dense .css3d-resolution-wrapper .map-node-memo__agent-console-panel {
                 box-shadow: none !important;
                 backdrop-filter: none !important;
                 -webkit-backdrop-filter: none !important;

package/wwwroot/service-worker-assets.js

@@ -1,5 +1,5 @@
 self.assetsManifest = {
-    "version":  "zdahFh/b",
+    "version":  "RQBjk+TB",
     "assets":  [
                    {
                        "hash":  "sha256-+CSYMcqLNTsq3VnH11jgYyOCCdxvHzL74CBmo4sCmMU=",
@@ -42,7 +42,7 @@
                        "url":  "_content/MindExecution.Shared/css/app.css"
                    },
                    {
-                       "hash":  "sha256-29ALhCvhp5pZs7AXAjTpX+UCuf7jQSP6SQCn0p9Wb4Y=",
+                       "hash":  "sha256-vy6wZFJwYl0hLFMMhAKU4de+TPg7CJ91jMwnXl8GBqk=",
                        "url":  "_content/MindExecution.Shared/css/mind-map-overrides.css"
                    },
                    {
@@ -86,7 +86,7 @@
                        "url":  "_content/MindExecution.Shared/js/mind-map-core.js.backup"
                    },
                    {
-                       "hash":  "sha256-VJQ48zNB42JJETm59vTBtxdXez0dwIui6LnZUisNTSo=",
+                       "hash":  "sha256-f5vcy6AIq6e21hjCQlnjZnjQQ3s7wfbK4K6iW5IdBjU=",
                        "url":  "_content/MindExecution.Shared/js/mind-map-css3d-manager.js"
                    },
                    {

package/wwwroot/service-worker.js

@@ -1,4 +1,4 @@
-/* Manifest version: zdahFh/b */
+/* Manifest version: RQBjk+TB */
 // Hosted deployments should prefer the network over stale offline caches.
 // This service worker immediately clears old Blazor offline caches and unregisters itself.