@mindexec/cli 0.2.186 → 0.2.187

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.186",
+  "version": "0.2.187",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/scripts/remote-registry-follower-smoke.mjs

@@ -15,6 +15,9 @@ const PAIR_TOKEN = 'remote-registry-follower-pair-token';
 const USER_ID = '11111111-2222-4333-8444-555555555555';
 const SUPABASE_KEY = 'remote-registry-follower-key';
 const ACCESS_TOKEN = 'remote-registry-follower-access-token';
+const EXPIRED_ACCESS_TOKEN = 'remote-registry-follower-expired-access-token';
+const REFRESHED_ACCESS_TOKEN = 'remote-registry-follower-refreshed-access-token';
+const REFRESH_TOKEN = 'remote-registry-follower-refresh-token';
 const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 function wait(ms) {
@@ -86,6 +89,14 @@ function createRegistryTarget({ endpoint, endpointCandidates, leaseId, active =
 function startFakeSupabase(getTarget, setTarget = null) {
     const requests = [];
     const realtimeClients = new Set();
+    const validAccessTokens = new Set([ACCESS_TOKEN]);
+    const assertRegistryAuth = req => {
+        assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+        const authorization = String(req.headers.authorization || '');
+        assert.ok(
+            validAccessTokens.has(authorization.replace(/^Bearer\s+/i, '')),
+            `unexpected registry authorization: ${authorization}`);
+    };
     const server = createServer(async (req, res) => {
         const readBody = () => new Promise(resolve => {
             let body = '';
@@ -103,8 +114,7 @@ function startFakeSupabase(getTarget, setTarget = null) {
         });
 
         if (req.method === 'GET' && parsed.pathname === '/rest/v1/remote_host_targets') {
-            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            assertRegistryAuth(req);
             res.writeHead(200, {
                 'Content-Type': 'application/json',
                 'Cache-Control': 'no-store'
@@ -115,8 +125,7 @@ function startFakeSupabase(getTarget, setTarget = null) {
         }
 
         if (req.method === 'POST' && parsed.pathname === '/rest/v1/rpc/set_remote_host_target') {
-            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-            assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
+            assertRegistryAuth(req);
             const body = JSON.parse(await readBody() || '{}');
             const now = Date.now();
             const existing = getTarget();
@@ -148,6 +157,31 @@ function startFakeSupabase(getTarget, setTarget = null) {
             return;
         }
 
+        if (req.method === 'POST' && parsed.pathname === '/auth/v1/token') {
+            assert.equal(parsed.searchParams.get('grant_type'), 'refresh_token');
+            assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
+            assert.equal(String(req.headers.authorization || ''), `Bearer ${SUPABASE_KEY}`);
+            const body = JSON.parse(await readBody() || '{}');
+            assert.equal(body.refresh_token, REFRESH_TOKEN);
+            validAccessTokens.add(REFRESHED_ACCESS_TOKEN);
+            res.writeHead(200, {
+                'Content-Type': 'application/json',
+                'Cache-Control': 'no-store'
+            });
+            res.end(JSON.stringify({
+                access_token: REFRESHED_ACCESS_TOKEN,
+                refresh_token: REFRESH_TOKEN,
+                token_type: 'bearer',
+                expires_in: 3600,
+                expires_at: Math.floor(Date.now() / 1000) + 3600,
+                user: {
+                    id: USER_ID,
+                    email: 'remote-registry-follower@example.test'
+                }
+            }));
+            return;
+        }
+
         res.writeHead(404, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'not-found' }));
     });
@@ -166,8 +200,8 @@ function startFakeSupabase(getTarget, setTarget = null) {
 
             if (message.event === 'phx_join') {
                 assert.equal(String(req.headers.apikey || ''), SUPABASE_KEY);
-                assert.equal(String(req.headers.authorization || ''), `Bearer ${ACCESS_TOKEN}`);
-                assert.equal(message.payload?.access_token, ACCESS_TOKEN);
+                assert.ok(validAccessTokens.has(String(req.headers.authorization || '').replace(/^Bearer\s+/i, '')));
+                assert.ok(validAccessTokens.has(String(message.payload?.access_token || '')));
                 assert.deepEqual(
                     message.payload?.config?.postgres_changes?.[0],
                     {
@@ -338,10 +372,14 @@ async function waitForBridge(bridge) {
     }, 30000, `bridge startup\n${bridge.details()}`);
 }
 
-function createSessionPayload() {
+function createSessionPayload(options = {}) {
+    const accessToken = options.accessToken || ACCESS_TOKEN;
+    const refreshToken = options.refreshToken || REFRESH_TOKEN;
+    const expiresAt = options.expiresAt ?? Math.floor(Date.now() / 1000) + 3600;
     return JSON.stringify({
-        access_token: ACCESS_TOKEN,
-        expires_at: Math.floor(Date.now() / 1000) + 3600,
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt,
         user: {
             id: USER_ID,
             email: 'remote-registry-follower@example.test'
@@ -349,9 +387,9 @@ function createSessionPayload() {
     });
 }
 
-async function writeSession(authRoot) {
+async function writeSession(authRoot, options = {}) {
     await mkdir(authRoot, { recursive: true });
-    await writeFile(path.join(authRoot, 'supabase-session.json'), createSessionPayload(), 'utf8');
+    await writeFile(path.join(authRoot, 'supabase-session.json'), createSessionPayload(options), 'utf8');
 }
 
 async function waitForManagedAgent(bridge, managerEndpoint, label, timeoutMs = 20000) {
@@ -435,7 +473,10 @@ async function main() {
         const hostBAuth = path.join(tempRoot, 'auth-host-b');
         const clientAuth = path.join(tempRoot, 'auth-client');
         await writeSession(renewHostAuth);
-        await writeSession(clientAuth);
+        await writeSession(clientAuth, {
+            accessToken: EXPIRED_ACCESS_TOKEN,
+            expiresAt: Math.floor(Date.now() / 1000) - 30
+        });
 
         renewHost = spawnBridge({
             bridgePort: renewHostBridgePort,
@@ -544,6 +585,17 @@ async function main() {
         assert.match(String(firstAgent.launcher || ''), /mindexec-remote-fast/i);
         assert.equal(firstAgent.manager, hostAEndpoint);
         assert.equal(firstAgent.managerCandidates?.[0], staleEndpoint, JSON.stringify(firstAgent.managerCandidates));
+        assert.ok(
+            fakeSupabase.requests.some(request =>
+                request.method === 'POST'
+                && request.pathname === '/auth/v1/token'),
+            'expected LocalBridge to refresh expired persisted Supabase session without browser involvement');
+        assert.ok(
+            fakeSupabase.requests.some(request =>
+                request.method === 'GET'
+                && request.pathname === '/rest/v1/remote_host_targets'
+                && request.authorization === `Bearer ${REFRESHED_ACCESS_TOKEN}`),
+            'expected registry read to use refreshed access token');
         await waitForConnectedDevice(hostA, 'host-a');
         const firstStatus = await fetchJson(`${client.baseUrl}/api/status`);
         assert.equal(firstStatus.payload?.remoteRegistryRealtime?.subscribed, true, JSON.stringify(firstStatus.payload?.remoteRegistryRealtime));

package/server.js

@@ -3388,6 +3388,7 @@ const REMOTE_REGISTRY_FOLLOWER_MISSING_SESSION_FAST_RETRY_COUNT = Math.max(
     Number(process.env.MINDEXEC_REMOTE_REGISTRY_MISSING_SESSION_FAST_RETRY_COUNT || 5) || 5);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_STOP_COUNT = Math.max(2, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_STOP_COUNT || 8) || 8);
 const REMOTE_REGISTRY_FOLLOWER_INACTIVE_GRACE_MS = Math.max(500, Number(process.env.MINDEXEC_REMOTE_REGISTRY_INACTIVE_GRACE_MS || 60000) || 60000);
+const REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS = Math.max(15_000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS || 120_000) || 120_000);
 const REMOTE_REGISTRY_REALTIME_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
     && !/^(0|false|no|off)$/i.test(String(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME || 'true'));
 const REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS = Math.max(10000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS || 25000) || 25000);
@@ -3426,6 +3427,7 @@ let remoteRegistryFollowerStarted = false;
 let remoteRegistryFollowerConsecutiveMissingSession = 0;
 let remoteRegistryFollowerConsecutiveInactiveTarget = 0;
 let remoteRegistryFollowerInactiveTargetFirstAt = 0;
+let remoteRegistrySessionRefreshPromise = null;
 let remoteRegistryRealtimeSocket = null;
 let remoteRegistryRealtimeSessionKey = '';
 let remoteRegistryRealtimeTopic = '';
@@ -5533,6 +5535,75 @@ function readSupabaseSessionField(source, ...keys) {
     return '';
 }
 
+function parseSupabaseSessionExpiresAtMs(value) {
+    if (value === undefined || value === null || String(value).trim() === '') {
+        return 0;
+    }
+
+    const numeric = Number(value);
+    if (Number.isFinite(numeric) && numeric > 0) {
+        return numeric > 9999999999 ? numeric : numeric * 1000;
+    }
+
+    const parsed = Date.parse(String(value));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function setSupabaseSessionKnownField(session, value, fallbackKey, ...keys) {
+    let wrote = false;
+    for (const key of keys) {
+        if (Object.prototype.hasOwnProperty.call(session, key)) {
+            session[key] = value;
+            wrote = true;
+        }
+    }
+
+    if (!wrote) {
+        session[fallbackKey] = value;
+    }
+}
+
+function buildRefreshedSupabaseSessionPayload(content, refreshedSession) {
+    const existing = JSON.parse(String(content || '{}'));
+    const accessToken = String(readSupabaseSessionField(refreshedSession, 'access_token', 'accessToken', 'AccessToken')).trim();
+    const refreshToken = String(readSupabaseSessionField(refreshedSession, 'refresh_token', 'refreshToken', 'RefreshToken')).trim()
+        || String(readSupabaseSessionField(existing, 'refresh_token', 'refreshToken', 'RefreshToken')).trim();
+    const tokenType = String(readSupabaseSessionField(refreshedSession, 'token_type', 'tokenType', 'TokenType')).trim()
+        || String(readSupabaseSessionField(existing, 'token_type', 'tokenType', 'TokenType')).trim()
+        || 'bearer';
+    const expiresInRaw = Number(readSupabaseSessionField(refreshedSession, 'expires_in', 'expiresIn', 'ExpiresIn') || 0);
+    const expiresAtFromResponse = readSupabaseSessionField(refreshedSession, 'expires_at', 'expiresAt', 'ExpiresAt');
+    const expiresAtMs = parseSupabaseSessionExpiresAtMs(expiresAtFromResponse)
+        || (Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? Date.now() + (expiresInRaw * 1000) : 0);
+    const expiresAtSeconds = expiresAtMs > 0 ? Math.floor(expiresAtMs / 1000) : 0;
+
+    if (!accessToken || !refreshToken || !expiresAtSeconds) {
+        const error = new Error('auth-refresh-response-incomplete');
+        error.statusCode = 502;
+        throw error;
+    }
+
+    setSupabaseSessionKnownField(existing, accessToken, 'access_token', 'access_token', 'accessToken', 'AccessToken');
+    setSupabaseSessionKnownField(existing, refreshToken, 'refresh_token', 'refresh_token', 'refreshToken', 'RefreshToken');
+    setSupabaseSessionKnownField(existing, tokenType, 'token_type', 'token_type', 'tokenType', 'TokenType');
+    setSupabaseSessionKnownField(existing, expiresAtSeconds, 'expires_at', 'expires_at', 'expiresAt', 'ExpiresAt');
+
+    if (Number.isFinite(expiresInRaw) && expiresInRaw > 0) {
+        setSupabaseSessionKnownField(existing, Math.floor(expiresInRaw), 'expires_in', 'expires_in', 'expiresIn', 'ExpiresIn');
+    }
+
+    const user = refreshedSession?.user || refreshedSession?.User;
+    if (user && typeof user === 'object') {
+        if (Object.prototype.hasOwnProperty.call(existing, 'User')) {
+            existing.User = user;
+        } else {
+            existing.user = user;
+        }
+    }
+
+    return JSON.stringify(existing);
+}
+
 function parseSupabaseSessionForRegistry(content) {
     let session = null;
     try {
@@ -5543,13 +5614,11 @@ function parseSupabaseSessionForRegistry(content) {
 
     const user = session?.user || session?.User || {};
     const accessToken = String(readSupabaseSessionField(session, 'access_token', 'accessToken', 'AccessToken')).trim();
+    const refreshToken = String(readSupabaseSessionField(session, 'refresh_token', 'refreshToken', 'RefreshToken')).trim();
     const userId = String(
         readSupabaseSessionField(user, 'id', 'Id')
         || readSupabaseSessionField(session, 'user_id', 'userId', 'UserId')).trim();
-    const expiresAtRaw = Number(readSupabaseSessionField(session, 'expires_at', 'expiresAt', 'ExpiresAt') || 0);
-    const expiresAtMs = Number.isFinite(expiresAtRaw) && expiresAtRaw > 0
-        ? (expiresAtRaw > 9999999999 ? expiresAtRaw : expiresAtRaw * 1000)
-        : 0;
+    const expiresAtMs = parseSupabaseSessionExpiresAtMs(readSupabaseSessionField(session, 'expires_at', 'expiresAt', 'ExpiresAt'));
 
     if (!accessToken || !userId) {
         return null;
@@ -5557,11 +5626,143 @@ function parseSupabaseSessionForRegistry(content) {
 
     return {
         accessToken,
+        refreshToken,
         userId,
         expiresAtMs
     };
 }
 
+async function refreshSupabaseSessionForRegistry(config, sessionPayload, reason = 'registry') {
+    const currentSession = parseSupabaseSessionForRegistry(sessionPayload?.content);
+    if (!currentSession?.refreshToken) {
+        return {
+            ok: false,
+            reason: 'refresh-token-missing'
+        };
+    }
+
+    if (remoteRegistrySessionRefreshPromise) {
+        return await remoteRegistrySessionRefreshPromise;
+    }
+
+    remoteRegistrySessionRefreshPromise = (async () => {
+        const url = new URL('/auth/v1/token', config.url);
+        url.searchParams.set('grant_type', 'refresh_token');
+        const response = await fetch(url.toString(), {
+            method: 'POST',
+            headers: {
+                apikey: config.key,
+                Authorization: `Bearer ${config.key}`,
+                Accept: 'application/json',
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                refresh_token: currentSession.refreshToken
+            })
+        });
+
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            const error = new Error(`auth-refresh-${response.status}${text ? `:${shortenText(text, 160)}` : ''}`);
+            error.statusCode = response.status;
+            throw error;
+        }
+
+        const refreshed = await response.json();
+        const content = buildRefreshedSupabaseSessionPayload(sessionPayload.content, refreshed);
+        await writeStableAuthSessionPayload(content);
+        const session = parseSupabaseSessionForRegistry(content);
+        if (!session) {
+            const error = new Error('auth-refresh-session-parse-failed');
+            error.statusCode = 502;
+            throw error;
+        }
+
+        logEvent(
+            'remote',
+            `registry auth refreshed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('expiresInMs', Math.max(0, session.expiresAtMs - Date.now()))}`,
+            'remote');
+
+        return {
+            ok: true,
+            reason: 'refreshed',
+            content,
+            session
+        };
+    })();
+
+    try {
+        return await remoteRegistrySessionRefreshPromise;
+    } finally {
+        remoteRegistrySessionRefreshPromise = null;
+    }
+}
+
+async function readFreshSupabaseSessionForRegistry(config, reason = 'registry') {
+    const sessionPayload = await readStableAuthSessionPayload();
+    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    if (!session) {
+        return {
+            found: sessionPayload.found,
+            payload: sessionPayload,
+            session: null,
+            refreshed: false,
+            expired: false
+        };
+    }
+
+    const now = Date.now();
+    const shouldRefresh = session.expiresAtMs > 0
+        && session.expiresAtMs <= now + REMOTE_REGISTRY_SESSION_REFRESH_LEAD_MS;
+    if (!shouldRefresh) {
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= now
+        };
+    }
+
+    try {
+        const refreshed = await refreshSupabaseSessionForRegistry(config, sessionPayload, reason);
+        if (refreshed.ok && refreshed.session) {
+            return {
+                found: true,
+                payload: {
+                    ...sessionPayload,
+                    content: refreshed.content,
+                    refreshed: true
+                },
+                session: refreshed.session,
+                refreshed: true,
+                expired: false
+            };
+        }
+
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= Date.now(),
+            refreshError: refreshed.reason || 'auth-refresh-skipped'
+        };
+    } catch (error) {
+        logWarn(
+            'remote',
+            `registry auth refresh failed ${formatKeyValue('reason', reason || 'registry')} ${formatKeyValue('error', error?.message || String(error || ''))}`);
+        return {
+            found: true,
+            payload: sessionPayload,
+            session,
+            refreshed: false,
+            expired: session.expiresAtMs > 0 && session.expiresAtMs <= Date.now(),
+            refreshError: error?.message || String(error || '')
+        };
+    }
+}
+
 function readRegistryTargetField(target, ...keys) {
     for (const key of keys) {
         const value = target?.[key];
@@ -5700,13 +5901,13 @@ async function readRemoteRegistryContext() {
         return { ok: false, reason: 'supabase-config-missing' };
     }
 
-    const sessionPayload = await readStableAuthSessionPayload();
-    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    const sessionState = await readFreshSupabaseSessionForRegistry(config, 'registry-context');
+    const session = sessionState.session;
     if (!session) {
         return { ok: false, reason: 'registry-not-authenticated' };
     }
 
-    if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+    if (sessionState.expired || (session.expiresAtMs && session.expiresAtMs <= Date.now())) {
         return { ok: false, reason: 'session-expired' };
     }
 
@@ -6321,8 +6522,8 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
             return serializeRemoteRegistryFollowerState();
         }
 
-        const sessionPayload = await readStableAuthSessionPayload();
-        const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+        const sessionState = await readFreshSupabaseSessionForRegistry(config, `follower-${trigger || 'timer'}`);
+        const session = sessionState.session;
         if (!session) {
             closeRemoteRegistryRealtime('registry-not-authenticated');
             remoteRegistryFollowerConsecutiveMissingSession += 1;
@@ -6368,23 +6569,39 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
         }
 
         remoteRegistryFollowerConsecutiveMissingSession = 0;
-        if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+        if (sessionState.expired || (session.expiresAtMs && session.expiresAtMs <= Date.now())) {
             closeRemoteRegistryRealtime('session-expired');
+            const agentKept = isRemoteAgentRegistryOwned() && isRemoteAgentProcessRunning();
+            const reason = agentKept
+                ? 'session-expired-agent-kept'
+                : 'session-expired';
+            const keptManager = agentKept ? safeRemoteAgentField(remoteAgentState.manager, 160) : '';
+            const keptCandidates = agentKept ? normalizeRemoteManagerEndpointList(remoteAgentState.managerCandidates, remoteAgentState.manager) : [];
             updateRemoteRegistryFollowerState({
-                status: 'skipped',
-                reason: 'session-expired',
+                status: agentKept ? 'auth-pending' : 'skipped',
+                reason,
                 authenticated: false,
                 lastAttemptAt: attemptedAt,
-                lastError: ''
+                lastError: sessionState.refreshError || '',
+                targetEndpoint: keptManager,
+                targetEndpointCandidates: keptCandidates,
+                targetLeaseId: agentKept ? safeRemoteAgentField(remoteAgentState.leaseId, 128) : '',
+                targetNodeId: agentKept ? safeRemoteAgentField(remoteAgentState.nodeId, 128) : '',
+                agentKept
             });
             await reportRemoteRegistryFollowerSync({
                 ok: true,
                 skipped: true,
-                reason: 'session-expired',
+                reason,
                 trigger,
-                authenticated: false
+                authenticated: false,
+                targetEndpoint: keptManager,
+                targetEndpointCandidates: keptCandidates,
+                targetLeaseId: agentKept ? remoteAgentState.leaseId : '',
+                targetNodeId: agentKept ? remoteAgentState.nodeId : '',
+                agentKept
             });
-            scheduleRemoteRegistryFollower(REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'session-expired');
+            scheduleRemoteRegistryFollower(agentKept ? REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS : REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'session-expired');
             return serializeRemoteRegistryFollowerState();
         }