@mindexec/cli 0.2.204 → 0.2.205

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.204",
+  "version": "0.2.205",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/server.js

@@ -3771,6 +3771,24 @@ function isRemoteAgentOutputReconnectSignal(text) {
 }
 
 function rememberRemoteAgentSyncReport(report) {
+    if (report?.authenticated !== true
+        && isRemoteAgentRegistryOwned()
+        && isRemoteAgentProcessRunning()
+        && /^(registry-auth-pending-agent-kept|registry-not-authenticated-agent-kept|session-expired-agent-kept)$/i.test(String(report.reason || ''))) {
+        const now = Date.now();
+        const key = `ignored-unauth|${report.reason || ''}|${remoteAgentState.manager || ''}|${remoteAgentState.leaseId || ''}`;
+        if (key !== remoteAgentSyncReportLogKey
+            || now - remoteAgentSyncReportLogAt >= REMOTE_AGENT_SYNC_REPORT_LOG_REPEAT_MS) {
+            remoteAgentSyncReportLogKey = key;
+            remoteAgentSyncReportLogAt = now;
+            logEvent(
+                'remote',
+                `registry sync ignored stale unauth report ${formatKeyValue('reason', report.reason || '-')} ${formatKeyValue('target', remoteAgentState.manager || '-')} ${formatKeyValue('auth', 'kept')}`,
+                'remote');
+        }
+        return false;
+    }
+
     remoteAgentSyncReportState = report;
     const reason = report.reason || report.error || (report.ok ? 'ok' : 'failed');
     const status = report.connected
@@ -3807,6 +3825,7 @@ function rememberRemoteAgentSyncReport(report) {
         'remote',
         `registry sync ${status} ${formatKeyValue('reason', reason)} ${formatKeyValue('target', report.targetEndpoint || '-')} ${formatKeyValue('auth', report.authenticated ? 'yes' : 'no')}`,
         'remote');
+    return true;
 }
 
 function appendRemoteAgentOutput(stream, chunk, stateConnectionKey = '') {
@@ -5841,6 +5860,28 @@ async function readFreshSupabaseSessionForRegistry(config, reason = 'registry')
     }
 }
 
+async function refreshSupabaseSessionAfterRegistryAuthFailure(config, trigger = 'registry-auth-failure') {
+    if (!config?.url || !config?.key) {
+        return {
+            ok: false,
+            reason: 'supabase-config-missing'
+        };
+    }
+
+    const sessionPayload = await readStableAuthSessionPayload();
+    if (!sessionPayload.found) {
+        return {
+            ok: false,
+            reason: 'registry-not-authenticated'
+        };
+    }
+
+    return await refreshSupabaseSessionForRegistry(
+        config,
+        sessionPayload,
+        `registry-auth-failure-${safeRemoteAgentField(trigger || 'timer', 80)}`);
+}
+
 function readRegistryTargetField(target, ...keys) {
     for (const key of keys) {
         const value = target?.[key];
@@ -6595,8 +6636,9 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
 
     remoteRegistryFollowerInFlight = true;
     const attemptedAt = new Date().toISOString();
+    let config = null;
     try {
-        const config = readSupabaseRuntimeConfig();
+        config = readSupabaseRuntimeConfig();
         if (!config.url || !config.key) {
             closeRemoteRegistryRealtime('supabase-config-missing');
             updateRemoteRegistryFollowerState({
@@ -6968,6 +7010,45 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
         return serializeRemoteRegistryFollowerState();
     } catch (error) {
         const transientAuth = error?.statusCode === 401 || error?.statusCode === 403;
+        if (transientAuth) {
+            const agentKept = isRemoteAgentRegistryOwned() && isRemoteAgentProcessRunning();
+            const keptManager = agentKept ? safeRemoteAgentField(remoteAgentState.manager, 160) : '';
+            const keptCandidates = agentKept ? normalizeRemoteManagerEndpointList(remoteAgentState.managerCandidates, remoteAgentState.manager) : [];
+            const refreshed = await refreshSupabaseSessionAfterRegistryAuthFailure(config, trigger).catch(refreshError => ({
+                ok: false,
+                reason: refreshError?.message || String(refreshError || 'auth-refresh-failed')
+            }));
+
+            if (refreshed?.ok === true && refreshed.session) {
+                updateRemoteRegistryFollowerState({
+                    status: 'auth-refreshed',
+                    reason: agentKept ? 'registry-auth-refreshed-agent-kept' : 'registry-auth-refreshed',
+                    authenticated: true,
+                    lastAttemptAt: attemptedAt,
+                    lastError: '',
+                    targetEndpoint: keptManager,
+                    targetEndpointCandidates: keptCandidates,
+                    targetLeaseId: agentKept ? safeRemoteAgentField(remoteAgentState.leaseId, 128) : '',
+                    targetNodeId: agentKept ? safeRemoteAgentField(remoteAgentState.nodeId, 128) : '',
+                    agentKept
+                });
+                await reportRemoteRegistryFollowerSync({
+                    ok: true,
+                    skipped: true,
+                    reason: agentKept ? 'registry-auth-refreshed-agent-kept' : 'registry-auth-refreshed',
+                    trigger,
+                    authenticated: true,
+                    targetEndpoint: keptManager,
+                    targetEndpointCandidates: keptCandidates,
+                    targetLeaseId: agentKept ? remoteAgentState.leaseId : '',
+                    targetNodeId: agentKept ? remoteAgentState.nodeId : '',
+                    agentKept
+                });
+                scheduleRemoteRegistryFollower(0, 'auth-refreshed');
+                return serializeRemoteRegistryFollowerState();
+            }
+        }
+
         updateRemoteRegistryFollowerState({
             status: transientAuth ? 'auth-pending' : 'error',
             reason: transientAuth ? 'registry-auth-pending' : 'registry-sync-failed',