@mindexec/cli 0.2.209 → 0.2.211

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindexec/cli",
-  "version": "0.2.209",
+  "version": "0.2.211",
   "description": "MindExec local runtime and bridge CLI",
   "main": "server.js",
   "type": "module",

package/scripts/auth-session-smoke.mjs

@@ -138,11 +138,25 @@ try {
     const sessionPayload = JSON.stringify({
         access_token: 'access-token-a',
         refresh_token: 'refresh-token-a',
+        expires_at: Math.floor(Date.now() / 1000) + 600,
         user: {
             id: 'user-a',
             email: 'auth-smoke@example.com'
         }
     });
+    let expectedStablePayload = sessionPayload;
+
+    function makeTimedSessionPayload(accessToken, refreshToken, expiresInSeconds) {
+        return JSON.stringify({
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            expires_at: Math.floor(Date.now() / 1000) + expiresInSeconds,
+            user: {
+                id: 'user-a',
+                email: 'auth-smoke@example.com'
+            }
+        });
+    }
 
     await withBridge({ workspacePath: workspaceA, authDataRoot }, async (baseUrl) => {
         const unauthorized = await fetchJson(`${baseUrl}/api/auth/session`);
@@ -170,12 +184,41 @@ try {
         assert.equal(loaded.status, 200);
         assert.equal(loaded.payload?.content, sessionPayload);
         assert.equal(loaded.payload?.source, 'stable');
+
+        const newerPayload = makeTimedSessionPayload('access-token-newer', 'refresh-token-newer', 3600);
+        const newerSaved = await fetchJson(`${baseUrl}/api/auth/session`, {
+            method: 'POST',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({ content: newerPayload })
+        });
+        assert.equal(newerSaved.status, 200);
+
+        const staleBrowserPayload = makeTimedSessionPayload('access-token-stale-browser', 'refresh-token-stale-browser', 120);
+        const staleSaved = await fetchJson(`${baseUrl}/api/auth/session`, {
+            method: 'POST',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({ content: staleBrowserPayload })
+        });
+        assert.equal(staleSaved.status, 200);
+
+        const afterStale = await fetchJson(`${baseUrl}/api/auth/session`, { token: BRIDGE_TOKEN });
+        assert.equal(afterStale.status, 200);
+        assert.equal(JSON.parse(afterStale.payload?.content || '{}').access_token, 'access-token-newer');
+
+        const newestPayload = makeTimedSessionPayload('access-token-newest', 'refresh-token-newest', 7200);
+        const newestSaved = await fetchJson(`${baseUrl}/api/auth/session`, {
+            method: 'POST',
+            token: BRIDGE_TOKEN,
+            body: JSON.stringify({ content: newestPayload })
+        });
+        assert.equal(newestSaved.status, 200);
+        expectedStablePayload = newestPayload;
     });
 
     await withBridge({ workspacePath: workspaceB, authDataRoot }, async (baseUrl) => {
         const loaded = await fetchJson(`${baseUrl}/api/auth/session`, { token: BRIDGE_TOKEN });
         assert.equal(loaded.status, 200);
-        assert.equal(loaded.payload?.content, sessionPayload);
+        assert.equal(loaded.payload?.content, expectedStablePayload);
         assert.equal(loaded.payload?.source, 'stable');
 
         const deleted = await fetchJson(`${baseUrl}/api/auth/session`, {

package/server.js

@@ -669,10 +669,49 @@ async function readStableAuthSessionPayload() {
 async function writeStableAuthSessionPayload(content) {
     const payload = validateAuthSessionPayload(content);
     const stablePath = getStableSupabaseSessionPath();
+    const existingPayload = await tryReadTextFile(stablePath);
+    if (shouldKeepExistingAuthSessionPayload(existingPayload, payload)) {
+        return stablePath;
+    }
+
     await writePrivateTextFile(stablePath, payload);
     return stablePath;
 }
 
+function shouldKeepExistingAuthSessionPayload(existingContent, incomingContent) {
+    if (!existingContent || !String(existingContent).trim()) {
+        return false;
+    }
+
+    const existing = parseSupabaseSessionForRegistry(existingContent);
+    const incoming = parseSupabaseSessionForRegistry(incomingContent);
+    if (!existing || !incoming) {
+        return false;
+    }
+
+    if (!existing.userId || !incoming.userId || existing.userId !== incoming.userId) {
+        return false;
+    }
+
+    if (!Number.isFinite(existing.expiresAtMs) || !Number.isFinite(incoming.expiresAtMs)) {
+        return false;
+    }
+
+    const now = Date.now();
+    const existingRemainingMs = existing.expiresAtMs - now;
+    const incomingRemainingMs = incoming.expiresAtMs - now;
+    const staleSkewMs = 30_000;
+    if (existingRemainingMs <= staleSkewMs || incoming.expiresAtMs + staleSkewMs >= existing.expiresAtMs) {
+        return false;
+    }
+
+    logEvent(
+        'remote',
+        `auth session write ignored stale payload ${formatKeyValue('existingMs', Math.max(0, existingRemainingMs))} ${formatKeyValue('incomingMs', Math.max(0, incomingRemainingMs))}`,
+        'remote');
+    return true;
+}
+
 async function deleteStableAuthSessionPayload() {
     const paths = [
         getStableSupabaseSessionPath(),
@@ -3610,13 +3649,14 @@ function createRemoteAgentIdleState(overrides = {}) {
         stderrTail: '',
         launcher: '',
         usingNpx: false,
+        pairToken: '',
         proc: null,
         ...overrides
     };
 }
 
 function serializeRemoteAgentState() {
-    const { proc, ...publicState } = remoteAgentState;
+    const { proc, pairToken, ...publicState } = remoteAgentState;
     return {
         ...publicState,
         registrySync: remoteAgentSyncReportState,
@@ -3757,6 +3797,32 @@ function markRemoteAgentReconnectNeededFromReport(report) {
     return markRemoteAgentReconnectNeeded(reason, 'agent-sync-report-disconnected');
 }
 
+function isRecentRemoteRegistryFollowerAuthenticated(maxAgeMs = 120000) {
+    if (remoteRegistryFollowerState?.authenticated !== true) {
+        return false;
+    }
+
+    const lastSuccessAt = Date.parse(remoteRegistryFollowerState.lastSuccessAt || remoteRegistryFollowerState.lastAttemptAt || '');
+    return Number.isFinite(lastSuccessAt) && Date.now() - lastSuccessAt <= maxAgeMs;
+}
+
+function shouldIgnoreBrowserUnauthRemoteAgentSyncReport(report) {
+    if (!report
+        || report.authenticated === true
+        || !/^(sync|browser-sync|web-sync)$/i.test(String(report.trigger || ''))) {
+        return false;
+    }
+
+    const reason = String(report.reason || report.error || '').trim();
+    if (!/^(registry-not-authenticated|registry-auth-pending|session-expired|registry-auth-pending-agent-kept|registry-not-authenticated-agent-kept|session-expired-agent-kept)$/i.test(reason)) {
+        return false;
+    }
+
+    return report.localHostTargetActive === true
+        || isLocalRemoteHostTargetActive()
+        || isRecentRemoteRegistryFollowerAuthenticated();
+}
+
 function isRemoteAgentOutputReconnectSignal(text) {
     const normalized = String(text || '').toLowerCase();
     if (!normalized) {
@@ -3771,6 +3837,22 @@ function isRemoteAgentOutputReconnectSignal(text) {
 }
 
 function rememberRemoteAgentSyncReport(report) {
+    if (shouldIgnoreBrowserUnauthRemoteAgentSyncReport(report)) {
+        const now = Date.now();
+        const key = `ignored-browser-unauth|${report.reason || report.error || ''}|${remoteRegistryFollowerState.reason || ''}|${isLocalRemoteHostTargetActive() ? 'local-host' : 'follower-auth'}`;
+        if (key !== remoteAgentSyncReportLogKey
+            || now - remoteAgentSyncReportLogAt >= REMOTE_AGENT_SYNC_REPORT_LOG_REPEAT_MS) {
+            remoteAgentSyncReportLogKey = key;
+            remoteAgentSyncReportLogAt = now;
+            logEvent(
+                'remote',
+                `registry sync ignored browser unauth report ${formatKeyValue('reason', report.reason || report.error || '-')} ${formatKeyValue('bridgeAuth', remoteRegistryFollowerState?.authenticated ? 'yes' : 'no')} ${formatKeyValue('localHost', isLocalRemoteHostTargetActive() ? 'yes' : 'no')}`,
+                'remote');
+        }
+        scheduleRemoteHostTargetRenewWake('ignored-browser-unauth-report', { throttleMs: REMOTE_HOST_TARGET_WAKE_RENEW_MS });
+        return false;
+    }
+
     if (report?.authenticated !== true
         && isRemoteAgentRegistryOwned()
         && isRemoteAgentProcessRunning()
@@ -4266,6 +4348,39 @@ function rememberRemoteRegistryInactiveTarget(reason = 'no-active-target') {
     };
 }
 
+async function maybeRestartKeptRemoteAgentForMissingRegistryTarget(reason = 'no-active-target') {
+    if (!isRemoteAgentRegistryOwned()
+        || !isRemoteAgentProcessRunning()
+        || isRemoteAgentReadyDataPlaneAlive()
+        || !isRemoteAgentRunningButNotReadyStale()) {
+        return null;
+    }
+
+    const managerCandidates = normalizeRemoteManagerEndpointList(remoteAgentState.managerCandidates, remoteAgentState.manager);
+    const manager = managerCandidates[0] || normalizeRemoteManagerEndpoint(remoteAgentState.manager);
+    const pairToken = safeRemoteAgentField(remoteAgentState.pairToken, 512);
+    if (!manager || !pairToken) {
+        markRemoteAgentReconnectNeeded(`${reason}-missing-target-agent-stale`, 'missing-target-agent-stale');
+        return {
+            ok: false,
+            error: pairToken ? 'missing-manager' : 'missing-pair-token'
+        };
+    }
+
+    logWarn(
+        'remote',
+        `registry target missing but managed RemoteAgent is stale; reconnecting previous manager ${formatKeyValue('reason', reason)} ${formatKeyValue('manager', manager)}`);
+    return await startRemoteAgentConnection({
+        manager,
+        managerCandidates,
+        pairToken,
+        leaseId: remoteAgentState.leaseId,
+        nodeId: remoteAgentState.nodeId,
+        engine: remoteAgentState.engine || 'auto',
+        source: remoteAgentState.source || 'local-bridge-registry-recovery'
+    });
+}
+
 function isLocalRemoteHostTargetActive() {
     const status = remoteHub.getStatus({ includeSecrets: false });
     return status?.hostTargetActive === true
@@ -4704,6 +4819,7 @@ function createRemoteAgentAttempt(options = {}) {
                 managerCandidates,
                 leaseId,
                 nodeId,
+                pairToken,
                 engine,
                 source,
                 connectionKey,
@@ -4718,6 +4834,7 @@ function createRemoteAgentAttempt(options = {}) {
         managerCandidates,
         leaseId,
         nodeId,
+        pairToken,
         engine,
         source,
         connectionKey,
@@ -4855,6 +4972,7 @@ async function startRemoteAgentConnectionRace(options = {}) {
         managerCandidates: managers,
         leaseId,
         nodeId,
+        pairToken,
         engine,
         source,
         startedAt: new Date().toISOString(),
@@ -4992,6 +5110,7 @@ async function startRemoteAgentConnectionAttempt(options = {}) {
         managerCandidates,
         leaseId,
         nodeId,
+        pairToken,
         engine,
         source,
         connectionKey,
@@ -6910,6 +7029,9 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
                 ? 'registry-inactive'
                 : 'no-active-target';
             const inactive = rememberRemoteRegistryInactiveTarget(inactiveReason);
+            const recovery = inactive.agentKept
+                ? await maybeRestartKeptRemoteAgentForMissingRegistryTarget(inactiveReason)
+                : null;
             if (inactive.confirmedInactive && isRemoteAgentRegistryOwned()) {
                 await stopRemoteAgentConnection('registry-inactive');
             }
@@ -6929,12 +7051,15 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
                 inactiveElapsedMs: inactive.elapsedMs,
                 agentKept: inactive.agentKept,
                 dataPlaneReady: inactive.dataPlaneReady,
-                lastError: ''
+                lastError: recovery?.ok === false ? (recovery.error || 'missing-target-agent-recovery-failed') : ''
             });
             await reportRemoteRegistryFollowerSync({
-                ok: true,
+                ok: recovery?.ok === false ? false : true,
                 skipped: true,
-                reason: inactive.agentKept ? `${inactiveReason}-agent-kept` : inactiveReason,
+                reason: recovery?.ok === true
+                    ? `${inactiveReason}-agent-recovered`
+                    : (inactive.agentKept ? `${inactiveReason}-agent-kept` : inactiveReason),
+                error: recovery?.ok === false ? recovery.error : '',
                 trigger,
                 authenticated: true,
                 targetEndpoint: keptManager,
@@ -6946,7 +7071,11 @@ async function runRemoteRegistryFollowerOnce(trigger = 'timer') {
                 agentKept: inactive.agentKept,
                 dataPlaneReady: inactive.dataPlaneReady
             });
-            scheduleRemoteRegistryFollower(REMOTE_REGISTRY_FOLLOWER_POLL_MS, 'no-target');
+            scheduleRemoteRegistryFollower(
+                inactive.agentKept && !inactive.dataPlaneReady
+                    ? REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS
+                    : REMOTE_REGISTRY_FOLLOWER_POLL_MS,
+                recovery?.ok === true ? 'missing-target-agent-recovered' : 'no-target');
             return serializeRemoteRegistryFollowerState();
         }
 

package/wwwroot/_framework/blazor.boot.json

@@ -1,7 +1,7 @@
 {
   "mainAssemblyName": "MindExecution.Web",
   "resources": {
-    "hash": "sha256-Ny3t+3+wMEcLBIrH8PviSLxWnIKH3h8bXWdrXi8ESDY=",
+    "hash": "sha256-iiSeCvB5NpvqIW1+MQgzzc+UStFn80YeJUyFtdiuER8=",
     "fingerprinting": {
       "Google.Protobuf.9h59ukbel7.dll": "Google.Protobuf.dll",
       "Markdig.d1j7v41cl1.dll": "Markdig.dll",
@@ -132,7 +132,7 @@
       "MindExecution.Plugins.PlanMaster.kibqg6rvqh.dll": "MindExecution.Plugins.PlanMaster.dll",
       "MindExecution.Plugins.YouTube.089r64n2hv.dll": "MindExecution.Plugins.YouTube.dll",
       "MindExecution.Shared.p86iw1fhns.dll": "MindExecution.Shared.dll",
-      "MindExecution.Web.aj117i28hy.dll": "MindExecution.Web.dll",
+      "MindExecution.Web.7axuoygrwi.dll": "MindExecution.Web.dll",
       "dotnet.js": "dotnet.js",
       "dotnet.native.qc8g39g30v.js": "dotnet.native.js",
       "dotnet.native.boem75ye5i.wasm": "dotnet.native.wasm",
@@ -284,7 +284,7 @@
       "MindExecution.Plugins.Concept.u9kzsgf64o.dll": "sha256-Yp38m6zHe8EBxtm480N4LfcHRpzFZRhYpr1RsCgnlK8=",
       "MindExecution.Plugins.PlanMaster.kibqg6rvqh.dll": "sha256-NOtEHR8Y0rO8BguFvD1soa8jfB4YVQFydten0SzqBEg=",
       "MindExecution.Shared.p86iw1fhns.dll": "sha256-GeQGsY17FMYu6beNS1RDR7yJ/nNgfiix6rjORzhXnCY=",
-      "MindExecution.Web.aj117i28hy.dll": "sha256-+jKjBygtNF6dsjwsyJ+O2NId2p7HeQk4rYksxd+SqPA="
+      "MindExecution.Web.7axuoygrwi.dll": "sha256-/6NQ8z9E7ixNwgYD71eh6M6YCGzctKodTWcZNJcNF8E="
     },
     "lazyAssembly": {
       "MindExecution.Plugins.Admin.29mytzdaun.dll": "sha256-2mHPbTPcHCi1xPuk3dNMVWxn42xZFUZ3QFhm3xIV/6E=",

package/wwwroot/service-worker-assets.js

@@ -1,5 +1,5 @@
 self.assetsManifest = {
-    "version":  "3ooTJksk",
+    "version":  "YLV1KsFI",
     "assets":  [
                    {
                        "hash":  "sha256-+CSYMcqLNTsq3VnH11jgYyOCCdxvHzL74CBmo4sCmMU=",
@@ -446,8 +446,8 @@
                        "url":  "_framework/MindExecution.Shared.p86iw1fhns.dll"
                    },
                    {
-                       "hash":  "sha256-+jKjBygtNF6dsjwsyJ+O2NId2p7HeQk4rYksxd+SqPA=",
-                       "url":  "_framework/MindExecution.Web.aj117i28hy.dll"
+                       "hash":  "sha256-/6NQ8z9E7ixNwgYD71eh6M6YCGzctKodTWcZNJcNF8E=",
+                       "url":  "_framework/MindExecution.Web.7axuoygrwi.dll"
                    },
                    {
                        "hash":  "sha256-IsZJ91/OW+fHzNqIgEc7Y072ns8z9dGritiSyvR9Wgc=",
@@ -770,7 +770,7 @@
                        "url":  "_framework/Websocket.Client.vapounvmnl.dll"
                    },
                    {
-                       "hash":  "sha256-txW3qdrqdJhTHyMMLK0IDsdhphqslC5BjXEhWNo5jpM=",
+                       "hash":  "sha256-xLiOU/vuEmRFIqaJXh1WMyuEaWcsagGwx5Uq71HsjkY=",
                        "url":  "_framework/blazor.boot.json"
                    },
                    {

package/wwwroot/service-worker.js

@@ -1,4 +1,4 @@
-/* Manifest version: 3ooTJksk */
+/* Manifest version: YLV1KsFI */
 // Hosted deployments should prefer the network over stale offline caches.
 // This service worker immediately clears old Blazor offline caches and unregisters itself.