@myvillage/cli 1.89.0 → 1.89.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myvillage/cli",
-  "version": "1.89.0",
+  "version": "1.89.2",
   "description": "MyVillageOS CLI for community developers",
   "type": "module",
   "bin": {

package/src/agent-runtime/loop.js

@@ -121,6 +121,19 @@ export async function agentLoop(agentName, { signal }) {
   // max_tokens_per_loop and the rate limiter regardless of this ceiling.
   const maxSteps = config.brain?.max_steps_per_loop || 25;
 
+  // Refresh BEFORE the first MCP connect. Whoever spawned us put a snapshot of
+  // MYVILLAGE_ACCESS_TOKEN in our env, and the MCP client bakes it into its
+  // Authorization header at construction with no refresh path of its own. The
+  // per-iteration self-heal below only runs once we're already in the loop, so
+  // without this the very first connect uses a possibly-dead token and comes up
+  // with zero tools. Doing it here covers every start path (fleet runner,
+  // Studio's local Start, `myvillage agent start`) in one place.
+  try {
+    if (isTokenExpired()) await refreshAccessToken();
+    const startupToken = getAccessToken();
+    if (startupToken) process.env.MYVILLAGE_ACCESS_TOKEN = startupToken;
+  } catch { /* fall through with whatever we were handed */ }
+
   // Initialize MCP tools
   let tools;
   try {
@@ -183,8 +196,20 @@ export async function agentLoop(agentName, { signal }) {
     // 401s until the daemon is restarted. Re-read credentials each loop and
     // swap the MCP client when the token changes.
     try {
+      // refreshAccessToken() RETURNS false on failure, it does not throw, so the
+      // catch below never fires for a dead refresh token. Check the return value
+      // or the whole failure is silent: no mcp_reconnected, no error, just an
+      // agent that 401s on every call for the rest of its life.
       if (isTokenExpired()) {
-        await refreshAccessToken();
+        const refreshed = await refreshAccessToken();
+        if (!refreshed) {
+          logActivity(agentDir, {
+            type: 'error',
+            error:
+              'Could not refresh the MyVillageOS sign-in on this machine. Tools and the model will keep ' +
+              'returning 401 until you run `myvillage login` here.',
+          });
+        }
       }
       const currentToken = getAccessToken();
       if (currentToken && currentToken !== process.env.MYVILLAGE_ACCESS_TOKEN) {

package/src/agent-runtime/runner.js

@@ -22,7 +22,8 @@ import os from 'os';
 import fs from 'fs';
 import path from 'path';
 import { getConfig } from '../utils/config.js';
-import { getAccessToken } from '../utils/auth.js';
+import { getAccessToken, isTokenExpired } from '../utils/auth.js';
+import { refreshAccessToken } from '../utils/api.js';
 import { listLocalAgents, readAgentConfig, getAgentDir, writeAgentConfig } from '../utils/local-agent.js';
 import { startDaemon, stopDaemon, isDaemonRunning, getDaemonInfo } from './daemon.js';
 
@@ -75,13 +76,29 @@ function makeClient(machineKey, machineId) {
   };
 }
 
+/**
+ * Read the signed-in user's OAuth bearer, refreshing it first when it is stale.
+ *
+ * Every headless machine needs this. On a desktop, Studio's own API traffic
+ * keeps the stored token fresh as a side effect; on a Pi nothing else uses the
+ * OAuth credential (the runner itself authenticates with its machine API key),
+ * so the token on disk simply expires and stays expired. Handing that dead
+ * token to a registration call or to a spawned daemon is a guaranteed 401.
+ *
+ * Returns null when there is no usable credential at all.
+ */
+async function currentUserToken() {
+  if (isTokenExpired()) await refreshAccessToken();
+  return getAccessToken();
+}
+
 /**
  * One-shot client authenticated as the signed-in *user* (OAuth bearer). Used
  * only to register a machine and receive its minted credential.
  */
-function makeUserClient() {
+async function makeUserClient() {
   const { networkBaseUrl } = getConfig();
-  const token = getAccessToken();
+  const token = await currentUserToken();
   if (!token) return null;
   return async function cp(pathname, { method = 'GET', body } = {}) {
     const headers = { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` };
@@ -198,9 +215,13 @@ function indexLocalAgentsByProfileId() {
   return map;
 }
 
-function startAgent(name, config, machineId, leaseEpoch) {
-  const token = getAccessToken();
+async function startAgent(name, config, machineId, leaseEpoch) {
+  // Refresh before snapshotting. The daemon inherits this env and bakes the
+  // token into its MCP Authorization header at construction, so a stale value
+  // here means the agent comes up with zero tools and no model access.
+  const token = await currentUserToken();
   if (token) process.env.MYVILLAGE_ACCESS_TOKEN = token;
+  else log(`no usable sign-in on this machine — ${name} will start unauthenticated; run \`myvillage login\``);
   if (config.man?.agent_id) process.env.MYVILLAGE_AGENT_ID = config.man.agent_id;
   if (config.man?.village_agent_id) process.env.MYVILLAGE_VILLAGE_AGENT_ID = config.man.village_agent_id;
   process.env.MYVILLAGE_MACHINE_ID = machineId;
@@ -262,7 +283,7 @@ async function resolveMachineIdentity(opts) {
     return { machineId, machineKey: saved.machineKey };
   }
 
-  const userClient = makeUserClient();
+  const userClient = await makeUserClient();
   if (!userClient) {
     throw new Error(
       'Not signed in. Run `myvillage login` on this machine (or pass --key with a machine:runner API key).',
@@ -370,7 +391,7 @@ async function reconcileOnce(ctx) {
       continue;
     }
 
-    const pid = startAgent(entry.name, entry.config, ctx.machineId, epoch);
+    const pid = await startAgent(entry.name, entry.config, ctx.machineId, epoch);
     ctx.leases.set(a.agentProfileId, { name: entry.name, epoch });
     log(`started ${entry.name} (pid ${pid}, epoch ${epoch})`);
   }

package/src/commands/agent-local.js

@@ -771,7 +771,29 @@ export async function agentLogsCommand(name, options = {}) {
   console.log('');
 }
 
+// Calendar day of the last entry printed, so we only emit a date header when
+// the day actually changes. readAgentLogs walks the per-day files newest-first
+// and keeps accumulating until it hits `limit`, so one invocation routinely
+// spans midnight. Without a header, yesterday's 10:21 and today's 10:21 render
+// identically and there is no way to tell a live agent from a stale log.
+let lastPrintedDay = null;
+
+function printDayHeader(ts) {
+  const d = new Date(ts);
+  if (Number.isNaN(d.getTime())) return;
+  const day = d.toLocaleDateString(undefined, {
+    weekday: 'short',
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+  });
+  if (day === lastPrintedDay) return;
+  lastPrintedDay = day;
+  console.log(`  ${chalk.dim(`── ${day} ──`)}`);
+}
+
 function printLogEntry(entry) {
+  printDayHeader(entry.ts);
   const time = brand.teal(new Date(entry.ts).toLocaleTimeString());
   const type = entry.type || 'info';
 

package/src/utils/auth.js

@@ -100,7 +100,15 @@ export function getAccessToken() {
 
 export function isTokenExpired() {
   const creds = loadCredentials();
-  if (!creds?.expires_at) return false;
+  // Nothing stored (or nothing decryptable): not "expired", just signed out.
+  // Callers treat a null token as unauthenticated on their own.
+  if (!creds?.access_token) return false;
+  // Fail closed. A credential with no recorded expiry cannot be proven valid,
+  // so treat it as expired and let the refresh path replace it — which also
+  // writes a real expires_at, so this self-corrects after one call. Returning
+  // false here meant such a token was considered valid forever: a long-lived
+  // agent daemon would 401 on every request and never once try to refresh.
+  if (!creds.expires_at) return true;
   // Consider expired if within 60 seconds of expiry
   return Date.now() >= (creds.expires_at - 60000);
 }