@nexrall/code-core 1.4.22 → 1.4.24

package/dist/api/client.js

@@ -7,6 +7,7 @@ exports.API_BASE = void 0;
 exports.chooseFinalContent = chooseFinalContent;
 exports.streamChat = streamChat;
 exports.cancelTurn = cancelTurn;
+exports.revokeRefreshToken = revokeRefreshToken;
 exports.getBalance = getBalance;
 exports.exchangeVscodeCode = exchangeVscodeCode;
 exports.login = login;
@@ -115,6 +116,91 @@ function authHeaders() {
         Authorization: `Bearer ${token}`,
     };
 }
+// ─── Silent token refresh ─────────────────────────────────────────────────────
+/**
+ * In-flight refresh, shared by every caller that discovers an expired token at the
+ * same moment.
+ *
+ * This is a correctness requirement, not a micro-optimisation. Refresh tokens
+ * ROTATE: presenting one invalidates it and returns a replacement, and presenting
+ * a spent one is treated by the backend as theft (`reuse_detected`) — it revokes
+ * the entire token family and forces a real re-login. A long turn can easily have
+ * several requests in flight (the stream, a cancel, a balance poll), so without
+ * this they would each present the SAME refresh token and all but the first would
+ * look exactly like an attack. De-duplicating means one rotation, one winner,
+ * everyone else awaiting the same promise.
+ */
+let _refreshInFlight = null;
+/**
+ * Exchange the stored refresh token for a fresh access token. Resolves true when
+ * the tokens on disk were updated, false when refreshing isn't possible (no
+ * refresh token stored, or the server rejected it).
+ *
+ * Deliberately never throws: every call site treats `false` as "carry on and let
+ * the original 401/403 surface", which is the correct fallback in all cases.
+ */
+async function refreshAccessToken() {
+    if (_refreshInFlight)
+        return _refreshInFlight;
+    _refreshInFlight = (async () => {
+        const refreshToken = (0, index_1.getRefreshToken)();
+        // No refresh token: a NEXRALL_TOKEN/CI credential, or a config written before
+        // this field existed. Nothing to do — the caller falls back to the auth error.
+        if (!refreshToken)
+            return false;
+        try {
+            const res = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/refresh`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ refreshToken }),
+            });
+            if (!res.ok)
+                return false; // 401 = invalid/expired/reused → a real re-login is needed
+            const data = (await res.json());
+            if (!data.token)
+                return false;
+            (0, index_1.updateTokens)(data.token, data.refreshToken);
+            return true;
+        }
+        catch {
+            // Network failure. Not an auth problem — report failure so the caller's own
+            // retry/backoff machinery handles it as the transport error it is.
+            return false;
+        }
+    })();
+    try {
+        return await _refreshInFlight;
+    }
+    finally {
+        _refreshInFlight = null;
+    }
+}
+/**
+ * Is this response an EXPIRED-CREDENTIAL failure that a refresh could fix?
+ *
+ * The backend's auth middleware answers 401 for a missing token and 403 for one
+ * that is invalid or expired. 403 is ambiguous — Anthropic's upstream
+ * "forbidden" passthrough uses it too — so the body has to disambiguate: the
+ * upstream shape is `{error:{type:'forbidden'}}` (a nested object), while the auth
+ * middleware sends a flat `{error:'Invalid or expired token'}` string. Refreshing
+ * on the upstream shape would be harmless but pointless; getting it backwards and
+ * NOT refreshing on the auth shape is the bug being fixed, so the test suite pins
+ * both directions.
+ */
+function isExpiredTokenResponse(status, body) {
+    if (status !== 401 && status !== 403)
+        return false;
+    try {
+        const parsed = JSON.parse(body);
+        // Nested object → Anthropic's upstream passthrough, not our auth layer.
+        if (parsed?.error && typeof parsed.error === 'object')
+            return false;
+        return typeof parsed?.error === 'string' && /token|auth|expired/i.test(parsed.error);
+    }
+    catch {
+        return false;
+    }
+}
 // ─── Retry helpers ────────────────────────────────────────────────────────────
 const MAX_RETRIES = 5;
 const RETRY_BASE_MS = 1000;
@@ -301,6 +387,71 @@ async function streamChat(messages, options, onEvent) {
             onEvent({ type: 'retry_resolved' });
         }
     };
+    /**
+     * Abandon the current turnId and prepare to restart the turn from scratch.
+     *
+     * Used whenever the server tells us this turn can no longer be followed — the
+     * buffered frame window moved past our cursor (410), the turn is simply gone
+     * (404, e.g. the owning pod was replaced by a deploy), or a mid-stream frame
+     * carried `notResumable`. In all of those cases resuming again with the same
+     * cursor would hit the identical wall, so the only recovery is a clean restart.
+     *
+     * Two things make this more than a state reset, and both are easy to get wrong
+     * — which is why all three call sites funnel through here rather than each
+     * open-coding it:
+     *
+     *  1. The OLD turn must be cancelled and AWAITED first. A 410/404 does not mean
+     *     the turn ended — it is very likely still generating and still holding its
+     *     idempotency claim, so re-POSTing the same turnId would be rejected as
+     *     `turnInFlight` and we would burn the entire retry budget waiting, while
+     *     the orphaned turn kept generating and billing.
+     *  2. Anything already rendered has to be reconciled. A restart re-sends the
+     *     answer from the beginning, so unless the caller can un-render its partial
+     *     output, restarting would duplicate it on screen.
+     *
+     * Returns `false` when the caller cannot roll back its rendered output; the
+     * caller must then surface a terminal error instead of restarting.
+     */
+    const prepareRestart = async (reason) => {
+        await cancelTurn(turnId);
+        turnId = (0, crypto_1.randomUUID)(); // a restart is semantically a NEW turn
+        resuming = false;
+        serverResumable = false;
+        lastEventId = 0;
+        carryText = [];
+        carryToolUse = [];
+        // Snapshot BEFORE resetting: the rollback decision needs to know what the user
+        // can currently see, but the counters must not carry into the restarted turn or
+        // a second restart would report characters this one already discarded.
+        const hadRendered = emittedAnythingAcrossAttempts;
+        const renderedChars = emittedCharsAcrossAttempts;
+        emittedAnythingAcrossAttempts = false;
+        emittedCharsAcrossAttempts = 0;
+        if (hadRendered && !allowRestartAfterRender)
+            return false;
+        if (hadRendered) {
+            onEvent({ type: 'stream_restart', reason, discardedChars: renderedChars });
+        }
+        return true;
+    };
+    /**
+     * Does an error response body carry the backend's explicit `notResumable` flag?
+     *
+     * The resume endpoint sets this on every "give up on this turnId" response
+     * (routes/code.js: the 410 gap case, the 404 no-such-turn case, and the
+     * synthesised mid-stream error frames). Reading the FLAG rather than matching
+     * the status code alone means a new give-up condition on the server is handled
+     * correctly here the day it ships, instead of falling through to the generic
+     * terminal-error path and killing a turn that was perfectly recoverable.
+     */
+    const bodySaysNotResumable = (body) => {
+        try {
+            return JSON.parse(body)?.notResumable === true;
+        }
+        catch {
+            return false;
+        }
+    };
     // One network attempt: connect (with connect-time 429/5xx retry) and consume the stream to
     // completion. Returns the assembled assistant Message, or throws — tagging a transient
     // pre-content failure with { retryable: true } for the outer loop below.
@@ -318,8 +469,19 @@ async function streamChat(messages, options, onEvent) {
         // short in-loop retry budget — the final throw tags `retryable: true` so it still
         // reaches the outer 5-minute stream-retry loop instead of dying as a terminal error.
         let forbiddenExhausted = false;
+        // Whether this attempt has already spent its one silent token refresh. Scoped to
+        // the attempt, not the whole call: if a freshly-minted token is ALSO rejected the
+        // failure isn't expiry, and retrying would pointlessly rotate the refresh token
+        // against a server that keeps refusing.
+        let refreshedThisAttempt = false;
+        // Set when the failure is a dead credential that refreshing could not fix, so the
+        // terminal throw below can tag it `authExpired` — letting the UI show a "sign in
+        // again" prompt instead of a generic error, and keeping it out of the outer
+        // retry loop (a re-login is not something reconnecting can solve).
+        let sessionExpired = false;
         for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
             try {
+                errorBodyOverride = null; // a fresh response — never reuse the previous body
                 response = await (0, node_fetch_1.default)(...buildFetchArgs());
                 if (response.status === 429 && attempt < MAX_RETRIES && canRetry()) {
                     reportRetry('Rate limited by the API — retrying');
@@ -332,6 +494,57 @@ async function streamChat(messages, options, onEvent) {
                     await sleepWithinBudget(backoffMs(attempt));
                     continue;
                 }
+                // ── Expired access token → refresh once, then retry ──────────────────
+                //
+                // The backend issues access tokens with a 2-HOUR TTL and has always
+                // returned a long-lived rotating refresh token alongside them. The web app
+                // refreshes silently; the CLI and extension discarded the refresh token
+                // entirely and stored only the access token — so after exactly two hours,
+                // mid-session, every request started failing with "Invalid or expired
+                // token" and the run simply died with no recovery and no useful guidance.
+                // That is the "it just stops working after a while" report.
+                //
+                // Refreshed at most once per attempt (`refreshedThisAttempt`): if the new
+                // token is ALSO rejected, the problem isn't expiry and looping would just
+                // rotate the refresh token repeatedly against a server that keeps saying no
+                // — every rotation invalidating the previous one.
+                //
+                // A successful refresh retries transparently. This is before any streaming,
+                // so nothing has been rendered and nothing can be duplicated.
+                if (response.status === 401 || response.status === 403) {
+                    const bodyText = await response.text().catch(() => '');
+                    if (isExpiredTokenResponse(response.status, bodyText)) {
+                        if (!refreshedThisAttempt) {
+                            refreshedThisAttempt = true;
+                            if (await refreshAccessToken()) {
+                                reportRetry('Session expired — signing you back in');
+                                attempt--; // a refresh is not a failed attempt; don't spend the budget on it
+                                continue; // buildFetchArgs()/authHeaders() will pick up the new token
+                            }
+                        }
+                        // Either refreshing was impossible (no refresh token stored — a config
+                        // predating this feature, or a NEXRALL_TOKEN credential), it was refused
+                        // (expired/revoked/reused), or the freshly-minted token was rejected too.
+                        // All three genuinely need a human.
+                        //
+                        // Signalled by BREAKING with a rewritten body rather than throwing: a
+                        // throw here lands in this loop's own catch, which cannot tell it from a
+                        // network failure and would retry it — firing a burst of full-context
+                        // POSTs at a credential that will never be accepted. Breaking routes it
+                        // through the terminal `!response.ok` handler below, which is exactly
+                        // what a deterministic auth failure should use.
+                        sessionExpired = true;
+                        errorBodyOverride = JSON.stringify({
+                            // Replaces the backend's bare "Invalid or expired token", which reads
+                            // like a bug rather than something the user can act on.
+                            error: 'Your session has expired. Run `nex login` to sign in again.',
+                        });
+                        break;
+                    }
+                    // Not an expiry — hand the body we already consumed to the handlers below
+                    // (node-fetch bodies are single-use).
+                    errorBodyOverride = bodyText;
+                }
                 // 403 `{"error":{"type":"forbidden","message":"Request not allowed"}}` is
                 // Anthropic's own upstream response shape (reproduced verbatim through the AI
                 // Gateway passthrough — see services/aiGatewayClient.js), not something Nexrall's
@@ -345,7 +558,11 @@ async function streamChat(messages, options, onEvent) {
                 // burning the whole reconnect budget on something that will never succeed.
                 const FORBIDDEN_RETRY_LIMIT = 2;
                 if (response.status === 403) {
-                    const bodyText = await response.text().catch(() => '');
+                    // The expiry check above already consumed the body on this path, and a
+                    // node-fetch body is single-use — calling .text() again yields '' and the
+                    // upstream-forbidden shape would never be recognised, turning a retryable
+                    // blip into an instant terminal failure.
+                    const bodyText = errorBodyOverride ?? await response.text().catch(() => '');
                     let isUpstreamForbidden = false;
                     try {
                         const parsed = JSON.parse(bodyText);
@@ -374,53 +591,49 @@ async function streamChat(messages, options, onEvent) {
                     errorBodyOverride = bodyText;
                     break;
                 }
-                // 410 Gone — a resume was refused because the buffered window no longer contains
-                // our position (we were away too long, or the turn produced a huge amount in the
-                // meantime). Continuity can't be proven, and silently skipping frames would corrupt
-                // the message being rebuilt. So abandon resuming and fall back to restarting the
-                // turn from scratch: correct, just not free.
-                if (response.status === 410 && resuming) {
-                    await response.text().catch(() => '');
-                    // A 410 means the BUFFER WINDOW moved past our cursor — it does NOT mean the turn
-                    // ended. It is almost certainly still generating and still holding its idempotency
-                    // claim, so re-POSTing with the same turnId would be rejected as `turnInFlight`,
-                    // and we would wait out the entire retry budget only to fail — while the orphaned
-                    // turn kept generating and billing.
-                    //
-                    // So: stop the old turn (awaited — the claim must be released BEFORE we re-POST),
-                    // and mint a fresh id, because a restart is semantically a new turn.
-                    await cancelTurn(turnId);
-                    turnId = (0, crypto_1.randomUUID)();
-                    resuming = false;
-                    serverResumable = false;
-                    lastEventId = 0;
-                    carryText = [];
-                    carryToolUse = [];
-                    // Snapshot BEFORE resetting: the rollback decision below needs to know what the
-                    // user can currently see, but the counters must not carry into the restarted turn
-                    // or a second restart would report characters this one already discarded.
-                    const hadRendered = emittedAnythingAcrossAttempts;
-                    const renderedChars = emittedCharsAcrossAttempts;
-                    emittedAnythingAcrossAttempts = false;
-                    emittedCharsAcrossAttempts = 0;
-                    if (hadRendered && !allowRestartAfterRender) {
-                        // Output is already on screen and the caller can't take it back, so a restart
-                        // would duplicate it. Surface the failure instead of corrupting the transcript.
-                        throw new Error('Connection lost and this turn could no longer be resumed. Send your message again.');
-                    }
-                    if (hadRendered) {
-                        onEvent({
-                            type: 'stream_restart',
-                            reason: 'Connection lost too long to resume',
-                            discardedChars: renderedChars,
-                        });
-                    }
-                    if (attempt < MAX_RETRIES && canRetry()) {
-                        reportRetry('Could not resume — restarting this turn');
-                        await sleepWithinBudget(backoffMs(attempt));
-                        continue;
+                // A resume that the server refuses: this turnId can no longer be followed.
+                //
+                //   410 Gone      — the buffered frame window moved past our cursor (we were
+                //                   away too long, or the turn produced a lot meanwhile).
+                //                   Continuity can't be proven and skipping frames would
+                //                   corrupt the message being rebuilt.
+                //   404 Not Found — the turn is gone entirely: nothing buffered AND no live
+                //                   registry record, which is what a deploy/pod replacement
+                //                   looks like from here.
+                //
+                // 404 used to fall straight through to the generic terminal-error handler
+                // below, so a backend rolling restart mid-turn killed the turn outright with
+                // "No such turn to resume." — even though the recovery path for it (mint a
+                // new turnId and restart) was already sitting right here for 410. That was
+                // the "disconnects and never reconnects" case.
+                //
+                // Matched on the backend's explicit `notResumable` flag in the body rather
+                // than on a hardcoded status list, so a new give-up condition on the server
+                // is handled the day it ships. The status check keeps 410 working even if a
+                // proxy strips the body.
+                if (resuming && response.status >= 400 && response.status < 500) {
+                    // May already have been read by the token-expiry check above (401/403);
+                    // node-fetch bodies are single-use, so reuse it rather than reading ''.
+                    const body = errorBodyOverride ?? await response.text().catch(() => '');
+                    if (response.status === 410 || response.status === 404 || bodySaysNotResumable(body)) {
+                        const canRestart = await prepareRestart('Connection lost too long to resume');
+                        if (!canRestart) {
+                            // Output is already on screen and the caller can't take it back, so a restart
+                            // would duplicate it. Surface the failure instead of corrupting the transcript.
+                            throw new Error('Connection lost and this turn could no longer be resumed. Send your message again.');
+                        }
+                        if (attempt < MAX_RETRIES && canRetry()) {
+                            reportRetry('Could not resume — restarting this turn');
+                            await sleepWithinBudget(backoffMs(attempt));
+                            continue;
+                        }
+                        errorBodyOverride = JSON.stringify({ error: 'Could not resume this turn — send your message again.' });
+                        break;
                     }
-                    errorBodyOverride = JSON.stringify({ error: 'Could not resume this turn — send your message again.' });
+                    // A 4xx during resume that is NOT a give-up signal (401/403 auth, 400 bad
+                    // turnId). Deterministic — fall through to the terminal handler, reusing the
+                    // body we already consumed since node-fetch bodies are single-use.
+                    errorBodyOverride = body;
                     break;
                 }
                 // 409 from the backend's turn-idempotency gate. Two distinct meanings, and the
@@ -518,7 +731,16 @@ async function streamChat(messages, options, onEvent) {
             // `retryable: true` on `forbiddenExhausted` hands the transient 403-upstream-forbidden
             // case (see above) to the outer stream-retry loop instead of letting it die as a
             // terminal error the moment the short in-connect-loop budget runs out.
-            throw Object.assign(new Error(errMsg), { status: response.status, balance, ...(forbiddenExhausted ? { retryable: true } : {}) });
+            //
+            // `authExpired` is the opposite signal: the credential is dead and no amount of
+            // reconnecting will help, so it must stay terminal AND be distinguishable, so the
+            // UI can offer a sign-in instead of showing a generic failure.
+            throw Object.assign(new Error(errMsg), {
+                status: response.status,
+                balance,
+                ...(forbiddenExhausted ? { retryable: true } : {}),
+                ...(sessionExpired ? { authExpired: true } : {}),
+            });
         }
         if (!response.body) {
             throw new Error('Response body is null');
@@ -928,6 +1150,15 @@ async function streamChat(messages, options, onEvent) {
                                 reject(tagTransient(new Error(message)));
                             }
                             else {
+                                // Terminal error. The three branches above each stop the watchdog
+                                // and tear the socket down; this one used to do neither, so a
+                                // fatal SSE error left a 5-second interval running and the
+                                // response body open for the lifetime of the process. The
+                                // rejection settles the promise either way, which is exactly why
+                                // the leak was invisible — nothing downstream ever noticed, it
+                                // just accumulated one timer per failed turn across a long session.
+                                clearInterval(heartbeatWatchdog);
+                                stream.destroy?.();
                                 onEvent({ type: 'error', message });
                                 reject(new Error(message));
                             }
@@ -1011,32 +1242,18 @@ async function streamChat(messages, options, onEvent) {
                 if (e.retryable && sAttempt < MAX_RETRIES && canRetry()) {
                     // The backend explicitly said this turnId's buffer is unrecoverable (gap in the
                     // Redis frame stream, or the owning pod is gone — see the `notResumable` case in
-                    // client.ts's SSE parser). Resuming with the same `lastEventId` would just hit
-                    // the same wall again, so — exactly like the inline 410-while-resuming handling
-                    // above — release the old claim, mint a fresh turnId, and restart clean instead
-                    // of falling into the "prefer resuming" branch below.
+                    // the SSE parser above). Resuming with the same `lastEventId` would just hit the
+                    // same wall again, so release the old claim, mint a fresh turnId and restart
+                    // clean instead of falling into the "prefer resuming" branch below.
+                    //
+                    // Shares prepareRestart() with the HTTP-status path in runAttempt: the two used
+                    // to be independent copies of the same fifteen lines, and the cancel-then-remint
+                    // ordering they encode is exactly the kind of thing that silently drifts apart.
                     if (e.forceRestart) {
-                        await cancelTurn(turnId);
-                        turnId = (0, crypto_1.randomUUID)();
-                        resuming = false;
-                        serverResumable = false;
-                        lastEventId = 0;
-                        carryText = [];
-                        carryToolUse = [];
-                        const hadRendered = emittedAnythingAcrossAttempts;
-                        const renderedChars = emittedCharsAcrossAttempts;
-                        emittedAnythingAcrossAttempts = false;
-                        emittedCharsAcrossAttempts = 0;
-                        if (hadRendered && !allowRestartAfterRender) {
+                        const canRestart = await prepareRestart(err.message || 'Could not resume — restarting this turn');
+                        if (!canRestart) {
                             throw new Error('Connection lost and this turn could no longer be resumed. Send your message again.');
                         }
-                        if (hadRendered) {
-                            onEvent({
-                                type: 'stream_restart',
-                                reason: err.message || 'Could not resume — restarting this turn',
-                                discardedChars: renderedChars,
-                            });
-                        }
                         reportRetry('Could not resume — restarting this turn');
                         await sleepWithinBudget(backoffMs(sAttempt));
                         continue;
@@ -1116,12 +1333,50 @@ async function cancelTurn(turnId) {
         // Ignored deliberately — see above.
     }
 }
+// ─── Logout ───────────────────────────────────────────────────────────────────
+/**
+ * Revoke the stored refresh token server-side.
+ *
+ * Deleting the local config alone is NOT a logout once refresh tokens exist: the
+ * token stays valid for its full 60-day life and can keep minting access tokens
+ * for anyone who recovered it (a synced dotfile, a backup, a shared machine).
+ * The backend already exposes /api/auth/logout for exactly this.
+ *
+ * Best-effort and never throws — a failed revoke must not stop the local
+ * credentials from being cleared, which is the part the user can see.
+ */
+async function revokeRefreshToken() {
+    const refreshToken = (0, index_1.getRefreshToken)();
+    if (!refreshToken)
+        return;
+    try {
+        await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/logout`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ refreshToken }),
+        });
+    }
+    catch {
+        // Offline logout: the local credentials still get cleared by the caller.
+    }
+}
 // ─── Get Balance ──────────────────────────────────────────────────────────────
 async function getBalance() {
-    const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/balance`, {
-        method: 'GET',
-        headers: authHeaders(),
-    });
+    const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/code/balance`, { method: 'GET', headers: authHeaders() });
+    let response = await fetchOnce();
+    // Same silent refresh as the chat path. This endpoint is polled on session start
+    // and after turns, so on an expired token it is frequently the FIRST thing the
+    // user sees fail — and a startup that reports "API error 403" while the chat
+    // path quietly recovers is just confusing.
+    if (response.status === 401 || response.status === 403) {
+        const body = await response.text().catch(() => '');
+        if (isExpiredTokenResponse(response.status, body) && await refreshAccessToken()) {
+            response = await fetchOnce();
+        }
+        else {
+            throw new Error(`API error ${response.status}: ${body}`);
+        }
+    }
     if (!response.ok) {
         const errText = await response.text();
         throw new Error(`API error ${response.status}: ${errText}`);
@@ -1143,7 +1398,18 @@ async function exchangeVscodeCode(code) {
     const data = (await response.json());
     if (!data.token)
         throw new Error('No token in exchange response');
-    return { token: data.token, email: data.user?.email ?? '' };
+    // `refreshToken` is forwarded when present but is NOT expected today: unlike the
+    // email-login path, /vscode-exchange mints a long-lived (30-day) token directly
+    // rather than going through mintSession's short-access-token + refresh pair. So
+    // the extension is not exposed to the 2-hour expiry that broke CLI sessions —
+    // it just expires much later, with no silent renewal. Reading the field now means
+    // that if the backend is ever switched to mintSession for consistency, the
+    // extension starts refreshing silently instead of breaking at the 2-hour mark.
+    return {
+        token: data.token,
+        ...(data.refreshToken ? { refreshToken: data.refreshToken } : {}),
+        email: data.user?.email ?? '',
+    };
 }
 // ─── Login ────────────────────────────────────────────────────────────────────
 async function login(email, password) {
@@ -1160,6 +1426,14 @@ async function login(email, password) {
     if (!data.token) {
         throw new Error('Login response missing token');
     }
-    return { token: data.token, email: data.email ?? email };
+    // KEEP THE REFRESH TOKEN. The backend has returned one on this path all along
+    // (routes/auth.js mintSession) and pairs it with an access token that expires in
+    // TWO HOURS. Discarding it here is what made a long working session die mid-run
+    // with "Invalid or expired token" and no way back except a manual `nex login`.
+    return {
+        token: data.token,
+        ...(data.refreshToken ? { refreshToken: data.refreshToken } : {}),
+        email: data.email ?? email,
+    };
 }
 //# sourceMappingURL=client.js.map

package/dist/auth/index.d.ts

@@ -4,4 +4,25 @@ export declare function loadAuth(): AuthConfig | null;
 export declare function clearAuth(): void;
 export declare function isAuthenticated(): boolean;
 export declare function getToken(): string | null;
+/**
+ * The stored refresh token, or null when there isn't one to use.
+ *
+ * Deliberately returns null for a token supplied via NEXRALL_TOKEN: that path is
+ * for CI/headless, where the caller owns the credential's lifecycle and there is
+ * no refresh token to pair with it. Silently reading a refresh token out of the
+ * config file while the access token came from the environment would also mix two
+ * different identities if they disagree.
+ */
+export declare function getRefreshToken(): string | null;
+/**
+ * Replace the stored token pair after a successful refresh, preserving any other
+ * fields already in the config (notably `email`, which the refresh response does
+ * not echo back and which the UI shows).
+ *
+ * Refresh tokens ROTATE: the backend invalidates the presented one and returns a
+ * replacement, and reusing a spent token is treated as theft (`reuse_detected`)
+ * and revokes the family. So this must persist BOTH halves, and must not be
+ * skipped just because the access token is what the caller needed.
+ */
+export declare function updateTokens(token: string, refreshToken?: string): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAiB3C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAGjD;AAED,wBAAgB,QAAQ,IAAI,UAAU,GAAG,IAAI,CAwB5C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAGxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAiB3C,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAGjD;AAED,wBAAgB,QAAQ,IAAI,UAAU,GAAG,IAAI,CAwB5C;AAED,wBAAgB,SAAS,IAAI,IAAI,CAQhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAGzC;AAED,wBAAgB,QAAQ,IAAI,MAAM,GAAG,IAAI,CAGxC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAM/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBvE"}

package/dist/auth/index.js

@@ -38,6 +38,8 @@ exports.loadAuth = loadAuth;
 exports.clearAuth = clearAuth;
 exports.isAuthenticated = isAuthenticated;
 exports.getToken = getToken;
+exports.getRefreshToken = getRefreshToken;
+exports.updateTokens = updateTokens;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
@@ -97,4 +99,55 @@ function getToken() {
     const auth = loadAuth();
     return auth?.token ?? null;
 }
+/**
+ * The stored refresh token, or null when there isn't one to use.
+ *
+ * Deliberately returns null for a token supplied via NEXRALL_TOKEN: that path is
+ * for CI/headless, where the caller owns the credential's lifecycle and there is
+ * no refresh token to pair with it. Silently reading a refresh token out of the
+ * config file while the access token came from the environment would also mix two
+ * different identities if they disagree.
+ */
+function getRefreshToken() {
+    const envToken = process.env.NEXRALL_TOKEN;
+    if (envToken && envToken.trim().length > 0)
+        return null;
+    const auth = loadAuth();
+    const rt = auth?.refreshToken;
+    return typeof rt === 'string' && rt.length > 0 ? rt : null;
+}
+/**
+ * Replace the stored token pair after a successful refresh, preserving any other
+ * fields already in the config (notably `email`, which the refresh response does
+ * not echo back and which the UI shows).
+ *
+ * Refresh tokens ROTATE: the backend invalidates the presented one and returns a
+ * replacement, and reusing a spent token is treated as theft (`reuse_detected`)
+ * and revokes the family. So this must persist BOTH halves, and must not be
+ * skipped just because the access token is what the caller needed.
+ */
+function updateTokens(token, refreshToken) {
+    // Read the file directly rather than via loadAuth(): under NEXRALL_TOKEN,
+    // loadAuth short-circuits to the env value and would let a refresh overwrite the
+    // on-disk config with a synthetic single-field object, destroying the user's
+    // real stored credentials.
+    let existing = {};
+    try {
+        if (fs.existsSync(CONFIG_FILE)) {
+            const parsed = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf-8'));
+            if (typeof parsed === 'object' && parsed !== null)
+                existing = parsed;
+        }
+    }
+    catch { /* corrupt or unreadable — start clean rather than refuse to save */ }
+    ensureConfigDir();
+    const next = {
+        ...existing,
+        token,
+        // Keep the previous refresh token if the server didn't send a new one, rather
+        // than deleting the only means of refreshing again.
+        ...(refreshToken ? { refreshToken } : {}),
+    };
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(next, null, 2), { mode: 0o600 });
+}
 //# sourceMappingURL=index.js.map

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from './tools/executor';
 export * from './agent/loop';
 export * from './agent/testIntegrity';
 export * from './agent/editCompleteness';
+export * from './agent/securityLint';
 export * from './agent/crossFile';
 export * from './agent/flaky';
 export * from './agent/claimEvidence';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}