@pharaoh-so/mcp 0.3.21 → 0.3.22

package/dist/auth.d.ts

@@ -12,6 +12,15 @@ export interface TokenResponse {
     access_token: string;
     token_type: string;
     expires_in: number;
+    /**
+     * Refresh token for silent access-token renewal. Present on all new sessions
+     * (server at src/web/routes/agent-auth.ts). Optional at the type level only
+     * for backward compat with hypothetical older servers — if missing, the proxy
+     * falls through to the full re-auth path on expiry.
+     */
+    refresh_token?: string;
+    /** Refresh token TTL in seconds. */
+    refresh_token_expires_in?: number;
     sse_url: string;
     github_login?: string;
     tenant_name?: string;

package/dist/credentials.d.ts

@@ -1,12 +1,21 @@
-/** Current credential schema version — bump when the format changes. */
-declare const SCHEMA_VERSION = 1;
+/**
+ * Current credential schema version. v2 adds refresh_token + refresh_expires_at
+ * so the proxy can silently renew access tokens. v1 files parse as null, which
+ * forces one re-auth on upgrade — unavoidable because v1 never had a refresh
+ * token to upgrade from.
+ */
+declare const SCHEMA_VERSION = 2;
 /** Stored credential shape. */
 export interface Credentials {
     version: typeof SCHEMA_VERSION;
     access_token: string;
-    /** ISO 8601 timestamp when the token expires. */
+    /** Refresh token used by refreshIfNeeded() to renew the access token. */
+    refresh_token: string;
+    /** ISO 8601 timestamp when the access token expires. */
     expires_at: string;
-    /** Original TTL in seconds (from the token response). */
+    /** ISO 8601 timestamp when the refresh token itself expires. */
+    refresh_expires_at: string;
+    /** Original access token TTL in seconds (from the token response). */
     expires_in: number;
     sse_url: string;
     github_login: string | null;
@@ -15,7 +24,8 @@ export interface Credentials {
 }
 /**
  * Read and parse stored credentials. Returns null if missing, unreadable,
- * malformed, or wrong schema version.
+ * malformed, or wrong schema version (v1 credentials will return null here,
+ * forcing one last re-auth on upgrade to v2).
  */
 export declare function readCredentials(path?: string): Credentials | null;
 /**
@@ -26,8 +36,13 @@ export declare function writeCredentials(creds: Credentials, path?: string): voi
 /** Delete the credential file. No-op if it doesn't exist. */
 export declare function deleteCredentials(path?: string): void;
 /**
- * Check if credentials are expired or within 10% of expiry.
+ * Check if the access token is expired or within 10% of expiry.
  * The 10% buffer prevents connecting with a token that will expire mid-session.
  */
 export declare function isExpired(creds: Credentials): boolean;
+/**
+ * Check if the refresh token itself has expired. When this returns true, even
+ * refresh cannot rescue the session — the user must re-authenticate.
+ */
+export declare function isRefreshExpired(creds: Credentials): boolean;
 export {};

package/dist/credentials.js

@@ -5,13 +5,19 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-/** Current credential schema version — bump when the format changes. */
-const SCHEMA_VERSION = 1;
+/**
+ * Current credential schema version. v2 adds refresh_token + refresh_expires_at
+ * so the proxy can silently renew access tokens. v1 files parse as null, which
+ * forces one re-auth on upgrade — unavoidable because v1 never had a refresh
+ * token to upgrade from.
+ */
+const SCHEMA_VERSION = 2;
 /** Default credential file path. */
 const CREDENTIALS_PATH = join(homedir(), ".pharaoh", "credentials.json");
 /**
  * Read and parse stored credentials. Returns null if missing, unreadable,
- * malformed, or wrong schema version.
+ * malformed, or wrong schema version (v1 credentials will return null here,
+ * forcing one last re-auth on upgrade to v2).
  */
 export function readCredentials(path = CREDENTIALS_PATH) {
     try {
@@ -46,7 +52,7 @@ export function deleteCredentials(path = CREDENTIALS_PATH) {
     }
 }
 /**
- * Check if credentials are expired or within 10% of expiry.
+ * Check if the access token is expired or within 10% of expiry.
  * The 10% buffer prevents connecting with a token that will expire mid-session.
  */
 export function isExpired(creds) {
@@ -58,6 +64,16 @@ export function isExpired(creds) {
     const bufferMs = totalTtlMs * 0.1;
     return now >= expiresAt - bufferMs;
 }
+/**
+ * Check if the refresh token itself has expired. When this returns true, even
+ * refresh cannot rescue the session — the user must re-authenticate.
+ */
+export function isRefreshExpired(creds) {
+    const refreshExpiresAt = new Date(creds.refresh_expires_at).getTime();
+    if (Number.isNaN(refreshExpiresAt))
+        return true;
+    return Date.now() >= refreshExpiresAt;
+}
 /** Type guard for valid credential objects. */
 function isValidCredentials(value) {
     if (typeof value !== "object" || value === null)
@@ -65,7 +81,9 @@ function isValidCredentials(value) {
     const obj = value;
     return (obj.version === SCHEMA_VERSION &&
         typeof obj.access_token === "string" &&
+        typeof obj.refresh_token === "string" &&
         typeof obj.expires_at === "string" &&
+        typeof obj.refresh_expires_at === "string" &&
         typeof obj.expires_in === "number" &&
         typeof obj.sse_url === "string" &&
         Array.isArray(obj.repos));

package/dist/helpers.d.ts

@@ -20,7 +20,14 @@ export declare function printUsage(): void;
  * Falls back to `${server}/sse` if the URL is missing, malformed, or cross-origin.
  */
 export declare function resolveSseUrl(tokenSseUrl: string | undefined, server: string): string;
-/** Convert a token response to storable credentials. */
+/**
+ * Convert a token response to storable credentials.
+ *
+ * @throws if the server response omits refresh_token — this is a breaking
+ * contract, not a graceful degradation: without a refresh token the proxy
+ * will eventually hit the same silent-expiry cliff we're trying to eliminate.
+ * Fail loud so the server regression surfaces instead of being absorbed.
+ */
 export declare function tokenToCredentials(token: TokenResponse, sseUrl: string): Credentials;
 /** Format remaining TTL as human-readable string (e.g. "5d 12h"). */
 export declare function formatTtl(expiresAt: string): string;

package/dist/helpers.js

@@ -66,12 +66,26 @@ export function resolveSseUrl(tokenSseUrl, server) {
         return fallback;
     }
 }
-/** Convert a token response to storable credentials. */
+/**
+ * Convert a token response to storable credentials.
+ *
+ * @throws if the server response omits refresh_token — this is a breaking
+ * contract, not a graceful degradation: without a refresh token the proxy
+ * will eventually hit the same silent-expiry cliff we're trying to eliminate.
+ * Fail loud so the server regression surfaces instead of being absorbed.
+ */
 export function tokenToCredentials(token, sseUrl) {
+    if (!token.refresh_token || !token.refresh_token_expires_in) {
+        throw new Error("Pharaoh server response missing refresh_token — server is older than this client. " +
+            "Update the server to a version that issues refresh tokens, or downgrade the client.");
+    }
+    const now = Date.now();
     return {
-        version: 1,
+        version: 2,
         access_token: token.access_token,
-        expires_at: new Date(Date.now() + token.expires_in * 1000).toISOString(),
+        refresh_token: token.refresh_token,
+        expires_at: new Date(now + token.expires_in * 1000).toISOString(),
+        refresh_expires_at: new Date(now + token.refresh_token_expires_in * 1000).toISOString(),
         expires_in: token.expires_in,
         sse_url: sseUrl,
         github_login: token.github_login ?? null,

package/dist/index.js

@@ -11,10 +11,12 @@
  * - Proxy (pipe):      require pre-existing credentials, bridge stdio ↔ SSE.
  */
 import { pollForToken, printActivationPrompt, printAuthSuccess, requestDeviceCode, } from "./auth.js";
-import { deleteCredentials, isExpired, readCredentials, writeCredentials } from "./credentials.js";
-import { formatTtl, NPX_COMMAND, parseArgs, printLines, printUsage, resolveSseUrl, tokenToCredentials, } from "./helpers.js";
+import { deleteCredentials, writeCredentials } from "./credentials.js";
+import { formatTtl, parseArgs, printLines, printUsage, resolveSseUrl, tokenToCredentials, } from "./helpers.js";
 import { runInstallSkills } from "./install-skills.js";
+import { exitForReauth, handleRefreshFailure, tryMidSessionRefresh } from "./lifecycle.js";
 import { startProxy, TenantSuspendedError, TokenExpiredError } from "./proxy.js";
+import { loadAndRefresh } from "./refresh.js";
 const BANNER = [
     "",
     "  ___  _  _   _   ___    _    ___  _  _ ",
@@ -57,7 +59,6 @@ async function main() {
         printLines("Pharaoh: credentials and MCP config cleared");
         process.exit(0);
     }
-    const creds = readCredentials();
     const isInteractive = Boolean(process.stdin.isTTY);
     // ── Interactive mode (user running in a terminal) ──
     // Full setup every time: fresh auth → register MCP → install skills → done.
@@ -86,11 +87,18 @@ async function main() {
         process.exit(0);
     }
     // ── Proxy mode (Claude Code spawned us as a stdio MCP server) ──
-    // If no credentials, we can't run the device flow (no TTY for user interaction).
-    if (!creds || isExpired(creds)) {
-        printLines("Pharaoh: no valid credentials — cannot start proxy.", "Run this command first to authenticate:", `  ${NPX_COMMAND}`, "");
-        process.exit(1);
+    // Load credentials; refresh silently if the access token is expired but the
+    // refresh token is still valid. Anything else → exit with guidance.
+    const outcome = await loadAndRefresh(server);
+    if (outcome === null) {
+        // No credentials file at all — first-time run or user logged out.
+        exitForReauth("no credentials — run authentication first");
     }
+    if (!outcome.ok) {
+        handleRefreshFailure(outcome.action, outcome.message);
+        return; // unreachable — handleRefreshFailure calls process.exit
+    }
+    let creds = outcome.creds;
     // Valid credentials — ensure skills are installed before starting proxy
     // Silently installs/updates on first run or package update; fast no-op if current.
     try {
@@ -105,8 +113,35 @@ async function main() {
     }
     catch (err) {
         if (err instanceof TokenExpiredError) {
-            printLines("Pharaoh: token expired or revoked.", "Run this command to re-authenticate:", `  ${NPX_COMMAND}`, "");
-            deleteCredentials();
+            // Mid-session token expired — attempt one silent refresh + retry
+            // before giving up. This is what makes the proxy self-heal across
+            // long sessions rather than dying at arbitrary moments.
+            const retryCreds = await tryMidSessionRefresh(creds, server);
+            if (retryCreds) {
+                creds = retryCreds;
+                printLines("Pharaoh: token refreshed mid-session — reconnecting");
+                try {
+                    await startProxy(creds.sse_url, creds.access_token);
+                    return;
+                }
+                catch (retryErr) {
+                    if (retryErr instanceof TokenExpiredError) {
+                        // Second 401 after a successful refresh — the fresh tokens
+                        // are already rejected, so the session is genuinely dead.
+                        // Delete creds before exit so the next spawn shows the
+                        // re-auth prompt instead of looping on the just-rejected
+                        // access token (which `isExpired` would still say is fresh).
+                        deleteCredentials();
+                        exitForReauth("token rejected after refresh");
+                    }
+                    if (retryErr instanceof TenantSuspendedError) {
+                        printLines(`Pharaoh: ${retryErr.message}`);
+                        process.exit(1);
+                    }
+                    throw retryErr;
+                }
+            }
+            // Refresh failed — exit message already printed by tryMidSessionRefresh
             process.exit(1);
         }
         if (err instanceof TenantSuspendedError) {

package/dist/lifecycle.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Proxy lifecycle helpers — credential state transitions and re-auth messaging.
+ *
+ * Extracted from index.ts so the branching logic can be unit-tested without
+ * booting the full CLI. Imported by main() and exercised as a real runtime
+ * dependency — no "test-only exports" here.
+ */
+import { type Credentials } from "./credentials.js";
+import { type RefreshFailureAction } from "./refresh.js";
+/**
+ * Attempt a silent refresh triggered by a mid-session TokenExpiredError.
+ * Returns new credentials on success, null on any failure (messages already
+ * printed). Caller decides whether to retry startProxy.
+ */
+export declare function tryMidSessionRefresh(creds: Credentials, server: string): Promise<Credentials | null>;
+/**
+ * Handle a failed `loadAndRefresh` at startup. Exits the process with the
+ * appropriate message and creds-file state per the classified action.
+ */
+export declare function handleRefreshFailure(action: RefreshFailureAction, message: string): never;
+/**
+ * Print a re-auth prompt and exit.
+ *
+ * Used for terminal lifecycle states where no refresh is possible:
+ * - Missing credentials file (first-time run, post-logout)
+ * - A fresh access token is rejected mid-session AFTER a successful refresh
+ *   (deleteCredentials is called explicitly before this in that case so the
+ *   next spawn sees a cold-start rather than looping on stale creds)
+ */
+export declare function exitForReauth(reason: string): never;

package/dist/lifecycle.js

@@ -0,0 +1,59 @@
+/**
+ * Proxy lifecycle helpers — credential state transitions and re-auth messaging.
+ *
+ * Extracted from index.ts so the branching logic can be unit-tested without
+ * booting the full CLI. Imported by main() and exercised as a real runtime
+ * dependency — no "test-only exports" here.
+ */
+import { deleteCredentials } from "./credentials.js";
+import { NPX_COMMAND, printLines } from "./helpers.js";
+import { refreshIfNeeded } from "./refresh.js";
+/**
+ * Attempt a silent refresh triggered by a mid-session TokenExpiredError.
+ * Returns new credentials on success, null on any failure (messages already
+ * printed). Caller decides whether to retry startProxy.
+ */
+export async function tryMidSessionRefresh(creds, server) {
+    const outcome = await refreshIfNeeded(creds, server);
+    if (outcome.ok)
+        return outcome.creds;
+    // Log the failure reason before caller's exit path runs.
+    if (outcome.action === "reauth") {
+        printLines("Pharaoh: refresh rejected — re-authentication required.", `  ${NPX_COMMAND}`, "");
+        deleteCredentials();
+    }
+    else {
+        // preserve / transient — keep creds, print diagnostic + next-step hint so
+        // the user knows their credentials file is intact (matches startup path).
+        printLines(`Pharaoh: refresh failed (${outcome.action}) — ${outcome.message}`, "Credentials preserved; next startup will retry.", "");
+    }
+    return null;
+}
+/**
+ * Handle a failed `loadAndRefresh` at startup. Exits the process with the
+ * appropriate message and creds-file state per the classified action.
+ */
+export function handleRefreshFailure(action, message) {
+    if (action === "reauth") {
+        deleteCredentials();
+        printLines("Pharaoh: session no longer valid — re-authenticate.", `  ${NPX_COMMAND}`, "");
+        process.exit(1);
+    }
+    // preserve / transient — keep creds, exit with diagnostic. Next spawn will
+    // try again; if the underlying cause clears, it just works.
+    printLines(`Pharaoh: refresh failed (${action}) — ${message}`, "Credentials preserved; next startup will retry.", "");
+    process.exit(1);
+}
+/**
+ * Print a re-auth prompt and exit.
+ *
+ * Used for terminal lifecycle states where no refresh is possible:
+ * - Missing credentials file (first-time run, post-logout)
+ * - A fresh access token is rejected mid-session AFTER a successful refresh
+ *   (deleteCredentials is called explicitly before this in that case so the
+ *   next spawn sees a cold-start rather than looping on stale creds)
+ */
+export function exitForReauth(reason) {
+    printLines(`Pharaoh: ${reason}.`, "Run this command to authenticate:", `  ${NPX_COMMAND}`, "");
+    process.exit(1);
+}

package/dist/refresh.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Silent access-token renewal via OAuth2 refresh grant.
+ *
+ * Called at proxy startup (when access is expired but refresh is valid) and on
+ * mid-session 401 (from proxy.ts TokenExpiredError handler). Success writes new
+ * credentials to disk. Failure returns a classified action so the caller can
+ * decide whether to delete credentials or preserve them for a later retry.
+ */
+import type { Credentials } from "./credentials.js";
+/** Outcome of a refresh attempt. */
+export type RefreshOutcome = {
+    ok: true;
+    creds: Credentials;
+} | {
+    ok: false;
+    action: RefreshFailureAction;
+    message: string;
+};
+/**
+ * How the caller should handle a failed refresh.
+ *
+ * - `reauth`:    server says the refresh token is dead (revoked, expired past
+ *                grace, user removed from org). Delete credentials and prompt
+ *                for re-auth on next start.
+ * - `preserve`:  transient server/network failure (503, fetch error). Keep the
+ *                credentials file intact — the next startup may succeed.
+ * - `transient`: unexpected response shape we can't confidently classify. Keep
+ *                credentials, exit with a diagnostic message. If this branch
+ *                fires often in production, tighten classification.
+ */
+export type RefreshFailureAction = "reauth" | "preserve" | "transient";
+/**
+ * Attempt to renew the access token using the stored refresh token.
+ *
+ * On success: writes new credentials to disk and returns them.
+ * On failure: returns a classified action — caller owns the creds lifecycle.
+ *
+ * @param creds   current (possibly-expired-access) credentials
+ * @param server  Pharaoh server base URL (e.g. "https://mcp.pharaoh.so")
+ * @param path    optional custom credentials path (for tests)
+ */
+export declare function refreshIfNeeded(creds: Credentials, server: string, path?: string): Promise<RefreshOutcome>;
+/**
+ * Read credentials from disk and refresh if the access token is expired.
+ *
+ * Returns:
+ * - `null` if no credentials exist (caller should show re-auth instructions)
+ * - `RefreshOutcome` with `ok: true` if creds are fresh or refresh succeeded
+ * - `RefreshOutcome` with `ok: false` if refresh failed (check `.action`)
+ *
+ * Intended use: called at proxy startup to replace the current "die if expired"
+ * branch in index.ts.
+ */
+export declare function loadAndRefresh(server: string, path?: string): Promise<RefreshOutcome | null>;

package/dist/refresh.js

@@ -0,0 +1,157 @@
+import { isRefreshExpired, readCredentials, writeCredentials } from "./credentials.js";
+/** Classify a non-200 response from the /token refresh endpoint. */
+function classifyRefreshError(status, body) {
+    // 503 or network — the server or GitHub API had a blip. Keep the refresh
+    // token; the next proxy spawn will retry. Blowing away good creds on a
+    // transient failure is exactly the "forced re-auth" pattern we're trying
+    // to eliminate (VestaTech-BV churn was this exact shape).
+    if (status >= 500)
+        return "preserve";
+    // 400 invalid_grant covers all three terminal cases from the server:
+    //   • user removed from GitHub org (not_member)
+    //   • session unreadable / pre-GCM CBC (reauth_required)
+    //   • refresh token expired or rotated out of grace window
+    // All three mean: the creds cannot produce a working session. Delete them
+    // so the next spawn shows the re-auth prompt instead of looping forever.
+    if (status === 400 && body.error === "invalid_grant")
+        return "reauth";
+    // Anything else — 401 without invalid_grant, 403, 404, parse error, etc.
+    // Don't delete creds (might be recoverable), but don't pretend it's
+    // transient either. Log-friendly exit, preserve creds, let the next spawn
+    // retry. If this case fires in practice, we'll see it in logs and tighten
+    // the classification.
+    return "transient";
+}
+/**
+ * Attempt to renew the access token using the stored refresh token.
+ *
+ * On success: writes new credentials to disk and returns them.
+ * On failure: returns a classified action — caller owns the creds lifecycle.
+ *
+ * @param creds   current (possibly-expired-access) credentials
+ * @param server  Pharaoh server base URL (e.g. "https://mcp.pharaoh.so")
+ * @param path    optional custom credentials path (for tests)
+ */
+export async function refreshIfNeeded(creds, server, path) {
+    // Guard: refresh token itself expired. No point hitting the server — the
+    // grant will fail with invalid_grant. Short-circuit to reauth.
+    if (isRefreshExpired(creds)) {
+        return {
+            ok: false,
+            action: "reauth",
+            message: "Refresh token expired",
+        };
+    }
+    let res;
+    try {
+        // POST to /device/token-refresh — RFC 8628 device-flow refresh. Distinct
+        // from /token (browser OAuth) because device flow has no client_id —
+        // the refresh_token itself is the credential.
+        res = await fetch(`${server}/device/token-refresh`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                refresh_token: creds.refresh_token,
+            }),
+        });
+    }
+    catch (err) {
+        // Network failure — keep creds, let the next spawn retry.
+        return {
+            ok: false,
+            action: "preserve",
+            message: `Network error: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (res.ok) {
+        // Parse body inside try/catch — a 200 response with truncated/malformed
+        // JSON (CDN/proxy mangling, connection drop mid-stream) would otherwise
+        // throw SyntaxError out of refreshIfNeeded and hit main()'s redact-only
+        // catch, giving the user no classification.
+        let token;
+        try {
+            token = (await res.json());
+        }
+        catch (err) {
+            return {
+                ok: false,
+                action: "transient",
+                message: `Malformed JSON in refresh response: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        if (!token.access_token ||
+            !token.refresh_token ||
+            !token.expires_in ||
+            !token.refresh_token_expires_in) {
+            // Server OK'd the request but returned an incomplete body. Treat as
+            // transient rather than reauth — the creds we have are still valid.
+            // (0 is not a legal OAuth2 TTL per RFC 6749; a server returning 0 is
+            // a regression, not a signal to delete credentials.)
+            return {
+                ok: false,
+                action: "transient",
+                message: "Refresh response missing required fields",
+            };
+        }
+        const now = Date.now();
+        const newCreds = {
+            ...creds,
+            access_token: token.access_token,
+            refresh_token: token.refresh_token,
+            expires_at: new Date(now + token.expires_in * 1000).toISOString(),
+            refresh_expires_at: new Date(now + token.refresh_token_expires_in * 1000).toISOString(),
+            expires_in: token.expires_in,
+        };
+        // Persist new credentials. If the disk write fails (EACCES, ENOSPC,
+        // EROFS), report `preserve` — the server already rotated the token
+        // server-side, so the old refresh_token is now in grace. Returning
+        // `ok: true` here would mean the next spawn reads stale creds and
+        // attempts to refresh with a rotated token, forcing an unnecessary
+        // re-auth. Preserving lets the user fix the disk issue and retry
+        // within the grace window.
+        try {
+            writeCredentials(newCreds, path);
+        }
+        catch (err) {
+            return {
+                ok: false,
+                action: "preserve",
+                message: `Could not persist refreshed credentials: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        return { ok: true, creds: newCreds };
+    }
+    let body = {};
+    try {
+        body = (await res.json());
+    }
+    catch {
+        // ALLOWED-CATCH: non-JSON body — classify on status alone
+    }
+    const action = classifyRefreshError(res.status, body);
+    const message = body.error_description ?? body.error ?? `HTTP ${res.status} ${res.statusText}`;
+    return { ok: false, action, message };
+}
+/**
+ * Read credentials from disk and refresh if the access token is expired.
+ *
+ * Returns:
+ * - `null` if no credentials exist (caller should show re-auth instructions)
+ * - `RefreshOutcome` with `ok: true` if creds are fresh or refresh succeeded
+ * - `RefreshOutcome` with `ok: false` if refresh failed (check `.action`)
+ *
+ * Intended use: called at proxy startup to replace the current "die if expired"
+ * branch in index.ts.
+ */
+export async function loadAndRefresh(server, path) {
+    const creds = readCredentials(path);
+    if (!creds)
+        return null;
+    // Access token still valid — no refresh needed.
+    const expiresAt = new Date(creds.expires_at).getTime();
+    const bufferMs = creds.expires_in * 1000 * 0.1;
+    if (Date.now() < expiresAt - bufferMs) {
+        return { ok: true, creds };
+    }
+    return refreshIfNeeded(creds, server, path);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pharaoh-so/mcp",
   "mcpName": "so.pharaoh/pharaoh",
-  "version": "0.3.21",
+  "version": "0.3.22",
   "description": "MCP proxy for Pharaoh — maps codebases into queryable knowledge graphs for AI agents. Enables Claude Code in headless environments (VPS, SSH, CI) via device flow auth.",
   "type": "module",
   "main": "dist/index.js",