@primitive.ai/prim 0.1.0-alpha.44 → 0.1.0-alpha.45

package/dist/{chunk-BSZGI5RL.js → chunk-6MKLCOEH.js}

@@ -1,7 +1,7 @@
 import {
   getClient,
   getSiteUrl
-} from "./chunk-W6PAKEDO.js";
+} from "./chunk-PI6LDYNJ.js";
 import {
   daemonRequest
 } from "./chunk-UTKQTZHL.js";

package/dist/{chunk-UISU3A7W.js → chunk-6TRRGGLD.js}

@@ -1,6 +1,6 @@
 import {
   getClient
-} from "./chunk-W6PAKEDO.js";
+} from "./chunk-PI6LDYNJ.js";
 
 // src/decisions/feedback.ts
 var FEEDBACK_PROTOCOL_VERSION = 1;

package/dist/{chunk-W6PAKEDO.js → chunk-PI6LDYNJ.js}

@@ -79,6 +79,7 @@ function getSiteUrl() {
   }
   return DEFAULT_API_URL;
 }
+var _endedRefreshToken;
 async function performTokenRefresh(options = {}) {
   if (!existsSync(REFRESH_TOKEN_PATH)) {
     return void 0;
@@ -87,6 +88,9 @@ async function performTokenRefresh(options = {}) {
   if (!refreshTokenValue) {
     return void 0;
   }
+  if (_endedRefreshToken !== void 0 && refreshTokenValue === _endedRefreshToken) {
+    return void 0;
+  }
   const siteUrl = getSiteUrl();
   const response = await fetch(`${siteUrl}/mcp/broker/refresh`, {
     method: "POST",
@@ -95,18 +99,23 @@ async function performTokenRefresh(options = {}) {
     signal: options.signal
   });
   if (!response.ok) {
-    if (options.quiet) return void 0;
     const detail = (await response.text().catch(() => "")).slice(0, 200);
-    process.stderr.write(
-      `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
+    if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) {
+      _endedRefreshToken = refreshTokenValue;
+    }
+    if (!options.quiet) {
+      process.stderr.write(
+        `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
 `
-    );
+      );
+    }
     return void 0;
   }
   const data = await response.json();
   if (!data.access_token) {
     return void 0;
   }
+  _endedRefreshToken = void 0;
   writeFileSync(TOKEN_FILE_PATH, data.access_token, { mode: 384 });
   if (data.refresh_token) {
     writeFileSync(REFRESH_TOKEN_PATH, data.refresh_token, { mode: 384 });

package/dist/{chunk-OKUXEBPT.js → chunk-ZWTZMTV5.js}

@@ -1,6 +1,6 @@
 import {
   getSiteUrl
-} from "./chunk-W6PAKEDO.js";
+} from "./chunk-PI6LDYNJ.js";
 
 // src/journal.ts
 import {

package/dist/daemon/server.js

@@ -88,6 +88,17 @@ function getSiteUrl() {
   }
   return DEFAULT_API_URL;
 }
+var _endedRefreshToken;
+function isSessionEnded() {
+  if (_endedRefreshToken === void 0) {
+    return false;
+  }
+  if (!existsSync(REFRESH_TOKEN_PATH)) {
+    return false;
+  }
+  const current = readFileSync(REFRESH_TOKEN_PATH, "utf-8").trim();
+  return current === _endedRefreshToken;
+}
 async function performTokenRefresh(options = {}) {
   if (!existsSync(REFRESH_TOKEN_PATH)) {
     return void 0;
@@ -96,6 +107,9 @@ async function performTokenRefresh(options = {}) {
   if (!refreshTokenValue) {
     return void 0;
   }
+  if (_endedRefreshToken !== void 0 && refreshTokenValue === _endedRefreshToken) {
+    return void 0;
+  }
   const siteUrl = getSiteUrl();
   const response = await fetch(`${siteUrl}/mcp/broker/refresh`, {
     method: "POST",
@@ -104,18 +118,23 @@ async function performTokenRefresh(options = {}) {
     signal: options.signal
   });
   if (!response.ok) {
-    if (options.quiet) return void 0;
     const detail = (await response.text().catch(() => "")).slice(0, 200);
-    process.stderr.write(
-      `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
+    if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) {
+      _endedRefreshToken = refreshTokenValue;
+    }
+    if (!options.quiet) {
+      process.stderr.write(
+        `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
 `
-    );
+      );
+    }
     return void 0;
   }
   const data = await response.json();
   if (!data.access_token) {
     return void 0;
   }
+  _endedRefreshToken = void 0;
   writeFileSync(TOKEN_FILE_PATH, data.access_token, { mode: 384 });
   if (data.refresh_token) {
     writeFileSync(REFRESH_TOKEN_PATH, data.refresh_token, { mode: 384 });
@@ -719,7 +738,7 @@ function createDaemonHealthState(version, pid, startedAt2) {
 function refreshDaemonHealth(state, now) {
   state.heartbeat.healthy = state.heartbeat.consecutiveFailures === 0 && state.heartbeat.lastSuccessAt !== void 0 && now - state.heartbeat.lastSuccessAt < HEARTBEAT_FRESH_MS;
   state.ingestion.healthy = state.ingestion.consecutiveFailures === 0 && !state.ingestion.pendingSampled && (state.ingestion.pendingCount === 0 || state.ingestion.oldestPendingAt !== void 0 && now - state.ingestion.oldestPendingAt <= INGESTION_SLA_MS);
-  state.healthy = state.heartbeat.healthy && state.ingestion.healthy;
+  state.healthy = state.heartbeat.healthy && state.ingestion.healthy && !state.needsReauth;
 }
 function retryDelayMs(consecutiveFailures, capMs, random) {
   const exponent = Math.max(0, consecutiveFailures - 1);
@@ -935,6 +954,7 @@ var heartbeatRerunRequested = false;
 var ownership;
 var socketServer;
 var shuttingDown = false;
+var reauthHold = false;
 function resolveRuntimeVersion() {
   if (process.env.PRIM_RUNTIME_VERSION) {
     return process.env.PRIM_RUNTIME_VERSION;
@@ -967,6 +987,42 @@ function updatePendingHealth() {
   daemonHealth.ingestion.oldestPendingAt = pending.oldestPendingAt;
   daemonHealth.ingestion.strandedCount = pending.strandedCount;
 }
+function enterReauthHold() {
+  if (reauthHold) {
+    return;
+  }
+  reauthHold = true;
+  daemonHealth.needsReauth = true;
+  if (heartbeatTimer) {
+    clearTimeout(heartbeatTimer);
+    heartbeatTimer = void 0;
+  }
+  if (ingestionTimer) {
+    clearTimeout(ingestionTimer);
+    ingestionTimer = void 0;
+  }
+  persistHealth();
+  process.stderr.write(
+    "[prim-daemon] authentication ended \u2014 halting heartbeat + ingestion until `prim auth login` (captures continue to the journal)\n"
+  );
+}
+function exitReauthHold() {
+  if (!reauthHold) {
+    return;
+  }
+  reauthHold = false;
+  daemonHealth.needsReauth = false;
+  daemonHealth.heartbeat.consecutiveFailures = 0;
+  daemonHealth.ingestion.consecutiveFailures = 0;
+  daemonHealth.heartbeat.lastError = void 0;
+  daemonHealth.ingestion.lastError = void 0;
+  persistHealth();
+  process.stderr.write(
+    "[prim-daemon] re-authentication detected \u2014 resuming heartbeat + ingestion\n"
+  );
+  void sendHeartbeat();
+  void runIngestionLoop();
+}
 async function takeOwnership() {
   const now = Date.now();
   const recordedOwner = readDaemonOwner(CONFIG_DIR);
@@ -1051,6 +1107,10 @@ async function performHeartbeat() {
     daemonHealth.heartbeat.lastError = errorMessage(err);
     daemonHealth.heartbeat.consecutiveFailures += 1;
     persistHealth();
+    if (isSessionEnded()) {
+      enterReauthHold();
+      return;
+    }
     process.stderr.write(`[prim-daemon] heartbeat error: ${errorMessage(err)}
 `);
   }
@@ -1076,7 +1136,7 @@ function sendHeartbeat() {
   return heartbeatInFlight;
 }
 function scheduleHeartbeat() {
-  if (shuttingDown) {
+  if (shuttingDown || reauthHold) {
     return;
   }
   const failures = daemonHealth.heartbeat.consecutiveFailures;
@@ -1101,7 +1161,7 @@ async function ensureTokenFresh() {
   }
 }
 function scheduleIngestion(delayMs) {
-  if (shuttingDown) {
+  if (shuttingDown || reauthHold) {
     return;
   }
   ingestionTimer = setTimeout(() => {
@@ -1154,6 +1214,10 @@ async function runIngestionLoop() {
     } catch {
     }
     persistHealth();
+    if (isSessionEnded()) {
+      enterReauthHold();
+      return;
+    }
     process.stderr.write(`[prim-daemon] ingestion error: ${errorMessage(err)}
 `);
     scheduleIngestion(delay);
@@ -1198,6 +1262,7 @@ function handleStatusSnapshot(params) {
     lastHeartbeatAt,
     version: runtimeVersion,
     healthy: daemonHealth.healthy,
+    needsReauth: daemonHealth.needsReauth === true,
     heartbeat: { ...daemonHealth.heartbeat },
     ingestion: { ...daemonHealth.ingestion }
   };
@@ -1338,7 +1403,16 @@ function startTimers() {
   void runTokenCheckLoop();
 }
 async function runTokenCheckLoop() {
-  await ensureTokenFresh();
+  if (reauthHold) {
+    if (!isSessionEnded()) {
+      exitReauthHold();
+    }
+  } else {
+    await ensureTokenFresh();
+    if (isSessionEnded()) {
+      enterReauthHold();
+    }
+  }
   if (!shuttingDown) {
     tokenCheckTimer = setTimeout(() => {
       tokenCheckTimer = void 0;

package/dist/hooks/post-commit.js

@@ -5,8 +5,8 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-OKUXEBPT.js";
-import "../chunk-W6PAKEDO.js";
+} from "../chunk-ZWTZMTV5.js";
+import "../chunk-PI6LDYNJ.js";
 
 // src/hooks/post-commit.ts
 import { execSync, spawn } from "child_process";

package/dist/hooks/post-tool-use.js

@@ -13,7 +13,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-OKUXEBPT.js";
+} from "../chunk-ZWTZMTV5.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-IMAIBPUC.js";
@@ -23,7 +23,7 @@ import {
 } from "../chunk-F7O7V6ZM.js";
 import {
   getClient
-} from "../chunk-W6PAKEDO.js";
+} from "../chunk-PI6LDYNJ.js";
 import {
   normalizeEnvelope,
   parseAgent

package/dist/hooks/pre-commit.js

@@ -2,8 +2,8 @@
 import {
   checkAffectedDecisions,
   formatDecisionsWarning
-} from "../chunk-BSZGI5RL.js";
-import "../chunk-W6PAKEDO.js";
+} from "../chunk-6MKLCOEH.js";
+import "../chunk-PI6LDYNJ.js";
 import "../chunk-UTKQTZHL.js";
 
 // src/hooks/pre-commit.ts

package/dist/hooks/pre-tool-use.js

@@ -6,7 +6,7 @@ import {
 import {
   getClient,
   getSiteUrl
-} from "../chunk-W6PAKEDO.js";
+} from "../chunk-PI6LDYNJ.js";
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";

package/dist/hooks/prim-hook.js

@@ -9,7 +9,7 @@ import {
 import {
   appendMove,
   resolveOrg
-} from "../chunk-OKUXEBPT.js";
+} from "../chunk-ZWTZMTV5.js";
 import {
   buildHookOutput,
   handoffHookOutput
@@ -19,7 +19,7 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-UISU3A7W.js";
+} from "../chunk-6TRRGGLD.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-IMAIBPUC.js";
@@ -27,7 +27,7 @@ import {
   isRepoActiveForCapture,
   warmBinCache
 } from "../chunk-F7O7V6ZM.js";
-import "../chunk-W6PAKEDO.js";
+import "../chunk-PI6LDYNJ.js";
 import {
   normalizeEnvelope,
   parseAgent

package/dist/hooks/session-start.js

@@ -8,7 +8,7 @@ import {
   acknowledgeDecisionFeedback,
   leaseDecisionFeedback,
   renderFeedback
-} from "../chunk-UISU3A7W.js";
+} from "../chunk-6TRRGGLD.js";
 import {
   getOrCreateWorkspaceId
 } from "../chunk-IMAIBPUC.js";
@@ -19,7 +19,7 @@ import {
 } from "../chunk-F7O7V6ZM.js";
 import {
   getSiteUrl
-} from "../chunk-W6PAKEDO.js";
+} from "../chunk-PI6LDYNJ.js";
 import {
   daemonRequest
 } from "../chunk-UTKQTZHL.js";

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   checkAffectedDecisions,
   daemonOrDirectGet,
   formatDecisionsWarning
-} from "./chunk-BSZGI5RL.js";
+} from "./chunk-6MKLCOEH.js";
 import {
   JOURNAL_DIR,
   SESSIONS_DIR,
@@ -21,10 +21,10 @@ import {
   listFlushing,
   pendingJournalStats,
   readMovesFromPath
-} from "./chunk-OKUXEBPT.js";
+} from "./chunk-ZWTZMTV5.js";
 import {
   fetchFeedbackCapability
-} from "./chunk-UISU3A7W.js";
+} from "./chunk-6TRRGGLD.js";
 import {
   inspectWorkspaceId
 } from "./chunk-IMAIBPUC.js";
@@ -48,7 +48,7 @@ import {
   getSiteUrl,
   getTokenExpiresAt,
   saveTokenExpiry
-} from "./chunk-W6PAKEDO.js";
+} from "./chunk-PI6LDYNJ.js";
 import {
   daemonIsLive,
   daemonRequest
@@ -3195,6 +3195,13 @@ function classifyDaemonHealth(snapshot, options = {}) {
       detail: `launchd does not own the daemon socket (launchd ${String(options.service.pid ?? "none")} \xB7 socket ${String(snapshot.pid ?? "none")})`
     };
   }
+  if (snapshot.needsReauth) {
+    return {
+      name: "daemon",
+      status: "fail",
+      detail: "authentication ended \u2014 run `prim auth login`"
+    };
+  }
   if (!snapshot.heartbeat?.healthy) {
     return {
       name: "daemon",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitive.ai/prim",
-  "version": "0.1.0-alpha.44",
+  "version": "0.1.0-alpha.45",
   "description": "CLI for Primitive's decision graph — passive decision capture, conflict gate, and team presence",
   "type": "module",
   "license": "MIT",