@primitive.ai/prim 0.1.0-alpha.44 → 0.1.0-alpha.46

package/dist/daemon/server.js

@@ -1,44 +1,211 @@
 #!/usr/bin/env node
 
 // src/daemon/server.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4, unlinkSync as unlinkSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
 import { createServer } from "net";
 import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/client.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
 import { homedir } from "os";
-import { join, resolve } from "path";
+import { dirname as dirname2, join as join2, resolve } from "path";
+
+// src/lib/file-lock.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_POLL_MS = 50;
+var DEFAULT_INIT_GRACE_MS = 2e3;
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+function ownerPath(lockDir) {
+  return join(lockDir, "owner.json");
+}
+function readOwner(lockDir) {
+  try {
+    const owner = JSON.parse(readFileSync(ownerPath(lockDir), "utf8"));
+    if (!Number.isInteger(owner.pid) || owner.pid <= 0 || typeof owner.nonce !== "string" || typeof owner.createdAt !== "number") {
+      return null;
+    }
+    return owner;
+  } catch {
+    return null;
+  }
+}
+function sameOwner(a, b) {
+  return a?.pid === b.pid && a.nonce === b.nonce && a.createdAt === b.createdAt;
+}
+function tryTakeLock(lockDir, now) {
+  try {
+    mkdirSync(lockDir, { mode: DIRECTORY_MODE });
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  const owner = {
+    pid: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    createdAt: now
+  };
+  try {
+    writeFileSync(ownerPath(lockDir), `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      mode: FILE_MODE,
+      flag: "wx"
+    });
+    return owner;
+  } catch (error) {
+    rmSync(lockDir, { recursive: true, force: true });
+    throw error;
+  }
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function recoverStaleLock(lockDir, now, alive, initGraceMs) {
+  const owner = readOwner(lockDir);
+  if (owner) {
+    if (alive(owner.pid)) return false;
+    if (!sameOwner(readOwner(lockDir), owner)) return false;
+    rmSync(lockDir, { recursive: true, force: true });
+    return true;
+  }
+  try {
+    const before = statSync(lockDir).mtimeMs;
+    if (now - before < initGraceMs) return false;
+    if (readOwner(lockDir)) return false;
+    if (statSync(lockDir).mtimeMs !== before) return false;
+    rmSync(lockDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return true;
+  }
+}
+function abortError(signal) {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted) throw abortError(signal);
+}
+async function defaultSleep(ms, signal) {
+  if (!signal) {
+    await new Promise((resolve2) => setTimeout(resolve2, ms));
+    return;
+  }
+  throwIfAborted(signal);
+  await new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve2();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function withFileLock(lockDir, operation, options = {}) {
+  mkdirSync(dirname(lockDir), { recursive: true, mode: DIRECTORY_MODE });
+  const nowMs = options.nowMs ?? Date.now;
+  const alive = options.processAlive ?? processIsAlive;
+  const deadline = nowMs() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  let owner = null;
+  while (!owner) {
+    throwIfAborted(options.signal);
+    const now = nowMs();
+    owner = tryTakeLock(lockDir, now);
+    if (owner) break;
+    recoverStaleLock(lockDir, now, alive, options.initGraceMs ?? DEFAULT_INIT_GRACE_MS);
+    if (now >= deadline) {
+      throw new Error(`timed out waiting for file lock ${lockDir}`);
+    }
+    if (options.sleep) {
+      await options.sleep(options.pollMs ?? DEFAULT_POLL_MS);
+      throwIfAborted(options.signal);
+    } else {
+      await defaultSleep(options.pollMs ?? DEFAULT_POLL_MS, options.signal);
+    }
+  }
+  try {
+    throwIfAborted(options.signal);
+    return await operation();
+  } finally {
+    if (sameOwner(readOwner(lockDir), owner)) {
+      rmSync(lockDir, { recursive: true, force: true });
+    }
+  }
+}
+
+// src/client.ts
+var CONFIG_DIR_MODE = 448;
+var CREDENTIAL_FILE_MODE = 384;
+var REFRESH_THRESHOLD_MS = 6e4;
+var DEFAULT_API_URL = "https://api.getprimitive.ai";
 function loadEnvFile() {
   const envVars = {};
-  const candidates = [".env.local", ".env"];
-  for (const file of candidates) {
+  for (const file of [".env.local", ".env"]) {
     const filePath = resolve(process.cwd(), file);
-    if (existsSync(filePath)) {
-      const content = readFileSync(filePath, "utf-8");
-      for (const line of content.split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#")) continue;
-        const eqIdx = trimmed.indexOf("=");
-        if (eqIdx === -1) continue;
-        const key = trimmed.slice(0, eqIdx).trim();
-        const value = trimmed.slice(eqIdx + 1).trim();
-        envVars[key] = value;
-      }
+    if (!existsSync2(filePath)) continue;
+    const content = readFileSync2(filePath, "utf-8");
+    for (const line of content.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIdx = trimmed.indexOf("=");
+      if (eqIdx === -1) continue;
+      envVars[trimmed.slice(0, eqIdx).trim()] = trimmed.slice(eqIdx + 1).trim();
     }
   }
   return envVars;
 }
-var TOKEN_FILE_PATH = join(homedir(), ".config", "prim", "token");
-var REFRESH_TOKEN_PATH = TOKEN_FILE_PATH.replace("/token", "/refresh_token");
-var TOKEN_EXPIRES_PATH = join(homedir(), ".config", "prim", "token_expires_at");
-var REFRESH_THRESHOLD_MS = 6e4;
-function isTokenExpiringSoon() {
-  if (!existsSync(TOKEN_EXPIRES_PATH)) return false;
-  const expiresAt = Number(readFileSync(TOKEN_EXPIRES_PATH, "utf-8").trim());
-  return !Number.isNaN(expiresAt) && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
+var TOKEN_FILE_PATH = join2(homedir(), ".config", "prim", "token");
+var REFRESH_TOKEN_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(dirname2(TOKEN_FILE_PATH), "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(dirname2(TOKEN_FILE_PATH), "refresh_terminal");
+var CREDENTIAL_LOCK_PATH = join2(dirname2(TOKEN_FILE_PATH), "credentials.lock");
+function readTrimmed(path) {
+  try {
+    const value = readFileSync2(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential() {
+  if (process.env.PRIM_TOKEN) {
+    return { token: process.env.PRIM_TOKEN, source: "environment" };
+  }
+  const stored = readTrimmed(TOKEN_FILE_PATH);
+  if (stored) {
+    return { token: stored, source: "token_file" };
+  }
+  const envToken = loadEnvFile().PRIM_TOKEN;
+  return envToken ? { token: envToken, source: "env_file" } : void 0;
+}
+function getSiteUrl() {
+  if (process.env.PRIM_API_URL) return process.env.PRIM_API_URL;
+  return loadEnvFile().PRIM_API_URL ?? DEFAULT_API_URL;
 }
 function getJwtExpiry(token) {
   const parts = token.split(".");
@@ -50,93 +217,169 @@ function getJwtExpiry(token) {
     return void 0;
   }
 }
-function saveTokenExpiry(token, expiresIn) {
-  const expiresAt = expiresIn ? Date.now() + expiresIn * 1e3 : getJwtExpiry(token);
-  if (expiresAt) {
-    writeFileSync(TOKEN_EXPIRES_PATH, String(expiresAt), { mode: 384 });
+function expiresAtFor(token, expiresIn) {
+  return expiresIn === void 0 ? getJwtExpiry(token) : Date.now() + expiresIn * 1e3;
+}
+function ensureConfigDirectory() {
+  const directory = dirname2(TOKEN_FILE_PATH);
+  mkdirSync2(directory, { recursive: true, mode: CONFIG_DIR_MODE });
+  chmodSync(directory, CONFIG_DIR_MODE);
+}
+function atomicWrite(path, content) {
+  ensureConfigDirectory();
+  const temp = join2(
+    dirname2(path),
+    `.${path.slice(dirname2(path).length + 1)}.tmp-${process.pid}-${randomBytes2(8).toString("hex")}`
+  );
+  try {
+    writeFileSync2(temp, content, {
+      encoding: "utf8",
+      mode: CREDENTIAL_FILE_MODE,
+      flag: "wx"
+    });
+    renameSync(temp, path);
+  } catch (error) {
+    rmSync2(temp, { force: true });
+    throw error;
   }
 }
+function removeCredentialFile(path) {
+  if (!existsSync2(path)) return false;
+  rmSync2(path, { force: true });
+  return true;
+}
 function getTokenExpiresAt() {
-  if (!existsSync(TOKEN_EXPIRES_PATH)) return void 0;
-  const val = Number(readFileSync(TOKEN_EXPIRES_PATH, "utf-8").trim());
-  return Number.isNaN(val) ? void 0 : val;
+  const stored = readTrimmed(TOKEN_EXPIRES_PATH);
+  if (stored === void 0) return void 0;
+  const value = Number(stored);
+  return Number.isNaN(value) ? void 0 : value;
 }
-function getAuthToken() {
-  if (process.env.PRIM_TOKEN) {
-    return process.env.PRIM_TOKEN;
-  }
-  if (existsSync(TOKEN_FILE_PATH)) {
-    const token = readFileSync(TOKEN_FILE_PATH, "utf-8").trim();
-    if (token) {
-      return token;
-    }
-  }
-  const envVars = loadEnvFile();
-  if (envVars.PRIM_TOKEN) {
-    return envVars.PRIM_TOKEN;
-  }
-  return void 0;
+function isTokenExpiringSoon(credential) {
+  if (credential.source !== "token_file") return false;
+  const expiresAt = getTokenExpiresAt();
+  return expiresAt !== void 0 && Date.now() >= expiresAt - REFRESH_THRESHOLD_MS;
 }
-var DEFAULT_API_URL = "https://api.getprimitive.ai";
-function getSiteUrl() {
-  if (process.env.PRIM_API_URL) {
-    return process.env.PRIM_API_URL;
-  }
-  const envVars = loadEnvFile();
-  if (envVars.PRIM_API_URL) {
-    return envVars.PRIM_API_URL;
-  }
-  return DEFAULT_API_URL;
+function refreshFingerprint(refreshToken2) {
+  return createHash("sha256").update(refreshToken2).digest("hex");
 }
-async function performTokenRefresh(options = {}) {
-  if (!existsSync(REFRESH_TOKEN_PATH)) {
-    return void 0;
+function terminalFingerprint() {
+  return readTrimmed(TERMINAL_REFRESH_PATH);
+}
+function writeTerminalFingerprint(refreshToken2) {
+  atomicWrite(TERMINAL_REFRESH_PATH, `${refreshFingerprint(refreshToken2)}
+`);
+}
+function clearTerminalFingerprint() {
+  removeCredentialFile(TERMINAL_REFRESH_PATH);
+}
+function isSessionEnded() {
+  if (resolveAuthCredential()?.source !== "token_file") return false;
+  const refreshToken2 = readTrimmed(REFRESH_TOKEN_PATH);
+  const ended = terminalFingerprint();
+  return Boolean(refreshToken2 && ended && refreshFingerprint(refreshToken2) === ended);
+}
+function withCredentialLock(operation, options = {}) {
+  return withFileLock(CREDENTIAL_LOCK_PATH, operation, options);
+}
+function commitCredentialsUnlocked(credentials) {
+  const accessToken = credentials.accessToken.trim();
+  const refreshToken2 = credentials.refreshToken.trim();
+  if (!accessToken || !refreshToken2) {
+    throw new Error("OAuth credentials require both access and refresh tokens");
   }
-  const refreshTokenValue = readFileSync(REFRESH_TOKEN_PATH, "utf-8").trim();
-  if (!refreshTokenValue) {
-    return void 0;
+  atomicWrite(REFRESH_TOKEN_PATH, `${refreshToken2}
+`);
+  const expiresAt = expiresAtFor(accessToken, credentials.expiresIn);
+  if (expiresAt === void 0) removeCredentialFile(TOKEN_EXPIRES_PATH);
+  else atomicWrite(TOKEN_EXPIRES_PATH, `${expiresAt}
+`);
+  atomicWrite(TOKEN_FILE_PATH, `${accessToken}
+`);
+  clearTerminalFingerprint();
+  _cachedCredential = { token: accessToken, source: "token_file" };
+}
+function isTerminalRefreshResponse(response, detail) {
+  if (detail.includes("invalid_grant") || detail.includes("Session has already ended")) return true;
+  try {
+    const error = JSON.parse(detail).error;
+    return error === "invalid_grant" || response.status === 401 && error === "Invalid or expired refresh token";
+  } catch {
+    return response.status === 401 && detail.includes("Invalid or expired refresh token");
   }
-  const siteUrl = getSiteUrl();
-  const response = await fetch(`${siteUrl}/mcp/broker/refresh`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ refresh_token: refreshTokenValue }),
-    signal: options.signal
-  });
-  if (!response.ok) {
-    if (options.quiet) return void 0;
-    const detail = (await response.text().catch(() => "")).slice(0, 200);
-    process.stderr.write(
-      `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
+}
+function refreshDiagnostic(response, detail, quiet) {
+  if (quiet) return;
+  process.stderr.write(
+    `[prim] token refresh rejected by broker: ${response.status} ${response.statusText}${detail ? ` \u2014 ${detail}` : ""}
 `
-    );
-    return void 0;
-  }
-  const data = await response.json();
-  if (!data.access_token) {
-    return void 0;
-  }
-  writeFileSync(TOKEN_FILE_PATH, data.access_token, { mode: 384 });
-  if (data.refresh_token) {
-    writeFileSync(REFRESH_TOKEN_PATH, data.refresh_token, { mode: 384 });
-  }
-  saveTokenExpiry(data.access_token, data.expires_in);
-  return data.access_token;
+  );
+}
+async function performTokenRefresh(options = {}) {
+  const selected = resolveAuthCredential();
+  if (selected?.source !== "token_file") return void 0;
+  const startingGeneration = readTrimmed(REFRESH_TOKEN_PATH);
+  if (!startingGeneration || isSessionEnded()) return void 0;
+  return withCredentialLock(
+    async () => {
+      const currentCredential = resolveAuthCredential();
+      if (currentCredential?.source !== "token_file") return void 0;
+      const currentGeneration = readTrimmed(REFRESH_TOKEN_PATH);
+      if (!currentGeneration) return void 0;
+      if (currentGeneration !== startingGeneration) {
+        return currentCredential.token;
+      }
+      if (isSessionEnded()) return void 0;
+      const response = await fetch(`${getSiteUrl()}/mcp/broker/refresh`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh_token: currentGeneration }),
+        signal: options.signal
+      });
+      if (!response.ok) {
+        const detail = (await response.text().catch(() => "")).slice(0, 200);
+        if (isTerminalRefreshResponse(response, detail) && readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        refreshDiagnostic(response, detail, options.quiet);
+        const winner = resolveAuthCredential();
+        return readTrimmed(REFRESH_TOKEN_PATH) !== currentGeneration && winner?.source === "token_file" ? winner.token : void 0;
+      }
+      let data;
+      try {
+        data = await response.json();
+      } catch {
+        if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        return void 0;
+      }
+      const record = typeof data === "object" && data !== null && !Array.isArray(data) ? data : void 0;
+      const accessToken = typeof record?.access_token === "string" ? record.access_token.trim() : "";
+      const replacementRefreshToken = typeof record?.refresh_token === "string" ? record.refresh_token.trim() : "";
+      if (!(accessToken && replacementRefreshToken) || replacementRefreshToken === currentGeneration) {
+        if (readTrimmed(REFRESH_TOKEN_PATH) === currentGeneration) {
+          writeTerminalFingerprint(currentGeneration);
+        }
+        return void 0;
+      }
+      commitCredentialsUnlocked({
+        accessToken,
+        refreshToken: replacementRefreshToken,
+        expiresIn: typeof record?.expires_in === "number" && Number.isFinite(record.expires_in) ? record.expires_in : void 0
+      });
+      return accessToken;
+    },
+    { signal: options.signal }
+  );
 }
 var _refreshInFlight;
 function refreshToken(options = {}) {
-  if (_refreshInFlight) {
-    return _refreshInFlight;
-  }
+  if (_refreshInFlight) return _refreshInFlight;
   const attempt = performTokenRefresh(options).then((token) => {
-    if (token) {
-      _cachedToken = token;
-    }
+    if (token) _cachedCredential = { token, source: "token_file" };
     return token;
   }).finally(() => {
-    if (_refreshInFlight === attempt) {
-      _refreshInFlight = void 0;
-    }
+    if (_refreshInFlight === attempt) _refreshInFlight = void 0;
   });
   _refreshInFlight = attempt;
   return attempt;
@@ -149,29 +392,29 @@ var HttpError = class extends Error {
     this.status = status;
   }
 };
-var _cachedToken;
-async function request(method, path, body, options) {
-  const siteUrl = getSiteUrl();
-  const url = `${siteUrl}${path}`;
-  if (!_cachedToken) {
-    _cachedToken = getAuthToken();
+var _cachedCredential;
+function selectedCredential() {
+  const resolved = resolveAuthCredential();
+  if (!_cachedCredential || resolved?.token !== _cachedCredential.token || resolved?.source !== _cachedCredential.source) {
+    _cachedCredential = resolved;
   }
-  if (_cachedToken && isTokenExpiringSoon()) {
-    const newToken = await refreshToken({
+  return _cachedCredential;
+}
+async function request(method, path, body, options) {
+  const url = `${getSiteUrl()}${path}`;
+  let credential = selectedCredential();
+  let refreshAttempted = false;
+  if (credential && isTokenExpiringSoon(credential)) {
+    refreshAttempted = true;
+    const token = await refreshToken({
       signal: options?.signal,
       quiet: options?.quietRefresh
     });
-    if (newToken) {
-      _cachedToken = newToken;
-    }
+    if (token) credential = { token, source: "token_file" };
   }
-  const doFetch = async (token) => {
-    const headers = {
-      "Content-Type": "application/json"
-    };
-    if (token) {
-      headers.Authorization = `Bearer ${token}`;
-    }
+  const doFetch = (token) => {
+    const headers = { "Content-Type": "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
     return fetch(url, {
       method,
       headers,
@@ -179,26 +422,31 @@ async function request(method, path, body, options) {
       signal: options?.signal
     });
   };
-  const tokenUsed = _cachedToken;
-  let res = await doFetch(tokenUsed);
-  if (res.status === 401) {
-    const newToken = _cachedToken && _cachedToken !== tokenUsed ? _cachedToken : await refreshToken({
-      signal: options?.signal,
-      quiet: options?.quietRefresh
-    });
-    if (newToken) {
-      _cachedToken = newToken;
-      res = await doFetch(newToken);
+  const tokenUsed = credential?.token;
+  let response = await doFetch(tokenUsed);
+  if (response.status === 401) {
+    const latest = resolveAuthCredential();
+    let retryToken = latest?.token !== tokenUsed ? latest?.token : void 0;
+    if (!retryToken && latest?.source === "token_file" && !refreshAttempted) {
+      refreshAttempted = true;
+      retryToken = await refreshToken({ signal: options?.signal, quiet: options?.quietRefresh });
+    }
+    if (retryToken) {
+      _cachedCredential = {
+        token: retryToken,
+        source: latest?.source === "token_file" ? "token_file" : latest?.source ?? "token_file"
+      };
+      response = await doFetch(retryToken);
     }
   }
-  if (!res.ok) {
-    if (res.status === 401) {
+  if (!response.ok) {
+    if (response.status === 401) {
       throw new HttpError(401, "Authentication expired. Run `prim auth login` to re-authenticate.");
     }
-    const errorBody = await res.json().catch(() => null);
-    throw new HttpError(res.status, errorBody?.error ?? `HTTP ${res.status}`);
+    const errorBody = await response.json().catch(() => null);
+    throw new HttpError(response.status, errorBody?.error ?? `HTTP ${response.status}`);
   }
-  return res.json();
+  return response.json();
 }
 function getClient() {
   return {
@@ -208,7 +456,7 @@ function getClient() {
 }
 
 // src/flusher.ts
-import { createReadStream, renameSync, unlinkSync } from "fs";
+import { createReadStream, renameSync as renameSync2, unlinkSync } from "fs";
 import { createInterface } from "readline";
 
 // src/ingest-response.ts
@@ -238,18 +486,18 @@ function requireDurableIngestAcknowledgement(value, expected) {
 import {
   appendFileSync,
   closeSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   fstatSync,
-  mkdirSync,
+  mkdirSync as mkdirSync3,
   openSync,
   opendirSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   readSync,
   readdirSync
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
-var JOURNAL_DIR = join2(homedir2(), ".config", "prim", "moves");
+import { dirname as dirname3, join as join3 } from "path";
+var JOURNAL_DIR = join3(homedir2(), ".config", "prim", "moves");
 var JOURNAL_BASENAME = "journal.ndjson";
 var JOURNAL_STATS_SAMPLE_BYTES = 64 * 1024;
 var PENDING_STATS_MAX_FILES = 128;
@@ -261,7 +509,7 @@ function envSlug(apiUrl) {
   return slug;
 }
 function currentEnvDir() {
-  return join2(JOURNAL_DIR, envSlug(getSiteUrl()));
+  return join3(JOURNAL_DIR, envSlug(getSiteUrl()));
 }
 function parseMoves(content) {
   const moves = [];
@@ -279,15 +527,15 @@ function parseMoves(content) {
 function listBuckets() {
   const out = [];
   const envDir = currentEnvDir();
-  if (!existsSync2(envDir)) {
+  if (!existsSync3(envDir)) {
     return out;
   }
   for (const entry of readdirSync(envDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const path = join2(envDir, entry.name, JOURNAL_BASENAME);
-    if (existsSync2(path)) {
+    const path = join3(envDir, entry.name, JOURNAL_BASENAME);
+    if (existsSync3(path)) {
       out.push({ bucket: entry.name, path });
     }
   }
@@ -345,7 +593,7 @@ function parseFlushingPid(name) {
   return last !== void 0 && /^[0-9]+$/.test(last) ? Number(last) : void 0;
 }
 function listFlushingInDir(dir, bucket, options = {}) {
-  if (!existsSync2(dir)) {
+  if (!existsSync3(dir)) {
     return [];
   }
   const out = [];
@@ -359,7 +607,7 @@ function listFlushingInDir(dir, bucket, options = {}) {
         entry = entries.readSync();
         continue;
       }
-      const path = join2(dir, entry.name);
+      const path = join3(dir, entry.name);
       let sample;
       try {
         sample = sampleJournalFile(path, remainingBytes);
@@ -386,7 +634,7 @@ function listFlushingInDir(dir, bucket, options = {}) {
 }
 function listFlushing(options = {}) {
   const envDir = currentEnvDir();
-  if (!existsSync2(envDir)) {
+  if (!existsSync3(envDir)) {
     return [];
   }
   const out = [];
@@ -397,7 +645,7 @@ function listFlushing(options = {}) {
       break;
     }
     if (entry.isDirectory()) {
-      const found = listFlushingInDir(join2(envDir, entry.name), entry.name, {
+      const found = listFlushingInDir(join3(envDir, entry.name), entry.name, {
         sampleBytes: remainingBytes,
         maxFiles: maxFiles - out.length
       });
@@ -501,7 +749,7 @@ async function drainFlushingPath(flushingPath, client2 = getClient()) {
 async function drainPath(path) {
   const tmpPath = `${path}.flushing.${String(Date.now())}.${String(process.pid)}`;
   try {
-    renameSync(path, tmpPath);
+    renameSync2(path, tmpPath);
   } catch (err) {
     if (err.code === "ENOENT") {
       return 0;
@@ -510,7 +758,7 @@ async function drainPath(path) {
   }
   return drainFlushingPath(tmpPath);
 }
-function processIsAlive(pid) {
+function processIsAlive2(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -520,7 +768,7 @@ function processIsAlive(pid) {
 }
 function selectRecoverable(files, now, opts = {}) {
   const quarantineMs = opts.quarantineMs ?? ORPHAN_QUARANTINE_MS;
-  const isAlive = opts.isAlive ?? processIsAlive;
+  const isAlive = opts.isAlive ?? processIsAlive2;
   return files.filter((f) => {
     if (f.pid === void 0) {
       return now - f.mtimeMs > quarantineMs;
@@ -592,14 +840,14 @@ function flush() {
 // src/daemon/client.ts
 import { createConnection } from "net";
 import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-var SOCK_PATH = join3(homedir3(), ".config", "prim", "sock");
-var DEFAULT_TIMEOUT_MS = 250;
+import { join as join4 } from "path";
+var SOCK_PATH = join4(homedir3(), ".config", "prim", "sock");
+var DEFAULT_TIMEOUT_MS2 = 250;
 var nextRequestId = 1;
 function daemonRequest(method, params = {}, opts = {}) {
   const id = nextRequestId++;
   const request2 = { id, method, params };
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   return new Promise((resolve2) => {
     let settled = false;
     let socket;
@@ -686,17 +934,17 @@ function assertCallerEnvMatches(callerEnv, boundEnv) {
 }
 
 // src/daemon/health.ts
-import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync2, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync4, mkdirSync as mkdirSync4, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join4 } from "path";
-var CONFIG_DIR_MODE = 448;
+import { dirname as dirname4, join as join5 } from "path";
+var CONFIG_DIR_MODE2 = 448;
 var HEALTH_FILE_MODE = 384;
 var INGESTION_SLA_MS = 3e4;
 var HEARTBEAT_FRESH_MS = 9e4;
 var HEARTBEAT_RETRY_CAP_MS = 3e4;
 var INGESTION_RETRY_BASE_MS = 5e3;
 var INGESTION_RETRY_CAP_MS = 15e3;
-var DAEMON_HEALTH_PATH = join4(homedir4(), ".config", "prim", "daemon-health.json");
+var DAEMON_HEALTH_PATH = join5(homedir4(), ".config", "prim", "daemon-health.json");
 function createDaemonHealthState(version, pid, startedAt2) {
   return {
     schemaVersion: 1,
@@ -719,7 +967,7 @@ function createDaemonHealthState(version, pid, startedAt2) {
 function refreshDaemonHealth(state, now) {
   state.heartbeat.healthy = state.heartbeat.consecutiveFailures === 0 && state.heartbeat.lastSuccessAt !== void 0 && now - state.heartbeat.lastSuccessAt < HEARTBEAT_FRESH_MS;
   state.ingestion.healthy = state.ingestion.consecutiveFailures === 0 && !state.ingestion.pendingSampled && (state.ingestion.pendingCount === 0 || state.ingestion.oldestPendingAt !== void 0 && now - state.ingestion.oldestPendingAt <= INGESTION_SLA_MS);
-  state.healthy = state.heartbeat.healthy && state.ingestion.healthy;
+  state.healthy = state.heartbeat.healthy && state.ingestion.healthy && !state.needsReauth;
 }
 function retryDelayMs(consecutiveFailures, capMs, random) {
   const exponent = Math.max(0, consecutiveFailures - 1);
@@ -734,37 +982,37 @@ function ingestionRetryDelayMs(consecutiveFailures, random = Math.random) {
   return retryDelayMs(consecutiveFailures, INGESTION_RETRY_CAP_MS, random);
 }
 function writeDaemonHealthState(state, path = DAEMON_HEALTH_PATH) {
-  const dir = dirname2(path);
-  if (!existsSync3(dir)) {
-    mkdirSync2(dir, { recursive: true, mode: CONFIG_DIR_MODE });
+  const dir = dirname4(path);
+  if (!existsSync4(dir)) {
+    mkdirSync4(dir, { recursive: true, mode: CONFIG_DIR_MODE2 });
   }
-  const tmp = join4(dir, `.${process.pid}.daemon-health.tmp`);
-  writeFileSync2(tmp, `${JSON.stringify(state, null, 2)}
+  const tmp = join5(dir, `.${process.pid}.daemon-health.tmp`);
+  writeFileSync3(tmp, `${JSON.stringify(state, null, 2)}
 `, { mode: HEALTH_FILE_MODE });
-  chmodSync(tmp, HEALTH_FILE_MODE);
-  renameSync2(tmp, path);
+  chmodSync2(tmp, HEALTH_FILE_MODE);
+  renameSync3(tmp, path);
 }
 
 // src/daemon/instance-lock.ts
 import { randomUUID } from "crypto";
 import {
-  chmodSync as chmodSync2,
-  existsSync as existsSync4,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync3,
-  renameSync as renameSync3,
-  rmSync,
-  statSync,
+  chmodSync as chmodSync3,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync3,
+  statSync as statSync2,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var DIR_MODE = 448;
-var FILE_MODE = 384;
+var FILE_MODE2 = 384;
 var DAEMON_STARTUP_GRACE_MS = 5e3;
 function readLockRecord(path) {
   try {
-    const value = JSON.parse(readFileSync3(path, "utf-8"));
+    const value = JSON.parse(readFileSync4(path, "utf-8"));
     if (Number.isInteger(value.pid) && typeof value.instanceId === "string" && typeof value.startedAt === "number") {
       return value;
     }
@@ -774,7 +1022,7 @@ function readLockRecord(path) {
 }
 function numericPid(path) {
   try {
-    const pid = Number(readFileSync3(path, "utf-8").trim());
+    const pid = Number(readFileSync4(path, "utf-8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
   } catch {
     return;
@@ -789,16 +1037,16 @@ function daemonProcessIsAlive(pid) {
   }
 }
 function readDaemonOwner(configDir) {
-  return readLockRecord(join5(configDir, "daemon.lock", "owner.json"));
+  return readLockRecord(join6(configDir, "daemon.lock", "owner.json"));
 }
 function readDaemonPid(configDir) {
-  const path = join5(configDir, "daemon.pid");
+  const path = join6(configDir, "daemon.pid");
   const pid = numericPid(path);
   if (pid === void 0) {
     return;
   }
   try {
-    return { pid, mtimeMs: statSync(path).mtimeMs };
+    return { pid, mtimeMs: statSync2(path).mtimeMs };
   } catch {
     return;
   }
@@ -807,29 +1055,29 @@ function acquireDaemonOwnership(configDir, opts = {}) {
   const pid = opts.pid ?? process.pid;
   const now = opts.now ?? Date.now();
   const isAlive = opts.isAlive ?? daemonProcessIsAlive;
-  const lockDir = join5(configDir, "daemon.lock");
-  const ownerPath = join5(lockDir, "owner.json");
-  const pidPath = join5(configDir, "daemon.pid");
+  const lockDir = join6(configDir, "daemon.lock");
+  const ownerPath2 = join6(lockDir, "owner.json");
+  const pidPath = join6(configDir, "daemon.pid");
   const instanceId = randomUUID();
-  if (!existsSync4(configDir)) {
-    mkdirSync3(configDir, { recursive: true, mode: DIR_MODE });
+  if (!existsSync5(configDir)) {
+    mkdirSync5(configDir, { recursive: true, mode: DIR_MODE });
   }
   for (; ; ) {
     try {
-      mkdirSync3(lockDir, { mode: DIR_MODE });
+      mkdirSync5(lockDir, { mode: DIR_MODE });
       break;
     } catch (err) {
       if (err.code !== "EEXIST") {
         throw err;
       }
-      const existing = readLockRecord(ownerPath);
+      const existing = readLockRecord(ownerPath2);
       if (existing && isAlive(existing.pid)) {
         throw new Error(`daemon already running (pid=${String(existing.pid)})`);
       }
       if (!existing) {
         let mtimeMs;
         try {
-          mtimeMs = statSync(lockDir).mtimeMs;
+          mtimeMs = statSync2(lockDir).mtimeMs;
         } catch (statErr) {
           if (statErr.code === "ENOENT") {
             continue;
@@ -842,8 +1090,8 @@ function acquireDaemonOwnership(configDir, opts = {}) {
       }
       const stale = `${lockDir}.stale.${String(pid)}.${instanceId}`;
       try {
-        renameSync3(lockDir, stale);
-        rmSync(stale, { recursive: true, force: true });
+        renameSync4(lockDir, stale);
+        rmSync3(stale, { recursive: true, force: true });
       } catch (renameErr) {
         if (renameErr.code !== "ENOENT") {
           throw renameErr;
@@ -854,22 +1102,22 @@ function acquireDaemonOwnership(configDir, opts = {}) {
   const ownership2 = {
     configDir,
     lockDir,
-    ownerPath,
+    ownerPath: ownerPath2,
     pidPath,
     pid,
     instanceId
   };
   const record = { pid, instanceId, startedAt: now };
-  writeFileSync3(ownerPath, `${JSON.stringify(record)}
-`, { mode: FILE_MODE });
-  chmodSync2(ownerPath, FILE_MODE);
+  writeFileSync4(ownerPath2, `${JSON.stringify(record)}
+`, { mode: FILE_MODE2 });
+  chmodSync3(ownerPath2, FILE_MODE2);
   const legacyPid = numericPid(pidPath);
   if (legacyPid !== void 0 && legacyPid !== pid && isAlive(legacyPid)) {
-    rmSync(lockDir, { recursive: true, force: true });
+    rmSync3(lockDir, { recursive: true, force: true });
     throw new Error(`daemon already running (pid=${String(legacyPid)})`);
   }
-  writeFileSync3(pidPath, String(pid), { mode: FILE_MODE });
-  chmodSync2(pidPath, FILE_MODE);
+  writeFileSync4(pidPath, String(pid), { mode: FILE_MODE2 });
+  chmodSync3(pidPath, FILE_MODE2);
   return ownership2;
 }
 function ownsDaemonInstance(ownership2) {
@@ -899,7 +1147,7 @@ function releaseDaemonOwnership(ownership2, socketPath) {
       }
     }
   }
-  rmSync(ownership2.lockDir, { recursive: true, force: true });
+  rmSync3(ownership2.lockDir, { recursive: true, force: true });
   if (cleanupError) {
     throw cleanupError;
   }
@@ -907,8 +1155,8 @@ function releaseDaemonOwnership(ownership2, socketPath) {
 }
 
 // src/daemon/server.ts
-var CONFIG_DIR = join6(homedir5(), ".config", "prim");
-var SOCK_PATH2 = join6(CONFIG_DIR, "sock");
+var CONFIG_DIR = join7(homedir5(), ".config", "prim");
+var SOCK_PATH2 = join7(CONFIG_DIR, "sock");
 var HEARTBEAT_INTERVAL_MS = 3e4;
 var INGESTION_POLL_INTERVAL_MS = 15e3;
 var TOKEN_CHECK_INTERVAL_MS = 6e4;
@@ -935,13 +1183,14 @@ var heartbeatRerunRequested = false;
 var ownership;
 var socketServer;
 var shuttingDown = false;
+var reauthHold = false;
 function resolveRuntimeVersion() {
   if (process.env.PRIM_RUNTIME_VERSION) {
     return process.env.PRIM_RUNTIME_VERSION;
   }
   try {
     const here = fileURLToPath(new URL(".", import.meta.url));
-    const pkg = JSON.parse(readFileSync4(join6(here, "..", "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync5(join7(here, "..", "..", "package.json"), "utf-8"));
     return pkg.version ?? "unknown";
   } catch {
     return "unknown";
@@ -967,6 +1216,42 @@ function updatePendingHealth() {
   daemonHealth.ingestion.oldestPendingAt = pending.oldestPendingAt;
   daemonHealth.ingestion.strandedCount = pending.strandedCount;
 }
+function enterReauthHold() {
+  if (reauthHold) {
+    return;
+  }
+  reauthHold = true;
+  daemonHealth.needsReauth = true;
+  if (heartbeatTimer) {
+    clearTimeout(heartbeatTimer);
+    heartbeatTimer = void 0;
+  }
+  if (ingestionTimer) {
+    clearTimeout(ingestionTimer);
+    ingestionTimer = void 0;
+  }
+  persistHealth();
+  process.stderr.write(
+    "[prim-daemon] authentication ended \u2014 halting heartbeat + ingestion until `prim auth login` (captures continue to the journal)\n"
+  );
+}
+function exitReauthHold() {
+  if (!reauthHold) {
+    return;
+  }
+  reauthHold = false;
+  daemonHealth.needsReauth = false;
+  daemonHealth.heartbeat.consecutiveFailures = 0;
+  daemonHealth.ingestion.consecutiveFailures = 0;
+  daemonHealth.heartbeat.lastError = void 0;
+  daemonHealth.ingestion.lastError = void 0;
+  persistHealth();
+  process.stderr.write(
+    "[prim-daemon] re-authentication detected \u2014 resuming heartbeat + ingestion\n"
+  );
+  void sendHeartbeat();
+  void runIngestionLoop();
+}
 async function takeOwnership() {
   const now = Date.now();
   const recordedOwner = readDaemonOwner(CONFIG_DIR);
@@ -976,7 +1261,7 @@ async function takeOwnership() {
       (pid) => pid !== void 0 && daemonProcessIsAlive(pid)
     )
   );
-  if (existsSync5(SOCK_PATH2) || candidatePids.size > 0) {
+  if (existsSync6(SOCK_PATH2) || candidatePids.size > 0) {
     const snapshot = await daemonRequest(
       "status_snapshot",
       {},
@@ -1051,11 +1336,18 @@ async function performHeartbeat() {
     daemonHealth.heartbeat.lastError = errorMessage(err);
     daemonHealth.heartbeat.consecutiveFailures += 1;
     persistHealth();
+    if (isSessionEnded()) {
+      enterReauthHold();
+      return;
+    }
     process.stderr.write(`[prim-daemon] heartbeat error: ${errorMessage(err)}
 `);
   }
 }
 function sendHeartbeat() {
+  if (shuttingDown || reauthHold) {
+    return Promise.resolve();
+  }
   if (heartbeatInFlight) {
     heartbeatRerunRequested = true;
     return heartbeatInFlight;
@@ -1068,7 +1360,7 @@ function sendHeartbeat() {
     do {
       heartbeatRerunRequested = false;
       await performHeartbeat();
-    } while (heartbeatRerunRequested && !shuttingDown);
+    } while (heartbeatRerunRequested && !(shuttingDown || reauthHold));
   })().finally(() => {
     heartbeatInFlight = void 0;
     scheduleHeartbeat();
@@ -1076,7 +1368,7 @@ function sendHeartbeat() {
   return heartbeatInFlight;
 }
 function scheduleHeartbeat() {
-  if (shuttingDown) {
+  if (shuttingDown || reauthHold) {
     return;
   }
   const failures = daemonHealth.heartbeat.consecutiveFailures;
@@ -1089,6 +1381,9 @@ function scheduleHeartbeat() {
   }, delay);
 }
 async function ensureTokenFresh() {
+  if (resolveAuthCredential()?.source !== "token_file") {
+    return;
+  }
   const expiresAt = getTokenExpiresAt();
   if (!expiresAt) {
     return;
@@ -1101,7 +1396,7 @@ async function ensureTokenFresh() {
   }
 }
 function scheduleIngestion(delayMs) {
-  if (shuttingDown) {
+  if (shuttingDown || reauthHold) {
     return;
   }
   ingestionTimer = setTimeout(() => {
@@ -1154,6 +1449,10 @@ async function runIngestionLoop() {
     } catch {
     }
     persistHealth();
+    if (isSessionEnded()) {
+      enterReauthHold();
+      return;
+    }
     process.stderr.write(`[prim-daemon] ingestion error: ${errorMessage(err)}
 `);
     scheduleIngestion(delay);
@@ -1198,6 +1497,7 @@ function handleStatusSnapshot(params) {
     lastHeartbeatAt,
     version: runtimeVersion,
     healthy: daemonHealth.healthy,
+    needsReauth: daemonHealth.needsReauth === true,
     heartbeat: { ...daemonHealth.heartbeat },
     ingestion: { ...daemonHealth.ingestion }
   };
@@ -1332,13 +1632,26 @@ function startSocketServer() {
   });
 }
 function startTimers() {
-  persistHealth();
-  void sendHeartbeat();
-  void runIngestionLoop();
+  if (isSessionEnded()) {
+    enterReauthHold();
+  } else {
+    persistHealth();
+    void sendHeartbeat();
+    void runIngestionLoop();
+  }
   void runTokenCheckLoop();
 }
 async function runTokenCheckLoop() {
-  await ensureTokenFresh();
+  if (reauthHold) {
+    if (!isSessionEnded() && resolveAuthCredential()) {
+      exitReauthHold();
+    }
+  } else {
+    await ensureTokenFresh();
+    if (isSessionEnded()) {
+      enterReauthHold();
+    }
+  }
   if (!shuttingDown) {
     tokenCheckTimer = setTimeout(() => {
       tokenCheckTimer = void 0;