@proagentstore/cli 0.4.150 → 0.4.153

package/dist/index.js

@@ -381,11 +381,61 @@ jobs:
 });
 
 // src/commands/login.ts
+import { spawn } from "child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { createServer } from "http";
-import { homedir } from "os";
+import { homedir, hostname } from "os";
 import { join as join3 } from "path";
 import { Command as Command3 } from "commander";
+
+// src/commands/login-device.ts
+function chooseLoginFlow(opts, env = process.env, platform = process.platform) {
+  if (opts.device) return { flow: "device", why: "--device" };
+  if (opts.browser) return { flow: "browser", why: "--browser" };
+  if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT) return { flow: "device", why: "this is an SSH session" };
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return { flow: "device", why: "there is no display here" };
+  return { flow: "browser", why: "" };
+}
+function sessionExpiresAt(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[0] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+async function deviceLogin(deps) {
+  const fetchFn = deps.fetch ?? fetch;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const post = (path, body) => fetchFn(`${deps.apiBase}${path}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) });
+  const res = await post("/v1/auth/device/start", { node: deps.node });
+  if (!res.ok) throw new Error(`Could not start a device sign-in (HTTP ${res.status}).`);
+  const started = await res.json();
+  deps.log("To sign this machine in, open this link on your phone or any device where you are signed in to ProAgentStore:");
+  deps.log(`  ${started.verification_uri_complete}`);
+  deps.log(`or go to ${started.verification_uri} and enter the code:  ${started.user_code}`);
+  deps.log(`Check that the page shows this machine (${deps.node}) and this code. Waiting for approval \u2014 the code lasts ${Math.round(started.expires_in / 60)} minutes\u2026`);
+  let interval = Math.max(1, started.interval) * 1e3;
+  const deadline = now() + started.expires_in * 1e3;
+  while (now() < deadline) {
+    await sleep2(interval);
+    let answer;
+    try {
+      const r = await post("/v1/auth/device/token", { device_code: started.device_code });
+      answer = await r.json().catch(() => ({}));
+      if (r.ok && answer.session) return answer.session;
+    } catch {
+      continue;
+    }
+    if (answer.error === "slow_down") interval += 5e3;
+    else if (answer.error === "access_denied") throw new Error("The sign-in was denied on the approval page.");
+    else if (answer.error === "expired_token") break;
+  }
+  throw new Error("The code expired before it was approved. Run `pags login --device` again for a new one.");
+}
+
+// src/commands/login.ts
 var CONFIG_DIR = join3(homedir(), ".config", "proagentstore");
 var TOKEN_FILE = join3(CONFIG_DIR, "session.json");
 var API_BASE = "https://api.proagentstore.online";
@@ -406,6 +456,14 @@ function saveSession(session) {
   mkdirSync2(CONFIG_DIR, { recursive: true });
   writeFileSync2(TOKEN_FILE, JSON.stringify(session, null, 2));
 }
+async function storeSession(token) {
+  const meRes = await fetch(`${API_BASE}/v1/auth/me`, { headers: { Authorization: `Bearer ${token}` } });
+  if (!meRes.ok) throw new Error("Session validation failed");
+  const me = await meRes.json();
+  const session = { token, user: { id: me.id, login: me.login, avatar: me.avatar }, expiresAt: sessionExpiresAt(token) ?? Date.now() + 29 * 24 * 36e5 };
+  saveSession(session);
+  return session;
+}
 function requireSession() {
   const session = loadSession();
   if (!session) {
@@ -414,9 +472,33 @@ function requireSession() {
   }
   return session;
 }
-var loginCommand = new Command3("login").description("Sign in with Google or GitHub (opens browser)").option("--github", "Use GitHub instead of Google").action(async (opts) => {
+function browserCommand(url, platform = process.platform) {
+  if (platform === "win32") return { file: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+  return { file: platform === "darwin" ? "open" : "xdg-open", args: [url] };
+}
+function openBrowser(url) {
+  const { file, args } = browserCommand(url);
+  try {
+    const child = spawn(file, args, { stdio: "ignore", detached: true, windowsHide: true });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+var loginCommand = new Command3("login").description("Sign in with Google or GitHub \u2014 in a browser here, or approved from another device over SSH/headless").option("--github", "Use GitHub instead of Google").option("--device", "Sign in from another device: show a link and a code to approve on your phone (SSH, no display)").option("--browser", "Open a browser on this machine, even over SSH").action(async (opts) => {
+  const choice = chooseLoginFlow(opts);
+  if (choice.flow === "device") {
+    if (choice.why !== "--device") writeLine(`Signing in from another device, because ${choice.why} (use --browser to open one here instead).`);
+    try {
+      const session = await storeSession(await deviceLogin({ apiBase: API_BASE, node: hostname(), log: writeLine }));
+      writeLine(`Signed in as ${session.user.login}. Token stored at ${TOKEN_FILE}`);
+    } catch (err) {
+      writeError(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    return;
+  }
   const provider = opts.github ? "github" : "google";
-  writeLine(`Opening browser for ${provider} sign-in...`);
   const port = await findFreePort();
   const callbackUrl = `http://127.0.0.1:${port}/callback`;
   const tokenPromise = new Promise((resolve5, reject) => {
@@ -441,17 +523,7 @@ var loginCommand = new Command3("login").description("Sign in with Google or Git
         return;
       }
       try {
-        const meRes = await fetch(`${API_BASE}/v1/auth/me`, {
-          headers: { Authorization: `Bearer ${session}` }
-        });
-        if (!meRes.ok) throw new Error("Session validation failed");
-        const me = await meRes.json();
-        saveSession({
-          token: session,
-          user: { id: me.id, login: me.login, avatar: me.avatar },
-          expiresAt: Date.now() + 29 * 24 * 60 * 60 * 1e3
-          // ~29 days
-        });
+        const me = (await storeSession(session)).user;
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(`<h1>Signed in as ${me.login}</h1><p>You can close this tab and return to the terminal.</p><script>window.close()</script>`);
         clearTimeout(timeout);
@@ -469,9 +541,9 @@ var loginCommand = new Command3("login").description("Sign in with Google or Git
   });
   const oauthBase = provider === "google" ? `${API_BASE}/v1/auth/google/start` : `${API_BASE}/v1/auth/github/start`;
   const oauthUrl = `${oauthBase}?return_to=${encodeURIComponent(callbackUrl)}`;
-  const open = (await import("child_process")).exec;
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  open(`${cmd} "${oauthUrl}"`);
+  writeLine(`Opening your browser for ${provider} sign-in. If it does not open, paste this URL into a browser on this machine:`);
+  writeLine(`  ${oauthUrl}`);
+  openBrowser(oauthUrl);
   try {
     await tokenPromise;
     const session = loadSession();
@@ -519,7 +591,7 @@ import { Command as Command4 } from "commander";
 // src/machine.ts
 import { randomUUID } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2, hostname } from "os";
+import { homedir as homedir2, hostname as hostname2 } from "os";
 import { join as join4 } from "path";
 var CONFIG_DIR2 = join4(homedir2(), ".config", "proagentstore");
 var MACHINE_FILE = join4(CONFIG_DIR2, "machine.json");
@@ -594,7 +666,7 @@ function saveMachineIdentity(identity2) {
 function sameIdentity(a, b) {
   return a.id === b.id && a.names.join("\0") === b.names.join("\0") && (a.declined ?? []).join("\0") === (b.declined ?? []).join("\0");
 }
-function loadMachineIdentity(now = hostname()) {
+function loadMachineIdentity(now = hostname2()) {
   let stored = null;
   try {
     if (existsSync4(MACHINE_FILE)) stored = parseMachineFile(readFileSync3(MACHINE_FILE, "utf-8"));
@@ -802,7 +874,7 @@ async function defaultAsk(question) {
 }
 
 // src/commands/runner/http.ts
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 function clean(value) {
   const trimmed = value?.trim();
   return trimmed || void 0;
@@ -828,7 +900,7 @@ function apiPathSegment(value) {
   return encodeURIComponent(value);
 }
 function buildRuntimeRegistrationBody(opts, capabilities = []) {
-  const node = hostname2();
+  const node = hostname3();
   const machine = loadMachineIdentity(node);
   return {
     endpointUrl: clean(opts.endpointUrl) || opts.endpointUrl,
@@ -990,14 +1062,14 @@ var unclaimCommand = new Command4("unclaim").description("Remove a mistaken mach
 var machinesCommand = new Command4("machines").description("Show and claim the machine names ProAgentStore has for this account").addCommand(listCommand, { isDefault: true }).addCommand(claimCommand).addCommand(unclaimCommand);
 
 // src/commands/mcp.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { Command as Command5 } from "commander";
 var DEFAULT_MCP_URL = "https://mcp.proagentstore.online/mcp";
 function buildMcpRemoteArgs(opts, extraArgs = []) {
   return ["-y", "mcp-remote", opts.url || DEFAULT_MCP_URL, ...extraArgs];
 }
 async function runMcpProxy(opts, extraArgs = []) {
-  const child = spawn("npx", buildMcpRemoteArgs(opts, extraArgs), {
+  const child = spawn2("npx", buildMcpRemoteArgs(opts, extraArgs), {
     stdio: "inherit",
     env: process.env
   });
@@ -1015,7 +1087,7 @@ var mcpCommand = new Command5("mcp").description("Run a local stdio proxy for th
 
 // src/commands/remote-auth.ts
 import { Command as Command6 } from "commander";
-import { hostname as hostname3 } from "os";
+import { hostname as hostname4 } from "os";
 var CONSOLE = "https://proagentstore.online/console";
 var FIELDS = ["request_id", "agent", "machine", "resource", "scopes", "approval_url", "expires_at"];
 var SECRET_KEY = /verifier|proof|private|secret|token|password|credential|ciphertext|session|cookie|^code$/i;
@@ -1041,7 +1113,7 @@ function buildRelayBody(input, identity2) {
 }
 function identity() {
   const id = loadMachineIdentity();
-  return { id: id.id, node: id.names[0] ?? hostname3() };
+  return { id: id.id, node: id.names[0] ?? hostname4() };
 }
 async function readStdin() {
   const chunks = [];
@@ -1180,12 +1252,12 @@ var publishCommand = new Command7("publish").description("Publish an agent to Pr
 });
 
 // src/commands/runner/command.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { randomUUID as randomUUID4 } from "crypto";
 import { Command as Command8 } from "commander";
 
 // src/commands/runner/process.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync6 } from "fs";
 import { resolve as resolve4, win32 } from "path";
 import { createServer as createServer2 } from "net";
@@ -1260,7 +1332,7 @@ function runnerSpawnSpec(opts) {
 function startRunnerForeground(opts) {
   const spec = runnerSpawnSpec(opts);
   return new Promise((resolvePromise, reject) => {
-    const child = spawn2(spec.command, spec.args, {
+    const child = spawn3(spec.command, spec.args, {
       cwd: spec.cwd,
       stdio: "inherit",
       shell: spec.shell
@@ -1288,7 +1360,7 @@ async function waitForLocalRunner(opts, timeoutMs = 15e3) {
 }
 
 // src/commands/runner/relay.ts
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 
 // src/commands/runner/resources.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, statfsSync, writeFileSync as writeFileSync4 } from "fs";
@@ -1336,7 +1408,7 @@ function sampleResources(read = os, now = Date.now(), extra = {}) {
 }
 
 // src/commands/runner/self-update.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 var RUNNER_UPDATE_PATH = "/pags/runner/update";
 var RUNNER_RESTART_PATH = "/pags/runner/restart";
 var RUNNER_RESTART_EXIT_CODE = 75;
@@ -1367,7 +1439,7 @@ function deferredUpdateLease(value, now = Date.now()) {
 function deferredUpdateLeaseActive(lease, now = Date.now()) {
   return now < lease.expiresAt;
 }
-function leaveForRestart(restarter, deps = { spawn: spawn3, exit: (code) => process.exit(code) }) {
+function leaveForRestart(restarter, deps = { spawn: spawn4, exit: (code) => process.exit(code) }) {
   logUpdateStep(`restart: leaving for the ${restarter} restarter (${restarter === "command" ? "restart command started, exit 0" : `exit ${RUNNER_RESTART_EXIT_CODE}`})`);
   if (restarter === "command") {
     deps.spawn(process.env[RESTART_COMMAND_ENV], { shell: true, detached: true, stdio: "ignore", env: process.env }).unref();
@@ -2395,14 +2467,109 @@ function releaseTrial(version2, cell, log, env = process.env, root = payloadRoot
   };
 }
 
+// src/commands/up-restart.ts
+import { spawn as nodeSpawn, spawnSync as nodeSpawnSync } from "child_process";
+var UP_LAUNCHER_ENV = "PAGS_UP_LAUNCHER";
+var UP_LAUNCHER_PID_ENV = "PAGS_UP_LAUNCHER_PID";
+var RUNNER_DIED_EXIT_CODE = 76;
+function upRestartMode(env, parent = { pid: process.ppid, alive: pidAlive }) {
+  if (env[SERVICE_ENV] === "1") return "service";
+  if (env[RESTART_COMMAND_ENV]?.trim()) return "command";
+  const launcher = Number(env[UP_LAUNCHER_PID_ENV]);
+  if (env[UP_LAUNCHER_ENV] === "1" && launcher === parent.pid && parent.alive(launcher)) return "launcher-child";
+  return "launcher";
+}
+function runnerExitAction(code, stopping) {
+  if (code === RUNNER_RESTART_EXIT_CODE) return "restart";
+  if (stopping) return "ignore";
+  return code === 0 ? "stop" : "died";
+}
+function restartOwner(env = process.env, alive = pidAlive) {
+  if (env[SERVICE_ENV] === "1") return "service";
+  return env[UP_LAUNCHER_ENV] === "1" && alive(Number(env[UP_LAUNCHER_PID_ENV])) ? "launcher" : "none";
+}
+function relaunchDelayMs(failures) {
+  return Math.min(5 * 6e4, 1e4 * 2 ** Math.max(0, failures - 1));
+}
+var RAN_MS = 6e4;
+var RESET_MS = 10 * 6e4;
+function processRestartDeps() {
+  return {
+    env: process.env,
+    execPath: process.execPath,
+    execArgv: process.execArgv,
+    script: process.argv[1],
+    spawn: nodeSpawn,
+    spawnSync: nodeSpawnSync,
+    exit: (code) => process.exit(code),
+    log: () => {
+    },
+    sleep: (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms),
+    step: (line) => logUpdateStep(line),
+    parent: { pid: process.ppid, alive: pidAlive },
+    pid: process.pid,
+    now: Date.now
+  };
+}
+function restartPagsUp(args, extraEnv, deps, opts = {}) {
+  const env = { ...deps.env, ...extraEnv };
+  const argv = [...deps.execArgv, deps.script, ...args];
+  const exitCode = opts.exitCode ?? RUNNER_RESTART_EXIT_CODE;
+  const mode = upRestartMode(env, deps.parent);
+  deps.step(`${opts.initial ? "start" : "restart"}: pags ${args.join(" ")} \u2014 ${opts.initial ? "as" : "leaving via"} ${mode}${exitCode === RUNNER_DIED_EXIT_CODE ? " (the runner died)" : ""}`);
+  if (mode === "service") {
+    deps.exit(exitCode);
+    return;
+  }
+  if (mode === "command") {
+    leaveForRestart(mode, { spawn: deps.spawn, exit: deps.exit });
+    return;
+  }
+  if (mode === "launcher-child") {
+    deps.exit(exitCode);
+    return;
+  }
+  const childEnv = { ...env, [UP_LAUNCHER_ENV]: "1", [UP_LAUNCHER_PID_ENV]: String(deps.pid) };
+  let failures = 0;
+  for (let first = true; ; first = false) {
+    const unattended = !first || env.PAGS_NO_PROMPT === "1";
+    deps.step(`launcher: starting pags up${unattended ? " (unattended)" : ""}`);
+    const startedAt = deps.now();
+    const r = deps.spawnSync(deps.execPath, argv, { stdio: "inherit", env: first ? childEnv : { ...childEnv, PAGS_NO_PROMPT: "1" } });
+    const ran = deps.now() - startedAt;
+    const how = r.error ? `could not start (${r.error.message})` : r.signal ? `was killed by ${r.signal}` : `exited ${r.status}`;
+    deps.step(`launcher: pags up ${how} after ${Math.round(ran / 1e3)}s`);
+    if (ran >= RESET_MS) failures = 0;
+    if (r.status === RUNNER_RESTART_EXIT_CODE) {
+      failures = 0;
+      continue;
+    }
+    if (!r.error && (r.status === 0 || r.signal === "SIGINT")) {
+      deps.exit(0);
+      return;
+    }
+    if (unattended || r.status === RUNNER_DIED_EXIT_CODE || ran >= RAN_MS) {
+      failures++;
+      const wait = relaunchDelayMs(failures);
+      deps.log(`pags up ${how} \u2014 starting it again in ${Math.round(wait / 1e3)}s (attempt ${failures + 1}).`);
+      deps.step(`launcher: retrying in ${Math.round(wait / 1e3)}s (failure ${failures})`);
+      deps.sleep(wait);
+      continue;
+    }
+    if (!opts.initial) deps.log(`Restart failed${typeof r.status === "number" ? ` (exit ${r.status})` : ""} \u2014 the runner is NOT running. Run 'pags up' again.`);
+    deps.exit(typeof r.status === "number" && r.status !== 0 ? r.status : 1);
+    return;
+  }
+}
+
 // src/commands/runner/relay.ts
 var MEMBERSHIP_SYNC_PATH = "/pags/membership/sync";
 var CLI_CONTROL_PATHS = /* @__PURE__ */ new Set([MEMBERSHIP_SYNC_PATH, RUNNER_UPDATE_PATH, RUNNER_RESTART_PATH]);
 async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force = false, watchInstances = false) {
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
-  const pagsToken = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
-  if (!pagsToken) throw new Error("PAGS token required for WebSocket relay");
-  const runnerNode = hostname4();
+  const pagsToken = () => clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  if (!pagsToken()) throw new Error("PAGS token required for WebSocket relay");
+  const runnerNode = hostname5();
   const machine = loadMachineIdentity(runnerNode);
   const autoUpdateKey = machine.id ? autoUpdatePolicyKey(machine.id) : "";
   const cell = new PolicyCell(autoUpdateKey ? loadAutoUpdatePolicy(autoUpdateKey) ?? { autoUpdate: false } : { autoUpdate: false }, (p) => saveAutoUpdatePolicy(autoUpdateKey, p), !!autoUpdateKey);
@@ -2598,7 +2765,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     const plan = reattachPlan(request, { held: attached.has(named), blocked: blocked.has(named), watching: watchInstances, scope: instanceIds });
     if (plan.refuse) return { status: 409, result: { error: plan.refuse } };
     if (plan.release) {
-      const res = await requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken });
+      const res = await requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken: pagsToken() });
       const released = pinnedAway(attached.keys(), res.instances ?? [], runnerNode, machine.names);
       for (const id of released) detach(id, `${id.slice(0, 8)}\u2026 (pinned to another machine now)`);
       if (released.length && attached.size === 0) writeLine("This `pags up --instance` holds no agent now \u2014 close it, or restart it without --instance.");
@@ -2619,7 +2786,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   };
   const attach = (id, label = `${id.slice(0, 8)}\u2026`) => {
     if (attached.has(id)) return;
-    const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken }, {}).then((r) => r.token);
+    const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken: pagsToken() }, {}).then((r) => r.token);
     attached.set(
       id,
       openRelaySocket(
@@ -2670,7 +2837,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   writeLine(startup.state === "ok" ? `Runtime registered with PAGS \u2713 (${startup.agents} agents)` : `Runtime registration incomplete: ${startup.agents} agents \u2014 retried on each relay (re)connect${watchInstances ? " and every 20s while this runs" : ""}.`);
   writeLine("");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname4()}`);
+  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname5()}`);
   writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
   writeLine("  No cloudflared needed. Ctrl+C to disconnect.");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
@@ -2690,7 +2857,11 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
           // #896: who is heartbeating. Set by `runner connect` from the lock it took.
           ...process.env.PAGS_RUNNER_RSID ? { rsid: process.env.PAGS_RUNNER_RSID } : {},
           pid: process.pid,
-          ...process.env.PAGS_RUNNER_LAUNCH ? { launch: process.env.PAGS_RUNNER_LAUNCH } : {}
+          ...process.env.PAGS_RUNNER_LAUNCH ? { launch: process.env.PAGS_RUNNER_LAUNCH } : {},
+          supervisor: restartOwner(),
+          // #1154: what starts it again if it dies
+          sessionExpiresAt: sessionExpiresAt(pagsToken() ?? "") ?? void 0
+          // #1157: when this runner signs out
         },
         relayRttMs,
         sessions: sessions ?? void 0
@@ -2729,7 +2900,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       const free = await requestPags(
         "GET",
         `/v1/relay/${apiPathSegment(id)}/status`,
-        { ...opts, pagsToken }
+        { ...opts, pagsToken: pagsToken() }
       ).then((r) => r.connected === false).catch(() => false);
       if (!free) continue;
       blocked.delete(id);
@@ -2742,7 +2913,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       const res = await requestPags(
         "GET",
         "/v1/instances/my/instances",
-        { ...opts, pagsToken }
+        { ...opts, pagsToken: pagsToken() }
       );
       const { attach: toAttach, detach: toDetach } = diffMembership(
         attached.keys(),
@@ -2793,7 +2964,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname4(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -3232,8 +3403,50 @@ function recordChildExit(o) {
   return report;
 }
 
+// src/session-refresh.ts
+var REFRESH_WITHIN_MS = 7 * 24 * 36e5;
+var WARN_WITHIN_MS = 3 * 24 * 36e5;
+var CHECK_EVERY_MS = 6 * 36e5;
+function refreshDecision(expiresAt, now) {
+  if (expiresAt === null) return "unreadable";
+  if (expiresAt <= now) return "expired";
+  return expiresAt - now <= REFRESH_WITHIN_MS ? "refresh" : "fresh";
+}
+var hoursLeft = (ms) => ms >= 48 * 36e5 ? `${Math.round(ms / (24 * 36e5))} days` : `${Math.max(1, Math.round(ms / 36e5))} hours`;
+async function checkSession(deps) {
+  const now = (deps.now ?? Date.now)();
+  const token = deps.token();
+  if (!token) return { decision: "unreadable" };
+  const expiresAt = sessionExpiresAt(token);
+  const decision = refreshDecision(expiresAt, now);
+  if (decision === "expired") {
+    deps.warn("Session expired: this runner is signed out. Sign in again with `pags login` (`pags login --device` over SSH).");
+    return { decision };
+  }
+  if (decision !== "refresh") return { decision };
+  const left = expiresAt - now;
+  try {
+    const res = await (deps.fetch ?? fetch)(`${deps.apiBase}/v1/auth/session/refresh`, { method: "POST", headers: { Authorization: `Bearer ${token}` } });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.session) throw new Error(body.error || `HTTP ${res.status}`);
+    deps.onRefreshed(body.session, token);
+    const until = sessionExpiresAt(body.session);
+    deps.log(`Session refreshed \u2014 signed in until ${until ? new Date(until).toISOString().slice(0, 10) : "the next 30 days"}.`);
+    return { decision, refreshed: true };
+  } catch (e) {
+    const why = e instanceof Error ? e.message : String(e);
+    if (left <= WARN_WITHIN_MS) deps.warn(`Session refresh failed (${why}): this runner signs out in ${hoursLeft(left)}. Sign in again with \`pags login\` (\`pags login --device\` over SSH).`);
+    return { decision, refreshed: false };
+  }
+}
+function startSessionRefresh(deps, every = setInterval) {
+  const run = () => void checkSession(deps).catch(() => void 0);
+  run();
+  every(run, CHECK_EVERY_MS).unref?.();
+}
+
 // src/commands/runner/command.ts
-import { hostname as hostname5 } from "os";
+import { hostname as hostname6 } from "os";
 function collectCapability(value, previous = []) {
   return [...previous, value];
 }
@@ -3251,12 +3464,14 @@ function createRunnerCommand() {
     const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
     let lockHeld = null;
     if (lockAccount) {
-      const taken = await acquireLock({ account: lockAccount, node: hostname5(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
+      const taken = await acquireLock({ account: lockAccount, node: hostname6(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
       if (!taken.ok) {
         for (const line of taken.lock ? holderMessage(taken.lock, taken.verdict) : ["Another `pags up` holds this machine for this account."]) writeError(line);
         process.exit(1);
       }
       lockHeld = { path: taken.path, rsid: taken.lock.rsid, nonce: taken.lock.nonce, launch: taken.lock.launch };
+      process.env.PAGS_RUNNER_RSID = taken.lock.rsid;
+      process.env.PAGS_RUNNER_LAUNCH = taken.lock.launch;
       writeLine(`STATUS runner-session=${taken.lock.rsid}`);
     }
     const releaseHeldLock = () => {
@@ -3268,7 +3483,7 @@ function createRunnerCommand() {
     const spec = runnerSpawnSpec(runnerOpts);
     const crashAccount = lockAccount || loadSession()?.user.login || "";
     const crashes = crashAccount ? crashPaths(configDir(), crashAccount, opts.dataDir) : null;
-    const runner = spawn4(spec.command, spec.args, {
+    const runner = spawn5(spec.command, spec.args, {
       cwd: spec.cwd,
       stdio: ["ignore", "pipe", "pipe"],
       shell: spec.shell,
@@ -3328,6 +3543,19 @@ function createRunnerCommand() {
       await connectViaRelay(instanceIds, localUrl, runnerToken, opts, Boolean(opts.force), Boolean(opts.watchInstances));
       void deliver().catch(() => void 0);
       setInterval(() => void deliver().catch(() => void 0), 5 * 6e4).unref();
+      if (!clean(opts.pagsToken)) {
+        startSessionRefresh({
+          apiBase: pagsApiBase(opts.apiBase),
+          token: () => clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token) || null,
+          onRefreshed: (token, previous) => {
+            process.env.PAGS_TOKEN = token;
+            const stored = loadSession();
+            if (stored?.token === previous) saveSession({ ...stored, token, expiresAt: sessionExpiresAt(token) ?? stored.expiresAt });
+          },
+          log: writeLine,
+          warn: writeError
+        });
+      }
       await new Promise((resolvePromise) => {
         runner.on("exit", () => resolvePromise());
       });
@@ -3453,7 +3681,7 @@ import { readFileSync as readFileSync11, statSync as statSync2, watchFile } from
 import { Command as Command9 } from "commander";
 
 // src/background.ts
-import { spawn as nodeSpawn } from "child_process";
+import { spawn as nodeSpawn2 } from "child_process";
 import { closeSync as closeSync3, existsSync as existsSync10, mkdirSync as mkdirSync8, openSync as openSync3, readFileSync as readFileSync10, renameSync as renameSync4, statSync, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname5, join as join11 } from "path";
 var BACKGROUND_ENV = "PAGS_BACKGROUND";
@@ -3492,12 +3720,12 @@ function backgroundRestartCommand(execPath, script, upArgs, platform = process.p
   const argv = [execPath, script, ...upArgs, "--background"].map((a) => shellQuote(a, platform)).join(" ");
   return platform === "win32" ? `set ${BACKGROUND_RESTART_ENV}=1&& ${argv}` : `${BACKGROUND_RESTART_ENV}=1 ${argv}`;
 }
-function spawnDetached(command, args, env, logPath, spawn5 = nodeSpawn) {
+function spawnDetached(command, args, env, logPath, spawn6 = nodeSpawn2) {
   mkdirSync8(dirname5(logPath), { recursive: true });
   rotateLog(logPath);
   const fd = openSync3(logPath, "a", 384);
   try {
-    const child = spawn5(command, args, { detached: true, stdio: ["ignore", fd, fd], env, windowsHide: true });
+    const child = spawn6(command, args, { detached: true, stdio: ["ignore", fd, fd], env, windowsHide: true });
     child.unref();
     if (!child.pid) throw new Error("the runner process did not start");
     return child.pid;
@@ -3590,11 +3818,11 @@ var logsCommand = new Command9("logs").description("Show the background runner's
 // src/commands/up.ts
 import { createRequire as createRequire2 } from "module";
 import { Command as Command10 } from "commander";
-import { homedir as homedir5, hostname as hostname7, userInfo } from "os";
+import { homedir as homedir5, hostname as hostname8, userInfo } from "os";
 
 // src/tui.ts
 import chalk from "chalk";
-import { hostname as hostname6 } from "os";
+import { hostname as hostname7 } from "os";
 import readline from "readline";
 var ACCENT = "#7c3aed";
 var c = chalk.hex(ACCENT);
@@ -3647,7 +3875,7 @@ function printStatus(state) {
   clearScreen();
   printLogo(state.version);
   const connected = state.runner === "online" && state.tunnel === "online" && state.registration === "registered";
-  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname6()));
+  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname7()));
   console.log("");
   const row = (kind, s, override) => {
     const { icon, label, note } = describe(kind, s);
@@ -3709,75 +3937,6 @@ async function waitForKey(keys, onInterrupt) {
   });
 }
 
-// src/commands/up-restart.ts
-import { spawn as nodeSpawn2, spawnSync as nodeSpawnSync } from "child_process";
-var UP_LAUNCHER_ENV = "PAGS_UP_LAUNCHER";
-function upRestartMode(env) {
-  if (env[SERVICE_ENV] === "1") return "service";
-  if (env[RESTART_COMMAND_ENV]?.trim()) return "command";
-  if (env[UP_LAUNCHER_ENV] === "1") return "launcher-child";
-  return "launcher";
-}
-function relaunchDelayMs(failures) {
-  return Math.min(5 * 6e4, 1e4 * 2 ** Math.max(0, failures - 1));
-}
-function processRestartDeps() {
-  return {
-    env: process.env,
-    execPath: process.execPath,
-    execArgv: process.execArgv,
-    script: process.argv[1],
-    spawn: nodeSpawn2,
-    spawnSync: nodeSpawnSync,
-    exit: (code) => process.exit(code),
-    log: () => {
-    },
-    sleep: (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms),
-    step: (line) => logUpdateStep(line)
-  };
-}
-function restartPagsUp(args, extraEnv, deps) {
-  const env = { ...deps.env, ...extraEnv };
-  const argv = [...deps.execArgv, deps.script, ...args];
-  const mode = upRestartMode(env);
-  deps.step(`restart: pags ${args.join(" ")} \u2014 leaving via ${mode}`);
-  if (mode === "service" || mode === "command") {
-    leaveForRestart(mode, { spawn: deps.spawn, exit: deps.exit });
-    return;
-  }
-  if (mode === "launcher-child") {
-    deps.exit(RUNNER_RESTART_EXIT_CODE);
-    return;
-  }
-  let failures = 0;
-  for (let first = true; ; first = false) {
-    const unattended = !first || env.PAGS_NO_PROMPT === "1";
-    deps.step(`launcher: starting pags up${unattended ? " (unattended)" : ""}`);
-    const r = deps.spawnSync(deps.execPath, argv, { stdio: "inherit", env: { ...env, [UP_LAUNCHER_ENV]: "1", ...first ? {} : { PAGS_NO_PROMPT: "1" } } });
-    const how = r.error ? `could not start (${r.error.message})` : r.signal ? `was killed by ${r.signal}` : `exited ${r.status}`;
-    deps.step(`launcher: pags up ${how}`);
-    if (r.status === RUNNER_RESTART_EXIT_CODE) {
-      failures = 0;
-      continue;
-    }
-    if (!r.error && r.status === 0) {
-      deps.exit(0);
-      return;
-    }
-    if (unattended) {
-      failures++;
-      const wait = relaunchDelayMs(failures);
-      deps.log(`pags up ${how} \u2014 starting it again in ${Math.round(wait / 1e3)}s (attempt ${failures + 1}).`);
-      deps.step(`launcher: retrying in ${Math.round(wait / 1e3)}s (failure ${failures})`);
-      deps.sleep(wait);
-      continue;
-    }
-    deps.log(`Restart failed${typeof r.status === "number" ? ` (exit ${r.status})` : ""} \u2014 the runner is NOT running. Run 'pags up' again.`);
-    deps.exit(typeof r.status === "number" && r.status !== 0 ? r.status : 1);
-    return;
-  }
-}
-
 // src/runner-replace.ts
 var REPLACE_EXIT_TIMEOUT_MS = 3e4;
 function describeWork(work) {
@@ -3987,6 +4146,15 @@ start();
 var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 var unitWord = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 var ps = (s) => `'${s.replace(/'/g, "''")}'`;
+function versionManagedNode(nodePath) {
+  if (/[\\/]n[\\/]versions[\\/]/.test(nodePath)) return "n";
+  const m = /[\\/]\.?(nvm|fnm|volta|asdf|nodenv)[\\/]/i.exec(nodePath);
+  return m ? m[1].toLowerCase() : null;
+}
+var pinnedNodeNote = (ctx) => {
+  const manager = versionManagedNode(ctx.nodePath);
+  return manager ? [`It runs Node ${ctx.nodePath}, installed by ${manager}. Removing or switching away from that Node version stops the service; after changing Node, run \`pags up --install-service\` again.`] : [];
+};
 function servicePlan(ctx) {
   const supervisor = supervisorPath(ctx);
   const log = serviceLogPath(ctx);
@@ -4010,6 +4178,7 @@ function servicePlan(ctx) {
 	<key>KeepAlive</key><true/>
 	<key>ThrottleInterval</key><integer>30</integer>
 	<key>ProcessType</key><string>Background</string>
+	<key>WorkingDirectory</key><string>${xml(ctx.home)}</string>
 	<key>StandardOutPath</key><string>${xml(log)}</string>
 	<key>StandardErrorPath</key><string>${xml(log)}</string>
 </dict>
@@ -4025,6 +4194,7 @@ function servicePlan(ctx) {
         { file: "launchctl", args: ["kickstart", "-k", `${domain}/${SERVICE_LABEL}`], why: "start it now" }
       ],
       notes: [
+        ...pinnedNodeNote(ctx),
         `LaunchAgent ${plist} \u2014 runs while this user is logged in. On a machine that must survive a reboot unattended, turn on automatic login for this user.`,
         `Remove it with: pags up --uninstall-service`
       ]
@@ -4039,8 +4209,11 @@ function servicePlan(ctx) {
 $ErrorActionPreference = 'Stop'
 $action    = New-ScheduledTaskAction -Execute ${ps(ctx.nodePath)} -Argument ${ps(`"${supervisor}"`)}
 $trigger   = New-ScheduledTaskTrigger -AtStartup
+# Task Scheduler restarts a task that failed to START; a supervisor killed later just ends. Re-trigger it every five
+# minutes, forever \u2014 MultipleInstances IgnoreNew makes a trigger that finds it running do nothing (#1154).
+$trigger.Repetition = (New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)).Repetition
 $principal = New-ScheduledTaskPrincipal -UserId ${ps(principal)} -LogonType S4U -RunLevel Limited
-$settings  = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
+$settings  = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 999 -RestartInterval (New-TimeSpan -Minutes 1) -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -MultipleInstances IgnoreNew
 Unregister-ScheduledTask -TaskName ${ps(WINDOWS_TASK)} -Confirm:$false -ErrorAction SilentlyContinue
 Register-ScheduledTask -TaskName ${ps(WINDOWS_TASK)} -Action $action -Trigger $trigger -Principal $principal -Settings $settings | Out-Null
 Start-ScheduledTask -TaskName ${ps(WINDOWS_TASK)}
@@ -4051,6 +4224,7 @@ Start-ScheduledTask -TaskName ${ps(WINDOWS_TASK)}
       files,
       commands: [{ file: "powershell.exe", args: ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", task], why: "register and start the Scheduled Task" }],
       notes: [
+        ...pinnedNodeNote(ctx),
         `Scheduled Task "${WINDOWS_TASK}" \u2014 starts at boot as ${principal || "this user"}, with nobody logged in. Registering it needs an elevated PowerShell: if it was refused, run ${task} from one.`,
         `Remove it with: pags up --uninstall-service`
       ]
@@ -4085,7 +4259,7 @@ WantedBy=default.target
       { file: "systemctl", args: ["--user", "enable", "--now", SYSTEMD_UNIT], why: "enable and start it" },
       { file: "loginctl", args: ["enable-linger", ...ctx.user ? [ctx.user] : []], optional: true, why: "keep it running with nobody logged in" }
     ],
-    notes: [`systemd user unit ${unit}. Logs: ${log} (and journalctl --user -u ${SYSTEMD_UNIT}).`, `Remove it with: pags up --uninstall-service`]
+    notes: [...pinnedNodeNote(ctx), `systemd user unit ${unit}. Logs: ${log} (and journalctl --user -u ${SYSTEMD_UNIT}).`, `Remove it with: pags up --uninstall-service`]
   };
 }
 function serviceRemovalPlan(ctx) {
@@ -4149,6 +4323,10 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     for (const line of uninstallService(serviceContext()).lines) writeLine(line);
     return;
   }
+  if (!opts.background && !opts.installService && upRestartMode(process.env) === "launcher") {
+    restartPagsUp(process.argv.slice(2), {}, { ...processRestartDeps(), log: (line) => writeLine(`  ${line}`) }, { initial: true });
+    return;
+  }
   const session = requireSession();
   if (opts.installService) {
     const result = installService(serviceContext());
@@ -4226,7 +4404,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     headless: opts.headless
   }).catch(() => void 0);
   if (!opts.instance) {
-    const split = partitionByPin(instances, hostname7(), loadMachineIdentity(hostname7()).names);
+    const split = partitionByPin(instances, hostname8(), loadMachineIdentity(hostname8()).names);
     instances = split.here;
     elsewhere = split.elsewhere;
   }
@@ -4269,7 +4447,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     }
     for (const line of replaced.lines) printStep(line, "ok");
   }
-  const { spawn: spawn5 } = await import("child_process");
+  const { spawn: spawn6 } = await import("child_process");
   const cliPath = process.argv[1];
   const args = [cliPath, "runner", "connect", ...instances.map((i) => i.id)];
   if (opts.headless) args.push("--headless");
@@ -4279,7 +4457,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     const code = await startInBackground({ session, opts, runnerArgs: args, instances: state.instances, lockFile, watching: !opts.instance });
     process.exit(code);
   }
-  const child = spawn5(process.execPath, args, {
+  const child = spawn6(process.execPath, args, {
     stdio: ["ignore", "pipe", "pipe"],
     // The child is the lock HOLDER (#896): it owns the relay sockets, so it is what a
     // contender must find and what `--replace` must be able to stop.
@@ -4339,7 +4517,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
         printStatus(state);
         continue;
       }
-      if (/error|Error|EADDRINUSE|ECONNREFUSED|failed/i.test(trimmed)) {
+      if (/error|Error|EADDRINUSE|ECONNREFUSED|failed|expired/i.test(trimmed)) {
         state.lastEvent = trimmed.slice(0, 80);
         printStatus(state);
       }
@@ -4355,33 +4533,29 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     void deliverCrashReports({ apiBase: API_BASE3, token: session.token, account: session.user.login, paths: crashes }).catch(() => void 0);
   };
   child.on("exit", (code, signal) => {
-    if (code === RUNNER_RESTART_EXIT_CODE) {
+    const action = runnerExitAction(code, stopping);
+    if (action === "restart") {
       logUpdateStep("restart: runner connect asked for a restart (exit 75)");
       restartUp("Runner updated remotely \u2014 restarting pags up on the new version\u2026", { PAGS_NO_PROMPT: "1" });
       return;
     }
     childDead = true;
     logUpdateStep(`runner connect ${signal ? `was killed by ${signal}` : `exited ${code}`}${stopping ? " (stopping)" : ""}`);
-    if (code !== 0 && !stopping) recordConnectExit(code, signal ?? null, logs.slice(-20));
-    if (code === null) {
-      state.runner = "error";
-      state.lastEvent = "Runner stopped by another process (signal) \u2014 it is not connected any more";
-      printStatus(state);
-      return;
-    }
-    if (code !== 0) {
-      state.runner = "error";
-      state.lastEvent = `Runner exited (code ${code})`;
-      const recent = logs.slice(-5);
-      if (recent.length) state.lastEvent += ": " + recent[recent.length - 1].slice(0, 60);
-      printStatus(state);
+    if (action === "ignore") return;
+    if (action === "stop") {
+      clearScreen();
+      writeLine("  Runner stopped (pags down, or replaced by another pags up).");
+      process.exit(0);
     }
+    recordConnectExit(code, signal ?? null, logs.slice(-20));
+    const recent = logs.slice(-5).at(-1);
+    restartUp(`Runner ${signal ? `was killed by ${signal}` : `exited (code ${code})`}${recent ? `: ${recent.slice(0, 60)}` : ""} \u2014 starting it again\u2026`, { PAGS_NO_PROMPT: "1" }, RUNNER_DIED_EXIT_CODE);
   });
-  function restartUp(why, env = {}) {
+  function restartUp(why, env = {}, exitCode) {
     writeLine(`  ${why}`);
     if (process.stdin.isTTY) process.stdin.setRawMode(false);
     process.stdin.pause();
-    restartPagsUp(restartUpArgs(opts), env, { ...processRestartDeps(), log: (line) => writeLine(`  ${line}`) });
+    restartPagsUp(restartUpArgs(opts), env, { ...processRestartDeps(), log: (line) => writeLine(`  ${line}`) }, { exitCode });
     process.exit(1);
   }
   const shutdown = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.150",
+  "version": "0.4.153",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",