@proagentstore/cli 0.4.152 → 0.4.154

package/dist/browser-runner/coding/engine-check.js

@@ -1,11 +1,38 @@
 import { spawnSync } from "node:child_process";
 import { unwrapLauncher } from "./launcher-wrapper.js";
-import { statSync } from "node:fs";
+import { realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { handlerFor } from "./handlers.js";
 import { parseCommand } from "./headless.js";
 import { resolveEngineSpawn } from "./engine-spawn.js";
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
+function defaultVersionText(launch, env) {
+    // The file the check FOUND, not the bare name: off Windows `command` is the name as given, which spawnSync would
+    // resolve against this process's PATH rather than the one being checked — and report another binary's version.
+    const command = launch.via === "direct" && launch.binaryPath ? launch.binaryPath : launch.command;
+    const r = spawnSync(command, launch.args, { encoding: "utf8", env, timeout: 5_000, windowsHide: true, windowsVerbatimArguments: launch.windowsVerbatimArguments });
+    return r.error || r.status !== 0 ? null : `${r.stdout ?? ""}${r.stderr ?? ""}`;
+}
+/** `codex-cli 0.146.0`, `2.1.3 (Claude Code)`, `grok 1.0.62 (1474f9cbdd91)` → the version. Null when there is none. */
+export function parseEngineVersion(text) {
+    return text?.match(/\b\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] ?? null;
+}
+/** Whose `grok` answered: xAI's names itself; the community npm one prints a bare version from a node_modules script. */
+export function grokVendor(text, binaryPath) {
+    if (text && /^\s*grok \d+\.\d+/m.test(text))
+        return "xai";
+    if (/[\\/]node_modules[\\/]|@vibe-kit/.test(binaryPath ?? ""))
+        return "community";
+    return "unknown";
+}
 function defaultExists(p) {
     try {
         statSync(p);
@@ -52,6 +79,14 @@ export function detectEngineLogin(engine, deps = {}) {
         }
         return { login: "missing", where: file };
     }
+    if (engine === "grok") {
+        // xAI's Grok CLI keeps its subscription login (grok.com / accounts.x.ai) in auth.json under GROK_HOME, default
+        // ~/.grok. An external auth provider or OIDC setup signs in another way, so absence is not proof there.
+        if (env.GROK_AUTH_PROVIDER_COMMAND?.trim() || env.GROK_OIDC_ISSUER?.trim() || env.GROK_DEPLOYMENT_KEY?.trim())
+            return { login: "unknown" };
+        const file = join(env.GROK_HOME?.trim() || join(home, ".grok"), "auth.json");
+        return { login: exists(file) ? "found" : "missing", where: file };
+    }
     if (engine === "gemini") {
         // Google sign-in lands here; Gemini also accepts other auth (gcloud, Vertex), so absence is
         // not proof of "signed out".
@@ -73,6 +108,9 @@ export function checkEngine(input, deps = {}) {
     const bin = parsed.bin || parseCommand(handlerFor(engine).cliCommand).bin || engine;
     const { binaryPath, via } = resolveEngineSpawn(bin, [], deps);
     const login = input.credentialInjected ? { login: "found", where: "platform" } : detectEngineLogin(engine, deps);
+    // Grok's version is what tells xAI's CLI from a same-named npm package, so it is always read for Grok (a native
+    // binary, milliseconds); the others only when asked (coding_engine_get), because each is a Node startup.
+    const versionText = binaryPath && (engine === "grok" || input.withVersion) ? (deps.versionText ?? defaultVersionText)(resolveEngineSpawn(bin, ["--version"], deps), deps.env ?? process.env) : null;
     return {
         checked: true,
         engine,
@@ -81,5 +119,7 @@ export function checkEngine(input, deps = {}) {
         ...(binaryPath ? { binaryPath, binaryVia: via } : {}),
         login: login.login,
         ...(login.where ? { loginWhere: login.where } : {}),
+        ...(binaryPath && (engine === "grok" || input.withVersion) ? { version: parseEngineVersion(versionText) } : {}),
+        ...(engine === "grok" && binaryPath ? { vendor: grokVendor(versionText, (deps.realpath ?? safeRealpath)(binaryPath)) } : {}),
     };
 }

package/dist/browser-runner/coding/engine-spawn.js

@@ -1,5 +1,23 @@
 import { accessSync, constants, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
+/**
+ * xAI's Grok CLI for a bare `grok`, wherever PATH points (#1156). Its installer (x.ai/cli/install.sh, install.ps1) always
+ * puts it in `~/.grok/bin` (`GROK_BIN_DIR` overrides), and adds that to PATH only in the SHELL's profile — so a
+ * `pags up` started by launchd, systemd, a Scheduled Task or an older terminal does not see it. And an npm package of
+ * the same name, the community `@vibe-kit/grok-cli` (API-key billed, different flags), can sit earlier on PATH: on the
+ * Mac mini it did, in nvm's bin. The preset means xAI's CLI, so its own location wins when it is there. An explicit path
+ * in a preset is the owner's choice and is never rewritten.
+ */
+export function officialEngineBinary(bin, deps = {}) {
+    if (bin !== "grok")
+        return null;
+    const windows = (deps.platform ?? process.platform) === "win32";
+    const env = deps.env ?? process.env;
+    const dir = envVar(env, "GROK_BIN_DIR", windows)?.trim() || (windows ? win32 : posix).join(deps.home ?? homedir(), ".grok", "bin");
+    const file = (windows ? win32 : posix).join(dir, windows ? "grok.exe" : "grok");
+    return (deps.isExecutable ?? defaultIsExecutable)(file) ? file : null;
+}
 function defaultIsExecutable(p) {
     try {
         if (!statSync(p).isFile())
@@ -67,7 +85,8 @@ export function quoteCmdArg(arg) {
     a = `"${a}"`;
     return a.replace(CMD_META, "^$1").replace(CMD_META, "^$1");
 }
-export function resolveEngineSpawn(bin, args, deps = {}) {
+export function resolveEngineSpawn(requested, args, deps = {}) {
+    const bin = officialEngineBinary(requested, deps) ?? requested;
     const windows = (deps.platform ?? process.platform) === "win32";
     if (!windows)
         return { command: bin, args, binaryPath: resolveBinary(bin, deps), via: "direct" };

package/dist/browser-runner/coding/grok-continuity.js

@@ -0,0 +1,53 @@
+/**
+ * Grok keeps ITS OWN conversation across one-shot turns (#1156) — by an id the runner chooses.
+ *
+ * Every Grok turn is a new `grok … -p "<turn>"` process, so without this each turn started with no memory of the last
+ * one but the platform's replay. `-c/--continue` was the CLI's only offer when the preset was written, and it picks the
+ * MOST RECENT session in the directory — another `grok` run in the same checkout (the owner's own) would answer instead
+ * (`coding-engines.ts`, "NO PRESET RESUMES"). xAI's Grok CLI now takes an explicit id, so continuity is exact:
+ *
+ *   first turn    `-s <uuid>`   a NEW conversation under an id the runner made up (1.x: must be a UUID, must not exist);
+ *   later turns   `-r <uuid>`   resume exactly that one (errors if it does not exist — never "the most recent").
+ *
+ * Checked against `grok --help` of xAI's Grok CLI 1.0.62 (2026-10-18). 0.2.x also accepts both: there `-s` creates-or-
+ * resumes and `-r` errors on an unknown id. NOT yet exercised end to end — the CLI refuses every turn until it is signed
+ * in, and it was not on the machine this was written on — so the runner treats it as unproven: a turn whose flags are
+ * rejected is retried once without them and the session runs without continuity, and the platform's replay is still
+ * sent with every turn (`holdsConversationThisTurn` stays false for Grok) until a signed-in run proves it.
+ */
+import { randomUUID } from "node:crypto";
+const UUID_RE = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i;
+/** Only a UUID ever reaches argv — anything else read back from the state file is discarded. */
+export function isGrokConversationId(value) {
+    return typeof value === "string" && UUID_RE.test(value);
+}
+export function newGrokConversation(makeId = randomUUID) {
+    return { id: makeId(), started: false };
+}
+/** The turn's argv: the continuity flag first (any order parses), then the preset, then the turn as `-p`'s value. */
+export function grokTurnArgs(userArgs, turnText, conversation) {
+    if (!conversation)
+        return [...userArgs, turnText];
+    return [conversation.started ? "-r" : "-s", conversation.id, ...userArgs, turnText];
+}
+/**
+ * The CLI refused the continuity flags themselves — an argument error, printed before it signs in or runs anything (the
+ * argument parser runs first). Narrow on purpose: retrying any other failure could run a real instruction twice.
+ */
+// Only a line that BEGINS with the CLI's own `error:` (clap's argument errors), and only about these flags or the id —
+// a tool's output in a failed turn that merely mentions a session must never cause a same-turn retry.
+const REJECTED_RE = /^\s*error:\s(?:.*unexpected argument '?-(?:s|r)\b|.*(?:--session-id|--resume)\b|.*must be a valid uuid|.*session\b.*\b(?:not found|already exists|does not exist))/i;
+export function grokRejectedContinuity(lines) {
+    return lines.some((l) => REJECTED_RE.test(l));
+}
+/** What a finished turn means for the conversation. Pure. */
+export function afterGrokTurn(conversation, outcome) {
+    // The flags themselves were refused before anything ran: run without continuity from now on.
+    if (outcome.code && outcome.rejected)
+        return { next: null, persist: null, disable: true };
+    // Done: the CLI holds the conversation now. Remember it, so the next turn — and the next runner start — resume it.
+    if (outcome.code === 0)
+        return { next: { ...conversation, started: true }, persist: conversation.id, disable: false };
+    // Any other failure: the conversation may be half-made or unknown. Forget it, so the next turn starts a clean one.
+    return { next: null, persist: null, disable: false };
+}

package/dist/browser-runner/coding/headless-state.js

@@ -5,7 +5,7 @@ export function isCodexThreadId(value) {
     return typeof value === "string" && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(value);
 }
 function stateKey(id, engine) {
-    return engine === "codex" ? `codex:${id}` : id;
+    return engine === "claude" ? id : `${engine}:${id}`;
 }
 function loadFile(path) {
     if (!path || !existsSync(path))

package/dist/browser-runner/coding/headless.js

@@ -14,6 +14,7 @@ import { handlerFor } from "./handlers.js";
 import { resolveEngineAuth } from "./engine-auth.js";
 import { buildCodexResumeArgs, engineAdapterFor, engineInvocationModeFromAdapter, engineInvocationWarning, genericRawEngineAdapter } from "./engine-adapter.js";
 import { isCodexThreadId, readCodexState, readState, writeState } from "./headless-state.js";
+import { afterGrokTurn, grokRejectedContinuity, grokTurnArgs, isGrokConversationId, newGrokConversation } from "./grok-continuity.js";
 export { buildClaudeArgs } from "./engine-adapter.js";
 export { defaultStatePath } from "./headless-state.js";
 /**
@@ -70,6 +71,10 @@ export class HeadlessSession {
     claudeSessionId = null;
     /** Codex's thread id from `thread.started` — used only by the explicit-ID resume path (#848). */
     codexThreadId = null;
+    /** Grok's own conversation across one-shot turns (#1156, grok-continuity.ts); null = the next turn starts one. */
+    grokConversation = null;
+    /** Off once this machine's CLI refused the continuity flags: the session then runs as before, turn by turn. */
+    grokContinuity = true;
     /**
      * The cloud's context brief, until the first turn spends it (ADR 0005, #693). Null once
      * delivered, and null from the start when the engine resumed its own conversation.
@@ -270,6 +275,8 @@ export class HeadlessSession {
             config.clientType === "codex" && this.mode === "stream-json" && !config.fresh
                 ? readCodexState(config.statePath, config.id) ?? (config.resumeFrom ? readCodexState(config.statePath, config.resumeFrom) : null)
                 : null;
+        const storedGrok = config.clientType === "grok" && !config.fresh ? (readState(config.statePath, config.id, "grok") ?? (config.resumeFrom ? readState(config.statePath, config.resumeFrom, "grok") : null)) : null;
+        this.grokConversation = isGrokConversationId(storedGrok) ? { id: storedGrok, started: true } : null;
         // AFTER both lines above, because `resumedConversation` reads them: the brief is the fallback,
         // so an engine that found its own conversation drops it unread rather than being handed a
         // summary of the conversation it is already in.
@@ -590,9 +597,15 @@ export class HeadlessSession {
         this.structuredOutputRejected = false;
         const resumedCodexThreadId = this.codexResumeThreadId;
         const inputId = this.turnInputId;
+        // #1156: Grok carries its conversation by an id this runner chose — `-s` to make it, `-r` to resume it.
+        if (this.config.clientType === "grok" && this.grokContinuity && !this.grokConversation)
+            this.grokConversation = newGrokConversation();
+        const grokConversation = this.config.clientType === "grok" && this.grokContinuity ? this.grokConversation : null;
         const turnArgs = resumedCodexThreadId
             ? buildCodexResumeArgs(this.cmdArgs, resumedCodexThreadId, text)
-            : this.adapter.buildTurnArgs(this.cmdArgs, text);
+            : grokConversation
+                ? grokTurnArgs(this.cmdArgs, text, grokConversation)
+                : this.adapter.buildTurnArgs(this.cmdArgs, text);
         const env = this.spawnEnv;
         const target = spawnTarget(this.cmdPrefix, this.cmdBin, turnArgs);
         const launch = resolveEngineSpawn(target.command, target.args, { env });
@@ -687,6 +700,19 @@ export class HeadlessSession {
                 this.runOneShot(text);
                 return;
             }
+            if (grokConversation) {
+                const after = afterGrokTurn(grokConversation, { code, rejected: grokRejectedContinuity(this.turnTail) });
+                this.grokConversation = after.next;
+                writeState(this.config.statePath, this.config.id, after.persist, "grok");
+                // The flags were refused before anything ran (an argument error): the same turn again, without them.
+                if (after.disable) {
+                    this.grokContinuity = false;
+                    this.proc = null;
+                    this.push("[grok CLI rejected its session flags; retrying this turn without conversation continuity]");
+                    this.runOneShot(text);
+                    return;
+                }
+            }
             // A rejected/expired explicit ID is not retried as the same turn: the CLI may have started
             // work before failing. Drop only that known-bad local key so the NEXT turn is safely fresh.
             if (code && resumedCodexThreadId && this.codexThreadId === resumedCodexThreadId) {

package/dist/index.js

@@ -384,9 +384,58 @@ jobs:
 import { spawn } from "child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "fs";
 import { createServer } from "http";
-import { homedir } from "os";
+import { homedir, hostname } from "os";
 import { join as join3 } from "path";
 import { Command as Command3 } from "commander";
+
+// src/commands/login-device.ts
+function chooseLoginFlow(opts, env = process.env, platform = process.platform) {
+  if (opts.device) return { flow: "device", why: "--device" };
+  if (opts.browser) return { flow: "browser", why: "--browser" };
+  if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT) return { flow: "device", why: "this is an SSH session" };
+  if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return { flow: "device", why: "there is no display here" };
+  return { flow: "browser", why: "" };
+}
+function sessionExpiresAt(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[0] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+async function deviceLogin(deps) {
+  const fetchFn = deps.fetch ?? fetch;
+  const sleep2 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const post = (path, body) => fetchFn(`${deps.apiBase}${path}`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) });
+  const res = await post("/v1/auth/device/start", { node: deps.node });
+  if (!res.ok) throw new Error(`Could not start a device sign-in (HTTP ${res.status}).`);
+  const started = await res.json();
+  deps.log("To sign this machine in, open this link on your phone or any device where you are signed in to ProAgentStore:");
+  deps.log(`  ${started.verification_uri_complete}`);
+  deps.log(`or go to ${started.verification_uri} and enter the code:  ${started.user_code}`);
+  deps.log(`Check that the page shows this machine (${deps.node}) and this code. Waiting for approval \u2014 the code lasts ${Math.round(started.expires_in / 60)} minutes\u2026`);
+  let interval = Math.max(1, started.interval) * 1e3;
+  const deadline = now() + started.expires_in * 1e3;
+  while (now() < deadline) {
+    await sleep2(interval);
+    let answer;
+    try {
+      const r = await post("/v1/auth/device/token", { device_code: started.device_code });
+      answer = await r.json().catch(() => ({}));
+      if (r.ok && answer.session) return answer.session;
+    } catch {
+      continue;
+    }
+    if (answer.error === "slow_down") interval += 5e3;
+    else if (answer.error === "access_denied") throw new Error("The sign-in was denied on the approval page.");
+    else if (answer.error === "expired_token") break;
+  }
+  throw new Error("The code expired before it was approved. Run `pags login --device` again for a new one.");
+}
+
+// src/commands/login.ts
 var CONFIG_DIR = join3(homedir(), ".config", "proagentstore");
 var TOKEN_FILE = join3(CONFIG_DIR, "session.json");
 var API_BASE = "https://api.proagentstore.online";
@@ -407,6 +456,14 @@ function saveSession(session) {
   mkdirSync2(CONFIG_DIR, { recursive: true });
   writeFileSync2(TOKEN_FILE, JSON.stringify(session, null, 2));
 }
+async function storeSession(token) {
+  const meRes = await fetch(`${API_BASE}/v1/auth/me`, { headers: { Authorization: `Bearer ${token}` } });
+  if (!meRes.ok) throw new Error("Session validation failed");
+  const me = await meRes.json();
+  const session = { token, user: { id: me.id, login: me.login, avatar: me.avatar }, expiresAt: sessionExpiresAt(token) ?? Date.now() + 29 * 24 * 36e5 };
+  saveSession(session);
+  return session;
+}
 function requireSession() {
   const session = loadSession();
   if (!session) {
@@ -428,7 +485,19 @@ function openBrowser(url) {
   } catch {
   }
 }
-var loginCommand = new Command3("login").description("Sign in with Google or GitHub (opens browser)").option("--github", "Use GitHub instead of Google").action(async (opts) => {
+var loginCommand = new Command3("login").description("Sign in with Google or GitHub \u2014 in a browser here, or approved from another device over SSH/headless").option("--github", "Use GitHub instead of Google").option("--device", "Sign in from another device: show a link and a code to approve on your phone (SSH, no display)").option("--browser", "Open a browser on this machine, even over SSH").action(async (opts) => {
+  const choice = chooseLoginFlow(opts);
+  if (choice.flow === "device") {
+    if (choice.why !== "--device") writeLine(`Signing in from another device, because ${choice.why} (use --browser to open one here instead).`);
+    try {
+      const session = await storeSession(await deviceLogin({ apiBase: API_BASE, node: hostname(), log: writeLine }));
+      writeLine(`Signed in as ${session.user.login}. Token stored at ${TOKEN_FILE}`);
+    } catch (err) {
+      writeError(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    return;
+  }
   const provider = opts.github ? "github" : "google";
   const port = await findFreePort();
   const callbackUrl = `http://127.0.0.1:${port}/callback`;
@@ -454,17 +523,7 @@ var loginCommand = new Command3("login").description("Sign in with Google or Git
         return;
       }
       try {
-        const meRes = await fetch(`${API_BASE}/v1/auth/me`, {
-          headers: { Authorization: `Bearer ${session}` }
-        });
-        if (!meRes.ok) throw new Error("Session validation failed");
-        const me = await meRes.json();
-        saveSession({
-          token: session,
-          user: { id: me.id, login: me.login, avatar: me.avatar },
-          expiresAt: Date.now() + 29 * 24 * 60 * 60 * 1e3
-          // ~29 days
-        });
+        const me = (await storeSession(session)).user;
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(`<h1>Signed in as ${me.login}</h1><p>You can close this tab and return to the terminal.</p><script>window.close()</script>`);
         clearTimeout(timeout);
@@ -532,7 +591,7 @@ import { Command as Command4 } from "commander";
 // src/machine.ts
 import { randomUUID } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2, hostname } from "os";
+import { homedir as homedir2, hostname as hostname2 } from "os";
 import { join as join4 } from "path";
 var CONFIG_DIR2 = join4(homedir2(), ".config", "proagentstore");
 var MACHINE_FILE = join4(CONFIG_DIR2, "machine.json");
@@ -607,7 +666,7 @@ function saveMachineIdentity(identity2) {
 function sameIdentity(a, b) {
   return a.id === b.id && a.names.join("\0") === b.names.join("\0") && (a.declined ?? []).join("\0") === (b.declined ?? []).join("\0");
 }
-function loadMachineIdentity(now = hostname()) {
+function loadMachineIdentity(now = hostname2()) {
   let stored = null;
   try {
     if (existsSync4(MACHINE_FILE)) stored = parseMachineFile(readFileSync3(MACHINE_FILE, "utf-8"));
@@ -815,7 +874,7 @@ async function defaultAsk(question) {
 }
 
 // src/commands/runner/http.ts
-import { hostname as hostname2 } from "os";
+import { hostname as hostname3 } from "os";
 function clean(value) {
   const trimmed = value?.trim();
   return trimmed || void 0;
@@ -841,7 +900,7 @@ function apiPathSegment(value) {
   return encodeURIComponent(value);
 }
 function buildRuntimeRegistrationBody(opts, capabilities = []) {
-  const node = hostname2();
+  const node = hostname3();
   const machine = loadMachineIdentity(node);
   return {
     endpointUrl: clean(opts.endpointUrl) || opts.endpointUrl,
@@ -1028,7 +1087,7 @@ var mcpCommand = new Command5("mcp").description("Run a local stdio proxy for th
 
 // src/commands/remote-auth.ts
 import { Command as Command6 } from "commander";
-import { hostname as hostname3 } from "os";
+import { hostname as hostname4 } from "os";
 var CONSOLE = "https://proagentstore.online/console";
 var FIELDS = ["request_id", "agent", "machine", "resource", "scopes", "approval_url", "expires_at"];
 var SECRET_KEY = /verifier|proof|private|secret|token|password|credential|ciphertext|session|cookie|^code$/i;
@@ -1054,7 +1113,7 @@ function buildRelayBody(input, identity2) {
 }
 function identity() {
   const id = loadMachineIdentity();
-  return { id: id.id, node: id.names[0] ?? hostname3() };
+  return { id: id.id, node: id.names[0] ?? hostname4() };
 }
 async function readStdin() {
   const chunks = [];
@@ -1301,7 +1360,7 @@ async function waitForLocalRunner(opts, timeoutMs = 15e3) {
 }
 
 // src/commands/runner/relay.ts
-import { hostname as hostname4 } from "os";
+import { hostname as hostname5 } from "os";
 
 // src/commands/runner/resources.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, statfsSync, writeFileSync as writeFileSync4 } from "fs";
@@ -2508,9 +2567,9 @@ var MEMBERSHIP_SYNC_PATH = "/pags/membership/sync";
 var CLI_CONTROL_PATHS = /* @__PURE__ */ new Set([MEMBERSHIP_SYNC_PATH, RUNNER_UPDATE_PATH, RUNNER_RESTART_PATH]);
 async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force = false, watchInstances = false) {
   const apiBase = pagsApiBase(opts.apiBase).replace(/^http/, "ws");
-  const pagsToken = clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
-  if (!pagsToken) throw new Error("PAGS token required for WebSocket relay");
-  const runnerNode = hostname4();
+  const pagsToken = () => clean(opts.pagsToken) || clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token);
+  if (!pagsToken()) throw new Error("PAGS token required for WebSocket relay");
+  const runnerNode = hostname5();
   const machine = loadMachineIdentity(runnerNode);
   const autoUpdateKey = machine.id ? autoUpdatePolicyKey(machine.id) : "";
   const cell = new PolicyCell(autoUpdateKey ? loadAutoUpdatePolicy(autoUpdateKey) ?? { autoUpdate: false } : { autoUpdate: false }, (p) => saveAutoUpdatePolicy(autoUpdateKey, p), !!autoUpdateKey);
@@ -2706,7 +2765,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
     const plan = reattachPlan(request, { held: attached.has(named), blocked: blocked.has(named), watching: watchInstances, scope: instanceIds });
     if (plan.refuse) return { status: 409, result: { error: plan.refuse } };
     if (plan.release) {
-      const res = await requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken });
+      const res = await requestPags("GET", "/v1/instances/my/instances", { ...opts, pagsToken: pagsToken() });
       const released = pinnedAway(attached.keys(), res.instances ?? [], runnerNode, machine.names);
       for (const id of released) detach(id, `${id.slice(0, 8)}\u2026 (pinned to another machine now)`);
       if (released.length && attached.size === 0) writeLine("This `pags up --instance` holds no agent now \u2014 close it, or restart it without --instance.");
@@ -2727,7 +2786,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   };
   const attach = (id, label = `${id.slice(0, 8)}\u2026`) => {
     if (attached.has(id)) return;
-    const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken }, {}).then((r) => r.token);
+    const mintToken = () => requestPags("POST", `/v1/relay/${apiPathSegment(id)}/token`, { ...opts, pagsToken: pagsToken() }, {}).then((r) => r.token);
     attached.set(
       id,
       openRelaySocket(
@@ -2778,7 +2837,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
   writeLine(startup.state === "ok" ? `Runtime registered with PAGS \u2713 (${startup.agents} agents)` : `Runtime registration incomplete: ${startup.agents} agents \u2014 retried on each relay (re)connect${watchInstances ? " and every 20s while this runs" : ""}.`);
   writeLine("");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
-  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname4()}`);
+  writeLine(`  \u2705 CONNECTED \u2014 WebSocket relay \xB7 ${hostname5()}`);
   writeLine(`  Agents:   ${instanceIds.length} instance${instanceIds.length === 1 ? "" : "s"}`);
   writeLine("  No cloudflared needed. Ctrl+C to disconnect.");
   writeLine("\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
@@ -2799,8 +2858,10 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
           ...process.env.PAGS_RUNNER_RSID ? { rsid: process.env.PAGS_RUNNER_RSID } : {},
           pid: process.pid,
           ...process.env.PAGS_RUNNER_LAUNCH ? { launch: process.env.PAGS_RUNNER_LAUNCH } : {},
-          supervisor: restartOwner()
+          supervisor: restartOwner(),
           // #1154: what starts it again if it dies
+          sessionExpiresAt: sessionExpiresAt(pagsToken() ?? "") ?? void 0
+          // #1157: when this runner signs out
         },
         relayRttMs,
         sessions: sessions ?? void 0
@@ -2839,7 +2900,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       const free = await requestPags(
         "GET",
         `/v1/relay/${apiPathSegment(id)}/status`,
-        { ...opts, pagsToken }
+        { ...opts, pagsToken: pagsToken() }
       ).then((r) => r.connected === false).catch(() => false);
       if (!free) continue;
       blocked.delete(id);
@@ -2852,7 +2913,7 @@ async function connectViaRelay(instanceIds, localUrl, runnerToken, opts, force =
       const res = await requestPags(
         "GET",
         "/v1/instances/my/instances",
-        { ...opts, pagsToken }
+        { ...opts, pagsToken: pagsToken() }
       );
       const { attach: toAttach, detach: toDetach } = diffMembership(
         attached.keys(),
@@ -2903,7 +2964,7 @@ async function readSessionResources(localUrl, runnerToken) {
 }
 var RTT_PROBE_PREFIX = "rtt:";
 var RTT_ECHO_PREFIX = "rtt-echo:";
-function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname4(), beginMutation = () => () => void 0) {
+function openRelaySocket(instanceId, wsBase, mintToken, localUrl, runnerToken, force = false, onConflict, onOpen, onControl, runnerNode = hostname5(), beginMutation = () => () => void 0) {
   let backoffMs = 1e3;
   let reconnecting = false;
   let closed = false;
@@ -3342,8 +3403,50 @@ function recordChildExit(o) {
   return report;
 }
 
+// src/session-refresh.ts
+var REFRESH_WITHIN_MS = 7 * 24 * 36e5;
+var WARN_WITHIN_MS = 3 * 24 * 36e5;
+var CHECK_EVERY_MS = 6 * 36e5;
+function refreshDecision(expiresAt, now) {
+  if (expiresAt === null) return "unreadable";
+  if (expiresAt <= now) return "expired";
+  return expiresAt - now <= REFRESH_WITHIN_MS ? "refresh" : "fresh";
+}
+var hoursLeft = (ms) => ms >= 48 * 36e5 ? `${Math.round(ms / (24 * 36e5))} days` : `${Math.max(1, Math.round(ms / 36e5))} hours`;
+async function checkSession(deps) {
+  const now = (deps.now ?? Date.now)();
+  const token = deps.token();
+  if (!token) return { decision: "unreadable" };
+  const expiresAt = sessionExpiresAt(token);
+  const decision = refreshDecision(expiresAt, now);
+  if (decision === "expired") {
+    deps.warn("Session expired: this runner is signed out. Sign in again with `pags login` (`pags login --device` over SSH).");
+    return { decision };
+  }
+  if (decision !== "refresh") return { decision };
+  const left = expiresAt - now;
+  try {
+    const res = await (deps.fetch ?? fetch)(`${deps.apiBase}/v1/auth/session/refresh`, { method: "POST", headers: { Authorization: `Bearer ${token}` } });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.session) throw new Error(body.error || `HTTP ${res.status}`);
+    deps.onRefreshed(body.session, token);
+    const until = sessionExpiresAt(body.session);
+    deps.log(`Session refreshed \u2014 signed in until ${until ? new Date(until).toISOString().slice(0, 10) : "the next 30 days"}.`);
+    return { decision, refreshed: true };
+  } catch (e) {
+    const why = e instanceof Error ? e.message : String(e);
+    if (left <= WARN_WITHIN_MS) deps.warn(`Session refresh failed (${why}): this runner signs out in ${hoursLeft(left)}. Sign in again with \`pags login\` (\`pags login --device\` over SSH).`);
+    return { decision, refreshed: false };
+  }
+}
+function startSessionRefresh(deps, every = setInterval) {
+  const run = () => void checkSession(deps).catch(() => void 0);
+  run();
+  every(run, CHECK_EVERY_MS).unref?.();
+}
+
 // src/commands/runner/command.ts
-import { hostname as hostname5 } from "os";
+import { hostname as hostname6 } from "os";
 function collectCapability(value, previous = []) {
   return [...previous, value];
 }
@@ -3361,7 +3464,7 @@ function createRunnerCommand() {
     const lockAccount = clean(process.env.PAGS_LOCK_ACCOUNT) || "";
     let lockHeld = null;
     if (lockAccount) {
-      const taken = await acquireLock({ account: lockAccount, node: hostname5(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
+      const taken = await acquireLock({ account: lockAccount, node: hostname6(), machineId: loadMachineIdentity().id || null, version: CLI_VERSION, port: Number(port), runnerToken });
       if (!taken.ok) {
         for (const line of taken.lock ? holderMessage(taken.lock, taken.verdict) : ["Another `pags up` holds this machine for this account."]) writeError(line);
         process.exit(1);
@@ -3440,6 +3543,19 @@ function createRunnerCommand() {
       await connectViaRelay(instanceIds, localUrl, runnerToken, opts, Boolean(opts.force), Boolean(opts.watchInstances));
       void deliver().catch(() => void 0);
       setInterval(() => void deliver().catch(() => void 0), 5 * 6e4).unref();
+      if (!clean(opts.pagsToken)) {
+        startSessionRefresh({
+          apiBase: pagsApiBase(opts.apiBase),
+          token: () => clean(process.env.PAGS_TOKEN) || clean(loadSession()?.token) || null,
+          onRefreshed: (token, previous) => {
+            process.env.PAGS_TOKEN = token;
+            const stored = loadSession();
+            if (stored?.token === previous) saveSession({ ...stored, token, expiresAt: sessionExpiresAt(token) ?? stored.expiresAt });
+          },
+          log: writeLine,
+          warn: writeError
+        });
+      }
       await new Promise((resolvePromise) => {
         runner.on("exit", () => resolvePromise());
       });
@@ -3702,11 +3818,11 @@ var logsCommand = new Command9("logs").description("Show the background runner's
 // src/commands/up.ts
 import { createRequire as createRequire2 } from "module";
 import { Command as Command10 } from "commander";
-import { homedir as homedir5, hostname as hostname7, userInfo } from "os";
+import { homedir as homedir5, hostname as hostname8, userInfo } from "os";
 
 // src/tui.ts
 import chalk from "chalk";
-import { hostname as hostname6 } from "os";
+import { hostname as hostname7 } from "os";
 import readline from "readline";
 var ACCENT = "#7c3aed";
 var c = chalk.hex(ACCENT);
@@ -3759,7 +3875,7 @@ function printStatus(state) {
   clearScreen();
   printLogo(state.version);
   const connected = state.runner === "online" && state.tunnel === "online" && state.registration === "registered";
-  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname6()));
+  console.log(pad + d("Signed in as ") + w(state.user) + d("  \xB7  agent: ") + w(state.activeInstance) + d("  \xB7  node: ") + w(hostname7()));
   console.log("");
   const row = (kind, s, override) => {
     const { icon, label, note } = describe(kind, s);
@@ -4288,7 +4404,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
     headless: opts.headless
   }).catch(() => void 0);
   if (!opts.instance) {
-    const split = partitionByPin(instances, hostname7(), loadMachineIdentity(hostname7()).names);
+    const split = partitionByPin(instances, hostname8(), loadMachineIdentity(hostname8()).names);
     instances = split.here;
     elsewhere = split.elsewhere;
   }
@@ -4401,7 +4517,7 @@ var upCommand = new Command10("up").description("Start the browser runner for al
         printStatus(state);
         continue;
       }
-      if (/error|Error|EADDRINUSE|ECONNREFUSED|failed/i.test(trimmed)) {
+      if (/error|Error|EADDRINUSE|ECONNREFUSED|failed|expired/i.test(trimmed)) {
         state.lastEvent = trimmed.slice(0, 80);
         printStatus(state);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.152",
+  "version": "0.4.154",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",