@q-agent/agent 0.1.28 → 0.1.29

package/dist/src/runner.js

@@ -399,6 +399,13 @@ async function processJob(cfg, job) {
  * the workDir is always removed, even if some uploads fail or time out.
  */
 async function uploadEvidenceThenCleanup(cfg, executionId, pendingEvidence, workDir) {
+    // Tell the UI evidence is still incoming so it can show a loader instead of an
+    // empty panel while these deferred uploads land (results are already visible).
+    if (pendingEvidence.length > 0) {
+        await api
+            .postEvent(cfg, executionId, "exec.evidence.uploading", { count: pendingEvidence.length })
+            .catch(() => { });
+    }
     try {
         for (const ev of pendingEvidence) {
             await api
@@ -414,6 +421,13 @@ async function uploadEvidenceThenCleanup(cfg, executionId, pendingEvidence, work
     }
     finally {
         fs.rmSync(workDir, { recursive: true, force: true });
+        // Signal completion so the UI drops the loader and refetches the now-uploaded
+        // evidence — always fire (even on partial failure) so the loader never sticks.
+        if (pendingEvidence.length > 0) {
+            await api
+                .postEvent(cfg, executionId, "exec.evidence.done", {})
+                .catch(() => { });
+        }
     }
 }
 /**
@@ -980,7 +994,7 @@ async function processAuthoringJob(cfg, job) {
     }
     const sess = origin ? (0, session_1.sessionPathsForOrigin)(origin) : null;
     const profileDir = sess ? path.join(sess.dir, "browser-profile") : "";
-    const finalize = async (code, discovered, summary, ok, costUsd = 0) => {
+    const finalize = async (code, discovered, summary, ok, costUsd = 0, refreshedCredentials = "") => {
         await api
             .postAuthoringFinalize(cfg, job.sessionId, {
             code,
@@ -988,6 +1002,7 @@ async function processAuthoringJob(cfg, job) {
             summary,
             ok,
             costUsd,
+            refreshedCredentials,
         })
             .catch((err) => console.error("postAuthoringFinalize failed:", err));
     };
@@ -1197,7 +1212,19 @@ async function processAuthoringJob(cfg, job) {
             case: job.caseId, phase: ok ? "done" : "failed", message: (summary || "").slice(0, 300), costUsd,
         })
             .catch(() => { });
-        await finalize(code, discovered, summary, ok, costUsd);
+        // Auto-rotation (#cred-rotate): if we ran with the app's saved credential and
+        // the CLI refreshed the OAuth token in our temp config dir, post the rotated
+        // .credentials.json back so the server captures it before workDir is deleted.
+        let refreshedCredentials = "";
+        if (claudeConfigDir) {
+            try {
+                const credFile = path.join(claudeConfigDir, ".credentials.json");
+                if (fs.existsSync(credFile))
+                    refreshedCredentials = fs.readFileSync(credFile, "utf-8");
+            }
+            catch { /* best-effort — a missing/unreadable file just skips rotation */ }
+        }
+        await finalize(code, discovered, summary, ok, costUsd, refreshedCredentials);
     }
     finally {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@q-agent/agent",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Q-Agent Local Agent — claims execution jobs from the Q-Agent server and runs Playwright locally, so manual login/MFA happens on the user's own machine and session credentials never leave it.",
   "license": "UNLICENSED",
   "bin": {