@remits/remits-cli 0.1.163 → 0.1.164

package/README.md

@@ -139,6 +139,10 @@ remits-cli install --skills --overwrite true
 - The service groups sessions by `baseUrl` so one websocket connection can service multiple authenticated accounts on the same Remits environment.
 - Websocket subscriptions are deduplicated by user topic. If multiple authenticated accounts share the same websocket topic, the listener subscribes once and maps that topic back to all related accounts.
 - The daemon keeps STOMP heartbeats enabled and runs a maintenance watchdog that recreates unhealthy websocket connections.
+- Terminal server authentication/authorization errors suspend WebSocket retries and show
+  `authentication_required`. Reauthenticate to replace the managed client's credentials; the watchdog
+  does not revive rejected credentials. Transient failures use jittered exponential backoff up to
+  60 seconds. Test watchers keep HTTP polling; restart local-AI workers after reauthentication.
 - If the machine sleeps, the network drops, or auth sessions change while the daemon is already running, the service now attempts to reconnect and resubscribe automatically once connectivity returns.
 - Support tickets are the primary unit of dispatched work. A serving agent launches one fresh worker process per routed ticket.
 - Agent sessions register themselves with `remits-cli agent register` or `remits-cli agent serve`; `serve` also starts the local supervisor.

package/index.js

@@ -4,18 +4,18 @@
 ## Table of Contents
 
 - L22  Runtime Bootstrap And Shared State
-- L124  Sessions, Account Resolution, And Production Guards
-- L630  Local State, Workspaces, And Verification Evidence
-- L2668  Account Repos, Guide Sync, And Platform Repo
-- L3508  Component Discovery And HTTP Logging
-- L4276  Skill Delivery And TOC Resolution
-- L4591  Auth And Component Staging
-- L5223  Component Summaries, Status, And Sync Gates
-- L7547  Branches, Promotion, Commit, And Test Runs
-- L9791  Tokens, Tools, Verification, And Config
-- L11308  Service Dashboard And WebSocket Listener
-- L13808  Agent And Ticket Workflows
-- L18069  Help, Auto Update, And Command Dispatch
+- L125  Sessions, Account Resolution, And Production Guards
+- L631  Local State, Workspaces, And Verification Evidence
+- L2669  Account Repos, Guide Sync, And Platform Repo
+- L3509  Component Discovery And HTTP Logging
+- L4277  Skill Delivery And TOC Resolution
+- L4592  Auth And Component Staging
+- L5224  Component Summaries, Status, And Sync Gates
+- L7548  Branches, Promotion, Commit, And Test Runs
+- L9802  Tokens, Tools, Verification, And Config
+- L11319  Service Dashboard And WebSocket Listener
+- L13829  Agent And Ticket Workflows
+- L18090  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -32,6 +32,7 @@ const axios = require('axios');
 const openModule = require('open');
 const { Client } = require('@stomp/stompjs');
 const WebSocket = require('ws');
+const { installWebsocketRetry } = require('./lib/websocket-retry');
 const YAML = require('yaml');
 
 Object.assign(global, { WebSocket });
@@ -9144,7 +9145,16 @@ function watchWebsocket(baseUrl, topicId, taskId, options = {}) {
   const emit = options.stderr ? console.error : console.log;
   const client = new Client({
     brokerURL: webSocketUrl(baseUrl),
-    connectHeaders: { 'X-Auth-Token': options.token || '' },
+    connectHeaders: {
+      'X-Auth-Token': options.token || '',
+      'x-remits-ws-label': 'cli-test',
+      'x-remits-client-kind': 'cli',
+      'x-remits-tab-id': 'cli:' + process.pid + ':test:' + crypto.randomUUID(),
+      'x-remits-origin': 'remits-cli://test',
+      'x-remits-path': 'test/watch',
+      'x-remits-location': normalizeBaseUrl(baseUrl),
+      'x-remits-broker': webSocketUrl(baseUrl)
+    },
     reconnectDelay: 3000,
     heartbeatIncoming: 10000,
     heartbeatOutgoing: 10000,
@@ -9176,6 +9186,7 @@ function watchWebsocket(baseUrl, topicId, taskId, options = {}) {
     });
   };
 
+  installWebsocketRetry(client, { onBlocked: code => emit('[ws] Authentication required (' + code + '); HTTP polling continues.') });
   client.activate();
   return () => {
     client.deactivate();
@@ -13538,6 +13549,7 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
     discardWebsocketOnCommFailure: true,
     connectHeaders: {
       'x-remits-ws-label': 'remits-cli',
+      'x-remits-client-kind': 'cli',
       'x-remits-ws-scope': headerScope,
       'x-remits-user-id': headerUserIds.length === 1 ? headerUserIds[0] : '',
       'x-remits-account-id': headerAccountIds.length === 1 ? headerAccountIds[0] : '',
@@ -13643,7 +13655,7 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
     ensureRuntimeWebsocketEntry(normalizedBaseUrl);
     runtimeState.websocket[normalizedBaseUrl] = {
       ...runtimeState.websocket[normalizedBaseUrl],
-      status: 'disconnected',
+      status: client.remitsAuthBlocked ? 'authentication_required' : 'disconnected',
       disconnectedAt: new Date().toISOString()
     };
     console.log('[listener] Disconnected from', normalizedBaseUrl, '- will reconnect');
@@ -13673,7 +13685,7 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
     ensureRuntimeWebsocketEntry(normalizedBaseUrl);
     runtimeState.websocket[normalizedBaseUrl] = {
       ...runtimeState.websocket[normalizedBaseUrl],
-      status: 'disconnected',
+      status: client.remitsAuthBlocked ? 'authentication_required' : 'disconnected',
       disconnectedAt: new Date().toISOString(),
       lastError: detail
     };
@@ -13700,6 +13712,12 @@ function createManagedWebsocketClient(baseUrl, urlSessions) {
   };
 
   managedClient.client = client;
+  installWebsocketRetry(client, { onBlocked: code => {
+    runtimeState.websocket[normalizedBaseUrl] = {
+      ...runtimeState.websocket[normalizedBaseUrl], status: 'authentication_required', lastError: code
+    };
+    updateRuntimeServiceState();
+  } });
   return managedClient;
 }
 
@@ -13745,6 +13763,9 @@ async function runManagedWebsocketWatchdog() {
     if (!managedClient || !managedClient.client) {
       continue;
     }
+    // A session-file change replaces the client. The watchdog must not revive rejected credentials
+    // or defeat the normal transport backoff while it is waiting to reconnect.
+    if (managedClient.client.remitsAuthBlocked || managedClient.client.remitsRetryPending) continue;
     const state = ensureRuntimeWebsocketEntry(managedClient.baseUrl);
     const socket = managedClient.client.webSocket;
     const readyState = socket && typeof socket.readyState === 'number' ? socket.readyState : null;

package/lib/local-ai.js

@@ -6,6 +6,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
 const { spawn } = require('node:child_process');
+const { installWebsocketRetry } = require('./websocket-retry');
 
 const MAX_BYTES = 8 * 1024 * 1024;
 const AGENTS = ['manual', 'codex', 'claude', 'gemini'];
@@ -623,6 +624,9 @@ async function command({ subcommand, flags, context, root, axios, Client, WebSoc
           console.error('Local AI WebSocket unavailable; authenticated polling continues.');
         }
       });
+      installWebsocketRetry(socket, { onBlocked: code => {
+        console.error(`Local AI WebSocket authentication required (${code}); reauthenticate and restart the worker.`);
+      } });
       socket.activate();
     }
     await supervisor.tick();

package/lib/websocket-retry.js

@@ -0,0 +1,67 @@
+'use strict';
+
+// The server sends stable, credential-free codes. A transport close code alone (including 1002)
+// cannot distinguish expired credentials from a transient broker failure.
+const TERMINAL_CODES = new Set(['credentials_missing', 'credentials_rejected', 'credentials_malformed',
+  'session_required', 'topic_denied', 'destination_denied', 'recipient_denied']);
+
+function terminalCode(frame) {
+  const headers = frame?.headers || {};
+  const code = headers['x-remits-error-code'];
+  return TERMINAL_CODES.has(code) ? code : null;
+}
+
+function installWebsocketRetry(client, { onBlocked = () => {}, random = Math.random,
+  setTimer = setTimeout, clearTimer = clearTimeout } = {}) {
+  const base = Math.max(1, Number(client.reconnectDelay) || 5000);
+  let failures = 0, wait = 0, timer, release;
+  const cancelWait = () => {
+    if (timer) clearTimer(timer);
+    timer = null;
+    if (release) release();
+    release = null;
+    client.remitsRetryPending = false;
+  };
+  const before = client.beforeConnect;
+  client.beforeConnect = async () => {
+    if (client.remitsAuthBlocked) { await client.deactivate(); return; }
+    if (wait > 0) {
+      client.remitsRetryPending = true;
+      await new Promise(resolve => { release = resolve; timer = setTimer(cancelWait, wait); });
+      // A stop/replacement may have resolved the wait; never read or send credentials afterwards.
+      if (!client.active || client.remitsAuthBlocked) return;
+    }
+    client.remitsRetryPending = false;
+    if (before) await before();
+  };
+  const connected = client.onConnect;
+  client.onConnect = frame => {
+    failures = 0; wait = 0; client.remitsRetryPending = false;
+    if (connected) connected(frame);
+  };
+  const closed = client.onWebSocketClose;
+  client.onWebSocketClose = event => {
+    const ceiling = Math.min(60000, base * Math.pow(2, Math.min(++failures, 5)));
+    // STOMP already waits base ms. Add jitter/backoff before its next CONNECT using public APIs.
+    wait = Math.max(0, Math.floor(ceiling / 2 + random() * ceiling / 2) - base);
+    client.remitsRetryPending = !client.remitsAuthBlocked;
+    if (closed) closed(event);
+  };
+  const error = client.onStompError;
+  client.onStompError = frame => {
+    const code = terminalCode(frame);
+    if (code) {
+      client.remitsAuthBlocked = code;
+      cancelWait();
+      // deactivate changes active synchronously, before STOMP schedules the close reconnect.
+      Promise.resolve(client.deactivate({ force: true })).catch(() => {});
+    }
+    if (error) error(frame);
+    if (code) onBlocked(code);
+  };
+  const deactivate = client.deactivate.bind(client);
+  client.deactivate = options => { cancelWait(); return deactivate(options); };
+  return client;
+}
+
+module.exports = { installWebsocketRetry, terminalCode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.163",
+  "version": "0.1.164",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,
@@ -13,6 +13,7 @@
     "index.js",
     "lib/sync-operation.js",
     "lib/local-ai.js",
+    "lib/websocket-retry.js",
     "README.md",
     "scripts/prepare-index-toc.js",
     "skills/remits-cli/SKILL.md",