@sentropic/h2a-runtime 0.81.0

package/dist/convsync.js

@@ -0,0 +1,108 @@
+/**
+ * Conversation alignment check: is a remote session's conversation log in sync
+ * with the latest LOCAL conversation for the same project? Compares metrics only
+ * (id, bytes, lines, sha256) — local read directly, remote computed in-Pod via
+ * kubectl (only the numbers cross the wire, never the conversation content).
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { getTunnel } from "./config.js";
+const CLAUDE_PROJECTS = ".claude/projects";
+/** claude's cwd→project-dir encoding (slashes → dashes). */
+export function encodeCwd(cwd) {
+    return cwd.replace(/\//g, "-");
+}
+function expandHome(p) {
+    return p.startsWith("~") ? join(homedir(), p.slice(1)) : p;
+}
+/** Newest local conversation for a project path (or undefined). */
+export function localConvStat(workspacePath, home = homedir()) {
+    const dir = join(home, CLAUDE_PROJECTS, encodeCwd(workspacePath));
+    if (!existsSync(dir))
+        return undefined;
+    let newest;
+    for (const e of readdirSync(dir)) {
+        if (!e.endsWith(".jsonl"))
+            continue;
+        const st = statSync(join(dir, e));
+        if (!newest || st.mtimeMs > newest.mtimeMs) {
+            newest = { name: e, mtimeMs: st.mtimeMs };
+        }
+    }
+    if (!newest)
+        return undefined;
+    const buf = readFileSync(join(dir, newest.name));
+    return {
+        convId: newest.name.replace(/\.jsonl$/, ""),
+        bytes: buf.byteLength,
+        lines: buf.toString("utf8").split("\n").filter(Boolean).length,
+        sha: createHash("sha256").update(buf).digest("hex").slice(0, 12),
+    };
+}
+/** Newest remote conversation for a session (computed in-Pod, metrics only). */
+export function remoteConvStat(sessionId, workspacePath) {
+    const tunnel = getTunnel();
+    if (!tunnel)
+        return undefined;
+    const env = { ...process.env };
+    if (tunnel.kubeconfig)
+        env.KUBECONFIG = expandHome(tunnel.kubeconfig);
+    const enc = encodeCwd(workspacePath);
+    const script = `d="$HOME/${CLAUDE_PROJECTS}/${enc}"; ` +
+        `f=$(ls -t "$d"/*.jsonl 2>/dev/null | head -1); ` +
+        `[ -z "$f" ] && exit 1; ` +
+        `printf '%s\\t%s\\t%s\\t%s' ` +
+        `"$(basename "$f" .jsonl)" "$(wc -c <"$f")" "$(wc -l <"$f")" "$(sha256sum "$f" | cut -c1-12)"`;
+    const r = spawnSync("kubectl", [
+        "-n",
+        tunnel.namespace,
+        "exec",
+        `session-${sessionId}`,
+        "-c",
+        "session-agent",
+        "--",
+        "bash",
+        "-lc",
+        script,
+    ], { encoding: "utf8", env });
+    if (r.status !== 0)
+        return undefined;
+    const [convId, bytes, lines, sha] = r.stdout.trim().split("\t");
+    if (!convId)
+        return undefined;
+    return { convId, bytes: Number(bytes), lines: Number(lines), sha: sha ?? "" };
+}
+export function alignment(local, remote) {
+    if (!local && !remote)
+        return { state: "missing", detail: "no conversation either side" };
+    if (!remote)
+        return { state: "missing", detail: "remote has no conversation" };
+    if (!local)
+        return { state: "remote-ahead", detail: "no local conversation (remote-only)" };
+    if (local.convId !== remote.convId) {
+        return {
+            state: "diverged",
+            detail: `different conversations — local newest ${local.convId} vs remote ${remote.convId} (separate sessions)`,
+        };
+    }
+    if (local.sha === remote.sha) {
+        return { state: "in-sync", detail: `identical (${local.lines} lines, ${(local.bytes / 1024 / 1024).toFixed(1)}M)` };
+    }
+    if (local.bytes > remote.bytes) {
+        return {
+            state: "local-ahead",
+            detail: `local +${local.lines - remote.lines} lines — push: re-deport (safe, remote is behind)`,
+        };
+    }
+    if (remote.bytes > local.bytes) {
+        return {
+            state: "remote-ahead",
+            detail: `remote +${remote.lines - local.lines} lines — pull: 'remote migrate back' (do NOT re-deport, it would overwrite remote)`,
+        };
+    }
+    return { state: "diverged", detail: "same conversation, content differs (both edited)" };
+}
+//# sourceMappingURL=convsync.js.map

package/dist/convsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convsync.js","sourceRoot":"","sources":["../src/convsync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAS3C,4DAA4D;AAC5D,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,OAAe,OAAO,EAAE;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,MAAqD,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC3C,KAAK,EAAE,GAAG,CAAC,UAAU;QACrB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM;QAC9D,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAC5B,SAAiB,EACjB,aAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACrC,MAAM,MAAM,GACV,YAAY,eAAe,IAAI,GAAG,KAAK;QACvC,iDAAiD;QACjD,yBAAyB;QACzB,6BAA6B;QAC7B,8FAA8F,CAAC;IACjG,MAAM,CAAC,GAAG,SAAS,CACjB,SAAS,EACT;QACE,IAAI;QACJ,MAAM,CAAC,SAAS;QAChB,MAAM;QACN,WAAW,SAAS,EAAE;QACtB,IAAI;QACJ,eAAe;QACf,IAAI;QACJ,MAAM;QACN,KAAK;QACL,MAAM;KACP,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAC1B,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;AAChF,CAAC;AAOD,MAAM,UAAU,SAAS,CACvB,KAA2B,EAC3B,MAA4B;IAE5B,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC1F,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,OAAO;YACL,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,0CAA0C,KAAK,CAAC,MAAM,cAAc,MAAM,CAAC,MAAM,sBAAsB;SAChH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtH,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,UAAU,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,mDAAmD;SAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,WAAW,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,oFAAoF;SAClI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;AAC3F,CAAC"}

package/dist/cred-health.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Credential RELIABILITY pure cores (remote supervise slice 2) — ADDITIVE ONLY.
+ *
+ * Remote Pods silently lose auth (claude / gh / npm / docker → 401). The
+ * `creds refresh --watch` loop pushes fresh local creds, but (a) it can't tell a
+ * Pod-side credential already expired, (b) nobody notices when the watcher
+ * itself stopped, (c) the local claude OAuth token expires roughly every 8h and
+ * only `claude` running LOCALLY can refresh it.
+ *
+ * This module is PURE (no IO, no clock unless injected): the watch loop / `ls`
+ * call these to DECIDE; the actual push reuses the EXISTING soft-refresh path
+ * unchanged. NOTHING here ever prints or logs a secret VALUE — tool names and
+ * ok/reason only.
+ */
+/** Tools whose Pod-side auth is CHEAP to probe (a non-mutating status check). */
+export type ProbeableTool = "gh" | "npm" | "docker";
+/** Is `tool` one we can cheaply health-probe in the Pod? (NOT claude/codex.) */
+export declare function isProbeableTool(tool: string): tool is ProbeableTool;
+/** All cheap-to-probe tools, in a stable order. */
+export declare const PROBEABLE_TOOLS: ReadonlyArray<ProbeableTool>;
+/**
+ * The ARGV (never a `bash -lc` string) to health-probe a tool's auth INSIDE the
+ * Pod, run through the existing `kubectl exec … -- <argv>` plumbing. Each is a
+ * READ-ONLY status check that fails (non-zero, or an unauth marker on stdout)
+ * when the Pod's credential is missing/expired:
+ *  - gh:     `gh auth status`        — non-zero when not logged in.
+ *  - npm:    `npm whoami`            — non-zero / empty when the token is invalid.
+ *  - docker: read `~/.docker/config.json` and check it carries at least one
+ *            `auths` entry (a pure config presence check — we do NOT hit a
+ *            registry, which would need a target + network and could mutate
+ *            nothing useful; a missing/empty config is the real 401 signal).
+ *
+ * The argv is built from STATIC tokens only (no untrusted interpolation), so it
+ * is safe to pass straight to `kubectl exec`. Pure, exported for tests.
+ */
+export declare function buildHealthProbeCommand(tool: ProbeableTool): string[];
+export type HealthResult = {
+    readonly tool: ProbeableTool;
+    /** true = the Pod's credential for this tool looks valid. */
+    readonly ok: boolean;
+    /** Short, SECRET-FREE reason (tool/status only — never a token value). */
+    readonly reason: string;
+};
+/**
+ * Interpret a probe's exit code + stdout into `{tool, ok, reason}`. PURE.
+ * `ok` is decided per tool:
+ *  - any tool: a non-zero exit is a fail.
+ *  - npm: even exit 0 with EMPTY stdout (no username) is treated as a fail —
+ *    some npm versions print a warning and exit 0 with no name.
+ *  - gh/docker: exit 0 is ok.
+ * The `reason` is a fixed, secret-free phrase. We NEVER echo stdout (it may
+ * carry a username/host) beyond the boolean decision.
+ */
+export declare function parseHealthResult(tool: ProbeableTool, exitCode: number, stdout: string): HealthResult;
+/** HOME/config-dir-relative file the `creds refresh --watch` loop touches each pass. */
+export declare const SUPERVISOR_HEARTBEAT_FILE = "supervisor-heartbeat";
+/**
+ * Loud advisory when the creds supervisor (`creds refresh --watch`) does not
+ * appear to be running: NO heartbeat, or a heartbeat OLDER than 2× the watch
+ * interval (a missed pass means the Pods are drifting toward a 401 with nobody
+ * pushing). PURE — the caller stats the heartbeat file and passes its mtime (ms)
+ * or undefined, the configured `intervalMs`, and `now`. Returns undefined when
+ * the heartbeat is fresh. Mirrors `conductorAdvisory`. Exported for tests.
+ *
+ * A non-finite/zero `intervalMs` falls back to treating ANY heartbeat as fresh
+ * only when present (we can't compute staleness without an interval), and warns
+ * when absent.
+ */
+export declare function supervisorAdvisory(heartbeatMtimeMs: number | undefined, intervalMs: number, now?: number): string | undefined;
+/** Within this window of `expiresAt` we warn the user to refresh claude locally. */
+export declare const CLAUDE_EXPIRY_WARN_MS: number;
+export type ClaudeExpiry = {
+    /** Parsed `expiresAt` (ms epoch), or undefined when absent/unparseable. */
+    readonly expiresAtMs: number | undefined;
+    /** ms until expiry (negative when already expired); undefined when unknown. */
+    readonly msUntilExpiry: number | undefined;
+    /** true when expired OR within CLAUDE_EXPIRY_WARN_MS of expiry. */
+    readonly expiringSoon: boolean;
+    /** true when `now >= expiresAt`. */
+    readonly expired: boolean;
+};
+/**
+ * Parse a claude `.credentials.json` (already JSON.parsed object OR a raw
+ * string) and report its OAuth-token expiry vs `now`. PURE. The token lives at
+ * `claudeAiOauth.expiresAt` (ms epoch). A missing/invalid field yields all-
+ * undefined / not-expiring (we never warn on what we can't read). We read ONLY
+ * the numeric expiry — NEVER the token values. Exported for tests.
+ */
+export declare function claudeTokenExpiry(credential: unknown, now?: number, warnMs?: number): ClaudeExpiry;
+/**
+ * The loud, SECRET-FREE advisory string for a claude token that is expired or
+ * about to expire. Returns undefined when not expiring soon. PURE. Used by the
+ * watch loop's per-pass output AND the `ls` advisory. Exported for tests.
+ */
+export declare function claudeExpiryAdvisory(expiry: ClaudeExpiry): string | undefined;
+//# sourceMappingURL=cred-health.d.ts.map

package/dist/cred-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cred-health.d.ts","sourceRoot":"","sources":["../src/cred-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEpD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,aAAa,CAEnE;AAED,mDAAmD;AACnD,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,CAA2B,CAAC;AAErF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE,CAmBrE;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,YAAY,CAQd;AAMD,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACpC,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAmB,GACvB,MAAM,GAAG,SAAS,CAkBpB;AAMD,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,QAAc,CAAC;AAcjD,MAAM,MAAM,YAAY,GAAG;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,OAAO,EACnB,GAAG,GAAE,MAAmB,EACxB,MAAM,GAAE,MAA8B,GACrC,YAAY,CAsBd;AAWD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAa7E"}

package/dist/cred-health.js

@@ -0,0 +1,170 @@
+/**
+ * Credential RELIABILITY pure cores (remote supervise slice 2) — ADDITIVE ONLY.
+ *
+ * Remote Pods silently lose auth (claude / gh / npm / docker → 401). The
+ * `creds refresh --watch` loop pushes fresh local creds, but (a) it can't tell a
+ * Pod-side credential already expired, (b) nobody notices when the watcher
+ * itself stopped, (c) the local claude OAuth token expires roughly every 8h and
+ * only `claude` running LOCALLY can refresh it.
+ *
+ * This module is PURE (no IO, no clock unless injected): the watch loop / `ls`
+ * call these to DECIDE; the actual push reuses the EXISTING soft-refresh path
+ * unchanged. NOTHING here ever prints or logs a secret VALUE — tool names and
+ * ok/reason only.
+ */
+/** Is `tool` one we can cheaply health-probe in the Pod? (NOT claude/codex.) */
+export function isProbeableTool(tool) {
+    return tool === "gh" || tool === "npm" || tool === "docker";
+}
+/** All cheap-to-probe tools, in a stable order. */
+export const PROBEABLE_TOOLS = ["gh", "npm", "docker"];
+/**
+ * The ARGV (never a `bash -lc` string) to health-probe a tool's auth INSIDE the
+ * Pod, run through the existing `kubectl exec … -- <argv>` plumbing. Each is a
+ * READ-ONLY status check that fails (non-zero, or an unauth marker on stdout)
+ * when the Pod's credential is missing/expired:
+ *  - gh:     `gh auth status`        — non-zero when not logged in.
+ *  - npm:    `npm whoami`            — non-zero / empty when the token is invalid.
+ *  - docker: read `~/.docker/config.json` and check it carries at least one
+ *            `auths` entry (a pure config presence check — we do NOT hit a
+ *            registry, which would need a target + network and could mutate
+ *            nothing useful; a missing/empty config is the real 401 signal).
+ *
+ * The argv is built from STATIC tokens only (no untrusted interpolation), so it
+ * is safe to pass straight to `kubectl exec`. Pure, exported for tests.
+ */
+export function buildHealthProbeCommand(tool) {
+    switch (tool) {
+        case "gh":
+            return ["gh", "auth", "status"];
+        case "npm":
+            return ["npm", "whoami"];
+        case "docker":
+            // No `docker` binary nor daemon is guaranteed in the runtime image, and a
+            // real registry login would need a target + network. The 401-equivalent
+            // we CAN cheaply detect is "the Pod has no usable docker auth config", so
+            // we test for a config.json carrying a non-empty `auths` object. node is
+            // always present in the session-agent image. Static argv — the inline
+            // node script contains no interpolated/untrusted data.
+            return [
+                "node",
+                "-e",
+                'const fs=require("fs");try{const c=JSON.parse(fs.readFileSync(process.env.HOME+"/.docker/config.json","utf8"));const a=c&&c.auths&&Object.keys(c.auths).length>0;process.exit(a?0:1)}catch(e){process.exit(1)}',
+            ];
+    }
+}
+/**
+ * Interpret a probe's exit code + stdout into `{tool, ok, reason}`. PURE.
+ * `ok` is decided per tool:
+ *  - any tool: a non-zero exit is a fail.
+ *  - npm: even exit 0 with EMPTY stdout (no username) is treated as a fail —
+ *    some npm versions print a warning and exit 0 with no name.
+ *  - gh/docker: exit 0 is ok.
+ * The `reason` is a fixed, secret-free phrase. We NEVER echo stdout (it may
+ * carry a username/host) beyond the boolean decision.
+ */
+export function parseHealthResult(tool, exitCode, stdout) {
+    if (exitCode !== 0) {
+        return { tool, ok: false, reason: `${tool}: probe exited ${exitCode} (not authenticated)` };
+    }
+    if (tool === "npm" && stdout.trim().length === 0) {
+        return { tool, ok: false, reason: "npm: whoami returned no user (not authenticated)" };
+    }
+    return { tool, ok: true, reason: `${tool}: authenticated` };
+}
+// ---------------------------------------------------------------------------
+// Watcher HEARTBEAT staleness → advisory (zero-risk; the highest-value piece).
+// ---------------------------------------------------------------------------
+/** HOME/config-dir-relative file the `creds refresh --watch` loop touches each pass. */
+export const SUPERVISOR_HEARTBEAT_FILE = "supervisor-heartbeat";
+/**
+ * Loud advisory when the creds supervisor (`creds refresh --watch`) does not
+ * appear to be running: NO heartbeat, or a heartbeat OLDER than 2× the watch
+ * interval (a missed pass means the Pods are drifting toward a 401 with nobody
+ * pushing). PURE — the caller stats the heartbeat file and passes its mtime (ms)
+ * or undefined, the configured `intervalMs`, and `now`. Returns undefined when
+ * the heartbeat is fresh. Mirrors `conductorAdvisory`. Exported for tests.
+ *
+ * A non-finite/zero `intervalMs` falls back to treating ANY heartbeat as fresh
+ * only when present (we can't compute staleness without an interval), and warns
+ * when absent.
+ */
+export function supervisorAdvisory(heartbeatMtimeMs, intervalMs, now = Date.now()) {
+    if (heartbeatMtimeMs === undefined) {
+        return ("[remote] creds supervisor heartbeat MISSING — `remote refresh --all --watch <min>` " +
+            "is not running; remote Pods will drift to 401 with no fresh creds pushed. " +
+            "Start it: tmux new-window -n creds 'remote refresh --all --watch 30'");
+    }
+    if (!Number.isFinite(intervalMs) || intervalMs <= 0)
+        return undefined;
+    const ageMs = now - heartbeatMtimeMs;
+    if (ageMs <= 2 * intervalMs)
+        return undefined;
+    const ageMin = Math.round(ageMs / 60_000);
+    return (`[remote] creds supervisor heartbeat STALE (${ageMin}m old, > 2× the ${Math.round(intervalMs / 60_000)}m interval) — the watcher likely stopped; remote Pods may be drifting to 401. ` +
+        "Restart it: tmux new-window -n creds 'remote refresh --all --watch 30'");
+}
+// ---------------------------------------------------------------------------
+// claude OAuth expiry DETECTION → advisory ONLY (no auto-action this slice).
+// ---------------------------------------------------------------------------
+/** Within this window of `expiresAt` we warn the user to refresh claude locally. */
+export const CLAUDE_EXPIRY_WARN_MS = 15 * 60_000; // 15 min
+/**
+ * Parse a claude `.credentials.json` (already JSON.parsed object OR a raw
+ * string) and report its OAuth-token expiry vs `now`. PURE. The token lives at
+ * `claudeAiOauth.expiresAt` (ms epoch). A missing/invalid field yields all-
+ * undefined / not-expiring (we never warn on what we can't read). We read ONLY
+ * the numeric expiry — NEVER the token values. Exported for tests.
+ */
+export function claudeTokenExpiry(credential, now = Date.now(), warnMs = CLAUDE_EXPIRY_WARN_MS) {
+    let obj = credential;
+    if (typeof credential === "string") {
+        try {
+            obj = JSON.parse(credential);
+        }
+        catch {
+            obj = undefined;
+        }
+    }
+    const expiresAtMs = readExpiresAt(obj);
+    if (expiresAtMs === undefined) {
+        return {
+            expiresAtMs: undefined,
+            msUntilExpiry: undefined,
+            expiringSoon: false,
+            expired: false,
+        };
+    }
+    const msUntilExpiry = expiresAtMs - now;
+    const expired = msUntilExpiry <= 0;
+    const expiringSoon = msUntilExpiry <= warnMs;
+    return { expiresAtMs, msUntilExpiry, expiringSoon, expired };
+}
+function readExpiresAt(obj) {
+    if (!obj || typeof obj !== "object")
+        return undefined;
+    const oauth = obj.claudeAiOauth;
+    if (!oauth || typeof oauth !== "object")
+        return undefined;
+    const raw = oauth.expiresAt;
+    if (typeof raw !== "number" || !Number.isFinite(raw))
+        return undefined;
+    return raw;
+}
+/**
+ * The loud, SECRET-FREE advisory string for a claude token that is expired or
+ * about to expire. Returns undefined when not expiring soon. PURE. Used by the
+ * watch loop's per-pass output AND the `ls` advisory. Exported for tests.
+ */
+export function claudeExpiryAdvisory(expiry) {
+    if (!expiry.expiringSoon)
+        return undefined;
+    if (expiry.expired) {
+        return ("[remote] LOCAL claude OAuth token has EXPIRED — run `claude` locally to refresh it, " +
+            "then the next supervisor pass will push the fresh token to your Pods.");
+    }
+    const mins = Math.max(0, Math.ceil((expiry.msUntilExpiry ?? 0) / 60_000));
+    return (`[remote] LOCAL claude OAuth token expires in ${mins}m — run \`claude\` locally to refresh it ` +
+        "so the supervisor can push the fresh token before your Pods 401.");
+}
+//# sourceMappingURL=cred-health.js.map

package/dist/cred-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cred-health.js","sourceRoot":"","sources":["../src/cred-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC;AAC9D,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,eAAe,GAAiC,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAErF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI;YACP,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,KAAK,KAAK;YACR,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3B,KAAK,QAAQ;YACX,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,uDAAuD;YACvD,OAAO;gBACL,MAAM;gBACN,IAAI;gBACJ,gNAAgN;aACjN,CAAC;IACN,CAAC;AACH,CAAC;AAUD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAmB,EACnB,QAAgB,EAChB,MAAc;IAEd,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,kBAAkB,QAAQ,sBAAsB,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,iBAAiB,EAAE,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,gBAAoC,EACpC,UAAkB,EAClB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CACL,qFAAqF;YACrF,4EAA4E;YAC5E,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAG,GAAG,GAAG,gBAAgB,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC,GAAG,UAAU;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;IAC1C,OAAO,CACL,8CAA8C,MAAM,mBAAmB,IAAI,CAAC,KAAK,CAC/E,UAAU,GAAG,MAAM,CACpB,gFAAgF;QACjF,wEAAwE,CACzE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,SAAS;AAyB3D;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE,EACxB,SAAiB,qBAAqB;IAEtC,IAAI,GAAG,GAAY,UAAU,CAAC;IAC9B,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,WAAW,EAAE,SAAS;YACtB,aAAa,EAAE,SAAS;YACxB,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,GAAG,GAAG,CAAC;IACxC,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,CAAC;IACnC,MAAM,YAAY,GAAG,aAAa,IAAI,MAAM,CAAC;IAC7C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,KAAK,GAAI,GAA+B,CAAC,aAAa,CAAC;IAC7D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAI,KAAiC,CAAC,SAAS,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CACL,sFAAsF;YACtF,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CACL,gDAAgD,IAAI,2CAA2C;QAC/F,kEAAkE,CACnE,CAAC;AACJ,CAAC"}