@skaile/workspaces 0.10.0 → 0.11.0

package/dist/{chunk-BYZI6FMB.js → chunk-L6PKR6YY.js}

@@ -1,12 +1,12 @@
-import { WorkspacePlugin } from './chunk-YWQ3NGCS.js';
+import { WorkspacePlugin } from './chunk-BTKNSMLK.js';
 import { WebSocketServerTransport } from './chunk-PBWMV5GM.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
-import { EventNormalizer } from './chunk-OSJH4SPO.js';
+import { EventNormalizer } from './chunk-VMU2WEN7.js';
 import { classifyClaudeSdkError } from './chunk-EWP5HZBV.js';
-import { createDriver } from './chunk-S7RACIZI.js';
+import { createDriver } from './chunk-YOFKTALB.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildConnectorPromptSection, buildSdkConnectorTools } from './chunk-EPGHAOEU.js';
+import { registerBuiltinConnectors, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildConnectorPromptSection, buildSdkConnectorTools } from './chunk-UHSC75L7.js';
 import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-W75ASXH4.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-GZWJGNNN.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-4RUVG5GX.js';
@@ -1488,47 +1488,74 @@ function handleMountResourceRequest(command, manager, emit) {
   }
 }
 
-// runner/src/refresh-flag-dispatcher.ts
-async function dispatchRefreshToExposedGitMounts(manager, log) {
-  if (!manager) return;
-  let gitConnectors;
-  try {
-    gitConnectors = manager.listGitConnectors();
-  } catch (err) {
-    log.warn("listGitConnectors failed during refresh-flag dispatch", {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    return;
+// runner/src/ai-credential-refresh.ts
+var PROACTIVE_AI_REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+function createAiCredentialRefreshScheduler(deps) {
+  const now = deps.now ?? (() => Date.now());
+  const setTimeoutImpl = deps.setTimeoutImpl ?? ((handler, ms) => {
+    const handle = setTimeout(handler, ms);
+    return handle;
+  });
+  const clearTimeoutImpl = deps.clearTimeoutImpl ?? ((handle) => {
+    clearTimeout(handle);
+  });
+  const marginMs = deps.marginMs ?? PROACTIVE_AI_REFRESH_MARGIN_MS;
+  let timer = null;
+  function cancel() {
+    if (timer !== null) {
+      clearTimeoutImpl(timer);
+      timer = null;
+    }
   }
-  const eligible = gitConnectors.filter(
-    (m) => m.exposeAccessToken === true && m.auth === "backend"
-  );
-  if (eligible.length === 0) {
-    log.debug("refresh-flag fired but no eligible git connectors (Tier-2 backend) found");
-    return;
+  async function fire() {
+    timer = null;
+    let next;
+    try {
+      next = await deps.refresh();
+    } catch (err) {
+      deps.log(
+        `[ai-credential-refresh] refresh threw: ${err instanceof Error ? err.message : String(err)}; reactive 401 path remains as safety net`
+      );
+      return;
+    }
+    if (next === void 0) {
+      deps.log(
+        "[ai-credential-refresh] refresh returned no expiry; reactive 401 path remains as safety net"
+      );
+      return;
+    }
+    schedule(next);
   }
-  log.info("refresh-flag fired -- dispatching backend mediation", {
-    connectorIds: eligible.map((m) => m.id)
-  });
-  await Promise.all(
-    eligible.map(async (m) => {
-      try {
-        const entry = manager.get(m.id);
-        if (typeof entry.connector.refreshExposedCredential !== "function") {
-          log.debug("connector lacks refreshExposedCredential -- skipping", {
-            connectorId: m.id
-          });
-          return;
-        }
-        await entry.connector.refreshExposedCredential(m.id, entry.handle);
-      } catch (err) {
-        log.warn("refresh-flag dispatch failed for connector", {
-          connectorId: m.id,
-          error: err instanceof Error ? err.message : String(err)
-        });
-      }
-    })
-  );
+  function schedule(expiresAtIso) {
+    cancel();
+    if (!expiresAtIso) {
+      return;
+    }
+    const expiresAtMs = Date.parse(expiresAtIso);
+    if (!Number.isFinite(expiresAtMs)) return;
+    const delayMs = expiresAtMs - now() - marginMs;
+    if (delayMs <= 0) {
+      deps.log(
+        `[ai-credential-refresh] token within ${marginMs / 1e3}s of expiry; refreshing now`
+      );
+      timer = setTimeoutImpl(() => {
+        void fire();
+      }, 0);
+    } else {
+      deps.log(
+        `[ai-credential-refresh] scheduled in ${Math.round(delayMs / 1e3)}s (expiresAt=${expiresAtIso})`
+      );
+      timer = setTimeoutImpl(() => {
+        void fire();
+      }, delayMs);
+    }
+    timer.unref?.();
+  }
+  return {
+    schedule,
+    cancel,
+    isPending: () => timer !== null
+  };
 }
 function keywordSearch(capabilities, query, limit) {
   const tokens = query.toLowerCase().split(/\s+/).filter((t) => t.length > 0);
@@ -1602,33 +1629,6 @@ function bootstrapCapabilityRegistry(registry) {
     registry.register(cap, "agent");
   }
 }
-var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
-async function writeClaudeCodeCredentialsFile(home, json) {
-  const claudeDir = join(home, ".claude");
-  await mkdir(claudeDir, { recursive: true, mode: 448 });
-  const finalPath = join(claudeDir, ".credentials.json");
-  const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-  await writeFile(tmpPath, json, { mode: 384 });
-  await rename(tmpPath, finalPath);
-  return finalPath;
-}
-async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
-  const credPath = join(home, ".claude", ".credentials.json");
-  let merged = {};
-  if (existsSync(credPath)) {
-    try {
-      merged = JSON.parse(readFileSync(credPath, "utf-8"));
-    } catch {
-      merged = {};
-    }
-  }
-  const oauthBlock = merged.claudeAiOauth ?? {};
-  oauthBlock.accessToken = accessToken;
-  if (expiresAt) oauthBlock.expiresAt = expiresAt;
-  merged.claudeAiOauth = oauthBlock;
-  merged.accessToken = accessToken;
-  return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
-}
 var DEFAULT_AUDIENCE = ["llm", "user"];
 function audienceOf(cap) {
   return cap.audience ?? DEFAULT_AUDIENCE;
@@ -2300,6 +2300,49 @@ function rewriteFileChangedPath(event, cwd, mounts) {
   }
   return event;
 }
+
+// runner/src/refresh-flag-dispatcher.ts
+async function dispatchRefreshToExposedGitMounts(manager, log) {
+  if (!manager) return;
+  let gitConnectors;
+  try {
+    gitConnectors = manager.listGitConnectors();
+  } catch (err) {
+    log.warn("listGitConnectors failed during refresh-flag dispatch", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return;
+  }
+  const eligible = gitConnectors.filter(
+    (m) => m.exposeAccessToken === true && m.auth === "backend"
+  );
+  if (eligible.length === 0) {
+    log.debug("refresh-flag fired but no eligible git connectors (Tier-2 backend) found");
+    return;
+  }
+  log.info("refresh-flag fired -- dispatching backend mediation", {
+    connectorIds: eligible.map((m) => m.id)
+  });
+  await Promise.all(
+    eligible.map(async (m) => {
+      try {
+        const entry = manager.get(m.id);
+        if (typeof entry.connector.refreshExposedCredential !== "function") {
+          log.debug("connector lacks refreshExposedCredential -- skipping", {
+            connectorId: m.id
+          });
+          return;
+        }
+        await entry.connector.refreshExposedCredential(m.id, entry.handle);
+      } catch (err) {
+        log.warn("refresh-flag dispatch failed for connector", {
+          connectorId: m.id,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    })
+  );
+}
 var RUNNER_CAP_ORIGIN = { kind: "framework" };
 function notImplemented(name) {
   return {
@@ -2471,6 +2514,54 @@ function buildRunnerCapabilities(handlers) {
     })
   ];
 }
+var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
+async function writeClaudeCodeCredentialsFile(home, json) {
+  const claudeDir = join(home, ".claude");
+  await mkdir(claudeDir, { recursive: true, mode: 448 });
+  const finalPath = join(claudeDir, ".credentials.json");
+  const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
+  await writeFile(tmpPath, json, { mode: 384 });
+  await rename(tmpPath, finalPath);
+  return finalPath;
+}
+async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
+  const credPath = join(home, ".claude", ".credentials.json");
+  let merged = {};
+  if (existsSync(credPath)) {
+    try {
+      merged = JSON.parse(readFileSync(credPath, "utf-8"));
+    } catch {
+      merged = {};
+    }
+  }
+  const oauthBlock = merged.claudeAiOauth ?? {};
+  oauthBlock.accessToken = accessToken;
+  if (expiresAt) oauthBlock.expiresAt = expiresAt;
+  merged.claudeAiOauth = oauthBlock;
+  merged.accessToken = accessToken;
+  return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
+}
+function extractClaudeAiOauthExpiresAt(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  const oauth = obj.claudeAiOauth;
+  const raw = oauth?.expiresAt ?? obj.expiresAt;
+  if (raw == null) return null;
+  if (typeof raw === "string") {
+    const t = Date.parse(raw);
+    return Number.isFinite(t) ? new Date(t).toISOString() : null;
+  }
+  if (typeof raw === "number" && Number.isFinite(raw)) {
+    return new Date(raw).toISOString();
+  }
+  return null;
+}
 
 // runner/src/session-stimulus.ts
 var DEFAULT_COALESCE_MS = 50;
@@ -2732,9 +2823,8 @@ async function startAgentServer(opts) {
     });
   };
   let aiProviderConfigId;
-  const onAuthError = async (args) => {
+  async function mintAndPersistAiCredential(args) {
     if (!transport.connected || aiProviderConfigId === void 0) {
-      log("[serve] auth error: no transport or no aiProviderConfigId; surfacing");
       return {
         ok: false,
         code: "not-configured",
@@ -2742,20 +2832,17 @@ async function startAgentServer(opts) {
       };
     }
     const targetConfigId = args.configId || aiProviderConfigId;
-    log("[serve] auth error: invoking host.refresh_credential capability");
     try {
       const result = await capabilityRegistry.invokeRemote("host.refresh_credential", {
         kind: "ai-credentials",
         id: targetConfigId,
-        reason: "retry-401"
+        reason: args.reason
       });
       if (!result?.ok) {
-        log(`[serve] auth error: mint failed (code=${result?.code ?? "backend-error"}); surfacing`);
         return result ?? { ok: false, code: "backend-error", message: "no result from host" };
       }
       const home = process.env.HOME ?? homedir();
       if (!home) {
-        log("[serve] auth error: HOME unset; cannot rewrite credentials file");
         return {
           ok: false,
           code: "backend-error",
@@ -2763,13 +2850,38 @@ async function startAgentServer(opts) {
         };
       }
       await mergeAndRewriteCredentialsFile(home, result.token, result.expiresAt ?? null);
-      log("[serve] auth error: rewrote .credentials.json with mediated accessToken");
+      aiCredentialRefreshScheduler.schedule(result.expiresAt ?? null);
       return result;
     } catch (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
-      log(`[serve] auth error: host.refresh_credential threw: ${errMsg}`);
       return { ok: false, code: "backend-error", message: errMsg };
     }
+  }
+  const aiCredentialRefreshScheduler = createAiCredentialRefreshScheduler({
+    refresh: async () => {
+      const result = await mintAndPersistAiCredential({ reason: "refresh" });
+      if (!result.ok) {
+        log(
+          `[serve] proactive AI refresh failed (code=${result.code}); leaving reactive path as fallback`
+        );
+        return void 0;
+      }
+      return result.expiresAt ?? null;
+    },
+    log
+  });
+  const onAuthError = async (args) => {
+    log("[serve] auth error: invoking host.refresh_credential capability");
+    const result = await mintAndPersistAiCredential({
+      configId: args.configId,
+      reason: "retry-401"
+    });
+    if (!result.ok) {
+      log(`[serve] auth error: mint failed (code=${result.code}); surfacing`);
+    } else {
+      log("[serve] auth error: rewrote .credentials.json with mediated accessToken");
+    }
+    return result;
   };
   const APPROVAL_REQUIRED_CAPABILITY_TIMEOUT_MS = 15 * 60 * 1e3;
   function buildClientCapabilityHandler2(wire) {
@@ -3208,6 +3320,7 @@ async function startAgentServer(opts) {
       driver?.kill();
     } catch {
     }
+    aiCredentialRefreshScheduler.cancel();
     for (const [callId, pending] of pendingCapabilityCalls) {
       clearTimeout(pending.timer);
       pending.reject(new Error(`Session terminated before capability_result (callId=${callId})`));
@@ -3270,6 +3383,7 @@ async function startAgentServer(opts) {
         }
         sendEvent({ type: "protocol_info", version: PROTOCOL_VERSION });
         preMintedSecrets = new PreMintedSecretProvider(cmd.credentials);
+        let initialAiCredentialExpiresAt = null;
         if (cmd.secrets) {
           const ccdValue = cmd.secrets[CLAUDE_CODE_CREDENTIALS_KEY];
           if (ccdValue) {
@@ -3285,6 +3399,7 @@ async function startAgentServer(opts) {
                 log(`[serve] failed to write Claude Code credentials file: ${errMsg}`);
               }
             }
+            initialAiCredentialExpiresAt = extractClaudeAiOauthExpiresAt(ccdValue);
           }
           const otherSecrets = Object.fromEntries(
             Object.entries(cmd.secrets).filter(([k]) => k !== CLAUDE_CODE_CREDENTIALS_KEY)
@@ -3336,6 +3451,9 @@ async function startAgentServer(opts) {
           aiProviderConfigId = cmd.resolvedConfig.aiProviderConfigId;
           log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
         }
+        if (aiProviderConfigId && initialAiCredentialExpiresAt) {
+          aiCredentialRefreshScheduler.schedule(initialAiCredentialExpiresAt);
+        }
         const cfg = {
           aiResources: cmd.resolvedConfig.aiResources,
           subagents: cmd.resolvedConfig.subagents,
@@ -3347,10 +3465,6 @@ async function startAgentServer(opts) {
         log(
           `[serve] configure cfg keys=${Object.keys(cfg).join(",")} sharedState=${cfg.sharedState ? cfg.sharedState.length : "undefined"} resourceManager=${resourceManager ? "set" : "null"}`
         );
-        if (cfg.aiProviderConfigId) {
-          aiProviderConfigId = cfg.aiProviderConfigId;
-          log(`[serve] stashed aiProviderConfigId=${aiProviderConfigId}`);
-        }
         let pendingResumeSessionId;
         const cfgResumeSessionId = cfg.resumeSessionId;
         const cfgExpectedSig = cfg.expectedCapabilitySignature;
@@ -4128,6 +4242,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, emitSystemPromptComposed, ensureGitConfigInclude, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-BYZI6FMB.js.map
-//# sourceMappingURL=chunk-BYZI6FMB.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-L6PKR6YY.js.map
+//# sourceMappingURL=chunk-L6PKR6YY.js.map