@skaile/workspaces 0.10.1 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 0.11.1
+
+### Patch Changes
+
+- ae93713: `webdav` and `sharepoint` connectors now `chmod 0o770` on every directory
+  they `mkdir` (mount target, vfs cache, cache root) via a new local
+  `ensureDirMode()` helper. `RcloneProcessManager.spawn()` does the same on
+  the mountPoint and cacheDir it creates.
+
+  `mkdirSync(mode:)` is masked by the process umask — default 022 yields
+  mode 0750 and strips the group-write bit `fusermount3` requires on the
+  mountpoint and rclone needs on the vfs cache. Explicit `chmod` is
+  umask-immune. EPERM on chmod is swallowed: a foreign-uid pre-create is
+  recovered by the platform's agent container entrypoint (see
+  skaile-ai/platform#139), so the runner staying quiet here is intentional
+  defence in depth rather than a swallowed failure.
+
+  Fixes the production symptom where a Nextcloud-backed session failed
+  after a platform restart with `fusermount3: user has no write access to
+mountpoint /skaile/.mounts/workspace` and
+  `mkdir /var/cache/skaile/.../vfs/skaile-workspace: permission denied`.
+
+## 0.11.0
+
+### Minor Changes
+
+- c0f3b15: Two-part hardening of the AI-credential 401 path:
+
+  **Bridge: defer the auth-error event when self-heal is pending.** The
+  `claude-sdk` driver used to emit a `{ type: "error" }` agent-event from
+  `failTurn()` _before_ its `onAuthError` self-heal callback decided
+  whether the credential could be refreshed. The runner forwarded every
+  such event to the platform, so users saw a flash of `Failed to
+authenticate. API Error: 401` even on every successful self-heal.
+  `failTurn()` now suppresses the downstream emission when the failure
+  is an `AuthError` on the first attempt AND an `onAuthError` callback is
+  configured; the event is emitted only if the self-heal callback returns
+  failure (or throws), or if the retry's own `failTurn` runs. Every auth
+  failure still produces exactly one downstream `error` event — none on
+  silent recovery, one on terminal failure.
+
+  **Runner: proactive AI-credential refresh.** New
+  `createAiCredentialRefreshScheduler` factory in
+  `runner/src/ai-credential-refresh.ts`. After the initial Claude Code
+  credentials blob lands at `session_init`, the runner parses
+  `claudeAiOauth.expiresAt`, schedules a single `setTimeout` to fire 5
+  minutes before expiry, and on fire calls
+  `host.refresh_credential { reason: 'refresh' }` via the existing
+  mediator path. Successful mints (proactive or reactive retry-401) chain
+  the next fire. Static tokens (`expiresAt: null`) and standalone CLI
+  sessions short-circuit to no-op. The reactive retry-401 path stays as
+  the safety net. Cancelled in `cleanup()` so SIGTERM / hibernate does
+  not leak the timer.
+
+  The new helper `extractClaudeAiOauthExpiresAt(json)` is exported from
+  the runner for callers that need to inspect the credentials blob
+  without persisting it.
+
+  Pair with the platform-side enablement of `SKAILE_AIP_AUTO_REFRESH` to
+  also pre-warm the platform's credential cache every 15 minutes; the
+  runner's proactive timer is the primary defence against in-container
+  401s and is independent of that flag.
+
 ## 0.10.1
 
 ### Patch Changes

package/dist/asset-manager/index.js

@@ -1,8 +1,8 @@
-export { AssetManager } from '../chunk-FEBLE7QX.js';
+export { AssetManager } from '../chunk-EARKGKKB.js';
 export { createScaffold, deployAll, removeAsset } from '../chunk-M2NLRGIX.js';
 export { appendHistory, clearHistory, getRecentHistory, loadHistory } from '../chunk-KTBKW2FI.js';
 import '../chunk-UQ6LFBPZ.js';
-export { listTemplates, scaffoldWorkspace, setTemplatesDir } from '../chunk-OQIBHB4F.js';
+export { listTemplates, scaffoldWorkspace, setTemplatesDir } from '../chunk-YHXBQLXX.js';
 import '../chunk-DIKFRNCS.js';
 import '../chunk-4RUVG5GX.js';
 import '../chunk-JKNWJ64A.js';

package/dist/asset-manager/scaffold.js

@@ -1,4 +1,4 @@
-export { applyBaseLayer, applyConnectorsLayer, applyContainerLayer, applyDriverTargetLayer, applyHooksLayer, applySkillsLayer, applyTemplateLayer, listTemplates, loadTemplate, resolveTemplatePath, scaffoldWorkspace, setTemplatesDir } from '../chunk-OQIBHB4F.js';
+export { applyBaseLayer, applyConnectorsLayer, applyContainerLayer, applyDriverTargetLayer, applyHooksLayer, applySkillsLayer, applyTemplateLayer, listTemplates, loadTemplate, resolveTemplatePath, scaffoldWorkspace, setTemplatesDir } from '../chunk-YHXBQLXX.js';
 export { applyAgentsLayer } from '../chunk-DIKFRNCS.js';
 import '../chunk-4RUVG5GX.js';
 import '../chunk-JKNWJ64A.js';

package/dist/base-assets/connectors/deploy.js

@@ -1,6 +1,6 @@
-export { DeployConnector, createConnector20 as createConnector } from '../../chunk-UHSC75L7.js';
+export { DeployConnector, createConnector20 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/devserver.js

@@ -1,6 +1,6 @@
-export { DevServerConnector, createConnector17 as createConnector } from '../../chunk-UHSC75L7.js';
+export { DevServerConnector, createConnector17 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/flow/adapter.js

@@ -1,6 +1,6 @@
-export { FlowAdapter, createConnector } from '../../../chunk-UHSC75L7.js';
+export { FlowAdapter, createConnector } from '../../../chunk-EAJKY27M.js';
 import '../../../chunk-W75ASXH4.js';
-import '../../../chunk-EBMFCF4P.js';
+import '../../../chunk-6MB7CRME.js';
 import '../../../chunk-GCRKAFH7.js';
 export { isBlocking } from '../../../chunk-ICS76R4T.js';
 import '../../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/flow/run-flow.js

@@ -1,9 +1,9 @@
-export { resumeFlow, runFlow } from '../../../chunk-IFRUVHOQ.js';
+export { resumeFlow, runFlow } from '../../../chunk-XYEFV7XN.js';
 import '../../../chunk-GCJXPUHG.js';
 import '../../../chunk-IPUYL6TD.js';
-import '../../../chunk-UHSC75L7.js';
+import '../../../chunk-EAJKY27M.js';
 import '../../../chunk-W75ASXH4.js';
-import '../../../chunk-EBMFCF4P.js';
+import '../../../chunk-6MB7CRME.js';
 import '../../../chunk-GCRKAFH7.js';
 import '../../../chunk-ICS76R4T.js';
 import '../../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/flow.js

@@ -1,6 +1,6 @@
-export { FlowAdapter, createConnector } from '../../chunk-UHSC75L7.js';
+export { FlowAdapter, createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/git.js

@@ -1,6 +1,6 @@
-export { GitConnector, createConnector2 as createConnector } from '../../chunk-UHSC75L7.js';
+export { GitConnector, createConnector2 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/gmail.js

@@ -1,6 +1,6 @@
-export { GmailConnector, createConnector15 as createConnector } from '../../chunk-UHSC75L7.js';
+export { GmailConnector, createConnector15 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/local.js

@@ -1,6 +1,6 @@
-export { LocalConnector, createConnector3 as createConnector } from '../../chunk-UHSC75L7.js';
+export { LocalConnector, createConnector3 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/mattermost.js

@@ -1,6 +1,6 @@
-export { MattermostConnector, createConnector16 as createConnector } from '../../chunk-UHSC75L7.js';
+export { MattermostConnector, createConnector16 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/memory.js

@@ -1,6 +1,6 @@
-export { MemoryConnector, createConnector7 as createConnector } from '../../chunk-UHSC75L7.js';
+export { MemoryConnector, createConnector7 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/minio.js

@@ -1,6 +1,6 @@
-export { MinIOConnector, createConnector11 as createConnector } from '../../chunk-UHSC75L7.js';
+export { MinIOConnector, createConnector11 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/postgres.js

@@ -1,6 +1,6 @@
-export { PostgresConnector, createConnector8 as createConnector } from '../../chunk-UHSC75L7.js';
+export { PostgresConnector, createConnector8 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/redis.js

@@ -1,6 +1,6 @@
-export { RedisConnector, createConnector9 as createConnector } from '../../chunk-UHSC75L7.js';
+export { RedisConnector, createConnector9 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/s3.js

@@ -1,6 +1,6 @@
-export { S3Connector, createConnector4 as createConnector } from '../../chunk-UHSC75L7.js';
+export { S3Connector, createConnector4 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/sharepoint/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../base-assets/connectors/sharepoint/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,cAAc,EAIf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EAIlB,MAAM,+BAA+B,CAAC;AAyEvC;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,OAAO,CAAC,MAAM,CAA8B;IAE5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAIjC;IAEI,OAAO,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAkGzF,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,KAAK;IAwBJ,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOjE,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAMpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,mBAAmB,CAErD"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../base-assets/connectors/sharepoint/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,cAAc,EAIf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EAKlB,MAAM,+BAA+B,CAAC;AAyEvC;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,QAAQ,CAAC,IAAI,gBAAgB;IAE7B,OAAO,CAAC,MAAM,CAA8B;IAE5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAIjC;IAEI,OAAO,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAoGzF,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,KAAK;IAwBJ,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOjE,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAMpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,mBAAmB,CAErD"}

package/dist/base-assets/connectors/sharepoint.js

@@ -1,6 +1,6 @@
-export { SharePointConnector, createConnector6 as createConnector } from '../../chunk-UHSC75L7.js';
+export { SharePointConnector, createConnector6 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/sqlite.js

@@ -1,6 +1,6 @@
-export { SQLiteConnector, createConnector10 as createConnector } from '../../chunk-UHSC75L7.js';
+export { SQLiteConnector, createConnector10 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/static-server.js

@@ -1,6 +1,6 @@
-export { StaticServerConnector, createConnector18 as createConnector } from '../../chunk-UHSC75L7.js';
+export { StaticServerConnector, createConnector18 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/tunnel.js

@@ -1,6 +1,6 @@
-export { TunnelConnector, createConnector19 as createConnector } from '../../chunk-UHSC75L7.js';
+export { TunnelConnector, createConnector19 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/webdav/driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../base-assets/connectors/webdav/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,cAAc,EAIf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EAKlB,MAAM,+BAA+B,CAAC;AA6EvC;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,iBAAiB;IACpD,QAAQ,CAAC,IAAI,YAAY;IAEzB,OAAO,CAAC,MAAM,CAA8B;IAE5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAIjC;IAEI,OAAO,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAkGzF,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,KAAK;IAwBJ,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOjE,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAMpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAEjD"}
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../../base-assets/connectors/webdav/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,cAAc,EAIf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,EAMlB,MAAM,+BAA+B,CAAC;AA6EvC;;;;;;GAMG;AACH,qBAAa,eAAgB,SAAQ,iBAAiB;IACpD,QAAQ,CAAC,IAAI,YAAY;IAEzB,OAAO,CAAC,MAAM,CAA8B;IAE5C,QAAQ,CAAC,UAAU,EAAE,cAAc,CAIjC;IAEI,OAAO,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC;IAoGzF,UAAU,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,KAAK;IAwBJ,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOjE,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAMpF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAEjD"}

package/dist/base-assets/connectors/webdav.js

@@ -1,6 +1,6 @@
-export { WebDAVConnector, createConnector5 as createConnector } from '../../chunk-UHSC75L7.js';
+export { WebDAVConnector, createConnector5 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/xstate-store.js

@@ -1,6 +1,6 @@
-export { XStateStoreConnector, createConnector13 as createConnector } from '../../chunk-UHSC75L7.js';
+export { XStateStoreConnector, createConnector13 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/xstate.js

@@ -1,6 +1,6 @@
-export { XStateConnector, createConnector12 as createConnector } from '../../chunk-UHSC75L7.js';
+export { XStateConnector, createConnector12 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/base-assets/connectors/yjs.js

@@ -1,6 +1,6 @@
-export { YjsConnector, createConnector14 as createConnector } from '../../chunk-UHSC75L7.js';
+export { YjsConnector, createConnector14 as createConnector } from '../../chunk-EAJKY27M.js';
 import '../../chunk-W75ASXH4.js';
-import '../../chunk-EBMFCF4P.js';
+import '../../chunk-6MB7CRME.js';
 import '../../chunk-GCRKAFH7.js';
 import '../../chunk-ICS76R4T.js';
 import '../../chunk-GZWJGNNN.js';

package/dist/bridge/drivers/claude-sdk.js

@@ -1,7 +1,7 @@
 import { classifyClaudeSdkError, AuthError } from '../../chunk-EWP5HZBV.js';
 import { fetchProviderModels } from '../../chunk-KOVLSBXK.js';
 import { dispatchCapability } from '../../chunk-RRVQAE5D.js';
-import { registerDriver, DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-S7RACIZI.js';
+import { registerDriver, DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-YOFKTALB.js';
 import '../../chunk-24UIWON4.js';
 import '../../chunk-NSBPE2FW.js';
 import { spawnSync } from 'child_process';
@@ -237,6 +237,17 @@ var ClaudeSdkDriver = class extends AgentDriver {
   turnReject = null;
   /** Guards against duplicate agent_end emissions per turn. */
   turnCompleted = false;
+  /**
+   * Mirror of the `_retryCount` argument of the in-flight {@link prompt} call.
+   * Read by {@link failTurn} to decide whether to defer the `agent-event:
+   * error` emission for a self-healable auth error. `0` means "first
+   * attempt"; `prompt()` increments to `1` before recursing on its
+   * `onAuthError` self-heal branch.
+   *
+   * Set unconditionally at the top of every {@link prompt} invocation; never
+   * reset elsewhere — the next call's set is the only legitimate transition.
+   */
+  currentRetryCount = 0;
   /** Tracks whether a session has been started (for continue: true). */
   hasSession = false;
   /** Session ID from the SDK — used for streamInput messages. */
@@ -313,6 +324,7 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * occurs after a container crash that prevented the SDK from flushing its session file.
    */
   async prompt(message, _retryCount = 0) {
+    this.currentRetryCount = _retryCount;
     if (!this.sdk) await this.start();
     let retrying = false;
     if (_retryCount === 0) this._lastTokens = null;
@@ -439,6 +451,18 @@ var ClaudeSdkDriver = class extends AgentDriver {
           retrying = true;
           return this.prompt(message, _retryCount + 1);
         }
+        try {
+          this.emit("agent-event", {
+            type: "error",
+            error: err.message,
+            detail: err.detail
+          });
+        } catch (emitErr) {
+          this.log.warn(
+            "agent-event listener threw during deferred auth-error surfacing; suppressing",
+            { error: emitErr instanceof Error ? emitErr.message : String(emitErr) }
+          );
+        }
       }
       throw err;
     } finally {
@@ -761,6 +785,17 @@ var ClaudeSdkDriver = class extends AgentDriver {
    * caller transitions even if the listener chain misbehaves; the emit is
    * wrapped in try/catch so a listener failure cannot leak out.
    *
+   * Self-heal deferral: when the failure is an {@link AuthError} on the
+   * first attempt (`currentRetryCount === 0`) AND the caller wired an
+   * `onAuthError` callback, the downstream `agent-event: error` emission
+   * is deferred. The rejected turn promise still travels to {@link prompt}'s
+   * catch block where the self-heal runs; if the retry succeeds the user
+   * never sees a 401, if the retry fails the second `failTurn` call (now
+   * with `currentRetryCount === 1`) emits the error normally. This stops
+   * the historical "401 flashes in the UI even though self-heal worked"
+   * misbehaviour where the bridge emitted the error event before the
+   * retry decision was known.
+   *
    * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`
    * § "Runner-side handling on 401" (the AI 401 mediation path that
    * exposed this hang).
@@ -771,6 +806,12 @@ var ClaudeSdkDriver = class extends AgentDriver {
       this.turnResolve = null;
       this.turnReject = null;
     }
+    this.turnCompleted = true;
+    const willSelfHeal = err instanceof AuthError && this.currentRetryCount === 0 && this.config.onAuthError != null;
+    if (willSelfHeal) {
+      this.log.info("deferring auth-error event; self-heal will attempt refresh");
+      return;
+    }
     try {
       this.emit("agent-event", {
         type: "error",