@skaile/workspaces 0.39.0 → 0.40.1

package/dist/{chunk-W23HDR6W.js → chunk-PBHLDLVU.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-LJIE3PGF.js';
+import { WorkspacePlugin } from './chunk-23WP47VA.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
@@ -6,7 +6,7 @@ import { EventNormalizer } from './chunk-5IXCNMMU.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
 import { createDriver } from './chunk-KM6DCR7A.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-CMZWYMGD.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-EAWENE2K.js';
 import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, deriveSingleMaterializedConnectorDeclaration } from './chunk-WLWHOA3S.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-FBIQ4QPF.js';
@@ -19,7 +19,7 @@ import { __require } from './chunk-NSBPE2FW.js';
 import pc from 'picocolors';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import { readdirSync, existsSync, readFileSync, unlinkSync, mkdirSync, writeFileSync, statSync, watch, chmodSync, openSync, readSync, closeSync } from 'fs';
+import { readdirSync, existsSync, readFileSync, statSync, rmSync, unlinkSync, mkdirSync, writeFileSync, watch, chmodSync, openSync, readSync, closeSync } from 'fs';
 import path4, { join, resolve, relative, sep, isAbsolute, dirname, basename } from 'path';
 import { homedir } from 'os';
 import * as z5 from 'zod';
@@ -2421,7 +2421,7 @@ function isBinaryFile(filePath) {
   }
 }
 function handleMountResourceRequest(command, manager, emit) {
-  const { requestId, connectorId: mountId, operation, path: reqPath, content } = command;
+  const { requestId, connectorId: mountId, operation, path: reqPath, options, content } = command;
   try {
     const entry = manager.get(mountId);
     const mountPath = entry.handle.mountPath;
@@ -2436,22 +2436,30 @@ function handleMountResourceRequest(command, manager, emit) {
     let data;
     switch (operation) {
       case "list": {
-        const entries = readdirSync(targetPath, { withFileTypes: true });
-        data = entries.filter((e) => !e.name.startsWith(".")).map((e) => {
-          const entryPath = reqPath ? join(reqPath, e.name) : e.name;
-          const result = {
-            name: e.name,
-            path: entryPath,
-            type: e.isDirectory() ? "directory" : "file"
-          };
-          if (!e.isDirectory()) {
-            try {
-              result.size = statSync(join(targetPath, e.name)).size;
-            } catch {
+        const recursive = Boolean(options?.recursive);
+        const collected = [];
+        const walk = (absDir, relDir) => {
+          for (const e of readdirSync(absDir, { withFileTypes: true })) {
+            if (e.name.startsWith(".")) continue;
+            const entryRel = relDir ? `${relDir}/${e.name}` : e.name;
+            const isDir = e.isDirectory();
+            const result = {
+              name: e.name,
+              path: entryRel,
+              type: isDir ? "directory" : "file"
+            };
+            if (!isDir) {
+              try {
+                result.size = statSync(join(absDir, e.name)).size;
+              } catch {
+              }
             }
+            collected.push(result);
+            if (isDir && recursive) walk(join(absDir, e.name), entryRel);
           }
-          return result;
-        });
+        };
+        walk(targetPath, reqPath ?? "");
+        data = collected;
         break;
       }
       case "read": {
@@ -2485,7 +2493,11 @@ function handleMountResourceRequest(command, manager, emit) {
         break;
       }
       case "delete": {
-        unlinkSync(targetPath);
+        if (statSync(targetPath).isDirectory()) {
+          rmSync(targetPath, { recursive: true, force: true });
+        } else {
+          unlinkSync(targetPath);
+        }
         data = true;
         break;
       }
@@ -2503,9 +2515,46 @@ function handleMountResourceRequest(command, manager, emit) {
     });
   }
 }
+var MINT_RETRY_MAX_ATTEMPTS = 3;
+var MINT_RETRY_BASE_DELAY_MS = 2e3;
+var MINT_RETRY_MAX_DELAY_MS = 5e3;
+function isTransientMintFailure(code) {
+  return code === "backend-error";
+}
+function mintRetryDelayMs(retryNumber) {
+  const delay = MINT_RETRY_BASE_DELAY_MS * 2 ** Math.max(0, retryNumber - 1);
+  return Math.min(delay, MINT_RETRY_MAX_DELAY_MS);
+}
+async function retryTransientMint(attempt, deps) {
+  const maxAttempts = deps.maxAttempts ?? MINT_RETRY_MAX_ATTEMPTS;
+  let result = await attempt();
+  for (let n = 1; n < maxAttempts; n++) {
+    if (result.ok || !isTransientMintFailure(result.code)) return result;
+    const nextDelayMs = mintRetryDelayMs(n);
+    deps.onRetry?.({ attempt: n, nextDelayMs, code: result.code });
+    await deps.sleep(nextDelayMs);
+    result = await attempt();
+  }
+  return result;
+}
+function computeRejectedFingerprint(accessToken) {
+  if (!accessToken) return void 0;
+  return createHash("sha256").update(accessToken).digest("hex").slice(0, 16);
+}
+function buildRefreshCredentialInput(args) {
+  const base = {
+    kind: "ai-credentials",
+    id: args.configId,
+    reason: args.reason
+  };
+  if (args.reason !== "retry-401") return base;
+  const rejectedFingerprint = computeRejectedFingerprint(args.rejectedToken);
+  return rejectedFingerprint ? { ...base, rejectedFingerprint } : base;
+}
 
 // runner/src/ai-credential-refresh.ts
 var PROACTIVE_AI_REFRESH_MARGIN_MS = 5 * 60 * 1e3;
+var STALE_REARM_MS = 9 * 60 * 60 * 1e3;
 function createAiCredentialRefreshScheduler(deps) {
   const now = deps.now ?? (() => Date.now());
   const setTimeoutImpl = deps.setTimeoutImpl ?? ((handler, ms) => {
@@ -2516,64 +2565,135 @@ function createAiCredentialRefreshScheduler(deps) {
     clearTimeout(handle);
   });
   const marginMs = deps.marginMs ?? PROACTIVE_AI_REFRESH_MARGIN_MS;
+  const logError = deps.logError ?? deps.log;
   let timer = null;
+  let transientRetryCount = 0;
+  let lastSuccessAt = null;
+  let isStatic = false;
+  let inStaleGuard = false;
   function cancel() {
     if (timer !== null) {
       clearTimeoutImpl(timer);
       timer = null;
     }
   }
+  function armTimer(handler, ms) {
+    cancel();
+    timer = setTimeoutImpl(handler, ms);
+    timer.unref?.();
+  }
+  function isStale() {
+    return lastSuccessAt !== null && now() - lastSuccessAt > STALE_REARM_MS;
+  }
   async function fire() {
     timer = null;
-    let next;
+    let outcome;
     try {
-      next = await deps.refresh();
+      outcome = await deps.refresh();
     } catch (err) {
-      deps.log(
-        `[ai-credential-refresh] refresh threw: ${err instanceof Error ? err.message : String(err)}; reactive 401 path remains as safety net`
+      logError(
+        `[ai-credential-refresh] refresh threw: ${err instanceof Error ? err.message : String(err)}; treating as transient`
+      );
+      outcome = { status: "transient" };
+    }
+    if (outcome.status === "ok") {
+      schedule(outcome.expiresAt);
+      return;
+    }
+    if (outcome.status === "terminal") {
+      transientRetryCount = 0;
+      inStaleGuard = false;
+      logError(
+        "[ai-credential-refresh] proactive refresh hit a terminal failure; not re-arming (reactive 401 path remains the safety net)"
       );
       return;
     }
-    if (next === void 0) {
-      deps.log(
-        "[ai-credential-refresh] refresh returned no expiry; reactive 401 path remains as safety net"
+    if (transientRetryCount < MINT_RETRY_MAX_ATTEMPTS - 1) {
+      transientRetryCount += 1;
+      inStaleGuard = false;
+      const delayMs = mintRetryDelayMs(transientRetryCount);
+      logError(
+        `[ai-credential-refresh] proactive refresh transient failure; bounded retry ${transientRetryCount}/${MINT_RETRY_MAX_ATTEMPTS - 1} in ${Math.round(delayMs / 1e3)}s`
       );
+      armTimer(() => void fire(), delayMs);
       return;
     }
-    schedule(next);
+    transientRetryCount = 0;
+    inStaleGuard = true;
+    logError(
+      `[ai-credential-refresh] proactive refresh failed after ${MINT_RETRY_MAX_ATTEMPTS} attempts; reactive 401 path is the fallback, re-checking in ${Math.round(STALE_REARM_MS / 36e5)}h`
+    );
+    armTimer(() => void fire(), STALE_REARM_MS);
   }
   function schedule(expiresAtIso) {
     cancel();
+    inStaleGuard = false;
     if (!expiresAtIso) {
+      isStatic = true;
+      transientRetryCount = 0;
+      lastSuccessAt = now();
       return;
     }
     const expiresAtMs = Date.parse(expiresAtIso);
     if (!Number.isFinite(expiresAtMs)) return;
+    isStatic = false;
+    transientRetryCount = 0;
+    lastSuccessAt = now();
     const delayMs = expiresAtMs - now() - marginMs;
     if (delayMs <= 0) {
       deps.log(
         `[ai-credential-refresh] token within ${marginMs / 1e3}s of expiry; refreshing now`
       );
-      timer = setTimeoutImpl(() => {
-        void fire();
-      }, 0);
+      armTimer(() => void fire(), 0);
     } else {
       deps.log(
         `[ai-credential-refresh] scheduled in ${Math.round(delayMs / 1e3)}s (expiresAt=${expiresAtIso})`
       );
-      timer = setTimeoutImpl(() => {
-        void fire();
-      }, delayMs);
+      armTimer(() => void fire(), delayMs);
     }
-    timer.unref?.();
+  }
+  function ensureArmed() {
+    if (isStatic) return;
+    if (timer !== null && !inStaleGuard && !isStale()) return;
+    deps.log("[ai-credential-refresh] ensureArmed: reviving idle/stale schedule");
+    transientRetryCount = 0;
+    inStaleGuard = false;
+    armTimer(() => void fire(), 0);
   }
   return {
     schedule,
+    ensureArmed,
     cancel,
     isPending: () => timer !== null
   };
 }
 
+// runner/src/credential-rotated.ts
+var AI_PROVIDER_CREDENTIAL_SUBKIND = "ai-provider-credential";
+function isCredentialRotatedSignal(msg) {
+  if (!msg || typeof msg !== "object") return false;
+  const m = msg;
+  if (m.type !== "log_entry") return false;
+  const entry = m.entry;
+  if (!entry || typeof entry !== "object") return false;
+  return entry.source?.subkind === AI_PROVIDER_CREDENTIAL_SUBKIND && entry.data?.credentialRotated === true;
+}
+async function handleCredentialRotatedSignal(deps) {
+  deps.log("[serve] credentialRotated broadcast received; re-pulling ai-credentials");
+  try {
+    const result = await deps.repull();
+    if (result.ok) {
+      deps.log("[serve] credentialRotated: re-pulled fresh token and rewrote .credentials.json");
+    } else {
+      deps.logError(`[serve] credentialRotated: re-pull failed (code=${result.code})`);
+    }
+  } catch (err) {
+    deps.logError(
+      `[serve] credentialRotated: re-pull threw: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+
 // runner/src/compaction/prompt.ts
 var DEFAULT_COMPACTION_PROMPT = `You are being asked to compact this conversation into a structured summary.
 This summary will replace the full conversation history when the session
@@ -3499,6 +3619,20 @@ function extractClaudeAiOauthExpiresAt(json) {
   }
   return null;
 }
+function readCurrentClaudeAccessToken(home) {
+  const credPath = join(home, ".claude", ".credentials.json");
+  if (!existsSync(credPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(credPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  const raw = obj.claudeAiOauth?.accessToken ?? obj.accessToken;
+  return typeof raw === "string" && raw.length > 0 ? raw : null;
+}
 
 // runner/src/session-stimulus.ts
 var DEFAULT_COALESCE_MS = 50;
@@ -3772,6 +3906,10 @@ async function startAgentServer(opts) {
     });
   };
   let aiProviderConfigId;
+  const sleep = (ms) => new Promise((resolve3) => {
+    const t = setTimeout(resolve3, ms);
+    t.unref?.();
+  });
   async function mintAndPersistAiCredential(args) {
     if (!transport.connected || aiProviderConfigId === void 0) {
       return {
@@ -3782,22 +3920,19 @@ async function startAgentServer(opts) {
     }
     const targetConfigId = args.configId || aiProviderConfigId;
     try {
-      const result = await capabilityRegistry.invokeRemote("host.refresh_credential", {
-        kind: "ai-credentials",
-        id: targetConfigId,
-        reason: args.reason
+      const home = process.env.HOME || homedir();
+      const refreshInput = buildRefreshCredentialInput({
+        configId: targetConfigId,
+        reason: args.reason,
+        rejectedToken: args.reason === "retry-401" ? readCurrentClaudeAccessToken(home) : null
       });
+      const result = await capabilityRegistry.invokeRemote(
+        "host.refresh_credential",
+        refreshInput
+      );
       if (!result?.ok) {
         return result ?? { ok: false, code: "backend-error", message: "no result from host" };
       }
-      const home = process.env.HOME ?? homedir();
-      if (!home) {
-        return {
-          ok: false,
-          code: "backend-error",
-          message: "HOME env var unset; cannot rewrite credentials file"
-        };
-      }
       await mergeAndRewriteCredentialsFile(home, result.token, result.expiresAt ?? null);
       aiCredentialRefreshScheduler.schedule(result.expiresAt ?? null);
       return result;
@@ -3809,22 +3944,27 @@ async function startAgentServer(opts) {
   const aiCredentialRefreshScheduler = createAiCredentialRefreshScheduler({
     refresh: async () => {
       const result = await mintAndPersistAiCredential({ reason: "refresh" });
-      if (!result.ok) {
-        log(
-          `[serve] proactive AI refresh failed (code=${result.code}); leaving reactive path as fallback`
-        );
-        return void 0;
+      if (result.ok) {
+        return { status: "ok", expiresAt: result.expiresAt ?? null };
       }
-      return result.expiresAt ?? null;
+      return isTransientMintFailure(result.code) ? { status: "transient" } : { status: "terminal" };
     },
-    log
+    log,
+    // Scheduler/refresh failures must be visible in `skaile session logs` and
+    // the debug panel, so route them through the error-level structured logger.
+    logError: (line) => serverLog.error(line)
   });
   const onAuthError = async (args) => {
     log("[serve] auth error: invoking host.refresh_credential capability");
-    const result = await mintAndPersistAiCredential({
-      configId: args.configId,
-      reason: "retry-401"
-    });
+    const result = await retryTransientMint(
+      () => mintAndPersistAiCredential({ configId: args.configId, reason: "retry-401" }),
+      {
+        sleep,
+        onRetry: ({ attempt, nextDelayMs, code }) => serverLog.error(
+          `[serve] auth error: transient mint failure (code=${code}); retry ${attempt} in ${Math.round(nextDelayMs / 1e3)}s`
+        )
+      }
+    );
     if (!result.ok) {
       log(`[serve] auth error: mint failed (code=${result.code}); surfacing`);
     } else {
@@ -4711,6 +4851,9 @@ async function startAgentServer(opts) {
       log(
         `[serve] configure cfg keys=${Object.keys(cfg).join(",")} sharedState=${cfg.sharedState ? cfg.sharedState.length : "undefined"} resourceManager=${resourceManager ? "set" : "null"}`
       );
+      if (aiProviderConfigId) {
+        aiCredentialRefreshScheduler.ensureArmed();
+      }
       let pendingResumeSessionId;
       const cfgResumeSessionId = cfg.resumeSessionId;
       const cfgExpectedSig = cfg.expectedCapabilitySignature;
@@ -5072,6 +5215,14 @@ async function startAgentServer(opts) {
   }
   async function handleCommand(cmd) {
     const inbound = cmd;
+    if (isCredentialRotatedSignal(cmd)) {
+      await handleCredentialRotatedSignal({
+        repull: () => mintAndPersistAiCredential({ reason: "refresh" }),
+        log,
+        logError: (line) => serverLog.error(line)
+      });
+      return;
+    }
     if (inbound.type === "capability_invoked") {
       await dispatchRunnerCapabilityInvocation(
         { callId: inbound.callId ?? "", name: inbound.name ?? "", input: inbound.input },
@@ -5352,5 +5503,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, stripStaleHtmlTail, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-W23HDR6W.js.map
-//# sourceMappingURL=chunk-W23HDR6W.js.map
+//# sourceMappingURL=chunk-PBHLDLVU.js.map
+//# sourceMappingURL=chunk-PBHLDLVU.js.map