@suveren/gateway 0.8.5 → 0.8.7

package/dist/control-plane/index.mjs

@@ -5,9 +5,9 @@ import {
 
 // src/index.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync6, renameSync } from "fs";
-import { dirname as dirname5, join as join7 } from "path";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync7, readFileSync as readFileSync8, renameSync as renameSync2 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
+import { homedir as homedir7 } from "os";
 import express from "express";
 import { createProxyMiddleware } from "http-proxy-middleware";
 
@@ -33,6 +33,15 @@ var Vault = class {
   spSessionCookie = null;
   unsealedBy = null;
   dataDir;
+  /**
+   * When the AS session (captured at login into `spSessionCookie`) is due to
+   * end — unix seconds, from the login response's `sessionExpiresAt`. Held in
+   * memory only, exactly like the vault key and the cookie: never written to
+   * disk, gone the moment the process restarts or the vault locks.
+   */
+  spSessionExpiresAt = null;
+  /** Set by lockExpired(); cleared by any fresh unseal (a new login). */
+  lockedReason = null;
   constructor(dataDir) {
     this.dataDir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join(homedir(), ".suveren");
   }
@@ -59,6 +68,7 @@ var Vault = class {
   async unseal(provider) {
     this.vaultKey = await provider.deriveKey(this.ensureSalt());
     this.unsealedBy = provider.id;
+    this.lockedReason = null;
   }
   /**
    * Unlock from the user's API key. Also records the key's hash so subsequent
@@ -86,6 +96,33 @@ var Vault = class {
     this.apiKeyHash = null;
     this.spSessionCookie = null;
     this.unsealedBy = null;
+    this.spSessionExpiresAt = null;
+    this.lockedReason = null;
+  }
+  /**
+   * Lock because the AS session ended — a 401 surfaced it, or the scheduled
+   * expiry arrived. Distinct from logout/clearKey() only in that it records
+   * WHY, so the next `/health` call and the next locked-tool notice can say
+   * something better than "boots locked by design" when that is not what
+   * happened.
+   */
+  lockExpired() {
+    this.clearKey();
+    this.lockedReason = "expired";
+  }
+  /** What locked the vault, if known. `null` covers both "still unlocked"
+   *  and the default boot-locked case — callers that care about the
+   *  difference should check `isUnlocked()` first. */
+  getLockedReason() {
+    return this.lockedReason;
+  }
+  /** unix seconds the current AS session is due to end, or null (locked, or
+   *  the AS didn't report one — a pre-30-day-rollout server). Never persisted. */
+  setSessionExpiresAt(expiresAt) {
+    this.spSessionExpiresAt = expiresAt;
+  }
+  getSessionExpiresAt() {
+    return this.spSessionExpiresAt;
   }
   /**
    * Check if the vault was created by a different API key.
@@ -263,6 +300,15 @@ async function configure(sessionCookie, vaultKeyHex) {
     clearTimeout(timeout);
   }
 }
+async function unconfigureSession() {
+  const res = await fetch(`${MCP_BASE}/internal/clear-session`, {
+    method: "POST",
+    headers: internalHeaders()
+  });
+  if (!res.ok) {
+    throw new Error(`MCP clear-session failed: ${res.status}`);
+  }
+}
 async function pushGateContent(data) {
   const res = await fetch(`${MCP_BASE}/internal/gate-content`, {
     method: "POST",
@@ -552,9 +598,45 @@ async function loadOrGenerateKeyPair(vault2) {
   return kp;
 }
 
+// src/lib/client-version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+var UNKNOWN = "unknown";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function detectGatewayVersion() {
+  const override = process.env.SUVEREN_GATEWAY_VERSION;
+  if (override) return override;
+  const start = import.meta.dirname ?? process.cwd();
+  let dir = start;
+  for (let up = 0; up < 6; up++) {
+    const pkg = readJson(join2(dir, "package.json"));
+    const name = pkg?.name;
+    const version = pkg?.version;
+    if (typeof version === "string" && (name === "@suveren/gateway" || name === "suveren-gateway")) {
+      return version;
+    }
+    const parent = join2(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.env.HAP_BUILD_SHA ?? UNKNOWN;
+}
+var GATEWAY_VERSION = detectGatewayVersion();
+function clientVersionHeaders() {
+  return {
+    "x-suveren-gateway-version": GATEWAY_VERSION
+  };
+}
+
 // src/routes/auth.ts
 var SP_URL = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
-function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
+function createAuthRouter(vault2, logoutAuth, loginRateLimit2, onSessionEstablished) {
   const router = Router();
   router.post("/login", loginRateLimit2, async (req, res) => {
     const apiKey = req.headers["x-api-key"] || req.body?.apiKey;
@@ -568,7 +650,11 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "X-API-Key": apiKey
+          "X-API-Key": apiKey,
+          // The AS grants a 30-day gateway session ONLY to a login that
+          // identifies itself this way; without it, a 24-hour browser
+          // session (see doc at the top of this file).
+          ...clientVersionHeaders()
         }
       });
       if (!spRes.ok) {
@@ -576,6 +662,7 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
         res.status(spRes.status).json(err);
         return;
       }
+      const data = await spRes.json();
       const setCookieHeaders = spRes.headers.getSetCookie?.() ?? [];
       const sessionCookie = setCookieHeaders.join("; ");
       vault2.setSpCookie(sessionCookie);
@@ -605,6 +692,9 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
         vault2.wipe();
         await vault2.deriveAndSetKey(apiKey);
       }
+      const sessionExpiresAt = typeof data.sessionExpiresAt === "number" ? data.sessionExpiresAt : null;
+      vault2.setSessionExpiresAt(sessionExpiresAt);
+      onSessionEstablished?.();
       if (sessionCookie) {
         try {
           await configure(sessionCookie, vault2.getVaultKeyHex());
@@ -612,7 +702,6 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
           console.error("[Control Plane] Failed to configure MCP:", err);
         }
       }
-      const data = await spRes.json();
       res.json(data);
       (async () => {
         try {
@@ -684,7 +773,16 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
     }
   });
   router.post("/logout", logoutAuth, async (_req, res) => {
+    const cookie = vault2.getSpCookie();
     vault2.clearKey();
+    await Promise.allSettled([
+      unconfigureSession(),
+      cookie ? fetch(`${SP_URL}/api/auth/logout`, {
+        method: "POST",
+        headers: { cookie, ...clientVersionHeaders() },
+        redirect: "manual"
+      }) : Promise.resolve()
+    ]);
     res.json({ ok: true });
   });
   return router;
@@ -1294,18 +1392,18 @@ async function testAIConnectivity(config) {
 }
 
 // src/lib/agent-brief-store.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var AGENT_CONTEXT_MAX_BYTES = 16 * 1024;
 function agentBriefPath() {
-  const dataDir = process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
-  return join2(dataDir, "context.md");
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
+  return join3(dataDir, "context.md");
 }
 function readAgentBrief() {
   const filePath = agentBriefPath();
   if (!existsSync2(filePath)) return "";
-  return readFileSync2(filePath, "utf-8");
+  return readFileSync3(filePath, "utf-8");
 }
 
 // src/routes/ai.ts
@@ -1676,15 +1774,15 @@ import { promisify } from "util";
 var run = promisify(execFile);
 var SUPPORTED = /* @__PURE__ */ new Set(["darwin", "win32", "linux"]);
 var MODULE_DIR = pathDirname(fileURLToPath(import.meta.url));
-function findCli(dirname6 = MODULE_DIR) {
+function findCli(dirname7 = MODULE_DIR) {
   const candidates = [
     // Bundled (the shipped layout): dist/control-plane → dist → root → bin
-    resolve(dirname6, "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "bin", "suveren-gateway.js"),
     // Bundled, were the routes/ directory ever preserved.
-    resolve(dirname6, "..", "..", "..", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "..", "bin", "suveren-gateway.js"),
     // Dev, running from source: the repo's own bundle directory.
-    resolve(dirname6, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
-    resolve(dirname6, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
+    resolve(dirname7, "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js"),
+    resolve(dirname7, "..", "..", "..", "..", "..", "bundle", "bin", "suveren-gateway.js")
     // Deliberately NO process.cwd() fallback: it makes the result depend on
     // where the process happened to be launched from, so the same install
     // resolves differently between a shell and a login service — and it would
@@ -1773,12 +1871,12 @@ import { spawn, spawnSync } from "child_process";
 // src/lib/notifier-icon.ts
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join3, dirname as dirname2 } from "path";
+import { join as join4, dirname as dirname2 } from "path";
 var ICON_BASE64 = "iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAACXBIWXMAACxLAAAsSwGlPZapAAAaEElEQVR42u2deXxNV9fH7/O2z/vHk+HmJoIoQQxpBtVPi+LTIWZqeDQ6V0tRFUWIeagSRAheyasxVNUsWtRQSquoMTRi9mgJooZWhBqaSIX97nWa9CVN4ubes8/Z55zf+ny+H1rknrv3Wr+zh7XXttmMaY94e3vXdDgcL3JifHx8ZnE2cvbw/z7MyeBc5eRxGABukFfgS+RTh8nHCnxtFvke+SD3xRrkkzaYGPP19fXmDd6eM403eDoCG0gqFPu5j07ltCOfReS6YbwRn+ANGsd/TeW/5sPBgMG4U+C7Ezh1ENFOGB9K+fLG6skbbiccCJgJ7tPH+K9D/f39KyLS/z7Eb84baD2pJpwFWGBksN5utzezetz/o2BevwdOASxKOn/5vUKxYKnA51/8tYLVejgBAA7HQUsIgZ+fXzB/43+LDgegWLZzwk0X+AEBAf/iX2wMtu8AePgaASeRvyy9zLKd147zMzoWgDLtGpzjv7Y1cuw/WvDWv4sOBcAl7tFogMfSfxsq8vlDB3IF240OBEAVfuDbhkGGCH7+oB35A19DpwGgKlf5S7WD7PP9DzDkB0DolCBG1mH/UHQQAJosEMZLdTS34GgkOgcA7fiMFtplCP7P0RkA6DISWK5nHQLK5Z+DjgBAVxGYrdecfwI6AAApGKv1an9vNDoAUo0EorXc58dWHwBycZeO1wvP8ONko7EBkDNZiL+gq4mK/38ivRcA6acCe4WcHeA//H/QwMAM+Po6WKNQH9arlZ0ldPZmKwZ4sfQ4T/afKZ7s4gwP9tsnf0K/p/+3f4Kn8ncm879L/4b+Lf0MiUVgstqLfu0L0hDhQMCQVK3kYL1be7Pl0V7sXJIH+32ee9DPSOE/K6qVt/KzJUwZflHNYh5n4UTAaPjxt/TLje3s8/5e7OocT7eDviToZ5MYdOKfJcvIgOoJ8ArEnmq8/afAmYCRKOfnYN2a2dmBOHFBXxI0lXi3qV15BgnaYqK78/4wzh9wKmAU6C18ZJKH5oFflCOTPNlLjex6t0ceLzYa4k713q1wKmAEQqr5sAW9vXQP/KKsHujF6gT56Nk237tUbdjxZ+luOBeQnjeft7NLH3tIF/yF/Jrswbo21W80wHMDIl15+6NuP5Caiv4+bGYPL2kDvygfd/fiz6xLWx0o0yiAL/z9Gw4GZN/W2/qhp2GCv5AdH3mxoMq6tNmLZRGAXXAyICu1A33YD+ONF/yF0O5EaDUfrbcF9zh9USecDMjK41V92PEE4wZ/IfQd6LtovBbQxJm3/3o4GpB12E9puUYP/kLS+ChG4yzCdaUGf/ny5Ss4cEU3kHTBz4hz/oexZZSnlguDdyjGS9v6GwhnAzIy6z1v0wV/ITO6eclROIT/hYNwNiAbb0fYTRv8hbyrXZ5AWknBHw5nA7IRzrPoKJHG7AJAiUwa7gzUQZFPYAjoHL7Zg78QOqqsUbvGFrf6vxcOB2SiY0O7ZYK/EDrMpME6wK6ib387Jx9OB2Q60ivDqT6tORzvqcVR4js838e7aMUfOB6QBjrPb7XgL6RLE7u2qcFcAKbB6YBMNfv0KOYhU4KQ6MpCPOYT7p8CpMPxgCxQGS+rBn8hkeKLify1HfgI/4/bcDwgC1TDz+oCsLSv8B2B28rFot7e3jXhdEAWAgMcLHu2p+UFgAqNij4nwA8HVafhf1s4HpAFKt1t9eAv5P2WwqcBrUkAYuB4QBYoGQbBr800QDkXQPeLw/GALKv/alzaYRYyEz1E7wYkkwBshPMBGWjMr9xC4D9IwxAfkSOADSQAe+B8QAbo3j0E/YO818IuUgB2kgAcgfMBGaCLOhH0DxL/prfINj9kw71/QBZWDsACYFG+GCB0IfA0CUA2nA84Q+XKldnzzz/POnbsyFq2bMlCQ0NV/flp47H/X5R94zxF9mkWCUAenBuUFvQjRoxg6enpLD8/nxW1ixcvstmzZ7MGDRq4/Vk/ToUAFOU/UzzFZgPCyUFJREVFsezsbOaM3b17ly1dupSFhIS4/HkXZiDgi/Lz/3oI7WMIAPj7Wfxy5di8efOYK5aTk6P8e1c+99ocBPzfU4IhAEDTZBxftmTJEuaOVahQAQIAAQBGZPDgwcxdCwoKwhQAUwDgDvwCBxYREcHeeOMN1rVrV2Xl3Z35tTPUrl2b3bp1y20BeOKJJ7AIaIxFQAiAdIUweaCvWbOG5ebmFhtcp06dYhMnTmQ1atRQ/bOnTZvG1LDGjRtjG9AY24AQABnw9/dnPXr0YIcOHXI6yG7cuMFiYmKUObtac//z58+rIgAtWrRAIpAxEoEgAHry2GOPsWHDhrHMzEyXgy0lJcXlRbf7oX18teydd95BKrAxUoEhAHpQsWJFNnbsWHb16lVVAo5EwN2RAAWtWjZu3DgcBjLAYSAIgA7Qot7p06eZ2jZo0CC3nmvAgAGqPcuyZctceoZGOA78N54J8YEAmIGGDRuyrVu3MlF28+ZNtxYG+/Tpo9qzpKWluVwQhIpgIPALCoIkiS8PDgEQXeQyMJDNnDmT/fHHH0y0xcfHu/ycnTp1Uu05fvvtN5QEU4El4isDQwBEQifmzp49y7SyjIwMl5+1Vq1a7N69e6o9i6uHg6JaYSFQw6KgEABRufRjxozR5K1f1MLCwlx+7r1796r2HAMHDkRZcDfLglNbQAAMBmXB7dmzh+llNJR35/SfWrZ69WpMA+S+GAQCoDZdunRR5r96Wvfu3d1KSDp+/Lgqz3HlyhXm5+fn2noErgZjLzWyQwCMxPDhw5Uz8Xpb586d3foedP7g9u3bqjwL/SxXdwPSLXw56A8aXA4KAVAxjXfhwoVMFmvatKnb34mSgtRYv0hKSnL5Gd618PXg70TYNfNfCIAbVKlShW3evFma4Kc3N2UZqvHdaC3B2WpAJdmlS5dcLg5Szs/Bjkyy3ijgULwn8/N1QABk5/HHH2cHDx5kMtm6detU/Y7BwcFs5cqVbm0PRkZGuvz5/37GjmvBIQDyER4erun+vrP20ksvCfm+bdq0YQcOHHDpmZYvX+7WZ3/R3zqjgJRoL819GQLgQtEMOpMvm23btk3o96YV/b59+7LLly+X6bmorgG1maufG1bdh/2SbP7gv/SxBwup5gMBkBnKtT927Jh0wU9zdVer8LiS2kyLe3l5eU4/X2Jioluf2fkF808F3nrBRxefhgA4SdWqVZXa+LIZFQZp1aqV5u1Rr149tmHDBqee8ffff2c1a9Z06/M+7m7e5KDErl66+TUEwAkqVarEUlNTpQt+yv1/7rnndG0bWnc4ceKE0INKSg0Ffwf7bpT51gM2j/BkFfwdEACZWbVqlVSBf/36dTZ58mRFmGTJhejfvz/Lysoq8ZmvXbvmdh3DqpXMVTeQEn60yPeHALjBqFGjpAl82lf/6KOPlOmIrGskc+fOZXfu3Cn2+Slhyu3t16o+7HiC8UXg2GQPFhzoo3ufQQBKoUOHDiU6s5ZGuw6UaqxWko9oqCow7UoUd30YHZF2eyeGBw5VyzVq8FOasx4r/hCAMu71l3XLS8Qb//3331et8q8M5c9oF4WmDG4vylYy5prA5pH6D/shAE4U7dRzxZ/y8GfNmqVsuZmlACqVLCu00aNHq/Oz+eLZjG7G2B249akHS3rXS9cFPwiAk8yYMUO34N+xYwd76qmnTJk6TXcO0jSABE7Nrcs3nrezixJfK/ZrsrYHfCAAbtCsWTOWn5+veeDTWgNtlbl6eMYo0GnFffv2KZeQqHm7ES0OLugt32hg9UAvFh7kI21/QADugy7YUKsgRlmMLgZp3bq15cqjL1iwQPX1jY4N7exwvKcUp/raN7BL3w8QgPugvXWtjY4T07Fiq96M1L59e/XPLfDjtF2b2nXJGaC9fRrua3mkFwKgAs8++6zmRTwXL16s3AKMugpiBJCq6tDx2mX9vIQWGqWfTTX8qIyXr6+x2h4CUHDSTctVfzpfHxsbC+HV8n6GgD+vHqNApQs33A36s4meSt3+nrx0d5UA47YLBIBDN/NqGfyUNot21w96S9OVWxS8k97yVm7gpcQiyjC8wHcTrs35E/o9/b+9/M/o79BFnXRXn+jruiAAGkJDcDpUo5WptQcOAARABWJiYjQL/gkTJsDpAARAFgICApR0Wy0sOTkZDgcgADJB13dpYd9//70q+e8AQABULPLhbtlrZ+zcuXNuV8MBAAKgMv369dOkTr8aF3UAAAFQGVfLXJfFRo4cCScDEADZoLx70ZaWlmb6gz0AAmBIVqxYIXzo36hRIzgYgAA4JLzYoyw17V2xuLg4OBeAAMgIFdUUaRcuXDBM7T4ALCcA+/fvFyoAtLsAxwIQAAkJCQlx66ZbZ6r3IuEHQAAkZdCgQULf/t26dYNTAQiArBRXq14t+/nnn7HtByAAslK9enWhFX/oXAEcSj5IlKkCMY3+qOTb1KlT2YgRI1jHjh2Vw2AQAIt80ffee0/ovj/y/eWiVq1abPr06aVe7nLr1i2lLNvTTz8NATA7dGedKFu6dCmCTjKxp8tInTXKCxk/frxSGg4CYFIOHjwoTABoOInAk4OEhASX+3Ht2rVKaXgIgAmP/oq65PPq1auo7Oswz03Oy5YtgwCYjXbt2mH4b3JeeOEF1RZ5o6KiIACo/OOcde7cGQEoAbt371atT2nhkEaNEACTQHM7Uff50e02CEB9admypep9O2DAAAiAWTh58qQQAaCFRQSg/sycOVP1vt2+fTsEwGGKSyB8WW5urhAB+OSTTxCAJq3ulJOTY4lzHaYXgODgYGHz/169eiEAJeD69etC+rdu3boQAKPTvHlzYQJQr149BKAEI7y7d+8K6d8WLVpAAIwOndATYfn5+Tj6Kwk3b94U0sdvvfUWBAAVgEo+/Yfgk4MzZ84I6WMrXOJqegGYM2eOEOegfWcEnxzs27dPSB9PnDgRAmB0lixZIsQ5UlJSEHyS8NVXXwnpYzpABgFwoAR4cZaUlITgk4R58+YJ6WNKIIMAGJx169YJcQ4qLoHgk4P4+HghffzNN99AAIwOdaIIGzduHIJPEmJjY4X08aZNmyAARoeu5sa9fxAAV2zjxo0QAKOTmpoqxDkGDx6M4JMEGo2JsK+//hoCAAHACEB2qJyXCNuwYQMEwOjQPE6EUekpBJ8c0H69CFu/fj0EwOgsX74cJwGR7OWS0Q4SBADOUax98cUXCD6TF3xZuHAhBMDo0H69CNuyZQuCTxL27t2LXA8IQPHQYp0Iy8zMRPBJwrlz54T0cUxMDATA6PTp00eIc9AZdNQD1B+q408Xe6DgKwSgWOjSDlFGpagRhPoSEREhrH+bNWsGATA6oaGhwhyErqBCEOpLv379hPVveHg4BAA140q25ORkBKHO0HasCKNLRqxwTZglBCAtLU2Ikxw5cgRBaNJiIEePHmUoC46iIKXavXv3lGuoEYj6UL16dWF3PtK14RAAB+oCPsy6du2KYNSJHj16COvXoUOHQgDMwmuvvSbMUebPn49gNFmaN1mbNm0gAGahWrVqShlvEZaVlYXrwXWgXLly7MqVK8JyPCpXrgwBMBPp6enC3havv/46gtJE+R0//fQTw/XgJiMxMVGYw3z55ZcISo2hNhdln332GQTAbERGRgpzmNu3byvTDASmNtDOi6j0X7I333wTAmA2KlWqpASqKBsyZAiCUyNGjRolVMytdMbDZiXH2bFjhzDHoRNpWAwUD93HmJGRIawfN2/ebKn2tJQAjB07lom0Dz74AEEqmN69ewvtQ6uN5CwlAHXq1BF2lTTZyZMnmZ+fHwJV4NbfqVOnhArAk08+CQHANMB16969O4JVEH379hXad4cPH7Zcm1pOAEQVCGH3XRuOQiFiFnFFVf5hFr7rwXICEBgYyHJycoQ60tSpUxG0BsrjIMvNzVUOF0EALMCqVauEOhPtUdevXx+BqxKNGzdWzueLtKVLl1qybS0pAK+++ioTbdu2bWO+vr4IYDehRVVRZ/7vt9atW0MArLSaTCv2om306NEIYjf58MMPhffTiRMnLNu+Nqt+cdGLgYVlpZo3b45AdhF6K4se+ls9i9OyAkBZe6JXlQt3BYKCghDQLuT7X7x4UXj//PLLLywgIAACYEVI+bUwumeeUlgR2M5P0bZu3apJ31j9DIelBaBixYrKG0ALs8I9c2pAC6cLFizQpE8uXbpk6be/5QVAi/MB9xtdY40gL51p06Zp1h9WuPoLAvAQqPTThQsXNHE4qiIcHR2NQC+B4cOHaxb8tP5jhbr/EAAnoMq+WhmJADk62v1BqAqvyINaRa1Xr15odwjA/0PnwLW06dOno90L5vzx8fGatv3OnTuRpAUBeJAGDRoILTNVnM2ePVtZ8bZycY9FixZp2uZU8adevXrweQjA36G3stZGKcNWvF2oZs2amo+6yOLi4uDrEIDioWO858+f19wp6TNbtGhhmXZu1aqVLu38448/YuEPAlA67du3F3aJyMNOEI4YMcLUFYVo3k25/Vqk97JiLvto27YtfBwC8HAmTZrE9LJDhw6xiIgI07UpzbtpuqOXTZkyBb4NAXA+FZVWivUyGg1MnjxZyVQ0QyUfWlvR461faFQGzsqLrRAAFwgLCxN291xZklWoDp4RzxFQwNFee2Zmpq5t+Ouvv7Lg4GD4NASg7LzyyitK4o7eRkHUv39/Q7zFaA2DEqu0qLfwMKO1HLpDEL4MAXAZGorLYqdPn1aKjNAWmmztREeeKZuPnlEWi42NhQ9DANxfuV68eDGTySiZ5fPPP1d2LPQcFdBnv/zyy8pFnSKvXXPFUlJSkO0HAVCveMi3337LZLTs7GzF2bt06cKqVKmiSQIP3X2wZMkSzY5Sl9U2bdqEa9ogAOqfGkxPT2cyG+0e7N+/n82dO1e5poyq6bozQqDEqKZNmyrl05KTk5Xvr+WBHVcsNTVV2XmAz0IAVKd27dpSzXGZk3UJqSwZBcbKlSuVQKZ1jTFjxjxAQkIC+/TTT9natWuVLVD6nrIHe1E7fvy4JWv7QwA0hO6OO3PmDIPJZWfPnmUhISHwUQiAeGhf+ejRo4g6SYxy/MPDw+GbEADtoKGmFhdWwEo3WvOQcVsUAmCR04NbtmxBFOpkdLaAFmfhixAAXSsL08IZTFtbtmwZSq1DAORJFqKVdD2OEVvNqI2pujKSfCAA0kHnzenwCUyMZWVlsU6dOsHXIADyEhoaquy5w9S1Xbt2YZsPAmCc1GFKuDFaIo2MRm1IxTxwnh8CYMjad3T1NMw1y8jIwHFeCIDxRwO0QCjbaTnZ05epipAZKiJBAMBfNfG2b9+O6GYPv7TjmWeegc9AAMwHVcuJiorCWQJW/E29PXv2hJ9AAKwxLSAhoAMsVrfLly8rUySrX9MNAbAgdEkF1fqTtbAGE3wZCl2SisCHAOBMAT9TMHDgQEucMKQ6A/RdscAHAQDF0KRJEzZ//nyWk5NjmqCnHZDVq1crW3pI4YUAACdr79E1WnRTkFGNjktHR0ezwMBA9CkEALhKnTp12ODBg5Wjx1pfYV4Wy83NZd999x0bOXIkq1+/PvoOAgDUht6mdPHGokWL2LFjx3Q/gUh1+GbMmMEiIyOxoAcBAHosILZp00a5WXjFihXs1KlTQu7hu3HjhjKkp/WJIUOGsA4dOrAaNWqgDyAAQMaEIzo517x5c/b222+zYcOGsaSkJOUyEVqMI9asWaNU1CmEhu7057NmzWJxcXFs0KBBykiDLh+pW7cu2tXEApCHhgDAktwmAchGQwBgSbJIAM6iIQCwJKdtPj4+R9AQAFiSQyQAu9EQAFgPHvs7SQA2ojEAsKQAbCABmI3GAMCSJNMiYAwaAgBLjgCiSQDaojEAsCStbd7e3jXQEABYD7vdXs3G7RHKCEKDAGCp4X8uxT4JAE0D0tEoAFiKNFuhcTWYigYBwFIjgMn3C0A7NAoAlqLNXwLAj4968f9xB40CgCW4QzFvu9/4KCAVDQOARVKAixr/g/FoHAAsQWxxAhCGhgHAEoTbijP+BwfQOACYmh9sJRnOBQBg+vl/vxIFwMPDozx2AwAw7+o/v5i2gq004wqxHg0FgClZa3uY8QMCzdBQAJjy8E+EzRnjo4BdaDAATDX332Nz1vhfbo9GA8Ckqb9O2D/4P9iPRgPAFBygmC6LANj4Pe6voOEAMMXcv6PNBaNRwBY0IACGZluZ3/73jQJC+Q/4A40IgCHJ4zEcYnPHqHAAGhIAQzLB5q4FBAT8i/+gM2hMAAxFZoUKFTxsapjjz9Lh99CoABiCe0rJbzWNTwWmoGEBMETST7xNgD2KDEEApA/+VB6r/xQhADQVqMK5goYGQEqucgGoahNp/AM68A+6i8YGQCryOS/atDD+Qb3Q4ABINfTva9PS+IeORcMDIEXwj7bpYfzDk9ABAOga/LNsOtoj/AGWoyMA0CX4U/664FNnEZiJDgFAU+bR1rxNFuMPNBSdAoBxE33U2CLsjS1CAIRu9fWyyWwF5cSy0VkAqMoVzfb51cgYpAsI0WkAqDLk38er+lS3Gcwe5Q8/BlMCANw61ZcoLLdfo9HAi3Q2GZ0JQJk4q/qRXr2soKgIjQZuo2MBKBUqwZfo7+/vaTObeXl51eLzmU3oZACKZRsnzGZ24wsakfyLpqPDAVDY72rpbkMb/+LPcr6DAwCLru7vom1zl8t2m2hE0IQ3yDoHriYH5od8fB35vA32oHl7e/vyxumJHAJgwrf9MUqXL1++fAVEunPTgzBOLG+43RgZACO+6QtqaI6lC3YQ0W6Yn5+fF+UTFFQmTsN2IpAQ8skfuI8mkK+achtPInuEz6GCKFGC/9qfjiNzvi5Q3IOcjILzCHlwTOAmeQW+RD51kKan5Gv898n81+gCH6Q03f8yYiD9H4Lpi7OZQSaFAAAAAElFTkSuQmCC";
 function ensureNotifierIcon(dataDir) {
   try {
-    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
-    const path = join3(dir, "notifier-icon.png");
+    const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
+    const path = join4(dir, "notifier-icon.png");
     if (!existsSync4(path)) {
       mkdirSync2(dirname2(path), { recursive: true });
       writeFileSync2(path, Buffer.from(ICON_BASE64, "base64"));
@@ -1861,6 +1959,14 @@ function lockedNotification(port2) {
     url
   };
 }
+function sessionExpiredNotification(port2) {
+  const url = `http://localhost:${port2}`;
+  return {
+    title: "Suveren Gateway locked",
+    message: "Your sign-in has ended. Sign in again so your agents can act.",
+    url
+  };
+}
 var terminalNotifierCache = null;
 function hasTerminalNotifier() {
   if (terminalNotifierCache !== null) return terminalNotifierCache;
@@ -1975,17 +2081,17 @@ import { Router as Router9 } from "express";
 
 // src/routes/approved-intents.ts
 import { Router as Router8 } from "express";
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
-var FILE_PATH = join4(SUVEREN_DATA_DIR, "approved-intents.enc.json");
+import { join as join5 } from "path";
+var SUVEREN_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
+var FILE_PATH = join5(SUVEREN_DATA_DIR, "approved-intents.enc.json");
 function readFile() {
   if (!existsSync5(FILE_PATH)) {
     return { version: 1, entries: {} };
   }
   try {
-    return JSON.parse(readFileSync3(FILE_PATH, "utf-8"));
+    return JSON.parse(readFileSync4(FILE_PATH, "utf-8"));
   } catch {
     return { version: 1, entries: {} };
   }
@@ -2367,6 +2473,7 @@ function startUpdateChecker(method, version) {
 
 // src/routes/events.ts
 var KEEPALIVE_INTERVAL_MS = 25e3;
+var PAYLOAD_ALLOWED = /* @__PURE__ */ new Set(["session-locked"]);
 function createEventsHandler() {
   return function eventsHandler(_req, res) {
     res.setHeader("Content-Type", "text/event-stream");
@@ -2375,8 +2482,9 @@ function createEventsHandler() {
     res.setHeader("X-Accel-Buffering", "no");
     res.flushHeaders();
     const unsubscribe = eventBus.subscribe((event) => {
+      const data = PAYLOAD_ALLOWED.has(event.type) ? JSON.stringify(event.payload ?? null) : "null";
       res.write(`event: ${event.type}
-data: null
+data: ${data}
 
 `);
     });
@@ -2394,19 +2502,19 @@ data: null
 import { Router as Router12 } from "express";
 
 // src/lib/gateway-settings.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join5, dirname as dirname4 } from "path";
+import { join as join6, dirname as dirname4 } from "path";
 var DEFAULT_SETTINGS = {
   desktopNotifications: true
 };
 function settingsPath(dataDir) {
-  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
-  return join5(dir, "settings.json");
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
+  return join6(dir, "settings.json");
 }
 function readSettings(dataDir) {
   try {
-    const raw = JSON.parse(readFileSync4(settingsPath(dataDir), "utf8"));
+    const raw = JSON.parse(readFileSync5(settingsPath(dataDir), "utf8"));
     return {
       desktopNotifications: typeof raw.desktopNotifications === "boolean" ? raw.desktopNotifications : DEFAULT_SETTINGS.desktopNotifications
     };
@@ -2449,10 +2557,76 @@ function createGatewaySettingsRouter() {
   return router;
 }
 
-// src/routes/internal-events.ts
+// src/routes/archived-mandates.ts
 import { Router as Router13 } from "express";
+
+// src/lib/archived-mandates-store.ts
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7, dirname as dirname5 } from "path";
+var ID_PATTERN = /^[A-Za-z0-9_.:-]{1,200}$/;
+function isValidMandateId(id) {
+  return typeof id === "string" && ID_PATTERN.test(id);
+}
+function storePath(dataDir) {
+  const dir = dataDir ?? process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
+  return join7(dir, "archived-mandates.json");
+}
+function readArchived(dataDir) {
+  try {
+    const raw = JSON.parse(readFileSync6(storePath(dataDir), "utf8"));
+    if (!Array.isArray(raw.archived)) return [];
+    return [...new Set(raw.archived.filter(isValidMandateId))];
+  } catch {
+    return [];
+  }
+}
+function writeArchived(ids, dataDir) {
+  const next = [...new Set(ids.filter(isValidMandateId))].sort();
+  const path = storePath(dataDir);
+  mkdirSync5(dirname5(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync5(tmp, JSON.stringify({ archived: next }, null, 2) + "\n", "utf8");
+  renameSync(tmp, path);
+  return next;
+}
+function archiveMandate(id, dataDir) {
+  if (!isValidMandateId(id)) throw new Error("invalid mandate id");
+  return writeArchived([...readArchived(dataDir), id], dataDir);
+}
+function unarchiveMandate(id, dataDir) {
+  if (!isValidMandateId(id)) throw new Error("invalid mandate id");
+  return writeArchived(readArchived(dataDir).filter((x) => x !== id), dataDir);
+}
+
+// src/routes/archived-mandates.ts
+function createArchivedMandatesRouter(dataDir) {
+  const router = Router13();
+  router.get("/", (_req, res) => {
+    res.json({ archived: readArchived(dataDir) });
+  });
+  const change = (fn) => (req, res) => {
+    const id = req.params.id;
+    if (!isValidMandateId(id)) {
+      res.status(400).json({ error: "invalid mandate id" });
+      return;
+    }
+    try {
+      res.json({ archived: fn(id, dataDir) });
+    } catch (err) {
+      res.status(500).json({ error: `Could not save: ${err.message}` });
+    }
+  };
+  router.put("/:id", change(archiveMandate));
+  router.delete("/:id", change(unarchiveMandate));
+  return router;
+}
+
+// src/routes/internal-events.ts
+import { Router as Router14 } from "express";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var ALLOWED = ["proposal-added", "action-approval-needed"];
+var SESSION_EXPIRED = "session-expired";
 function secretMatches(provided, expected) {
   if (!expected) return false;
   if (!provided) return false;
@@ -2461,14 +2635,19 @@ function secretMatches(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual2(a, b);
 }
-function createInternalEventsRouter(getSecret) {
-  const router = Router13();
+function createInternalEventsRouter(getSecret, onSessionExpired) {
+  const router = Router14();
   router.post("/event", (req, res) => {
     if (!secretMatches(req.headers["x-internal-secret"], getSecret())) {
       res.status(401).json({ error: "Unauthorized" });
       return;
     }
     const type = (req.body ?? {}).type;
+    if (type === SESSION_EXPIRED) {
+      onSessionExpired?.();
+      res.json({ ok: true });
+      return;
+    }
     if (typeof type !== "string" || !ALLOWED.includes(type)) {
       res.status(400).json({ error: "Unsupported event type" });
       return;
@@ -2565,23 +2744,112 @@ function startNotificationDispatcher(opts = {}) {
   return new NotificationDispatcher(opts).start();
 }
 
+// src/lib/session-lock.ts
+var SESSION_LOCKED_MESSAGE = "Your sign-in ended after 30 days or was revoked. Sign in again.";
+function createSessionLock(deps) {
+  const { vault: vault2, port: port2 } = deps;
+  const notifyFn = deps.notifyFn ?? notify;
+  const unconfigureSessionFn = deps.unconfigureSessionFn ?? unconfigureSession;
+  const emit = deps.emit ?? eventBus.emit.bind(eventBus);
+  return function lockExpiredSession2() {
+    if (!vault2.isUnlocked()) return;
+    vault2.lockExpired();
+    console.error("[Control Plane] Authority Server session ended \u2014 gateway LOCKED");
+    void unconfigureSessionFn().catch((err) => {
+      console.error("[Control Plane] Failed to push cleared session to MCP:", err);
+    });
+    emit("session-locked", { reason: "expired", message: SESSION_LOCKED_MESSAGE });
+    const { title, message, url } = sessionExpiredNotification(port2);
+    notifyFn(title, message, process.platform, url);
+  };
+}
+
+// src/lib/session-expiry-scheduler.ts
+var MAX_TIMEOUT_MS = 2147483647;
+var SessionExpiryScheduler = class {
+  constructor(getExpiresAt, onExpired, opts = {}) {
+    this.getExpiresAt = getExpiresAt;
+    this.onExpired = onExpired;
+    this.now = opts.now ?? Date.now;
+    this.setTimeoutFn = opts.setTimeoutFn ?? setTimeout;
+    this.clearTimeoutFn = opts.clearTimeoutFn ?? clearTimeout;
+    this.setIntervalFn = opts.setIntervalFn ?? setInterval;
+    this.clearIntervalFn = opts.clearIntervalFn ?? clearInterval;
+    this.coarseIntervalMs = opts.coarseIntervalMs ?? 5 * 6e4;
+  }
+  preciseTimer = null;
+  coarseTimer = null;
+  now;
+  setTimeoutFn;
+  clearTimeoutFn;
+  setIntervalFn;
+  clearIntervalFn;
+  coarseIntervalMs;
+  /** Start the coarse safety-net interval and arm the precise timer. */
+  start() {
+    if (this.coarseTimer) return;
+    this.coarseTimer = this.setIntervalFn(() => this.check(), this.coarseIntervalMs);
+    this.reschedule();
+  }
+  stop() {
+    if (this.preciseTimer) this.clearTimeoutFn(this.preciseTimer);
+    if (this.coarseTimer) this.clearIntervalFn(this.coarseTimer);
+    this.preciseTimer = null;
+    this.coarseTimer = null;
+  }
+  /** Call whenever `sessionExpiresAt` changes — a login (new value) or a
+   *  lock (now null, via getExpiresAt) — to re-arm the precise timer. */
+  reschedule() {
+    if (this.preciseTimer) {
+      this.clearTimeoutFn(this.preciseTimer);
+      this.preciseTimer = null;
+    }
+    const exp = this.getExpiresAt();
+    if (exp === null) return;
+    const delayMs = Math.max(0, exp * 1e3 - this.now());
+    if (delayMs > MAX_TIMEOUT_MS) {
+      this.preciseTimer = this.setTimeoutFn(() => this.reschedule(), MAX_TIMEOUT_MS);
+      return;
+    }
+    this.preciseTimer = this.setTimeoutFn(() => this.check(), delayMs);
+  }
+  /** Idempotent: only fires onExpired when the expiry has actually arrived. */
+  check() {
+    const exp = this.getExpiresAt();
+    if (exp !== null && this.now() >= exp * 1e3) this.onExpired();
+  }
+};
+
+// src/lib/session-health.ts
+function buildSessionHealth(vault2) {
+  const unlocked = vault2.isUnlocked();
+  const lockedReason = vault2.getLockedReason();
+  return {
+    state: unlocked ? "active" : "locked",
+    expiresAt: unlocked ? vault2.getSessionExpiresAt() : null,
+    ...lockedReason ? { lockedReason } : {}
+  };
+}
+
 // src/lib/denials-reader.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 function loadDenials(dataDir, decrypt) {
-  const encPath = join6(dataDir, "denials.enc.json");
-  const plainPath = join6(dataDir, "denials.json");
+  const encPath = join8(dataDir, "denials.enc.json");
+  const plainPath = join8(dataDir, "denials.json");
   if (existsSync6(encPath)) {
-    const { blob } = JSON.parse(readFileSync5(encPath, "utf-8"));
+    const { blob } = JSON.parse(readFileSync7(encPath, "utf-8"));
     return JSON.parse(decrypt(blob)).records ?? [];
   }
   if (existsSync6(plainPath)) {
-    return JSON.parse(readFileSync5(plainPath, "utf-8")).records ?? [];
+    return JSON.parse(readFileSync7(plainPath, "utf-8")).records ?? [];
   }
   return [];
 }
+var DENIAL_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 function selectDenials(records, opts = {}) {
-  let out = [...records].sort((a, b) => b.ts - a.ts);
+  const cutoff = (opts.now ?? Date.now()) - DENIAL_MAX_AGE_MS;
+  let out = records.filter((r) => r.ts >= cutoff).sort((a, b) => b.ts - a.ts);
   if (opts.since !== void 0 && Number.isFinite(opts.since)) out = out.filter((r) => r.ts >= opts.since);
   const count = out.length;
   if (opts.limit !== void 0 && Number.isFinite(opts.limit) && opts.limit > 0) out = out.slice(0, opts.limit);
@@ -2591,11 +2859,11 @@ function selectDenials(records, opts = {}) {
 // src/index.ts
 (function migrateDataDir() {
   if (process.env.SUVEREN_DATA_DIR) return;
-  const oldDir = join7(homedir6(), ".hap");
-  const newDir = join7(homedir6(), ".suveren");
+  const oldDir = join9(homedir7(), ".hap");
+  const newDir = join9(homedir7(), ".suveren");
   if (!existsSync7(newDir) && existsSync7(oldDir)) {
     try {
-      renameSync(oldDir, newDir);
+      renameSync2(oldDir, newDir);
       console.error(`[Control Plane] Migrated data directory: ${oldDir} \u2192 ${newDir}`);
     } catch (err) {
       console.error(`[Control Plane] FATAL: could not migrate data directory ${oldDir} \u2192 ${newDir}:`, err);
@@ -2606,7 +2874,7 @@ function selectDenials(records, opts = {}) {
 var SP_URL2 = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 var port = parseInt(process.env.SUVEREN_CP_PORT ?? "3402", 10);
 var HAP_MODE = process.env.HAP_MODE ?? "personal";
-var UI_DIST = process.env.HAP_UI_DIST ?? join7(import.meta.dirname ?? __dirname, "../../ui/dist");
+var UI_DIST = process.env.HAP_UI_DIST ?? join9(import.meta.dirname ?? __dirname, "../../ui/dist");
 var vault = new Vault();
 var internalSecret2 = process.env.SUVEREN_INTERNAL_SECRET ?? randomBytes2(32).toString("hex");
 setInternalSecret(internalSecret2);
@@ -2630,7 +2898,17 @@ function loginRateLimit(req, res, next) {
   }
   next();
 }
-app.use("/auth", jsonParser, createAuthRouter(vault, requireAuth(vault), loginRateLimit));
+var lockExpiredSession = createSessionLock({ vault, port });
+var sessionExpiryScheduler = new SessionExpiryScheduler(
+  () => vault.getSessionExpiresAt(),
+  lockExpiredSession
+);
+app.use("/auth", jsonParser, createAuthRouter(
+  vault,
+  requireAuth(vault),
+  loginRateLimit,
+  () => sessionExpiryScheduler.reschedule()
+));
 function resolveOrigin(req) {
   const fwdHost = req.get("x-forwarded-host");
   if (fwdHost) return `${req.protocol}://${fwdHost}`;
@@ -2836,13 +3114,14 @@ app.get("/auth/oauth/:integrationId/health", authGuard, async (req, res) => {
   }
 });
 app.get("/events", requireAllowedHost, requireAuthQueryOrHeader(vault), createEventsHandler());
-app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2));
+app.use("/internal", jsonParser, createInternalEventsRouter(() => internalSecret2, lockExpiredSession));
 app.use("/vault", jsonParser, authGuard, createVaultRouter(vault));
 app.use("/ai", jsonParser, authGuard, createAIRouter(vault));
 app.use("/ai-prompts", jsonParser, authGuard, createAIPromptsRouter());
 app.use("/mcp", jsonParser, authGuard, createMCPRouter());
 app.use("/autostart", jsonParser, authGuard, createAutostartRouter());
 app.use("/api/gateway-settings", jsonParser, authGuard, createGatewaySettingsRouter());
+app.use("/api/archived-mandates", jsonParser, authGuard, createArchivedMandatesRouter());
 app.use("/api/encrypt-intent", jsonParser, authGuard, createEncryptIntentRouter());
 app.use("/api/evidence-export", authGuard, createEvidenceExportRouter(SP_URL2, vault));
 app.use("/api/evidence", authGuard, createEvidenceRouter());
@@ -2976,7 +3255,7 @@ app.get("/active-authorizations", authGuard, async (_req, res) => {
 });
 app.get("/denials", authGuard, (req, res) => {
   try {
-    const dataDir = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
+    const dataDir = process.env.SUVEREN_DATA_DIR ?? join9(homedir7(), ".suveren");
     const all = loadDenials(dataDir, (blob) => vault.decrypt(blob));
     const since = Number(req.query.since);
     const limit = Number(req.query.limit);
@@ -3027,12 +3306,12 @@ app.put("/agent-brief/context", jsonParser, authGuard, async (req, res) => {
       res.status(413).json({ error: `Context exceeds ${AGENT_CONTEXT_MAX_BYTES}-byte cap` });
       return;
     }
-    const { mkdirSync: mkdirSync5, writeFileSync: writeFileSync5, renameSync: renameSync2 } = await import("fs");
+    const { mkdirSync: mkdirSync6, writeFileSync: writeFileSync6, renameSync: renameSync3 } = await import("fs");
     const filePath = agentBriefPath();
-    mkdirSync5(dirname5(filePath), { recursive: true });
+    mkdirSync6(dirname6(filePath), { recursive: true });
     const tmpPath = `${filePath}.tmp`;
-    writeFileSync5(tmpPath, content, "utf-8");
-    renameSync2(tmpPath, filePath);
+    writeFileSync6(tmpPath, content, "utf-8");
+    renameSync3(tmpPath, filePath);
     res.json({ ok: true });
   } catch (err) {
     console.error("[Control Plane] agent-brief/context PUT failed:", err);
@@ -3054,6 +3333,9 @@ app.use(
       },
       proxyRes: (proxyRes, req) => {
         const status = proxyRes.statusCode ?? 0;
+        if (status === 401 && vault.isUnlocked()) {
+          lockExpiredSession();
+        }
         if (status < 200 || status >= 300) return;
         const method = req.method?.toUpperCase();
         const url = req.url ?? "";
@@ -3086,8 +3368,8 @@ function detectInstallMethod() {
   if (dir.includes("/node_modules/@suveren/gateway/")) return "npm";
   let cursor = dir;
   for (let i = 0; i < 8; i++) {
-    if (existsSync7(join7(cursor, ".git"))) return "dev";
-    const parent = dirname5(cursor);
+    if (existsSync7(join9(cursor, ".git"))) return "dev";
+    const parent = dirname6(cursor);
     if (parent === cursor) break;
     cursor = parent;
   }
@@ -3099,10 +3381,10 @@ function detectRunningVersion() {
     return process.env.HAP_BUILD_SHA ?? "dev";
   }
   const dir = import.meta.dirname ?? __dirname;
-  const bundlePkg = join7(dir, "..", "..", "package.json");
+  const bundlePkg = join9(dir, "..", "..", "package.json");
   if (existsSync7(bundlePkg)) {
     try {
-      const pkg = JSON.parse(readFileSync6(bundlePkg, "utf8"));
+      const pkg = JSON.parse(readFileSync8(bundlePkg, "utf8"));
       if (pkg.name === "@suveren/gateway" && typeof pkg.version === "string") {
         return pkg.version;
       }
@@ -3125,6 +3407,7 @@ app.get("/health", async (req, res) => {
     updateAvailable: update.updateAvailable,
     installMethod: INSTALL_METHOD,
     spUrl: SP_URL2,
+    session: buildSessionHealth(vault),
     security: {
       note: "Gateway secures tool execution. Agent host isolation is the user's responsibility."
     }
@@ -3140,7 +3423,7 @@ if (existsSync7(UI_DIST)) {
   }));
   app.get("*", (_req, res) => {
     res.setHeader("Cache-Control", "no-store, must-revalidate");
-    res.sendFile(join7(UI_DIST, "index.html"));
+    res.sendFile(join9(UI_DIST, "index.html"));
   });
 } else {
   app.get("/", (_req, res) => {
@@ -3157,6 +3440,7 @@ app.listen(port, "0.0.0.0", () => {
     notify(title, message, process.platform, url);
   }
   startNotificationDispatcher({ url: `http://localhost:${port}` });
+  sessionExpiryScheduler.start();
   console.error(`[Control Plane]   SP proxy: ${SP_URL2}`);
   console.error(`[Control Plane]   UI dist:  ${UI_DIST}`);
   console.error(`[Control Plane]   Internal secret: configured`);