@tyvm/knowhow 0.0.153 → 0.0.155

package/src/clients/http.ts

@@ -247,9 +247,9 @@ export class HttpClient implements GenericClient {
         max_tokens: options.max_tokens || 4000,
         ...this.extra_body,
 
-        ...(options.tools && {
+        ...(options.tools?.length && {
           tools: options.tools,
-          tool_choice: "auto",
+          tool_choice: options.tool_choice ?? "auto",
         }),
       };
 
@@ -297,9 +297,9 @@ export class HttpClient implements GenericClient {
       ...this.extra_body,
       stream: true,
       stream_options: { include_usage: true },
-      ...(options.tools && {
+      ...(options.tools?.length && {
         tools: options.tools,
-        tool_choice: "auto",
+        tool_choice: options.tool_choice ?? "auto",
       }),
     };
 
@@ -442,7 +442,10 @@ export class HttpClient implements GenericClient {
         input,
         ...(instructions && { instructions }),
         ...(options.max_tokens && { max_output_tokens: options.max_tokens }),
-        ...(tools?.length && { tools, tool_choice: "auto" }),
+        ...(tools?.length && {
+          tools,
+          tool_choice: options.tool_choice ?? "auto",
+        }),
         // Reasoning persistence: store server-side when requested, otherwise
         // ask the provider to return encrypted reasoning content so we can
         // thread the reasoning items back into the next request ourselves.

package/src/clients/index.ts

@@ -28,8 +28,9 @@ import { GenericXAIClient } from "./xai";
 import { KnowhowGenericClient } from "./knowhow";
 import { HttpClient } from "./http";
 import { ModelProvider } from "../types";
-import { getConfig } from "../config";
+import { getConfig, getConfigSync } from "../config";
 import { loadKnowhowJwt, KNOWHOW_API_URL } from "../services/KnowhowClient";
+import { keyPairExists } from "../auth/keyManager";
 import { ContextLimits } from "./contextLimits";
 import { OpenAiTextPricing } from "./pricing/openai";
 import { AnthropicTextPricing } from "./pricing/anthropic";
@@ -108,9 +109,11 @@ const BUILT_IN_PROVIDER_REGISTRY: Record<string, ProviderRegistryEntry> = {
   qwen: { clientClass: GenericQwenClient },
   knowhow: {
     createClient: (entry: ModelProvider) => {
-      const jwt = loadKnowhowJwt();
-      if (!jwt) return null;
-      return new KnowhowGenericClient(KNOWHOW_API_URL, jwt);
+      if (!loadKnowhowJwt()) {
+        const config = getConfigSync();
+        if (!config.orgId || (!keyPairExists(config.cliIdentityPath) && !keyPairExists())) return null;
+      }
+      return new KnowhowGenericClient(KNOWHOW_API_URL);
     },
   },
 };

package/src/clients/knowhowMcp.ts

@@ -62,9 +62,9 @@ export class KnowhowMcpClient implements GenericClient {
           ...options,
           max_tokens: options.max_tokens || 3000,
 
-          ...(options.tools && {
+          ...(options.tools?.length && {
             tools: options.tools,
-            tool_choice: "auto",
+            tool_choice: options.tool_choice ?? "auto",
           }),
         },
       }

package/src/clients/openai.ts

@@ -235,9 +235,9 @@ export class GenericOpenAiClient implements GenericClient {
         max_completion_tokens: Math.max(options.max_tokens ?? 0, 16_000),
         reasoning_effort: this.resolveReasoningEffort(options),
       }),
-      ...(options.tools && {
+      ...(options.tools?.length && {
         tools: options.tools,
-        tool_choice: "auto",
+        tool_choice: options.tool_choice ?? "auto",
       }),
     }, { signal: options.signal });
 
@@ -296,7 +296,10 @@ export class GenericOpenAiClient implements GenericClient {
       max_tokens: options.max_tokens,
       stream: true,
       stream_options: { include_usage: true },
-      ...(options.tools && { tools: options.tools, tool_choice: "auto" }),
+      ...(options.tools?.length && {
+        tools: options.tools,
+        tool_choice: options.tool_choice ?? "auto",
+      }),
     }, { signal: options.signal });
 
     let usage: CompletionResponse['usage'] | undefined;
@@ -492,16 +495,22 @@ export class GenericOpenAiClient implements GenericClient {
         include: ["reasoning.encrypted_content"],
       }),
       // Don't limit max_output_tokens for Responses API - codex truncates tool call arguments when limited
-      ...(OpenAiReasoningModels.includes(options.model) && !this.isReasoningDisabled(options) && {
-        max_output_tokens: Math.max(options.max_tokens || 0, 16000),
+      ...(OpenAiReasoningModels.includes(options.model) && {
         reasoning: {
-          effort: this.resolveReasoningEffortForModel(options),
-          ...(options.reasoning_summary && { summary: "auto" }),
+          ...(this.isReasoningDisabled(options)
+            ? { effort: "none" }
+            : {
+                effort: this.resolveReasoningEffortForModel(options),
+                ...(options.reasoning_summary && { summary: "auto" }),
+              }),
         },
       }),
+      ...(wantsReasoning && {
+        max_output_tokens: Math.max(options.max_tokens || 0, 16000),
+      }),
       ...(tools?.length && {
         tools,
-        tool_choice: "auto",
+        tool_choice: options.tool_choice ?? "auto",
       }),
     } as any);
 
@@ -579,6 +588,33 @@ export class GenericOpenAiClient implements GenericClient {
       }
     }
 
+    // Tool-only responses are valid agent turns. Warn only when the response
+    // contains neither visible text nor any callable output, and include enough
+    // provider metadata to diagnose incomplete or reasoning-only responses.
+    if (!textContent?.trim() && toolCalls.length === 0) {
+      const outputShape = response.output.map((item: any) => ({
+        type: item.type,
+        contentTypes: Array.isArray(item.content)
+          ? item.content.map((part: any) => part?.type ?? typeof part)
+          : [],
+      }));
+      const reasoningSummaryCount = response.output
+        .filter((item: any) => item.type === "reasoning")
+        .reduce(
+          (count: number, item: any) =>
+            count + (Array.isArray(item.summary) ? item.summary.length : 0),
+          0
+        );
+      console.warn("[Responses API] Response contained no text or tool calls", {
+        responseId: (response as any).id,
+        status: (response as any).status,
+        incompleteDetails: (response as any).incomplete_details,
+        outputShape,
+        reasoningSummaryCount,
+        usage: response.usage,
+      });
+    }
+
     return {
       choices: [
         {

package/src/clients/pricing/google.ts

@@ -7,7 +7,8 @@ import { completions, embeddings, images, videos, audios, liveApi, ModelCatalogE
 // ─── Model IDs ────────────────────────────────────────────────────────────────
 
 export const GoogleModels = {
-  // Gemini 3.6 / 3.5
+  // Gemini 3.7 / 3.6 / 3.5
+  Gemini_37_Flash: "gemini-3.7-flash",
   Gemini_36_Flash: "gemini-3.6-flash",
   Gemini_35_Flash: "gemini-3.5-flash",
   Gemini_35_Flash_Lite: "gemini-3.5-flash-lite",
@@ -86,6 +87,7 @@ export const GoogleEmbeddingModels: Record<string, string> = {
 // ─── Modality arrays ──────────────────────────────────────────────────────────
 
 export const GoogleTextModels: string[] = [
+  GoogleModels.Gemini_37_Flash,
   GoogleModels.Gemini_36_Flash,
   GoogleModels.Gemini_35_Flash,
   GoogleModels.Gemini_35_Flash_Lite,
@@ -101,6 +103,7 @@ export const GoogleTextModels: string[] = [
 
 // Models that support thinkingLevel (Gemini 3.x series)
 export const GoogleThinkingLevelModels: string[] = [
+  GoogleModels.Gemini_37_Flash,
   GoogleModels.Gemini_36_Flash,
   GoogleModels.Gemini_35_Flash,
   GoogleModels.Gemini_35_Flash_Lite,
@@ -214,7 +217,13 @@ export interface GeminiModelPricing extends ModelPricing {
 }
 
 export const GeminiPricing: Record<string, GeminiModelPricing> = {
-  // ── Gemini 3.6 / 3.5 ──────────────────────────────────────────────────────
+  // ── Gemini 3.7 / 3.6 / 3.5 ────────────────────────────────────────────────
+  // Introductory pricing through December 31, 2026. Standard pricing beginning
+  // January 1, 2027 is $1.50 input, $7.50 output, and $0.15 cached input.
+  [GoogleModels.Gemini_37_Flash]: {
+    input: 0.75, output: 3.75,
+    context_caching: 0.075, context_caching_storage: 0.5,
+  },
   [GoogleModels.Gemini_36_Flash]: {
     input: 1.5, output: 7.5,
     context_caching: 0.15, context_caching_storage: 1.0,

package/src/clients/pricing/xai.ts

@@ -7,6 +7,7 @@ import { completions, images, videos, ModelCatalogEntry, ModelPricing } from "./
 // ─── Model IDs ────────────────────────────────────────────────────────────────
 
 export const XaiModels = {
+  Grok4_6: "grok-4.6",
   Grok_4_20_Reasoning: "grok-4.20-0309-reasoning",
   Grok_4_20_NonReasoning: "grok-4.20-0309-non-reasoning",
   Grok_4_20_MultiAgent: "grok-4.20-multi-agent-0309",
@@ -42,6 +43,7 @@ export const XaiModels = {
 // ─── Modality arrays ──────────────────────────────────────────────────────────
 
 export const XaiTextModels: string[] = [
+  XaiModels.Grok4_6,
   XaiModels.Grok_4_20_Reasoning, XaiModels.Grok_4_20_NonReasoning,
   XaiModels.Grok_4_20_MultiAgent,
   XaiModels.Grok4_1_Fast_Reasoning, XaiModels.Grok4_1_Fast_NonReasoning,
@@ -61,8 +63,9 @@ export const XaiResponsesOnlyModels: string[] = [
 ];
 
 // Models that support the reasoning_effort parameter
-// grok-3-mini variants support reasoning_effort; grok-3-beta, grok-4 etc. do NOT
+// Grok 4.6, Grok 4.20 multi-agent, and grok-3-mini variants support reasoning_effort
 export const XaiReasoningModels: string[] = [
+  XaiModels.Grok4_6,
   XaiModels.Grok_4_20_MultiAgent,
   XaiModels.Grok3MiniBeta,
   XaiModels.Grok3MiniFastBeta,
@@ -84,6 +87,7 @@ export const XaiVideoModels: string[] = [XaiModels.GrokImagineVideo];
 // ─── Pricing (USD per 1M tokens / per-image / per-second) ────────────────────
 
 export const XaiTextPricing: Record<string, ModelPricing> = {
+  [XaiModels.Grok4_6]:                    { input: 2.0, input_gt_200k: 4.0, cache_hit: 0.50, output: 6.0, output_gt_200k: 12.0, reasoningLevels: ["low", "medium", "high", "xhigh"] },
   [XaiModels.Grok_4_20_Reasoning]:       { input: 2.0, cache_hit: 0.20, output: 6.0, useResponsesApi: true },
   [XaiModels.Grok_4_20_NonReasoning]:    { input: 2.0, cache_hit: 0.20, output: 6.0, useResponsesApi: true },
   [XaiModels.Grok_4_20_MultiAgent]:      { input: 2.0, cache_hit: 0.20, output: 6.0, reasoningLevels: ["low", "medium", "high", "xhigh"], useResponsesApi: true },

package/src/clients/xai.ts

@@ -90,9 +90,9 @@ export class GenericXAIClient implements GenericClient {
         // grok-3-mini models support reasoning_effort: "low" | "medium" | "high"
         reasoning_effort: reasoningEffort,
       }),
-      ...(options.tools && {
+      ...(options.tools?.length && {
         tools: options.tools,
-        tool_choice: "auto",
+        tool_choice: options.tool_choice ?? "auto",
       }),
     });
 
@@ -238,7 +238,10 @@ export class GenericXAIClient implements GenericClient {
       ...(instructions && { instructions }),
       ...(options.max_tokens && { max_output_tokens: Math.max(options.max_tokens, 16_000) }),
       ...(reasoningEffort && { reasoning: { effort: reasoningEffort } }),
-      ...(tools?.length && { tools, tool_choice: "auto" }),
+      ...(tools?.length && {
+        tools,
+        tool_choice: options.tool_choice ?? "auto",
+      }),
       // Reasoning persistence (same construct as OpenAI's Responses API):
       //  - store === true  → xAI persists the response; next turn passes
       //    previous_response_id to continue the reasoning chain server-side.

package/src/services/KnowhowClient.ts

@@ -3,7 +3,7 @@ import { TraceAll } from "../util/Trace";
 import http, { HTTP_UNAUTHORIZED_HANDLER, RefreshableHeaders } from "../utils/http";
 import fs from "fs";
 import { getConfigSync } from "../config";
-import { exchangePublicKeyJwt, storeJwt } from "../auth/keyAuth";
+import { exchangeAvailablePublicKeyJwt, storeJwt } from "../auth/keyAuth";
 import { keyPairExists } from "../auth/keyManager";
 import { Message } from "../clients/types";
 import path from "path";
@@ -189,6 +189,7 @@ export class KnowhowSimpleClient {
   }
 
   private jwtExpiresSoon(): boolean {
+    if (!this.jwt) return true;
     try {
       const payload = JSON.parse(Buffer.from(this.jwt.split(".")[1], "base64url").toString("utf8"));
       return typeof payload.exp === "number" && payload.exp * 1000 - Date.now() < 5 * 60 * 1000;
@@ -205,11 +206,11 @@ export class KnowhowSimpleClient {
     this.refreshPromise = (async () => {
       const config = getConfigSync();
       const identityPath = config.cliIdentityPath;
-      if (!config.orgId || !keyPairExists(identityPath)) {
+      if (!config.orgId || (!keyPairExists(identityPath) && !keyPairExists())) {
         throw new Error("JWT expired and the CLI identity is unavailable. Please run `knowhow login` again.");
       }
       try {
-        const freshJwt = await exchangePublicKeyJwt(config.orgId, this.baseUrl, identityPath);
+        const freshJwt = await exchangeAvailablePublicKeyJwt(config.orgId, this.baseUrl, identityPath);
         storeJwt(freshJwt);
         this.setJwt(freshJwt);
         this.jwtValidated = true;
@@ -226,12 +227,12 @@ export class KnowhowSimpleClient {
   }
 
   async checkJwt() {
+    await this.renewJwt();
+
     if (!this.jwt) {
       throw new Error("No JWT found. Please login first.");
     }
 
-    await this.renewJwt();
-
     if (!this.jwtValidated) {
       try {
         this.jwtValidated = true;

package/src/services/watchers/FsSyncer.ts

@@ -15,7 +15,9 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
   public taskId: string = "";
   private taskPath: string = "";
   private watcher: fs.FSWatcher | null = null;
+  private lastThreadIndex: number = -1;
   private lastThreadLength: number = 0;
+  private lastMessageJson: string | null = null;
   public agentName: string = "unknown";
   private debounceTimer: NodeJS.Timeout | null = null;
   public agentEvents = new EventService();
@@ -37,7 +39,9 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
       const threads: any[][] = metadata.threads || [];
       const lastThread = threads[threads.length - 1] || [];
       this.agentName = metadata.agentName || taskId;
+      this.lastThreadIndex = threads.length - 1;
       this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
     }
 
     // Watch the directory for metadata.json changes
@@ -68,8 +72,26 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
     const threads: any[][] = metadata.threads;
     const lastThread = threads[threads.length - 1] || [];
 
+    const threadIndex = threads.length - 1;
+    let newMessages: any[];
+    if (
+      threadIndex === this.lastThreadIndex &&
+      lastThread.length >= this.lastThreadLength
+    ) {
+      newMessages = lastThread.slice(this.lastThreadLength);
+    } else {
+      const retainedIndex = this.findLastMessage(
+        lastThread,
+        this.lastMessageJson
+      );
+      newMessages = lastThread.slice(retainedIndex + 1);
+    }
+
+    this.lastThreadIndex = threadIndex;
+    this.lastThreadLength = lastThread.length;
+    this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
+
     // Only render NEW messages since last check
-    const newMessages = lastThread.slice(this.lastThreadLength);
     if (newMessages.length > 0) {
       const renderEvents = messagesToRenderEvents(
         newMessages,
@@ -93,7 +115,6 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
         }
       }
       this.agentEvents.emit(this.eventTypes.threadUpdate, lastThread);
-      this.lastThreadLength = lastThread.length;
     }
 
     // Emit done if the agent has completed and has a result
@@ -149,6 +170,23 @@ export class FsSyncedAgentWatcher implements SyncedAgentWatcher {
     console.log(`🫵 Interrupt written to input for agent: ${this.taskId}`);
   }
 
+  private messageJson(message: any): string | null {
+    if (message == null) return null;
+    try {
+      return JSON.stringify(message);
+    } catch {
+      return null;
+    }
+  }
+
+  private findLastMessage(messages: any[], messageJson: string | null): number {
+    if (messageJson == null) return -1;
+    for (let index = messages.length - 1; index >= 0; index--) {
+      if (this.messageJson(messages[index]) === messageJson) return index;
+    }
+    return -1;
+  }
+
   private async readMetadata(): Promise<any> {
     try {
       const metaPath = path.join(this.taskPath, "metadata.json");

package/src/services/watchers/RemoteSyncer.ts

@@ -16,7 +16,9 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
   public taskId: string = "";
   private client: KnowhowSimpleClient;
   private pollInterval: NodeJS.Timeout | null = null;
+  private lastThreadIndex: number = -1;
   private lastThreadLength: number = 0;
+  private lastMessageJson: string | null = null;
   public agentName: string = "remote-agent";
   private stopped: boolean = false;
   public agentEvents = new EventService();
@@ -41,8 +43,10 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
       const details = await this.client.getTaskDetails(taskId);
       const threads: any[][] = details?.data?.threads || [];
       const lastThread = threads[threads.length - 1] || [];
+      this.lastThreadIndex = threads.length - 1;
       this.agentName = "remote-agent";
       this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
     } catch (err: any) {
       console.warn(
         `⚠️  Could not load initial state for task ${taskId}: ${err.message}`
@@ -68,8 +72,26 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
       const details = await this.client.getTaskDetails(this.taskId);
       const threads: any[][] = details?.data?.threads || [];
       const lastThread = threads[threads.length - 1] || [];
+      const threadIndex = threads.length - 1;
+
+      let newMessages: any[];
+      if (
+        threadIndex === this.lastThreadIndex &&
+        lastThread.length >= this.lastThreadLength
+      ) {
+        newMessages = lastThread.slice(this.lastThreadLength);
+      } else {
+        const retainedIndex = this.findLastMessage(
+          lastThread,
+          this.lastMessageJson
+        );
+        newMessages = lastThread.slice(retainedIndex + 1);
+      }
+
+      this.lastThreadIndex = threadIndex;
+      this.lastThreadLength = lastThread.length;
+      this.lastMessageJson = this.messageJson(lastThread[lastThread.length - 1]);
 
-      const newMessages = lastThread.slice(this.lastThreadLength);
       if (newMessages.length > 0) {
         const renderEvents = messagesToRenderEvents(
           newMessages,
@@ -93,7 +115,6 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
           }
         }
         this.agentEvents.emit(this.eventTypes.threadUpdate, lastThread);
-        this.lastThreadLength = lastThread.length;
       }
 
       // Stop polling and emit done if task is complete with a result
@@ -155,4 +176,21 @@ export class WebSyncedAgentWatcher implements SyncedAgentWatcher {
     await this.client.sendMessageToAgent(this.taskId, `/poke ${message || ""}`.trim());
     console.log(`🫵 Interrupt sent to remote web agent: ${this.taskId}`);
   }
+
+  private messageJson(message: any): string | null {
+    if (message == null) return null;
+    try {
+      return JSON.stringify(message);
+    } catch {
+      return null;
+    }
+  }
+
+  private findLastMessage(messages: any[], messageJson: string | null): number {
+    if (messageJson == null) return -1;
+    for (let index = messages.length - 1; index >= 0; index--) {
+      if (this.messageJson(messages[index]) === messageJson) return index;
+    }
+    return -1;
+  }
 }

package/src/tunnel.ts

@@ -10,10 +10,12 @@ import { WorkerPasskeyAuthService } from "./workers/auth/WorkerPasskeyAuth";
 import { WsMiddlewareStack } from "./workers/auth/WsMiddleware";
 import { makeAuthMiddleware } from "./workers/auth/authMiddleware";
 
+const PROD_TUNNEL_WORKER_DOMAIN = "worker.tyvm-apps.com";
+
 /**
- * Extract the tunnel domain and protocol from the API URL.
- * e.g., "https://api.knowhow.tyvm.ai" -> { domain: "worker.knowhow.tyvm.ai", useHttps: true }
- * e.g., "http://localhost:4000" -> { domain: "worker.localhost:4000", useHttps: false }
+ * Resolve the tunnel domain and protocol from the environment and API URL.
+ * TUNNEL_WORKER_DOMAIN takes precedence. Otherwise dev API URLs use the dev
+ * tunnel domain and all other API URLs use the production tunnel domain.
  */
 export function extractTunnelDomain(apiUrl: string): {
   domain: string;
@@ -22,18 +24,22 @@ export function extractTunnelDomain(apiUrl: string): {
   try {
     const url = new URL(apiUrl);
     const useHttps = url.protocol === "https:";
+    const configuredDomain = process.env.TUNNEL_WORKER_DOMAIN?.trim();
 
-    // For localhost, include port; for production, just use hostname
-    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-      return {
-        domain: `worker.${url.hostname}:${url.port || "80"}`,
-        useHttps,
-      };
-    }
-    return { domain: `worker.${url.hostname}`, useHttps };
+    const isDevApi = url.hostname.split(".").includes("dev");
+    const domain =
+      configuredDomain ||
+      (isDevApi ? `worker.dev.tyvm-apps.com` : PROD_TUNNEL_WORKER_DOMAIN);
+
+    return { domain, useHttps };
   } catch (err) {
     console.error("Failed to parse API_URL for tunnel domain:", err);
-    return { domain: "worker.localhost:4000", useHttps: false }; // fallback
+    return {
+      domain:
+        process.env.TUNNEL_WORKER_DOMAIN?.trim() ||
+        PROD_TUNNEL_WORKER_DOMAIN,
+      useHttps: false,
+    };
   }
 }
 

package/src/worker.ts

@@ -6,6 +6,7 @@ import { loadJwt } from "./login";
 import { services } from "./services";
 import { PasskeySetupService } from "./workers/auth/PasskeySetup";
 import { WorkerPasskeyAuthService } from "./workers/auth/WorkerPasskeyAuth";
+import { authenticateWithKey, hasKeyPair } from "./auth/keyAuth";
 import {
   makeUnlockTool,
   makeLockTool,
@@ -303,8 +304,8 @@ export async function worker(options?: {
   let connected = false;
   let tunnelHandler: TunnelHandler | null = null;
   let tunnelWs: WebSocket | null = null;
-  let lastJwt: string | null = null;
   let unauthorizedJwt: string | null = null;
+  let refreshAttemptedJwt: string | null = null;
 
   // ---------------------------------------------------------------------------
   // Liveness watchdog state
@@ -353,7 +354,6 @@ export async function worker(options?: {
   async function connectWebSocket() {
     const jwt = await loadJwt();
     console.log(`Connecting to ${API_URL}`);
-    lastJwt = jwt;
 
     // Reset the MCP server to avoid "Already connected to a transport" error on reconnects
     await mcpServer.reset();
@@ -476,11 +476,17 @@ export async function worker(options?: {
         },
         onClose: (code, _reason) => {
           if (code === 1008) {
-            unauthorizedJwt = lastJwt;
+            unauthorizedJwt = jwt;
+            // The worker and tunnel sockets share a JWT and must be renewed as
+            // one connection cycle. Ensure a later worker "open" event cannot
+            // leave us connected with a permanently closed tunnel.
+            if (ws.readyState !== WebSocket.CLOSED) {
+              ws.terminate();
+            }
             console.error(
               "❌ Tunnel received Unauthorized (1008). The JWT may be expired."
             );
-            console.error("   Pausing reconnection until JWT changes...");
+            console.error("   Attempting to refresh the JWT with the CLI identity...");
           } else {
             console.log(
               "Tunnel connection will reconnect on next connection cycle..."
@@ -532,14 +538,16 @@ export async function worker(options?: {
       // If we got an Unauthorized (1008) close, record the JWT that failed
       // so we don't keep hammering the server with the same expired token
       if (code === 1008) {
-        unauthorizedJwt = lastJwt;
+        unauthorizedJwt = jwt;
+        if (tunnelConnection?.readyState !== WebSocket.CLOSED) {
+          tunnelConnection?.terminate();
+        }
         console.error(
           "❌ Worker received Unauthorized (1008). The JWT may be expired."
         );
         console.error(
-          "   Run 'knowhow login' to refresh your token, then restart the worker."
+          "   Attempting to refresh the JWT with the CLI identity..."
         );
-        console.error("   Pausing reconnection until JWT changes...");
       } else {
         console.log("Attempting to reconnect...");
       }
@@ -566,17 +574,59 @@ export async function worker(options?: {
 
   while (true) {
     if (!connected) {
-      // If we got an Unauthorized error, check if the JWT has changed before retrying
+      // A registered CLI identity can renew an expired JWT without requiring an
+      // interactive login. Attempt this once per rejected token; if it fails,
+      // continue watching the JWT file so `knowhow login` in another shell works.
       if (unauthorizedJwt !== null) {
-        const currentJwt = await loadJwt().catch(() => null);
+        let currentJwt = await loadJwt().catch(() => null);
         if (currentJwt === unauthorizedJwt) {
-          // JWT hasn't changed - don't reconnect, just wait
-          await wait(5000);
-          continue;
+          let attemptedRefreshNow = false;
+          if (refreshAttemptedJwt !== currentJwt) {
+            refreshAttemptedJwt = currentJwt;
+            attemptedRefreshNow = true;
+            const freshConfig = await getConfig();
+            const identityPath = freshConfig.cliIdentityPath;
+            if (freshConfig.orgId && hasKeyPair(identityPath)) {
+              try {
+                const refreshed = await authenticateWithKey(
+                  freshConfig.orgId,
+                  API_URL,
+                  identityPath
+                );
+                if (refreshed) {
+                  currentJwt = await loadJwt();
+                  console.log("✅ JWT refreshed automatically; reconnecting...");
+                } else {
+                  console.error(
+                    "❌ CLI identity was rejected and could not refresh the JWT."
+                  );
+                }
+              } catch (error) {
+                const message =
+                  error instanceof Error ? error.message : String(error);
+                console.error(`❌ Automatic JWT refresh failed: ${message}`);
+              }
+            } else {
+              console.error(
+                "❌ No registered CLI identity is available for automatic JWT refresh."
+              );
+            }
+          }
+
+          if (currentJwt === unauthorizedJwt) {
+            if (attemptedRefreshNow) {
+              console.error(
+                "   Run 'knowhow login' in another shell; reconnection will resume when the JWT changes."
+              );
+            }
+            await wait(5000);
+            continue;
+          }
         }
         // JWT changed - clear the unauthorized state and reconnect
         console.log("🔄 JWT has changed, attempting to reconnect...");
         unauthorizedJwt = null;
+        refreshAttemptedJwt = null;
       }
 
       console.log("Attempting to connect...");