@wenrwa/marketplace-cli 0.6.3 → 0.6.5

package/README.md

@@ -14,11 +14,19 @@ npx @wenrwa/marketplace-cli
 ## Setup
 
 ```bash
-# Authenticate with the marketplace
-wen-market auth login --api-key YOUR_WALLET_OR_API_KEY
+# Sign in with your browser (recommended for interactive use)
+wen-market auth login
 
-# Optionally specify a custom API URL
-wen-market auth login --api-key YOUR_KEY --api-url http://localhost:3002/api/v1
+# Prints an approval URL and code, opens your browser when possible, and
+# works over SSH too (approve from any device — the code and URL are
+# always printed). Approving on marketplace.wenrwa.com/settings/cli-login
+# mints an API key named after this machine.
+
+# CI / scripts: use a key created in Settings → API Keys instead
+wen-market auth login --api-key wm_sk_...
+
+# Point at a non-production API (local dev)
+MARKETPLACE_API_URL=http://localhost:3002/api/v1 wen-market auth login
 ```
 
 ## Commands
@@ -26,8 +34,10 @@ wen-market auth login --api-key YOUR_KEY --api-url http://localhost:3002/api/v1
 ### auth — Authentication
 
 ```bash
-wen-market auth login --api-key <key>    # Authenticate
-wen-market auth whoami                    # Show current session
+wen-market auth login                 # Browser device-code login (interactive)
+wen-market auth login --api-key wm_sk_...  # CI/scripts: use an existing API key
+wen-market auth whoami                # Show current session
+wen-market auth logout                # Revoke the key server-side and remove it locally
 ```
 
 ### bounty — Bounty Lifecycle & Management
@@ -168,16 +178,19 @@ Config is saved to `~/.wen-market/config.json` after `auth login`:
 
 ```json
 {
-  "apiKey": "your-wallet-or-api-key",
-  "apiUrl": "http://localhost:3002/api/v1"
+  "apiKey": "wm_sk_...",
+  "apiUrl": "https://api.wenrwa.com/api/v1"
 }
 ```
 
+`apiKey` is always a real API key (`wm_sk_...`), sent as `X-API-Key` on every
+request — never a wallet public key.
+
 ## Environment Variables
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `MARKETPLACE_API_URL` | `https://api.wenrwa.com/api/v1` | Override API URL |
+| `MARKETPLACE_API_URL` | `https://api.wenrwa.com/api/v1` (production) | Override API URL, e.g. for local development |
 
 ## Development
 

package/dist/__tests__/agent.test.js

@@ -54,6 +54,21 @@ describe('agent list', () => {
         spy.mockRestore();
     });
 });
+describe('agent logs', () => {
+    // sio-07: `agent logs` streams via the SAME connectWebSocket() helper
+    // dashboard.ts uses, which is what carries the authenticated handshake
+    // (auth: { token }, path '/marketplace') — exercised directly in
+    // websocket.test.ts. This just pins that `agent logs` still wires through
+    // that one shared call site rather than opening its own socket.
+    it('streams via the shared authenticated websocket helper', async () => {
+        const { connectWebSocket } = require('../utils/websocket');
+        const logSpy = jest.spyOn(console, 'log').mockImplementation();
+        await runCommand('logs', 'wallet-abc-12345678');
+        expect(connectWebSocket).toHaveBeenCalledTimes(1);
+        expect(connectWebSocket).toHaveBeenCalledWith(expect.any(Function), { channel: 'agent', filters: { agentWallet: 'wallet-abc-12345678' } });
+        logSpy.mockRestore();
+    });
+});
 describe('agent status', () => {
     it('displays agent details', async () => {
         mockClient.get.mockImplementation((path) => {

package/dist/__tests__/bridge-relay-fast-wake.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-relay-fast-wake.test.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Fast wake — the relay socket is replaced within ~1s of a Fly resume, and
+ * within a few seconds even if the resume can't be seen.
+ *
+ * Production 2026-09-25: machine resumed in 0.25s, terminal back ~21s later —
+ * the bridge only noticed its dead socket on the next 20s heartbeat.
+ */
+const relayClient_1 = require("../bridge/relayClient");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const factory = { spawn: () => new FakePty() };
+function fakeSocket() {
+    const handlers = new Map();
+    const sock = {
+        readyState: 1, pings: 0, terminated: 0,
+        send() { }, close() { handlers.get('close')?.(1006); },
+        terminate() { sock.terminated += 1; handlers.get('close')?.(1006); },
+        on(e, cb) { handlers.set(e, cb); },
+        fire(e, ...a) { handlers.get(e)?.(...a); },
+        ping() { sock.pings += 1; },
+    };
+    return sock;
+}
+function start(opts = {}) {
+    const socket = fakeSocket();
+    const intervals = [];
+    const deadlines = [];
+    (0, relayClient_1.startRelayClient)({
+        relayUrl: 'ws://relay.test', relayToken: 'tok', sessions: new sessionManager_1.SessionManager(factory),
+        wsFactory: () => socket,
+        setHeartbeatIntervalFn: (cb, ms) => { intervals.push({ cb, ms }); return intervals.length; },
+        clearHeartbeatIntervalFn: () => { },
+        setPongDeadlineFn: (cb, ms) => { const d = { cb, ms, cleared: false }; deadlines.push(d); return d; },
+        clearPongDeadlineFn: (h) => { h.cleared = true; },
+        ...(opts.resumed ? { resumeDetectorFactory: () => ({ check: opts.resumed }) } : {}),
+        setTimeoutFn: () => 0, clearTimeoutFn: () => { },
+    });
+    socket.fire('open');
+    const tick = (ms) => { for (const i of intervals)
+        if (i.ms === ms)
+            i.cb(); };
+    return { socket, intervals, deadlines, tick };
+}
+describe('fast wake: resume detection', () => {
+    it('checks for a resume every second while connected', () => {
+        const { intervals } = start({ resumed: () => false });
+        expect(intervals.some((i) => i.ms === 1000)).toBe(true);
+    });
+    it('a detected resume terminates the socket at once, so reconnect runs immediately', () => {
+        let resumed = false;
+        const { socket, tick } = start({ resumed: () => resumed });
+        tick(1000);
+        expect(socket.terminated).toBe(0);
+        resumed = true;
+        tick(1000);
+        expect(socket.terminated).toBe(1);
+    });
+});
+describe('fast wake: a ping must be answered within seconds', () => {
+    it('heartbeat defaults to every 5s (was 20s)', () => {
+        const { intervals } = start({ resumed: () => false });
+        expect(intervals.some((i) => i.ms === 5000)).toBe(true);
+        expect(intervals.some((i) => i.ms === 20_000)).toBe(false);
+    });
+    it('an unanswered ping is declared dead after its own 4s deadline, not a whole interval later', () => {
+        const { socket, tick, deadlines } = start({ resumed: () => false });
+        tick(5000);
+        expect(socket.pings).toBe(1);
+        const d = deadlines[deadlines.length - 1];
+        expect(d.ms).toBe(4000);
+        d.cb();
+        expect(socket.terminated).toBe(1);
+    });
+    it('a pong cancels the deadline — a healthy link is never killed', () => {
+        const { socket, tick, deadlines } = start({ resumed: () => false });
+        tick(5000);
+        socket.fire('pong');
+        const d = deadlines[deadlines.length - 1];
+        expect(d.cleared).toBe(true);
+        d.cb(); // even if a cleared timer somehow fired
+        expect(socket.terminated).toBe(0);
+    });
+});

package/dist/__tests__/bridge-relay-heartbeat.test.js

@@ -56,6 +56,12 @@ function startWithFakeSocket(socket, heartbeatMs) {
         ...(heartbeatMs === undefined ? {} : { heartbeatMs }),
         setHeartbeatIntervalFn: (cb, ms) => { intervals.push({ cb, ms }); return intervals.length; },
         clearHeartbeatIntervalFn: () => { },
+        // Fast wake (2026-09-27) added a per-ping deadline and a resume check;
+        // both have their own suite (bridge-relay-fast-wake.test.ts). Kept inert
+        // here so these tests still pin the original two-missed-beats rule.
+        setPongDeadlineFn: () => 0,
+        clearPongDeadlineFn: () => { },
+        resumeCheckMs: 0,
         // Never let a real reconnect timer fire during a unit test.
         setTimeoutFn: () => 0,
         clearTimeoutFn: () => { },
@@ -65,7 +71,7 @@ function startWithFakeSocket(socket, heartbeatMs) {
     // would be a different cadence, and isn't configured here anyway).
     const beat = () => {
         for (const i of intervals)
-            if (i.ms === (heartbeatMs ?? 20_000))
+            if (i.ms === (heartbeatMs ?? 5_000))
                 i.cb();
     };
     return { handle, sessions, beat, intervals };
@@ -147,8 +153,9 @@ describe('relay keepalive (twr-18)', () => {
         // so the default must leave a wide margin or the self-heal races a reboot.
         const socket = fakeSocket();
         const { intervals, handle } = startWithFakeSocket(socket);
-        const beatMs = intervals.find((i) => i.ms === 20_000)?.ms;
-        expect(beatMs).toBe(20_000);
+        // Fast wake (2026-09-27): default 5s (was 20s), plus a 4s per-ping deadline.
+        const beatMs = intervals.find((i) => i.ms === 5_000)?.ms;
+        expect(beatMs).toBe(5_000);
         expect(beatMs * 2).toBeLessThan(300_000);
         handle.close();
     });

package/dist/__tests__/bridge-resume-detector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-resume-detector.test.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Fast wake — the bridge notices a Fly SUSPEND/resume at once.
+ *
+ * Production 2026-09-25: Fly resumed the machine in 0.25s, but the terminal
+ * came back ~21s later. Suspend freezes the guest (and its MONOTONIC clock,
+ * which Node timers run on), the relay drops the old socket meanwhile, and the
+ * bridge only found out on its next 20s heartbeat. A 1s tick comparing wall-
+ * clock progress with monotonic progress sees the frozen stretch immediately.
+ */
+const resumeDetector_1 = require("../bridge/resumeDetector");
+function clocks() {
+    let wall = 1_000_000;
+    let mono = 5_000;
+    return {
+        wallNow: () => wall,
+        monoNow: () => mono,
+        run(ms) { wall += ms; mono += ms; }, // normal time passing
+        suspend(ms) { wall += ms; }, // VM frozen: wall moves, mono does not
+    };
+}
+describe('createResumeDetector', () => {
+    it('says nothing while time passes normally', () => {
+        const c = clocks();
+        const d = (0, resumeDetector_1.createResumeDetector)({ wallNow: c.wallNow, monoNow: c.monoNow });
+        for (let i = 0; i < 10; i++) {
+            c.run(1000);
+            expect(d.check()).toBe(false);
+        }
+    });
+    it('flags a resume after the machine was frozen for longer than the threshold', () => {
+        const c = clocks();
+        const d = (0, resumeDetector_1.createResumeDetector)({ wallNow: c.wallNow, monoNow: c.monoNow, thresholdMs: 3000 });
+        c.run(1000);
+        expect(d.check()).toBe(false);
+        c.suspend(45 * 60_000);
+        c.run(1000);
+        expect(d.check()).toBe(true);
+        // Only once per freeze.
+        c.run(1000);
+        expect(d.check()).toBe(false);
+    });
+    it('ignores a short stall below the threshold (GC, a busy event loop)', () => {
+        const c = clocks();
+        const d = (0, resumeDetector_1.createResumeDetector)({ wallNow: c.wallNow, monoNow: c.monoNow, thresholdMs: 3000 });
+        c.suspend(1500);
+        c.run(1000);
+        expect(d.check()).toBe(false);
+    });
+    it('ignores the wall clock stepping BACKWARDS (an NTP correction is not a resume)', () => {
+        const c = clocks();
+        const d = (0, resumeDetector_1.createResumeDetector)({ wallNow: c.wallNow, monoNow: c.monoNow });
+        c.suspend(-60_000);
+        c.run(1000);
+        expect(d.check()).toBe(false);
+    });
+});

package/dist/__tests__/websocket.test.js

@@ -4,10 +4,35 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const chalk_1 = __importDefault(require("chalk"));
+const events_1 = require("events");
+// sio-07 (docs/prd/authenticated-sockets.md): the CLI is a headless client —
+// it must authenticate the Socket.IO handshake with `auth: { token }`
+// (never the retired `walletPubkey` field) against the server's
+// `/marketplace` path (backend/src/server.ts), and surface a clear message
+// on refusal. connectWebSocket() is the single call site both
+// `dashboard.ts` and `agent.ts` (`agent logs`) share, so exercising it here
+// covers the handshake contract for both commands.
+const TEST_API_KEY = 'wm_sk_' + 'a'.repeat(64);
+const mockIo = jest.fn();
+jest.mock('socket.io-client', () => ({
+    io: (...args) => mockIo(...args),
+}));
+jest.mock('../utils/config', () => ({
+    requireConfig: jest.fn().mockReturnValue({
+        apiUrl: 'https://api.wenrwa.com/api/v1/api/marketplace',
+        apiKey: 'wm_sk_' + 'a'.repeat(64),
+    }),
+}));
 const websocket_1 = require("../utils/websocket");
+class FakeSocket extends events_1.EventEmitter {
+    disconnect = jest.fn();
+}
 beforeAll(() => {
     chalk_1.default.level = 0;
 });
+beforeEach(() => {
+    mockIo.mockReset();
+});
 function makeEvent(event, data, timestamp) {
     return { event, data, timestamp: timestamp || '2024-06-15T14:30:00.000Z' };
 }
@@ -59,3 +84,71 @@ describe('formatEventJson()', () => {
         expect(result.event).toBe('test');
     });
 });
+describe('connectWebSocket() handshake (sio-07)', () => {
+    it('authenticates with auth.token = the API key', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        expect(mockIo).toHaveBeenCalledTimes(1);
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.auth).toEqual({ token: TEST_API_KEY });
+    });
+    it('never sends the retired walletPubkey field', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.auth).not.toHaveProperty('walletPubkey');
+        expect(JSON.stringify(opts)).not.toContain('walletPubkey');
+    });
+    it('connects on the server\'s /marketplace Socket.IO path', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        (0, websocket_1.connectWebSocket)(() => { });
+        const [, opts] = mockIo.mock.calls[0];
+        expect(opts.path).toBe('/marketplace');
+    });
+    it('shows a clear message and tells the user to log in again on CREDENTIAL_INVALID', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        const err = new Error('invalid credential');
+        err.data = { code: 'CREDENTIAL_INVALID' };
+        fake.emit('connect_error', err);
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('shows a clear message and tells the user to log in again on SESSION_REVOKED', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        const err = new Error('session revoked');
+        err.data = { code: 'SESSION_REVOKED' };
+        fake.emit('connect_error', err);
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('falls back to a generic message for other connect errors', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => { });
+        (0, websocket_1.connectWebSocket)(() => { });
+        fake.emit('connect_error', new Error('ECONNREFUSED'));
+        const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
+        expect(printed).toContain('ECONNREFUSED');
+        expect(printed).not.toMatch(/wen-market auth login/);
+        errorSpy.mockRestore();
+    });
+    it('subscribes to the requested channel on connect, unaffected by the auth change', () => {
+        const fake = new FakeSocket();
+        mockIo.mockReturnValue(fake);
+        const emitSpy = jest.spyOn(fake, 'emit');
+        (0, websocket_1.connectWebSocket)(() => { }, { channel: 'workspace', filters: { workspaceId: 'ws1' } });
+        fake.emit('connect');
+        expect(emitSpy).toHaveBeenCalledWith('subscribe', { channel: 'workspace', workspaceId: 'ws1' });
+    });
+});

package/dist/bridge/relayClient.d.ts

@@ -335,6 +335,26 @@ export interface RelayClientOpts {
      */
     setHeartbeatIntervalFn?: (cb: () => void, ms: number) => unknown;
     clearHeartbeatIntervalFn?: (handle: unknown) => void;
+    /**
+     * Fast wake (2026-09-27) — how long a single ping may go unanswered before
+     * the socket is declared dead. Default 4000. Before this, the deadline WAS
+     * the heartbeat interval (20s), so a dead socket survived up to 40s; that is
+     * most of why a resumed machine's terminal took ~21s to come back.
+     */
+    pongTimeoutMs?: number;
+    /** Injectable for the pong deadline only (tests). Defaults to setTimeout. */
+    setPongDeadlineFn?: (cb: () => void, ms: number) => unknown;
+    clearPongDeadlineFn?: (handle: unknown) => void;
+    /**
+     * Fast wake — how often to check for a Fly suspend/resume (resumeDetector.ts).
+     * A detected resume terminates the socket at once so the redial starts
+     * immediately. Default 1000; 0 disables. Runs on the heartbeat timer seam.
+     */
+    resumeCheckMs?: number;
+    /** Injectable for tests. */
+    resumeDetectorFactory?: () => {
+        check(): boolean;
+    };
     /**
      * Rock-solid sleep/wake — how often to push the PTY inventory (`sessions`
      * frame) while connected. Default 30_000ms.

package/dist/bridge/relayClient.js

@@ -56,6 +56,7 @@ exports.startRelayClient = startRelayClient;
  * that) — on re-pair the pane sends `attach` again and gets a fresh
  * `replay`, exactly as it would against the local server.
  */
+const resumeDetector_1 = require("./resumeDetector");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const ws_1 = require("ws");
@@ -239,7 +240,18 @@ function startRelayClient(opts) {
     const cancelInterval = opts.clearIntervalFn ?? ((h) => clearInterval(h));
     // pucc-int-03 activity-tap config (enabled by default; the container bridge
     // runs Claude Code, so observing its tool-use is the norm).
-    const heartbeatMs = opts.heartbeatMs ?? 20_000;
+    // Fast wake (2026-09-27): 5s, not 20s — with the 4s pong deadline below a
+    // dead socket is found within ~9s even when a resume goes undetected.
+    const heartbeatMs = opts.heartbeatMs ?? 5_000;
+    const pongTimeoutMs = opts.pongTimeoutMs ?? 4_000;
+    const schedulePongDeadline = opts.setPongDeadlineFn ?? ((cb, ms) => {
+        const t = setTimeout(cb, ms);
+        t.unref?.();
+        return t;
+    });
+    const cancelPongDeadline = opts.clearPongDeadlineFn ?? ((h) => clearTimeout(h));
+    const resumeCheckMs = opts.resumeCheckMs ?? 1_000;
+    const makeResumeDetector = opts.resumeDetectorFactory ?? (() => (0, resumeDetector_1.createResumeDetector)());
     const scheduleHeartbeat = opts.setHeartbeatIntervalFn ?? ((cb, ms) => setInterval(cb, ms));
     const cancelHeartbeat = opts.clearHeartbeatIntervalFn ?? ((h) => clearInterval(h));
     const sessionsReportMs = opts.sessionsReportMs ?? 30_000;
@@ -746,16 +758,38 @@ function startRelayClient(opts) {
         // twr-18 relay keepalive (see RelayClientOpts#heartbeatMs). Per-connection:
         // recreated on every dial, torn down in onDown.
         let hbHandle = null;
+        let resumeHandle = null;
+        let pongDeadline = null;
         let awaitingPong = false;
+        const clearPongDeadline = () => {
+            if (pongDeadline != null)
+                cancelPongDeadline(pongDeadline);
+            pongDeadline = null;
+        };
         const stopHeartbeat = () => {
             if (hbHandle != null)
                 cancelHeartbeat(hbHandle);
+            if (resumeHandle != null)
+                cancelHeartbeat(resumeHandle);
             hbHandle = null;
+            resumeHandle = null;
+            clearPongDeadline();
             awaitingPong = false;
         };
+        // Declare this socket dead and let the close handler's reconnect run.
+        // terminate() (not close()) — a half-open socket never completes a close
+        // handshake.
+        const dropSocket = (why) => {
+            console.error(`[bridge] ${why} — reconnecting`);
+            stopHeartbeat();
+            try {
+                (socket.terminate ?? socket.close).call(socket);
+            }
+            catch { /* the close handler still runs */ }
+        };
         // ANY inbound traffic proves the link is alive — a busy socket never needs
         // to ping at all, and a pong is just the idle case of the same proof.
-        const markLinkAlive = () => { awaitingPong = false; };
+        const markLinkAlive = () => { awaitingPong = false; clearPongDeadline(); };
         const startHeartbeat = () => {
             // No ping() (test double, or a non-ws implementation) ⇒ no keepalive.
             // Never fake it: a heartbeat that can't be answered would kill every
@@ -767,23 +801,36 @@ function startRelayClient(opts) {
                     return;
                 if (awaitingPong) {
                     // Previous ping went unanswered for a full interval: the server is
-                    // gone even though TCP still believes otherwise. terminate() (not
-                    // close()) — a half-open socket never completes a close handshake.
-                    console.error('[bridge] relay heartbeat timed out — reconnecting');
-                    stopHeartbeat();
-                    try {
-                        (socket.terminate ?? socket.close).call(socket);
-                    }
-                    catch { /* the close handler still runs */ }
+                    // gone even though TCP still believes otherwise.
+                    dropSocket('relay heartbeat timed out');
                     return;
                 }
                 awaitingPong = true;
                 try {
                     socket.ping();
                 }
-                catch { /* a failed ping surfaces as the next tick's timeout */ }
+                catch { /* a failed ping surfaces via the deadline */ }
+                // Fast wake: the ping gets its OWN short deadline instead of waiting a
+                // whole interval for the next tick to notice.
+                clearPongDeadline();
+                pongDeadline = schedulePongDeadline(() => {
+                    pongDeadline = null;
+                    if (connected && awaitingPong)
+                        dropSocket(`relay ping unanswered for ${pongTimeoutMs}ms`);
+                }, pongTimeoutMs);
             }, heartbeatMs);
             hbHandle?.unref?.();
+            // Fast wake: a Fly suspend froze this process; the socket it holds is
+            // almost certainly dead. Notice within a second of resuming and redial
+            // now, not on the next heartbeat (resumeDetector.ts).
+            if (resumeCheckMs > 0) {
+                const detector = makeResumeDetector();
+                resumeHandle = scheduleHeartbeat(() => {
+                    if (connected && detector.check())
+                        dropSocket('machine resumed from suspend');
+                }, resumeCheckMs);
+                resumeHandle?.unref?.();
+            }
         };
         socket.on('pong', markLinkAlive);
         socket.on('open', () => {

package/dist/bridge/resumeDetector.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Fast wake: has this machine just been RESUMED from a Fly suspend?
+ *
+ * Suspend freezes the whole guest, including the monotonic clock Node's
+ * timers run on, while real (wall-clock) time keeps going. On resume the wall
+ * clock is corrected forward and the monotonic clock simply continues. So in
+ * one short tick, wall-clock progress far exceeding monotonic progress means
+ * the process was frozen, and every socket it held is almost certainly dead
+ * (the relay drops a silent socket within ~90s).
+ *
+ * Production 2026-09-25: Fly resumed in 0.25s but the terminal took ~21s,
+ * because the bridge only learned its socket was dead on the next 20s
+ * heartbeat. relayClient checks this every second and redials at once.
+ * (browserIdle.ts relies on the same clock property for the browser.)
+ *
+ * Pure: both clocks injectable.
+ */
+export interface ResumeDetectorOpts {
+    /** Wall-clock gap beyond monotonic progress that counts as a freeze. */
+    thresholdMs?: number;
+    wallNow?: () => number;
+    monoNow?: () => number;
+}
+export interface ResumeDetector {
+    /** True exactly once after a freeze longer than the threshold. */
+    check(): boolean;
+}
+export declare function createResumeDetector(opts?: ResumeDetectorOpts): ResumeDetector;

package/dist/bridge/resumeDetector.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createResumeDetector = createResumeDetector;
+const defaultMono = () => Number(process.hrtime.bigint() / 1000000n);
+function createResumeDetector(opts = {}) {
+    const threshold = opts.thresholdMs ?? 3000;
+    const wallNow = opts.wallNow ?? Date.now;
+    const monoNow = opts.monoNow ?? defaultMono;
+    let lastWall = wallNow();
+    let lastMono = monoNow();
+    return {
+        check() {
+            const w = wallNow();
+            const m = monoNow();
+            const frozenFor = (w - lastWall) - (m - lastMono);
+            lastWall = w;
+            lastMono = m;
+            // Only a FORWARD jump: a backwards NTP step is not a resume.
+            return frozenFor > threshold;
+        },
+    };
+}

package/dist/utils/websocket.js

@@ -10,12 +10,32 @@ const socket_io_client_1 = require("socket.io-client");
 const chalk_1 = __importDefault(require("chalk"));
 const config_1 = require("./config");
 const format_1 = require("./format");
+// sio-07 (docs/prd/authenticated-sockets.md): headless clients (the CLI)
+// authenticate the Socket.IO handshake with `auth: { token }` — the API key
+// (`wm_sk_…`) — against the server's dedicated `/marketplace` path
+// (backend/src/server.ts). The legacy `auth: { walletPubkey }` field proved
+// nothing (public keys are public) and is retired; the server's
+// socket-auth middleware (backend/src/middleware/socket-auth.middleware.ts)
+// refuses bad/revoked credentials with a `connect_error` carrying
+// `err.data.code` of CREDENTIAL_INVALID or SESSION_REVOKED.
+const AUTH_LOGIN_HINT = 'Run `wen-market auth login` to sign in again.';
+function connectRefusalMessage(err) {
+    const code = err?.data?.code;
+    if (code === 'CREDENTIAL_INVALID') {
+        return `Your API key is invalid or expired. ${AUTH_LOGIN_HINT}`;
+    }
+    if (code === 'SESSION_REVOKED') {
+        return `Your session was revoked. ${AUTH_LOGIN_HINT}`;
+    }
+    return `WebSocket error: ${err?.message}`;
+}
 function connectWebSocket(onEvent, options = {}) {
     const config = (0, config_1.requireConfig)();
     const wsUrl = config.apiUrl.replace('/api/marketplace', '');
     const socket = (0, socket_io_client_1.io)(wsUrl, {
+        path: '/marketplace',
         transports: ['websocket'],
-        auth: { walletPubkey: config.apiKey },
+        auth: { token: config.apiKey },
     });
     socket.on('connect', () => {
         if (options.channel) {
@@ -29,7 +49,7 @@ function connectWebSocket(onEvent, options = {}) {
         onEvent(event);
     });
     socket.on('connect_error', (err) => {
-        console.error(chalk_1.default.red(`WebSocket error: ${err.message}`));
+        console.error(chalk_1.default.red(connectRefusalMessage(err)));
     });
     return socket;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wenrwa/marketplace-cli",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "CLI tool for the Wenrwa Agent Marketplace — monitor bounties, agents, workspaces, and treasury from your terminal",
   "author": "Wenrwa <dev@wenrwa.com>",
   "license": "MIT",