aismemory 0.4.0 → 0.5.1

package/dist/hydration.js

@@ -1,13 +1,59 @@
+const LOG_PREFIX = '[aismemory]';
+function redactHydrationMessage(message) {
+    return message
+        .replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]')
+        .replace(/authorization:\s*\S+/gi, 'authorization: [REDACTED]')
+        .slice(0, 300);
+}
+function isRetryableHttpStatus(status) {
+    return status >= 500 || status === 429;
+}
+function isRetryableHydrationError(err) {
+    if (!(err instanceof Error))
+        return true;
+    const msg = err.message.toLowerCase();
+    return (msg.includes('network') ||
+        msg.includes('fetch') ||
+        msg.includes('timeout') ||
+        msg.includes('econnrefused') ||
+        msg.includes('enotfound'));
+}
+function logHydrationFailure(kind, details) {
+    const retryLabel = details.retryable ? 'retryable' : 'permanent';
+    const statusPart = details.status !== undefined ? ` status=${details.status}` : '';
+    const line = `${LOG_PREFIX} hydrateIdentity failed (${kind}, ${retryLabel})${statusPart}: ${redactHydrationMessage(details.message)}\n`;
+    process.stderr.write(line);
+}
 export async function hydrateIdentity(aisUrl, agentId, token) {
     try {
         const res = await fetch(`${aisUrl}/v1/agents/${agentId}/full-context`, {
             headers: { Authorization: `Bearer ${token}` },
         });
-        if (!res.ok)
+        if (!res.ok) {
+            let bodyHint = res.statusText;
+            try {
+                const text = await res.text();
+                if (text.length > 0)
+                    bodyHint = text;
+            }
+            catch {
+                /* ignore body read errors */
+            }
+            logHydrationFailure('http', {
+                status: res.status,
+                message: bodyHint,
+                retryable: isRetryableHttpStatus(res.status),
+            });
             return null;
+        }
         const json = (await res.json());
-        if (!json.success || !json.data)
+        if (!json.success || !json.data) {
+            logHydrationFailure('api', {
+                message: json.success === false ? 'AIS full-context success=false' : 'AIS full-context missing data',
+                retryable: false,
+            });
             return null;
+        }
         const d = json.data;
         const identity = {
             id: d.identity?.id ?? '',
@@ -55,7 +101,12 @@ export async function hydrateIdentity(aisUrl, agentId, token) {
             totalTokens: d.context?.totalTokens ?? 0,
         };
     }
-    catch {
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        logHydrationFailure('network', {
+            message,
+            retryable: isRetryableHydrationError(err),
+        });
         return null;
     }
 }

package/dist/hydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"hydration.js","sourceRoot":"","sources":["../src/hydration.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,OAAO,eAAe,EAAE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAqB7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAE7C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAEpB,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YAC1B,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE;YAC1C,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACjC,CAAC;QAEF,MAAM,WAAW,GACf,CAAC,CAAC,WAAW,IAAI,IAAI;YACnB,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE;gBAClC,kBAAkB,EAAE,CAAC,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE;gBAC1D,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE;aACrD;YACH,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;SACvB,CAAC,CAAC,CAAC;QAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;YAC7B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;SAC7B,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,WAAW,GACf,CAAC,CAAC,WAAW,IAAI,IAAI;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE;gBACpC,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE;gBAC9C,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE;gBAC5C,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE;aACzC;YACH,CAAC,CAAC,IAAI,CAAC;QAEX,OAAO;YACL,QAAQ;YACR,WAAW;YACX,KAAK;YACL,cAAc;YACd,MAAM;YACN,WAAW;YACX,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC;SACzC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"hydration.js","sourceRoot":"","sources":["../src/hydration.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAG,aAAa,CAAC;AAIjC,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,OAAO;SACX,OAAO,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SAC9C,OAAO,CAAC,wBAAwB,EAAE,2BAA2B,CAAC;SAC9D,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAA0B,EAC1B,OAAiE;IAEjE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IACjE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,GAAG,UAAU,4BAA4B,IAAI,KAAK,UAAU,IAAI,UAAU,KAAK,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;IACxI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,OAAe,EACf,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,cAAc,OAAO,eAAe,EAAE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,QAAQ,GAAG,IAAI,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YACD,mBAAmB,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,QAAQ;gBACjB,SAAS,EAAE,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;aAC7C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAqB7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,mBAAmB,CAAC,KAAK,EAAE;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,+BAA+B;gBACpG,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;QAEpB,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE;YAC1B,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;YAC5B,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE;YAC1C,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE;SACjC,CAAC;QAEF,MAAM,WAAW,GACf,CAAC,CAAC,WAAW,IAAI,IAAI;YACnB,CAAC,CAAC;gBACE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE;gBAClC,kBAAkB,EAAE,CAAC,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE;gBAC1D,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE;aACrD;YACH,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC;YACzB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;SACvB,CAAC,CAAC,CAAC;QAEJ,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC;YAC7B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;SAC7B,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAErE,MAAM,WAAW,GACf,CAAC,CAAC,WAAW,IAAI,IAAI;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE;gBACpC,YAAY,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE;gBAC9C,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE;gBAC5C,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE;aACzC;YACH,CAAC,CAAC,IAAI,CAAC;QAEX,OAAO;YACL,QAAQ;YACR,WAAW;YACX,KAAK;YACL,cAAc;YACd,MAAM;YACN,WAAW;YACX,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;YAChC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC;SACzC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mBAAmB,CAAC,SAAS,EAAE;YAC7B,OAAO;YACP,SAAS,EAAE,yBAAyB,CAAC,GAAG,CAAC;SAC1C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -9,37 +9,33 @@
  */
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { tryKeyAuth } from './key-auth.js';
+import { isCredsStale, isAuthErrorResult } from './auth-staleness.js';
 import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
-import { join } from 'path';
 import { homedir } from 'os';
+import { loadOAuthCredentials, saveOAuthCredentials, } from './oauth-credentials.js';
 import { hydrateIdentity } from './hydration.js';
 import { assemblePrompt } from './prompt-resource.js';
 import { startRefreshTimer, stopRefreshTimer } from './refresh.js';
 import { ActivityTracker, setupAutoHandoff } from './auto-handoff.js';
+import { assertEnvAgentInTenant } from './env-agent.js';
+import { emitTelemetry, hashAgentId } from './telemetry.js';
+import { parseAgentLoadArgs, parseEmptyToolArgs, parseHandoffArgs, parseRecallArgs, parseRememberArgs, } from './tool-args.js';
 // ── Config ──────────────────────────────────────────────
 const AIS_URL = process.env['AIS_URL'] ?? 'https://ais.agentsandswarms.ai';
-const CREDS_DIR = join(homedir(), '.aismemory');
-const CREDS_FILE = join(CREDS_DIR, 'credentials.json');
 // ── Credential persistence ──────────────────────────────
 function loadCredentials() {
-    try {
-        if (!existsSync(CREDS_FILE))
-            return null;
-        const data = JSON.parse(readFileSync(CREDS_FILE, 'utf-8'));
-        if (new Date(data.expiresAt) <= new Date()) {
-            stderr('Saved credentials expired. Re-authenticating...');
-            return null;
-        }
-        return data;
-    }
-    catch {
+    const data = loadOAuthCredentials();
+    if (!data)
+        return null;
+    if (isCredsStale(data.expiresAt, Date.now())) {
+        stderr('Saved credentials expired or expiring soon. Re-authenticating...');
         return null;
     }
+    return data;
 }
 function saveCredentials(creds) {
-    mkdirSync(CREDS_DIR, { recursive: true });
-    writeFileSync(CREDS_FILE, JSON.stringify(creds, null, 2));
+    saveOAuthCredentials(creds);
 }
 // ── HTTP helpers ────────────────────────────────────────
 function stderr(msg) {
@@ -49,17 +45,55 @@ async function aisPost(path, body, token) {
     const headers = { 'Content-Type': 'application/json' };
     if (token)
         headers['Authorization'] = `Bearer ${token}`;
-    const res = await fetch(`${AIS_URL}${path}`, {
-        method: 'POST',
-        headers,
-        body: JSON.stringify(body),
-    });
+    let res;
+    try {
+        res = await fetch(`${AIS_URL}${path}`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    if (!res.ok) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            httpStatus: res.status,
+            error: `HTTP ${res.status}`,
+        });
+    }
     return res.json();
 }
 async function aisGet(path, token) {
-    const res = await fetch(`${AIS_URL}${path}`, {
-        headers: { 'Authorization': `Bearer ${token}` },
-    });
+    let res;
+    try {
+        res = await fetch(`${AIS_URL}${path}`, {
+            headers: { 'Authorization': `Bearer ${token}` },
+        });
+    }
+    catch (err) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    if (!res.ok) {
+        emitTelemetry({
+            event: 'ais.http.failure',
+            path,
+            httpStatus: res.status,
+            error: `HTTP ${res.status}`,
+        });
+    }
     return res.json();
 }
 async function resolveAgentForLoad(token, query) {
@@ -95,11 +129,21 @@ async function resolveAgentForLoad(token, query) {
  * User can override with AIS_AGENT_ID or AIS_AGENT_NAME env vars.
  */
 async function resolveAgent(token, fallbackAgentId, fallbackTenantId) {
-    // Explicit env var overrides everything
+    // Explicit env var overrides everything — must belong to this tenant.
     const envAgentId = process.env['AIS_AGENT_ID'];
     if (envAgentId) {
-        stderr(`Using agent from AIS_AGENT_ID: ${envAgentId}`);
-        return { agentId: envAgentId, tenantId: fallbackTenantId };
+        const listRes = (await aisGet('/v1/agents', token));
+        const agents = listRes.data?.agents ?? [];
+        try {
+            const match = assertEnvAgentInTenant(envAgentId, agents);
+            stderr(`Using agent from AIS_AGENT_ID: ${match.name} (${match.id})`);
+            return { agentId: match.id, tenantId: fallbackTenantId };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            stderr(message);
+            throw error;
+        }
     }
     try {
         const res = await aisGet('/v1/agents', token);
@@ -154,6 +198,7 @@ class BondPendingError extends Error {
     }
 }
 async function startDeviceFlow() {
+    emitTelemetry({ event: 'auth.device_flow.start' });
     stderr('Starting authentication...');
     const authRes = (await aisPost('/v1/oauth/device/authorize', {
         name: `agent-${homedir().split('/').pop() ?? 'user'}`,
@@ -170,14 +215,24 @@ async function startDeviceFlow() {
     stderr(`  Code     : ${user_code}`);
     stderr('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     const poll = pollForToken(device_code, interval, agent_id, provisional_tenant_id);
-    return {
+    const flow = {
         device_code,
         user_code,
         verification_uri_complete,
         agent_id,
         provisional_tenant_id,
         poll,
+        dead: false,
     };
+    // Mark the flow dead as soon as its poll rejects so the next
+    // `ensureCredentials` call starts a fresh flow. The `.catch` here is purely
+    // for state-tracking — the original rejection is still observed by callers
+    // racing `flow.poll`. We swallow on this branch to suppress unhandled
+    // rejection warnings between rejection and the next ensureCredentials call.
+    poll.catch(() => {
+        flow.dead = true;
+    });
+    return flow;
 }
 async function pollForToken(device_code, interval, agent_id, provisional_tenant_id) {
     const pollInterval = Math.max(interval, 5) * 1000;
@@ -284,7 +339,33 @@ const tools = [
     },
 ];
 // ── MCP Server ──────────────────────────────────────────
+/**
+ * Decode the user_id + tenant_id claims from a (presumed valid) JWT without
+ * verifying the signature. Used to derive bootstrap context after a successful
+ * key-auth handshake — we trust the token because the server just minted it.
+ */
+function decodeJwtClaims(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return {};
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
+        return { userId: payload.user_id ?? payload.sub, tenantId: payload.tenant_id };
+    }
+    catch {
+        return {};
+    }
+}
 async function main() {
+    // Subcommand dispatch — CLI entrypoints exit before MCP server startup.
+    if (process.argv[2] === 'enable-key-auth') {
+        await import('./cli/enable-key-auth.js');
+        return; // CLI calls process.exit() itself
+    }
+    if (process.argv[2] === 'sync') {
+        await import('./cli/sync-memory.js');
+        return; // sync-memory.ts calls process.exit() on failure
+    }
     // Lazy-auth state. We connect the MCP transport before the user has approved
     // the device flow so Claude Code's 30s connection timeout is not blocked on
     // human approval. The first tool call surfaces the bond URL via its result.
@@ -292,22 +373,82 @@ async function main() {
     let activeFlow = null;
     let postAuthDone = false;
     // Created here so `agent_load` and post-auth setup can reference it via closure.
-    const server = new Server({ name: 'aismemory', version: '0.4.0' }, { capabilities: { tools: {}, prompts: {} } });
+    const server = new Server({ name: 'aismemory', version: '0.5.0' }, { capabilities: { tools: {}, prompts: {} } });
     /**
      * Wait briefly for the in-flight device-flow poll to complete. If the user
      * has already approved, this returns the fresh credentials. If not, throws
      * BondPendingError so the calling tool returns the bond URL to the agent.
+     *
+     * Recovery: if the previous flow's poll rejected (expired_token,
+     * access_denied, 30-min deadline, etc.), the dead flow is discarded and a
+     * new device flow is started inline — the user gets a fresh bond URL on
+     * the next tool call without having to restart the MCP process.
      */
     async function ensureCredentials(softTimeoutMs = 7000) {
-        if (creds)
-            return creds;
-        if (!activeFlow)
+        if (creds) {
+            if (!isCredsStale(creds.expiresAt, Date.now()))
+                return creds;
+            // CORBOT-A5BBD580: tokens live 7 days but the process can outlive
+            // them. Drop stale creds and fall through to silent key auth.
+            stderr('Cached credentials are expired or expiring soon — re-authenticating...');
+            creds = null;
+        }
+        // ── Key auth (Phase 1 DID auth) ───────────────────────────────────────
+        // If the user has enrolled a private key for this device, sign a
+        // server-issued challenge and skip the device-flow ceremony entirely.
+        // tryKeyAuth() returns null if no key file is present (clean fallback
+        // to device flow) and throws only on real failures (e.g. server says
+        // INVALID_SIGNATURE). On throw we log and continue to device flow —
+        // device flow is the recovery path for "user wiped their key file".
+        try {
+            const keyResult = await tryKeyAuth({ aisUrl: AIS_URL });
+            if (keyResult) {
+                const claims = decodeJwtClaims(keyResult.token);
+                const tenantId = claims.tenantId ?? '';
+                const resolved = await resolveAgent(keyResult.token, '', tenantId);
+                creds = {
+                    token: keyResult.token,
+                    agentId: resolved.agentId,
+                    tenantId: resolved.tenantId || tenantId,
+                    expiresAt: keyResult.expiresAt,
+                };
+                saveCredentials(creds);
+                emitTelemetry({
+                    event: 'auth.key.success',
+                    agentIdHash: hashAgentId(creds.agentId),
+                });
+                stderr('Authenticated via DID key auth (no browser required)');
+                if (!postAuthDone) {
+                    postAuthDone = true;
+                    void runPostAuth(creds);
+                }
+                return creds;
+            }
+        }
+        catch (err) {
+            emitTelemetry({
+                event: 'auth.key.fallback',
+                error: err instanceof Error ? err.message : String(err),
+            });
+            stderr(`Key auth failed: ${err instanceof Error ? err.message : String(err)}. Falling back to device flow.`);
+        }
+        if (!activeFlow || activeFlow.dead) {
             activeFlow = await startDeviceFlow();
+        }
         const sentinel = Symbol('bond-pending');
-        const got = await Promise.race([
-            activeFlow.poll,
-            new Promise((r) => setTimeout(() => r(sentinel), softTimeoutMs)),
-        ]);
+        let got;
+        try {
+            got = await Promise.race([
+                activeFlow.poll,
+                new Promise((r) => setTimeout(() => r(sentinel), softTimeoutMs)),
+            ]);
+        }
+        catch {
+            // Poll rejected (deadline / expired / denied). Start a fresh flow
+            // immediately and surface its new bond URL — no restart required.
+            activeFlow = await startDeviceFlow();
+            throw new BondPendingError(activeFlow.verification_uri_complete, activeFlow.user_code);
+        }
         if (got === sentinel) {
             throw new BondPendingError(activeFlow.verification_uri_complete, activeFlow.user_code);
         }
@@ -319,6 +460,16 @@ async function main() {
         }
         return creds;
     }
+    /** Poll AIS for recent memories and refresh the identity prompt. */
+    function applyMemoryRefresh(agentId, token) {
+        startRefreshTimer(AIS_URL, agentId, token, (memories) => {
+            if (agentContext) {
+                agentContext.recentMemories = memories;
+            }
+            server.notification({ method: 'notifications/prompts/list_changed' });
+            stderr(`Memory refresh: ${memories.length} memories`);
+        });
+    }
     /** Identity hydration, prompt refresh, and auto-handoff — all post-auth. */
     async function runPostAuth(c) {
         try {
@@ -330,13 +481,7 @@ async function main() {
             else {
                 stderr('Agent identity not loaded — tools work, but no identity prompt');
             }
-            startRefreshTimer(AIS_URL, c.agentId, c.token, (memories) => {
-                if (agentContext) {
-                    agentContext.recentMemories = memories;
-                }
-                server.notification({ method: 'notifications/prompts/list_changed' });
-                stderr(`Memory refresh: ${memories.length} memories`);
-            });
+            applyMemoryRefresh(c.agentId, c.token);
             setupAutoHandoff(AIS_URL, c.agentId, c.token, activityTracker, () => {
                 stopRefreshTimer();
                 stderr('Session handoff saved');
@@ -352,94 +497,145 @@ async function main() {
             ? [{ name: 'agent-identity', description: 'Active AIS agent identity, personality, and context' }]
             : [],
     }));
-    server.setRequestHandler(GetPromptRequestSchema, async () => ({
-        messages: [{
-                role: 'user',
-                content: { type: 'text', text: assemblePrompt(agentContext) },
-            }],
-    }));
+    server.setRequestHandler(GetPromptRequestSchema, async (request) => {
+        const { name } = request.params;
+        if (name !== 'agent-identity') {
+            throw new Error(`Unknown prompt: ${name}`);
+        }
+        return {
+            messages: [{
+                    role: 'user',
+                    content: { type: 'text', text: assemblePrompt(agentContext) },
+                }],
+        };
+    });
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
         const { name, arguments: args } = request.params;
-        const a = (args ?? {});
+        const rawArgs = args ?? {};
         activityTracker.recordToolUse(name);
+        const toolStartedAt = Date.now();
         try {
-            const c = await ensureCredentials();
-            const token = c.token;
-            // agentId is mutable across `agent_load` calls within this session.
-            let agentId = c.agentId;
-            let result;
-            switch (name) {
-                case 'remember':
-                    result = await aisPost(`/v1/agents/${agentId}/memory`, {
-                        content: a['content'],
-                        type: a['type'] ?? 'context',
-                        importance: a['importance'] ?? 0.5,
-                    }, token);
-                    activityTracker.recordMemoryStored(String(a['content'] ?? ''));
-                    break;
-                case 'recall': {
-                    const params = new URLSearchParams();
-                    if (a['query'])
-                        params.set('query', String(a['query']));
-                    if (a['limit'])
-                        params.set('limit', String(a['limit']));
-                    if (a['type'])
-                        params.set('types', String(a['type']));
-                    result = await aisGet(`/v1/agents/${agentId}/memory?${params}`, token);
-                    break;
-                }
-                case 'whoami':
-                    result = await aisGet(`/v1/agents/${agentId}`, token);
-                    break;
-                case 'full_context':
-                    result = await aisGet(`/v1/agents/${agentId}/full-context`, token);
-                    break;
-                case 'dream':
-                    result = await aisPost(`/v1/agents/${agentId}/dream`, {}, token);
-                    break;
-                case 'handoff':
-                    result = await aisPost(`/v1/agents/${agentId}/handoff`, {
-                        summary: a['summary'] ?? 'Session ended',
-                        keyLearnings: a['keyLearnings'] ?? [],
-                    }, token);
-                    break;
-                case 'agent_load': {
-                    const query = String(a['query'] ?? '').trim();
-                    if (!query) {
-                        throw new Error('agent_load: query is required');
+            const UNKNOWN_TOOL = Symbol('unknown-tool');
+            const dispatchTool = async (c) => {
+                const token = c.token;
+                // agentId is mutable across `agent_load` calls within this session.
+                let agentId = c.agentId;
+                let result;
+                switch (name) {
+                    case 'remember': {
+                        const rememberArgs = parseRememberArgs(rawArgs);
+                        result = await aisPost(`/v1/agents/${agentId}/memory`, {
+                            content: rememberArgs.content,
+                            type: rememberArgs.type,
+                            importance: rememberArgs.importance,
+                        }, token);
+                        activityTracker.recordMemoryStored(rememberArgs.content);
+                        break;
+                    }
+                    case 'recall': {
+                        const recallArgs = parseRecallArgs(rawArgs);
+                        const params = new URLSearchParams();
+                        params.set('query', recallArgs.query);
+                        if (recallArgs.limit !== undefined)
+                            params.set('limit', String(recallArgs.limit));
+                        if (recallArgs.type !== undefined)
+                            params.set('types', recallArgs.type);
+                        result = await aisGet(`/v1/agents/${agentId}/memory?${params}`, token);
+                        break;
+                    }
+                    case 'whoami':
+                        parseEmptyToolArgs(rawArgs);
+                        result = await aisGet(`/v1/agents/${agentId}`, token);
+                        break;
+                    case 'full_context':
+                        parseEmptyToolArgs(rawArgs);
+                        result = await aisGet(`/v1/agents/${agentId}/full-context`, token);
+                        break;
+                    case 'dream':
+                        parseEmptyToolArgs(rawArgs);
+                        result = await aisPost(`/v1/agents/${agentId}/dream`, {}, token);
+                        break;
+                    case 'handoff': {
+                        const handoffArgs = parseHandoffArgs(rawArgs);
+                        result = await aisPost(`/v1/agents/${agentId}/handoff`, {
+                            summary: handoffArgs.summary ?? 'Session ended',
+                            keyLearnings: handoffArgs.keyLearnings ?? [],
+                        }, token);
+                        break;
                     }
-                    const target = await resolveAgentForLoad(token, query);
-                    agentId = target.id;
-                    // Persist the switch so subsequent tool calls use the new agent.
-                    if (creds) {
-                        creds = { ...creds, agentId };
+                    case 'agent_load': {
+                        const { query } = parseAgentLoadArgs(rawArgs);
+                        const target = await resolveAgentForLoad(token, query);
+                        agentId = target.id;
+                        // Persist the switch so subsequent tool calls use the new agent.
+                        if (creds) {
+                            creds = { ...creds, agentId };
+                        }
+                        agentContext = await hydrateIdentity(AIS_URL, agentId, token);
+                        applyMemoryRefresh(agentId, token);
+                        server.notification({ method: 'notifications/prompts/list_changed' });
+                        stderr(`agent_load: switched to "${target.name}" (${target.id})`);
+                        result = {
+                            success: true,
+                            agentId: target.id,
+                            name: target.name,
+                            did: agentContext?.identity.did ?? null,
+                            status: target.status,
+                            memoriesLoaded: agentContext?.recentMemories.length ?? 0,
+                            goalsLoaded: agentContext?.goals.length ?? 0,
+                        };
+                        break;
                     }
-                    agentContext = await hydrateIdentity(AIS_URL, agentId, token);
-                    server.notification({ method: 'notifications/prompts/list_changed' });
-                    stderr(`agent_load: switched to "${target.name}" (${target.id})`);
-                    result = {
-                        success: true,
-                        agentId: target.id,
-                        name: target.name,
-                        did: agentContext?.identity.did ?? null,
-                        status: target.status,
-                        memoriesLoaded: agentContext?.recentMemories.length ?? 0,
-                        goalsLoaded: agentContext?.goals.length ?? 0,
-                    };
-                    break;
+                    default:
+                        emitTelemetry({
+                            event: 'tool.call',
+                            tool: name,
+                            agentIdHash: hashAgentId(agentId),
+                            latencyMs: Date.now() - toolStartedAt,
+                            status: 'error',
+                            error: `Unknown tool: ${name}`,
+                        });
+                        return UNKNOWN_TOOL;
                 }
-                default:
-                    return {
-                        content: [{ type: 'text', text: JSON.stringify({ error: `Unknown tool: ${name}` }) }],
-                        isError: true,
-                    };
+                return result;
+            };
+            let result = await dispatchTool(await ensureCredentials());
+            if (isAuthErrorResult(result)) {
+                // CORBOT-A5BBD580: the server rejected our token mid-session
+                // (expired or secret rotated). Clear the cached creds, silently
+                // re-auth (key auth when a key file exists), and retry once.
+                stderr('AIS rejected the cached token; re-authenticating and retrying once...');
+                creds = null;
+                result = await dispatchTool(await ensureCredentials());
             }
+            if (result === UNKNOWN_TOOL) {
+                return {
+                    content: [{ type: 'text', text: JSON.stringify({ error: `Unknown tool: ${name}` }) }],
+                    isError: true,
+                };
+            }
+            emitTelemetry({
+                event: 'tool.call',
+                tool: name,
+                agentIdHash: creds ? hashAgentId(creds.agentId) : undefined,
+                latencyMs: Date.now() - toolStartedAt,
+                status: 'ok',
+            });
             return {
                 content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
             };
         }
         catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
+            const agentHash = creds ? hashAgentId(creds.agentId) : undefined;
+            emitTelemetry({
+                event: 'tool.call',
+                tool: name,
+                agentIdHash: agentHash,
+                latencyMs: Date.now() - toolStartedAt,
+                status: 'error',
+                error: message,
+            });
             // BondPendingError carries human-readable text that the agent should
             // render verbatim — return as plain text rather than JSON.
             if (error instanceof BondPendingError) {