aismemory 0.6.1 → 0.7.0

package/dist/__tests__/token-manager.test.js

@@ -0,0 +1,253 @@
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { hasEnrolledKey } from '../key-auth.js';
+import { createTokenManager, AisUnreachableError } from '../token-manager.js';
+describe('hasEnrolledKey', () => {
+    it('false for empty dir, true for one v1 key, false for two keys', () => {
+        const dir = mkdtempSync(join(tmpdir(), 'ais-keys-'));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(false);
+        writeFileSync(join(dir, 'a.json'), JSON.stringify({ version: 1, userId: 'u', userDid: 'd', keyType: 'Ed25519', privateKey: 'x', publicKey: 'y', publicKeyJwk: {}, createdAt: 'now' }));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(true);
+        writeFileSync(join(dir, 'b.json'), JSON.stringify({ version: 1 }));
+        expect(hasEnrolledKey({ keysDir: dir })).toBe(false);
+    });
+});
+/**
+ * Controllable `authenticate` test double. Starts in 'ok' mode returning
+ * sequential tokens (t1, t2, t3, ...), each with a 1h TTL computed from the
+ * current (possibly fake) clock at call time. `setMode('fail')` makes every
+ * subsequent call reject until switched back.
+ */
+function createAuthMock() {
+    let mode = 'ok';
+    let tokenIndex = 0;
+    let callCount = 0;
+    const fn = vi.fn(async () => {
+        callCount++;
+        if (mode === 'fail') {
+            throw new Error(`auth-failed-${callCount}`);
+        }
+        tokenIndex++;
+        return { token: `t${tokenIndex}`, expiresAt: new Date(Date.now() + 3_600_000).toISOString() };
+    });
+    return { fn, calls: () => callCount, setMode: (m) => { mode = m; } };
+}
+function createIdentityMock() {
+    let callCount = 0;
+    const fn = vi.fn(async () => {
+        callCount++;
+        return { agentId: 'agent-1', tenantId: 'tenant-1' };
+    });
+    return { fn, calls: () => callCount };
+}
+/**
+ * Advances fake timers in small steps until `predicate()` is true, so
+ * jittered backoff delays never need hand-calculated exact totals.
+ */
+async function advanceUntil(predicate, stepMs = 50_000, maxSteps = 200) {
+    for (let i = 0; i < maxSteps; i++) {
+        if (predicate())
+            return;
+        await vi.advanceTimersByTimeAsync(stepMs);
+    }
+    if (!predicate()) {
+        throw new Error(`advanceUntil: condition not met after ${maxSteps * stepMs}ms`);
+    }
+}
+describe('createTokenManager', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+    it('bullet 1: first getCredentials() authenticates + resolves identity; concurrent callers share one in-flight acquire', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const [c1, c2] = await Promise.all([mgr.getCredentials(), mgr.getCredentials()]);
+        expect(auth.calls()).toBe(1);
+        expect(identity.calls()).toBe(1);
+        expect(c1).toEqual(c2);
+        expect(c1.token).toBe('t1');
+        expect(c1.agentId).toBe('agent-1');
+        expect(c1.tenantId).toBe('tenant-1');
+        mgr.stop();
+    });
+    it('bullet 2: renews at 75% of TTL, swaps token/expiresAt in place, does not re-resolve identity', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const first = await mgr.getCredentials();
+        expect(first.token).toBe('t1');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% of the 1h TTL
+        expect(auth.calls()).toBe(2);
+        const second = await mgr.getCredentials();
+        expect(second.token).toBe('t2');
+        expect(identity.calls()).toBe(1); // identity resolved only on first acquire
+        expect(second.agentId).toBe('agent-1');
+        expect(second.tenantId).toBe('tenant-1');
+        mgr.stop();
+    });
+    it('bullet 3: renewal failure retries with backoff, emits renew.retry, and keeps returning the current token', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        await mgr.getCredentials(); // acquire t1 (call #1)
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // trips the 75%-TTL renewal → call #2 fails
+        expect(auth.calls()).toBe(2);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(1);
+        // Current token (t1) is still returned; it has not hit hard expiry yet.
+        await expect(mgr.getCredentials()).resolves.toMatchObject({ token: 't1' });
+        await vi.advanceTimersByTimeAsync(6_500); // 5s backoff ± 20% jitter → next retry fires
+        expect(auth.calls()).toBe(3);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(2);
+        mgr.stop();
+    });
+    it('bullet 4: after hard expiry getCredentials() rejects with AisUnreachableError (retries continue; first success recovers with no restart)', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        await mgr.getCredentials(); // acquire t1, expiresAt = start + 1h
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% TTL → first failed renewal (call #2)
+        // Advance, in small steps, through repeated backoff retries (capped at
+        // 300s ± 20% jitter) until the token hard-expires and the event fires.
+        await advanceUntil(() => events.some((e) => e.event === 'renew.hard_expiry'));
+        expect(events.filter((e) => e.event === 'renew.hard_expiry')).toHaveLength(1);
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        await expect(mgr.getCredentials()).rejects.toThrow('AIS unreachable');
+        await expect(mgr.getCredentials()).rejects.toThrow('no action needed');
+        // hard_expiry must fire only once per outage even as failures continue —
+        // advance through at least one more capped-backoff retry attempt.
+        await vi.advanceTimersByTimeAsync(400_000);
+        expect(events.filter((e) => e.event === 'renew.hard_expiry')).toHaveLength(1);
+        // First success after the outage recovers getCredentials() with no restart
+        // (same manager instance; identity resolved only on the very first acquire).
+        const callsBeforeRecovery = auth.calls();
+        auth.setMode('ok');
+        await advanceUntil(() => auth.calls() > callsBeforeRecovery);
+        const recovered = await mgr.getCredentials();
+        expect(recovered.token).not.toBe('t1');
+        expect(recovered.agentId).toBe('agent-1');
+        expect(identity.calls()).toBe(1);
+        mgr.stop();
+    });
+    it('bullet 5: stop() clears all timers so no further renewal attempts occur', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await mgr.getCredentials();
+        expect(auth.calls()).toBe(1);
+        mgr.stop();
+        await vi.advanceTimersByTimeAsync(3_600_000); // well past the 75%-TTL renewal point
+        expect(auth.calls()).toBe(1);
+    });
+    it('reliability fix: sequential getCredentials() calls during an outage share one backoff window instead of each hammering authenticate()', async () => {
+        const auth = createAuthMock();
+        auth.setMode('fail'); // AIS is down from the very first call — no successful acquire ever happens
+        const identity = createIdentityMock();
+        const events = [];
+        const mgr = createTokenManager({
+            authenticate: auth.fn,
+            resolveIdentity: identity.fn,
+            onEvent: (event, detail) => events.push({ event, detail }),
+        });
+        // N sequential (not concurrent) calls in quick succession — no time
+        // advances between them, mirroring a single MCP chat turn bursting
+        // several tool calls while AIS is unreachable.
+        const N = 5;
+        for (let i = 0; i < N; i++) {
+            await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        }
+        // Exactly one authenticate() attempt for the whole burst, not N.
+        expect(auth.calls()).toBe(1);
+        expect(events.filter((e) => e.event === 'renew.retry')).toHaveLength(1);
+        // After the backoff window (5s ± 20% jitter) elapses and the server
+        // heals, a getCredentials() call attempts again and succeeds.
+        auth.setMode('ok');
+        await vi.advanceTimersByTimeAsync(6_500);
+        const recovered = await mgr.getCredentials();
+        expect(recovered.agentId).toBe('agent-1');
+        expect(auth.calls()).toBe(2);
+        mgr.stop();
+    });
+    it('invalidate(): forces a fresh acquire, and the new token reschedules renewal from its own expiry (not the invalidated token\'s old schedule)', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        const first = await mgr.getCredentials(); // T=0: acquires t1, expires T=3_600_000
+        expect(first.token).toBe('t1');
+        expect(auth.calls()).toBe(1);
+        // Let time pass before invalidating so t1's original 75%-TTL renewal
+        // slot (T=2_700_000) and t2's fresh slot (computed from whenever the
+        // re-acquire actually happens) are measurably different.
+        await vi.advanceTimersByTimeAsync(100_000); // T=100_000
+        mgr.invalidate();
+        const second = await mgr.getCredentials(); // re-acquires t2 at T=100_000, expires T=3_700_000
+        expect(second.token).toBe('t2');
+        expect(auth.calls()).toBe(2);
+        expect(identity.calls()).toBe(1); // identity still resolved only once — invalidate() doesn't touch that
+        // t1's OLD renewal slot (absolute T=2_700_000) must not fire — it was
+        // superseded when the re-acquire rescheduled renewal off t2's expiry.
+        await vi.advanceTimersByTimeAsync(2_600_000); // now T=2_700_000
+        expect(auth.calls()).toBe(2);
+        // t2's OWN 75%-TTL slot (T=100_000 acquire + 2_700_000 = T=2_800_000) fires here.
+        await vi.advanceTimersByTimeAsync(100_000); // now T=2_800_000
+        expect(auth.calls()).toBe(3);
+        mgr.stop();
+    });
+    it('invalidate() during an active backoff window does not bypass the gate — the next getCredentials() still rejects fast', async () => {
+        const auth = createAuthMock();
+        const identity = createIdentityMock();
+        const mgr = createTokenManager({ authenticate: auth.fn, resolveIdentity: identity.fn });
+        await mgr.getCredentials(); // acquire t1 (call #1)
+        auth.setMode('fail');
+        await vi.advanceTimersByTimeAsync(2_700_000); // 75% TTL -> renewal fails (call #2), backoff window opens
+        expect(auth.calls()).toBe(2);
+        // t1 is still time-valid (not hard-expired) at this point — without
+        // invalidate(), getCredentials() would just return it via the fast path
+        // without ever touching the backoff gate. invalidate() drops it so the
+        // gate is exercised, but must NOT reset retryDelayMs/lastAttemptAt.
+        mgr.invalidate();
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(auth.calls()).toBe(2); // gated — no extra authenticate() attempt inside the window
+        mgr.stop();
+    });
+    it('acquire(): a non-finite expiresAt from authenticate() rejects instead of scheduling a near-zero renewal loop', async () => {
+        const identity = createIdentityMock();
+        let authCalls = 0;
+        const badAuth = vi.fn(async () => {
+            authCalls++;
+            return { token: 'bad-token', expiresAt: 'garbage' };
+        });
+        const mgr = createTokenManager({ authenticate: badAuth, resolveIdentity: identity.fn });
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(1);
+        // If the bad expiresAt had scheduled a renewal timer, its NaN-derived
+        // delay would tight-loop. Instead: the very next call, made with no
+        // time advance, must be gated by the normal backoff window rather than
+        // firing a second authenticate() attempt immediately.
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(1);
+        // Only after the backoff window elapses does a second attempt happen.
+        await vi.advanceTimersByTimeAsync(6_500);
+        await expect(mgr.getCredentials()).rejects.toBeInstanceOf(AisUnreachableError);
+        expect(authCalls).toBe(2);
+        mgr.stop();
+    });
+});
+//# sourceMappingURL=token-manager.test.js.map

package/dist/__tests__/token-manager.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.test.js","sourceRoot":"","sources":["../../src/__tests__/token-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvL,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAWH;;;;;GAKG;AACH,SAAS,cAAc;IAKrB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAyB,EAAE;QAC/C,SAAS,EAAE,CAAC;QACZ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,eAAe,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB;IAIzB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,SAAwB,EACxB,MAAM,GAAG,MAAM,EACf,QAAQ,GAAG,GAAG;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,SAAS,EAAE;YAAE,OAAO;QACxB,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oHAAoH,EAAE,KAAK,IAAI,EAAE;QAClI,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAEjF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAErC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;QAElE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;QAC5E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;QACxH,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,uBAAuB;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,4CAA4C;QAC1F,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,wEAAwE;QACxE,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,6CAA6C;QACvF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0IAA0I,EAAE,KAAK,IAAI,EAAE;QACxJ,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,qCAAqC;QACjE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C;QAEzF,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC;QAE9E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAEvE,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE9E,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,mBAAmB,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjC,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAsC;QAEpF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uIAAuI,EAAE,KAAK,IAAI,EAAE;QACrJ,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,4EAA4E;QAClG,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,MAAM,GAA8C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,kBAAkB,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,eAAe,EAAE,QAAQ,CAAC,EAAE;YAC5B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAC3D,CAAC,CAAC;QAEH,oEAAoE;QACpE,mEAAmE;QACnE,+CAA+C;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,iEAAiE;QACjE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAExE,oEAAoE;QACpE,8DAA8D;QAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6IAA6I,EAAE,KAAK,IAAI,EAAE;QAC3J,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,wCAAwC;QAClF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,qEAAqE;QACrE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;QAExD,GAAG,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,mDAAmD;QAC9F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,sEAAsE;QAExG,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB;QAChE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,kFAAkF;QAClF,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sHAAsH,EAAE,KAAK,IAAI,EAAE;QACpI,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,uBAAuB;QACnD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,2DAA2D;QACzG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE7B,oEAAoE;QACpE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,GAAG,CAAC,UAAU,EAAE,CAAC;QAEjB,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,4DAA4D;QAE1F,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8GAA8G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAmD,EAAE;YAC9E,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,sEAAsE;QACtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1B,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/token-rejection-reauth-e2e.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/token-rejection-reauth-e2e.test.js

@@ -0,0 +1,219 @@
+/**
+ * Final-review wave (2026-08-24) — CRITICAL fix: `TokenManager.invalidate()`
+ * wired to the mid-session 401 branch.
+ *
+ * Reproduces the JWT_SECRET-rotation scenario (CORBOT-A5BBD580): AIS
+ * rejects a token that is still time-valid from the client's point of view
+ * (e.g. the server rotated its signing secret). Before this fix,
+ * `ensureCredentials`'s key-enrolled path cleared the outer `creds` variable
+ * on a 401 but re-read the SAME rejected token straight back out of the
+ * TokenManager's `current` (still time-valid, so `getCredentials()` returned
+ * it via the fast path) — the "retry" was a no-op that re-sent the exact
+ * token AIS had just rejected. `tokenManager.invalidate()` drops `current`
+ * so the retry's `ensureCredentials()` call actually re-runs challenge/prove.
+ *
+ * Also covers the companion Fix 3 (restored `auth.key.success` telemetry +
+ * the one-line stderr confirmation on the first successful key-enrolled
+ * acquire): asserts both appear exactly once across a session that spans
+ * multiple tool calls and one forced re-auth.
+ *
+ * Follows the fake-AIS + spawned-built-binary pattern of
+ * silent-renewal-e2e.test.ts / agent-load-session-override-e2e.test.ts.
+ * `isAuthErrorResult` (src/auth-staleness.ts) is what detects the 401 body
+ * below — it requires `{ success: false, error: { code: 'TOKEN_EXPIRED' |
+ * 'INVALID_TOKEN' } }`, so the fake server's rejection body matches that
+ * shape exactly.
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'path';
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { generateAndSaveKeypair } from '../key-auth.js';
+// Long enough that the TokenManager's 75%-of-TTL background renewal never
+// fires during this short test — the retry the test exercises must be
+// driven purely by the mid-session 401, not by an incidental renewal.
+const LONG_TTL_MS = 60_000;
+let proveCalls = 0;
+/** GET /v1/agents/agent-1 (exact path) call count — the whoami data call. */
+let agentGetCalls = 0;
+function mintJwt() {
+    const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
+    const payload = Buffer.from(JSON.stringify({ sub: 'user-1', user_id: 'user-1', tenant_id: 'tenant-1', call: proveCalls })).toString('base64url');
+    return `${header}.${payload}.fakesig-${proveCalls}`;
+}
+describe('mid-session 401 (server-rejected, still-time-valid token) forces a real re-auth', () => {
+    let fakeAis;
+    let port = 0;
+    beforeAll(async () => {
+        fakeAis = createServer((req, res) => {
+            req.on('data', () => { });
+            req.on('end', () => {
+                const url = req.url ?? '';
+                if (url === '/v1/auth/challenge' && req.method === 'POST') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { nonce: 'test-nonce', exp: Math.floor(Date.now() / 1000) + 60, hmac: 'test-hmac' },
+                    }));
+                    return;
+                }
+                if (url === '/v1/auth/did-prove' && req.method === 'POST') {
+                    proveCalls += 1;
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: { bearerToken: mintJwt(), expiresAt: new Date(Date.now() + LONG_TTL_MS).toISOString() },
+                    }));
+                    return;
+                }
+                if (url.startsWith('/v1/agents') && !url.includes('/v1/agents/agent-') && req.method === 'GET') {
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({
+                        success: true,
+                        data: {
+                            agents: [{ id: 'agent-1', name: 'Agent1', status: 'active' }],
+                            pagination: { total: 1, page: 1, limit: 100, hasMore: false },
+                        },
+                    }));
+                    return;
+                }
+                if (url === '/v1/agents/agent-1' && req.method === 'GET') {
+                    agentGetCalls += 1;
+                    // Reject exactly the SECOND data call — simulates AIS rejecting a
+                    // still-time-valid token mid-session (e.g. JWT_SECRET rotation).
+                    // The first call (initial whoami) and every call after the forced
+                    // re-auth succeed normally.
+                    if (agentGetCalls === 2) {
+                        res.writeHead(401, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ success: false, error: { code: 'TOKEN_EXPIRED', message: 'token rejected' } }));
+                        return;
+                    }
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ success: true, data: { id: 'agent-1', name: 'Agent1', status: 'active' } }));
+                    return;
+                }
+                // Hydration / memory refresh / handoff / resolve / key-enroll — generic success.
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ success: true, data: {} }));
+            });
+        });
+        await new Promise((r) => {
+            fakeAis.listen(0, '127.0.0.1', () => {
+                const addr = fakeAis.address();
+                if (addr && typeof addr === 'object')
+                    port = addr.port;
+                r();
+            });
+        });
+    });
+    afterAll(async () => {
+        await new Promise((r) => fakeAis?.close(() => r()));
+    });
+    it('re-proves and the retried tool call succeeds; auth.key.success + its stderr line fire exactly once', async () => {
+        const distPath = resolve(__dirname, '..', '..', 'dist', 'index.js');
+        if (!existsSync(distPath)) {
+            throw new Error(`dist/index.js missing — run \`pnpm build\` first (looked at ${distPath})`);
+        }
+        proveCalls = 0;
+        agentGetCalls = 0;
+        const fakeHome = mkdtempSync(join(tmpdir(), 'aismem-token-rejection-'));
+        const aismemDir = join(fakeHome, '.aismemory');
+        mkdirSync(aismemDir, { recursive: true });
+        await generateAndSaveKeypair({
+            userId: 'user-1',
+            userDid: 'did:web:test:users:user-1',
+            keysDir: join(aismemDir, 'keys'),
+        });
+        let proc = null;
+        try {
+            proc = spawn('node', [distPath], {
+                env: { ...process.env, HOME: fakeHome, AIS_URL: `http://127.0.0.1:${port}`, AISMEMORY_TELEMETRY: '1' },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            proc.stdout.on('data', (d) => { stdoutBuf += d.toString(); });
+            proc.stderr.on('data', (d) => { stderrBuf += d.toString(); });
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 1, method: 'initialize',
+                params: { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'token-rejection-test', version: '0.0.0' } },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":1'), 5000, 'initialize response');
+            // ── whoami #1: establishes the manager's first acquire; ok. ──
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":2'), 15000, 'first whoami');
+            expect(extractResponseText(stdoutBuf, 2)).toContain('agent-1');
+            expect(proveCalls).toBe(1);
+            expect(agentGetCalls).toBe(1);
+            // ── whoami #2: the fake server rejects this data call with a
+            // TOKEN_EXPIRED 401 even though the token is still time-valid. The
+            // client must invalidate() the manager, re-prove, and retry the tool
+            // call once — succeeding transparently in the SAME response. ──
+            proc.stdin.write(JSON.stringify({
+                jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'whoami', arguments: {} },
+            }) + '\n');
+            await waitFor(() => stdoutBuf.includes('"id":3'), 15000, 'whoami after server-side rejection');
+            const retriedText = extractResponseText(stdoutBuf, 3);
+            expect(retriedText).toContain('agent-1');
+            expect(retriedText).not.toContain('error');
+            // The rejection forced a real re-prove — not a no-op retry of the
+            // same rejected token — and the underlying data call was attempted a
+            // third time (2nd = rejected, 3rd = succeeded with the new token).
+            expect(proveCalls).toBe(2);
+            expect(agentGetCalls).toBe(3);
+            // The existing re-auth-and-retry log line fired exactly once.
+            const retryLogHits = stderrBuf.split('AIS rejected the cached token; re-authenticating and retrying once...').length - 1;
+            expect(retryLogHits).toBe(1);
+            // ── Fix 3: auth.key.success + its stderr confirmation fire on the
+            // FIRST successful key-enrolled acquire only — not again on the
+            // forced re-auth triggered by the 401 retry. ──
+            const stderrConfirmationHits = stderrBuf.split('Authenticated via DID key auth (no browser required)').length - 1;
+            expect(stderrConfirmationHits).toBe(1);
+            const telemetryKeySuccessHits = stderrBuf
+                .split('\n')
+                .filter((line) => line.includes('[aismemory-telemetry]') && line.includes('"auth.key.success"'))
+                .length;
+            expect(telemetryKeySuccessHits).toBe(1);
+        }
+        finally {
+            proc?.kill();
+            rmSync(fakeHome, { recursive: true, force: true });
+        }
+    }, 30000);
+});
+function waitFor(predicate, ms, label) {
+    return new Promise((resolveOuter, reject) => {
+        const start = Date.now();
+        const tick = () => {
+            if (predicate()) {
+                resolveOuter();
+                return;
+            }
+            if (Date.now() - start > ms) {
+                reject(new Error(`timeout waiting for ${label}`));
+                return;
+            }
+            setTimeout(tick, 50);
+        };
+        tick();
+    });
+}
+function extractResponseText(buf, id) {
+    for (const line of buf.split('\n')) {
+        if (!line.includes(`"id":${id}`))
+            continue;
+        try {
+            const parsed = JSON.parse(line);
+            const text = parsed.result?.content?.[0]?.text;
+            if (typeof text === 'string')
+                return text;
+        }
+        catch { /* malformed line; skip */ }
+    }
+    return '';
+}
+//# sourceMappingURL=token-rejection-reauth-e2e.test.js.map

package/dist/__tests__/token-rejection-reauth-e2e.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-rejection-reauth-e2e.test.js","sourceRoot":"","sources":["../../src/__tests__/token-rejection-reauth-e2e.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,0EAA0E;AAC1E,sEAAsE;AACtE,sEAAsE;AACtE,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,6EAA6E;AAC7E,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9F,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,GAAG,MAAM,IAAI,OAAO,YAAY,UAAU,EAAE,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,iFAAiF,EAAE,GAAG,EAAE;IAC/F,IAAI,OAA2B,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,OAAO,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACnE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAoD,CAAC,CAAC,CAAC;YAC3E,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;gBAE1B,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;qBAC1F,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1D,UAAU,IAAI,CAAC,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE;qBAC9F,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC/F,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE;4BACJ,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;4BAC7D,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;yBAC9D;qBACF,CAAC,CAAC,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzD,aAAa,IAAI,CAAC,CAAC;oBACnB,kEAAkE;oBAClE,iEAAiE;oBACjE,kEAAkE;oBAClE,4BAA4B;oBAC5B,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;wBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;wBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;wBACzG,OAAO;oBACT,CAAC;oBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;oBACtG,OAAO;gBACT,CAAC;gBAED,iFAAiF;gBACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE;YAC5B,OAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACnC,MAAM,IAAI,GAAG,OAAQ,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvD,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;QAClH,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,QAAQ,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,UAAU,GAAG,CAAC,CAAC;QACf,aAAa,GAAG,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,sBAAsB,CAAC;YAC3B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,2BAA2B;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,IAAI,GAA0C,IAAI,CAAC;QACvD,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE;gBACtG,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,SAAS,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY;gBAC3C,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;aAC5H,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAE/E,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aACvF,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;YACzE,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,8DAA8D;YAC9D,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;aACvF,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;YAC/F,MAAM,WAAW,GAAG,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE3C,kEAAkE;YAClE,qEAAqE;YACrE,mEAAmE;YACnE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE9B,8DAA8D;YAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACzH,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE7B,mEAAmE;YACnE,gEAAgE;YAChE,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,SAAS,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAClH,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEvC,MAAM,uBAAuB,GAAG,SAAS;iBACtC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;iBAC/F,MAAM,CAAC;YACV,MAAM,CAAC,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,IAAI,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,SAAwB,EAAE,EAAU,EAAE,KAAa;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAS,EAAE;YACtB,IAAI,SAAS,EAAE,EAAE,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC3F,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,EAAU;IAClD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwD,CAAC;YACvF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/agent-preference.d.ts

@@ -0,0 +1,24 @@
+export interface AgentPreference {
+    schemaVersion: 2;
+    agentId: string;
+    tenantId: string;
+}
+/**
+ * Persist agent preference (schemaVersion + ids, no secrets) under
+ * ~/.aismemory/credentials.json with restrictive POSIX permissions
+ * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ */
+export declare function saveAgentPreference(pref: {
+    agentId: string;
+    tenantId: string;
+}, home?: string): void;
+/**
+ * Load agent preference from ~/.aismemory/credentials.json.
+ * Handles both v2 files (agentId/tenantId only) and legacy v1 files
+ * (token/agentId/tenantId/expiresAt) — returns ids only.
+ * Returns null if file is missing or corrupt.
+ */
+export declare function loadAgentPreference(home?: string): {
+    agentId: string;
+    tenantId: string;
+} | null;

package/dist/agent-preference.js

@@ -0,0 +1,51 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { credentialsDir, credentialsFilePath } from './oauth-credentials.js';
+/**
+ * Persist agent preference (schemaVersion + ids, no secrets) under
+ * ~/.aismemory/credentials.json with restrictive POSIX permissions
+ * (dir 0700, file 0600). Replaces legacy token-based persistence.
+ */
+export function saveAgentPreference(pref, home = homedir()) {
+    const dir = credentialsDir(home);
+    const file = credentialsFilePath(home);
+    // Create directory with restrictive permissions (0700)
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Write the file with schemaVersion + ids (no legacy token/expiresAt)
+    const data = {
+        schemaVersion: 2,
+        agentId: pref.agentId,
+        tenantId: pref.tenantId,
+    };
+    writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });
+    // chmod is the reliable path on POSIX
+    if (process.platform !== 'win32') {
+        chmodSync(file, 0o600);
+    }
+}
+/**
+ * Load agent preference from ~/.aismemory/credentials.json.
+ * Handles both v2 files (agentId/tenantId only) and legacy v1 files
+ * (token/agentId/tenantId/expiresAt) — returns ids only.
+ * Returns null if file is missing or corrupt.
+ */
+export function loadAgentPreference(home = homedir()) {
+    const file = credentialsFilePath(home);
+    try {
+        if (!existsSync(file))
+            return null;
+        const content = readFileSync(file, 'utf-8');
+        const parsed = JSON.parse(content);
+        // Extract agentId and tenantId, ignoring any other fields (like token)
+        const agentId = parsed.agentId;
+        const tenantId = parsed.tenantId;
+        if (typeof agentId === 'string' && typeof tenantId === 'string') {
+            return { agentId, tenantId };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=agent-preference.js.map

package/dist/agent-preference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-preference.js","sourceRoot":"","sources":["../src/agent-preference.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQ7E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA2C,EAC3C,OAAe,OAAO,EAAE;IAExB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEvC,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,sEAAsE;IACtE,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpE,sCAAsC;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,OAAO,EAAE;IAI1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAE9D,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,4 +7,15 @@
  *
  * Usage: npx aismemory
  */
+type AgentSummary = {
+    id: string;
+    name: string;
+    status: string;
+};
+/**
+ * Fetch EVERY agent in the tenant, following server pagination.
+ * The server defaults to limit=20 and silently truncates (2026-08-24
+ * lockout, ticket 72ab7f4e) — never call GET /v1/agents without this.
+ */
+export declare function listAllAgents(token: string): Promise<AgentSummary[]>;
 export {};