fraim 2.0.353 → 2.0.354

package/dist/src/config/feature-flags.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getFeatureFlags = getFeatureFlags;
 exports.isPersonaEntitlementsEnabled = isPersonaEntitlementsEnabled;
+exports.isShowTokenCostEnabled = isShowTokenCostEnabled;
 exports.getPublicFeatureFlags = getPublicFeatureFlags;
 function parseBooleanFlag(value) {
     if (!value)
@@ -18,6 +19,9 @@ function getFeatureFlags() {
 function isPersonaEntitlementsEnabled() {
     return getFeatureFlags().personaEntitlements.enabled;
 }
+function isShowTokenCostEnabled() {
+    return parseBooleanFlag(process.env.FRAIM_FF_SHOW_TOKEN_COST);
+}
 function getPublicFeatureFlags() {
     return {
         personaEntitlementsEnabled: isPersonaEntitlementsEnabled()

package/dist/src/fraim/db-service.js

@@ -188,6 +188,10 @@ class FraimDbService {
         await this.sessionsCollection.createIndex({ sessionId: 1 }, { unique: true });
         await this.sessionsCollection.createIndex({ userId: 1 });
         await this.sessionsCollection.createIndex({ lastActive: -1 });
+        // Issue #2093 — getActiveSessionByApiKey no longer bounds its match by recency, so a
+        // long-lived user's full session history is a candidate. This compound index keeps that
+        // lookup an indexed scan with an ordered result instead of a fetch-then-sort in memory.
+        await this.sessionsCollection.createIndex({ userId: 1, lastActive: -1 });
         await this.signupsCollection.createIndex({ email: 1 }, { unique: true });
         await this.signupsCollection.createIndex({ timestamp: -1 });
         await this.salesCollection.createIndex({ email: 1 });
@@ -344,17 +348,21 @@ class FraimDbService {
         // Preserve the stored credential and its history; auth checks the current entitlement.
         return paid || credential;
     }
+    /**
+     * Most recently active session for the key's owner, at any age.
+     *
+     * Issue #2093 — a FRAIM work session has no lifetime. Elapsed time must never make an
+     * existing, owned session unresolvable, so this lookup filters on ownership only and
+     * leaves recency to the sort. Access is still bounded by `verifyApiKey`: an unknown,
+     * revoked or suspended credential resolves nothing.
+     */
     async getActiveSessionByApiKey(key) {
         if (!this.keysCollection || !this.sessionsCollection)
             throw new Error('DB not connected');
-        // 1. Get user for this key
         const apiKeyData = await this.verifyApiKey(key);
         if (!apiKeyData)
             return null;
-        // 2. Get latest session for this user (within last 24h)
-        const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
-        const session = await this.sessionsCollection.findOne({ userId: apiKeyData.userId, lastActive: { $gt: dayAgo } }, { sort: { lastActive: -1 } });
-        return session;
+        return this.sessionsCollection.findOne({ userId: apiKeyData.userId }, { sort: { lastActive: -1 } });
     }
     async getSessionByApiKeyAndSessionId(key, sessionId) {
         if (!this.keysCollection || !this.sessionsCollection)
@@ -364,11 +372,17 @@ class FraimDbService {
             return null;
         return this.getSessionByUserIdAndSessionId(apiKeyData.userId, sessionId);
     }
+    /**
+     * Exact session lookup scoped to its owner, at any age.
+     *
+     * Issue #2093 — resuming a session after days, months or years must return the original
+     * record so the run keeps its job, phase and review state. `userId` remains the only
+     * eligibility condition, so another account still cannot reach this session.
+     */
     async getSessionByUserIdAndSessionId(userId, sessionId) {
         if (!this.sessionsCollection)
             throw new Error('DB not connected');
-        const dayAgo = new Date(Date.now() - 24 * 60 * 60 * 1000);
-        return this.sessionsCollection.findOne({ sessionId, userId, lastActive: { $gt: dayAgo } });
+        return this.sessionsCollection.findOne({ sessionId, userId });
     }
     async createAuthSession(input) {
         if (!this.authSessionsCollection)

package/dist/src/services/mcp-service.js

@@ -137,7 +137,9 @@ class McpService {
             else if (method === 'fraim/session/validate') {
                 const sessionId = typeof params?.sessionId === 'string' ? params.sessionId.trim() : '';
                 if (!sessionId || !context.userId || !(await this.dbService.getSessionByUserIdAndSessionId(context.userId, sessionId))) {
-                    const error = new Error('FRAIM session is missing, expired, or invalid. Call fraim_connect again.');
+                    // Issue #2093 — sessions do not expire, so the rejection names the two
+                    // causes that remain: the session is unknown, or it belongs elsewhere.
+                    const error = new Error('FRAIM session is unknown or not accessible with this account. Call fraim_connect again.');
                     error.code = -32001;
                     throw error;
                 }

package/dist/src/services/usage-analytics-service.js

@@ -306,19 +306,21 @@ class UsageAnalyticsService {
         await this.logUsage(mentoringEvent);
     }
     /**
-     * Validate that a jobId exists for the user (check recent usage events)
+     * Validate that this user started this jobId, regardless of how long ago.
      */
     async validateJobId(jobId, userId) {
         try {
-            // Check if there's a recent job start event for this jobId and user
-            const recentEvents = await this.dbService.getDb();
-            const collection = recentEvents.collection('fraim_usage_events');
+            // Issue #2093 — a run resumed days or months later is still the same job, so
+            // this match is on job identity and ownership only. Adding an age condition
+            // here would silently drop analytics for exactly the long-gap resumes that
+            // the session fix is meant to support.
+            const events = await this.dbService.getDb();
+            const collection = events.collection('fraim_usage_events');
             const jobStartEvent = await collection.findOne({
                 jobId,
                 userId,
                 type: 'job',
-                'args.action': 'start',
-                createdAt: { $gte: new Date(Date.now() - 24 * 60 * 60 * 1000) } // Within last 24 hours
+                'args.action': 'start'
             });
             return jobStartEvent !== null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.353",
+  "version": "2.0.354",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {