hiwork-core 0.0.38 → 0.0.40

package/lib/index.js

@@ -8267,7 +8267,7 @@ defineMethod("transform", [
 ], ({ inner }, isInner) => inner.toString(isInner));
 
 // src/version.ts
-var PKG_VERSION = false ? "dev" : "0.0.38";
+var PKG_VERSION = false ? "dev" : "0.0.40";
 
 // src/browser-login.ts
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -8278,6 +8278,7 @@ var API_KEY_REF = "AI_ROUTER_API_KEY";
 var SESSION_REF = "AI_ROUTER_SESSION";
 var PENDING_PASSWORD_REF = "AI_ROUTER_PENDING_PASSWORD";
 var REMEMBERED_PASSWORD_REF = "AI_ROUTER_REMEMBERED_PASSWORD";
+var REFRESH_TOKEN_REF = "AI_ROUTER_REFRESH_TOKEN";
 var PROVIDER_ROUTES = {
   "ai-router-chat": "openai-completions",
   "ai-router-anthropic": "anthropic-messages",
@@ -8435,6 +8436,7 @@ async function provisionSession(opts) {
   const displayName = opts.user.display_name?.trim() || void 0;
   const set2 = {
     ...opts.username === void 0 ? {} : { username: opts.username },
+    ...opts.sessionExpiresAt === void 0 ? {} : { sessionExpiresAt: opts.sessionExpiresAt },
     ...displayName === void 0 ? {} : { displayName },
     lastLogin: {
       at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -8600,12 +8602,15 @@ async function completeBrowserLogin(input, opts) {
     }
     const baseURL = opts.value.baseURL;
     if (baseURL === void 0 || baseURL === "") return await failBrowserLogin(opts.state, NO_BASE_URL_ERROR, log);
-    const { sessionCookie, user } = await opts.gateway.exchangeCode({
+    const { sessionCookie, user, sessionExpiresAt, refreshToken } = await opts.gateway.exchangeCode({
       code: input.code,
       codeVerifier: pending.codeVerifier,
       deviceId: pending.deviceId
     });
     await opts.credentials.set(SESSION_REF, sessionCookie);
+    if (refreshToken === void 0) await opts.credentials.unset(REFRESH_TOKEN_REF).catch(() => {
+    });
+    else await opts.credentials.set(REFRESH_TOKEN_REF, refreshToken);
     const username = typeof user.username === "string" && user.username.trim() !== "" ? user.username.trim() : void 0;
     await provisionSession({
       gateway: opts.gateway,
@@ -8617,6 +8622,7 @@ async function completeBrowserLogin(input, opts) {
       sessionCookie,
       user,
       username,
+      sessionExpiresAt,
       requestUnset: ["browserLoginRequest", "browserLogin"],
       ...opts.defaultModel === void 0 ? {} : { defaultModel: opts.defaultModel },
       ...opts.ensureWorkspace === void 0 ? {} : { ensureWorkspace: opts.ensureWorkspace }
@@ -8647,6 +8653,13 @@ function gatewayUserAgent(version2 = desktopAppVersion()) {
 }
 
 // src/ai-router-client.ts
+var sessionActivitySink;
+function setSessionActivitySink(sink) {
+  sessionActivitySink = sink;
+}
+function clearSessionActivitySink(sink) {
+  if (sessionActivitySink === sink) sessionActivitySink = void 0;
+}
 async function knowledgeErrorCodeFromBody(res) {
   try {
     const payload = await res.clone().json();
@@ -8658,6 +8671,7 @@ async function knowledgeErrorCodeFromBody(res) {
 var AUTH_AUTHORIZE_PATH = "/api/auth/authorize";
 var AUTH_TOKEN_PATH = "/api/auth/token";
 var AUTH_SESSIONS_PATH = "/api/auth/sessions";
+var AUTH_REFRESH_PATH = "/api/auth/refresh";
 var ME_ANALYTICS_SUMMARY_PATH = "/api/me/analytics/summary";
 var ME_ANALYTICS_TRENDS_PATH = "/api/me/analytics/trends";
 var ME_ANALYTICS_MODEL_TRENDS_PATH = "/api/me/analytics/model-trends";
@@ -8758,8 +8772,16 @@ var AiRouterClient = class {
     if (res.status === 401) throw new GatewayError("AUTH_FAILED", "\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF", 401);
     if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
     if (sid === void 0) throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u767B\u5F55\u6210\u529F\u4F46\u672A\u8FD4\u56DE\u4F1A\u8BDD Cookie", res.status);
-    const user = await res.json();
-    return { sessionCookie: `session_id=${sid}`, user };
+    const { expires_at: rawExpiresAt, refresh_token: rawRefreshToken, ...user } = await res.json();
+    const bodyExpiresAt = typeof rawExpiresAt === "string" && !Number.isNaN(Date.parse(rawExpiresAt)) ? rawExpiresAt : void 0;
+    const sessionExpiresAt = bodyExpiresAt ?? parseSessionCookieExpiry(res.headers);
+    const refreshToken = typeof rawRefreshToken === "string" && rawRefreshToken !== "" ? rawRefreshToken : void 0;
+    return {
+      sessionCookie: `session_id=${sid}`,
+      user,
+      ...sessionExpiresAt === void 0 ? {} : { sessionExpiresAt },
+      ...refreshToken === void 0 ? {} : { refreshToken }
+    };
   }
   /**
    * POST /api/auth/token：用一次性 code + PKCE verifier 换取会话。
@@ -8781,7 +8803,49 @@ var AiRouterClient = class {
     if (data === void 0 || data.session_id === void 0 || data.session_id === "") {
       throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u5151\u6362\u6210\u529F\u4F46\u672A\u8FD4\u56DE\u4F1A\u8BDD\u6807\u8BC6", res.status);
     }
-    return { sessionCookie: `session_id=${data.session_id}`, user: data.user };
+    const rawExpiresAt = typeof data.expires_at === "string" ? data.expires_at : void 0;
+    const sessionExpiresAt = rawExpiresAt !== void 0 && !Number.isNaN(Date.parse(rawExpiresAt)) ? rawExpiresAt : void 0;
+    const refreshToken = typeof data.refresh_token === "string" && data.refresh_token !== "" ? data.refresh_token : void 0;
+    return {
+      sessionCookie: `session_id=${data.session_id}`,
+      user: data.user,
+      ...sessionExpiresAt === void 0 ? {} : { sessionExpiresAt },
+      ...refreshToken === void 0 ? {} : { refreshToken }
+    };
+  }
+  /**
+   * POST /api/auth/refresh：用 refresh grant 换一份新会话（M2 网关的静默重认证）。
+   *
+   * 拒绝语义必须分开，调用方据此决定「弃用 grant」还是「保留待重试」：
+   *  - 400 = grant 无效（过期 / 已被轮换 / 复用检测拒绝）→ `REFRESH_GRANT_INVALID`，本地作废；
+   *  - 404 = 老网关根本没有这条路由 → `REFRESH_GRANT_ABSENT`，本地作废且**静默降级**；
+   *  - 其余非 2xx（5xx / 反代错误页）与网络层异常 → `GATEWAY_UNREACHABLE`，grant 保留，
+   *    下次 SESSION_EXPIRED 再试。
+   *
+   * 任何日志/异常信息都不得包含 refresh_token / session_id 明文。
+   */
+  async refreshSession(refreshToken) {
+    const res = await this.requestOrUnreachable(AUTH_REFRESH_PATH, {
+      method: "POST",
+      body: { refresh_token: refreshToken }
+    });
+    if (res.status === 400) throw new GatewayError("REFRESH_GRANT_INVALID", "\u767B\u5F55\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55", 400);
+    if (res.status === 404) throw new GatewayError("REFRESH_GRANT_ABSENT", "\u7F51\u5173\u4E0D\u652F\u6301\u9759\u9ED8\u7EED\u671F", 404);
+    if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
+    const data = await readJson(res);
+    const sid = typeof data?.session_id === "string" && data.session_id !== "" ? data.session_id : extractSessionId(res.headers);
+    if (data === void 0 || data.user === void 0 || sid === void 0) {
+      throw new GatewayError("GATEWAY_UNREACHABLE", "\u7F51\u5173\u7EED\u671F\u6210\u529F\u4F46\u672A\u8FD4\u56DE\u4F1A\u8BDD\u6807\u8BC6", res.status);
+    }
+    const rawExpiresAt = typeof data.expires_at === "string" ? data.expires_at : void 0;
+    const sessionExpiresAt = rawExpiresAt !== void 0 && !Number.isNaN(Date.parse(rawExpiresAt)) ? rawExpiresAt : void 0;
+    const rotated = typeof data.refresh_token === "string" && data.refresh_token !== "" ? data.refresh_token : void 0;
+    return {
+      sessionCookie: `session_id=${sid}`,
+      user: data.user,
+      ...sessionExpiresAt === void 0 ? {} : { sessionExpiresAt },
+      ...rotated === void 0 ? {} : { refreshToken: rotated }
+    };
   }
   /** GET /api/auth/sessions：当前账号的登录设备列表。 */
   async listSessions(sessionCookie) {
@@ -9016,6 +9080,9 @@ var AiRouterClient = class {
     if (res.status === 503) {
       throw new GatewayError("MCP_ASSERTION_DISABLED", "\u672C\u90E8\u7F72\u672A\u542F\u7528 MCP \u65AD\u8A00\u7B7E\u53D1\uFF0C\u8BF7\u8054\u7CFB\u7BA1\u7406\u5458", 503);
     }
+    if (res.status === 429) {
+      throw new GatewayError("MCP_ASSERTION_RATE_LIMITED", "\u65AD\u8A00\u7B7E\u53D1\u8FC7\u4E8E\u9891\u7E41\uFF0C\u7A0D\u540E\u81EA\u52A8\u91CD\u8BD5", 429);
+    }
     if (!res.ok) throw new GatewayError("GATEWAY_UNREACHABLE", `\u7F51\u5173\u8FD4\u56DE\u9519\u8BEF\uFF08HTTP ${res.status}\uFF09`, res.status);
     return await parseMeJson(res);
   }
@@ -9389,7 +9456,19 @@ var AiRouterClient = class {
         opts.rawBody.byteOffset + opts.rawBody.byteLength
       );
     } else if (opts.body !== void 0) init.body = JSON.stringify(opts.body);
-    return fetch(`${this.baseURL}${path}`, init);
+    const res = await fetch(`${this.baseURL}${path}`, init);
+    if (opts.sessionCookie !== void 0) {
+      try {
+        if (res.status === 401) sessionActivitySink?.({ kind: "unauthorized" });
+        else if (res.ok) {
+          const headerExpiresAt = res.headers.get("x-session-expires-at");
+          const expiresAt = headerExpiresAt !== null && !Number.isNaN(Date.parse(headerExpiresAt)) ? headerExpiresAt : void 0;
+          sessionActivitySink?.(expiresAt === void 0 ? { kind: "success" } : { kind: "success", expiresAt });
+        }
+      } catch {
+      }
+    }
+    return res;
   }
 };
 function headerSafeValue(value) {
@@ -9427,6 +9506,27 @@ function extractSessionId(headers) {
   }
   return void 0;
 }
+function parseSessionCookieExpiry(headers, now = Date.now()) {
+  const raws = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [headers.get("set-cookie")].filter((raw) => raw !== null);
+  for (const raw of raws) {
+    for (const section of raw.split(/,\s*(?=[!#$%&'*+\-.^_`|~0-9A-Za-z]+=)/)) {
+      if (!/(?:^|;\s*)session_id=/.test(section)) continue;
+      const expires = /;\s*Expires=([^;]+)/i.exec(section);
+      const expiresRaw = expires?.[1];
+      if (expiresRaw !== void 0) {
+        const ms = Date.parse(expiresRaw);
+        if (!Number.isNaN(ms)) return new Date(ms).toISOString();
+      }
+      const maxAge = /;\s*Max-Age=(-?\d+)/i.exec(section);
+      if (maxAge !== null) {
+        const seconds = Number(maxAge[1]);
+        if (Number.isFinite(seconds)) return new Date(now + seconds * 1e3).toISOString();
+      }
+      return void 0;
+    }
+  }
+  return void 0;
+}
 async function readJson(res) {
   try {
     return await res.json();
@@ -9577,6 +9677,58 @@ async function fetchClientPolicy(opts) {
     return void 0;
   }
 }
+var CLIENT_POLICY_POLL_INTERVAL_MS = 6 * 60 * 6e4;
+var CLIENT_POLICY_RETRY_DELAYS_MS = [6e4, 10 * 6e4, 60 * 6e4];
+function createClientPolicyPoller(deps) {
+  let timer;
+  let disposed = false;
+  let running = false;
+  let retryIndex = 0;
+  const schedule = (delayMs) => {
+    if (disposed) return;
+    if (timer !== void 0) clearTimeout(timer);
+    timer = setTimeout(() => {
+      timer = void 0;
+      void run();
+    }, delayMs);
+    timer.unref?.();
+  };
+  const run = async () => {
+    if (disposed || running) return;
+    running = true;
+    let ok = false;
+    try {
+      ok = await deps.attempt();
+    } catch {
+      ok = false;
+    } finally {
+      running = false;
+    }
+    if (disposed) return;
+    if (ok) {
+      retryIndex = 0;
+      schedule(CLIENT_POLICY_POLL_INTERVAL_MS);
+      return;
+    }
+    const delay2 = CLIENT_POLICY_RETRY_DELAYS_MS[Math.min(retryIndex, CLIENT_POLICY_RETRY_DELAYS_MS.length - 1)];
+    retryIndex += 1;
+    deps.log?.(`hiwork-core: \u5BA2\u6237\u7AEF\u7B56\u7565\u62C9\u53D6\u5931\u8D25\uFF0C${Math.round(delay2 / 1e3)}s \u540E\u91CD\u8BD5`);
+    schedule(delay2);
+  };
+  return {
+    trigger: () => {
+      if (disposed || running || timer !== void 0) return;
+      void run();
+    },
+    dispose: () => {
+      disposed = true;
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        timer = void 0;
+      }
+    }
+  };
+}
 
 // src/default-model.ts
 var DEFAULT_MODEL_NS = "agent-default-model";
@@ -9783,14 +9935,18 @@ async function runLogin(opts) {
     const password = await opts.credentials.resolve(pending.passwordRef);
     if (password === void 0) throw new GatewayError("AUTH_FAILED", "\u767B\u5F55\u51ED\u636E\u7F3A\u5931\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");
     const device = await resolveDeviceInfo(opts.credentials);
-    const { sessionCookie, user } = await opts.gateway.login(pending.username, password.value, device);
+    const { sessionCookie, user, sessionExpiresAt, refreshToken } = await opts.gateway.login(pending.username, password.value, device);
     await opts.credentials.set(SESSION_REF, sessionCookie);
+    if (refreshToken === void 0) await opts.credentials.unset(REFRESH_TOKEN_REF).catch(() => {
+    });
+    else await opts.credentials.set(REFRESH_TOKEN_REF, refreshToken);
     await provisionSession({
       ...opts,
       baseURL,
       sessionCookie,
       user,
       username: pending.username,
+      sessionExpiresAt,
       requestUnset: ["pendingLogin"],
       onApiKeyWritten: async () => {
         if (opts.value.rememberPassword === true) await opts.credentials.set(REMEMBERED_PASSWORD_REF, password.value);
@@ -9814,6 +9970,9 @@ async function runLogin(opts) {
   }
 }
 async function runRefresh(opts) {
+  return refreshWith(opts, false);
+}
+async function refreshWith(opts, grantRetried) {
   const baseURL = opts.value.baseURL;
   if (baseURL === void 0) {
     await opts.state.patch({ unset: ["refreshRequest"] });
@@ -9850,6 +10009,28 @@ async function runRefresh(opts) {
     return null;
   } catch (error) {
     const refreshError = toLoginError(error, "\u65E0\u6CD5\u8FDE\u63A5\u7F51\u5173\uFF0C\u8BF7\u68C0\u67E5 baseURL \u6216\u7F51\u7EDC");
+    if (refreshError.code === "SESSION_EXPIRED" && !grantRetried) {
+      const grant = await opts.credentials.resolve(REFRESH_TOKEN_REF).catch(() => void 0);
+      if (grant !== void 0 && grant.value !== "") {
+        try {
+          const renewed = await opts.gateway.refreshSession(grant.value);
+          await opts.credentials.set(SESSION_REF, renewed.sessionCookie);
+          if (renewed.refreshToken === void 0) await opts.credentials.unset(REFRESH_TOKEN_REF).catch(() => {
+          });
+          else await opts.credentials.set(REFRESH_TOKEN_REF, renewed.refreshToken);
+          if (renewed.sessionExpiresAt !== void 0) {
+            await opts.state.patch({ set: { sessionExpiresAt: renewed.sessionExpiresAt } });
+          }
+          return refreshWith(opts, true);
+        } catch (grantError) {
+          const code = grantError instanceof GatewayError ? grantError.code : void 0;
+          if (code === "REFRESH_GRANT_INVALID" || code === "REFRESH_GRANT_ABSENT") {
+            await opts.credentials.unset(REFRESH_TOKEN_REF).catch(() => {
+            });
+          }
+        }
+      }
+    }
     if (refreshError.code === "SESSION_EXPIRED" && opts.value.rememberPassword === true && opts.value.username !== void 0) {
       const remembered = await opts.credentials.resolve(REMEMBERED_PASSWORD_REF).catch(() => void 0);
       if (remembered !== void 0) {
@@ -9874,6 +10055,8 @@ async function runLogout(opts) {
   });
   await opts.credentials.unset(SESSION_REF).catch(() => {
   });
+  await opts.credentials.unset(REFRESH_TOKEN_REF).catch(() => {
+  });
   await opts.credentials.unset(PENDING_PASSWORD_REF).catch(() => {
   });
   await opts.credentials.unset(REMEMBERED_PASSWORD_REF).catch(() => {
@@ -9892,7 +10075,9 @@ async function runLogout(opts) {
       "lastError",
       "keyId",
       "budgets",
-      "keys"
+      "keys",
+      // 会话寿命随会话一起清空：残留的旧 expiresAt 会让保活决策基于已失效的会话。
+      "sessionExpiresAt"
     ]
   });
 }
@@ -18504,6 +18689,140 @@ async function readJson2(response) {
   }
 }
 
+// src/session-fanout.ts
+function buildSessionFanout(handlers) {
+  const entries = [
+    ["client policy", handlers.onPolicyRefresh],
+    ["managed mcp", handlers.onManagedMcpRefresh],
+    ["managed skills", handlers.onManagedSkillsRefresh],
+    ["workbench", handlers.onWorkbenchRefresh]
+  ];
+  return () => {
+    for (const [label, run] of entries) {
+      try {
+        run();
+      } catch (error) {
+        handlers.log?.(`hiwork-core: \u4F1A\u8BDD\u8054\u52A8\u5237\u65B0\u300C${label}\u300D\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+      }
+    }
+  };
+}
+
+// src/session-supervisor.ts
+var SESSION_TTL_ASSUMPTION_MS = 24 * 60 * 6e4;
+var SESSION_CHECK_INTERVAL_MS = 60 * 6e4;
+var SESSION_RECOVERY_COOLDOWN_MS = 6e4;
+var SessionSupervisor = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  timer;
+  /** 上次「已知会话存活」的时刻；undefined = 本进程内还没确认过（重启后的首次检查照打）。 */
+  lastAuthedSuccessAt;
+  /**
+   * 最近一次带会话成功响应里 `X-Session-Expires-At` 给出的**内存**寿命估计（原样时刻串）。
+   * 只活在内存里——热路径绝不写 settings（Review Focus 5），只有心跳成功才落盘。
+   */
+  lastHeaderExpiresAt;
+  /** 恢复请求是否在途（单飞去抖）。 */
+  recoveryInFlight = false;
+  /** 上次触发恢复的时刻（冷却窗口基准）。 */
+  lastRecoveryAt;
+  /** 开始兜底检查；重复调用不叠加定时器。 */
+  start() {
+    if (this.timer !== void 0) return;
+    this.timer = setInterval(() => {
+      void this.wake();
+    }, SESSION_CHECK_INTERVAL_MS);
+    this.timer.unref?.();
+  }
+  /** 停止兜底检查（调用后零活动）。 */
+  stop() {
+    if (this.timer === void 0) return;
+    clearInterval(this.timer);
+    this.timer = void 0;
+  }
+  /**
+   * 带会话的请求成功 → 记活动时间（由 ai-router-client 的活动汇聚驱动）。
+   * `expiresAt` 为响应头 `X-Session-Expires-At` 给出的会话寿命：**只更新内存估计**，
+   * 绝不在此写 settings——热路径上每个成功请求都写盘会打爆设置面（Review Focus 5）。
+   * 不可解析的值直接丢弃（当作没给），不覆盖既有估计。
+   */
+  noteAuthedSuccess(expiresAt) {
+    this.lastAuthedSuccessAt = this.now();
+    if (expiresAt !== void 0 && !Number.isNaN(Date.parse(expiresAt))) this.lastHeaderExpiresAt = expiresAt;
+  }
+  /**
+   * 带会话的请求收到 401 → 去抖后触发一次会话恢复。
+   * 去抖有两层：`recoveryInFlight`（单飞，覆盖「恢复请求还没落地，同刻又来了 5 条 401」）
+   * 与 `SESSION_RECOVERY_COOLDOWN_MS` 冷却（覆盖恢复完成后短时间内的余波 401）。
+   * 恢复失败只记日志——apply 后写入面需要几秒才就绪，那一侧的失败不该惊动宿主。
+   */
+  reportAuthed401(source) {
+    if (this.recoveryInFlight) return;
+    const now = this.now();
+    if (this.lastRecoveryAt !== void 0 && now - this.lastRecoveryAt < SESSION_RECOVERY_COOLDOWN_MS) return;
+    this.recoveryInFlight = true;
+    this.lastRecoveryAt = now;
+    void this.deps.requestRecovery().catch(() => {
+      this.log(`hiwork-core: \u4F1A\u8BDD\u6062\u590D\u89E6\u53D1\u5931\u8D25\uFF08\u6765\u6E90 ${source}\uFF09\uFF0C\u7B49\u5F85\u4E0B\u4E2A 401 \u6216\u5FC3\u8DF3\u91CD\u8BD5`);
+    }).finally(() => {
+      this.recoveryInFlight = false;
+    });
+  }
+  now() {
+    return this.deps.now?.() ?? Date.now();
+  }
+  log(message) {
+    this.deps.log?.(message);
+  }
+  /**
+   * 一次兜底检查。判定顺序（早退即不发请求）：
+   * 无会话 / 无 baseURL → 返回；距上次已认证成功不足 TTL/2 → 返回；
+   * 已知剩余寿命 > TTL/2 → 返回；否则 ping。
+   * 寿命未知也 ping——重启后的首次检查即校验会话是否还活着。
+   * 「已知剩余寿命」取 settings 值与内存估计（响应头）的**较大者**：头值只会更晚更准，
+   * 用较大者才不会因为 settings 里的旧估算偏早而白打心跳。
+   */
+  async wake() {
+    try {
+      const session = await this.deps.getSession();
+      if (session === void 0 || session === "") return;
+      if (this.deps.getBaseURL() === void 0) return;
+      const now = this.now();
+      if (this.lastAuthedSuccessAt !== void 0 && now - this.lastAuthedSuccessAt < SESSION_TTL_ASSUMPTION_MS / 2) return;
+      const knownExpiresAtMs = this.knownExpiresAtMs();
+      if (knownExpiresAtMs !== void 0 && knownExpiresAtMs - now > SESSION_TTL_ASSUMPTION_MS / 2) return;
+      let pinged;
+      try {
+        pinged = await this.deps.ping(session);
+      } catch (error) {
+        const expired = error instanceof GatewayError && error.code === "SESSION_EXPIRED";
+        this.log(expired ? "hiwork-core: \u4F1A\u8BDD\u5FC3\u8DF3\u53D1\u73B0\u4F1A\u8BDD\u5DF2\u5931\u6548\uFF0C\u7B49\u5F85 401 \u6C47\u805A\u89E6\u53D1\u6062\u590D" : "hiwork-core: \u4F1A\u8BDD\u5FC3\u8DF3\u8BF7\u6C42\u5931\u8D25\uFF0C\u5C06\u5728\u4E0B\u4E2A\u5468\u671F\u91CD\u8BD5");
+        return;
+      }
+      const pingedExpiresAt = pinged?.expiresAt;
+      const pingedMs = pingedExpiresAt === void 0 ? Number.NaN : Date.parse(pingedExpiresAt);
+      const nextExpiresAt = pingedExpiresAt === void 0 || Number.isNaN(pingedMs) ? new Date(this.now() + SESSION_TTL_ASSUMPTION_MS).toISOString() : pingedExpiresAt;
+      try {
+        await this.deps.patchSessionExpiresAt(nextExpiresAt);
+      } catch {
+        this.log("hiwork-core: \u4F1A\u8BDD\u5FC3\u8DF3\u6210\u529F\u4F46\u5BFF\u547D\u56DE\u5199\u5931\u8D25\uFF0C\u5C06\u5728\u4E0B\u4E2A\u5468\u671F\u91CD\u8BD5");
+      }
+    } catch {
+      this.log("hiwork-core: \u4F1A\u8BDD\u5FC3\u8DF3\u68C0\u67E5\u5931\u8D25\uFF0C\u5C06\u5728\u4E0B\u4E2A\u5468\u671F\u91CD\u8BD5");
+    }
+  }
+  /**
+   * 已知的会话到期时刻（epoch ms）：settings 值与内存头值里**有效且较晚**的那个；
+   * 两者都没有（或都不可解析）返回 undefined = 寿命未知。
+   */
+  knownExpiresAtMs() {
+    const values = [this.deps.getSessionExpiresAt(), this.lastHeaderExpiresAt].map((iso) => iso === void 0 ? Number.NaN : Date.parse(iso)).filter((ms) => !Number.isNaN(ms));
+    return values.length === 0 ? void 0 : Math.max(...values);
+  }
+};
+
 // src/pms-todo-bridge.ts
 var PMS_TODO_RPC_CHANNEL = "/hiwork-pms-todo";
 var PMS_TODO_RPC_ENDPOINTS = [
@@ -19168,6 +19487,34 @@ function registerIdentityContext(systemPrompt, deps) {
   };
 }
 
+// src/ttl-cache.ts
+var TtlCache = class {
+  ttlMs;
+  entry;
+  constructor(opts) {
+    this.ttlMs = opts.ttlMs;
+  }
+  /** 命中返回缓存值；会话键不同或已到期返回 undefined。`now` 可注入（缺省 Date.now）。 */
+  get(sessionKey, now = Date.now()) {
+    const hit = this.entry;
+    if (hit === void 0 || hit.sessionKey !== sessionKey) return void 0;
+    if (now - hit.at >= this.ttlMs) return void 0;
+    return hit.value;
+  }
+  /** 写入/覆盖缓存（新会话键会顶掉旧会话那条）。 */
+  put(sessionKey, value, now = Date.now()) {
+    this.entry = { sessionKey, value, at: now };
+  }
+  /** 清掉指定会话键的条目（不影响别的键，虽然只会存在一条）；不传参数则清空。 */
+  invalidate(sessionKey) {
+    if (sessionKey === void 0) {
+      this.entry = void 0;
+      return;
+    }
+    if (this.entry?.sessionKey === sessionKey) this.entry = void 0;
+  }
+};
+
 // src/knowledge-config.ts
 var HIWORK_KNOWLEDGE_SERVICE = "hiworkKnowledge";
 var ME_KNOWLEDGE_CONFIG_PATH = "/api/me/knowledge-config";
@@ -19256,8 +19603,9 @@ var KnowledgeConfigProvider = class {
   constructor(deps) {
     this.deps = deps;
   }
-  cached;
-  tokenCached;
+  configCache = new TtlCache({ ttlMs: KNOWLEDGE_CONFIG_TTL_MS });
+  // 令牌缓存比配置缓存短 30s（KNOWLEDGE_TOKEN_CACHE_TTL_MS 已扣掉余量，见其注释）。
+  tokenCache = new TtlCache({ ttlMs: KNOWLEDGE_TOKEN_CACHE_TTL_MS });
   async token(opts) {
     const force = opts?.force === true;
     let sessionCookie;
@@ -19268,9 +19616,9 @@ var KnowledgeConfigProvider = class {
       return failure12("error");
     }
     if (!sessionCookie) return failure12("unauthenticated");
-    const hit = this.tokenCached;
-    if (!force && hit?.sessionCookie === sessionCookie && this.now() - hit.at < KNOWLEDGE_TOKEN_CACHE_TTL_MS) {
-      return hit.view;
+    if (!force) {
+      const hit = this.tokenCache.get(sessionCookie, this.now());
+      if (hit !== void 0) return hit;
     }
     const gateway = this.deps.gateway();
     if (!gateway) return failure12("unreachable");
@@ -19295,7 +19643,7 @@ var KnowledgeConfigProvider = class {
         return id ? [{ id, name: textOrUndefined7(obj["name"]) ?? "" }] : [];
       }).filter((item) => knowledgeBaseIds.includes(item.id)) : [];
       const view = { ok: true, token, audience, knowledgeBaseIds, knowledgeBases };
-      this.tokenCached = { sessionCookie, view, at: this.now() };
+      this.tokenCache.put(sessionCookie, view, this.now());
       return view;
     } catch (error) {
       const mapped = reasonOfErrorCode(error);
@@ -19315,10 +19663,8 @@ var KnowledgeConfigProvider = class {
     }
     if (sessionCookie === void 0 || sessionCookie === "") return failure12("unauthenticated");
     if (!force) {
-      const hit = this.cached;
-      if (hit !== void 0 && hit.sessionCookie === sessionCookie && this.now() - hit.at < KNOWLEDGE_CONFIG_TTL_MS) {
-        return hit.view;
-      }
+      const hit = this.configCache.get(sessionCookie, this.now());
+      if (hit !== void 0) return hit;
     }
     const gateway = this.deps.gateway();
     if (gateway === void 0) return failure12("unreachable");
@@ -19341,7 +19687,7 @@ var KnowledgeConfigProvider = class {
       this.deps.log?.("hiwork-core: \u7F51\u5173\u8FD4\u56DE\u7684 knowledge-config \u4E0D\u5B8C\u6574\uFF08\u7F3A base_url / api_key \u4E4B\u4E00\uFF09");
       return failure12("error");
     }
-    this.cached = { sessionCookie, view, at: this.now() };
+    this.configCache.put(sessionCookie, view, this.now());
     return view;
   }
   now() {
@@ -19465,7 +19811,7 @@ var MemoryConfigProvider = class {
   constructor(deps) {
     this.deps = deps;
   }
-  cached;
+  cache = new TtlCache({ ttlMs: MEMORY_CONFIG_TTL_MS });
   async config(opts) {
     const force = opts?.force === true;
     let sessionCookie;
@@ -19477,10 +19823,8 @@ var MemoryConfigProvider = class {
     }
     if (sessionCookie === void 0 || sessionCookie === "") return failure13("unauthenticated");
     if (!force) {
-      const hit = this.cached;
-      if (hit !== void 0 && hit.sessionCookie === sessionCookie && this.now() - hit.at < MEMORY_CONFIG_TTL_MS) {
-        return hit.view;
-      }
+      const hit = this.cache.get(sessionCookie, this.now());
+      if (hit !== void 0) return hit;
     }
     const gateway = this.deps.gateway();
     if (gateway === void 0) return failure13("unreachable", MESSAGE_NO_GATEWAY);
@@ -19503,7 +19847,7 @@ var MemoryConfigProvider = class {
       this.deps.log?.("hiwork-core: \u7F51\u5173\u8FD4\u56DE\u7684 memory-config \u4E0D\u5B8C\u6574\uFF08\u7F3A panel_url / service_id / api_key \u4E4B\u4E00\uFF09");
       return failure13("error");
     }
-    this.cached = { sessionCookie, view, at: this.now() };
+    this.cache.put(sessionCookie, view, this.now());
     return view;
   }
   now() {
@@ -19969,6 +20313,7 @@ var Config = Schema.object({
   keyId: Schema.string().volatile(),
   username: Schema.string().volatile(),
   displayName: Schema.string().volatile(),
+  sessionExpiresAt: Schema.string().volatile(),
   lastLogin: Schema.object({ at: Schema.string().required(), modelCount: Schema.number().required(), gatewayName: Schema.string().required() }).default(void 0).volatile(),
   lastError: lastErrorSchema.volatile(),
   pendingLogin: Schema.object({ username: Schema.string().required(), passwordRef: Schema.string().required() }).default(void 0).volatile(),
@@ -20323,22 +20668,60 @@ function apply(ctx, config) {
     }
   };
   let inFlight;
-  let policyRequested = false;
-  const requestClientPolicy = () => {
-    if (policyRequested) return;
-    const baseURL = current().baseURL;
-    if (baseURL === void 0 || baseURL === "") return;
-    policyRequested = true;
-    void projectLoginMode({
-      baseURL,
-      credentials: ports.credentials,
-      state: ports.state,
-      log: (message) => {
-        ctx.logger.warn(message);
-      }
-    }).catch(() => {
-    });
+  const sessionSupervisor = new SessionSupervisor({
+    getSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
+    getSessionExpiresAt: () => current().sessionExpiresAt,
+    getBaseURL: () => current().baseURL,
+    ping: async (sessionCookie) => {
+      const baseURL = current().baseURL;
+      if (baseURL === void 0 || baseURL === "") throw new Error("baseURL \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u4F1A\u8BDD\u5FC3\u8DF3");
+      const sessions = await gatewayFor(baseURL).listSessions(sessionCookie);
+      const expiresAt = sessions.find((item) => item.current === true && item.expires_at !== void 0)?.expires_at;
+      return expiresAt === void 0 ? {} : { expiresAt };
+    },
+    patchSessionExpiresAt: (iso) => ports.state.patch({ set: { sessionExpiresAt: iso } }),
+    requestRecovery: () => ports.state.patch({ set: { refreshRequest: { at: (/* @__PURE__ */ new Date()).toISOString() } } }),
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  });
+  const sessionActivitySink2 = (event) => {
+    if (event.kind === "success") sessionSupervisor.noteAuthedSuccess(event.expiresAt);
+    else sessionSupervisor.reportAuthed401("gateway");
   };
+  ctx.effect(() => {
+    setSessionActivitySink(sessionActivitySink2);
+    sessionSupervisor.start();
+    return () => {
+      sessionSupervisor.stop();
+      clearSessionActivitySink(sessionActivitySink2);
+    };
+  }, "hiwork-core: session supervisor");
+  const policyPoller = createClientPolicyPoller({
+    attempt: async () => {
+      const baseURL = current().baseURL;
+      if (baseURL === void 0 || baseURL === "") return false;
+      let fetched = false;
+      await projectLoginMode({
+        baseURL,
+        credentials: ports.credentials,
+        state: ports.state,
+        fetchPolicy: async (input) => {
+          const policy = await fetchClientPolicy(input);
+          fetched = policy !== void 0;
+          return policy;
+        },
+        log: (message) => {
+          ctx.logger.warn(message);
+        }
+      });
+      return fetched;
+    },
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  });
+  let notifySessionProvisioned;
   const dispatchSectionChange = () => {
     const value = current();
     const requested = value.pendingLogin ?? value.browserLoginRequest ?? value.refreshRequest ?? value.logoutRequest;
@@ -20355,6 +20738,7 @@ function apply(ctx, config) {
             ctx.logger.warn(message);
           }
         });
+        if (value.pendingLogin !== void 0 || value.refreshRequest !== void 0) notifySessionProvisioned?.();
       } catch (error) {
         ctx.logger.error("hiwork-core: ai-router section change failed", error);
         if (isHmrNestedWriteError(error)) {
@@ -20377,7 +20761,7 @@ function apply(ctx, config) {
   };
   ctx.effect(() => {
     const consume = () => {
-      requestClientPolicy();
+      policyPoller.trigger();
       dispatchSectionChange();
     };
     consume();
@@ -20385,6 +20769,7 @@ function apply(ctx, config) {
     timer.unref?.();
     return () => {
       clearInterval(timer);
+      policyPoller.dispose();
     };
   }, "hiwork-core: login request poll");
   void ctx.root.loader.await().then(() => importLegacyMenuSection({
@@ -20394,7 +20779,7 @@ function apply(ctx, config) {
   })).catch((error) => {
     ctx.logger.warn(`hiwork-core: \u65E7\u7248\u83DC\u5355\u504F\u597D\u8FC1\u79FB\u672A\u6267\u884C\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
   });
-  requestClientPolicy();
+  policyPoller.trigger();
   void (async () => {
     for (const delay2 of STALE_BROWSER_LOGIN_RECONCILE_DELAYS_MS) {
       if (delay2 > 0) await new Promise((resolve3) => {
@@ -20599,6 +20984,27 @@ function apply(ctx, config) {
       clearInterval(timer);
     };
   }, "hiwork-core: workbench warmup");
+  notifySessionProvisioned = buildSessionFanout({
+    onPolicyRefresh: () => policyPoller.trigger(),
+    onManagedMcpRefresh: () => {
+      void managedMcp.load().catch((error) => {
+        ctx.logger.warn(`hiwork-core: \u4F1A\u8BDD\u4F9B\u7ED9\u540E\u5237\u65B0\u53D7\u7BA1 MCP \u6E05\u5355\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+      });
+    },
+    onManagedSkillsRefresh: () => {
+      void managedSkills.load().catch((error) => {
+        ctx.logger.warn(`hiwork-core: \u4F1A\u8BDD\u4F9B\u7ED9\u540E\u5237\u65B0\u53D7\u7BA1\u6280\u80FD\u6E05\u5355\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+      });
+    },
+    onWorkbenchRefresh: () => {
+      void workbench.load().catch((error) => {
+        ctx.logger.warn(`hiwork-core: \u4F1A\u8BDD\u4F9B\u7ED9\u540E\u5237\u65B0\u5DE5\u4F5C\u53F0\u6E05\u5355\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
+      });
+    },
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  });
   const pmsTodoDeps = {
     resolveSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
     gateway: () => {
@@ -20709,9 +21115,9 @@ function apply(ctx, config) {
   }), "hiwork-core: plugin updates rpc");
   ctx.effect(() => registerIpcMessageHandler({
     source: process,
-    complete: (input) => {
+    complete: async (input) => {
       const value = current();
-      return completeBrowserLogin(input, {
+      const result = await completeBrowserLogin(input, {
         ...ports,
         value,
         gateway: gatewayFor(value.baseURL ?? ""),
@@ -20719,6 +21125,8 @@ function apply(ctx, config) {
           ctx.logger.warn(message);
         }
       });
+      if (result === null) notifySessionProvisioned?.();
+      return result;
     },
     setDevice: (info) => {
       setDeviceInfo(info);