linkshell-cli 0.10.70 → 0.10.72

package/dist/wire/src/watch.d.ts

@@ -151,8 +151,8 @@ export declare const watchTimelineItemSchema: z.ZodObject<{
     imageBase64: z.ZodOptional<z.ZodString>;
     imageMimeType: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    text: string;
     kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+    text: string;
     id: string;
     status?: "completed" | "failed" | "running" | "waiting" | undefined;
     title?: string | undefined;
@@ -166,8 +166,8 @@ export declare const watchTimelineItemSchema: z.ZodObject<{
     imageBase64?: string | undefined;
     imageMimeType?: string | undefined;
 }, {
-    text: string;
     kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+    text: string;
     id: string;
     status?: "completed" | "failed" | "running" | "waiting" | undefined;
     title?: string | undefined;
@@ -313,8 +313,8 @@ export declare const watchSessionSchema: z.ZodObject<{
         imageBase64: z.ZodOptional<z.ZodString>;
         imageMimeType: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        text: string;
         kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+        text: string;
         id: string;
         status?: "completed" | "failed" | "running" | "waiting" | undefined;
         title?: string | undefined;
@@ -328,8 +328,8 @@ export declare const watchSessionSchema: z.ZodObject<{
         imageBase64?: string | undefined;
         imageMimeType?: string | undefined;
     }, {
-        text: string;
         kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+        text: string;
         id: string;
         status?: "completed" | "failed" | "running" | "waiting" | undefined;
         title?: string | undefined;
@@ -403,8 +403,8 @@ export declare const watchSessionSchema: z.ZodObject<{
     } | undefined;
     hasEarlier?: boolean | undefined;
     items?: {
-        text: string;
         kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+        text: string;
         id: string;
         status?: "completed" | "failed" | "running" | "waiting" | undefined;
         title?: string | undefined;
@@ -474,8 +474,8 @@ export declare const watchSessionSchema: z.ZodObject<{
     } | undefined;
     hasEarlier?: boolean | undefined;
     items?: {
-        text: string;
         kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+        text: string;
         id: string;
         status?: "completed" | "failed" | "running" | "waiting" | undefined;
         title?: string | undefined;
@@ -703,8 +703,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
             imageBase64: z.ZodOptional<z.ZodString>;
             imageMimeType: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -718,8 +718,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
             imageBase64?: string | undefined;
             imageMimeType?: string | undefined;
         }, {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -793,8 +793,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
         } | undefined;
         hasEarlier?: boolean | undefined;
         items?: {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -864,8 +864,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
         } | undefined;
         hasEarlier?: boolean | undefined;
         items?: {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -975,8 +975,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
         } | undefined;
         hasEarlier?: boolean | undefined;
         items?: {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -1084,8 +1084,8 @@ export declare const watchSnapshotSchema: z.ZodObject<{
         } | undefined;
         hasEarlier?: boolean | undefined;
         items?: {
-            text: string;
             kind: "user" | "assistant" | "image" | "diff" | "tool" | "subagent" | "question" | "error" | "thought" | "plan" | "permission";
+            text: string;
             id: string;
             status?: "completed" | "failed" | "running" | "waiting" | undefined;
             title?: string | undefined;
@@ -1183,6 +1183,7 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
         questionId?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
+    kind: "action";
     action: {
         kind: "answer" | "permission" | "async-answer";
         id: string;
@@ -1194,9 +1195,9 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
         computerKey: string;
         questionId?: string | undefined;
     };
-    kind: "action";
     id: string;
 }, {
+    kind: "action";
     action: {
         kind: "answer" | "permission" | "async-answer";
         id: string;
@@ -1208,7 +1209,6 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
         computerKey: string;
         questionId?: string | undefined;
     };
-    kind: "action";
     id: string;
 }>, z.ZodObject<{
     id: z.ZodString;
@@ -1218,15 +1218,15 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
     text: z.ZodString;
     now: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    text: string;
     kind: "prompt";
+    text: string;
     id: string;
     sessionId: string;
     computerKey: string;
     now?: boolean | undefined;
 }, {
-    text: string;
     kind: "prompt";
+    text: string;
     id: string;
     sessionId: string;
     computerKey: string;
@@ -1284,15 +1284,15 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
     optionId: z.ZodString;
     value: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    value: string;
     kind: "set-config";
+    value: string;
     id: string;
     optionId: string;
     sessionId: string;
     computerKey: string;
 }, {
-    value: string;
     kind: "set-config";
+    value: string;
     id: string;
     optionId: string;
     sessionId: string;
@@ -1335,15 +1335,15 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
     cwd: z.ZodString;
     prompt: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    agent: string;
     kind: "create-session";
+    agent: string;
     id: string;
     cwd: string;
     computerKey: string;
     prompt?: string | undefined;
 }, {
-    agent: string;
     kind: "create-session";
+    agent: string;
     id: string;
     cwd: string;
     computerKey: string;
@@ -1388,14 +1388,14 @@ export declare const watchCommandSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodO
     terminalId: z.ZodString;
     data: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    data: string;
     kind: "terminal-input";
+    data: string;
     terminalId: string;
     id: string;
     computerKey: string;
 }, {
-    data: string;
     kind: "terminal-input";
+    data: string;
     terminalId: string;
     id: string;
     computerKey: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linkshell-cli",
-  "version": "0.10.70",
+  "version": "0.10.72",
   "description": "Follow, steer and approve the coding agents on your computer (Claude Code, Codex, Gemini, Copilot and more) from your phone",
   "type": "module",
   "main": "dist/cli/src/index.js",
@@ -35,8 +35,8 @@
     "qrcode-terminal": "^0.12.0",
     "ws": "^8.21.0",
     "@linkshell/gateway": "0.6.38",
-    "@linkshell/wire": "0.2.20",
-    "@linkshell/host": "0.4.67"
+    "@linkshell/host": "0.4.67",
+    "@linkshell/wire": "0.2.20"
   },
   "devDependencies": {
     "@types/ws": "^8.5.14",

package/src/auth.ts

@@ -65,44 +65,25 @@ export async function refreshAccessToken(options: { signal?: AbortSignal } = {})
     if (!auth?.refreshToken) return null;
     if (auth.expiresAt - Date.now() >= 60_000) return auth;
 
-    try {
-      const res = await fetch(
-        `${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`,
-        {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            apikey: SUPABASE_ANON_KEY,
-          },
-          body: JSON.stringify({ refresh_token: auth.refreshToken }),
-          signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000),
-        },
-      );
-      if (!res.ok) return (await refused(res)) ? signedOutElsewhere(auth) : rotatedElsewhere(auth);
-      const body = (await res.json()) as {
-        access_token: string;
-        refresh_token: string;
-        expires_in: number;
-        user: { id: string; email?: string };
-      };
-      const tokens: AuthTokens = {
-        accessToken: body.access_token,
-        refreshToken: body.refresh_token,
-        expiresAt: Date.now() + body.expires_in * 1000,
-        userId: body.user.id,
-        email: body.user.email ?? auth.email,
-      };
-      // A login or logout may finish while the refresh is in flight.
-      const current = loadAuth();
-      if (tokens.userId !== auth.userId || current?.userId !== auth.userId) return null;
-      if (current.refreshToken !== auth.refreshToken) return rotatedElsewhere(auth);
-      // Saved even when the caller gave up: the old refresh token is spent now, and presenting it
-      // again later would make Supabase revoke the whole session.
-      saveAuth(tokens);
-      return options.signal?.aborted ? null : tokens;
-    } catch {
-      return rotatedElsewhere(auth);
-    }
+    const outcome = await exchangeRefreshToken(auth.refreshToken, options.signal);
+    if (outcome.kind === "dead") return signedOutElsewhere(auth);
+    if (outcome.kind === "retryable") return rotatedElsewhere(auth);
+    const body = outcome.body;
+    const tokens: AuthTokens = {
+      accessToken: body.access_token,
+      refreshToken: body.refresh_token,
+      expiresAt: Date.now() + body.expires_in * 1000,
+      userId: body.user.id,
+      email: body.user.email ?? auth.email,
+    };
+    // A login or logout may finish while the refresh is in flight.
+    const current = loadAuth();
+    if (tokens.userId !== auth.userId || current?.userId !== auth.userId) return null;
+    if (current.refreshToken !== auth.refreshToken) return rotatedElsewhere(auth);
+    // Saved even when the caller gave up: the old refresh token is spent now, and presenting it
+    // again later would make Supabase revoke the whole session.
+    saveAuth(tokens);
+    return options.signal?.aborted ? null : tokens;
   })().finally(() => {
     inflightRefresh = null;
   });
@@ -136,6 +117,71 @@ async function refused(res: Response): Promise<boolean> {
   }
 }
 
+// itool.tech proxies the Supabase token exchange so clients in regions that can't reach
+// supabase.co directly can still refresh. Set LINKSHELL_TOKEN_PROXY=off to skip it (kill switch).
+const TOKEN_PROXY_URL = "https://itool.tech/api/linkshell/token";
+
+interface TokenResponse {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  user: { id: string; email?: string };
+}
+
+type ExchangeOutcome =
+  | { kind: "ok"; body: TokenResponse }
+  | { kind: "dead" } // the refresh token can never work again → sign out
+  | { kind: "retryable" }; // outage, network, rate limit → keep the tokens and try again later
+
+function exchangeSignal(signal?: AbortSignal): AbortSignal {
+  return signal ? AbortSignal.any([signal, AbortSignal.timeout(8_000)]) : AbortSignal.timeout(8_000);
+}
+
+/**
+ * Tries the itool.tech proxy. Returns an outcome to act on, or null meaning the proxy itself
+ * couldn't give a verdict (unreachable, 5xx, unexpected shape) so the caller should fall back to
+ * Supabase directly. Only a definite `invalid_grant` from the proxy signs the account out.
+ */
+async function exchangeViaProxy(refreshToken: string, signal?: AbortSignal): Promise<ExchangeOutcome | null> {
+  try {
+    const res = await fetch(TOKEN_PROXY_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: refreshToken }),
+      signal: exchangeSignal(signal),
+    });
+    if (res.ok) return { kind: "ok", body: (await res.json()) as TokenResponse };
+    const body = (await res.json().catch(() => ({}))) as { code?: string };
+    if (body.code === "invalid_grant") return { kind: "dead" };
+    return null; // temporarily_unavailable, invalid_request, anything else → fall back to direct
+  } catch {
+    return null; // couldn't reach itool.tech → fall back to direct
+  }
+}
+
+async function exchangeDirect(refreshToken: string, signal?: AbortSignal): Promise<ExchangeOutcome> {
+  try {
+    const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", apikey: SUPABASE_ANON_KEY },
+      body: JSON.stringify({ refresh_token: refreshToken }),
+      signal: exchangeSignal(signal),
+    });
+    if (res.ok) return { kind: "ok", body: (await res.json()) as TokenResponse };
+    return (await refused(res)) ? { kind: "dead" } : { kind: "retryable" };
+  } catch {
+    return { kind: "retryable" };
+  }
+}
+
+async function exchangeRefreshToken(refreshToken: string, signal?: AbortSignal): Promise<ExchangeOutcome> {
+  if (process.env.LINKSHELL_TOKEN_PROXY !== "off") {
+    const viaProxy = await exchangeViaProxy(refreshToken, signal);
+    if (viaProxy) return viaProxy;
+  }
+  return exchangeDirect(refreshToken, signal);
+}
+
 /**
  * The account was signed out on the server. Keeping its dead tokens would leave every client
  * showing a signed-in account that nothing can use, so this computer signs out too.
@@ -163,3 +209,16 @@ export async function getValidToken(options: { signal?: AbortSignal } = {}): Pro
 
   return auth.accessToken;
 }
+
+/**
+ * The access token on hand right now, without ever blocking on the network. Returns whatever is
+ * saved (even if expired), and kicks off a background refresh when it is close to expiring. The
+ * gateway keeps a peer's account binding when an expired token is presented, so a stale token here
+ * still connects — the point is that a slow or unreachable Supabase can't stall the handshake.
+ */
+export function getCachedToken(): string | null {
+  const auth = loadAuth();
+  if (!auth) return null;
+  if (auth.expiresAt - Date.now() < 120_000) void refreshAccessToken().catch(() => {});
+  return auth.accessToken;
+}

package/src/commands/host.ts

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import type { GatewayStatus } from "@linkshell/wire";
-import { getValidToken, isLoggedIn, loadAuth } from "../auth.js";
+import { getCachedToken, isLoggedIn, loadAuth } from "../auth.js";
 import * as daemon from "../utils/daemon.js";
 
 // node:sqlite prints an ExperimentalWarning on load; it is expected here and
@@ -111,7 +111,9 @@ export async function runHostForeground(version: string): Promise<void> {
       url: () => resolveGateway(home),
       // The account is LinkShell's, so its token goes to LinkShell's gateway and to no other: a
       // gateway of one's own has no accounts, and would refuse a computer that offered one.
-      token: async () => (sameGateway(resolveGateway(home), OFFICIAL_GATEWAY) ? ((await getValidToken()) ?? undefined) : undefined),
+      // Never blocks: the cached token (even expired) goes out at once so a slow Supabase can't
+      // stall the gateway handshake; a background refresh keeps it fresh for the next connection.
+      token: async () => (sameGateway(resolveGateway(home), OFFICIAL_GATEWAY) ? (getCachedToken() ?? undefined) : undefined),
     },
     tcpPort: devPort,
     claudeCommand: process.env.LINKSHELL_CLAUDE_COMMAND || undefined,