omnara 0.3.1 → 0.4.0

package/dist/cli.js

@@ -7,7 +7,7 @@ const __dirname = pathShim.dirname(__filename);
 // src/cli.ts
 import path15 from "path";
 import { Command as Command4 } from "commander";
-import * as Sentry28 from "@sentry/node";
+import * as Sentry27 from "@sentry/node";
 
 // src/commands/agent.ts
 import fs5 from "node:fs";
@@ -908,9 +908,7 @@ var CredentialsStore = class {
   async save(credentials) {
     await this.withLock(async () => {
       const payload = {
-        accessToken: credentials.accessToken,
-        accessTokenExpiresAt: credentials.accessTokenExpiresAt,
-        refreshToken: credentials.refreshToken
+        pat: credentials.pat
       };
       await fs2.mkdir(path3.dirname(this.filePath), { recursive: true, mode: DEFAULT_DIR_MODE });
       const tempPath = `${this.filePath}.tmp`;
@@ -2494,7 +2492,7 @@ import { randomUUID as randomUUID5 } from "crypto";
 import EventEmitter from "events";
 import WebSocket from "ws";
 import { simpleGit as simpleGit2 } from "simple-git";
-import * as Sentry13 from "@sentry/node";
+import * as Sentry12 from "@sentry/node";
 
 // ../shared-js/dist/api/base.js
 var ApiError = class extends Error {
@@ -6186,345 +6184,41 @@ async function registerRelaySession(client, accessToken, options) {
 }
 
 // src/auth/auth-provider.ts
-import { setTimeout as delay3 } from "node:timers/promises";
-import * as Sentry12 from "@sentry/node";
-
-// src/auth/credential-manager.ts
-import { setTimeout as delay2 } from "node:timers/promises";
-import * as Sentry8 from "@sentry/node";
-
-// src/auth/supabase-client.ts
-import { createClient } from "@supabase/supabase-js";
-
-// src/package-info.ts
-import { createRequire } from "node:module";
-var require2 = createRequire(import.meta.url);
-var pkg = require2("../package.json");
-var FALLBACK_NAME = pkg.name ?? "omnara";
-var FALLBACK_VERSION = pkg.version ?? "0.0.0";
-var FALLBACK_DESCRIPTION = pkg.description ?? "Command-line interface for Omnara.";
-var PACKAGE_NAME = true ? "omnara" : FALLBACK_NAME;
-var PACKAGE_VERSION = true ? "0.3.1" : FALLBACK_VERSION;
-var PACKAGE_DESCRIPTION = true ? "Command-line interface for Omnara." : FALLBACK_DESCRIPTION;
-
-// src/auth/supabase-client.ts
-var CLIENT_INFO_HEADER = `${PACKAGE_NAME}/${PACKAGE_VERSION}`;
-var singleton = null;
-function getSupabaseClient(config) {
-  if (singleton) {
-    return singleton;
-  }
-  singleton = createClient(config.url, config.anonKey, {
-    auth: {
-      autoRefreshToken: false,
-      persistSession: false,
-      detectSessionInUrl: false
-    },
-    global: {
-      headers: {
-        "X-Client-Info": CLIENT_INFO_HEADER
-      }
-    }
-  });
-  return singleton;
-}
-
-// src/auth/supabase-config.ts
-var CACHE = /* @__PURE__ */ new Map();
-async function getSupabaseAuthConfig(baseUrl) {
-  const normalized = normalizeBaseUrl2(baseUrl);
-  const cached = CACHE.get(normalized);
-  if (cached) {
-    return cached;
-  }
-  const client = new ApiClient({ baseUrl: normalized });
-  const response = await client.getJson("/api/v1/auth/config");
-  const config = {
-    url: response.supabase_url,
-    anonKey: response.supabase_anon_key
-  };
-  CACHE.set(normalized, config);
-  return config;
-}
-function normalizeBaseUrl2(raw) {
-  return raw.endsWith("/") ? raw : `${raw}/`;
-}
+import * as Sentry11 from "@sentry/node";
 
 // src/auth/credential-manager.ts
-var EXPIRY_BUFFER_MS = 6e4;
-var AUTH_REQUEST_TIMEOUT_MS = 15e3;
 var AuthContextError = class extends Error {
   code;
-  status;
   constructor(message, code, options) {
     super(message, { cause: options?.cause });
     this.name = "AuthContextError";
     this.code = code;
-    this.status = options?.status;
   }
 };
-async function ensureAuthContext(store, backendUrl, initialCredentials, options = {}) {
+async function ensureAuthContext(store, initialCredentials) {
   const credentials = initialCredentials ?? await store.load();
-  if (!credentials) {
+  const rawPat = credentials?.pat;
+  if (!credentials || rawPat === void 0 || rawPat === null) {
     throw new AuthContextError(
       "No credentials found. Run `omnara auth login` first.",
       "missing_credentials"
     );
   }
-  if (!credentials.refreshToken) {
-    throw new AuthContextError(
-      "Refresh token unavailable. Please run `omnara auth login`.",
-      "refresh_token_unavailable"
-    );
-  }
-  if (!credentials.accessToken) {
-    return await refreshWithStoredToken(
-      store,
-      credentials,
-      backendUrl,
-      "access_token_missing",
-      options
-    );
-  }
-  if (!isExpiring(credentials.accessTokenExpiresAt, EXPIRY_BUFFER_MS)) {
-    return { credentials, accessToken: credentials.accessToken };
-  }
-  return await refreshWithStoredToken(
-    store,
-    credentials,
-    backendUrl,
-    "access_token_expired",
-    options
-  );
-}
-async function refreshWithStoredToken(store, credentials, backendUrl, reasonCode, options) {
-  const reasonMessage = reasonCode === "access_token_missing" ? "No access token stored." : "Access token expired.";
-  return await store.withLock(async () => {
-    const latest = await store.load();
-    const effective = latest ?? credentials;
-    if (effective.accessToken && !isExpiring(effective.accessTokenExpiresAt, EXPIRY_BUFFER_MS)) {
-      return { credentials: effective, accessToken: effective.accessToken };
-    }
-    const refreshToken = effective.refreshToken;
-    if (!refreshToken) {
-      throw new AuthContextError(
-        `Cannot refresh Supabase session because no refresh token is stored. Please run \`omnara auth login\`.`,
-        "refresh_token_unavailable"
-      );
-    }
-    const session = await refreshSupabaseSession({
-      backendUrl,
-      refreshToken,
-      reasonMessage,
-      logger: options.logger
-    });
-    const updated = applySession(effective, session);
-    await store.save(updated);
-    if (!updated.accessToken) {
-      throw new AuthContextError(
-        "Supabase refresh completed without an access token.",
-        "refresh_failed"
-      );
-    }
-    return { credentials: updated, accessToken: updated.accessToken };
-  });
-}
-var MAX_REFRESH_ATTEMPTS = 3;
-var REFRESH_RETRY_DELAY_MS = 500;
-var INVALID_REFRESH_ERROR_CODES = /* @__PURE__ */ new Set([
-  "invalid_grant",
-  "refresh_token_not_found",
-  "refresh_token_already_used",
-  "session_not_found",
-  "session_expired"
-]);
-var INVALID_REFRESH_ERROR_PHRASES = [
-  "invalid refresh token",
-  "refresh token not found",
-  "refresh_token_not_found",
-  "refresh token already used",
-  "refresh token is expired",
-  "session not found",
-  "session expired",
-  "invalid_grant"
-];
-async function refreshSupabaseSession(options) {
-  const supabase = await createSupabaseClientWithRetry(
-    options.backendUrl,
-    options.reasonMessage,
-    options.logger
-  );
-  let attempt = 0;
-  let lastError = null;
-  while (attempt < MAX_REFRESH_ATTEMPTS) {
-    attempt += 1;
-    try {
-      options.logger?.debug?.(
-        `Refreshing Supabase session (attempt ${attempt}/${MAX_REFRESH_ATTEMPTS}).`
-      );
-      const result = await withTimeout(
-        supabase.auth.refreshSession({ refresh_token: options.refreshToken }),
-        AUTH_REQUEST_TIMEOUT_MS,
-        () => new AuthContextError(
-          `${options.reasonMessage} Supabase session refresh timed out after ${AUTH_REQUEST_TIMEOUT_MS}ms.`,
-          "network_error"
-        )
-      );
-      const { data, error } = result;
-      if (error || !data?.session) {
-        const status = typeof error?.status === "number" ? error.status : void 0;
-        const loginRequired = isInvalidRefreshTokenError(error);
-        const code = loginRequired ? "refresh_failed" : "network_error";
-        Sentry8.captureException(error);
-        throw new AuthContextError(
-          `${options.reasonMessage} Failed to refresh Supabase session: ${error?.message ?? "unknown error"}.`,
-          code,
-          { cause: error, status }
-        );
-      }
-      return data.session;
-    } catch (error) {
-      const authError = error instanceof AuthContextError ? error : new AuthContextError(
-        `${options.reasonMessage} Failed to refresh Supabase session: ${extractErrorMessage4(error)}.`,
-        "network_error",
-        { cause: error }
-      );
-      lastError = authError;
-      options.logger?.debug?.(
-        `Supabase refresh failed (status ${authError.status ?? "unknown"}): ${authError.message}`
-      );
-      if (authError.code === "network_error" && attempt < MAX_REFRESH_ATTEMPTS) {
-        options.logger?.debug?.("Retrying Supabase refresh after transient error.");
-        await delay2(REFRESH_RETRY_DELAY_MS * attempt);
-        continue;
-      }
-      Sentry8.captureException(authError);
-      throw authError;
-    }
-  }
-  throw lastError ?? new AuthContextError(
-    `${options.reasonMessage} Failed to refresh Supabase session after multiple attempts.`,
-    "network_error"
-  );
-}
-async function createSupabaseClientWithRetry(backendUrl, reasonMessage, logger3) {
-  let attempt = 0;
-  let lastError = null;
-  while (attempt < MAX_REFRESH_ATTEMPTS) {
-    attempt += 1;
-    try {
-      logger3?.debug?.(
-        `Loading Supabase auth configuration (attempt ${attempt}/${MAX_REFRESH_ATTEMPTS}).`
-      );
-      return await createSupabaseClient(backendUrl, reasonMessage);
-    } catch (error) {
-      const authError = error instanceof AuthContextError ? error : new AuthContextError(
-        `${reasonMessage} Failed to load Supabase configuration: ${extractErrorMessage4(error)}.`,
-        "network_error",
-        { cause: error }
-      );
-      lastError = authError;
-      if (authError.code === "network_error" && attempt < MAX_REFRESH_ATTEMPTS) {
-        logger3?.debug?.("Retrying Supabase auth configuration load after transient error.");
-        await delay2(REFRESH_RETRY_DELAY_MS * attempt);
-        continue;
-      }
-      throw authError;
-    }
-  }
-  throw lastError ?? new AuthContextError(
-    `${reasonMessage} Failed to load Supabase configuration after multiple attempts.`,
-    "network_error"
-  );
-}
-async function createSupabaseClient(backendUrl, reasonMessage) {
-  try {
-    const supabaseConfig = await withTimeout(
-      getSupabaseAuthConfig(backendUrl),
-      AUTH_REQUEST_TIMEOUT_MS,
-      () => new AuthContextError(
-        `${reasonMessage} Failed to load Supabase configuration: request timed out after ${AUTH_REQUEST_TIMEOUT_MS}ms.`,
-        "network_error"
-      )
-    );
-    return getSupabaseClient(supabaseConfig);
-  } catch (error) {
-    Sentry8.captureException(error);
+  const pat = rawPat.trim();
+  if (!pat) {
     throw new AuthContextError(
-      `${reasonMessage} Failed to load Supabase configuration: ${extractErrorMessage4(error)}.`,
-      "network_error",
-      { cause: error }
+      "Stored credentials are invalid. Please run `omnara auth login`.",
+      "invalid_credentials"
     );
   }
-}
-function isExpiring(expiresAtIso, bufferMs) {
-  if (!expiresAtIso) {
-    return true;
-  }
-  const timestamp = Date.parse(expiresAtIso);
-  if (Number.isNaN(timestamp)) {
-    return true;
-  }
-  return timestamp - bufferMs <= Date.now();
-}
-function applySession(credentials, session) {
-  const expiresAt = deriveAccessExpiry(session);
   return {
-    ...credentials,
-    accessToken: session.access_token,
-    accessTokenExpiresAt: expiresAt,
-    refreshToken: session.refresh_token ?? credentials.refreshToken
+    credentials: { pat },
+    pat
   };
 }
-function deriveAccessExpiry(session) {
-  if (session.expires_at) {
-    return new Date(session.expires_at * 1e3).toISOString();
-  }
-  if (session.expires_in) {
-    return new Date(Date.now() + session.expires_in * 1e3).toISOString();
-  }
-  return void 0;
-}
-function extractErrorMessage4(error) {
-  if (error instanceof Error && error.message) {
-    return error.message;
-  }
-  return String(error);
-}
-function isInvalidRefreshTokenError(error) {
-  if (!error) {
-    return false;
-  }
-  const statusField = error.status;
-  const status = typeof statusField === "number" ? statusField : void 0;
-  const codeRaw = error.code;
-  const code = typeof codeRaw === "string" ? codeRaw.toLowerCase() : "";
-  const messageRaw = error.message;
-  const message = typeof messageRaw === "string" ? messageRaw.toLowerCase() : "";
-  if (INVALID_REFRESH_ERROR_CODES.has(code)) {
-    return true;
-  }
-  if ((status === 400 || status === 401) && INVALID_REFRESH_ERROR_PHRASES.some((phrase) => message.includes(phrase))) {
-    return true;
-  }
-  return false;
-}
-async function withTimeout(promise, timeoutMs, onTimeout) {
-  let timeoutHandle = null;
-  try {
-    const timeoutPromise = new Promise((_, reject) => {
-      timeoutHandle = setTimeout(() => reject(onTimeout()), timeoutMs);
-    });
-    return await Promise.race([promise, timeoutPromise]);
-  } finally {
-    if (timeoutHandle) {
-      clearTimeout(timeoutHandle);
-    }
-  }
-}
 
 // src/auth/login-flow.ts
-import * as Sentry11 from "@sentry/node";
+import * as Sentry10 from "@sentry/node";
 
 // src/utils/prompt.ts
 import readline from "readline/promises";
@@ -6603,7 +6297,7 @@ function base64UrlEncode(input2) {
 // src/auth/loopback-listener.ts
 import http from "http";
 import { randomBytes as randomBytes2 } from "crypto";
-import * as Sentry9 from "@sentry/node";
+import * as Sentry8 from "@sentry/node";
 var CALLBACK_PATH = "/callback";
 var LISTEN_HOST = "127.0.0.1";
 var LoopbackListener = class _LoopbackListener {
@@ -6613,7 +6307,7 @@ var LoopbackListener = class _LoopbackListener {
       await listener.start();
       return listener;
     } catch (error) {
-      Sentry9.captureException(error);
+      Sentry8.captureException(error);
       await listener.stop().catch(() => void 0);
       return null;
     }
@@ -6759,7 +6453,7 @@ function buildMessageHtml(message) {
 
 // src/utils/browser.ts
 import { spawn } from "child_process";
-import * as Sentry10 from "@sentry/node";
+import * as Sentry9 from "@sentry/node";
 var buildBrowserFailureMessage = (url) => `Unable to automatically open ${url}. Please copy and paste this link into your browser.`;
 var escapeForPowerShell = (value) => value.replace(/'/g, "''");
 function tryOpenBrowser(url) {
@@ -6788,11 +6482,11 @@ function tryOpenBrowser(url) {
     if (process.env.DEBUG && error) {
       const details = error instanceof Error ? error.message : String(error);
       console.warn(`${baseMessage} (${details}).`);
-      Sentry10.captureException(error);
+      Sentry9.captureException(error);
       return;
     }
     if (error) {
-      Sentry10.captureException(error);
+      Sentry9.captureException(error);
     }
     console.warn(baseMessage);
   };
@@ -6848,9 +6542,8 @@ async function performVerificationLogin({
       code,
       codeVerifier ? { codeVerifier } : {}
     );
-    const updated = mergeCredentialsAfterExchange({
-      exchange
-    });
+    const pat = await issuePatToken(client, exchange.accessToken);
+    const updated = { pat };
     await store.save(updated);
     latestCredentials = updated;
     if (!successLogged) {
@@ -6897,7 +6590,7 @@ async function performVerificationLogin({
           break;
         }
       }
-      Sentry11.captureException(error);
+      Sentry10.captureException(error);
       await loopback?.stop();
       throw error;
     }
@@ -6923,33 +6616,13 @@ function resolveFrontendUrl(option) {
   const candidate = option ?? process.env.OMNARA_FRONTEND_URL ?? DEFAULT_FRONTEND_URL;
   return normalizeBaseUrl(candidate);
 }
-function mergeCredentialsAfterExchange(args) {
-  const now = Date.now();
-  const accessExpiresAt = new Date(now + args.exchange.accessTokenExpiresIn * 1e3).toISOString();
-  return {
-    accessToken: args.exchange.accessToken,
-    accessTokenExpiresAt: accessExpiresAt,
-    refreshToken: args.exchange.refreshToken
-  };
-}
-function formatDuration(ms) {
-  const totalSeconds = Math.round(ms / 1e3);
-  if (totalSeconds < 60) {
-    return `${totalSeconds}s`;
-  }
-  const totalMinutes = Math.round(totalSeconds / 60);
-  if (totalMinutes < 60) {
-    const seconds = totalSeconds % 60;
-    return seconds > 0 ? `${totalMinutes}m ${seconds}s` : `${totalMinutes}m`;
-  }
-  const totalHours = Math.floor(totalMinutes / 60);
-  const minutes = totalMinutes % 60;
-  if (totalHours < 48) {
-    return minutes > 0 ? `${totalHours}h ${minutes}m` : `${totalHours}h`;
-  }
-  const totalDays = Math.floor(totalHours / 24);
-  const hours = totalDays % 24;
-  return hours > 0 ? `${totalDays}d ${hours}h` : `${totalDays}d`;
+async function issuePatToken(client, accessToken) {
+  const response = await client.postJson(
+    "/api/v1/auth/pat",
+    {},
+    { accessToken }
+  );
+  return response.token;
 }
 function reportLoopbackError(error) {
   if (error instanceof ApiError) {
@@ -6958,8 +6631,8 @@ function reportLoopbackError(error) {
     );
     return;
   }
-  Sentry11.captureException(error);
-  console.log(`Automatic login failed: ${extractErrorMessage5(error)}`);
+  Sentry10.captureException(error);
+  console.log(`Automatic login failed: ${extractErrorMessage4(error)}`);
 }
 function printSessionInstructions(session) {
   console.log(
@@ -6968,7 +6641,7 @@ function printSessionInstructions(session) {
   console.log(chalk.blueBright.underline(`${session.verificationUriComplete}`));
   console.log(chalk.blue("\nApprove the request, then return to the CLI."));
 }
-function extractErrorMessage5(error) {
+function extractErrorMessage4(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -6991,96 +6664,57 @@ async function waitForLoopback(listener, sessionId, onCode) {
       reportLoopbackError(error);
     }
   } catch (error) {
-    Sentry11.captureException(error);
-    console.log(`Loopback listener error: ${extractErrorMessage5(error)}`);
+    Sentry10.captureException(error);
+    console.log(`Loopback listener error: ${extractErrorMessage4(error)}`);
   }
 }
 
 // src/auth/auth-provider.ts
-var TOKEN_REFRESH_BUFFER_MS = 6e4;
-var AUTH_RETRY_BASE_MS = 500;
-var AUTH_RETRY_MAX_MS = 5e3;
 var AuthProvider = class {
   constructor(options) {
     this.options = options;
     this.backendUrl = normalizeBaseUrl(options.backendUrl);
+    this.defaultInteractive = options.interactive ?? true;
   }
-  cached = null;
-  inflight = null;
+  lastBadPat = null;
+  defaultInteractive;
   backendUrl;
-  lastBadCredentials = null;
   async getAuthContext(options) {
-    const interactive = options?.interactive ?? true;
-    const snapshot = await this.options.store.load();
-    const useCache = this.cached && isAccessTokenFresh(this.cached) && credentialsEqual(this.cached.credentials, snapshot ?? null);
-    if (useCache && this.cached) {
-      return this.cached;
-    }
-    let inflight = this.inflight;
-    if (!inflight) {
-      const pending = this.loadAuthContext(interactive);
-      inflight = pending.finally(() => {
-        if (this.inflight === inflight) {
-          this.inflight = null;
-        }
-      });
-      this.inflight = inflight;
-    }
-    const auth = await inflight;
-    this.cached = auth;
-    return auth;
+    const interactive = options?.interactive ?? this.defaultInteractive;
+    return await this.loadAuthContext(interactive);
   }
   async getAccessToken(options) {
     const auth = await this.getAuthContext(options);
-    return auth.accessToken;
+    return auth.pat;
   }
   async loadAuthContext(interactive) {
-    let attempt = 0;
-    while (true) {
-      attempt += 1;
-      const snapshot = await this.options.store.load();
-      if (this.lastBadCredentials && credentialsEqual(snapshot ?? null, this.lastBadCredentials)) {
-        throw new AuthContextError(
-          "Stored credentials unchanged since invalid refresh token. Please log in.",
-          "refresh_failed"
-        );
+    const snapshot = await this.options.store.load();
+    if (this.lastBadPat && snapshot?.pat === this.lastBadPat) {
+      throw new AuthContextError(
+        "Stored credentials unchanged since invalid PAT. Please log in.",
+        "invalid_credentials"
+      );
+    }
+    try {
+      const context = await ensureAuthContext(this.options.store, snapshot);
+      this.lastBadPat = null;
+      return context;
+    } catch (error) {
+      const authError = error instanceof AuthContextError ? error : null;
+      if (authError?.code === "invalid_credentials") {
+        this.lastBadPat = snapshot?.pat ?? null;
       }
-      try {
-        const context = await ensureAuthContext(this.options.store, this.backendUrl, snapshot, {
-          logger: this.options.logger
-        });
-        this.cached = context;
-        this.lastBadCredentials = null;
-        return context;
-      } catch (error) {
-        const authError = error instanceof AuthContextError ? error : null;
-        if (authError?.code === "refresh_failed") {
-          this.lastBadCredentials = snapshot ?? null;
-        }
-        if (authError) {
-          Sentry12.captureException(authError);
-        } else {
-          Sentry12.captureException(error);
-        }
-        if (authError && shouldAttemptLogin(authError)) {
-          if (!interactive) {
-            throw authError;
-          }
-          await this.performLogin();
-          continue;
-        }
-        if (authError && !shouldRetryAuth(authError)) {
-          throw authError;
-        }
-        const delayMs = Math.min(
-          AUTH_RETRY_BASE_MS * 2 ** Math.min(attempt - 1, 6),
-          AUTH_RETRY_MAX_MS
-        );
-        this.options.logger?.debug?.(
-          `Auth transient error (${extractErrorMessage6(authError ?? error)}). Retrying in ${delayMs}ms\u2026`
-        );
-        await delay3(delayMs + Math.floor(Math.random() * 100));
+      if (authError) {
+        Sentry11.captureException(authError);
+      } else {
+        Sentry11.captureException(error);
       }
+      if (!interactive) {
+        throw authError ?? error;
+      }
+      await this.performLogin();
+      const updated = await this.options.store.load();
+      return await ensureAuthContext(this.options.store, updated);
     }
   }
   async performLogin() {
@@ -7093,74 +6727,10 @@ var AuthProvider = class {
     });
   }
 };
-function isAccessTokenFresh(context) {
-  const expiresAt = context.credentials.accessTokenExpiresAt;
-  if (!expiresAt) {
-    return false;
-  }
-  const timestamp = Date.parse(expiresAt);
-  if (Number.isNaN(timestamp)) {
-    return false;
-  }
-  return timestamp - TOKEN_REFRESH_BUFFER_MS > Date.now();
-}
-function shouldAttemptLogin(error) {
-  if (error instanceof AuthContextError) {
-    return authContextErrorRequiresLogin(error);
-  }
-  return false;
-}
-function authContextErrorRequiresLogin(error) {
-  switch (error.code) {
-    case "missing_credentials":
-    case "refresh_token_unavailable":
-    case "refresh_failed":
-      return true;
-    default:
-      return false;
-  }
-}
-function shouldRetryAuth(error) {
-  if (error.code !== "network_error") {
-    return false;
-  }
-  if (typeof error.status === "number" && error.status === 429) {
-    return true;
-  }
-  if (isLockErrorMessage(error.message)) {
-    return true;
-  }
-  if (typeof error.status === "number" && error.status >= 500) {
-    return true;
-  }
-  if (typeof error.status !== "number") {
-    return true;
-  }
-  return false;
-}
-function credentialsEqual(a, b) {
-  if (!a && !b) {
-    return true;
-  }
-  if (!a || !b) {
-    return false;
-  }
-  return a.accessToken === b.accessToken && a.accessTokenExpiresAt === b.accessTokenExpiresAt && a.refreshToken === b.refreshToken;
-}
 async function createAuthProvider(options) {
   const provider = new AuthProvider(options);
   return provider;
 }
-function isLockErrorMessage(message) {
-  const lower = message.toLowerCase();
-  return lower.includes("credentials lock") || lower.includes("acquiring credentials lock");
-}
-function extractErrorMessage6(error) {
-  if (error instanceof Error && error.message) {
-    return error.message;
-  }
-  return String(error);
-}
 
 // src/http/user-sessions.ts
 async function ensureUserSession(client, accessToken, options) {
@@ -7246,7 +6816,7 @@ var RelayBridge = class extends EventEmitter {
           } else {
             this.logger.debug("Relay bridge still waiting for credentials...");
           }
-          await delay4(LOGIN_WAIT_DELAY_MS);
+          await delay2(LOGIN_WAIT_DELAY_MS);
           continue;
         }
         const aborted = isAbortError(error);
@@ -7256,11 +6826,11 @@ var RelayBridge = class extends EventEmitter {
           }
           break;
         }
-        Sentry13.captureException(error);
+        Sentry12.captureException(error);
         this.logger.error(
-          `Relay connection failed: ${extractErrorMessage7(error)}. Retrying in ${Math.round(backoffMs / 1e3)}s.`
+          `Relay connection failed: ${extractErrorMessage5(error)}. Retrying in ${Math.round(backoffMs / 1e3)}s.`
         );
-        await delay4(backoffMs);
+        await delay2(backoffMs);
         backoffMs = Math.min(backoffMs * 2, 3e4);
       }
     }
@@ -7297,7 +6867,6 @@ var RelayBridge = class extends EventEmitter {
     const url = buildRelayWebsocketUrl(this.backendUrl, registration.relayWsPath);
     const ws = new WebSocket(url, {
       headers: {
-        authorization: `Bearer ${accessToken}`,
         "x-relay-token": registration.relayToken
       }
     });
@@ -7383,8 +6952,8 @@ var RelayBridge = class extends EventEmitter {
         target.send(serialized);
         return;
       } catch (error) {
-        Sentry13.captureException(error);
-        this.logger.error(`Failed to send relay frame: ${extractErrorMessage7(error)}`);
+        Sentry12.captureException(error);
+        this.logger.error(`Failed to send relay frame: ${extractErrorMessage5(error)}`);
         if (target === this.ws) {
           this.closeCurrentSocket();
         }
@@ -7417,7 +6986,7 @@ var RelayBridge = class extends EventEmitter {
       };
       const onError = (error) => {
         if (!this.stopped) {
-          Sentry13.captureException(error);
+          Sentry12.captureException(error);
           this.logger.error(`Relay websocket error: ${error.message}`);
         }
       };
@@ -7448,8 +7017,8 @@ var RelayBridge = class extends EventEmitter {
       const text = typeof data === "string" ? data : data.toString("utf8");
       parsed = JSON.parse(text);
     } catch (error) {
-      Sentry13.captureException(error);
-      this.logger.error(`Received invalid JSON from relay: ${extractErrorMessage7(error)}`);
+      Sentry12.captureException(error);
+      this.logger.error(`Received invalid JSON from relay: ${extractErrorMessage5(error)}`);
       return;
     }
     if (this.tryHandleControlMessage(parsed)) {
@@ -7674,7 +7243,7 @@ var RelayBridge = class extends EventEmitter {
         diff: diff.length > 0 ? diff : null
       };
     } catch (error) {
-      Sentry13.captureException(error);
+      Sentry12.captureException(error);
       this.logger.error(`Failed to get git diff for branch ${branchName}:`, error);
       return {
         type: "git_diff",
@@ -7784,8 +7353,8 @@ var RelayBridge = class extends EventEmitter {
       try {
         this.ws.send(payload);
       } catch (error) {
-        Sentry13.captureException(error);
-        this.logger.error(`Failed to flush relay queue: ${extractErrorMessage7(error)}`);
+        Sentry12.captureException(error);
+        this.logger.error(`Failed to flush relay queue: ${extractErrorMessage5(error)}`);
         this.pendingOutbound.unshift(payload);
         this.closeCurrentSocket();
         break;
@@ -7835,10 +7404,10 @@ function buildRelayWebsocketUrl(baseUrl, path16) {
   }
   return url.toString();
 }
-function delay4(ms) {
+function delay2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function extractErrorMessage7(error) {
+function extractErrorMessage5(error) {
   if (error instanceof Error) {
     return error.message;
   }
@@ -7874,14 +7443,14 @@ function waitForOpen(ws) {
   });
 }
 function isLoginRequiredError(error) {
-  return error instanceof AuthContextError && (error.code === "missing_credentials" || error.code === "refresh_token_unavailable" || error.code === "refresh_failed");
+  return error instanceof AuthContextError && (error.code === "missing_credentials" || error.code === "invalid_credentials");
 }
 function isUnauthorizedApiError(error) {
   return error instanceof ApiError && (error.status === 401 || error.status === 403);
 }
 
 // src/commands/agent.ts
-import * as Sentry14 from "@sentry/node";
+import * as Sentry13 from "@sentry/node";
 async function runAgentOrchestrator(options = {}) {
   const log = buildOrchestratorLogger();
   const orchestrator = await startAgentOrchestrator();
@@ -7911,7 +7480,7 @@ async function runAgentOrchestrator(options = {}) {
   try {
     await bridge.start();
   } catch (error) {
-    Sentry14.captureException(error);
+    Sentry13.captureException(error);
     log.error(`Relay orchestrator terminated: ${extractErrorMessage(error)}`);
     process.exitCode = process.exitCode || 1;
   } finally {
@@ -7930,7 +7499,7 @@ function createSignalHandler(onStop, log) {
     log.important(`
 Received ${signal}. Shutting down agent orchestrator...`);
     void onStop().catch((error) => {
-      Sentry14.captureException(error);
+      Sentry13.captureException(error);
       log.error("Error while shutting down agent orchestrator:", error);
     });
   };
@@ -7963,7 +7532,7 @@ function buildOrchestratorLogger() {
 
 // src/commands/auth.ts
 import { Command } from "commander";
-import * as Sentry15 from "@sentry/node";
+import * as Sentry14 from "@sentry/node";
 function buildAuthCommand() {
   const auth = new Command("auth").description("Authenticate the Omnara CLI.");
   auth.command("login").description("Authenticate via the browser-based verification flow.").action(async () => {
@@ -7976,13 +7545,13 @@ function buildAuthCommand() {
         store
       });
     } catch (error) {
-      Sentry15.captureException(error);
+      Sentry14.captureException(error);
       if (error instanceof ApiError) {
         console.error(`
 Request failed (HTTP ${error.status}): ${error.message}`);
       } else {
         console.error(`
-Login failed: ${extractErrorMessage8(error)}`);
+Login failed: ${extractErrorMessage6(error)}`);
       }
       process.exitCode = 1;
     }
@@ -8004,30 +7573,13 @@ Login failed: ${extractErrorMessage8(error)}`);
   return auth;
 }
 function printStatus(credentials) {
-  if (credentials.accessToken) {
-    const accessStatus = describeExpiry(credentials.accessTokenExpiresAt);
-    const refreshStatus = credentials.refreshToken ? "stored" : "missing";
-    console.log(
-      `Authentication: Supabase access token (${accessStatus}), Refresh token (${refreshStatus})`
-    );
+  if (credentials.pat) {
+    console.log("Authentication: PAT stored");
     return;
   }
   console.log("Authentication: Not configured");
 }
-function describeExpiry(iso) {
-  if (!iso) {
-    return "unknown expiry";
-  }
-  const timestamp = Date.parse(iso);
-  if (Number.isNaN(timestamp)) {
-    return "invalid timestamp";
-  }
-  const diff = timestamp - Date.now();
-  const abs = Math.abs(diff);
-  const descriptor = formatDuration(abs);
-  return diff >= 0 ? `expires in ${descriptor}` : `expired ${descriptor} ago`;
-}
-function extractErrorMessage8(error) {
+function extractErrorMessage6(error) {
   if (error instanceof Error) {
     return error.message;
   }
@@ -8036,22 +7588,22 @@ function extractErrorMessage8(error) {
 
 // src/commands/daemon.ts
 import { Command as Command2 } from "commander";
-import * as Sentry26 from "@sentry/node";
+import * as Sentry25 from "@sentry/node";
 
 // src/daemon/daemon-launcher.ts
 import { spawn as spawn2, exec as execCb } from "node:child_process";
 import path12 from "node:path";
-import os3 from "node:os";
-import { promisify } from "node:util";
+import os4 from "node:os";
+import { promisify as promisify2 } from "node:util";
 
 // src/daemon/daemon-client.ts
 import http2 from "node:http";
-import * as Sentry17 from "@sentry/node";
+import * as Sentry16 from "@sentry/node";
 
 // src/daemon/state-store.ts
 import fs7 from "node:fs/promises";
 import path8 from "node:path";
-import * as Sentry16 from "@sentry/node";
+import * as Sentry15 from "@sentry/node";
 
 // src/daemon/paths.ts
 import fs6 from "node:fs/promises";
@@ -8095,9 +7647,9 @@ var DaemonStateStore = class {
       if (isFileNotFound2(error)) {
         return null;
       }
-      Sentry16.captureException(error);
+      Sentry15.captureException(error);
       throw new Error(
-        `Failed to read daemon state from ${this.filePath}: ${extractErrorMessage9(error)}`
+        `Failed to read daemon state from ${this.filePath}: ${extractErrorMessage7(error)}`
       );
     }
   }
@@ -8116,7 +7668,7 @@ var DaemonStateStore = class {
       await fs7.unlink(this.filePath);
     } catch (error) {
       if (!isFileNotFound2(error)) {
-        Sentry16.captureException(error);
+        Sentry15.captureException(error);
         throw error;
       }
     }
@@ -8127,7 +7679,7 @@ function isFileNotFound2(error) {
     error && typeof error === "object" && "code" in error && error.code === "ENOENT"
   );
 }
-function extractErrorMessage9(error) {
+function extractErrorMessage7(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -8154,7 +7706,7 @@ var DaemonClient = class {
         await this.stateStore.clear();
         return null;
       }
-      Sentry17.captureException(error);
+      Sentry16.captureException(error);
       throw error;
     }
   }
@@ -8174,7 +7726,7 @@ var DaemonClient = class {
         await this.stateStore.clear();
         return null;
       }
-      Sentry17.captureException(error);
+      Sentry16.captureException(error);
       throw error;
     }
   }
@@ -8197,7 +7749,7 @@ var DaemonClient = class {
         await this.stateStore.clear();
         return false;
       }
-      Sentry17.captureException(error);
+      Sentry16.captureException(error);
       throw error;
     }
   }
@@ -8221,7 +7773,7 @@ var DaemonClient = class {
         await this.stateStore.clear();
         return null;
       }
-      Sentry17.captureException(error);
+      Sentry16.captureException(error);
       throw error;
     }
   }
@@ -8295,7 +7847,7 @@ function isProcessAlive2(pid) {
     if (isErrno2(error, "ESRCH")) {
       return false;
     }
-    Sentry17.captureException(error);
+    Sentry16.captureException(error);
     return false;
   }
 }
@@ -8328,13 +7880,13 @@ var HttpError = class extends Error {
 // src/daemon/directory-registry.ts
 import fs9 from "node:fs/promises";
 import path10 from "node:path";
-import * as Sentry19 from "@sentry/node";
+import * as Sentry18 from "@sentry/node";
 
 // src/daemon/config-store.ts
 import fs8 from "node:fs/promises";
 import path9 from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import * as Sentry18 from "@sentry/node";
+import * as Sentry17 from "@sentry/node";
 var DEFAULT_CONFIG = {
   directories: [],
   settings: {}
@@ -8352,9 +7904,9 @@ var DaemonConfigStore = class {
       if (isFileNotFound3(error)) {
         return cloneConfig(DEFAULT_CONFIG);
       }
-      Sentry18.captureException(error);
+      Sentry17.captureException(error);
       throw new Error(
-        `Failed to read daemon config from ${this.filePath}: ${extractErrorMessage10(error)}`
+        `Failed to read daemon config from ${this.filePath}: ${extractErrorMessage8(error)}`
       );
     }
   }
@@ -8436,7 +7988,7 @@ function isFileNotFound3(error) {
     error && typeof error === "object" && "code" in error && error.code === "ENOENT"
   );
 }
-function extractErrorMessage10(error) {
+function extractErrorMessage8(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -8474,14 +8026,14 @@ var DirectoryRegistry = class {
         throw new Error("Path is not a directory");
       }
     } catch (error) {
-      Sentry19.captureException(error);
+      Sentry18.captureException(error);
       throw new Error(
-        `Directory ${directoryPath} is not accessible: ${extractErrorMessage11(error)}`
+        `Directory ${directoryPath} is not accessible: ${extractErrorMessage9(error)}`
       );
     }
   }
 };
-function extractErrorMessage11(error) {
+function extractErrorMessage9(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -8494,9 +8046,14 @@ import chalk2 from "chalk";
 // src/daemon/session-pid-registry.ts
 import fs10 from "node:fs/promises";
 import path11 from "node:path";
-import * as Sentry20 from "@sentry/node";
+import os3 from "node:os";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import * as Sentry19 from "@sentry/node";
 var REGISTRY_PATH = path11.join(OMNARA_HOME_DIR, "session-processes.json");
 var LOCK_PATH = `${REGISTRY_PATH}.lock`;
+var execFileAsync = promisify(execFile);
+var START_TIME_TOLERANCE_MS = 5e3;
 async function acquireLock(retries = 20, delayMs = 50) {
   for (let attempt = 0; attempt < retries; attempt += 1) {
     try {
@@ -8504,7 +8061,7 @@ async function acquireLock(retries = 20, delayMs = 50) {
       return handle;
     } catch (error) {
       if (error.code !== "EEXIST") {
-        Sentry20.captureException(error);
+        Sentry19.captureException(error);
         throw error;
       }
       await new Promise((resolve) => setTimeout(resolve, delayMs));
@@ -8519,12 +8076,29 @@ async function releaseLock(handle) {
 async function readRegistry() {
   try {
     const raw = await fs10.readFile(REGISTRY_PATH, "utf8");
-    return JSON.parse(raw);
+    const parsed = JSON.parse(raw);
+    const normalized = {};
+    for (const [sessionId, value] of Object.entries(parsed)) {
+      if (typeof value === "number") {
+        normalized[sessionId] = {
+          pid: value
+        };
+        continue;
+      }
+      if (value && typeof value.pid === "number") {
+        normalized[sessionId] = {
+          pid: value.pid,
+          startedAt: typeof value.startedAt === "string" ? value.startedAt : void 0,
+          command: typeof value.command === "string" ? value.command : void 0
+        };
+      }
+    }
+    return normalized;
   } catch (error) {
     if (error.code === "ENOENT") {
       return {};
     }
-    Sentry20.captureException(error);
+    Sentry19.captureException(error);
     throw error;
   }
 }
@@ -8552,13 +8126,73 @@ async function isProcessAlive3(pid) {
     if (error.code === "ESRCH") {
       return false;
     }
-    Sentry20.captureException(error);
+    Sentry19.captureException(error);
+    return true;
+  }
+}
+async function isSessionProcessAlive(record) {
+  const alive = await isProcessAlive3(record.pid);
+  if (!alive) {
+    return false;
+  }
+  const tokensMatch = await matchesExpectedCommand(record.pid);
+  if (!tokensMatch) {
+    return false;
+  }
+  const timeMatch = await matchesStartTime(record.pid, record.startedAt);
+  if (record.startedAt && !timeMatch) {
+    return false;
+  }
+  return true;
+}
+async function matchesExpectedCommand(pid) {
+  if (os3.platform() === "win32") {
+    return true;
+  }
+  try {
+    const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "command="]);
+    const command = stdout.trim().toLowerCase();
+    if (!command) {
+      return false;
+    }
+    if (!command.includes("omnara") || !command.includes("daemon run-session")) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function matchesStartTime(pid, recordedStartedAt) {
+  if (os3.platform() === "win32") {
+    return true;
+  }
+  if (!recordedStartedAt) {
+    return true;
+  }
+  const recordedMs = Date.parse(recordedStartedAt);
+  if (Number.isNaN(recordedMs)) {
+    return true;
+  }
+  try {
+    const { stdout } = await execFileAsync("ps", ["-p", String(pid), "-o", "lstart="]);
+    const psStart = stdout.trim();
+    if (!psStart) {
+      return true;
+    }
+    const psDate = new Date(psStart);
+    if (Number.isNaN(psDate.getTime())) {
+      return true;
+    }
+    const delta = Math.abs(psDate.getTime() - recordedMs);
+    return delta <= START_TIME_TOLERANCE_MS;
+  } catch {
     return true;
   }
 }
 
 // src/daemon/daemon-launcher.ts
-var exec = promisify(execCb);
+var exec = promisify2(execCb);
 var DEFAULT_WAIT_MS = 1e4;
 async function ensureDaemonForSession(options = {}) {
   const logger3 = options.logger ?? logger;
@@ -8598,7 +8232,7 @@ async function ensureMachineNameConfigured(configStore, logger3) {
     process.env.OMNARA_MACHINE_NAME = config.machine.name;
     return config.machine.name;
   }
-  const defaultName = os3.hostname();
+  const defaultName = os4.hostname();
   let machineName = defaultName;
   if (process.stdin.isTTY && process.stdout.isTTY) {
     const answer = (await prompt(chalk2.blue(`Enter a name for this machine [${defaultName}]: `))).trim();
@@ -8701,13 +8335,13 @@ async function killAllDaemonProcesses(options = {}) {
           process.kill(pid, "SIGKILL");
           logger3.success(`Killed process ${pid}`);
         } catch (error) {
-          logger3.warn(`Failed to kill ${pid}: ${extractErrorMessage12(error)}`);
+          logger3.warn(`Failed to kill ${pid}: ${extractErrorMessage10(error)}`);
         }
       }
       await stateStore.clear();
       logger3.debug(`Cleared ${envLabel} daemon state file`);
     } catch (error) {
-      logger3.error(`Failed to kill ${envLabel} daemon processes: ${extractErrorMessage12(error)}`);
+      logger3.error(`Failed to kill ${envLabel} daemon processes: ${extractErrorMessage10(error)}`);
     }
   }
 }
@@ -8724,7 +8358,7 @@ async function killDaemonByState(options = {}) {
     process.kill(state.pid, "SIGKILL");
     logger3.success(`Killed daemon process ${state.pid}`);
   } catch (error) {
-    logger3.warn(`Failed to kill daemon ${state.pid}: ${extractErrorMessage12(error)}`);
+    logger3.warn(`Failed to kill daemon ${state.pid}: ${extractErrorMessage10(error)}`);
   }
   await stateStore.clear();
 }
@@ -8732,26 +8366,25 @@ async function killSessionsByRegistry(options = {}) {
   const logger3 = options.logger ?? logger;
   try {
     await withSessionRegistry(async (registry) => {
-      const pids = Object.values(registry);
-      for (const pid of pids) {
-        if (!Number.isFinite(pid)) {
+      for (const record of Object.values(registry)) {
+        if (!record || !Number.isFinite(record.pid)) {
           continue;
         }
-        const alive = await isProcessAlive3(pid);
+        const alive = await isSessionProcessAlive(record);
         if (!alive) {
           continue;
         }
         try {
-          process.kill(pid, "SIGKILL");
-          logger3.success(`Killed session process ${pid}`);
+          process.kill(record.pid, "SIGKILL");
+          logger3.success(`Killed session process ${record.pid}`);
         } catch (error) {
-          logger3.warn(`Failed to kill session ${pid}: ${extractErrorMessage12(error)}`);
+          logger3.warn(`Failed to kill session ${record.pid}: ${extractErrorMessage10(error)}`);
         }
       }
       return [{}, void 0];
     });
   } catch (error) {
-    logger3.warn(`Failed to kill sessions via registry: ${extractErrorMessage12(error)}`);
+    logger3.warn(`Failed to kill sessions via registry: ${extractErrorMessage10(error)}`);
   }
 }
 async function findDaemonRelatedPids() {
@@ -8788,7 +8421,7 @@ async function registerDirectory(directoryPath, options) {
     options.logger.warn("Daemon was unavailable; storing directory locally.");
   } catch (error) {
     options.logger.warn(
-      `Failed to register ${normalized} with daemon: ${extractErrorMessage12(error)}`
+      `Failed to register ${normalized} with daemon: ${extractErrorMessage10(error)}`
     );
   }
   const registry = new DirectoryRegistry();
@@ -8826,7 +8459,7 @@ async function waitForReady(client, options = {}) {
   logger3.warn("Timed out waiting for daemon readiness.");
   return null;
 }
-function extractErrorMessage12(error) {
+function extractErrorMessage10(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -8834,16 +8467,16 @@ function extractErrorMessage12(error) {
 }
 
 // src/daemon/run-daemon.ts
-import * as Sentry25 from "@sentry/node";
+import * as Sentry24 from "@sentry/node";
 
 // src/daemon/daemon-service.ts
-import * as Sentry24 from "@sentry/node";
+import * as Sentry23 from "@sentry/node";
 
 // src/daemon/local-control-server.ts
 import http3 from "node:http";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { URL as URL2 } from "node:url";
-import * as Sentry21 from "@sentry/node";
+import * as Sentry20 from "@sentry/node";
 var MIN_PORT = 1e4;
 var MAX_PORT = 65535;
 var MAX_ATTEMPTS = 100;
@@ -8910,8 +8543,8 @@ function createRequestHandler(context) {
           });
           sendJson(res, 200, { directory: result.entry, created: result.created });
         } catch (error) {
-          Sentry21.captureException(error);
-          sendJson(res, 400, { error: extractErrorMessage13(error) });
+          Sentry20.captureException(error);
+          sendJson(res, 400, { error: extractErrorMessage11(error) });
         }
         return;
       }
@@ -8939,8 +8572,8 @@ function createRequestHandler(context) {
             });
             return;
           }
-          Sentry21.captureException(error);
-          sendJson(res, 400, { error: extractErrorMessage13(error) });
+          Sentry20.captureException(error);
+          sendJson(res, 400, { error: extractErrorMessage11(error) });
         }
         return;
       }
@@ -8948,14 +8581,14 @@ function createRequestHandler(context) {
         const body = await readJsonBody(req);
         sendJson(res, 202, { status: "stopping" });
         Promise.resolve().then(() => context.onStopRequested(body?.status ?? "OFFLINE")).catch((error) => {
-          Sentry21.captureException(error);
+          Sentry20.captureException(error);
           context.logger?.error("Failed to stop daemon:", error);
         });
         return;
       }
       sendJson(res, 404, { error: "not_found" });
     } catch (error) {
-      Sentry21.captureException(error);
+      Sentry20.captureException(error);
       context.logger?.error("Control server error:", error);
       if (!res.headersSent) {
         sendJson(res, 500, { error: "internal_error" });
@@ -9042,7 +8675,7 @@ function isPortInUse(error) {
     error && typeof error === "object" && "code" in error && error.code === "EADDRINUSE"
   ) || false;
 }
-function extractErrorMessage13(error) {
+function extractErrorMessage11(error) {
   if (error instanceof Error && error.message) {
     return error.message;
   }
@@ -9051,10 +8684,10 @@ function extractErrorMessage13(error) {
 
 // src/daemon/machine-supervisor.ts
 import { randomUUID as randomUUID7 } from "node:crypto";
-import os4 from "node:os";
-import { setTimeout as delay5 } from "node:timers/promises";
+import os5 from "node:os";
+import { setTimeout as delay3 } from "node:timers/promises";
 import WebSocket2 from "ws";
-import * as Sentry23 from "@sentry/node";
+import * as Sentry22 from "@sentry/node";
 
 // src/http/machines.ts
 async function registerMachine(client, accessToken, payload) {
@@ -9089,14 +8722,14 @@ async function ensureWorkspace(client, accessToken, payload) {
 
 // src/daemon/session-runner.ts
 import { spawn as spawn3 } from "node:child_process";
-import * as Sentry22 from "@sentry/node";
+import * as Sentry21 from "@sentry/node";
+import fs11 from "node:fs";
 import path13 from "node:path";
 var SessionManager = class {
   backendUrl;
   frontendUrl;
   directoryRegistry;
   logger;
-  runners = /* @__PURE__ */ new Map();
   constructor(options) {
     this.backendUrl = options.backendUrl;
     this.frontendUrl = options.frontendUrl;
@@ -9104,9 +8737,6 @@ var SessionManager = class {
     this.logger = options.logger;
   }
   async startSession(spec) {
-    if (this.runners.has(spec.launchId)) {
-      throw new Error("Session is already running on this machine");
-    }
     const entry = await this.directoryRegistry.getEntry(spec.directory);
     if (!entry) {
       throw new Error(`Directory ${spec.directory} is not registered on this machine`);
@@ -9118,23 +8748,15 @@ var SessionManager = class {
       frontendUrl: this.frontendUrl,
       logger: this.logger,
       onExit: () => {
-        this.runners.delete(spec.launchId);
       }
     });
-    this.runners.set(spec.launchId, runner);
     try {
       await runner.start();
     } catch (error) {
-      this.runners.delete(spec.launchId);
-      Sentry22.captureException(error);
+      Sentry21.captureException(error);
       throw error;
     }
   }
-  async stopAll() {
-    const runners = Array.from(this.runners.values());
-    this.runners.clear();
-    await Promise.all(runners.map((runner) => runner.stop()));
-  }
 };
 var SessionRunner = class {
   spec;
@@ -9143,12 +8765,7 @@ var SessionRunner = class {
   frontendUrl;
   logger;
   onExit;
-  startedAt = null;
   child = null;
-  exitPromise = null;
-  resolveExit = null;
-  exitHandled = false;
-  sessionLogPath = null;
   constructor(options) {
     this.spec = options.spec;
     this.directory = options.directory;
@@ -9165,15 +8782,12 @@ var SessionRunner = class {
     if (!entry) {
       throw new Error("Unable to determine CLI entry path for session runner");
     }
-    this.exitPromise = new Promise((resolve) => {
-      this.resolveExit = resolve;
-    });
-    this.sessionLogPath = await createSessionLogPath(this.spec.workspaceId, this.spec.launchId);
-    this.logger.info(`Session ${this.spec.launchId} logs available at ${this.sessionLogPath}`);
+    const sessionLogPath = await createSessionLogPath(this.spec.workspaceId, this.spec.launchId);
+    this.logger.info(`Session ${this.spec.launchId} logs available at ${sessionLogPath}`);
     await withSessionRegistry(async (registry) => {
-      const existingPid = registry[this.spec.userSessionId];
-      if (existingPid) {
-        const alive = await isProcessAlive3(existingPid);
+      const existing = registry[this.spec.userSessionId];
+      if (existing) {
+        const alive = await isSessionProcessAlive(existing);
         if (alive) {
           throw new Error(`User session ${this.spec.userSessionId} is already running`);
         }
@@ -9199,7 +8813,7 @@ var SessionRunner = class {
       OMNARA_WORKSPACE_ID: this.spec.workspaceId,
       OMNARA_WORKSPACE_DIR: this.directory.path,
       OMNARA_USER_SESSION_ID: this.spec.userSessionId,
-      ...this.sessionLogPath ? { OMNARA_SESSION_LOG_PATH: this.sessionLogPath } : {}
+      OMNARA_SESSION_LOG_PATH: sessionLogPath
     };
     if (this.spec.workspaceConfig) {
       env.OMNARA_WORKSPACE_CONFIG = JSON.stringify(this.spec.workspaceConfig);
@@ -9210,95 +8824,58 @@ var SessionRunner = class {
     if (this.spec.metadata) {
       env.OMNARA_WORKSPACE_METADATA = JSON.stringify(this.spec.metadata);
     }
-    const child = spawn3(process.execPath, args, {
-      cwd: this.directory.path,
-      stdio: ["ignore", "ignore", "ignore"],
-      env
-    });
-    this.child = child;
-    let spawned = false;
-    const spawnPromise = new Promise((resolve, reject) => {
-      child.once("spawn", () => {
-        spawned = true;
-        this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-        this.writeLog("INFO", `Session process started in ${this.directory.path}`);
-        resolve();
+    let logFd = null;
+    try {
+      logFd = fs11.openSync(sessionLogPath, "a");
+      const child = spawn3(process.execPath, args, {
+        cwd: this.directory.path,
+        stdio: ["ignore", logFd, logFd],
+        env,
+        detached: true
       });
-      child.once("error", (error) => {
-        if (!spawned) {
-          Sentry22.captureException(error);
-          this.writeLog("ERROR", error.message);
-          this.cleanup();
-          this.resolveExit?.();
-          reject(error);
-        } else {
-          Sentry22.captureException(error);
-          this.handleExit(error.message, true);
-        }
+      fs11.closeSync(logFd);
+      logFd = null;
+      child.unref();
+      await new Promise((resolve, reject) => {
+        child.once("spawn", resolve);
+        child.once("error", reject);
       });
-      child.once("exit", (code, signal) => {
-        const message = buildExitMessage(code, signal);
-        const failed = typeof code === "number" && code !== 0;
-        this.handleExit(message, failed);
+      this.child = child;
+      child.once("exit", () => {
+        this.onExit();
+        this.child = null;
       });
-    });
-    await withSessionRegistry(async (registry) => {
-      registry[this.spec.userSessionId] = child.pid ?? -1;
-      return [registry, null];
-    });
-    await spawnPromise;
+      const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const command = `${process.execPath} ${args.join(" ")}`;
+      await withSessionRegistry(async (registry) => {
+        registry[this.spec.userSessionId] = {
+          pid: child.pid ?? -1,
+          startedAt,
+          command
+        };
+        return [registry, null];
+      });
+    } catch (error) {
+      if (logFd !== null) {
+        try {
+          fs11.closeSync(logFd);
+        } catch {
+        }
+      }
+      Sentry21.captureException(error);
+      this.logger.error("Failed to start session process:", error);
+      throw error;
+    }
   }
   async stop() {
     if (!this.child) {
-      await this.exitPromise;
       return;
     }
     if (!this.child.killed) {
       this.child.kill("SIGINT");
     }
-    await this.exitPromise;
-  }
-  handleExit(reason, failed) {
-    if (this.exitHandled) {
-      return;
-    }
-    this.exitHandled = true;
-    if (reason) {
-      this.writeLog(failed ? "ERROR" : "INFO", reason);
-    }
-    this.cleanup();
-    this.resolveExit?.();
-    this.onExit();
-  }
-  cleanup() {
-    if (this.child) {
-      this.child.removeAllListeners();
-      this.child = null;
-    }
-    void withSessionRegistry(async (registry) => {
-      delete registry[this.spec.userSessionId];
-      return [registry, null];
-    });
-  }
-  writeLog(level, ...args) {
-    if (level === "ERROR") {
-      this.logger.error(...args);
-    } else if (level === "WARN") {
-      this.logger.warn(...args);
-    } else {
-      this.logger.info(...args);
-    }
   }
 };
-function buildExitMessage(code, signal) {
-  if (code !== null) {
-    return code === 0 ? null : `Process exited with code ${code}`;
-  }
-  if (signal) {
-    return `Process terminated via signal ${signal}`;
-  }
-  return null;
-}
 async function createSessionLogPath(workspaceId, launchId) {
   await ensureOmnaraHome();
   const workspaceDir = path13.join(USER_SESSION_LOG_ROOT, workspaceId);
@@ -9308,10 +8885,22 @@ async function createSessionLogPath(workspaceId, launchId) {
   return logPath;
 }
 
+// src/package-info.ts
+import { createRequire } from "node:module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var FALLBACK_NAME = pkg.name ?? "omnara";
+var FALLBACK_VERSION = pkg.version ?? "0.0.0";
+var FALLBACK_DESCRIPTION = pkg.description ?? "Command-line interface for Omnara.";
+var PACKAGE_NAME = true ? "omnara" : FALLBACK_NAME;
+var PACKAGE_VERSION = true ? "0.4.0" : FALLBACK_VERSION;
+var PACKAGE_DESCRIPTION = true ? "Command-line interface for Omnara." : FALLBACK_DESCRIPTION;
+
 // src/daemon/machine-supervisor.ts
 var HEARTBEAT_INTERVAL_MS = 1e4;
 var RECONNECT_DELAY_MS = 2e3;
 var LOGIN_WAIT_DELAY_MS2 = 3e4;
+var CONNECT_TIMEOUT_MS = 3e4;
 var DAEMON_VERSION = PACKAGE_VERSION ?? "0.0.0";
 var MachineSupervisor = class {
   backendUrl;
@@ -9376,15 +8965,14 @@ var MachineSupervisor = class {
       type: "heartbeat",
       status,
       metadata: {
-        hostname: os4.hostname(),
-        platform: os4.platform(),
-        architecture: os4.arch(),
+        hostname: os5.hostname(),
+        platform: os5.platform(),
+        architecture: os5.arch(),
         daemon_version: DAEMON_VERSION
       },
       directories: directories.map((entry) => entry.path)
     };
     await this.sendMessage(payload);
-    await this.sessionManager.stopAll();
     await this.closeWebsocket();
     if (this.loopPromise) {
       await this.loopPromise;
@@ -9412,11 +9000,11 @@ var MachineSupervisor = class {
           } else {
             this.logger.debug("Machine supervisor still waiting for login\u2026");
           }
-          await delay5(LOGIN_WAIT_DELAY_MS2);
+          await delay3(LOGIN_WAIT_DELAY_MS2);
         } else {
-          Sentry23.captureException(error);
+          Sentry22.captureException(error);
           this.logger.warn(`Machine supervisor error: ${error.message}`);
-          await delay5(RECONNECT_DELAY_MS);
+          await delay3(RECONNECT_DELAY_MS);
         }
       }
     }
@@ -9435,9 +9023,9 @@ var MachineSupervisor = class {
     const payload = {
       machine_id: config.machine?.id,
       machine_name: machineName,
-      hostname: os4.hostname(),
-      platform: os4.platform(),
-      architecture: os4.arch(),
+      hostname: os5.hostname(),
+      platform: os5.platform(),
+      architecture: os5.arch(),
       daemon_version: DAEMON_VERSION,
       directories: directories.map((entry) => entry.path),
       metadata: {
@@ -9459,7 +9047,7 @@ var MachineSupervisor = class {
         });
         return await this.registerMachine();
       }
-      Sentry23.captureException(error);
+      Sentry22.captureException(error);
       throw error;
     }
     const now = /* @__PURE__ */ new Date();
@@ -9494,7 +9082,38 @@ var MachineSupervisor = class {
         }
       });
       this.websocket = ws;
+      let done = false;
+      let connectTimer = null;
+      const finish = (error) => {
+        if (done) return;
+        done = true;
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
+        this.clearHeartbeatTimer();
+        this.websocket = null;
+        try {
+          ws.removeAllListeners();
+          if (ws.readyState === WebSocket2.OPEN || ws.readyState === WebSocket2.CONNECTING) {
+            ws.close();
+          }
+        } catch {
+        }
+        if (error) {
+          reject(error);
+        } else {
+          resolve();
+        }
+      };
+      connectTimer = setTimeout(() => {
+        finish(new Error("machine websocket connection timed out"));
+      }, CONNECT_TIMEOUT_MS);
       ws.on("open", () => {
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
         this.logger.success("\u2713 Machine daemon connected to backend");
         void this.sendHeartbeat().catch((error) => {
           this.logger.error("Failed to send heartbeat:", error);
@@ -9505,25 +9124,28 @@ var MachineSupervisor = class {
         try {
           this.handleSocketMessage(data);
         } catch (error) {
-          Sentry23.captureException(error);
+          Sentry22.captureException(error);
           this.logger.error("Failed to process machine message:", error);
         }
       });
       ws.on("close", (code, reason) => {
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
         this.logger.warn(
           `Machine websocket closed (${code}${reason ? `: ${reason.toString()}` : ""})`
         );
-        this.clearHeartbeatTimer();
-        this.websocket = null;
         if (this.stopRequested) {
-          resolve();
+          finish();
         } else {
-          reject(new Error("machine websocket closed"));
+          finish(new Error("machine websocket closed"));
         }
       });
       ws.on("error", (error) => {
-        Sentry23.captureException(error);
+        Sentry22.captureException(error);
         this.logger.error("Machine websocket error:", error);
+        finish(new Error("machine websocket error"));
       });
     });
   }
@@ -9563,7 +9185,7 @@ var MachineSupervisor = class {
         });
         return;
       }
-      Sentry23.captureException(error);
+      Sentry22.captureException(error);
       const messageText = error instanceof Error ? error.message : String(error);
       await this.sendRpcResponse(message.request_id, "error", messageText);
     }
@@ -9647,7 +9269,7 @@ var MachineSupervisor = class {
         await this.recoverMachineRegistration("workspace ensure returned 404");
         return await this.ensureWorkspaceWithRetry(directory, metadata, attempt + 1);
       }
-      Sentry23.captureException(error);
+      Sentry22.captureException(error);
       throw error;
     }
   }
@@ -9686,7 +9308,7 @@ var MachineSupervisor = class {
           return;
         }
       }
-      await delay5(250);
+      await delay3(250);
     }
     throw new Error("Machine has not finished registering yet. Try again in a few seconds.");
   }
@@ -9694,7 +9316,7 @@ var MachineSupervisor = class {
     this.clearHeartbeatTimer();
     this.heartbeatTimer = setInterval(() => {
       void this.sendHeartbeat().catch((error) => {
-        Sentry23.captureException(error);
+        Sentry22.captureException(error);
         this.logger.error("Failed to send heartbeat:", error);
       });
     }, HEARTBEAT_INTERVAL_MS);
@@ -9711,9 +9333,9 @@ var MachineSupervisor = class {
       type: "heartbeat",
       status: "ONLINE",
       metadata: {
-        hostname: os4.hostname(),
-        platform: os4.platform(),
-        architecture: os4.arch(),
+        hostname: os5.hostname(),
+        platform: os5.platform(),
+        architecture: os5.arch(),
         daemon_version: DAEMON_VERSION
       },
       directories: directories.map((entry) => entry.path)
@@ -9776,13 +9398,13 @@ function buildMachineWebsocketUrl(baseUrl, path16) {
   return url.toString();
 }
 function isLoginRequiredError2(error) {
-  return error instanceof AuthContextError && (error.code === "missing_credentials" || error.code === "refresh_token_unavailable" || error.code === "refresh_failed");
+  return error instanceof AuthContextError && (error.code === "missing_credentials" || error.code === "invalid_credentials");
 }
 function isUnauthorizedApiError2(error) {
   return error instanceof ApiError && (error.status === 401 || error.status === 403);
 }
 function deriveMachineName() {
-  return process.env.OMNARA_MACHINE_NAME || os4.hostname();
+  return process.env.OMNARA_MACHINE_NAME || os5.hostname();
 }
 function decodeJson(raw) {
   const text = typeof raw === "string" ? raw : raw.toString("utf8");
@@ -9834,7 +9456,7 @@ var DaemonService = class {
       this.resolveStopPromise = null;
       await this.machineSupervisor?.stop("OFFLINE").catch(() => void 0);
       await this.cleanupState();
-      Sentry24.captureException(error);
+      Sentry23.captureException(error);
       throw error;
     }
   }
@@ -9902,7 +9524,7 @@ var DaemonService = class {
 };
 
 // src/daemon/run-daemon.ts
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 import path14 from "node:path";
 async function runDaemonProcess() {
   await ensureOmnaraHome();
@@ -9910,7 +9532,7 @@ async function runDaemonProcess() {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const fileName = `${timestamp}-${process.pid}.log`;
   const logPath = path14.join(DAEMON_LOG_DIR, fileName);
-  const stream = fs11.createWriteStream(logPath, {
+  const stream = fs12.createWriteStream(logPath, {
     flags: "a",
     mode: DEFAULT_FILE_MODE2
   });
@@ -9959,7 +9581,7 @@ async function runDaemonProcess() {
     return () => {
       logger3.warn(`Received ${signal}. Stopping daemon...`);
       void service.stop().catch((error) => {
-        Sentry25.captureException(error);
+        Sentry24.captureException(error);
         logger3.error("Failed to stop daemon:", error);
       });
     };
@@ -9972,7 +9594,7 @@ async function runDaemonProcess() {
     await service.start();
     await service.waitForShutdown();
   } catch (error) {
-    Sentry25.captureException(error);
+    Sentry24.captureException(error);
     logger3.error("Daemon exited with error:", error);
     process.exitCode = 1;
   } finally {
@@ -10027,7 +9649,7 @@ function buildDaemonCommand() {
     try {
       process.chdir(options.directory);
     } catch (error) {
-      Sentry26.captureException(error);
+      Sentry25.captureException(error);
       logger.error(
         `Unable to switch to directory ${options.directory}: ${error.message}`
       );
@@ -10045,7 +9667,7 @@ function buildDaemonCommand() {
         userSessionId: options.userSessionId
       });
     } catch (error) {
-      Sentry26.captureException(error);
+      Sentry25.captureException(error);
       logger.error("User session exited with error:", error);
       process.exitCode = process.exitCode || 1;
     }
@@ -10080,7 +9702,7 @@ function buildKillCommand() {
 // src/utils/version-check.ts
 import chalk3 from "chalk";
 import { execSync } from "child_process";
-import * as Sentry27 from "@sentry/node";
+import * as Sentry26 from "@sentry/node";
 async function fetchLatestVersion(packageName) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 3e3);
@@ -10174,13 +9796,13 @@ $ sudo npm install -g ${packageName}@latest`,
             "\n"
           )
         );
-        Sentry27.captureException(err);
+        Sentry26.captureException(err);
       }
     } else {
       console.log(chalk3.grey("Omnara is up to date!\n"));
     }
   } catch (e) {
-    Sentry27.captureException(e);
+    Sentry26.captureException(e);
     console.log(e);
   }
   return false;
@@ -10292,7 +9914,7 @@ async function run(argv) {
   try {
     await program.parseAsync(argv);
   } catch (error) {
-    Sentry28.captureException(error);
+    Sentry27.captureException(error);
     program.error(error.message, { exitCode: 1 });
   }
 }
@@ -10306,7 +9928,7 @@ function isMainModule() {
 }
 if (isMainModule()) {
   run(process.argv).catch((error) => {
-    Sentry28.captureException(error);
+    Sentry27.captureException(error);
     logger.error(error);
     process.exitCode = 1;
   });
@@ -10382,7 +10004,7 @@ ${chalk5.bold("Chat via the Omnara mobile app or web dashboard")}: ${chalk5.unde
       process.exitCode = 1;
       return;
     }
-    Sentry28.captureException(error);
+    Sentry27.captureException(error);
     logger.warn(`Failed to prepare daemon: ${error.message}`);
   }
 }
@@ -10403,7 +10025,7 @@ async function requestDaemonLaunch(client, payload, options) {
       if (isRecoverableLaunchError(error)) {
         options.logger.debug("Daemon not ready for launch yet:", error.message);
       } else {
-        Sentry28.captureException(error);
+        Sentry27.captureException(error);
         throw error;
       }
     }