orkestrator 2.28.0-beta → 2.29.0-beta

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orkestrator",
-  "version": "2.28.0-beta",
+  "version": "2.29.0-beta",
   "description": "Run the Orkestrator backend service without the desktop application",
   "homepage": "https://orkestrator.dev",
   "repository": {
@@ -39,8 +39,8 @@
     "sharp": "0.35.5"
   },
   "devDependencies": {
-    "@orkestrator/protocol": "2.28.0-beta",
-    "@orkestrator/toolchain": "2.28.0-beta"
+    "@orkestrator/protocol": "2.29.0-beta",
+    "@orkestrator/toolchain": "2.29.0-beta"
   },
   "engines": {
     "bun": ">=1.4.3"

package/resources/claude-bridge/dist/index.js

@@ -12593,6 +12593,10 @@ var authRead;
 var authReadGeneration;
 var authRefreshPending = false;
 var authGeneration = 0;
+var turnAuthenticationFailedUntil = 0;
+function withTurnFailure(value) {
+  return Date.now() < turnAuthenticationFailedUntil && value.state === "signed-in" ? { ...value, state: "expired" } : value;
+}
 function presentSource(value) {
   return value && value !== "none" ? value : undefined;
 }
@@ -12629,8 +12633,9 @@ async function probeAccount() {
   }
 }
 function readClaudeAuthStatus() {
-  if (authCache && authCache.expiresAt > Date.now())
-    return Promise.resolve(authCache.value);
+  if (authCache && authCache.expiresAt > Date.now()) {
+    return Promise.resolve(withTurnFailure(authCache.value));
+  }
   if (authRead)
     return authRead;
   const generation = authGeneration;
@@ -12645,7 +12650,7 @@ function readClaudeAuthStatus() {
     if (generation === authGeneration) {
       authCache = { expiresAt: Date.now() + ttl, value };
     }
-    return value;
+    return withTurnFailure(value);
   }).finally(() => {
     if (authRead !== read)
       return;
@@ -12661,6 +12666,7 @@ function readClaudeAuthStatus() {
   return read;
 }
 function noteClaudeAuthenticationFailure() {
+  turnAuthenticationFailedUntil = Date.now() + AUTH_CACHE_TTL_MS;
   authCache = undefined;
   if (authRead && authReadGeneration !== authGeneration)
     authRefreshPending = true;
@@ -12669,6 +12675,7 @@ function noteClaudeAuthenticationFailure() {
 function noteClaudeAuthenticationWorked() {
   authGeneration += 1;
   authRefreshPending = false;
+  turnAuthenticationFailedUntil = 0;
   if (authCache?.value.state === "needs-auth")
     authCache = undefined;
 }
@@ -14797,7 +14804,8 @@ function claudeQueryOptions(turn, plan, turnFor, mcp) {
       append: [
         "IMPORTANT: You MUST read a file before editing or writing to it. The Edit and Write tools will fail if you have not first used the Read tool to read the file in this conversation. Always read files before attempting to modify them.",
         backgroundCommandInstruction(queryEnvironment),
-        "When the user asks for a document (a report, design doc, plan, analysis, guide, or other writing to keep), prefer writing it as a Markdown file in a `docs/` folder at the root of the working directory over creating a Claude Doc or claude.ai artifact, and tell the user the file's path. Project instructions (such as CLAUDE.md or AGENTS.md), local skills, and the user's own request take priority over this default when they say where or how to write documents."
+        "When the user asks for a document (a report, design doc, plan, analysis, guide, or other writing to keep), prefer writing it as a Markdown file in a `docs/` folder at the root of the working directory over creating a Claude Doc or claude.ai artifact, and tell the user the file's path. Project instructions (such as CLAUDE.md or AGENTS.md), local skills, and the user's own request take priority over this default when they say where or how to write documents.",
+        "When you show the user an image in your reply (a screenshot, rendered preview, or chart) using Markdown image syntax, reference it by its absolute path. In a managed worktree or container environment, save the file inside the working directory, preferably in a git-ignored folder so preview files stay out of the change set. Local image previews are limited to Orkestrator-managed workspace storage or the container's /workspace. Project-home checkouts are excluded from host preview reads, even when they are the working directory, so images saved there cannot be previewed from a local Markdown path. Paths outside previewable storage, such as /tmp, also show a placeholder."
       ].join(`
 
 `)