privateer-agent 0.6.6 → 0.6.8

package/src/auth/privateer.ts

@@ -15,6 +15,14 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, rmSync } from "node:fs";
 import { hostname, userInfo } from "node:os";
 import { globalDir, credentialsPath } from "../config/paths.ts";
+import {
+  type OwnedSession,
+  recordOwnedSession,
+  forgetOwnedSession,
+  orphanedSessions,
+  dropOwnedSession,
+  clearOwnedSessions,
+} from "./accountSessions.ts";
 import { isAccountCapCode } from "../engine/errors.ts";
 import { terminalPublicKeyBase64 } from "../crypto/terminalKey.ts";
 import { pinAccountSignKey, clearAccountSignKey } from "../crypto/accountTrust.ts";
@@ -87,9 +95,37 @@ export function defaultDeviceLabel(): string {
   }
 }
 
-// ── Credential storage (0600, like saveGlobalConfig) ─────────────────────────
+// ── Cross-instance state ─────────────────────────────────────────────────────
+//
+// Pi loads every extension with a FRESH jiti instance (`moduleCache: false`, see
+// core/extensions/loader.js), so privateer-brand and privateer-account each get their
+// OWN copy of this module — separate credential cache, separate listener sets.
+//
+// That silently broke /login. The account provider's OAuth login() ran inside the
+// privateer-account copy and called notifySignedIn() there, while the UI's listener
+// (the one that switches the live session onto a model the account can actually
+// serve) was registered on the privateer-brand copy. The signal never crossed, so a
+// successful sign-in left the terminal pinned to its keyless launch model and the
+// very next prompt died with "No API key found for openrouter" — exactly the state
+// the login was supposed to fix. The same split let a /logout in one copy leave a
+// stale `user` memoized in another.
+//
+// So anything that must be observed ACROSS extensions lives on globalThis, keyed by
+// a registered Symbol — one bus, however many module instances jiti creates.
+const SHARED = Symbol.for("privateer.auth.shared");
+
+interface SharedAuthState {
+  cache: Credentials | null;
+  signedIn: Set<SignedInListener>;
+  expired: Set<SessionExpiredListener>;
+}
+
+function shared(): SharedAuthState {
+  const g = globalThis as { [SHARED]?: SharedAuthState };
+  return (g[SHARED] ??= { cache: null, signedIn: new Set(), expired: new Set() });
+}
 
-let _cache: Credentials | null | undefined;
+// ── Credential storage (0600, like saveGlobalConfig) ─────────────────────────
 
 // Per-terminal child session (see spawnChildSession). Held in memory ONLY — it
 // is never written to the shared credentials file, so each running terminal
@@ -117,6 +153,15 @@ let _refreshInFlight: Promise<ChildSession> | null = null;
 // right after revokeLocalSessions() so the next launch spawns a fresh session instead
 // of reusing the revoked one. Doing both is safe; doing only one is not. See
 // revokeLocalSessions and its callers (cli/chat.ts, daemon/index.ts).
+//
+// That pairing only covers a CLEAN exit, though. A terminal killed without running its
+// shutdown hook leaves its row alive server-side for the full TTL, and the next launch
+// used to spawn another on top of it — enough repeats and the spawn is refused with
+// `429 CHILD_SESSION_CAP`. So every session is also recorded in a pid-keyed registry
+// (auth/accountSessions.ts) and acquireAccountCredential reclaims one whose owning
+// terminal is gone instead of spawning. Keep the registry in step with reality:
+// recordOwnedSession wherever a credential is minted or rotated, forgetOwnedSession
+// wherever one is revoked.
 let _account: { accessToken: string } | null = null;
 
 export function loadCredentials(): Credentials | null {
@@ -128,15 +173,16 @@ export function loadCredentials(): Credentials | null {
   // memoized the pre-login "absent" as null, that instance would report "not signed
   // in" forever (e.g. /remote-access refusing after a successful sign-in). Re-reading
   // disk on each miss lets a later call see what a sign-in just wrote.
-  if (_cache) return _cache;
+  const state = shared();
+  if (state.cache) return state.cache;
   const path = credentialsPath();
   if (!existsSync(path)) return null;
   try {
-    _cache = JSON.parse(readFileSync(path, "utf8")) as Credentials;
+    state.cache = JSON.parse(readFileSync(path, "utf8")) as Credentials;
   } catch {
     return null;
   }
-  return _cache;
+  return state.cache;
 }
 
 export function saveCredentials(creds: Credentials): void {
@@ -146,7 +192,7 @@ export function saveCredentials(creds: Credentials): void {
   const path = credentialsPath();
   writeFileSync(path, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
   tryChmod(path, 0o600);
-  _cache = creds;
+  shared().cache = creds;
 }
 
 export function clearCredentials(): void {
@@ -158,7 +204,7 @@ export function clearCredentials(): void {
   // Drop the pinned account signing key too — it belongs to the account that just
   // signed out; a different account must re-pin its own at link.
   clearAccountSignKey();
-  _cache = null;
+  shared().cache = null;
   _child = null;
   _account = null;
 }
@@ -188,15 +234,15 @@ function tryChmod(path: string, mode: number): void {
 // stops working; the UI subscribes to announce the sign-out prominently.
 
 type SessionExpiredListener = () => void;
-const _expiredListeners = new Set<SessionExpiredListener>();
 
 export function onSessionExpired(listener: SessionExpiredListener): () => void {
-  _expiredListeners.add(listener);
-  return () => _expiredListeners.delete(listener);
+  const listeners = shared().expired;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
 }
 
 function notifySessionExpired(): void {
-  for (const listener of _expiredListeners) {
+  for (const listener of shared().expired) {
     try {
       listener();
     } catch {
@@ -232,17 +278,19 @@ export function handleServerRevoke(): void {
 // A listener here refreshes the UI regardless of which path the user took.
 
 type SignedInListener = () => void;
-const _signedInListeners = new Set<SignedInListener>();
 
 export function onSignedIn(listener: SignedInListener): () => void {
-  _signedInListeners.add(listener);
-  return () => _signedInListeners.delete(listener);
+  const listeners = shared().signedIn;
+  listeners.add(listener);
+  return () => listeners.delete(listener);
 }
 
 // Emit the sign-in signal. Exported so the account OAuth provider can announce a
 // completed subscription login on the already-linked path (see the note above).
+// Listeners MUST be idempotent: a device-code login fires this once the credentials
+// land and again once the account channel is armed (see privateerOAuthProvider.login).
 export function notifySignedIn(): void {
-  for (const listener of _signedInListeners) {
+  for (const listener of shared().signedIn) {
     try {
       listener();
     } catch {
@@ -375,6 +423,29 @@ export async function runDeviceLogin(opts: {
  * isolation, so two terminals never fight over one rotating token (which would
  * trip the server's reuse-detection and revoke every session).
  */
+// Turn a failed /auth/session/spawn into an accurate error.
+//
+// A 401 means the parent refresh token is gone — the machine login itself is dead, so
+// clear it and announce (the UI flips to signed-out). EVERY OTHER status used to be
+// reported as an expiry too, which actively misled: the common one is 429
+// `CHILD_SESSION_CAP` ("Too many active terminals for this device. Sign one out and
+// try again"), where /login is not the fix and the credentials are perfectly valid.
+// Pass the server's own message through so the user learns what to actually do.
+async function spawnFailure(res: Response): Promise<Error> {
+  if (res.status === 401) {
+    clearCredentials();
+    notifySessionExpired();
+    return new Error("Your Privateer session expired. Run /login to sign in again.");
+  }
+  let message: string | undefined;
+  try {
+    message = ((await res.json()) as { message?: string }).message;
+  } catch {
+    /* non-JSON body — fall back to the status line below */
+  }
+  return new Error(message?.trim() || `Couldn't start a Privateer session (HTTP ${res.status}).`);
+}
+
 async function spawnChildSession(): Promise<ChildSession> {
   const parent = loadCredentials();
   if (!parent) throw new Error("Not logged in to Privateer. Run /login.");
@@ -389,14 +460,7 @@ async function spawnChildSession(): Promise<ChildSession> {
   }, {
     headers: { Authorization: `Bearer ${parent.accessToken}` },
   });
-  if (!res.ok) {
-    // Parent refresh token invalid/expired → the machine login is gone.
-    if (res.status === 401) {
-      clearCredentials();
-      notifySessionExpired();
-    }
-    throw new Error("Your Privateer session expired. Run /login to sign in again.");
-  }
+  if (!res.ok) throw await spawnFailure(res);
   const { accessToken, refreshToken } = (await res.json()) as ChildSession;
   _child = { accessToken, refreshToken };
   return _child;
@@ -543,6 +607,10 @@ export async function revokeAccountSession(timeoutMs = 1500): Promise<void> {
   const account = _account;
   if (!account) return;
   _account = null;
+  // Stop advertising this session as reclaimable BEFORE killing it: an entry left
+  // behind would offer the next launch a dead row to adopt (it would fail over to a
+  // spawn, but only after a wasted round trip).
+  forgetOwnedSession();
   await deleteSession(account.accessToken, timeoutMs);
 }
 
@@ -566,15 +634,55 @@ export async function revokeLocalSessions(timeoutMs = 1500): Promise<void> {
 // ── Logout ───────────────────────────────────────────────────────────────────
 
 /**
- * Log out this terminal: revoke its session server-side (best effort) and wipe
- * local credentials. Other devices/sessions are untouched.
+ * Log out this MACHINE: revoke the machine login and every terminal session
+ * spawned from it, then wipe all local auth state. Other devices (the phone app,
+ * another laptop) keep their own logins — each has its own token family.
+ *
+ * Two things this deliberately does NOT do, both of which it used to:
+ *
+ * 1. It does not POST /auth/logout. That endpoint calls revokeAllUserSessions —
+ *    the entire ACCOUNT, every device including the app — while this function's
+ *    contract (and its old doc comment) promised the opposite. Signing out of one
+ *    terminal must not sign you out of your phone.
+ *
+ * 2. It does not go through apiRequest/authedFetch. Those authenticate with a CHILD
+ *    session and spawn one if absent — so at the per-machine child cap the spawn
+ *    throws 429 and the logout never reaches the server AT ALL. That was a deadlock:
+ *    the cap blocked the one call that clears the cap. We authenticate with the
+ *    PARENT instead, which is never subject to the cap.
+ *
+ * The parent's stored access token is usually expired (it is minted once at /login
+ * and never rotated — the refresh token is the liveness proof), so we rotate for a
+ * fresh one first. Rotation is free here precisely because we are destroying the
+ * credential either way: nothing downstream needs the token we burn. rotateSession
+ * is the no-ownership-side-effects variant, so this cannot clobber the registry
+ * entry of a session we are about to revoke wholesale anyway.
+ *
+ * DELETE /auth/session/current then revokes the parent's family, which the server
+ * cascades to every row with `parentFamilyId === familyId` — i.e. all this machine's
+ * terminals, including the orphans left by terminals that died without their
+ * shutdown hook. That cascade is what makes an accumulated cap self-clearing:
+ * logout, log back in, and the machine starts from zero live children.
+ *
+ * Local state is wiped unconditionally at the end, whatever the network did. A
+ * logout that can't reach the server must still leave you logged out locally —
+ * the rows it failed to revoke age out on their TTL.
  */
 export async function logout(): Promise<void> {
-  try {
-    await apiRequest("/auth/logout", { method: "POST" });
-  } catch {
-    /* best effort — clear locally regardless */
+  const parent = loadCredentials();
+  if (parent) {
+    try {
+      const fresh = await rotateSession(parent.refreshToken);
+      await deleteSession(fresh.access, 5000);
+    } catch {
+      /* offline, or the login was already dead server-side — wipe locally anyway */
+    }
   }
+  // In-memory sessions are gone with the family above; drop the handles so nothing
+  // tries to revoke them individually on the way out.
+  _child = null;
+  _account = null;
+  clearOwnedSessions(); // every entry named a session the cascade just killed
   clearCredentials();
 }
 
@@ -586,7 +694,7 @@ export async function logout(): Promise<void> {
 // = the JWT's exp (so Pi refreshes just before the server would reject it). These are
 // independent of authedFetch's in-memory _child (Pi owns this credential's lifecycle).
 
-interface AccountCredential {
+export interface AccountCredential {
   access: string;
   refresh: string;
   expires: number; // ms epoch
@@ -615,26 +723,102 @@ export async function spawnAccountCredentials(): Promise<AccountCredential> {
     { refreshToken: parent.refreshToken, deviceLabel: defaultDeviceLabel() },
     { headers: { Authorization: `Bearer ${parent.accessToken}` } },
   );
+  if (!res.ok) throw await spawnFailure(res);
+  const { accessToken, refreshToken } = (await res.json()) as { accessToken: string; refreshToken: string };
+  _account = { accessToken }; // track for explicit sign-out revoke (revokeAccountSession)
+  const cred = { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+  recordOwnedSession(cred); // claim the row, so a crash leaves it reclaimable
+  return cred;
+}
+
+// An /auth/refresh the server actively REFUSED, as opposed to one that never got an
+// answer. Only the former proves the session is gone; a network failure says nothing,
+// and treating it as death would leak the row (see dropOwnedSession).
+export interface RefreshRejection extends Error {
+  status: number;
+}
+
+export function isRefreshRejection(e: unknown): e is RefreshRejection {
+  return e instanceof Error && typeof (e as RefreshRejection).status === "number";
+}
+
+// Rotate a session's refresh token, with NO ownership side effects. Split out from
+// refreshAccountCredentials so orphan cleanup can rotate a session purely to obtain a
+// token it can revoke with, without claiming that session as this terminal's own.
+async function rotateSession(refresh: string): Promise<AccountCredential> {
+  const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: refresh });
   if (!res.ok) {
-    if (res.status === 401) {
-      clearCredentials();
-      notifySessionExpired();
-    }
-    throw new Error("Your Privateer session expired. Run /login to sign in again.");
+    const err = new Error(`account refresh failed (${res.status})`) as RefreshRejection;
+    err.status = res.status;
+    throw err;
   }
   const { accessToken, refreshToken } = (await res.json()) as { accessToken: string; refreshToken: string };
-  _account = { accessToken }; // track for explicit sign-out revoke (revokeAccountSession)
   return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
 }
 
 // Rotate this account credential's own refresh token; caller falls back to a fresh
 // spawn if this throws (expired/reused child token).
 export async function refreshAccountCredentials(refresh: string): Promise<AccountCredential> {
-  const res = await postJson(serverBaseUrl(), "/auth/refresh", { refreshToken: refresh });
-  if (!res.ok) throw new Error(`account refresh failed (${res.status})`);
-  const { accessToken, refreshToken } = (await res.json()) as { accessToken: string; refreshToken: string };
-  _account = { accessToken }; // the rotated session is the one an explicit sign-out revokes
-  return { access: accessToken, refresh: refreshToken, expires: jwtExpMs(accessToken) };
+  const cred = await rotateSession(refresh);
+  _account = { accessToken: cred.access }; // the rotated session is the one an explicit sign-out revokes
+  // Re-claim on every rotation — including the ones Pi drives on expiry — so the
+  // registry always holds a token that would actually work if we crashed right now.
+  recordOwnedSession(cred);
+  return cred;
+}
+
+// Get an account credential for THIS terminal, reusing a session orphaned by a
+// terminal that died without revoking rather than stacking another row on top of it.
+//
+// Reclaiming is what keeps a crash from costing a permanent session slot: each orphan
+// otherwise sits on the server for its full TTL, and enough of them earn a
+// `429 CHILD_SESSION_CAP` on the next spawn. A successful /auth/refresh doubles as the
+// liveness probe — it proves the row is real and hands back a usable access token —
+// so an orphan that turns out to be dead just falls through to the next candidate.
+//
+// Orphans we don't adopt are revoked in the background: their terminal is gone, so the
+// row is pure waste, and freeing it is what actually unwinds an account already at the
+// cap. Never touches a session whose owner is still running (see accountSessions.ts).
+export async function acquireAccountCredential(): Promise<AccountCredential> {
+  const orphans = orphanedSessions();
+  let adopted: AccountCredential | null = null;
+  let attempted = 0;
+
+  while (attempted < orphans.length && !adopted) {
+    const orphan = orphans[attempted++];
+    try {
+      adopted = await refreshAccountCredentials(orphan.refresh);
+      dropOwnedSession(orphan.pid); // the rotation above re-recorded it under OUR pid
+    } catch (e) {
+      // Refused → the session is gone; stop tracking it. Unreachable → keep it, so a
+      // network blip doesn't strand a live row we could have reclaimed next launch.
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+    }
+  }
+
+  // Best-effort cleanup of the ones we didn't need. Detached: freeing slots must never
+  // delay startup, and a failure here costs nothing the next launch can't retry.
+  const leftovers = orphans.slice(attempted);
+  if (leftovers.length) void revokeOrphanedSessions(leftovers);
+
+  return adopted ?? (await spawnAccountCredentials());
+}
+
+// Revoke sessions whose terminal is gone. Revoking needs a LIVE access token
+// (DELETE /auth/session/current is Bearer-authenticated) and an orphan's stored one is
+// usually stale, so rotate first — via rotateSession, which deliberately does NOT claim
+// ownership: these sessions are being destroyed, not adopted, and recording them would
+// overwrite the entry for the credential this terminal is actually using.
+async function revokeOrphanedSessions(orphans: OwnedSession[], timeoutMs = 1500): Promise<void> {
+  for (const orphan of orphans) {
+    try {
+      const cred = await rotateSession(orphan.refresh);
+      await deleteSession(cred.access, timeoutMs);
+      dropOwnedSession(orphan.pid);
+    } catch (e) {
+      if (isRefreshRejection(e)) dropOwnedSession(orphan.pid);
+    }
+  }
 }
 
 function sleep(ms: number, signal?: AbortSignal): Promise<void> {

package/src/cli/chat.ts

@@ -341,7 +341,7 @@ async function main() {
   // resolves it; Pi then manages refresh on expiry via the registered oauth provider.
   if (provider === "privateer") {
     try {
-      const creds = await priv.spawnAccountCredentials();
+      const creds = await priv.acquireAccountCredential();
       (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
     } catch (e) {
       console.log(`${RED}Account channel unavailable: ${(e as Error).message}${RESET}`);
@@ -478,8 +478,8 @@ async function main() {
       });
       console.log(`${GREEN}Signed in as ${user.email ?? user.id}.${RESET}`);
       // Move the live session onto a confidential model right away, so the next prompt
-      // doesn't dead-end on the keyless launch model ("No API key found for openrouter").
-      // resolveSignedInModel prefers Tinfoil GLM 5.2, else the account's NEAR channel;
+      // doesn't dead-end on the launch model's missing key. resolveSignedInModel picks
+      // Tinfoil GLM 5.2 — direct with a Tinfoil key, over the subscription otherwise;
       // PRIVATEER_MODEL (a deliberate override) is respected and left alone.
       if (!process.env.PRIVATEER_MODEL?.trim()) {
         const target = resolveSignedInModel();

package/src/config/paths.ts

@@ -39,3 +39,12 @@ export function credentialsPath(): string {
 export function configPath(): string {
   return join(globalDir(), "config.json");
 }
+
+// Account-provider inference sessions this MACHINE has spawned, keyed by the pid of
+// the terminal that owns each one (see auth/accountSessions.ts). Lets a launch tell a
+// session belonging to a STILL-RUNNING terminal from one orphaned by a crash, so it
+// can reclaim the orphan instead of spawning another and walking into the server's
+// per-device terminal cap. Holds refresh tokens — written 0600, like credentials.json.
+export function accountSessionsPath(): string {
+  return join(globalDir(), "account-sessions.json");
+}

package/src/daemon/index.ts

@@ -30,7 +30,7 @@ import { openJsonFromApp } from "../crypto/terminalUnseal.ts";
 import { verifyChannelSave, verifyOutboxKey } from "../crypto/accountVerify.ts";
 import { loadAccountSignKey, loadLastControlTs, saveLastControlTs } from "../crypto/accountTrust.ts";
 import { authorizeControl } from "../remote/controlAuth.ts";
-import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, spawnAccountCredentials, handleServerRevoke } from "../auth/privateer.ts";
+import { hasCredentials, revokeLocalSessions, revokeAccountSession, apiRequest, acquireAccountCredential, handleServerRevoke } from "../auth/privateer.ts";
 import {
   loadRoutines,
   upsertRoutine,
@@ -326,7 +326,7 @@ export class Daemon {
         // The account signed this daemon out server-side (revoked from the app's Linked
         // Devices). Beyond ending remote access (onTerminate), this wipes the machine
         // login: drop the relay and clear credentials, so routines/tasks stop cleanly
-        // instead of dead-ending on a 401 each run. Stays idle until you /signin on this
+        // instead of dead-ending on a 401 each run. Stays idle until you /login on this
         // machine and restart the daemon (the relayTerminated guard, as with onTerminate).
         onRevoked: () => {
           this.relayTerminated = true;
@@ -334,7 +334,7 @@ export class Daemon {
           this.relay?.stop();
           this.relay = undefined;
           handleServerRevoke();
-          log("account signed out from the app (session revoked) — cleared credentials; idle until you run /signin on this machine and restart the daemon");
+          log("account signed out from the app (session revoked) — cleared credentials; idle until you run /login on this machine and restart the daemon");
         },
         onStatus: (text) => log(`relay: ${text}`),
         onDisconnected: () => {
@@ -735,7 +735,7 @@ export class Daemon {
       const { provider, modelId } = parseSpec(spec.model);
       if (provider === "privateer") {
         try {
-          const creds = await spawnAccountCredentials();
+          const creds = await acquireAccountCredential();
           (services.authStorage as any).set("privateer", { type: "oauth", ...creds });
           spawnedAccount = true;
         } catch (e) {