toolroll 0.5.0 → 0.6.0

package/dist/exhaustion.d.ts

@@ -20,6 +20,10 @@
  *   class. Exit code, bare rate-limit prose, timeout, notFound, stderr,
  *   and zero tokens NEVER independently establish exhaustion.
  * - Everything unmatched is `unknown` — the ordinary failure road.
+ * - A sign-in that no longer works (`auth-expired`) is recognized FIRST,
+ *   for every provider and version: an expired or revoked login is not a
+ *   property of a CLI version, and retrying it only burns attempts. It is
+ *   never fallback-eligible — a lapsed login must not reach a paid key.
  */
 import type { ProviderId } from "./provider.js";
 export type TerminalClass = 
@@ -29,6 +33,9 @@ export type TerminalClass =
  | "credits-depleted"
 /** Temporary throttling NOT tied to the usage cap — backoff, NEVER paid fallback. */
  | "transient-throttle"
+/** The provider's sign-in or API key no longer works — NO retry, NO
+ * fallback: dispatch for that provider pauses until someone signs in. */
+ | "auth-expired"
 /** A definite non-exhaustion terminal (ordinary failure). */
  | "not-exhausted"
 /** No structural signal matched — the ordinary failure/strike road. */
@@ -82,4 +89,11 @@ export declare function classifyTerminal(args: {
     version: string | null;
     authMode: "subscription" | "api-key";
     terminal: StructuralTerminal | null;
+    /** What a run that failed within seconds, having produced nothing, said
+     * on its way out (stderr and unstructured stdout) — read ONLY for the
+     * sign-in signal: a CLI that is not logged in often exits before its
+     * structured stream begins. */
+    earlyExit?: string | null;
 }): TerminalClass;
+/** Whether a provider's own words say its sign-in or key no longer works. */
+export declare function isAuthFailure(text: string): boolean;

package/dist/exhaustion.js

@@ -20,6 +20,10 @@
  *   class. Exit code, bare rate-limit prose, timeout, notFound, stderr,
  *   and zero tokens NEVER independently establish exhaustion.
  * - Everything unmatched is `unknown` — the ordinary failure road.
+ * - A sign-in that no longer works (`auth-expired`) is recognized FIRST,
+ *   for every provider and version: an expired or revoked login is not a
+ *   property of a CLI version, and retrying it only burns attempts. It is
+ *   never fallback-eligible — a lapsed login must not reach a paid key.
  */
 /** The two classes that may authorize a fallback advance. */
 export const FALLBACK_ELIGIBLE = new Set([
@@ -111,6 +115,12 @@ export function classMatchesAuthMode(cls, authMode) {
  */
 export function classifyTerminal(args) {
     const { provider, version, authMode, terminal } = args;
+    // A sign-in that no longer works, before anything else and for any
+    // provider or version: no fixture is needed to know a login is gone.
+    if (terminal !== null && terminal.failed === true && isAuthFailure(`${terminal.code ?? ""}\n${terminal.text ?? ""}`))
+        return "auth-expired";
+    if (typeof args.earlyExit === "string" && isAuthFailure(args.earlyExit))
+        return "auth-expired";
     if (terminal === null)
         return "unknown";
     // The classifier's contract permits failed:false, but a non-failure
@@ -139,3 +149,28 @@ export function classifyTerminal(args) {
     // unknown above).
     return "not-exhausted";
 }
+/**
+ * The sign-in signals, provider-neutral: Claude's expired or unrefreshable
+ * OAuth session and its "Please run /login", an API key the provider calls
+ * invalid or revoked, Codex's and Gemini's "not logged in", and an HTTP 401
+ * the harness reports as its terminal. Ordinary failures (a test that
+ * failed, a timeout, a usage limit) match none of these.
+ */
+const AUTH_FAILURE = [
+    // Provider-specific phrasings only: a build's own output (a login feature's
+    // tests, an HTTP 401 in a log) must never read as the agent's sign-in.
+    /\bOAuth (?:session|token)\b[^\n]{0,80}\b(?:expired|could not be refreshed|revoked|invalid)/i,
+    /\bFailed to authenticate\b[^\n]{0,40}\b(?:OAuth|token|session|credentials|API key)/i,
+    /\bPlease run \/login\b/i,
+    /\binvalid[ _-](?:x-)?api[ _-]?key\b/i,
+    /\binvalid bearer token\b/i,
+    /\bapi[ _-]?key\b[^\n]{0,40}\b(?:is )?(?:invalid|revoked|expired|not valid)\b/i,
+    /"type"\s*:\s*"authentication_error"/i,
+    /\bMissing bearer (?:or basic )?authentication\b/i,
+    /^Not logged in\b/m,
+];
+/** Whether a provider's own words say its sign-in or key no longer works. */
+export function isAuthFailure(text) {
+    const bounded = text.slice(0, 8192);
+    return AUTH_FAILURE.some(re => re.test(bounded));
+}

package/dist/invoke.js

@@ -19,6 +19,7 @@
 import { adapterFor, auditOf } from "./provider.js";
 import { readProviderKey, readAuthModeStrict, PROVIDER_KEY_ENV, OWN_KEY_ENV } from "./keys.js";
 import { classifyTerminal } from "./exhaustion.js";
+import { liftAuthPause } from "./provider-auth.js";
 import { attestProvider } from "./attest.js";
 import { run as runCommand, runOwnerTag, startClaudeHeldSession } from "./exec.js";
 import { currentContainment } from "./containment.js";
@@ -32,6 +33,9 @@ import { billingOf, claudeBillingFrom, seenBilling } from "./spend.js";
 /** The claude binary name — kept for the legacy quota rows and tests that
  * describe history; new code carries a resolved AgentSpec instead. */
 export const PROVIDER_BINARY = "claude";
+/** "Within seconds": how soon a silent failed run must end for its stderr to
+ * be read for the sign-in signal. */
+const AUTH_EARLY_EXIT_MS = 30_000;
 /**
  * A provider can run the repository's own CLI. In a self-hosting build that
  * must never mean "open the database that launched me": a migration from the
@@ -306,6 +310,7 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
         ? await codexLoginBilling(attested !== null ? attested.executable : adapter.binary, [...(runOptions.omitEnv ?? []), ...adapter.extraOmitEnv, ...ownKeyEnv])
         : null;
     let result;
+    const spawnedAt = Date.now();
     try {
         // Under the stop watch (v52): the run's stop row is re-read while the
         // provider runs, and a stop kills THIS run's process group through the
@@ -438,11 +443,20 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
     // no version here yet (attested === null), so they classify fail-closed
     // until their exhaustion fixture — and the version proving it needs — is
     // captured and reviewed.
+    // A run that failed within seconds having produced nothing is read for
+    // the sign-in signal too: a CLI that is not logged in often says so on
+    // stderr before its structured stream starts.
+    const quietEarlyExit = result.code !== 0 && !result.timedOut && !result.notFound &&
+        Date.now() - spawnedAt <= AUTH_EARLY_EXIT_MS &&
+        envelope.promptConsumed !== true && (envelope.tokensOut ?? 0) === 0;
     const terminalClass = classifyTerminal({
         provider: spec.provider,
         version: attested === null ? null : attested.version,
         authMode,
         terminal: envelope.structuralTerminal,
+        // stderr and plain stdout only: a JSON event line can carry the agent's
+        // own command output (codex aggregated_output), never its sign-in.
+        earlyExit: quietEarlyExit ? `${result.stderr.slice(-4096)}\n${plainLines(result.stdout).slice(-4096)}` : null,
     });
     store.stampTerminalClass(runId, authMode, terminalClass);
     // Contradictory structural identity is a provider protocol failure, not
@@ -519,6 +533,14 @@ export async function invokeAgent(store, runId, spec, invocation, options) {
             finalMessage: envelope.finalMessage,
         };
     }
+    // A run that worked proves its provider's sign-in works: a sign-in pause
+    // on it lifts, and its waiting tasks may start again.
+    if (result.code === 0 && envelope.structuralTerminal === null && envelope.promptConsumed !== false) {
+        try {
+            liftAuthPause(store, spec.provider, "run", `run #${runId}`, clock(), new Date(spawnedAt));
+        }
+        catch { /* the pause stays until the next proof */ }
+    }
     return {
         kind: "ran",
         outcome: {
@@ -778,3 +800,7 @@ async function codexLoginBilling(binary, omitEnv) {
         return null;
     }
 }
+/** The lines of a harness's stdout that are not JSON events. */
+function plainLines(stdout) {
+    return stdout.split("\n").filter(line => !line.trimStart().startsWith("{")).join("\n");
+}

package/dist/lead-status.d.ts

@@ -62,6 +62,13 @@ export type InstallationStatus = {
         plan: string | null;
         observedAt: string;
     })[];
+    /** Providers whose sign-in stopped working: their dispatch is paused. */
+    signIn: {
+        provider: string;
+        reason: string;
+        command: string;
+        since: string;
+    }[];
 };
 /** One indexed observation for `task wait`. `watchedRun` is the attempt the
  * caller first saw. Each poll follows the task's newest attempt from there, so

package/dist/lead-status.js

@@ -2,6 +2,7 @@
  * this module never opens a repository, retained evidence, or a live log. */
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { windowLabel } from "./provider-limits.js";
+import { openAuthPauses, signInCommand, signInReason } from "./provider-auth.js";
 import { BUILT_IN, checkSuitesOf } from "./store.js";
 const maybeNumber = (value) => value === null || value === undefined || !Number.isInteger(Number(value)) ? null : Number(value);
 const CHECK_COLUMNS = "rc.status AS check_status, rc.exit_code AS check_exit_code, rc.suites_json AS check_suites_json";
@@ -192,8 +193,16 @@ export function installationStatus(store, now) {
     WHERE task.state = 'queued'`).all(now.toISOString(), BUILT_IN);
     const reasons = new Map();
     const queuedTasks = [];
+    const pauses = openAuthPauses(store);
     for (const row of queuedRows) {
-        const reason = queueReason(row);
+        let reason = queueReason(row);
+        if (reason === "ready for a worker" && pauses.length > 0) {
+            const scope = store.getScope(String(row["id"]));
+            const provider = scope?.approvedProfile?.provider ?? scope?.profile?.provider;
+            const paused = pauses.find(one => one.provider === provider);
+            if (paused !== undefined)
+                reason = signInReason(paused);
+        }
         reasons.set(reason, (reasons.get(reason) ?? 0) + 1);
         if (queuedTasks.length < 8)
             queuedTasks.push({ task: String(row["id"]), reason });
@@ -243,10 +252,14 @@ export function installationStatus(store, now) {
             reached: Number(row["reached"]) === 1,
             observedAt: String(row["observed_at"]),
         })),
+        signIn: pauses.map(one => ({ provider: one.provider, reason: signInReason(one), command: signInCommand(one), since: one.openedAt })),
     };
 }
 export function renderInstallationStatus(status) {
     const lines = [];
+    // A paused provider comes first: it is the one thing a person must do.
+    for (const one of status.signIn)
+        lines.push(`${one.reason} — run \`${one.command}\`. Its tasks wait until then.`);
     lines.push(status.running.count === 0 ? "Running: none" : `Running: ${status.running.count} — ${status.running.tasks.map(one => `${one.task} (#${one.run}, ${one.phase})`).join(", ")}${status.running.count > status.running.tasks.length ? ", …" : ""}`);
     lines.push(status.queued.count === 0 ? "Queued: none" : `Queued: ${status.queued.count} — ${status.queued.tasks.map(one => `${one.task} (${one.reason})`).join(", ")}${status.queued.count > status.queued.tasks.length ? ", …" : ""}`);
     lines.push(status.waitingForReview.count === 0 ? "Ready for review: none" : `Ready for review: ${status.waitingForReview.count} — ${status.waitingForReview.results.map(one => `${one.task} (#${one.run})`).join(", ")}${status.waitingForReview.count > status.waitingForReview.results.length ? ", …" : ""}`);
@@ -276,7 +289,7 @@ export function renderInstallationStatus(status) {
             lines.push(`Plan windows: ${provider} — ${detail}`);
         }
     }
-    return lines.slice(0, 12);
+    return lines.slice(0, 12 + status.signIn.length);
 }
 export function renderTaskWait(snapshot, outcome = snapshot.outcome) {
     const check = snapshot.check.status === "unknown" ? "checks unknown" : snapshot.check.status === "not-run" ? "checks not run" : `checks ${snapshot.check.status}${snapshot.check.exitCode === null ? "" : ` (exit ${snapshot.check.exitCode})`}`;

package/dist/mate.js

@@ -410,10 +410,13 @@ export async function runMateTurn(input) {
             const outcome = executeMateTool({ store, who, now: clock(), draft, selectEvidence, step: steps, readDecisions, readResults, ...(input.evidenceRoot === undefined ? {} : { evidenceRoot: input.evidenceRoot }), ...(input.mediaDelivery === undefined ? {} : { mediaDelivery: input.mediaDelivery }) }, call.name, call.args, view);
             if (READ_TOOLS.has(call.name))
                 reads++;
-            // Opt-in, local diagnostics for end-to-end runs: what the lead asked of each tool and what came back, keys blanked.
+            // Opt-in, local diagnostics for end-to-end runs: what the lead asked of each tool and what came back (its start), keys
+            // blanked. Each line stays whole JSON so a run can assert on what a tool returned rather than on the model's words.
             if (envValue(process.env, "MATE_TRACE") === "1") {
                 const blanked = (_, value) => typeof value === "string" ? redactSecretAssignments(redactSecretLines(value, scanForSecrets(value))) : value;
-                process.stderr.write(`mate-trace ${JSON.stringify({ turn: turnId, step: steps, tool: call.name, args: call.args, ok: outcome.ok, ...(outcome.ok ? {} : { message: outcome.message }) }, blanked).slice(0, 4000)}\n`);
+                const args = JSON.stringify(call.args, blanked).slice(0, 1500);
+                const result = JSON.stringify(outcome.ok ? outcome.body : null, blanked)?.slice(0, 2000) ?? null;
+                process.stderr.write(`mate-trace ${JSON.stringify({ turn: turnId, step: steps, tool: call.name, args: args.length < 1500 ? call.args : args, ok: outcome.ok, ...(outcome.ok ? { result } : { message: outcome.message }) }, blanked)}\n`);
             }
             history.push({ role: "tool", callId: call.id, name: call.name, result: capped(outcome.ok ? outcome.body : { ok: false, message: outcome.message }) });
         }

package/dist/operate.js

@@ -10,6 +10,8 @@ import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, mont
 import { spendCsv } from "./spend-ui.js";
 import { buildExport, exportSummary, exportZip, writeExportFolder } from "./export.js";
 import { startBudgetAlerts } from "./budget-alerts.js";
+import { liftAuthPause, openAuthPauses, signInGate, signInWords, startSignInProbes } from "./provider-auth.js";
+import { createConnectionChecker } from "./provider-connection.js";
 import { backupFiles, backupFolderOf, backupOwner, backupNow, restoreDatabase, startBackups } from "./backup.js";
 import { pushLimitSink } from "./provider-limits.js";
 import { limitsView } from "./limits-ui.js";
@@ -121,7 +123,7 @@ import { verdictWords as proofVerdictWords, matrixWords, semanticCoverage, cover
 import { probeRepo, isVerified } from "./probe.js";
 import { diagnoseTaskDispatch, diagnosisIsDispatchable, scopeApprovedForDispatch, } from "./dispatch.js";
 import { createDecisionServer } from "./serve.js";
-import { daemonLaunchCommand, daemonStatus, installDaemon, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
+import { daemonLaunchCommand, daemonStatus, installReplacingLegacy, installedLegacyDaemon, planDaemon, uninstallDaemon, awaitFreshHeartbeat, } from "./daemon.js";
 import { bridgePass, clearBotToken, createTransport, followBridge, hashPairingCode, loadBotToken, mintPairingCode, redactToken, saveBotToken, PAIRING_TTL_MS, TOKEN_ENV, telegramHookSecret, telegramPushUrl, } from "./telegram.js";
 import { scanRepo } from "./capscan.js";
 import { computeGaps, describeCapability } from "./gaps.js";
@@ -405,6 +407,8 @@ Agents — which provider and model each phase runs on
   toolroll providers --report --runner <name> --token <t>
                                         record this machine's readiness per
                                         provider under its runner name
+  toolroll providers resume <provider> after signing in again, start its
+                                        paused tasks now
   toolroll config set chat --provider claude-subscription|codex-subscription|anthropic-api|openrouter-api
       [--model <m>] [--weekly-usd <n>] [--daily-turns <n>] --as <you> --token <t>
       membership providers reuse a logged-in local harness with no dollar
@@ -913,6 +917,8 @@ async function dispatch(command, positional, flags, context) {
         case "intake":
             return intakeCommand(positional, flags, context);
         case "providers":
+            if (positional[0] === "resume")
+                return resumeProviderCommand(positional.slice(1), flags, context);
             return providersCommand(flags, context);
         case "template":
             return templateCommand(positional, flags, context);
@@ -1007,6 +1013,7 @@ async function readyCommand(flags, context) {
     const ready = store.listReady(now);
     const described = ready.map(ref => describeRef(store, ref, now));
     const dispatchableCount = described.filter(one => diagnosisIsDispatchable(one.dispatch)).length;
+    const pauses = openAuthPauses(store);
     if (json) {
         write(envelopeJson({
             ok: ready.length > 0,
@@ -1014,10 +1021,14 @@ async function readyCommand(flags, context) {
             ...(ready.length > 0 ? {} : { reason: "empty", message: "nothing is task-locally ready" }),
             count: ready.length,
             dispatchableCount,
+            signIn: pauses.map(one => ({ provider: one.provider, message: signInWords(one), since: one.openedAt })),
             tasks: described,
         }));
         return ready.length > 0 ? EXIT.ok : EXIT.refused;
     }
+    // A paused provider first: nothing on it runs until someone signs in.
+    for (const one of pauses)
+        write(signInWords(one));
     if (ready.length === 0) {
         write("Nothing is ready to dispatch.");
         return EXIT.refused;
@@ -1026,7 +1037,7 @@ async function readyCommand(flags, context) {
     for (const ref of ready) {
         const task = store.getTask(ref.externalId);
         const diagnosis = diagnoseTaskDispatch(store, ref.externalId, now);
-        write(`  ${ref.externalId}  ${task === null ? "" : task.title}${ref.assignedRunner === null ? "" : `  (reserved for ${ref.assignedRunner})`}${diagnosis === null ? "" : ` — ${diagnosis.summary.toLowerCase()}`}`);
+        write(`  ${ref.externalId}  ${task === null ? "" : task.title}${ref.assignedRunner === null ? "" : `  (reserved for ${ref.assignedRunner})`}${diagnosis === null ? "" : ` — ${diagnosis.code === "signed-out" ? diagnosis.summary : diagnosis.summary.toLowerCase()}`}`);
     }
     return EXIT.ok;
 }
@@ -1826,6 +1837,7 @@ async function buildCommand(positional, flags, context) {
         const broke = result.reason === "agent" ||
             result.reason === "agent-reported" ||
             result.reason === "no-op" ||
+            result.reason === "no-handoff" ||
             result.reason === "moved-head" ||
             result.reason === "timeout" ||
             result.reason === "git" ||
@@ -2114,6 +2126,13 @@ async function tickCommand(flags, context) {
                 resumed.push({ id: taskId, outcome: "skipped", reason: "budget", detail: budgetWords(laneBudget) });
                 continue;
             }
+            // The sign-in pause holds a resumed lane too: it waits, parked, instead of failing.
+            const laneSignedOut = signInGate(store, [racer.provider], clock());
+            if (laneSignedOut !== null) {
+                backToParked();
+                resumed.push({ id: taskId, outcome: "skipped", reason: "signed-out", detail: signInWords(laneSignedOut) });
+                continue;
+            }
             // Legacy comparison lanes carried an absolute clock. New profiles use
             // a progress watchdog and may remain alive indefinitely while useful
             // work is observable; only legacy approvals retain their cumulative
@@ -2575,6 +2594,18 @@ async function tickCommand(flags, context) {
             dispatched.push({ id, outcome: "skipped", reason: "auth-mode", detail: brokenMode.problem });
             continue;
         }
+        // THE SIGN-IN PAUSE: a provider whose sign-in stopped working takes no
+        // new work — no claim, no run, never a substitute (a lapsed login must not
+        // reach a paid fallback) — until a run or check on it works again or a
+        // person resumes it. Other providers keep working.
+        // One task every AUTH_TRIAL_MS goes ahead as the trial: a sign-in check
+        // can say "logged in" for a session that cannot refresh, so a real run
+        // decides — it lifts the pause, or fails into the same incident.
+        const signedOut = signInGate(store, modeProviders, clock(), ref.id);
+        if (signedOut !== null) {
+            dispatched.push({ id, outcome: "skipped", reason: "signed-out", detail: signInWords(signedOut) });
+            continue;
+        }
         // The leg is the authority: what resolved must BE the leg, exactly —
         // the sealed build leg, or the parked fallback entry's own pair.
         const governingLeg = wantsPlan ? planLeg : parkedEntry !== null ? { provider: parkedEntry.provider, model: parkedEntry.model, chosen: "fallback" } : sealedBuildLeg;
@@ -3678,7 +3709,9 @@ async function tickCommand(flags, context) {
                     id,
                     outcome: "failed",
                     reason: disposition.sealed
-                        ? `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
+                        ? disposition.disposition === "auth-expired"
+                            ? "auth-expired — requeued, sign-in needed"
+                            : `${disposition.failureClass}${disposition.disposition === "backoff" ? ` — retry ${disposition.strikes}/3` : disposition.disposition === "stalled" ? " — stalled" : ""}`
                         : "fenced",
                     ...(result.ok ? {} : { detail: result.message.slice(0, 200) }),
                     worktree: leased.worktree.path,
@@ -3745,6 +3778,12 @@ async function tickCommand(flags, context) {
             dispatched.push({ id: pending.taskId, outcome: "skipped", reason: "budget-unenforceable" });
             continue;
         }
+        // The sign-in pause holds a fallback entry too: the admission stays pending until its provider works.
+        const entrySignedOut = signInGate(store, [peek.profile.provider], clock(), pending.taskRef);
+        if (entrySignedOut !== null) {
+            dispatched.push({ id: pending.taskId, outcome: "skipped", reason: "signed-out", detail: signInWords(entrySignedOut) });
+            continue;
+        }
         // The FALLBACK claim (finding 4): every acquireIfReady gate — task
         // state, non-backoff holds, blockers, approved scope + mode belt,
         // capability, capacity, and quota keyed by the PINNED credential —
@@ -3934,6 +3973,12 @@ async function tickCommand(flags, context) {
                 dispatched.push({ id: taskId, outcome: "skipped", reason: "budget", detail: budgetWords(continuationBudget) });
                 continue;
             }
+            // The sign-in pause holds a continuation too: its authorization stays open and it starts once the sign-in works.
+            const continuationSignedOut = signInGate(store, [pinned.provider], clock(), parent.taskRef);
+            if (continuationSignedOut !== null) {
+                dispatched.push({ id: taskId, outcome: "skipped", reason: "signed-out", detail: signInWords(continuationSignedOut) });
+                continue;
+            }
             const claimed = acquireContinuation(store, continuation, runner, { now: clock(), token, ttlMs: leaseTtlMs });
             if (!claimed.ok) {
                 dispatched.push({ id: taskId, outcome: "skipped", reason: claimed.reason, ...("message" in claimed ? { detail: claimed.message } : {}) });
@@ -4633,6 +4678,8 @@ async function startConsole(options) {
     server.on("close", stopMonitoring);
     // v105: budget alerts at 50/80/100 %, a pass a minute.
     server.on("close", startBudgetAlerts(context.store));
+    // A paused provider's sign-in is checked every two minutes (no model, nothing spent); the pause lifts when it works.
+    server.on("close", startSignInProbes(context.store, createConnectionChecker()));
     // Sprint 8: scheduled backups, a pass a minute; its lease also tells a restore that the console is running.
     server.on("close", startBackups(context.store, context.databaseFile));
     server.on("close", startCodexLimits(context.store));
@@ -5009,6 +5056,27 @@ async function webhookCommand(positional, flags, context) {
         `Send yourself a proof: toolroll webhook test`,
     ]);
 }
+/**
+ * `toolroll providers resume <provider>` — a person says the sign-in works
+ * again (after `claude /login`, say): the provider's sign-in pause lifts, its
+ * tasks may start, and one short message says how many resumed. A pause that
+ * lifted by itself answers so; nothing is paused twice.
+ */
+function resumeProviderCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const command = "providers resume";
+    const provider = positional[0];
+    if (provider === undefined || !isProviderId(provider) || positional.length > 1) {
+        return fail(write, json, command, "usage", `Use \`toolroll providers resume <${PROVIDER_IDS.join("|")}>\`.`, EXIT.usage);
+    }
+    const who = text(flags, "as") ?? process.env["USER"] ?? "operator";
+    const lifted = liftAuthPause(store, provider, "person", who, context.clock());
+    if (lifted === null)
+        return succeed(write, json, command, { provider, resumed: 0, paused: false }, () => [`${provider} is not paused.`]);
+    return succeed(write, json, command, { provider, resumed: lifted.resumed, paused: false }, () => [
+        `${provider} resumed — ${lifted.resumed} ${lifted.resumed === 1 ? "task" : "tasks"} can start again.`,
+    ]);
+}
 /**
  * `toolroll providers` — identification, never integration theater.
  *
@@ -6884,18 +6952,12 @@ async function daemonCommand(positional, flags, context) {
             write("Nothing was written. Re-run without --dry-run to install.");
             return EXIT.ok;
         }
-        if (legacy !== null) {
-            try {
-                await uninstallDaemon(legacy, supervise);
-            }
-            catch (error) {
-                return fail(write, json, "daemon install", "supervisor", `could not stop ${legacy.label}, the same watch under its older name: ${error.message}`, EXIT.failed);
-            }
-        }
-        const installed = await installDaemon(plan, token, supervise);
+        const installed = await installReplacingLegacy(plan, token, legacy, supervise);
         if (!installed.ok) {
             return fail(write, json, "daemon install", "supervisor", installed.message, EXIT.failed);
         }
+        // The legacy watch beat for this runner until it stopped: only a beat after that proves the new one.
+        const readySince = legacy === null ? heartbeatBefore : store.getRunner(runnerName)?.runner.heartbeatAt ?? null;
         const started = await daemonStatus(plan, supervise);
         if (started.state !== "running") {
             return fail(write, json, "daemon install", "not-running", `the service was installed but did not stay running (${started.detail}) — read ${plan.logPath}; no work will be claimed until this is fixed`, EXIT.failed);
@@ -6906,7 +6968,7 @@ async function daemonCommand(positional, flags, context) {
         // readiness receipt that proves this service reached the work loop —
         // a FRESH one when the service was (re)started; the one already
         // standing when a healthy running service was left alone.
-        const fresh = await awaitFreshHeartbeat(store, runnerName, installed.action === "running" ? null : heartbeatBefore);
+        const fresh = await awaitFreshHeartbeat(store, runnerName, installed.action === "running" && legacy === null ? null : readySince);
         const liveRunner = fresh.ok ? store.getRunner(runnerName)?.runner ?? null : null;
         if (liveRunner === null) {
             const macHint = process.platform === "darwin" && repo.startsWith(join(homedir(), "Documents"))

package/dist/provider-auth.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Sign-in pauses: when a provider's sign-in (or API key) stops working, its
+ * runs fail in seconds and every retry fails the same way. So an
+ * `auth-expired` run takes no strike and no retry: its task goes back to the
+ * queue, dispatch for THAT provider pauses (the others keep working), and a
+ * person is told once per incident, on every connected messaging channel, what
+ * to run. The pause lifts when a run or a sign-in probe on that provider
+ * succeeds, or when a person resumes it; one short message says so.
+ *
+ * One row per incident. At most one open incident per provider (a partial
+ * unique index), so however many runs hit it, one notification goes out:
+ * its key is `signin:auth-expired:<provider>:<ordinal>:<person>`, the ordinal
+ * being the incident's own number for that provider.
+ */
+import type { Store } from "./store.js";
+import { type ProviderId } from "./provider.js";
+/** Every sign-in message's dedupe key starts here: `signin:<kind>:<provider>:<ordinal>:<person>`.
+ * Not a lifecycle (`life:`) key: those are progress chatter, and an undelivered
+ * one stays out of the attention list — this one needs a person. */
+export declare const SIGN_IN_KEY_PREFIX = "signin:";
+export declare const PROVIDER_AUTH_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_auth_pause (\n  id          INTEGER PRIMARY KEY AUTOINCREMENT,\n  provider    TEXT NOT NULL,\n  ordinal     INTEGER NOT NULL,\n  auth_mode   TEXT NOT NULL DEFAULT 'subscription' CHECK (auth_mode IN ('subscription', 'api-key')),\n  opened_at   TEXT NOT NULL,\n  first_run   INTEGER,\n  task_ref    INTEGER,\n  runs        INTEGER NOT NULL DEFAULT 1,\n  -- 1 once a sign-in probe during this pause said the provider is signed out:\n  -- only a probe that then sees it signed in again may lift the pause.\n  probe_saw_out INTEGER NOT NULL DEFAULT 0,\n  lifted_at   TEXT,\n  lifted_by   TEXT,\n  lifted_how  TEXT CHECK (lifted_how IS NULL OR lifted_how IN ('run', 'probe', 'person')),\n  resumed     INTEGER,\n  -- The last task let through as a trial while paused: a sign-in check can\n  -- say \"logged in\" for a session that no longer works, so a real run decides.\n  last_trial_at TEXT,\n  UNIQUE (provider, ordinal)\n);\nCREATE UNIQUE INDEX IF NOT EXISTS provider_auth_pause_open ON provider_auth_pause (provider) WHERE lifted_at IS NULL;\n";
+export type AuthPause = {
+    id: number;
+    provider: ProviderId;
+    ordinal: number;
+    authMode: "subscription" | "api-key";
+    openedAt: string;
+    firstRun: number | null;
+    taskRef: number | null;
+    runs: number;
+};
+export declare function providerName(provider: string): string;
+/** The plain reason: "Claude needs you to sign in again". */
+export declare function signInReason(pause: Pick<AuthPause, "provider" | "authMode">): string;
+/** What to run, as a command. */
+export declare function signInCommand(pause: Pick<AuthPause, "provider" | "authMode">): string;
+/** One line for status, ready and the console. */
+export declare function signInWords(pause: AuthPause): string;
+/** The open pause for a provider, or null. */
+export declare function authPauseOf(store: Store, provider: string): AuthPause | null;
+/** The open pause the dispatch gate last left this task waiting on, or null. */
+export declare function authWaitOf(store: Store, taskRef: number): AuthPause | null;
+/** Every open pause, oldest first. */
+export declare function openAuthPauses(store: Store): AuthPause[];
+/**
+ * Record an auth-expired run against its provider's pause, opening the
+ * incident (and its one notification) when none is open. Called inside the
+ * run's own failure transaction. Returns whether this run opened it.
+ */
+export declare function pauseForAuth(store: Store, args: {
+    provider: string;
+    authMode: "subscription" | "api-key" | null;
+    runId: number;
+    taskRef: number;
+    now: Date;
+}): {
+    opened: boolean;
+    pause: AuthPause;
+};
+/**
+ * Lift a provider's open pause — a run or probe on it succeeded, or a person
+ * resumed it — and send the one short "signed in again" message. Returns the
+ * number of tasks its incident sent back to the queue, or null when nothing
+ * was paused.
+ */
+export declare function liftAuthPause(store: Store, provider: string, how: "run" | "probe" | "person", by: string, now: Date, 
+/** For a run: when it started. A run that began before the pause opened proves nothing about the sign-in now. */
+runStartedAt?: Date): {
+    resumed: number;
+    pause: AuthPause;
+} | null;
+/**
+ * What a non-spending sign-in probe said. A probe lifts the pause only after
+ * one during the same pause saw the provider signed out: a CLI that reports
+ * "logged in" while its session cannot refresh must not lift and re-open the
+ * pause over and over.
+ */
+export declare function noteSignInProbe(store: Store, provider: string, state: string, now: Date): {
+    resumed: number;
+} | null;
+/** How often a paused provider lets one task through as a trial. */
+export declare const AUTH_TRIAL_MS: number;
+/**
+ * Whether this task may go ahead as the paused provider's trial: at most one
+ * every AUTH_TRIAL_MS. A trial that works lifts the pause (its run proves the
+ * sign-in); one that fails the same way only counts against the open
+ * incident, so nobody is told twice.
+ */
+export declare function claimAuthTrial(store: Store, pause: AuthPause, now: Date): boolean;
+/**
+ * The sign-in gate every road that starts an agent asks before it claims
+ * anything: the tick's queue, and the roads beside it (fallback entries,
+ * attended continuations, contest resumes). The open pause the work waits
+ * on, or null when it may go ahead — nothing paused, or this is the pause's
+ * one trial. A waiting task is noted on its task_ref, so the work index says
+ * exactly what the gate decided; a task let through is un-noted.
+ */
+export declare function signInGate(store: Store, providers: readonly string[], now: Date, taskRef?: number): AuthPause | null;
+/** The loop beside the console: every two minutes, probe each paused
+ * provider's sign-in (no model, nothing spent) and lift the pause when it
+ * works again. Nothing is probed while nothing is paused. */
+export declare function startSignInProbes(store: Store, check: (provider: ProviderId, fresh?: boolean) => Promise<{
+    state: string;
+}>, everyMs?: number): () => void;
+/** The console's view of every open pause: title, command, one action. */
+export declare function signInNotices(store: Store): {
+    provider: string;
+    title: string;
+    command: string;
+    detail: string;
+    resumeLabel: string;
+    resumeHref: string;
+}[];