usebeeline 0.0.108 → 0.0.109

package/dist/usebeeline.mjs

@@ -8476,7 +8476,7 @@ async function installGoogleTool(options) {
     return fail("connector type", `${options.connectorType} is not a Google tool connector`);
   }
   push(step("Google credentials resolved", "running", { output: "resolving\u2026" }));
-  const resolved = options.resolveCredentials ? await options.resolveCredentials() : await (async () => {
+  const resolved = options.resolvedCredentials ? await options.resolvedCredentials : options.resolveCredentials ? await options.resolveCredentials() : await (async () => {
     const oneClick = await readGoogleCredentialsFromVault(options.squire);
     return oneClick.source === "squire" ? { ...oneClick } : { ...loadManualGoogleCredentials(options.home, options.env) };
   })();
@@ -8515,7 +8515,31 @@ function describe(error) {
 
 // apps/body/dist/connector-squire.js
 import { execFile, spawn as spawn2 } from "node:child_process";
-var SQUIRE_CONNECT_PACKAGE = "@trusty-squire/mcp@next";
+var SQUIRE_MCP_NAME = "@trusty-squire/mcp";
+var SQUIRE_CONNECT_PACKAGE = `${SQUIRE_MCP_NAME}@latest`;
+var activeConnectSession;
+function isProcessAlive(pid) {
+  if (pid === void 0 || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+function releaseSquireConnectSession(log2) {
+  const claim = activeConnectSession;
+  activeConnectSession = void 0;
+  if (!claim)
+    return;
+  if (isProcessAlive(claim.pid)) {
+    log2?.(`released trusty-squire connect session claim (pid ${String(claim.pid)} still live \u2014 a fresh connect owns the browser now)`);
+    claim.abort();
+  } else {
+    log2?.("cleared dead trusty-squire connect session claim (owner process gone)");
+  }
+}
 var defaultShellRunner = (command, args) => new Promise((resolve31) => {
   execFile(command, [...args], { timeout: 12e4, maxBuffer: 4 * 1024 * 1024, encoding: "utf8" }, (error, stdout6, stderr) => {
     const code = error?.code;
@@ -8537,7 +8561,7 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
   const safetyTimer = setTimeout(() => {
     if (!resolved) {
       resolved = true;
-      resolve31({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+      resolve31({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
       } });
     }
     child.kill();
@@ -8546,6 +8570,12 @@ var defaultStreamedRunner = (command, args) => new Promise((resolve31) => {
     clearTimeout(safetyTimer);
     child.kill();
   };
+  const claim = {
+    pid: child.pid ?? void 0,
+    claimedAt: Date.now(),
+    abort
+  };
+  activeConnectSession = claim;
   const finish = (result) => {
     if (!resolved) {
       resolved = true;
@@ -8570,11 +8600,11 @@ ${stderr}`;
     checkOutput();
   });
   child.on("close", () => {
-    finish({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+    finish({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
     } });
   });
   child.on("error", () => {
-    finish({ stdout: stdout6, stderr, signIn: void 0, abort: () => {
+    finish({ stdout: stdout6, stderr, pid: child.pid ?? void 0, signIn: void 0, abort: () => {
     } });
   });
 });
@@ -8595,17 +8625,57 @@ function parseConnectOutput(output) {
   }
   return { method: "streamed-page", url };
 }
-async function installedSquireVersion(run2) {
-  const probe = await run2("npx", ["-y", SQUIRE_CONNECT_PACKAGE, "--version"]);
+async function installedSquireVersion(run2, spec = SQUIRE_CONNECT_PACKAGE, preferOnline = false) {
+  const probe = await run2("npx", [
+    ...preferOnline ? ["--prefer-online"] : [],
+    "-y",
+    spec,
+    "--version"
+  ]);
   const version = probe.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0];
   return version;
 }
+async function currentSquireRelease(run2) {
+  const probe = await run2("npm", ["view", SQUIRE_MCP_NAME, "version"]);
+  if (probe.code !== 0)
+    return void 0;
+  return probe.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0];
+}
+async function resolveSquireConnectSpec(run2) {
+  const currentRelease = await currentSquireRelease(run2);
+  const first = await installedSquireVersion(run2);
+  if (currentRelease === void 0 || first === currentRelease) {
+    return {
+      npxArgs: ["-y", SQUIRE_CONNECT_PACKAGE],
+      ...first !== void 0 ? { resolvedVersion: first } : {},
+      ...currentRelease !== void 0 ? { currentRelease } : {},
+      reResolved: false
+    };
+  }
+  const fresh = await installedSquireVersion(run2, SQUIRE_CONNECT_PACKAGE, true);
+  if (fresh === currentRelease) {
+    return {
+      npxArgs: ["--prefer-online", "-y", SQUIRE_CONNECT_PACKAGE],
+      resolvedVersion: fresh,
+      currentRelease,
+      reResolved: true
+    };
+  }
+  return {
+    npxArgs: ["-y", `${SQUIRE_MCP_NAME}@${currentRelease}`],
+    ...fresh !== void 0 ? { resolvedVersion: fresh } : {},
+    currentRelease,
+    reResolved: true
+  };
+}
 function parseSignedInAs(output) {
   return output.match(/signed in as ([^\s,;]+)/i)?.[1];
 }
 async function installSquire(options) {
   const run2 = options.run ?? defaultShellRunner;
   const streamRun = options.streamRun ?? defaultStreamedRunner;
+  const log2 = options.log ?? (() => {
+  });
   const steps = [step2("helper reached", "done")];
   const emit = () => options.onProgress?.([...steps]);
   const push = (next) => {
@@ -8618,9 +8688,13 @@ async function installSquire(options) {
     return { status: "error", steps, errorMessage: reason };
   };
   emit();
+  releaseSquireConnectSession(log2);
+  const resolution = await resolveSquireConnectSpec(run2);
+  if (resolution.reResolved) {
+    log2(`trusty-squire stale copy ${resolution.resolvedVersion ?? "unknown"} re-resolved against current release ${resolution.currentRelease}`);
+  }
   const install = await streamRun("npx", [
-    "-y",
-    SQUIRE_CONNECT_PACKAGE,
+    ...resolution.npxArgs,
     "connect",
     "--force-relogin=google",
     "--target=codex",
@@ -8631,7 +8705,7 @@ async function installSquire(options) {
     push(step2("trusty-squire installed", "failed", stderr || "connect printed no sign-in URL"));
     return fail(stderr || "the trusty-squire connect command printed no sign-in surface");
   }
-  const version = await installedSquireVersion(run2);
+  const version = resolution.resolvedVersion;
   push(step2(`trusty-squire${version ? ` ${version}` : ""} installed`, "done"));
   const signIn = install.signIn;
   const signedInAs = parseSignedInAs(`${install.stdout}
@@ -8788,9 +8862,10 @@ var StdioSquireMcpClient = class {
   }
   initialize() {
     const child = (this.options.spawn ?? spawn3)(this.options.command ?? "npx", [
-      // `@next` RC: only the RC coordinates with a running Trusty Squire broker
-      // for concurrent sessions; stable `latest` cannot share its browser.
-      ...this.options.args ?? ["-y", "@trusty-squire/mcp@next"]
+      // `@latest`: the current release, never a source-level version pin
+      // (captain). Only the vault MCP server the agent spawns; the connect
+      // install path verifies freshness itself (connector-squire.ts).
+      ...this.options.args ?? ["-y", "@trusty-squire/mcp@latest"]
     ]);
     this.child = child;
     this.buffer = "";
@@ -8899,7 +8974,12 @@ var ConnectorAssignmentLoop = class {
     this.log = options.log ?? (() => {
     });
     this.install = options.install ?? installSquire;
-    this.installGoogle = options.installGoogle ?? ((connectorType, onProgress) => installGoogleTool({ connectorType, home: this.googleHome(), onProgress }));
+    this.installGoogle = options.installGoogle ?? ((connectorType, onProgress, sharedCredentials) => installGoogleTool({
+      connectorType,
+      home: this.googleHome(),
+      onProgress,
+      resolvedCredentials: sharedCredentials ? sharedCredentials() : this.resolveGoogleCredentials()
+    }));
     this.googleHomeDir = options.googleHome ?? process.env.BEELINE_AGENT_HOME ?? process.cwd();
     this.readVaultFn = options.readVault ?? readVault;
     this.revokeGrantsFn = options.revokeGrants ?? revokeGrants;
@@ -8941,15 +9021,60 @@ var ConnectorAssignmentLoop = class {
       this.log(`connector assignments unavailable: ${describe2(error)}`);
       return;
     }
+    let googleBatch;
     for (const assignment of assignments) {
       const key = `${assignment.kind}:${assignment.connectorId}`;
       if (assignment.kind === "uninstall")
         continue;
+      if (assignment.kind === "install" && isGoogleToolConnectorType(assignment.connectorType)) {
+        if (this.inFlight.has(key))
+          continue;
+        this.inFlight.add(key);
+        (googleBatch ??= []).push(assignment);
+        continue;
+      }
       if (this.inFlight.has(key))
         continue;
       this.inFlight.add(key);
       void this.handle(assignment).catch((error) => this.log(`connector assignment ${key} failed: ${describe2(error)}`)).finally(() => this.inFlight.delete(key));
     }
+    if (googleBatch)
+      this.flushGoogleBatch(googleBatch);
+  }
+  flushGoogleBatch(batch) {
+    const keys = batch.map((a2) => `${a2.kind}:${a2.connectorId}`);
+    void this.runGoogleBatch(batch).catch((error) => this.log(`google connector installs failed: ${describe2(error)}`)).finally(() => {
+      for (const key of keys)
+        this.inFlight.delete(key);
+    });
+  }
+  /** The Google tool connectors ride ONE grant: every install in the batch
+   * shares one credential resolution (the single Google consent) and the
+   * installs run one at a time. Each tool still verifies and fails
+   * independently — a grant that cannot serve one tool's scope refuses that
+   * tool alone, never its siblings. */
+  async runGoogleBatch(batch) {
+    let shared;
+    const sharedCredentials = () => shared ??= this.resolveGoogleCredentials();
+    for (const assignment of batch) {
+      await this.runGoogleInstall(assignment.connectorId, assignment.connectorType, sharedCredentials);
+    }
+  }
+  /** The ONE grant resolution shared by every Google tool install of a
+   * drain: the Squire one-click vault path first, then the manual
+   * credentials path. Never rejects — a failure resolves as an unusable
+   * grant each install reports through its own steps. */
+  resolveGoogleCredentials() {
+    return (async () => {
+      try {
+        const oneClick = await readGoogleCredentialsFromVault(this.squire());
+        if (oneClick.source === "squire")
+          return oneClick;
+      } catch (error) {
+        this.log(`google one-click grant lookup failed: ${describe2(error)}`);
+      }
+      return loadManualGoogleCredentials(this.googleHome(), process.env);
+    })();
   }
   squire() {
     this.mcp ??= defaultSquireMcpClient();
@@ -8957,11 +9082,7 @@ var ConnectorAssignmentLoop = class {
   }
   async handle(assignment) {
     if (assignment.kind === "install") {
-      if (isGoogleToolConnectorType(assignment.connectorType)) {
-        await this.runGoogleInstall(assignment.connectorId, assignment.connectorType);
-      } else {
-        await this.runInstall(assignment.connectorId);
-      }
+      await this.runInstall(assignment.connectorId);
     } else if (assignment.kind === "sync")
       await this.runSync();
     else if (assignment.kind === "revoke-grants")
@@ -8971,8 +9092,9 @@ var ConnectorAssignmentLoop = class {
   googleHome() {
     return this.googleHomeDir;
   }
-  /** Install one Google tool connector (Gmail/Calendar/Drive/YouTube). */
-  async runGoogleInstall(connectorId, connectorType) {
+  /** Install one Google tool connector (Gmail/Calendar/Drive/YouTube),
+   * riding the drain's shared grant resolution. */
+  async runGoogleInstall(connectorId, connectorType, sharedCredentials) {
     const report = async (steps) => {
       try {
         await this.api.execute("postConnectorStatus", { agentId: this.agentId, connectorId, steps });
@@ -8980,7 +9102,7 @@ var ConnectorAssignmentLoop = class {
         this.log(`step report failed: ${describe2(error)}`);
       }
     };
-    const result = await this.installGoogle(connectorType, report);
+    const result = await this.installGoogle(connectorType, report, sharedCredentials);
     if (result.status === "error") {
       await this.api.execute("postConnectorStatus", {
         agentId: this.agentId,
@@ -9008,7 +9130,8 @@ var ConnectorAssignmentLoop = class {
     const result = await this.install({
       workspaceId: this.agentId,
       mcp: this.squire(),
-      onProgress: report
+      onProgress: report,
+      log: (message) => this.log(`[trusty-squire] ${message}`)
     });
     if (result.status === "error") {
       await this.api.execute("postConnectorStatus", {
@@ -19412,7 +19535,7 @@ Then take exactly one action:
 }
 
 // apps/body/dist/external-mcp-capabilities.js
-var SQUIRE_MCP_VERSION = "next";
+var SQUIRE_MCP_VERSION = "latest";
 var SQUIRE_MCP_PACKAGE = `@trusty-squire/mcp@${SQUIRE_MCP_VERSION}`;
 function isTrustySquireMcpLaunch(command, args = []) {
   return [command, ...args].some((value) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "usebeeline",
-  "version": "0.0.108",
+  "version": "0.0.109",
   "description": "Connect an AI coding agent to Beeline with one command.",
   "homepage": "https://usebeeline.app",
   "bugs": {