Fix critical PR review issues

- Fix JWT expiration in watch.ts: Store RealmAuthClient instead of
  cached JWT string, call getJWT() before each request for auto-refresh
- Fix Linux fs.watch: Add platform check to avoid recursive option on
  Linux where it throws ERR_FEATURE_UNAVAILABLE_ON_PLATFORM
- Remove .claude/settings.local.json from repo and add to .gitignore
  (user-specific settings should not be committed)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: christse

.claude/settings.local.json

@@ -22,6 +22,9 @@ Thumbs.db
 *.swp
 *.swo
 
+# Claude Code (user-specific settings)
+.claude/settings.local.json
+
 # Test workspaces
 test-workspace/
 *-workspace/

.gitignore

@@ -332,11 +332,20 @@ export async function trackCommand(
   };
 
   // Use fs.watch for efficient file watching
+  // Note: recursive: true is not reliably supported on Linux
+  const isLinux = process.platform === 'linux';
   const watchers: fs.FSWatcher[] = [];
 
+  if (isLinux && !options.quiet) {
+    console.log('Note: Recursive file watching is limited on Linux. Using polling as primary method.');
+  }
+
   const watchDir = (dir: string) => {
     try {
-      const watcher = fs.watch(dir, { recursive: true }, (eventType, filename) => {
+      // On Linux, don't use recursive option as it may throw ERR_FEATURE_UNAVAILABLE_ON_PLATFORM
+      const watchOptions: fs.WatchOptions = isLinux ? {} : { recursive: true };
+
+      const watcher = fs.watch(dir, watchOptions, (eventType, filename) => {
         if (!filename) return;
 
         // Skip internal files
@@ -355,7 +364,10 @@ export async function trackCommand(
 
       watchers.push(watcher);
     } catch (error) {
-      console.error(`Failed to watch directory:`, error);
+      // On platforms where fs.watch fails, we rely on polling
+      if (!options.quiet) {
+        console.log('File system watching unavailable, using polling only.');
+      }
     }
   };
 

src/commands/track.ts

@@ -22,7 +22,7 @@ interface WatchedRealm {
   name: string;
   localDir: string;
   workspaceUrl: string;
-  jwt: string;
+  realmAuthClient: RealmAuthClient;  // Store client for JWT refresh support
   checkpointManager: CheckpointManager;
   lastKnownState: Record<string, number>;
   pendingChanges: Map<string, { status: 'added' | 'modified' | 'deleted'; mtime: number }>;
@@ -87,14 +87,15 @@ export async function watchCommand(
 
     const normalizedUrl = workspaceUrl.endsWith('/') ? workspaceUrl : workspaceUrl + '/';
 
-    // Get JWT for this realm
+    // Create realm auth client (handles JWT caching and refresh internally)
     if (options.verbose) {
-      console.log(`[VERBOSE] Getting JWT for ${normalizedUrl}...`);
+      console.log(`[VERBOSE] Creating RealmAuthClient for ${normalizedUrl}...`);
     }
-    const realmAuth = new RealmAuthClient(new URL(normalizedUrl), matrixClient);
-    const jwt = await realmAuth.getJWT();
+    const realmAuthClient = new RealmAuthClient(new URL(normalizedUrl), matrixClient);
+    // Verify we can get a JWT (this also caches it)
+    const initialJwt = await realmAuthClient.getJWT();
     if (options.verbose) {
-      console.log(`[VERBOSE] JWT acquired (${jwt.length} chars)`);
+      console.log(`[VERBOSE] Initial JWT acquired (${initialJwt.length} chars)`);
     }
 
     // Initialize checkpoint manager
@@ -123,7 +124,7 @@ export async function watchCommand(
       name,
       localDir,
       workspaceUrl: normalizedUrl,
-      jwt,
+      realmAuthClient,
       checkpointManager,
       lastKnownState,
       pendingChanges: new Map(),
@@ -184,11 +185,14 @@ export async function watchCommand(
 
     console.log(`  Pulling changes...`);
 
+    // Get fresh JWT (handles refresh if expired)
+    const jwt = await realm.realmAuthClient.getJWT();
+
     for (const file of [...newFiles, ...modifiedFiles]) {
       const fileUrl = `${realm.workspaceUrl}${file}`;
       const fileResponse = await fetch(fileUrl, {
         headers: {
-          'Authorization': realm.jwt,
+          'Authorization': jwt,
           'Accept': file.endsWith('.json')
             ? 'application/vnd.card+json'
             : file.endsWith('.gts')
@@ -247,10 +251,13 @@ export async function watchCommand(
 
   const checkRealmForChanges = async (realm: WatchedRealm) => {
     try {
+      // Get fresh JWT (handles refresh if expired)
+      const jwt = await realm.realmAuthClient.getJWT();
+
       const mtimesUrl = `${realm.workspaceUrl}_mtimes`;
       const response = await fetch(mtimesUrl, {
         headers: {
-          'Authorization': realm.jwt,
+          'Authorization': jwt,
           'Accept': 'application/vnd.api+json',
         },
       });