@agentage/cli 0.38.0 → 0.38.1

package/dist/cli.js

@@ -3,8 +3,10 @@
 const nodeMajor = Number(process.versions.node.split('.')[0]);
 if (nodeMajor < 22) {
     process.stderr.write(`agentage requires Node.js >= 22 (you have v${process.versions.node})\n`);
-    process.exit(1);
+    process.exitCode = 1;
+}
+else {
+    const { run } = await import('./program.js');
+    process.exitCode = await run();
 }
-const { run } = await import('./program.js');
-await run();
 export {};

package/dist/commands/auth/setup.d.ts

@@ -1,20 +1,12 @@
 import { type Command } from 'commander';
-import { startCallbackServer } from '../../lib/auth/callback-server.js';
-import { introspectToken } from '../../lib/auth/api.js';
-import { exchangeCode, registerClient, revokeToken } from '../../lib/auth/oauth.js';
-export interface SetupOptions {
+import { type SignInOptions, type SignInResult } from '../../lib/auth/sign-in.js';
+export interface SetupOptions extends SignInOptions {
     disconnect?: boolean;
-    reauth?: boolean;
-    browser?: boolean;
 }
 export interface SetupDeps {
-    register: typeof registerClient;
-    exchange: typeof exchangeCode;
-    revoke: typeof revokeToken;
-    startServer: typeof startCallbackServer;
-    openBrowser: (url: string) => Promise<void>;
+    ensureSignedIn: (opts: SignInOptions) => Promise<SignInResult>;
+    signOut: () => Promise<void>;
     printStatus: () => Promise<void>;
-    introspect: typeof introspectToken;
 }
-export declare const runSetup: (opts: SetupOptions, deps?: SetupDeps) => Promise<void>;
-export declare const registerSetup: (program: Command) => void;
+export declare const runSetup: (opts: SetupOptions, deps: SetupDeps) => Promise<void>;
+export declare const registerSetup: (program: Command, action: (opts: SetupOptions) => Promise<void>) => void;

package/dist/commands/auth/setup.js

@@ -1,129 +1,17 @@
-import chalk from 'chalk';
-import { startCallbackServer } from '../../lib/auth/callback-server.js';
-import { deleteAuth, ensureConfigDir, mutateAuth, readAuth, } from '../../lib/fs/config.js';
-import { AuthRequiredError, introspectToken } from '../../lib/auth/api.js';
-import { detectEnvMismatch } from '../../lib/auth/env-match.js';
-import { buildAuthorizeUrl, exchangeCode, pkcePair, randomState, registerClient, revokeToken, } from '../../lib/auth/oauth.js';
-import { links, siteFqdn } from '../../lib/net/origins.js';
-import { runStatus } from '../status/status.js';
-const defaultDeps = {
-    register: registerClient,
-    exchange: exchangeCode,
-    revoke: revokeToken,
-    startServer: startCallbackServer,
-    openBrowser: async (url) => {
-        const { default: open } = await import('open');
-        await open(url);
-    },
-    printStatus: () => runStatus({}),
-    introspect: introspectToken,
+import {} from 'commander';
+import {} from '../../lib/auth/sign-in.js';
+export const runSetup = async (opts, deps) => {
+    if (opts.disconnect)
+        return deps.signOut();
+    await deps.ensureSignedIn({ reauth: opts.reauth, browser: opts.browser });
+    await deps.printStatus();
 };
-const toAuthState = (fqdn, clientId, tokens) => ({
-    siteFqdn: fqdn,
-    clientId,
-    tokens: {
-        accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token,
-        expiresAt: tokens.expires_in ? Date.now() + tokens.expires_in * 1000 : undefined,
-    },
-});
-const disconnect = async (deps) => {
-    const auth = readAuth();
-    if (!auth) {
-        console.log('Nothing to disconnect.');
-        return;
-    }
-    await deps.revoke(links(auth.siteFqdn).auth, auth.tokens.accessToken);
-    await deleteAuth();
-    console.log('Disconnected - local credentials removed.');
-};
-// Validate the stored session instead of trusting mere token presence. Returns true to short-circuit
-// (valid or a transient blip - creds intact), false to proceed into a fresh sign-in (truly expired or
-// the credential belongs to a different target than the current run).
-const alreadySignedIn = async (auth, deps) => {
-    const mismatch = detectEnvMismatch(auth, siteFqdn());
-    if (mismatch) {
-        console.log(`Signed in to ${mismatch.credentialFqdn} (${mismatch.credentialEnv}), but this run targets ` +
-            `${mismatch.targetFqdn} (${mismatch.targetEnv}) - signing you into ${mismatch.targetEnv}.\n`);
-        return false; // proceed to a fresh sign-in against the current target
-    }
-    try {
-        await deps.introspect(auth, links(auth.siteFqdn));
-        console.log(`Already signed in. Run ${chalk.white('agentage setup --reauth')} to sign in again.\n`);
-        await deps.printStatus();
-        return true;
-    }
-    catch (err) {
-        if (err instanceof AuthRequiredError) {
-            console.log('Session expired - signing you in again.\n');
-            return false; // fall through to the sign-in flow, no --reauth needed
-        }
-        // Transient: do not force reauth on a blip; keep credentials and show status.
-        console.log('You appear signed in (could not fully verify - temporary).\n');
-        await deps.printStatus();
-        return true;
-    }
-};
-export const runSetup = async (opts, deps = defaultDeps) => {
-    if (opts.disconnect) {
-        await disconnect(deps);
-        return;
-    }
-    const stored = readAuth();
-    if (stored && !opts.reauth && (await alreadySignedIn(stored, deps)))
-        return;
-    const fqdn = siteFqdn();
-    const target = links(fqdn);
-    ensureConfigDir();
-    const { verifier, challenge } = pkcePair();
-    const state = randomState();
-    const server = await deps.startServer(state);
-    try {
-        const clientId = await deps.register(target.auth, server.redirectUri);
-        const url = buildAuthorizeUrl(target.auth, {
-            clientId,
-            redirectUri: server.redirectUri,
-            challenge,
-            state,
-        });
-        console.log(`\nSign in to agentage (${fqdn}):\n\n  ${url}\n`);
-        if (opts.browser === false)
-            console.log('Open the URL above in a browser to continue.');
-        else
-            await deps
-                .openBrowser(url)
-                .catch(() => console.log('Could not open a browser - use the URL above.'));
-        console.log('Waiting for sign-in to complete...');
-        const code = await server.waitForCode();
-        const tokens = await deps.exchange(target.auth, {
-            clientId,
-            code,
-            redirectUri: server.redirectUri,
-            verifier,
-        });
-        await mutateAuth(() => toAuthState(fqdn, clientId, tokens));
-        console.log(chalk.green('\nSigned in.\n'));
-        await deps.printStatus();
-    }
-    finally {
-        server.close();
-    }
-};
-export const registerSetup = (program) => {
+export const registerSetup = (program, action) => {
     program
         .command('setup')
         .description('Sign in and connect this machine to your agentage account')
         .option('--disconnect', 'sign out and remove local credentials')
         .option('--reauth', 'force a fresh sign-in')
         .option('--no-browser', 'print the sign-in URL instead of opening a browser')
-        .action(async (opts) => {
-        try {
-            await runSetup(opts);
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            console.error(chalk.red(`Setup failed: ${message}`));
-            process.exitCode = 1;
-        }
-    });
+        .action(action);
 };

package/dist/commands/status/status.d.ts

@@ -1,8 +1,9 @@
 import { type Command } from 'commander';
 import { type StatusReport } from '../../lib/status/status-info.js';
 export declare const printStatus: (report: StatusReport) => void;
-export declare const runStatus: (opts?: {
+export interface StatusOptions {
     json?: boolean;
     token?: string;
-}) => Promise<void>;
-export declare const registerStatus: (program: Command) => void;
+}
+export declare const runStatus: (opts?: StatusOptions) => Promise<void>;
+export declare const registerStatus: (program: Command, action: (opts: StatusOptions) => Promise<void>) => void;

package/dist/commands/status/status.js

@@ -1,4 +1,5 @@
 import chalk from 'chalk';
+import {} from 'commander';
 import { resolveAuth } from '../../lib/auth/credentials.js';
 import { siteFqdn } from '../../lib/net/origins.js';
 import { gatherStatus } from '../../lib/status/status-info.js';
@@ -54,11 +55,11 @@ export const runStatus = async (opts = {}) => {
     }
     printStatus(report);
 };
-export const registerStatus = (program) => {
+export const registerStatus = (program, action) => {
     program
         .command('status')
         .description('Show CLI, account, and endpoint status')
         .option('--json', 'machine-readable output')
         .option('--token <token>', 'authenticate with a personal access token (aga_...); or set AGENTAGE_TOKEN')
-        .action(runStatus);
+        .action(action);
 };

package/dist/commands/update/update.d.ts

@@ -1,5 +1,7 @@
 import { type Command } from 'commander';
+import { requireNpm10, runNpm } from '../../lib/npm/npm-cli.js';
 import { type UpdateInfo } from '../../lib/update/update-check.js';
+export declare const installLatest: (run?: typeof runNpm, check?: typeof requireNpm10) => Promise<void>;
 export interface UpdateDeps {
     check: (installed: string) => Promise<UpdateInfo>;
     install: () => Promise<void>;
@@ -11,4 +13,4 @@ export interface UpdateOptions {
     check?: boolean;
 }
 export declare const runUpdate: (opts: UpdateOptions, deps?: UpdateDeps) => Promise<void>;
-export declare const registerUpdate: (program: Command) => void;
+export declare const registerUpdate: (program: Command, action: (opts: UpdateOptions) => Promise<void>) => void;

package/dist/commands/update/update.js

@@ -1,17 +1,30 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
+import { join } from 'node:path';
 import chalk from 'chalk';
+import {} from 'commander';
+import { getConfigDir } from '../../lib/fs/config.js';
+import { acquireFileLock, releaseFileLock } from '../../lib/fs/file-lock.js';
+import { requireNpm10, runNpm } from '../../lib/npm/npm-cli.js';
 import { checkForUpdate, INSTALL_HINT } from '../../lib/update/update-check.js';
-import { acquireUpdateLock, releaseUpdateLock } from '../../lib/update/update-lock.js';
 import { VERSION } from '../../utils/version.js';
-const pexec = promisify(execFile);
+const INSTALL_TIMEOUT_MS = 5 * 60_000;
+const NPM_TAIL_LINES = 10;
+// An install takes minutes, so the crashed-holder ages scale up from the config-write defaults.
+const UPDATE_LOCK = { ttlMs: 10 * 60_000, hardStaleMs: 30 * 60_000 };
+const updateLockTarget = () => join(getConfigDir(), 'update');
+const tail = (text) => text.trimEnd().split('\n').slice(-NPM_TAIL_LINES).join('\n');
+export const installLatest = async (run = runNpm, check = requireNpm10) => {
+    await check(run);
+    const res = await run(['install', '-g', '@agentage/cli@latest'], {
+        timeoutMs: INSTALL_TIMEOUT_MS,
+    });
+    if (res.code !== 0)
+        throw new Error(`npm install failed (exit ${res.code}):\n${tail(res.stderr || res.stdout)}`);
+};
 const defaultDeps = {
     check: checkForUpdate,
-    install: async () => {
-        await pexec('npm', ['install', '-g', '@agentage/cli@latest']);
-    },
-    acquireLock: () => acquireUpdateLock(),
-    releaseLock: releaseUpdateLock,
+    install: () => installLatest(),
+    acquireLock: () => acquireFileLock(updateLockTarget(), Date.now(), UPDATE_LOCK),
+    releaseLock: () => releaseFileLock(updateLockTarget()),
     log: (msg) => console.log(msg),
 };
 const describe = (info) => {
@@ -32,9 +45,7 @@ const install = async (deps) => {
     await deps.install();
     deps.log(chalk.green('Updated. Run `agentage status` to confirm.'));
 };
-// --check reports the verdict and never installs. Otherwise, install only when the registry says
-// we're behind (available/unsupported), guarded by a single-writer lock; current/unreachable just
-// report.
+// --check never installs; otherwise install only when behind, under a single-writer lock.
 export const runUpdate = async (opts, deps = defaultDeps) => {
     const info = await deps.check(VERSION);
     deps.log(describe(info));
@@ -52,18 +63,10 @@ export const runUpdate = async (opts, deps = defaultDeps) => {
         deps.releaseLock();
     }
 };
-export const registerUpdate = (program) => {
+export const registerUpdate = (program, action) => {
     program
         .command('update')
         .description('Update @agentage/cli to the latest published version')
         .option('--check', 'report whether an update is available, without installing')
-        .action(async (opts) => {
-        try {
-            await runUpdate(opts);
-        }
-        catch (err) {
-            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-            process.exitCode = 1;
-        }
-    });
+        .action(action);
 };

package/dist/lib/auth/api.d.ts

@@ -1,7 +1,8 @@
 import { type AuthState } from '../fs/config.js';
+import { type CliRequestInit } from '../net/fetch.js';
 import { type Links } from '../net/origins.js';
 export { AuthRequiredError, TransientAuthError } from './auth-errors.js';
 export declare const refreshOrThrow: (auth: AuthState, links: Links) => Promise<void>;
-export declare const authedGet: <T>(auth: AuthState, links: Links, url: string) => Promise<T>;
-export declare const authedPost: (auth: AuthState, links: Links, url: string, body: unknown) => Promise<Response>;
+export declare const authedFetch: (auth: AuthState, links: Links, url: string, init?: CliRequestInit) => Promise<Response>;
+export declare const authedJson: <T>(auth: AuthState, links: Links, url: string, init?: CliRequestInit) => Promise<T>;
 export { introspectToken, type TokenSession } from './introspect.js';

package/dist/lib/auth/api.js

@@ -1,45 +1,52 @@
 import { mutateAuth } from '../fs/config.js';
-import { refreshTokens, TokenRequestError } from './oauth.js';
-import { requestHeaders } from '../net/user-agent.js';
+import { cliFetch, isRedirect } from '../net/fetch.js';
+import {} from '../net/origins.js';
 import { AuthRequiredError, isTerminalRefresh, TransientAuthError } from './auth-errors.js';
+import { refreshTokens, TokenRequestError, tokensFrom } from './oauth.js';
 export { AuthRequiredError, TransientAuthError } from './auth-errors.js';
-// Every authed call is CLI-originated; identify the caller alongside the bearer.
-const cliHeaders = () => requestHeaders();
-// Refresh the stored token in place. On success mutates auth + persists and returns. On failure it
-// throws: AuthRequiredError when the grant is dead (401/invalid_grant/invalid_client), else
-// TransientAuthError (429/5xx/network/timeout) - a blip that must not be read as a dead session.
-export const refreshOrThrow = async (auth, links) => {
-    if (auth.kind === 'pat')
-        throw new AuthRequiredError('personal access token expired or revoked - mint a new one in the dashboard (Settings -> API tokens)');
-    if (!auth.tokens.refreshToken)
-        throw new AuthRequiredError('no refresh token');
-    let fresh;
+const requestTokens = async (auth, links, rt) => {
     try {
-        fresh = await refreshTokens(links.auth, auth.clientId, auth.tokens.refreshToken);
+        return tokensFrom(await refreshTokens(links.auth, auth.clientId, rt), rt);
     }
     catch (err) {
         if (err instanceof TokenRequestError && isTerminalRefresh(err.status, err.oauthError))
             throw new AuthRequiredError('session expired');
         throw new TransientAuthError('refresh temporarily failed');
     }
-    const tokens = {
-        accessToken: fresh.access_token,
-        refreshToken: fresh.refresh_token ?? auth.tokens.refreshToken,
-        expiresAt: fresh.expires_in ? Date.now() + fresh.expires_in * 1000 : undefined,
-    };
-    auth.tokens = tokens; // the caller retries its request with this in-memory copy
-    // Persist under the lock, folding the new tokens onto the freshly-read state so a concurrent
-    // writer's other fields (clientId, siteFqdn) are not clobbered by a stale in-memory copy. A null
-    // re-read means a sign-out won the race: skip the write rather than resurrect it (issue #236).
+};
+// Never resurrect a sign-out (null) or overwrite a newer sign-in by another client.
+const persistTokens = async (clientId, tokens) => {
     await mutateAuth((current) => {
-        if (!current)
+        if (!current || current.clientId !== clientId)
             return null;
         current.tokens = tokens;
         return current;
     });
 };
-// Boolean shim for the request paths that just want "refresh once, then retry": any failure
-// (terminal or transient) collapses to false so they fall through to their own status handling.
+const refreshAndPersist = async (auth, links, rt) => {
+    const tokens = await requestTokens(auth, links, rt);
+    await persistTokens(auth.clientId, tokens);
+    return tokens;
+};
+// Keyed by refresh token: parallel 401s share one grant instead of racing its rotation.
+const inflight = new Map();
+const sharedRefresh = (auth, links, rt) => {
+    const pending = inflight.get(rt);
+    if (pending)
+        return pending;
+    const next = refreshAndPersist(auth, links, rt).finally(() => inflight.delete(rt));
+    inflight.set(rt, next);
+    return next;
+};
+// Throws AuthRequiredError for a dead grant, TransientAuthError for a blip (429/5xx/network).
+export const refreshOrThrow = async (auth, links) => {
+    if (auth.kind === 'pat')
+        throw new AuthRequiredError('personal access token expired or revoked - mint a new one in the dashboard (Settings -> API tokens)');
+    const rt = auth.tokens.refreshToken;
+    if (!rt)
+        throw new AuthRequiredError('no refresh token');
+    auth.tokens = await sharedRefresh(auth, links, rt); // the caller retries with this copy
+};
 const tryRefresh = async (auth, links) => {
     try {
         await refreshOrThrow(auth, links);
@@ -49,41 +56,28 @@ const tryRefresh = async (auth, links) => {
         return false;
     }
 };
-// redirect: 'manual' so the bearer is never replayed to a redirect target; any 3xx is an error.
-const isRedirect = (res) => res.type === 'opaqueredirect' || (res.status >= 300 && res.status < 400);
-export const authedGet = async (auth, links, url) => {
-    const call = () => fetch(url, {
-        headers: { authorization: `Bearer ${auth.tokens.accessToken}`, ...cliHeaders() },
-        redirect: 'manual',
-    });
-    let res = await call();
-    if (res.status === 401 && (await tryRefresh(auth, links)))
-        res = await call();
+const withBearer = (auth, init) => ({
+    ...init,
+    headers: { ...init.headers, authorization: `Bearer ${auth.tokens.accessToken}` },
+});
+// The raw Response after at most one refresh-and-retry on 401; callers branch on the status.
+export const authedFetch = async (auth, links, url, init = {}) => {
+    const res = await cliFetch(url, withBearer(auth, init));
+    if (res.status !== 401 || !(await tryRefresh(auth, links)))
+        return res;
+    await res.body?.cancel();
+    return cliFetch(url, withBearer(auth, init));
+};
+export const authedJson = async (auth, links, url, init = {}) => {
+    const method = init.method ?? 'GET';
+    const res = await authedFetch(auth, links, url, init);
     if (res.status === 401)
         throw new AuthRequiredError('session expired');
     if (isRedirect(res))
-        throw new Error(`GET ${url} refused redirect (${res.status})`);
+        throw new Error(`${method} ${url} refused redirect (${res.status})`);
     if (!res.ok)
-        throw new Error(`GET ${url} failed (${res.status})`);
+        throw new Error(`${method} ${url} failed (${res.status})`);
     return (await res.json());
 };
-// A bearer POST with the same refresh-once dance as authedGet. Unlike authedGet it returns the
-// raw Response (never throws on a non-2xx): callers branch on the status codes themselves.
-export const authedPost = async (auth, links, url, body) => {
-    const call = () => fetch(url, {
-        method: 'POST',
-        headers: {
-            authorization: `Bearer ${auth.tokens.accessToken}`,
-            'content-type': 'application/json',
-            ...cliHeaders(),
-        },
-        body: JSON.stringify(body),
-        redirect: 'manual',
-    });
-    let res = await call();
-    if (res.status === 401 && (await tryRefresh(auth, links)))
-        res = await call();
-    return res;
-};
 // Re-export the introspection surface so existing callers keep importing from './api.js'.
 export { introspectToken } from './introspect.js';

package/dist/lib/auth/env-match.js

@@ -1,3 +1,4 @@
+import {} from '../fs/config.js';
 import { environment, normalizeFqdn } from '../net/origins.js';
 // The stored credential belongs to the environment it was issued for (auth.siteFqdn); the CLI's
 // current target comes from AGENTAGE_SITE_FQDN (production default). Introspecting a dev credential

package/dist/lib/auth/introspect.js

@@ -1,4 +1,6 @@
-import { authedGet, refreshOrThrow } from './api.js';
+import {} from '../fs/config.js';
+import {} from '../net/origins.js';
+import { authedJson, refreshOrThrow } from './api.js';
 import { AuthRequiredError, TransientAuthError } from './auth-errors.js';
 const isPast = (iso) => {
     if (!iso)
@@ -6,17 +8,14 @@ const isPast = (iso) => {
     const t = Date.parse(iso);
     return !Number.isNaN(t) && t <= Date.now();
 };
-const sleep = (ms) => new Promise((resolve) => {
-    // unref so a pending backoff never keeps `status` from exiting.
-    const timer = setTimeout(resolve, ms);
-    timer.unref();
-});
-// Introspection over global fetch: a network error reflects as a transient (a blip must not read as
-// a dead session), never letting the raw error escape to gatherStatus. Only a 401 stays terminal.
+const RETRY_BACKOFF_MS = 300;
+// Ref'd on purpose: an unref'd backoff let Node exit 13 mid-retry once nothing else held the loop.
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+// Any failure but a 401 is a transient: a network blip must never read as a dead session.
 const getSession = async (auth, links) => {
     const url = `${links.auth}/api/auth/mcp/get-session`;
     try {
-        return await authedGet(auth, links, url);
+        return await authedJson(auth, links, url);
     }
     catch (err) {
         if (err instanceof AuthRequiredError)
@@ -75,7 +74,7 @@ const introspectOnce = async (auth, links) => {
     }
     return freshenIfStale(auth, links, body);
 };
-// A retry-once with a short unref'd backoff absorbs a lone transient blip; a terminal error skips it.
+// A retry-once with a short backoff absorbs a lone transient blip; a terminal error skips it.
 export const introspectToken = async (auth, links) => {
     try {
         return await introspectOnce(auth, links);
@@ -83,7 +82,7 @@ export const introspectToken = async (auth, links) => {
     catch (err) {
         if (err instanceof AuthRequiredError)
             throw err; // terminal: no point retrying a dead session
-        await sleep(300);
+        await sleep(RETRY_BACKOFF_MS);
         return introspectOnce(auth, links); // one transient-only retry; a 2nd transient propagates
     }
 };

package/dist/lib/auth/oauth.d.ts

@@ -1,3 +1,4 @@
+import { type StoredTokens } from '../fs/config.js';
 export interface PkcePair {
     verifier: string;
     challenge: string;
@@ -12,6 +13,7 @@ export interface TokenResponse {
 export declare const DEFAULT_SCOPE = "memory:read memory:write offline_access";
 export declare const pkcePair: () => PkcePair;
 export declare const randomState: () => string;
+export declare const tokensFrom: (res: TokenResponse, previousRefresh?: string) => StoredTokens;
 export declare const registerClient: (authUrl: string, redirectUri: string) => Promise<string>;
 export declare const buildAuthorizeUrl: (authUrl: string, params: {
     clientId: string;

package/dist/lib/auth/oauth.js

@@ -1,11 +1,11 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { requestHeaders } from '../net/user-agent.js';
-// OAuth register/token/revoke are all CLI-originated; identify the caller on each.
-const cliHeaders = () => requestHeaders();
+import {} from '../fs/config.js';
+import { AUTH_TIMEOUT_MS, cliFetch } from '../net/fetch.js';
 const REGISTER_PATH = '/api/auth/mcp/register';
 const AUTHORIZE_PATH = '/api/auth/mcp/authorize';
 const TOKEN_PATH = '/api/auth/mcp/token';
 const REVOKE_PATH = '/api/auth/mcp/revoke';
+const REVOKE_TIMEOUT_MS = 3_000;
 export const DEFAULT_SCOPE = 'memory:read memory:write offline_access';
 export const pkcePair = () => {
     const verifier = randomBytes(32).toString('base64url');
@@ -13,18 +13,25 @@ export const pkcePair = () => {
     return { verifier, challenge };
 };
 export const randomState = () => randomBytes(16).toString('base64url');
+// A refresh that does not rotate keeps the previous refresh token.
+export const tokensFrom = (res, previousRefresh) => ({
+    accessToken: res.access_token,
+    refreshToken: res.refresh_token ?? previousRefresh,
+    expiresAt: res.expires_in ? Date.now() + res.expires_in * 1000 : undefined,
+});
+const registration = (redirectUri) => JSON.stringify({
+    client_name: 'agentage CLI',
+    redirect_uris: [redirectUri],
+    token_endpoint_auth_method: 'none',
+    grant_types: ['authorization_code', 'refresh_token'],
+    response_types: ['code'],
+});
 export const registerClient = async (authUrl, redirectUri) => {
-    const res = await fetch(`${authUrl}${REGISTER_PATH}`, {
+    const res = await cliFetch(`${authUrl}${REGISTER_PATH}`, {
         method: 'POST',
-        headers: { 'content-type': 'application/json', ...cliHeaders() },
-        body: JSON.stringify({
-            client_name: 'agentage CLI',
-            redirect_uris: [redirectUri],
-            token_endpoint_auth_method: 'none',
-            grant_types: ['authorization_code', 'refresh_token'],
-            response_types: ['code'],
-        }),
-    });
+        headers: { 'content-type': 'application/json' },
+        body: registration(redirectUri),
+    }, { timeoutMs: AUTH_TIMEOUT_MS });
     if (!res.ok)
         throw new Error(`client registration failed (${res.status})`);
     const body = (await res.json());
@@ -55,12 +62,13 @@ export class TokenRequestError extends Error {
         this.name = 'TokenRequestError';
     }
 }
+const formInit = (form) => ({
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(form).toString(),
+});
 const postForm = async (url, form) => {
-    const res = await fetch(url, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded', ...cliHeaders() },
-        body: new URLSearchParams(form).toString(),
-    });
+    const res = await cliFetch(url, formInit(form), { timeoutMs: AUTH_TIMEOUT_MS });
     if (!res.ok) {
         const body = (await res.json().catch(() => null));
         throw new TokenRequestError(res.status, body?.error);
@@ -79,18 +87,12 @@ export const refreshTokens = (authUrl, clientId, refreshToken) => postForm(`${au
     refresh_token: refreshToken,
     client_id: clientId,
 });
-// AbortSignal.timeout caps a stalled revoke on a packet-drop network; residual undici keepalive is
-// acceptable here since --disconnect exits right after and errors are swallowed anyway.
-export const revokeToken = async (authUrl, token, timeoutMs = 3000) => {
+// Best-effort with a short cap: local credentials are removed whatever the server says.
+export const revokeToken = async (authUrl, token, timeoutMs = REVOKE_TIMEOUT_MS) => {
     try {
-        await fetch(`${authUrl}${REVOKE_PATH}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded', ...cliHeaders() },
-            body: new URLSearchParams({ token }).toString(),
-            signal: AbortSignal.timeout(timeoutMs),
-        });
+        await cliFetch(`${authUrl}${REVOKE_PATH}`, formInit({ token }), { timeoutMs });
     }
     catch {
-        // best-effort: local credentials are removed regardless
+        // a stalled or refused revoke never blocks sign-out
     }
 };

package/dist/lib/auth/sign-in.d.ts

@@ -0,0 +1,20 @@
+import { startCallbackServer } from './callback-server.js';
+import { introspectToken } from './introspect.js';
+import { exchangeCode, registerClient, revokeToken } from './oauth.js';
+export interface SignInOptions {
+    reauth?: boolean;
+    browser?: boolean;
+}
+export type SignInResult = 'signed-in' | 'already' | 'mismatch-resigned';
+export interface SignInDeps {
+    register: typeof registerClient;
+    exchange: typeof exchangeCode;
+    revoke: typeof revokeToken;
+    startServer: typeof startCallbackServer;
+    openBrowser: (url: string) => Promise<void>;
+    introspect: typeof introspectToken;
+    log: (msg: string) => void;
+}
+export declare const signIn: (opts: SignInOptions, deps?: SignInDeps) => Promise<void>;
+export declare const signOut: (deps?: SignInDeps) => Promise<void>;
+export declare const ensureSignedIn: (opts: SignInOptions, deps?: SignInDeps) => Promise<SignInResult>;