@anyslate/cli 0.2.0 → 0.3.1

package/src/auth.mjs

@@ -0,0 +1,310 @@
+// Bearer resolution and refresh for every command that talks to the server.
+//
+// THIS IS THE LOAD-BEARING PART OF THE OAUTH WORK. A static `as_mcp_` token
+// never expires, so `loadConfig().mcpToken` was the whole auth story. An OAuth
+// access token lives 3600 seconds, and hooks fire unattended in
+// non-interactive shells — so a token WILL expire mid-session, in a process
+// with no terminal, no browser, and a hard "must exit 0" contract.
+//
+// The rules that fall out of that:
+//
+//   * Refresh PROACTIVELY, 5 minutes ahead of expiry, before the call. Waiting
+//     for the 401 spends a round trip and, on the hook path, risks the 15s
+//     budget.
+//   * On a 401, refresh EXACTLY ONCE and retry EXACTLY ONCE. A loop here is a
+//     self-inflicted rate limit against an endpoint that is already refusing us.
+//   * Persist the rotated refresh token immediately (rotation is on server-side).
+//   * NEVER open a browser. This module is imported by `hook`; a browser launch
+//     from a lifecycle hook would spray tabs across the user's screen and hang
+//     a process that must not hang.
+//   * Never throw. Callers are fail-open paths; a rejected promise here would
+//     become an uncaught exception in a hook and a non-zero exit.
+
+import { readConfigFile, updateConfigFile, withRefreshLock } from './credentials.mjs';
+import { callTool } from './mcp-client.mjs';
+import { discover, refreshAccessToken, REFRESH_SKEW_MS } from './oauth.mjs';
+
+export { REFRESH_SKEW_MS };
+
+/** Everything a hook/checkpoint/upload path is allowed to say about auth. */
+export const RELOGIN_HINT = 'Run `anyslate login` to sign in again.';
+
+/**
+ * @param {unknown} expiresAt ISO 8601
+ * @returns {number|null} epoch ms, or null when unparseable
+ */
+export function expiryMs(expiresAt) {
+  if (typeof expiresAt !== 'string' || !expiresAt) return null;
+  const t = Date.parse(expiresAt);
+  return Number.isFinite(t) ? t : null;
+}
+
+/**
+ * Is this credential inside the refresh window (or already dead)?
+ *
+ * An UNPARSEABLE or ABSENT expiry counts as expiring. Treating "I do not know"
+ * as "still valid" is how a config written by a future version, or hand-edited,
+ * turns into a silent 401 loop.
+ *
+ * @param {{expires_at?: string}|null|undefined} oauth
+ * @param {number} [skewMs]
+ * @param {number} [now]
+ */
+export function isExpiring(oauth, skewMs = REFRESH_SKEW_MS, now = Date.now()) {
+  if (!oauth?.access_token) return true;
+  const t = expiryMs(oauth.expires_at);
+  if (t == null) return true;
+  return t - now <= skewMs;
+}
+
+/** Hard expiry, no skew — used for reporting, not for refresh decisions. */
+export function isExpired(oauth, now = Date.now()) {
+  return isExpiring(oauth, 0, now);
+}
+
+/** Minutes until expiry, for human output. Negative means already expired. */
+export function minutesUntilExpiry(oauth, now = Date.now()) {
+  const t = expiryMs(oauth?.expires_at);
+  if (t == null) return null;
+  return Math.round((t - now) / 60_000);
+}
+
+/** Does this config hold OAuth credentials worth using or refreshing? */
+export function hasOauthCredentials(oauth) {
+  return !!(oauth && (oauth.access_token || oauth.refresh_token));
+}
+
+/**
+ * Resolve the endpoints used for a refresh.
+ *
+ * `login` caches `token_endpoint`/`resource`/`root` alongside the tokens, so
+ * the common refresh costs ONE request rather than three. The cache is only
+ * trusted when it was recorded for the root we are actually calling — a
+ * `--api-url` switch from prod to dev must re-discover, because the two issue
+ * different client ids and different `resource` values.
+ *
+ * @returns {Promise<{ok: true, tokenEndpoint: string, resource: string}
+ *   | {ok: false, code: string, message: string}>}
+ */
+async function refreshEndpoints({ oauth, root, fetchImpl }) {
+  if (oauth?.root === root && oauth?.token_endpoint && oauth?.resource) {
+    return { ok: true, tokenEndpoint: oauth.token_endpoint, resource: oauth.resource };
+  }
+  const found = await discover({ root, fetchImpl });
+  if (!found.ok) return found;
+  return { ok: true, tokenEndpoint: found.tokenEndpoint, resource: found.resource };
+}
+
+/**
+ * Perform one refresh, under the lock, persisting the rotated token.
+ *
+ * `staleToken` is the access token that just failed. It exists because expiry
+ * alone cannot decide whether a refresh is still needed: a token the server
+ * rejected with a 401 may have an `expires_at` an hour in the future (revoked
+ * early, clock skew, a config restored from a backup). Without it, the
+ * "somebody else already refreshed" short-circuit hands the caller back the
+ * very token that just 401'd, and the retry fails identically.
+ *
+ * @param {{env: NodeJS.ProcessEnv, root: string, fetchImpl?: typeof fetch, now?: number,
+ *          staleToken?: string|null}} opts
+ * @returns {Promise<{ok: true, token: string, rotated: boolean, oauth: object}
+ *   | {ok: false, code: string, message: string}>}
+ */
+export async function refreshCredentials({ env, root, fetchImpl = fetch, now, staleToken = null }) {
+  return withRefreshLock(
+    async () => {
+      // Re-read INSIDE the lock. While we queued, a sibling hook may have done
+      // the whole refresh already — redeeming our (now-replaced) refresh token
+      // would fail and, worse, would overwrite theirs.
+      const disk = readConfigFile(env);
+      const oauth = disk.oauth && typeof disk.oauth === 'object' ? disk.oauth : null;
+
+      if (!hasOauthCredentials(oauth)) {
+        return { ok: false, code: 'no_oauth_credentials', message: 'anyslate: no OAuth credentials to refresh.' };
+      }
+
+      // Skip only when the on-disk token is BOTH unexpired AND different from
+      // the one we are replacing — i.e. genuinely somebody else's fresh token.
+      const supersededByPeer = staleToken ? oauth.access_token && oauth.access_token !== staleToken : true;
+      if (supersededByPeer && !isExpiring(oauth, REFRESH_SKEW_MS, now)) {
+        return { ok: true, token: oauth.access_token, rotated: false, oauth };
+      }
+      if (!oauth.refresh_token) {
+        return {
+          ok: false,
+          code: 'no_refresh_token',
+          message: `anyslate: the stored OAuth session has no refresh token and its access token has expired. ${RELOGIN_HINT}`,
+        };
+      }
+
+      const endpoints = await refreshEndpoints({ oauth, root, fetchImpl });
+      if (!endpoints.ok) return endpoints;
+
+      const res = await refreshAccessToken({
+        tokenEndpoint: endpoints.tokenEndpoint,
+        refreshToken: oauth.refresh_token,
+        clientId: oauth.client_id,
+        resource: endpoints.resource,
+        fetchImpl,
+        now,
+      });
+      if (!res.ok) {
+        return {
+          ok: false,
+          code: res.code || 'refresh_failed',
+          message: `${res.message} ${RELOGIN_HINT}`,
+        };
+      }
+
+      // Persist BEFORE returning. Rotation means the old refresh token is dead
+      // the instant the server answered; a crash between here and the next
+      // write would lose the only usable credential.
+      const next = {
+        ...oauth,
+        access_token: res.tokens.access_token,
+        // A response that omits refresh_token means "keep the one you have".
+        refresh_token: res.tokens.refresh_token || oauth.refresh_token,
+        expires_at: res.tokens.expires_at,
+        token_endpoint: endpoints.tokenEndpoint,
+        resource: endpoints.resource,
+        root,
+      };
+      try {
+        updateConfigFile((current) => ({ ...current, oauth: { ...(current.oauth ?? {}), ...next } }), env);
+      } catch (e) {
+        return {
+          ok: false,
+          code: 'persist_failed',
+          message: `anyslate: refreshed the OAuth session but could not write the config (${e?.message ?? e}).`,
+        };
+      }
+      return { ok: true, token: next.access_token, rotated: true, oauth: next };
+    },
+    { env },
+  );
+}
+
+/**
+ * The bearer for the next call, refreshing if needed.
+ *
+ * Precedence mirrors loadConfig: ANYSLATE_MCP_TOKEN → OAuth → static
+ * `mcp_token` → nothing. The one deliberate divergence: loadConfig cannot
+ * refresh (it is synchronous), so an EXPIRED OAuth credential falls through
+ * there while here it is refreshed and preferred. If the refresh fails and a
+ * static token also exists, we fall back to it rather than failing the call —
+ * with `warning` set, so the caller can say so.
+ *
+ * @param {{cfg: object, env: NodeJS.ProcessEnv, fetchImpl?: typeof fetch, force?: boolean, now?: number}} opts
+ * @returns {Promise<{ok: true, token: string, mode: 'env'|'oauth'|'static', refreshed: boolean, warning?: string}
+ *   | {ok: false, code: string, message: string, mode: string}>}
+ */
+export async function resolveBearer({ cfg, env, fetchImpl = fetch, force = false, now }) {
+  if (cfg?.sources?.mcpToken === 'env' && cfg.mcpToken) {
+    return { ok: true, token: cfg.mcpToken, mode: 'env', refreshed: false };
+  }
+
+  const oauth = cfg?.oauth ?? null;
+  if (hasOauthCredentials(oauth)) {
+    if (!force && !isExpiring(oauth, REFRESH_SKEW_MS, now)) {
+      return { ok: true, token: oauth.access_token, mode: 'oauth', refreshed: false };
+    }
+    // `force` means "the token we just used was rejected" — name it, so the
+    // lock's peer-refresh check cannot hand the same rejected token back.
+    const refreshed = await refreshCredentials({
+      env,
+      root: cfg.apiUrl,
+      fetchImpl,
+      now,
+      staleToken: force ? (oauth.access_token ?? null) : null,
+    });
+    if (refreshed.ok) {
+      return { ok: true, token: refreshed.token, mode: 'oauth', refreshed: refreshed.rotated };
+    }
+    if (cfg.staticToken) {
+      return {
+        ok: true,
+        token: cfg.staticToken,
+        mode: 'static',
+        refreshed: false,
+        warning: `anyslate: OAuth refresh failed (${refreshed.code}) — falling back to the static token in your config.`,
+      };
+    }
+    return { ...refreshed, mode: 'oauth' };
+  }
+
+  if (cfg?.mcpToken) {
+    return { ok: true, token: cfg.mcpToken, mode: 'static', refreshed: false };
+  }
+
+  return {
+    ok: false,
+    mode: 'none',
+    code: 'no_credentials',
+    message:
+      'no credentials configured. Run `anyslate login` to sign in with your browser, or `anyslate login --token <BEARER>` for CI. Mint a token in the AnySlate desktop app at Avatar (top-right) → API Tokens.',
+  };
+}
+
+/**
+ * `callTool` with the auth lifecycle wrapped around it: proactive refresh, then
+ * at most one refresh-and-retry on a 401.
+ *
+ * The retry is gated on `mode === 'oauth'`: a static token that 401s is revoked
+ * or mistyped, and re-sending it cannot help.
+ *
+ * @param {{cfg: object, env: NodeJS.ProcessEnv, toolName: string, args: object,
+ *          fetchImpl?: typeof fetch, timeoutMs?: number}} opts
+ * @returns {Promise<object>} the callTool result, plus `authMode` / `authWarning`,
+ *   or an auth failure shaped like a callTool failure (`authError: true`).
+ */
+export async function callToolWithAuth({ cfg, env, toolName, args, fetchImpl, timeoutMs }) {
+  const first = await resolveBearer({ cfg, env, fetchImpl });
+  if (!first.ok) {
+    return { ok: false, status: 0, data: first.message, raw: null, authError: true, authMode: first.mode };
+  }
+
+  const invoke = (token) =>
+    callTool({ apiUrl: cfg.apiUrl, token, toolName, args, fetchImpl, timeoutMs });
+
+  let res = await invoke(first.token);
+  res.authMode = first.mode;
+  if (first.warning) res.authWarning = first.warning;
+
+  const retryable = !res.ok && res.status === 401 && first.mode === 'oauth' && !first.refreshed;
+  if (!retryable) return res;
+
+  const second = await resolveBearer({ cfg, env, fetchImpl, force: true });
+  if (!second.ok) {
+    res.authError = true;
+    res.authRefreshFailed = second.message;
+    return res;
+  }
+  const retried = await invoke(second.token);
+  retried.authMode = second.mode;
+  retried.authRetried = true;
+  if (second.warning) retried.authWarning = second.warning;
+  return retried;
+}
+
+/**
+ * The failure line for a result that failed on AUTH rather than on transport.
+ *
+ * `formatCallFailure` renders `server ${status} — ${data}`, which for an auth
+ * failure that never reached the server would print `server 0` — an HTTP status
+ * that did not happen. Returns null when this is an ordinary failure and the
+ * existing formatter should be used instead.
+ *
+ * @param {string} prefix
+ * @param {object} res
+ * @returns {string|null}
+ */
+export function formatAuthFailure(prefix, res) {
+  if (!res?.authError) return null;
+  if (res.authRefreshFailed) {
+    return `${prefix}: server ${res.status} and the OAuth refresh failed — ${res.authRefreshFailed}\n`;
+  }
+  if (res.status === 0 && !res.networkError) {
+    return `${prefix}: ${typeof res.data === 'string' ? res.data : JSON.stringify(res.data)}\n`;
+  }
+  return null;
+}

package/src/commands/checkpoint.mjs

@@ -12,7 +12,8 @@
 // stdout carries results only. Every error goes to stderr.
 
 import { loadConfig, requireToken, apiUrlNormalizationNotice, DISABLED_NOTICE } from '../config.mjs';
-import { callTool, formatCallFailure } from '../mcp-client.mjs';
+import { formatCallFailure } from '../mcp-client.mjs';
+import { callToolWithAuth, formatAuthFailure } from '../auth.mjs';
 import { recordRun } from '../runlog.mjs';
 import { VERSION } from '../version.mjs';
 import { makeIo } from '../io.mjs';
@@ -51,10 +52,11 @@ export async function runCheckpoint(argv, deps = {}) {
   const notice = apiUrlNormalizationNotice(cfg);
   if (notice) err.write(notice);
 
-  const tokenCheck = requireToken(cfg);
-  if (!tokenCheck.ok) {
-    err.write(`anyslate checkpoint: ${tokenCheck.error}\n`);
-    recordRun({ command: 'checkpoint', ok: false, apiUrl: cfg.apiUrl, error: tokenCheck.error, version: VERSION, exitCode: 1 }, env);
+  // Presence only — an expired OAuth token is refreshed by callToolWithAuth.
+  if (cfg.authMode === 'none') {
+    const error = requireToken({ mcpToken: null }).error;
+    err.write(`anyslate checkpoint: ${error}\n`);
+    recordRun({ command: 'checkpoint', ok: false, apiUrl: cfg.apiUrl, error, version: VERSION, exitCode: 1 }, env);
     return 1;
   }
 
@@ -74,15 +76,16 @@ export async function runCheckpoint(argv, deps = {}) {
   if (flags.session) args.session_id_hint = flags.session;
 
   try {
-    const res = await callTool({
-      apiUrl: cfg.apiUrl,
-      token: cfg.mcpToken,
+    const res = await callToolWithAuth({
+      cfg,
+      env,
       toolName: 'activity_submit',
       args,
       fetchImpl: deps.fetchImpl,
     });
+    if (res.authWarning) err.write(`${res.authWarning}\n`);
     if (!res.ok) {
-      const message = formatCallFailure('anyslate checkpoint', res);
+      const message = formatAuthFailure('anyslate checkpoint', res) ?? formatCallFailure('anyslate checkpoint', res);
       err.write(message);
       recordRun(
         {

package/src/commands/doctor.mjs

@@ -26,6 +26,7 @@ import {
   requireToken,
 } from '../config.mjs';
 import { checkUrlShape, hasWriteScope, isValidTokenFormat, probeVerify, tokenPreview } from '../verify.mjs';
+import { hasOauthCredentials, isExpired, minutesUntilExpiry, resolveBearer } from '../auth.mjs';
 import { lastRunPath, readLastRun } from '../runlog.mjs';
 import { callTool } from '../mcp-client.mjs';
 import { VERSION, USER_AGENT } from '../version.mjs';
@@ -128,9 +129,21 @@ export async function runDoctor(argv = [], deps = {}) {
   }
 
   // ---- 2. Token present --------------------------------------------------
+  // "Present" now has three shapes: an env/static token, a live OAuth access
+  // token, or OAuth credentials whose access token has aged out but which carry
+  // a refresh token. The third is NOT a failure — the refresh happens further
+  // down, once the URL and reachability checks have cleared.
+  const oauthPresent = hasOauthCredentials(cfg.oauth);
   const tokenCheck = requireToken(cfg);
-  if (!tokenCheck.ok) {
+  if (!tokenCheck.ok && !oauthPresent) {
     add(FAIL, 'token-present', 'No MCP token configured.', tokenCheck.error);
+  } else if (!tokenCheck.ok) {
+    add(
+      WARN,
+      'token-present',
+      'OAuth access token has expired; a refresh is needed before the next call.',
+      'This is normal — access tokens live one hour. The refresh is exercised by the oauth-refresh check below.',
+    );
   } else {
     add(
       PASS,
@@ -139,6 +152,44 @@ export async function runDoctor(argv = [], deps = {}) {
     );
   }
 
+  // ---- 2a. Auth mode -----------------------------------------------------
+  // Pure config inspection, no network. Which credential the CLI would use is
+  // the first thing anyone debugging "capture stopped" needs to know, and it
+  // must be answerable even when the host is down.
+  if (cfg.sources.mcpToken === 'env' && cfg.mcpToken) {
+    add(PASS, 'auth-mode', 'Static token from ANYSLATE_MCP_TOKEN (env) — no refresh, never expires.');
+    if (oauthPresent) {
+      add(
+        WARN,
+        'auth-override',
+        'ANYSLATE_MCP_TOKEN is overriding a stored OAuth session.',
+        'Unset ANYSLATE_MCP_TOKEN to go back to the browser-issued credential.',
+      );
+    }
+  } else if (oauthPresent) {
+    const mins = minutesUntilExpiry(cfg.oauth);
+    const when =
+      mins == null
+        ? 'expiry unknown (no parseable expires_at)'
+        : mins >= 0
+          ? `expires in ${mins} min (${cfg.oauth.expires_at})`
+          : `expired ${Math.abs(mins)} min ago (${cfg.oauth.expires_at})`;
+    if (!cfg.oauth.refresh_token) {
+      add(
+        WARN,
+        'auth-mode',
+        `OAuth (browser sign-in), ${when}, no refresh token stored.`,
+        'Without a refresh token the session dies at expiry. Run `anyslate login` to get one.',
+      );
+    } else {
+      add(PASS, 'auth-mode', `OAuth (browser sign-in), ${when}, refresh token stored.`);
+    }
+  } else if (cfg.staticToken) {
+    add(PASS, 'auth-mode', `Static MCP token from ${cfg.sources.mcpToken} — no refresh, never expires.`);
+  } else {
+    add(SKIP, 'auth-mode', 'No credentials to classify.');
+  }
+
   // ---- 2b. Handle FORMAT — never gated behind a server round trip ---------
   // This is the exact live failure that produced a 100% invisible capture
   // loss: cli/README.md told users to export `ANYSLATE_HANDLE=h_xxx`, but real
@@ -171,6 +222,8 @@ export async function runDoctor(argv = [], deps = {}) {
         'Mint one in the desktop app at Avatar (top-right) → API Tokens → Create Token.',
       );
     }
+  } else if (oauthPresent) {
+    add(SKIP, 'token-format', 'OAuth access token is past its expiry; the format is checked after it is refreshed.');
   } else {
     add(SKIP, 'token-format', 'No token to check.');
   }
@@ -224,10 +277,49 @@ export async function runDoctor(argv = [], deps = {}) {
     add(SKIP, 'reachability', 'URL shape failed; not probing.');
   }
 
+  // ---- 5b. OAuth refresh -------------------------------------------------
+  // Deliberately AFTER url-shape and reachability. A refresh against an
+  // unreachable host fails for a reason that has nothing to do with the
+  // credential, and reporting that as "refresh is broken" sends the user
+  // hunting for the wrong bug.
+  let bearer = cfg.mcpToken;
+  if (shape.ok && reachable && oauthPresent && cfg.sources.mcpToken !== 'env') {
+    const wasStale = isExpired(cfg.oauth) || flags.refresh;
+    const resolved = await resolveBearer({ cfg, env, fetchImpl, force: flags.refresh });
+    if (resolved.ok) {
+      bearer = resolved.token;
+      if (resolved.refreshed) {
+        add(PASS, 'oauth-refresh', 'Refreshed the access token successfully; the rotated refresh token was persisted.');
+      } else if (wasStale) {
+        add(PASS, 'oauth-refresh', 'Access token was already renewed by another process; nothing to do.');
+      } else {
+        add(
+          PASS,
+          'oauth-refresh',
+          'Refresh token is stored and the access token is still valid — refresh not exercised.',
+          'Run `anyslate doctor --refresh` to force a real refresh round trip (it rotates the refresh token).',
+        );
+      }
+    } else {
+      add(
+        FAIL,
+        'oauth-refresh',
+        `OAuth refresh failed: ${String(resolved.message).replace(/^anyslate: /, '')}`,
+        'Run `anyslate login` to sign in again. Refresh tokens live 30 days and are single-use (rotated on every refresh).',
+      );
+    }
+  } else if (oauthPresent && cfg.sources.mcpToken === 'env') {
+    add(SKIP, 'oauth-refresh', 'ANYSLATE_MCP_TOKEN is in use; the stored OAuth session is not consulted.');
+  } else if (oauthPresent) {
+    add(SKIP, 'oauth-refresh', 'Skipped — the URL and reachability checks must pass before a refresh is meaningful.');
+  } else {
+    add(SKIP, 'oauth-refresh', 'Not an OAuth session.');
+  }
+
   // ---- 6. Token valid ----------------------------------------------------
   let verified = null;
-  if (shape.ok && tokenCheck.ok && reachable) {
-    verified = await probeVerify({ root, token: cfg.mcpToken, fetchImpl });
+  if (shape.ok && reachable && bearer) {
+    verified = await probeVerify({ root, token: bearer, fetchImpl });
     if (verified.ok) {
       add(PASS, 'token-valid', `${verified.message.replace(/^anyslate: /, '')}`);
     } else {
@@ -345,7 +437,7 @@ export async function runDoctor(argv = [], deps = {}) {
     if (verified?.ok) {
       const res = await callTool({
         apiUrl: root,
-        token: cfg.mcpToken,
+        token: bearer,
         toolName: 'activity_submit',
         args: {
           source: 'api',
@@ -513,9 +605,10 @@ function indent(block) {
 
 /** @param {string[]} argv */
 function parseFlags(argv) {
-  const out = { deep: false };
+  const out = { deep: false, refresh: false };
   for (const a of argv) {
     if (a === '--deep') out.deep = true;
+    else if (a === '--refresh') out.refresh = true;
   }
   return out;
 }

package/src/commands/hook.mjs

@@ -19,7 +19,8 @@
 // nothing and exited 0.
 
 import { loadConfig, requireToken, apiUrlNormalizationNotice, DISABLED_NOTICE } from '../config.mjs';
-import { callTool, formatCallFailure } from '../mcp-client.mjs';
+import { formatCallFailure } from '../mcp-client.mjs';
+import { callToolWithAuth, formatAuthFailure } from '../auth.mjs';
 import { buildHookSubmission, parseHookEvent } from '../hooks.mjs';
 import { readStdin, stdinTimeoutFromEnv } from '../stdin.mjs';
 import { recordRun, shouldEscalate, escalationPayload } from '../runlog.mjs';
@@ -65,9 +66,12 @@ export async function runHook(argv, deps = {}) {
   const notice = apiUrlNormalizationNotice(cfg);
   if (notice) err.write(notice);
 
-  const tokenCheck = requireToken(cfg);
-  if (!tokenCheck.ok) {
-    return fail(`${prefix}: ${tokenCheck.error}\n`);
+  // Credential PRESENCE only. An expired OAuth access token is not "missing" —
+  // callToolWithAuth refreshes it below — so gating on `cfg.mcpToken` here (as
+  // this did before OAuth) would turn every hour-old session into a silent
+  // no-capture with a misleading "no token configured" in the run log.
+  if (cfg.authMode === 'none') {
+    return fail(`${prefix}: ${requireToken({ mcpToken: null }).error}\n`);
   }
 
   let stdinRaw = '';
@@ -95,15 +99,18 @@ export async function runHook(argv, deps = {}) {
   if (submission.sessionIdHint) args.session_id_hint = submission.sessionIdHint;
 
   try {
-    const res = await callTool({
-      apiUrl: cfg.apiUrl,
-      token: cfg.mcpToken,
+    // Never opens a browser: this path runs unattended inside Claude Code.
+    // A refresh failure surfaces as an ordinary failure and still exits 0.
+    const res = await callToolWithAuth({
+      cfg,
+      env,
       toolName: 'activity_submit',
       args,
       fetchImpl: deps.fetchImpl,
     });
+    if (res.authWarning) err.write(`${res.authWarning}\n`);
     if (!res.ok) {
-      return fail(formatCallFailure(prefix, res), {
+      return fail(formatAuthFailure(prefix, res) ?? formatCallFailure(prefix, res), {
         status: res.status,
         isError: !!res.isError,
         networkError: !!res.networkError,