@brainbase-labs/cli 0.16.1 → 0.16.2

package/README.md

@@ -22,6 +22,12 @@ brainbase template onboard <creator/slug>   # install or refresh a template
 
 Run `brainbase help` to see every command.
 
+## Development
+
+Use Bun 1.3.10 when building this repository. The generated
+`dist/index.js` is committed and byte-checked in CI, and Bun patch releases
+can produce different bundle output.
+
 ## Agent runtime configuration
 
 `brainbase.agent.yaml` can declare the provider and default model used by

package/dist/index.js

@@ -16651,7 +16651,7 @@ Learn more about this warning here: https://reactjs.org/link/legacy-context`, so
 
 ` + ("" + errorBoundaryMessage);
             console["error"](combinedMessage);
-          }
+          } else {}
         } catch (e2) {
           setTimeout(function() {
             throw e2;
@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.16.1",
+  version: "0.16.2",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -36407,6 +36407,17 @@ function writeJson(p, data) {
   fs2.writeFileSync(p, JSON.stringify(data, null, 2) + `
 `);
 }
+function writeJsonAtomic(p, data) {
+  ensureDir(path2.dirname(p));
+  const temporaryPath = `${p}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+  try {
+    fs2.writeFileSync(temporaryPath, JSON.stringify(data, null, 2) + `
+`, { flag: "wx", mode: 384 });
+    fs2.renameSync(temporaryPath, p);
+  } finally {
+    fs2.rmSync(temporaryPath, { force: true });
+  }
+}
 function listDirs(dir) {
   if (!exists(dir))
     return [];
@@ -40874,7 +40885,14 @@ import fs7 from "node:fs";
 // src/core/auth.ts
 import path8 from "node:path";
 import fs6 from "node:fs";
+import { randomUUID } from "node:crypto";
 var AUTH_FILE = path8.join(BRAINBASE_HOME, "auth.json");
+var AUTH_LOCK_FILE = `${AUTH_FILE}.lock`;
+var AUTH_LOCK_TIMEOUT_MS = 5000;
+var REFRESH_LOCK_FILE = `${AUTH_FILE}.refresh.lock`;
+var REFRESH_LOCK_TIMEOUT_MS = 1e4;
+var REFRESH_REQUEST_TIMEOUT_MS = 5000;
+var lockWaiter = new Int32Array(new SharedArrayBuffer(4));
 var AuthSessionSchema = exports_external.object({
   schemaVersion: exports_external.literal(1),
   access_token: exports_external.string(),
@@ -40897,22 +40915,99 @@ function readAuth() {
     return null;
   }
 }
-function writeAuth(s) {
+function acquireLock(lockFile, timeoutMs) {
   ensureDir(BRAINBASE_HOME);
-  writeJson(AUTH_FILE, s);
+  const deadline = Date.now() + timeoutMs;
+  const lockId = randomUUID();
+  const owner = `${process.pid}:${lockId}`;
+  const candidate = `${lockFile}.${lockId}.tmp`;
+  while (true) {
+    try {
+      fs6.writeFileSync(candidate, owner, {
+        encoding: "utf8",
+        mode: 384,
+        flag: "wx"
+      });
+      fs6.linkSync(candidate, lockFile);
+      fs6.rmSync(candidate, { force: true });
+      return () => {
+        try {
+          if (fs6.readFileSync(lockFile, "utf8") === owner) {
+            fs6.rmSync(lockFile, { force: true });
+          }
+        } catch {}
+      };
+    } catch (error) {
+      fs6.rmSync(candidate, { force: true });
+      if (error.code !== "EEXIST")
+        throw error;
+      if (Date.now() >= deadline)
+        return null;
+      Atomics.wait(lockWaiter, 0, 0, 10);
+    }
+  }
+}
+function acquireAuthLock() {
+  const release = acquireLock(AUTH_LOCK_FILE, AUTH_LOCK_TIMEOUT_MS);
+  if (!release) {
+    throw new Error(`Timed out waiting to update CLI authentication; if no other brainbase process is running, remove ${AUTH_LOCK_FILE}`);
+  }
+  return release;
+}
+function withAuthLock(operation) {
+  const release = acquireAuthLock();
+  try {
+    return operation();
+  } finally {
+    release();
+  }
+}
+function writeAuthUnlocked(s) {
+  writeJsonAtomic(AUTH_FILE, s);
   try {
     fs6.chmodSync(AUTH_FILE, 384);
   } catch {}
 }
+function writeAuth(s) {
+  withAuthLock(() => writeAuthUnlocked(s));
+}
 function clearAuth() {
-  if (exists(AUTH_FILE))
-    fs6.rmSync(AUTH_FILE);
+  withAuthLock(() => {
+    if (exists(AUTH_FILE))
+      fs6.rmSync(AUTH_FILE);
+  });
 }
 function isExpired(session) {
   if (!session.expires_at)
     return false;
   const now = Math.floor(Date.now() / 1000);
-  return session.expires_at <= now - 5;
+  return session.expires_at <= now + 5;
+}
+function isNearExpiry(session, marginSeconds = 60) {
+  if (!session.expires_at)
+    return false;
+  const now = Math.floor(Date.now() / 1000);
+  return session.expires_at <= now + marginSeconds;
+}
+function isAuthValid(session) {
+  return !!session && !isExpired(session);
+}
+function isSameAuthIdentity(a3, b3) {
+  return a3.user_id === b3.user_id && (a3.server ?? null) === (b3.server ?? null) && (a3.control_plane_url ?? null) === (b3.control_plane_url ?? null) && (a3.supabase_url ?? null) === (b3.supabase_url ?? null);
+}
+
+class AuthSessionChangedError extends Error {
+  constructor() {
+    super("CLI authentication changed while this command was running; retry it");
+    this.name = "AuthSessionChangedError";
+  }
+}
+
+class AuthRefreshLockTimeoutError extends Error {
+  constructor() {
+    super(`Timed out waiting to refresh CLI authentication; retry, or if no other brainbase process is running, remove ${REFRESH_LOCK_FILE}`);
+    this.name = "AuthRefreshLockTimeoutError";
+  }
 }
 function authStatus() {
   const s = readAuth();
@@ -40922,52 +41017,157 @@ function authStatus() {
     return { ok: false, session: s, reason: "session expired" };
   return { ok: true, session: s };
 }
-async function tryRefreshSession() {
-  const session = readAuth();
-  if (!session)
-    return null;
+var refreshInFlight = null;
+function validatedRefreshResult(expectedSession, result) {
+  const current = readAuth();
+  if (!current || !isSameAuthIdentity(current, expectedSession) || result && !isSameAuthIdentity(result, expectedSession)) {
+    throw new AuthSessionChangedError;
+  }
+  if (result)
+    return result;
+  return isAuthValid(current) ? current : null;
+}
+function adoptRefreshedLineage(session) {
+  const current = readAuth();
+  if (!current || !isSameAuthIdentity(current, session)) {
+    throw new AuthSessionChangedError;
+  }
+  const sameRefreshLineage = current.access_token === session.access_token && current.refresh_token === session.refresh_token;
+  if (sameRefreshLineage)
+    return;
+  return isAuthValid(current) ? current : null;
+}
+async function refreshSession(session) {
   if (!session.refresh_token)
     return null;
   if (!session.supabase_url || !session.supabase_anon_key)
     return null;
-  const url = `${session.supabase_url.replace(/\/+$/, "")}/auth/v1/token?grant_type=refresh_token`;
-  let res;
+  const releaseRefreshLock = acquireLock(REFRESH_LOCK_FILE, REFRESH_LOCK_TIMEOUT_MS);
+  if (!releaseRefreshLock) {
+    const adopted = adoptRefreshedLineage(session);
+    if (adopted !== undefined)
+      return adopted;
+    if (isAuthValid(session))
+      return session;
+    throw new AuthRefreshLockTimeoutError;
+  }
   try {
-    res = await fetch(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        apikey: session.supabase_anon_key,
-        Authorization: `Bearer ${session.supabase_anon_key}`
-      },
-      body: JSON.stringify({ refresh_token: session.refresh_token })
+    const adopted = adoptRefreshedLineage(session);
+    if (adopted !== undefined)
+      return adopted;
+    const url = `${session.supabase_url.replace(/\/+$/, "")}/auth/v1/token?grant_type=refresh_token`;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "POST",
+        signal: AbortSignal.timeout(REFRESH_REQUEST_TIMEOUT_MS),
+        headers: {
+          "Content-Type": "application/json",
+          apikey: session.supabase_anon_key,
+          Authorization: `Bearer ${session.supabase_anon_key}`
+        },
+        body: JSON.stringify({ refresh_token: session.refresh_token })
+      });
+    } catch {
+      return null;
+    }
+    if (!res.ok)
+      return null;
+    let data;
+    try {
+      data = await res.json();
+    } catch {
+      return null;
+    }
+    if (!data.access_token)
+      return null;
+    const now = Math.floor(Date.now() / 1000);
+    const expires_at = data.expires_at ?? (data.expires_in ? now + data.expires_in : undefined);
+    const updated = {
+      ...session,
+      access_token: data.access_token,
+      refresh_token: data.refresh_token ?? session.refresh_token,
+      expires_at,
+      user_id: data.user?.id ?? session.user_id,
+      email: data.user?.email ?? session.email,
+      authedAt: new Date().toISOString()
+    };
+    if (!isSameAuthIdentity(updated, session)) {
+      throw new AuthSessionChangedError;
+    }
+    return withAuthLock(() => {
+      const adopted2 = adoptRefreshedLineage(session);
+      if (adopted2 !== undefined)
+        return adopted2;
+      writeAuthUnlocked(updated);
+      return updated;
     });
-  } catch {
-    return null;
+  } finally {
+    releaseRefreshLock();
   }
-  if (!res.ok)
+}
+async function tryRefreshSession(expectedSession = readAuth()) {
+  if (!expectedSession)
     return null;
-  let data;
+  if (refreshInFlight) {
+    if (!isSameAuthIdentity(refreshInFlight.session, expectedSession)) {
+      throw new AuthSessionChangedError;
+    }
+    const result = await refreshInFlight.promise;
+    return validatedRefreshResult(expectedSession, result);
+  }
+  const current = readAuth();
+  if (!current || !isSameAuthIdentity(current, expectedSession)) {
+    throw new AuthSessionChangedError;
+  }
+  const refresh = refreshSession(current);
+  refreshInFlight = { session: current, promise: refresh };
   try {
-    data = await res.json();
-  } catch {
-    return null;
+    const result = await refresh;
+    return validatedRefreshResult(expectedSession, result);
+  } finally {
+    if (refreshInFlight?.promise === refresh)
+      refreshInFlight = null;
   }
-  if (!data.access_token)
+}
+async function refreshSessionAfterUnauthorized(rejectedSession) {
+  const current = readAuth();
+  if (!current || !isSameAuthIdentity(current, rejectedSession)) {
+    throw new AuthSessionChangedError;
+  }
+  if (current.access_token !== rejectedSession.access_token && isAuthValid(current)) {
+    return current;
+  }
+  const refreshed = await tryRefreshSession(rejectedSession);
+  if (refreshed) {
+    if (!isSameAuthIdentity(refreshed, rejectedSession)) {
+      throw new AuthSessionChangedError;
+    }
+    return refreshed;
+  }
+  const latest = readAuth();
+  if (!latest || !isSameAuthIdentity(latest, rejectedSession)) {
+    throw new AuthSessionChangedError;
+  }
+  if (latest.access_token !== rejectedSession.access_token && isAuthValid(latest)) {
+    return latest;
+  }
+  return null;
+}
+async function ensureFreshSession() {
+  const s = readAuth();
+  if (!s)
     return null;
-  const now = Math.floor(Date.now() / 1000);
-  const expires_at = data.expires_at ?? (data.expires_in ? now + data.expires_in : undefined);
-  const updated = {
-    ...session,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token ?? session.refresh_token,
-    expires_at,
-    user_id: data.user?.id ?? session.user_id,
-    email: data.user?.email ?? session.email,
-    authedAt: new Date().toISOString()
-  };
-  writeAuth(updated);
-  return updated;
+  if (!isExpired(s) && !isNearExpiry(s))
+    return s;
+  const refreshed = await tryRefreshSession(s);
+  if (refreshed)
+    return refreshed;
+  const current = readAuth();
+  if (current && isSameAuthIdentity(current, s) && isAuthValid(current)) {
+    return current;
+  }
+  return null;
 }
 
 // src/core/skill-marker-write.ts
@@ -53393,38 +53593,58 @@ function legacyScheduleError() {
 function legacyAgentConfigError() {
   return new ApiError("Declarative machine/model config requires the MAS control plane. Set BRAINBASE_CONTROL_PLANE_URL or unset the legacy BRAINBASE_API_URL override.", 400);
 }
-function requireSession() {
-  const status = authStatus();
-  if (!status.ok || !status.session) {
-    throw new ApiError(status.reason ?? "not logged in", 401);
-  }
-  return status.session;
-}
-function resolveCredential() {
+async function resolveCredential() {
   const envToken = process.env.BRAINBASE_TOKEN;
   if (envToken && envToken.trim()) {
-    return { bearer: envToken.trim(), session: null };
+    return {
+      bearer: envToken.trim(),
+      session: null,
+      source: "env_pat"
+    };
   }
-  const session = requireSession();
-  return { bearer: session.access_token, session };
+  const session = await ensureFreshSession();
+  if (session) {
+    return {
+      bearer: session.access_token,
+      session,
+      source: "session"
+    };
+  }
+  const status = authStatus();
+  throw new ApiError(status.ok ? "CLI authentication changed while this command was starting; retry it" : status.reason ?? "not logged in", 401);
 }
-async function request(pathname, init = {}) {
-  const { bearer, session } = resolveCredential();
-  const url = `${apiBase(session)}${pathname}`;
-  const headers = {
-    Authorization: `Bearer ${bearer}`,
-    Accept: "application/json",
-    ...init.headers
-  };
-  if (init.body && !headers["Content-Type"]) {
-    headers["Content-Type"] = "application/json";
+async function sendRequest(url, init, bearer) {
+  const headers = new Headers(init.headers);
+  if (!headers.has("Authorization")) {
+    headers.set("Authorization", `Bearer ${bearer}`);
+  }
+  if (!headers.has("Accept"))
+    headers.set("Accept", "application/json");
+  if (init.body && !headers.has("Content-Type")) {
+    headers.set("Content-Type", "application/json");
   }
-  let res;
   try {
-    res = await fetch(url, { ...init, headers });
+    return await fetch(url, { ...init, headers });
   } catch (err) {
     throw new ApiError(`Network error: ${err.message}`);
   }
+}
+async function sendWithAuthRetry(session, send) {
+  const res = await send();
+  if (res.status !== 401 || !session)
+    return res;
+  const refreshed = await refreshSessionAfterUnauthorized(session);
+  if (!refreshed || refreshed.access_token === session.access_token) {
+    return res;
+  }
+  if (res.body)
+    res.body.cancel().catch(() => {});
+  return await send(refreshed);
+}
+async function request(pathname, init = {}) {
+  const credential = await resolveCredential();
+  const retrySession = credential.source === "session" && !new Headers(init.headers).has("Authorization") ? credential.session : null;
+  const res = await sendWithAuthRetry(retrySession, (refreshed) => sendRequest(`${apiBase(refreshed ?? credential.session)}${pathname}`, init, refreshed?.access_token ?? credential.bearer));
   const text2 = await res.text();
   let body = text2;
   try {
@@ -53541,6 +53761,9 @@ function proxyBaseUrl(session) {
   const envOverride = process.env.BRAINBASE_PROXY_URL || process.env.BRAINBASE_API_URL;
   if (envOverride)
     return envOverride.replace(/\/+$/, "");
+  if (process.env.BRAINBASE_TOKEN?.trim()) {
+    return DEFAULT_PROXY_BASE.replace(/\/+$/, "");
+  }
   if (session?.server)
     return session.server.replace(/\/+$/, "");
   return DEFAULT_PROXY_BASE.replace(/\/+$/, "");
@@ -53618,61 +53841,89 @@ function registryHost() {
   const env3 = process.env.BRAINBASE_REGISTRY_URL || process.env.BRAINBASE_API_URL;
   if (env3)
     return env3.replace(/\/+$/, "");
+  if (process.env.BRAINBASE_TOKEN?.trim())
+    return DEFAULT_BASE;
   const s = readAuth();
   if (s?.server)
     return s.server.replace(/\/+$/, "");
   return DEFAULT_BASE.replace(/\/+$/, "");
 }
-function authHeaders() {
-  const envToken = process.env.BRAINBASE_TOKEN;
-  if (envToken) {
-    return {
-      headers: {
-        Authorization: `Bearer ${envToken}`,
-        "X-Auth-Source": "pat"
-      },
-      session: null
-    };
+function patAuth(token) {
+  return {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "X-Auth-Source": "pat"
+    },
+    session: null
+  };
+}
+function jwtAuth(session) {
+  return {
+    headers: {
+      Authorization: `Bearer ${session.access_token}`,
+      "X-Auth-Source": "jwt"
+    },
+    session
+  };
+}
+async function resolveAuth() {
+  const envToken = process.env.BRAINBASE_TOKEN?.trim();
+  if (envToken)
+    return patAuth(envToken);
+  let freshSession;
+  try {
+    freshSession = await ensureFreshSession();
+  } catch (error) {
+    if (!(error instanceof AuthRefreshLockTimeoutError))
+      throw error;
+    const pat2 = readToken();
+    if (pat2)
+      return patAuth(pat2.token);
+    throw error;
   }
+  if (freshSession)
+    return jwtAuth(freshSession);
   const status = authStatus();
-  if (status.ok && status.session) {
-    return {
-      headers: {
-        Authorization: `Bearer ${status.session.access_token}`,
-        "X-Auth-Source": "jwt"
-      },
-      session: status.session
-    };
-  }
   const pat = readToken();
-  if (pat) {
-    return {
-      headers: {
-        Authorization: `Bearer ${pat.token}`,
-        "X-Auth-Source": "pat"
-      },
-      session: null
-    };
-  }
-  throw new ApiError(status.reason ?? "not logged in", 401);
+  if (pat)
+    return patAuth(pat.token);
+  throw new ApiError(status.ok ? "CLI authentication changed while this command was starting; retry it" : status.reason ?? "not logged in", 401);
 }
-async function jsonRequest(pathname, init = {}) {
-  const { headers, session } = authHeaders();
+function mergeHeaders(auth, overrides) {
+  const headers = new Headers(auth);
+  new Headers(overrides).forEach((value, key2) => headers.set(key2, value));
+  return headers;
+}
+async function sendRequest2(pathname, init, session) {
   const url = `${baseUrl(session)}${pathname}`;
-  const merged = {
-    ...headers,
-    Accept: "application/json",
-    ...init.headers ?? {}
-  };
-  if (init.body && !merged["Content-Type"] && typeof init.body === "string") {
-    merged["Content-Type"] = "application/json";
-  }
-  let res;
   try {
-    res = await fetch(url, { ...init, headers: merged });
+    return await fetch(url, init);
   } catch (err) {
     throw new ApiError(`Network error: ${err.message}`);
   }
+}
+async function sendAuthenticatedRequest(pathname, init, auth) {
+  return await sendRequest2(pathname, {
+    ...init,
+    headers: mergeHeaders(auth.headers, init.headers)
+  }, auth.session);
+}
+async function registryFetch(pathname, init = {}) {
+  if (new Headers(init.headers).has("Authorization")) {
+    return await sendRequest2(pathname, init, readAuth());
+  }
+  const auth = await resolveAuth();
+  const retrySession = auth.headers["X-Auth-Source"] === "jwt" ? auth.session : null;
+  return await sendWithAuthRetry(retrySession, (refreshed) => sendAuthenticatedRequest(pathname, init, refreshed ? jwtAuth(refreshed) : auth));
+}
+async function jsonRequest(pathname, init = {}) {
+  const headers = new Headers(init.headers);
+  if (!headers.has("Accept"))
+    headers.set("Accept", "application/json");
+  if (init.body && !headers.has("Content-Type") && typeof init.body === "string") {
+    headers.set("Content-Type", "application/json");
+  }
+  const res = await registryFetch(pathname, { ...init, headers });
   const text2 = await res.text();
   let body = text2;
   try {
@@ -53730,9 +53981,8 @@ var registryApi = {
     return jsonRequest(`/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}`);
   },
   async getFile(creator, slug, version, relPath) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/files/${relPath}`;
-    const res = await fetch(url, { headers });
+    const pathname = `/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/files/${relPath}`;
+    const res = await registryFetch(pathname);
     if (!res.ok) {
       throw new ApiError(`HTTP ${res.status} reading file ${relPath}`, res.status);
     }
@@ -53740,9 +53990,8 @@ var registryApi = {
     return Buffer.from(ab);
   },
   async downloadTarball(creator, slug, version, destPath) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/tarball`;
-    const res = await fetch(url, { headers });
+    const pathname = `/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/tarball`;
+    const res = await registryFetch(pathname);
     if (!res.ok || !res.body) {
       throw new ApiError(`HTTP ${res.status} downloading tarball`, res.status);
     }
@@ -53768,8 +54017,7 @@ var registryApi = {
     });
   },
   async publishVersion(creator, slug, input) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions`;
+    const pathname = `/v1/registry/templates/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions`;
     const form = new FormData;
     form.set("version", input.version);
     form.set("source_harness", input.sourceHarness);
@@ -53777,16 +54025,11 @@ var registryApi = {
     form.set("manifest", new Blob([input.manifestJson], { type: "application/json" }), "manifest.json");
     const bytes = fs45.readFileSync(input.bundlePath);
     form.set("bundle", new Blob([bytes], { type: "application/gzip" }), "bundle.tgz");
-    let res;
-    try {
-      res = await fetch(url, {
-        method: "POST",
-        headers: { ...headers, Accept: "application/json" },
-        body: form
-      });
-    } catch (err) {
-      throw new ApiError(`Network error: ${err.message}`);
-    }
+    const res = await registryFetch(pathname, {
+      method: "POST",
+      headers: { Accept: "application/json" },
+      body: form
+    });
     const text2 = await res.text();
     let body = text2;
     try {
@@ -58385,9 +58628,8 @@ var skillsApi = {
     return jsonRequest(`/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}`);
   },
   async getFile(creator, slug, version, relPath) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/files/${relPath}`;
-    const res = await fetch(url, { headers });
+    const pathname = `/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/files/${relPath}`;
+    const res = await registryFetch(pathname);
     if (!res.ok) {
       throw new ApiError(`HTTP ${res.status} reading file ${relPath}`, res.status);
     }
@@ -58395,9 +58637,8 @@ var skillsApi = {
     return Buffer.from(ab);
   },
   async downloadTarball(creator, slug, version, destPath) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/tarball`;
-    const res = await fetch(url, { headers });
+    const pathname = `/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/tarball`;
+    const res = await registryFetch(pathname);
     if (!res.ok || !res.body) {
       throw new ApiError(`HTTP ${res.status} downloading tarball`, res.status);
     }
@@ -58423,8 +58664,7 @@ var skillsApi = {
     });
   },
   async publishVersion(creator, slug, input) {
-    const { headers, session } = authHeaders();
-    const url = `${baseUrl(session)}/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions`;
+    const pathname = `/v1/skill-registry/skills/${encodeURIComponent(creator)}/${encodeURIComponent(slug)}/versions`;
     const form = new FormData;
     form.set("version", input.version);
     form.set("source_harness", input.sourceHarness);
@@ -58432,16 +58672,11 @@ var skillsApi = {
     form.set("manifest", new Blob([input.manifestJson], { type: "application/json" }), "manifest.json");
     const bytes = fs52.readFileSync(input.bundlePath);
     form.set("bundle", new Blob([bytes], { type: "application/gzip" }), "bundle.tgz");
-    let res;
-    try {
-      res = await fetch(url, {
-        method: "POST",
-        headers: { ...headers, Accept: "application/json" },
-        body: form
-      });
-    } catch (err) {
-      throw new ApiError(`Network error: ${err.message}`);
-    }
+    const res = await registryFetch(pathname, {
+      method: "POST",
+      headers: { Accept: "application/json" },
+      body: form
+    });
     const text2 = await res.text();
     let body = text2;
     try {
@@ -75811,6 +76046,12 @@ var PROTECTED = new Set([
   "status",
   "token"
 ]);
+var STORED_PAT_COMMANDS = new Set([
+  "template",
+  "skill",
+  "publish",
+  "token"
+]);
 function help() {
   const out = [];
   out.push("");
@@ -75953,13 +76194,23 @@ async function requireAuth(cmd) {
     return;
   let status = authStatus();
   if (!status.ok && status.session?.refresh_token) {
-    const refreshed = await tryRefreshSession();
+    let refreshed;
+    try {
+      refreshed = await tryRefreshSession(status.session);
+    } catch (error2) {
+      if (error2 instanceof AuthRefreshLockTimeoutError && STORED_PAT_COMMANDS.has(cmd) && readToken()) {
+        return;
+      }
+      throw error2;
+    }
     if (refreshed) {
       status = { ok: true, session: refreshed };
     }
   }
   if (status.ok)
     return;
+  if (STORED_PAT_COMMANDS.has(cmd) && readToken())
+    return;
   console.error("");
   console.error(`  ${brandTint("◆")}  ${import_picocolors43.default.bold("brainbase")}`);
   console.error("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainbase-labs/cli",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "description": "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   "type": "module",
   "bin": {