@dosu/cli 0.16.0 → 0.16.2

package/bin/dosu.js

@@ -2082,6 +2082,260 @@ var init_esm = __esm(() => {
   } = import__.default);
 });
 
+// src/config/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+function getConfigDir() {
+  const dirName = process.env.DOSU_DEV === "true" ? "dosu-cli-dev" : "dosu-cli";
+  const xdgConfig = process.env.XDG_CONFIG_HOME;
+  if (xdgConfig)
+    return join(xdgConfig, dirName);
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return join(home, ".config", dirName);
+}
+function getConfigPath() {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  return join(dir, "config.json");
+}
+function loadConfig() {
+  const path = getConfigPath();
+  if (!existsSync(path)) {
+    return emptyConfig();
+  }
+  try {
+    const data = readFileSync(path, "utf-8");
+    return JSON.parse(data);
+  } catch {
+    return emptyConfig();
+  }
+}
+function saveConfig(cfg) {
+  const path = getConfigPath();
+  const dir = getConfigDir();
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  }
+  writeFileSync(path, JSON.stringify(cfg, null, 2), { mode: 384 });
+}
+function isAuthenticated(cfg) {
+  return cfg.access_token !== "";
+}
+function isTokenExpired(cfg) {
+  if (cfg.expires_at === 0)
+    return false;
+  return Math.floor(Date.now() / 1000) > cfg.expires_at - 300;
+}
+function emptyConfig() {
+  return {
+    access_token: "",
+    refresh_token: "",
+    expires_at: 0
+  };
+}
+var MODE_OSS = "oss";
+var init_config = () => {};
+
+// src/config/constants.ts
+function getWebAppURL() {
+  return process.env.DOSU_WEB_APP_URL_OVERRIDE ?? "https://app.dosu.dev" ?? "";
+}
+function getBackendURL() {
+  return process.env.DOSU_BACKEND_URL_OVERRIDE ?? "https://api.dosu.dev" ?? "";
+}
+function getSupabaseURL() {
+  return process.env.SUPABASE_URL_OVERRIDE ?? "https://wldmetsoicvieidlsqrb.supabase.co" ?? "";
+}
+function getSupabaseAnonKey() {
+  return process.env.SUPABASE_ANON_KEY_OVERRIDE ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6IndsbG1ldHNvaWN2aWVpZGxzcXJiIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MzQ0NjA1NjUsImV4cCI6MjA1MDAzNjU2NX0.15LIxqSMVRnxsvLrk0GPjL1aSYPfOeaeFMdJXqgc5Xs" ?? "";
+}
+
+// src/client/client.ts
+var exports_client = {};
+__export(exports_client, {
+  SessionExpiredError: () => SessionExpiredError,
+  Client: () => Client
+});
+
+class Client {
+  baseURL;
+  config;
+  constructor(cfg) {
+    this.baseURL = getBackendURL();
+    this.config = cfg;
+  }
+  async doRequest(method, path, body) {
+    if (!isAuthenticated(this.config)) {
+      throw new Error("not authenticated - please run setup first");
+    }
+    if (isTokenExpired(this.config)) {
+      await this.refreshToken();
+    }
+    let resp = await this.doRequestOnce(method, path, body);
+    if (resp.status === 401 || resp.status === 403) {
+      try {
+        await this.refreshToken();
+      } catch {
+        throw new SessionExpiredError;
+      }
+      resp = await this.doRequestOnce(method, path, body);
+    }
+    return resp;
+  }
+  async doRequestRaw(method, path) {
+    return this.doRequestOnce(method, path);
+  }
+  async doRequestOnce(method, path, body) {
+    const url = this.baseURL + path;
+    const headers = {
+      "Content-Type": "application/json",
+      "Supabase-Access-Token": this.config.access_token
+    };
+    const options = { method, headers };
+    if (body !== undefined) {
+      options.body = JSON.stringify(body);
+    }
+    const controller = new AbortController;
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    options.signal = controller.signal;
+    try {
+      return await fetch(url, options);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  async get(path) {
+    return this.doRequest("GET", path);
+  }
+  async post(path, body) {
+    return this.doRequest("POST", path, body);
+  }
+  async put(path, body) {
+    return this.doRequest("PUT", path, body);
+  }
+  async delete(path) {
+    return this.doRequest("DELETE", path);
+  }
+  async getWithApiKey(path) {
+    return this.apiKeyRequest("GET", path);
+  }
+  async postWithApiKey(path, body) {
+    return this.apiKeyRequest("POST", path, body);
+  }
+  async apiKeyRequest(method, path, body) {
+    if (!this.config.api_key) {
+      throw new Error("no API key available");
+    }
+    const url = this.baseURL + path;
+    const headers = {
+      "Content-Type": "application/json",
+      "X-Dosu-API-Key": this.config.api_key
+    };
+    const options = { method, headers };
+    if (body !== undefined) {
+      options.body = JSON.stringify(body);
+    }
+    const controller = new AbortController;
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    options.signal = controller.signal;
+    try {
+      return await fetch(url, options);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  async refreshToken() {
+    if (!this.config.refresh_token) {
+      throw new Error("no refresh token available");
+    }
+    const supabaseURL = getSupabaseURL();
+    const endpoint = `${supabaseURL}/auth/v1/token?grant_type=refresh_token`;
+    const resp = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        apikey: getSupabaseAnonKey()
+      },
+      body: JSON.stringify({ refresh_token: this.config.refresh_token })
+    });
+    if (resp.status !== 200) {
+      throw new Error(`refresh failed with status ${resp.status}`);
+    }
+    const data = await resp.json();
+    this.config.access_token = data.access_token;
+    this.config.refresh_token = data.refresh_token;
+    this.config.expires_at = Math.floor(Date.now() / 1000) + data.expires_in;
+    saveConfig(this.config);
+  }
+  async getDeployments() {
+    const resp = await this.get("/v1/mcp/deployments");
+    if (resp.status !== 200) {
+      let detail = await readErrorBody(resp);
+      if (!detail || detail === "Internal Server Error") {
+        detail = "check backend logs for details";
+      }
+      throw new Error(`failed to fetch deployments (status ${resp.status}): ${detail}`);
+    }
+    return resp.json();
+  }
+  async getOrgs() {
+    const resp = await this.get("/v1/mcp/orgs");
+    if (resp.status !== 200) {
+      const detail = await readErrorBody(resp);
+      throw new Error(`failed to fetch orgs (status ${resp.status}): ${detail}`);
+    }
+    return resp.json();
+  }
+  async validateAPIKey(apiKey, deploymentID) {
+    try {
+      const endpoint = `${this.baseURL}/v1/mcp/deployments/${encodeURIComponent(deploymentID)}`;
+      const controller = new AbortController;
+      const timeout = setTimeout(() => controller.abort(), 5000);
+      try {
+        const resp = await fetch(endpoint, {
+          method: "GET",
+          headers: { "X-Dosu-API-Key": apiKey },
+          signal: controller.signal
+        });
+        return resp.status !== 401 && resp.status !== 403;
+      } finally {
+        clearTimeout(timeout);
+      }
+    } catch {
+      return true;
+    }
+  }
+  async createAPIKey(deploymentID, name) {
+    const path = `/v1/mcp/deployments/${deploymentID}/api-keys`;
+    const resp = await this.post(path, { name });
+    if (resp.status !== 200 && resp.status !== 201) {
+      const detail = await readErrorBody(resp);
+      throw new Error(`failed to create API key (status ${resp.status}): ${detail}`);
+    }
+    return resp.json();
+  }
+}
+async function readErrorBody(resp) {
+  try {
+    const text = await resp.text();
+    return text.slice(0, 1024);
+  } catch {
+    return "";
+  }
+}
+var SessionExpiredError;
+var init_client = __esm(() => {
+  init_config();
+  SessionExpiredError = class SessionExpiredError extends Error {
+    constructor() {
+      super("session expired");
+      this.name = "SessionExpiredError";
+    }
+  };
+});
+
 // node_modules/picocolors/picocolors.js
 var require_picocolors = __commonJS((exports, module) => {
   var p = process || {};
@@ -4267,81 +4521,11 @@ var init_dist4 = __esm(() => {
   allowErrorProps = SuperJSON.allowErrorProps;
 });
 
-// src/config/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-function getConfigDir() {
-  const dirName = process.env.DOSU_DEV === "true" ? "dosu-cli-dev" : "dosu-cli";
-  const xdgConfig = process.env.XDG_CONFIG_HOME;
-  if (xdgConfig)
-    return join(xdgConfig, dirName);
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return join(home, ".config", dirName);
-}
-function getConfigPath() {
-  const dir = getConfigDir();
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  return join(dir, "config.json");
-}
-function loadConfig() {
-  const path = getConfigPath();
-  if (!existsSync(path)) {
-    return emptyConfig();
-  }
-  try {
-    const data = readFileSync(path, "utf-8");
-    return JSON.parse(data);
-  } catch {
-    return emptyConfig();
-  }
-}
-function saveConfig(cfg) {
-  const path = getConfigPath();
-  const dir = getConfigDir();
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  writeFileSync(path, JSON.stringify(cfg, null, 2), { mode: 384 });
-}
-function isAuthenticated(cfg) {
-  return cfg.access_token !== "";
-}
-function isTokenExpired(cfg) {
-  if (cfg.expires_at === 0)
-    return false;
-  return Math.floor(Date.now() / 1000) > cfg.expires_at - 300;
-}
-function emptyConfig() {
-  return {
-    access_token: "",
-    refresh_token: "",
-    expires_at: 0
-  };
-}
-var MODE_OSS = "oss";
-var init_config = () => {};
-
-// src/config/constants.ts
-function getWebAppURL() {
-  return process.env.DOSU_WEB_APP_URL_OVERRIDE ?? "https://app.dosu.dev" ?? "";
-}
-function getBackendURL() {
-  return process.env.DOSU_BACKEND_URL_OVERRIDE ?? "https://api.dosu.dev" ?? "";
-}
-function getSupabaseURL() {
-  return process.env.SUPABASE_URL_OVERRIDE ?? "https://wldmetsoicvieidlsqrb.supabase.co" ?? "";
-}
-function getSupabaseAnonKey() {
-  return process.env.SUPABASE_ANON_KEY_OVERRIDE ?? "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6IndsbG1ldHNvaWN2aWVpZGxzcXJiIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MzQ0NjA1NjUsImV4cCI6MjA1MDAzNjU2NX0.15LIxqSMVRnxsvLrk0GPjL1aSYPfOeaeFMdJXqgc5Xs" ?? "";
-}
-
 // src/version/version.ts
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.16.0";
+var VERSION = "0.16.2";
 
 // src/debug/logger.ts
 import {
@@ -4474,162 +4658,6 @@ var init_logger = __esm(() => {
   };
 });
 
-// src/client/client.ts
-var exports_client = {};
-__export(exports_client, {
-  SessionExpiredError: () => SessionExpiredError,
-  Client: () => Client
-});
-
-class Client {
-  baseURL;
-  config;
-  constructor(cfg) {
-    this.baseURL = getBackendURL();
-    this.config = cfg;
-  }
-  async doRequest(method, path, body) {
-    if (!isAuthenticated(this.config)) {
-      throw new Error("not authenticated - please run setup first");
-    }
-    if (isTokenExpired(this.config)) {
-      await this.refreshToken();
-    }
-    let resp = await this.doRequestOnce(method, path, body);
-    if (resp.status === 401 || resp.status === 403) {
-      try {
-        await this.refreshToken();
-      } catch {
-        throw new SessionExpiredError;
-      }
-      resp = await this.doRequestOnce(method, path, body);
-    }
-    return resp;
-  }
-  async doRequestRaw(method, path) {
-    return this.doRequestOnce(method, path);
-  }
-  async doRequestOnce(method, path, body) {
-    const url = this.baseURL + path;
-    const headers = {
-      "Content-Type": "application/json",
-      "Supabase-Access-Token": this.config.access_token
-    };
-    const options = { method, headers };
-    if (body !== undefined) {
-      options.body = JSON.stringify(body);
-    }
-    const controller = new AbortController;
-    const timeout = setTimeout(() => controller.abort(), 1e4);
-    options.signal = controller.signal;
-    try {
-      return await fetch(url, options);
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-  async get(path) {
-    return this.doRequest("GET", path);
-  }
-  async post(path, body) {
-    return this.doRequest("POST", path, body);
-  }
-  async put(path, body) {
-    return this.doRequest("PUT", path, body);
-  }
-  async delete(path) {
-    return this.doRequest("DELETE", path);
-  }
-  async refreshToken() {
-    if (!this.config.refresh_token) {
-      throw new Error("no refresh token available");
-    }
-    const supabaseURL = getSupabaseURL();
-    const endpoint = `${supabaseURL}/auth/v1/token?grant_type=refresh_token`;
-    const resp = await fetch(endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        apikey: getSupabaseAnonKey()
-      },
-      body: JSON.stringify({ refresh_token: this.config.refresh_token })
-    });
-    if (resp.status !== 200) {
-      throw new Error(`refresh failed with status ${resp.status}`);
-    }
-    const data = await resp.json();
-    this.config.access_token = data.access_token;
-    this.config.refresh_token = data.refresh_token;
-    this.config.expires_at = Math.floor(Date.now() / 1000) + data.expires_in;
-    saveConfig(this.config);
-  }
-  async getDeployments() {
-    const resp = await this.get("/v1/mcp/deployments");
-    if (resp.status !== 200) {
-      let detail = await readErrorBody(resp);
-      if (!detail || detail === "Internal Server Error") {
-        detail = "check backend logs for details";
-      }
-      throw new Error(`failed to fetch deployments (status ${resp.status}): ${detail}`);
-    }
-    return resp.json();
-  }
-  async getOrgs() {
-    const resp = await this.get("/v1/mcp/orgs");
-    if (resp.status !== 200) {
-      const detail = await readErrorBody(resp);
-      throw new Error(`failed to fetch orgs (status ${resp.status}): ${detail}`);
-    }
-    return resp.json();
-  }
-  async validateAPIKey(apiKey, deploymentID) {
-    try {
-      const endpoint = `${this.baseURL}/v1/mcp/deployments/${encodeURIComponent(deploymentID)}`;
-      const controller = new AbortController;
-      const timeout = setTimeout(() => controller.abort(), 5000);
-      try {
-        const resp = await fetch(endpoint, {
-          method: "GET",
-          headers: { "X-Dosu-API-Key": apiKey },
-          signal: controller.signal
-        });
-        return resp.status !== 401 && resp.status !== 403;
-      } finally {
-        clearTimeout(timeout);
-      }
-    } catch {
-      return true;
-    }
-  }
-  async createAPIKey(deploymentID, name) {
-    const path = `/v1/mcp/deployments/${deploymentID}/api-keys`;
-    const resp = await this.post(path, { name });
-    if (resp.status !== 200 && resp.status !== 201) {
-      const detail = await readErrorBody(resp);
-      throw new Error(`failed to create API key (status ${resp.status}): ${detail}`);
-    }
-    return resp.json();
-  }
-}
-async function readErrorBody(resp) {
-  try {
-    const text = await resp.text();
-    return text.slice(0, 1024);
-  } catch {
-    return "";
-  }
-}
-var SessionExpiredError;
-var init_client = __esm(() => {
-  init_config();
-  SessionExpiredError = class SessionExpiredError extends Error {
-    constructor() {
-      super("session expired");
-      this.name = "SessionExpiredError";
-    }
-  };
-});
-
 // src/client/trpc.ts
 var exports_trpc = {};
 __export(exports_trpc, {
@@ -5408,7 +5436,7 @@ function isDefinitiveError(err) {
 }
 async function requestCreateTicket(cfg, req) {
   const client = new Client(cfg);
-  const resp = await client.post(TICKETS_PATH, req);
+  const resp = await client.postWithApiKey(TICKETS_PATH, req);
   if (resp.status !== 202 && resp.status !== 200 && resp.status !== 201) {
     throw new TicketHttpError(resp.status);
   }
@@ -5416,7 +5444,7 @@ async function requestCreateTicket(cfg, req) {
 }
 async function requestGetTicket(cfg, ticketId) {
   const client = new Client(cfg);
-  const resp = await client.get(`${TICKETS_PATH}/${encodeURIComponent(ticketId)}`);
+  const resp = await client.getWithApiKey(`${TICKETS_PATH}/${encodeURIComponent(ticketId)}`);
   if (resp.status !== 200 && resp.status !== 202) {
     throw new TicketHttpError(resp.status);
   }
@@ -6224,7 +6252,8 @@ function installClaudeHooks(configPath, opts = {}) {
   if (typeof cfg.hooks !== "object" || cfg.hooks === null) {
     cfg.hooks = {};
   }
-  const events = [...DEFAULT_HOOK_EVENTS, ...opts.withStop ? ["Stop"] : []];
+  const includeStop = opts.stop !== false;
+  const events = DEFAULT_HOOK_EVENTS.filter((event) => event !== "Stop" || includeStop);
   for (const event of events) {
     const existing = Array.isArray(cfg.hooks[event]) ? cfg.hooks[event] : [];
     const preserved = existing.filter((g2) => !isDosuGroup(g2));
@@ -6284,7 +6313,7 @@ function inspectClaudeHooks(configPath) {
 var DEFAULT_HOOK_EVENTS, MARKER = "__dosu", EVENT_SUBCOMMAND;
 var init_claude_code = __esm(() => {
   init_config_helpers();
-  DEFAULT_HOOK_EVENTS = ["UserPromptSubmit", "PostToolUse"];
+  DEFAULT_HOOK_EVENTS = ["UserPromptSubmit", "PostToolUse", "Stop"];
   EVENT_SUBCOMMAND = {
     UserPromptSubmit: "user-prompt-submit",
     PostToolUse: "post-tool-use",
@@ -12239,6 +12268,7 @@ var init_flow3 = __esm(() => {
 
 // src/cli/cli.ts
 init_esm();
+init_client();
 import { readFileSync as readFileSync11, unlinkSync as unlinkSync2 } from "node:fs";
 
 // src/commands/analytics.ts
@@ -12998,7 +13028,7 @@ async function runUserPromptSubmit(input, now = Date.now()) {
     return;
   }
   const cfg = loadConfig();
-  if (!isAuthenticated(cfg) || !cfg.deployment_id) {
+  if (!cfg.api_key || !cfg.deployment_id) {
     logger.debug("hooks", "submit skipped reason=not-configured");
     return;
   }
@@ -13052,7 +13082,7 @@ async function runPostToolUse(input, now = Date.now()) {
     return;
   }
   const cfg = loadConfig();
-  if (!isAuthenticated(cfg) || !cfg.deployment_id) {
+  if (!cfg.api_key || !cfg.deployment_id) {
     saveState({ ...state, lastCheckedAt: now });
     return;
   }
@@ -13109,7 +13139,7 @@ async function runStop(input, now = Date.now()) {
     return printContinue();
   }
   const cfg = loadConfig();
-  if (!isAuthenticated(cfg) || !cfg.deployment_id)
+  if (!cfg.api_key || !cfg.deployment_id)
     return printContinue();
   const tc = await Promise.resolve().then(() => (init_ticket_client(), exports_ticket_client));
   let resp;
@@ -13209,7 +13239,7 @@ async function runInstall(agent, opts) {
   const { installClaudeHooks: installClaudeHooks2, claudeLocalSettingsPath: claudeLocalSettingsPath2 } = await Promise.resolve().then(() => (init_claude_code(), exports_claude_code));
   const configPath = claudeLocalSettingsPath2(resolveDir(opts.dir));
   try {
-    const { events } = installClaudeHooks2(configPath, { withStop: opts.withStop });
+    const { events } = installClaudeHooks2(configPath, { stop: opts.stop });
     if (opts.json) {
       const { emitStep: emitStep2 } = await Promise.resolve().then(() => exports_output);
       emitStep2({ step: "hooks-install", path: configPath, events });
@@ -13299,7 +13329,7 @@ async function collectDoctorChecks(opts) {
       detail: "no deployment selected (run 'dosu setup')"
     });
   }
-  if (cfg.api_key && cfg.deployment_id && isAuthenticated(cfg)) {
+  if (cfg.api_key && cfg.deployment_id) {
     const { Client: Client2 } = await Promise.resolve().then(() => (init_client(), exports_client));
     const ok = await new Client2(cfg).validateAPIKey(cfg.api_key, cfg.deployment_id);
     checks.push({
@@ -13311,7 +13341,7 @@ async function collectDoctorChecks(opts) {
     checks.push({
       name: "backend",
       status: "warn",
-      detail: "skipped (not authenticated / no deployment)"
+      detail: "skipped (no API key / no deployment)"
     });
   }
   return checks;
@@ -13341,7 +13371,7 @@ function hooksCommand() {
   cmd.command("post-tool-use").description("Hook entrypoint: poll and inject ready knowledge once").action(async () => {
     await runHookEntrypoint("post-tool-use", readStdinRaw());
   });
-  cmd.command("stop").description("Hook entrypoint (opt-in): last-chance non-blocking delivery").action(async () => {
+  cmd.command("stop").description("Hook entrypoint: last-chance knowledge delivery when the agent stops").action(async () => {
     await runHookEntrypoint("stop", readStdinRaw());
   });
   cmd.command("status").description("Show the active Dosu knowledge ticket for this session").option("--json", "Output JSON", false).action((opts) => {
@@ -13354,13 +13384,13 @@ function hooksCommand() {
     }
     runStatus(input, opts);
   });
-  cmd.command("install").description("Install Dosu hooks into a coding agent's local config").addArgument(new Argument("<agent>", "coding agent to configure").choices(SUPPORTED_AGENTS)).option("--scope <scope>", "Config scope (local only)", "local").option("--dir <path>", "Project root (defaults to current directory)").option("--with-stop", "Also install the optional Stop hook", false).option("--json", "Emit machine-readable JSON", false).addHelpText("after", [
+  cmd.command("install").description("Install Dosu hooks into a coding agent's local config").addArgument(new Argument("<agent>", "coding agent to configure").choices(SUPPORTED_AGENTS)).option("--scope <scope>", "Config scope (local only)", "local").option("--dir <path>", "Project root (defaults to current directory)").option("--no-stop", "Skip the Stop hook (knowledge then delivers mid-session only, less reliably)").option("--json", "Emit machine-readable JSON", false).addHelpText("after", [
     "",
     `Supported agents: ${SUPPORTED_AGENTS.join(", ")}`,
     "",
     "Examples:",
     "  $ dosu hooks install claude-code",
-    "  $ dosu hooks install claude-code --with-stop",
+    "  $ dosu hooks install claude-code --no-stop",
     "  $ dosu hooks install claude-code --dir ./my-project"
   ].join(`
 `)).action((agent, opts) => runInstall(agent, opts));
@@ -14341,10 +14371,17 @@ function createProgram() {
       return;
     }
     const cfg = loadConfig();
-    if (isAuthenticated(cfg) && !isTokenExpired(cfg)) {
-      console.log("You are already logged in.");
-      console.log("Run 'dosu logout' first to re-authenticate.");
-      return;
+    if (isAuthenticated(cfg)) {
+      if (!isTokenExpired(cfg)) {
+        console.log("You are already logged in.");
+        console.log("Run 'dosu logout' first to re-authenticate.");
+        return;
+      }
+      if (await ensureFreshSession(cfg)) {
+        console.log("Session refreshed.");
+        console.log(`Credentials saved to ${getConfigPath()}`);
+        return;
+      }
     }
     console.log("Opening browser for authentication...");
     const { startOAuthFlow: startOAuthFlow2 } = await Promise.resolve().then(() => (init_flow(), exports_flow));
@@ -14384,14 +14421,14 @@ function createProgram() {
     saveConfig(cfg);
     console.log("Successfully logged out.");
   });
-  program2.command("status").description("Show current authentication and MCP status").action(() => {
+  program2.command("status").description("Show current authentication and MCP status").action(async () => {
     const cfg = loadConfig();
     if (!isAuthenticated(cfg)) {
       console.log("Status: Not logged in");
       console.log("Run 'dosu login' to authenticate.");
       return;
     }
-    if (isTokenExpired(cfg)) {
+    if (isTokenExpired(cfg) && !await ensureFreshSession(cfg)) {
       console.log("Status: Token expired");
       console.log("Run 'dosu login' to re-authenticate.");
     } else {
@@ -14409,7 +14446,7 @@ function createProgram() {
     }
   });
   const mcp = program2.command("mcp").description("Manage MCP server integrations");
-  mcp.command("add <agent>").description("Add Dosu MCP to an AI tool").option("-g, --global", "Add globally (all projects) instead of project-local", false).option("--show-secret", "Print full manual configuration secrets", false).action((toolId, opts) => {
+  mcp.command("add <agent>").description("Add Dosu MCP to an AI tool").option("-g, --global", "Add globally (all projects) instead of project-local", false).option("--show-secret", "Print full manual configuration secrets", false).action(async (toolId, opts) => {
     let provider;
     try {
       provider = getProvider(toolId.toLowerCase());
@@ -14420,7 +14457,7 @@ function createProgram() {
     if (!isAuthenticated(cfg)) {
       throw new Error("not logged in. Run 'dosu login' first");
     }
-    if (isTokenExpired(cfg)) {
+    if (isTokenExpired(cfg) && !await ensureFreshSession(cfg)) {
       throw new Error("session expired. Run 'dosu login' to re-authenticate");
     }
     if (cfg.mode !== MODE_OSS && !cfg.deployment_id) {
@@ -14545,6 +14582,18 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
   });
   return program2;
 }
+async function ensureFreshSession(cfg) {
+  if (!isTokenExpired(cfg))
+    return true;
+  try {
+    logger.debug("cli", "token expired, attempting refresh");
+    await new Client(cfg).refreshToken();
+    return true;
+  } catch (err) {
+    logger.debug("cli", `token refresh failed: ${err instanceof Error ? err.message : err}`);
+    return false;
+  }
+}
 async function execute() {
   const program2 = createProgram();
   await program2.parseAsync(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dosu/cli",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "type": "module",
   "description": "Dosu CLI - Manage MCP servers for AI tools",
   "license": "MIT",