@eve-horizon/cli 0.2.36 → 0.2.37

package/dist/index.js

@@ -49613,7 +49613,14 @@ for cloud deployments. Credentials are stored globally per API URL.`,
           "--dry-run          Show what would be set without actually setting",
           "",
           "Scope priority: --project > --org > user (default)",
-          "Default scope is user-level, so credentials are available to all your jobs."
+          "Default scope is user-level, so credentials are available to all your jobs.",
+          "",
+          "Token type guidance:",
+          "  Tokens starting with sk-ant-oat01-* are long-lived setup-tokens (preferred).",
+          "  A warning is emitted when syncing any other Claude token (short-lived OAuth,",
+          "  ~15h). Generate a long-lived token with: claude setup-token",
+          "  Codex/Code tokens are automatically written back to their originating secret",
+          "  scope after each job when the CLI refreshes them during the session."
         ],
         examples: [
           "eve auth sync                    # Sync to user-level (default)",
@@ -49627,7 +49634,10 @@ for cloud deployments. Credentials are stored globally per API URL.`,
         usage: "eve auth creds [--claude] [--codex]",
         options: [
           "--claude           Only check Claude/Anthropic credentials",
-          "--codex            Only check Codex/OpenAI credentials"
+          "--codex            Only check Codex/OpenAI credentials",
+          "",
+          "Shows token type for Claude (setup-token = long-lived, oauth = short-lived ~15h)",
+          "and expiry for Codex/Code tokens."
         ],
         examples: [
           "eve auth creds",
@@ -58189,7 +58199,9 @@ var SecretResolveRequestSchema = external_exports.object({
 var SecretResolveItemSchema = external_exports.object({
   key: external_exports.string(),
   value: external_exports.string(),
-  type: SecretTypeSchema
+  type: SecretTypeSchema,
+  scope_type: external_exports.enum(["user", "org", "project", "system"]).optional(),
+  scope_id: external_exports.string().optional()
 });
 var SecretResolveResponseSchema = external_exports.object({
   data: external_exports.array(SecretResolveItemSchema)
@@ -65559,6 +65571,18 @@ Permissions (${data.permissions.length}):`);
         );
         return;
       }
+      const warnings = [];
+      const claudeToken = extractedTokens.CLAUDE_CODE_OAUTH_TOKEN;
+      if (claudeToken && !claudeToken.startsWith("sk-ant-oat01-")) {
+        warnings.push("Found short-lived Claude OAuth token (expires in ~15h). For reliable agent execution, generate a long-lived token: claude setup-token\nThen re-run: eve auth sync");
+        if (!json) {
+          process.stderr.write(`\u26A0  Found short-lived Claude OAuth token (expires in ~15h).
+   For reliable agent execution, generate a long-lived token: claude setup-token
+   Then re-run: eve auth sync
+
+`);
+        }
+      }
       const targetLabel = scope.type === "user" ? "user" : scope.type === "org" ? `org ${scope.orgId}` : `project ${scope.projectId}`;
       if (dryRun) {
         const tokenList = Object.keys(extractedTokens).map((key) => ({
@@ -65566,7 +65590,7 @@ Permissions (${data.permissions.length}):`);
           value: `${extractedTokens[key].substring(0, 10)}...`
         }));
         outputJson(
-          { dry_run: true, would_set: tokenList, target: targetLabel, scope },
+          { dry_run: true, would_set: tokenList, target: targetLabel, scope, warnings },
           json,
           `Would set ${tokenList.length} token(s) on ${targetLabel}:
 ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
@@ -65601,7 +65625,8 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
           scope,
           results,
           success: successCount,
-          failed: failCount
+          failed: failCount,
+          warnings
         },
         json,
         `\u2713 Set ${successCount} secret(s) on ${targetLabel}${failCount > 0 ? ` (${failCount} failed)` : ""}`
@@ -65620,6 +65645,7 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
         let claudeSource = "";
         let claudePreview = "";
         let claudeExpires;
+        let claudeTokenType;
         if (plat === "darwin" && !claudeFound) {
           for (const service of ["Claude Code-credentials", "anthropic.claude"]) {
             try {
@@ -65630,7 +65656,15 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
               if (output) {
                 claudeFound = true;
                 claudeSource = `macOS Keychain (${service})`;
-                claudePreview = output.substring(0, 15) + "...";
+                let tokenStr = output;
+                try {
+                  const parsed = JSON.parse(output);
+                  const claudeOauth = parsed.claudeAiOauth;
+                  if (typeof claudeOauth?.accessToken === "string") tokenStr = claudeOauth.accessToken;
+                } catch {
+                }
+                claudeTokenType = tokenStr.startsWith("sk-ant-oat01-") ? "setup-token" : "oauth";
+                claudePreview = tokenStr.substring(0, 15) + "...";
                 break;
               }
             } catch {
@@ -65652,7 +65686,9 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
                 if (claudeOauth?.accessToken) {
                   claudeFound = true;
                   claudeSource = credPath.replace((0, import_node_os3.homedir)(), "~");
-                  claudePreview = claudeOauth.accessToken.substring(0, 15) + "...";
+                  const tokenStr = claudeOauth.accessToken;
+                  claudePreview = tokenStr.substring(0, 15) + "...";
+                  claudeTokenType = tokenStr.startsWith("sk-ant-oat01-") ? "setup-token" : "oauth";
                   if (claudeOauth.expiresAt) {
                     const expDate = new Date(claudeOauth.expiresAt);
                     claudeExpires = expDate.toISOString();
@@ -65664,6 +65700,7 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
                   claudeSource = credPath.replace((0, import_node_os3.homedir)(), "~");
                   const token = creds.oauth_token || creds.access_token;
                   claudePreview = token.substring(0, 15) + "...";
+                  claudeTokenType = token.startsWith("sk-ant-oat01-") ? "setup-token" : "oauth";
                   break;
                 }
               } catch {
@@ -65676,7 +65713,8 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
           source: claudeFound ? claudeSource : "not found",
           found: claudeFound,
           preview: claudePreview || void 0,
-          expiresAt: claudeExpires
+          expiresAt: claudeExpires,
+          tokenType: claudeTokenType
         });
       }
       if (checkCodex) {
@@ -65700,6 +65738,7 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
             }
           }
         }
+        let codexExpires;
         if (!codexFound) {
           const freshest = pickFreshestCodeAuth();
           if (freshest) {
@@ -65711,13 +65750,17 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
               codexSource += " (API key)";
               codexPreview = freshest.apiKey.substring(0, 10) + "...";
             }
+            if (freshest.expiresAt > 0) {
+              codexExpires = new Date(freshest.expiresAt * 1e3).toISOString();
+            }
           }
         }
         credentials2.push({
           name: "Codex/Code OAuth",
           source: codexFound ? codexSource : "not found",
           found: codexFound,
-          preview: codexPreview || void 0
+          preview: codexPreview || void 0,
+          expiresAt: codexExpires
         });
       }
       const foundCount = credentials2.filter((c) => c.found).length;
@@ -65731,6 +65774,10 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
         const status = cred.found ? "\u2713" : "\u2717";
         console.log(`  ${status} ${cred.name}`);
         console.log(`    Source: ${cred.source}`);
+        if (cred.tokenType) {
+          const typeLabel = cred.tokenType === "setup-token" ? "setup-token (long-lived)" : "oauth (short-lived, ~15h)";
+          console.log(`    Type:   ${typeLabel}`);
+        }
         if (cred.preview) {
           console.log(`    Token:  ${cred.preview}`);
         }
@@ -65738,8 +65785,8 @@ ${tokenList.map((t) => `  - ${t.name}`).join("\n")}`
           const expDate = new Date(cred.expiresAt);
           const now = /* @__PURE__ */ new Date();
           const isExpired = expDate < now;
-          const expLabel = isExpired ? "(expired)" : "";
-          console.log(`    Expires: ${cred.expiresAt} ${expLabel}`);
+          const expLabel = isExpired ? " (expired)" : "";
+          console.log(`    Expires: ${cred.expiresAt}${expLabel}`);
         }
         console.log("");
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eve-horizon/cli",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Eve Horizon CLI",
   "license": "MIT",
   "repository": {