@f-o-h/cli 0.1.61 → 0.1.62

package/README.md

@@ -68,16 +68,22 @@ foh agent replay --file ./transcript-export.json --json
 foh bug improve --from-file foh-proof.json --out foh-improvement.json --json
 ```
 
-Trusted server-side automation can use a scoped service token without browser
-approval:
-
-```bash
-FOH_SERVICE_TOKEN="$FOH_SERVICE_TOKEN" FOH_ORG_ID="$FOH_ORG_ID" foh auth whoami --json
-```
-
-`auth signup --web` opens the console signup page when possible and always
-prints the fallback URL. `auth login --web` starts browser device
-authorization, opens `/cli-auth`, waits for console approval, and stores the
+Trusted server-side automation can use a scoped service token without browser
+approval:
+
+```bash
+FOH_SERVICE_TOKEN="$FOH_SERVICE_TOKEN" FOH_ORG_ID="$FOH_ORG_ID" foh auth whoami --json
+```
+
+`auth whoami --json` includes `auth.expires_at` and `auth.token_ttl_seconds`
+without exposing the token. Refresh short-lived eval tokens before long
+external-agent runs; controlled live eval execution fails closed when explicit
+`FOH_EXTERNAL_AGENT_EVAL_*` credentials are missing, expired, or expire before
+the run budget.
+
+`auth signup --web` opens the console signup page when possible and always
+prints the fallback URL. `auth login --web` starts browser device
+authorization, opens `/cli-auth`, waits for console approval, and stores the
 returned short-lived token. Credential auth remains available as fallback.
 
 `foh prove` produces a compact signed proof report across auth, org context,
@@ -305,6 +311,4 @@ foh bug improve \
 
 The command emits a redacted `foh_improvement_packet.v1` with stable IDs,
 reason code, promotion decision, evidence summary, and deterministic next
-commands.
-
-
+commands.

package/dist/foh.js

@@ -10073,6 +10073,15 @@ function expiryFromJwt(token) {
 function fallbackExpiry() {
   return new Date(Date.now() + 60 * 60 * 1e3).toISOString();
 }
+function credentialMillisecondsUntilExpiry(expiresAt, now = Date.now()) {
+  const expiresMs = Date.parse(expiresAt);
+  if (!Number.isFinite(expiresMs)) return null;
+  return expiresMs - now;
+}
+function credentialExpiresSoon(expiresAt, minimumTtlMs = 0, now = Date.now()) {
+  const remainingMs = credentialMillisecondsUntilExpiry(expiresAt, now);
+  return remainingMs !== null && remainingMs <= minimumTtlMs;
+}
 function credentialsFromEnv(apiUrlOverride, env = process.env) {
   const token = normalizeEnv(env[SERVICE_TOKEN_ENV]);
   if (!token) return void 0;
@@ -10090,7 +10099,12 @@ function hasEnvCredentials(env = process.env) {
 }
 function loadCredentials(apiUrlOverride) {
   const envCreds = credentialsFromEnv(apiUrlOverride);
-  if (envCreds) return envCreds;
+  if (envCreds) {
+    if (credentialExpiresSoon(envCreds.expiresAt)) {
+      throw new Error("Token expired. Refresh FOH_SERVICE_TOKEN/FOH_TOKEN_EXPIRES_AT or run: foh auth login");
+    }
+    return envCreds;
+  }
   let creds;
   try {
     const raw = (0, import_fs.readFileSync)(CONFIG_PATH, "utf-8");
@@ -10098,7 +10112,7 @@ function loadCredentials(apiUrlOverride) {
   } catch {
     throw new Error("Not authenticated. Run: foh auth login");
   }
-  if (creds.expiresAt && new Date(creds.expiresAt) < /* @__PURE__ */ new Date()) {
+  if (creds.expiresAt && credentialExpiresSoon(creds.expiresAt)) {
     throw new Error("Token expired. Run: foh auth login");
   }
   const resolvedApiUrl = resolveApiUrlOverride(apiUrlOverride);
@@ -10457,7 +10471,11 @@ async function storeAuthenticatedSession(params) {
   const output = {
     status: "authenticated",
     apiUrl: params.apiUrl,
-    expires_at: params.expiresAt
+    expires_at: params.expiresAt,
+    token_ttl_seconds: (() => {
+      const ttlMs = credentialMillisecondsUntilExpiry(params.expiresAt);
+      return ttlMs === null ? null : Math.max(0, Math.floor(ttlMs / 1e3));
+    })()
   };
   if (autoOrgId) {
     output["default_org_id"] = autoOrgId;
@@ -10631,11 +10649,17 @@ function registerAuth(program3) {
     try {
       const creds = loadCredentials(opts.apiUrl);
       const orgId = opts.org ?? creds.orgId;
+      const ttlMs = credentialMillisecondsUntilExpiry(creds.expiresAt);
+      const authMetadata = {
+        apiUrl: creds.apiUrl,
+        expires_at: creds.expiresAt,
+        token_ttl_seconds: ttlMs === null ? null : Math.max(0, Math.floor(ttlMs / 1e3)),
+        default_org_id: creds.orgId ?? null,
+        auth_source: process.env.FOH_SERVICE_TOKEN ? "env_service_token" : "stored_credentials"
+      };
       if (!orgId) {
         format({
-          apiUrl: creds.apiUrl,
-          expires_at: creds.expiresAt,
-          default_org_id: creds.orgId ?? null,
+          ...authMetadata,
           note: creds.orgId ? void 0 : "No default org set. Run: foh org list then: foh org use --org <id>"
         }, { json: opts.json ?? false });
         return;
@@ -10651,7 +10675,7 @@ function registerAuth(program3) {
         });
       }
       const data = await res.json();
-      format(data, { json: opts.json ?? false });
+      format({ ...data, auth: authMetadata }, { json: opts.json ?? false });
     } catch (e) {
       if (e instanceof Error && (e.message.includes("Not authenticated") || e.message.includes("Token expired"))) {
         throw new FohError({
@@ -32853,7 +32877,7 @@ var StdioServerTransport = class {
 };
 
 // src/lib/cli-version.ts
-var CLI_VERSION = "0.1.61";
+var CLI_VERSION = "0.1.62";
 
 // src/commands/mcp-serve.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -39340,19 +39364,25 @@ function shouldRunExternalAgentEvalAuthPreflight(env = process.env) {
     env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT || env.FOH_SERVICE_TOKEN || env.FOH_ORG_ID || env.FOH_API_URL || env.FOH_TOKEN_EXPIRES_AT
   );
 }
-async function runExternalAgentEvalAuthPreflight(env = process.env) {
-  if (!shouldRunExternalAgentEvalAuthPreflight(env)) return null;
+async function runExternalAgentEvalAuthPreflight(env = process.env, options = {}) {
+  const hasExplicitEvalAuth = Boolean(
+    env.FOH_EXTERNAL_AGENT_EVAL_TOKEN || env.FOH_EXTERNAL_AGENT_EVAL_ORG_ID || env.FOH_EXTERNAL_AGENT_EVAL_API_URL || env.FOH_EXTERNAL_AGENT_EVAL_TOKEN_EXPIRES_AT
+  );
+  if (!shouldRunExternalAgentEvalAuthPreflight(env) && !options.requireExplicitEvalAuth) return null;
   const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
   const auth = readExternalAgentEvalAuthEnv(env);
+  const tokenTtlMs = auth.expiresAt ? Date.parse(auth.expiresAt) - Date.now() : null;
   const base = {
     api_url: auth.apiUrl,
     org_id: auth.orgId || null,
     checked_at: checkedAt,
-    token_present: Boolean(auth.token),
+    token_present: Boolean(auth.token) && hasExplicitEvalAuth,
     expires_at: auth.expiresAt || null,
+    token_ttl_seconds: tokenTtlMs === null || !Number.isFinite(tokenTtlMs) ? null : Math.max(0, Math.floor(tokenTtlMs / 1e3)),
+    minimum_required_ttl_seconds: typeof options.minimumTtlMs === "number" ? Math.ceil(options.minimumTtlMs / 1e3) : null,
     matched_org: null
   };
-  if (!auth.token || !auth.orgId) {
+  if (!hasExplicitEvalAuth || !auth.token || !auth.orgId) {
     return { ...base, ok: false, reason_code: "eval_auth_missing" };
   }
   if (auth.expiresAt) {
@@ -39360,6 +39390,9 @@ async function runExternalAgentEvalAuthPreflight(env = process.env) {
     if (Number.isFinite(expiresMs) && expiresMs <= Date.now()) {
       return { ...base, ok: false, reason_code: "eval_auth_expired" };
     }
+    if (typeof options.minimumTtlMs === "number" && Number.isFinite(expiresMs) && expiresMs - Date.now() < options.minimumTtlMs) {
+      return { ...base, ok: false, reason_code: "eval_auth_expires_too_soon" };
+    }
   }
   const res = await fetch(`${auth.apiUrl.replace(/\/$/, "")}/v1/console/auth/my-orgs`, {
     headers: {
@@ -39853,6 +39886,7 @@ function createExternalAgentExecutorPlan(options) {
     batch_path: batchPath,
     batch_dir: batchDir,
     private_repo_root: privateRepoRoot,
+    private_repo_root_explicit: Boolean(options.privateRepoRoot),
     workspace_root: workspaceRoot,
     timeout_minutes: timeoutMinutes,
     safety: {
@@ -40171,7 +40205,10 @@ async function executeExternalAgentExecutorPlan(plan, options = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const results = [];
   const runnerCommand = options.runnerCommand || resolveRunnerExecutionCommand(plan.runner);
-  const authPreflight = options.env ? await runExternalAgentEvalAuthPreflight(options.env) : null;
+  const authPreflight = options.env || options.requireExplicitEvalAuth ? await runExternalAgentEvalAuthPreflight(options.env ?? {}, {
+    requireExplicitEvalAuth: options.requireExplicitEvalAuth,
+    minimumTtlMs: options.minimumEvalAuthTtlMs
+  }) : null;
   if (authPreflight && !authPreflight.ok) {
     const endedAt2 = (/* @__PURE__ */ new Date()).toISOString();
     const blockedResults = plan.runs.map((run) => {
@@ -40322,6 +40359,10 @@ function quoteArg(value) {
   if (/^[A-Za-z0-9_./:=@-]+$/.test(text)) return text;
   return `"${text.replace(/(["$`])/g, "\\$1")}"`;
 }
+function scanArtifactsCommand(runDir, privateRepoRoot) {
+  const privateRootArg = privateRepoRoot ? ` --private-repo-root ${quoteArg(privateRepoRoot)}` : "";
+  return `foh eval external-agent scan-artifacts --run-dir ${quoteArg(runDir)}${privateRootArg} --write-redacted --json`;
+}
 function externalAgentSummaryCommand2(root) {
   const summaryPath = (0, import_path14.join)(root, "latest-summary.json");
   const reportPath = (0, import_path14.join)(root, "summary.report.json");
@@ -40681,7 +40722,7 @@ Exit the shell to finalize run.json.
   external.command("scan-artifacts").description("Scan and redact external-agent run artifacts before they are promoted into improvement loops").requiredOption("--run-dir <path>", "External-agent run artifact directory").option("--private-repo-root <path>", "Private repository root that must not appear in artifacts").option("--write-redacted", "Write .redacted copies next to scanned artifacts").option("--json", "Output as JSON").action(async (opts) => {
     const report = scanExternalAgentArtifacts({
       runDir: String(opts.runDir),
-      privateRepoRoot: opts.privateRepoRoot ? String(opts.privateRepoRoot) : process.cwd(),
+      privateRepoRoot: opts.privateRepoRoot ? String(opts.privateRepoRoot) : void 0,
       writeRedacted: Boolean(opts.writeRedacted)
     });
     format(cliEnvelope({
@@ -40731,7 +40772,9 @@ Exit the shell to finalize run.json.
         }
         const result = await executeExternalAgentExecutorPlan(plan, {
           privateRepoRoot: plan.private_repo_root,
-          env: process.env
+          env: process.env,
+          requireExplicitEvalAuth: true,
+          minimumEvalAuthTtlMs: (plan.timeout_minutes + 5) * 60 * 1e3
         });
         const resultPath = (0, import_path14.join)(plan.batch_dir, "execution-result.json");
         (0, import_fs16.writeFileSync)(resultPath, `${JSON.stringify(result, null, 2)}
@@ -40747,7 +40790,10 @@ Exit the shell to finalize run.json.
             runs: result.results.map((run) => run.artifacts.run)
           },
           nextCommands: [
-            ...result.results.map((run) => `foh eval external-agent scan-artifacts --run-dir ${quoteArg(plan.runs.find((item) => item.run_id === run.run_id)?.run_dir || ".")} --private-repo-root ${quoteArg(plan.private_repo_root)} --write-redacted --json`),
+            ...result.results.map((run) => scanArtifactsCommand(
+              plan.runs.find((item) => item.run_id === run.run_id)?.run_dir || ".",
+              plan.private_repo_root_explicit ? plan.private_repo_root : void 0
+            )),
             externalAgentSummaryCommand2(plan.batch_dir)
           ],
           extra: { result }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@f-o-h/cli",
-  "version": "0.1.61",
+  "version": "0.1.62",
   "description": "FOH CLI - AI-operator provisioning tool for Front Of House",
   "license": "UNLICENSED",
   "bin": {