@great-arrow/cli 0.1.52 → 0.1.54

package/dist/index.js

@@ -9402,7 +9402,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.52";
+var CLI_VERSION = "0.1.54";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9411,6 +9411,9 @@ var GAD_CLI_VERSION_HEADER = "X-GAD-CLI-Version";
 // src/commands/login.ts
 import { execFile } from "node:child_process";
 
+// src/lib/credentials.ts
+import { randomUUID } from "node:crypto";
+
 // src/lib/keychain.ts
 import { mkdir, writeFile, readFile, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -9532,7 +9535,12 @@ async function loadStoredCredential() {
   return parseStoredValue(await getToken());
 }
 async function saveOAuthCredential(credential) {
-  return setToken(JSON.stringify(credential));
+  return setToken(
+    JSON.stringify({
+      ...credential,
+      localSessionId: credential.localSessionId || randomUUID()
+    })
+  );
 }
 async function savePatToken(token) {
   return setToken(token);
@@ -9903,14 +9911,33 @@ function toCredential(env4, apiUrl, clientId, now) {
 }
 var TOKEN_POST_TIMEOUT_MS = 8e3;
 async function postToken(apiUrl, form, fetchImpl, timeoutMs = TOKEN_POST_TIMEOUT_MS) {
-  const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
-    method: "POST",
-    headers: TOKEN_HEADERS,
-    body: new URLSearchParams(form).toString(),
-    signal: AbortSignal.timeout(timeoutMs)
+  const controller = new AbortController();
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      const error = new DOMException(
+        "Token exchange timed out.",
+        "TimeoutError"
+      );
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
   });
-  const json = await res.json().catch(() => ({}));
-  return { ok: res.ok, status: res.status, json };
+  const request = async () => {
+    const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
+      method: "POST",
+      headers: TOKEN_HEADERS,
+      body: new URLSearchParams(form).toString(),
+      signal: controller.signal
+    });
+    const json = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, json };
+  };
+  try {
+    return await Promise.race([request(), deadline]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 async function exchangeCode(opts) {
   const now = opts.now ?? Date.now();
@@ -10364,6 +10391,20 @@ var login_default = loginCommand;
 import { mkdir as mkdir3, open, rm, stat } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { join as join4 } from "node:path";
+
+// src/lib/oauth/session-identity.ts
+import { createHash as createHash2 } from "node:crypto";
+function credentialSessionId(credential) {
+  return credential.localSessionId || createHash2("sha256").update(
+    JSON.stringify([
+      credential.clientId,
+      credential.apiUrl,
+      credential.refreshToken
+    ])
+  ).digest("hex");
+}
+
+// src/lib/auth.ts
 var REFRESH_SKEW_MS = 12e4;
 var inflightRefresh = null;
 var REFRESH_LOCK_STALE_MS = 15e3;
@@ -10387,7 +10428,12 @@ async function acquireRefreshLock() {
       await handle.close();
       return true;
     } catch (err) {
-      if (err.code !== "EEXIST") return true;
+      if (err.code !== "EEXIST") {
+        throw networkError(
+          "Could not lock session renewal.",
+          "Check local credential storage and retry; your session has been kept."
+        );
+      }
     }
     const age = await stat(path10).then((st) => Date.now() - st.mtimeMs).catch(() => Number.POSITIVE_INFINITY);
     if (age > REFRESH_LOCK_STALE_MS) {
@@ -10416,8 +10462,13 @@ async function storedPairOtherThan(ours) {
   } catch (err) {
     debugSwallow("refresh.reread", err);
   }
-  if (stored?.kind !== "oauth") return null;
-  if (stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
+  if (stored?.kind !== "oauth") {
+    throw authError(
+      "The original session changed or ended during renewal.",
+      "Restart this command with your current connection."
+    );
+  }
+  if (ours.localSessionId && credentialSessionId(stored.credential) !== credentialSessionId(ours) || stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
     throw networkError(
       "The stored session changed while renewing it.",
       "Retry the command with the current session."
@@ -10443,11 +10494,32 @@ async function resolveAuth() {
   if (stored?.kind === "oauth") {
     const fresh = await ensureFreshAccessToken(stored.credential);
     warnLegacyApiUrl(fresh.apiUrl);
+    const originalSessionId = credentialSessionId(fresh);
+    const originalApiUrl = fresh.apiUrl;
+    const originalClientId = fresh.clientId;
     return withWorkspace({
       token: fresh.accessToken,
       apiUrl: fresh.apiUrl,
       tokenType: "oauth",
-      expiresAt: fresh.accessExpiresAt
+      expiresAt: fresh.accessExpiresAt,
+      getToken: async () => {
+        const latestConfig = await loadConfig();
+        const latest = await loadStoredCredential();
+        if ((latestConfig.api_url || DEFAULT_API_URL) !== configApiUrl || (latestConfig.default_workspace || void 0) !== activeWorkspace || process.env.GAD_TOKEN || latest?.kind !== "oauth" || credentialSessionId(latest.credential) !== originalSessionId || latest.credential.apiUrl !== originalApiUrl || latest.credential.clientId !== originalClientId) {
+          throw authError(
+            "The original session or workspace changed or ended.",
+            "Restart this command with your current connection."
+          );
+        }
+        const renewed = await ensureFreshAccessToken(latest.credential);
+        if (credentialSessionId(renewed) !== originalSessionId) {
+          throw authError(
+            "The original session changed.",
+            "Restart this command with your current connection."
+          );
+        }
+        return renewed.accessToken;
+      }
     });
   }
   if (stored?.kind === "pat") {
@@ -10502,10 +10574,6 @@ async function ensureFreshAccessToken(credential) {
   if (Date.now() < credential.accessExpiresAt - REFRESH_SKEW_MS) {
     return credential;
   }
-  if (Date.now() >= credential.refreshExpiresAt) {
-    await clearStoredCredential();
-    throw sessionExpired();
-  }
   inflightRefresh ??= doRefresh(credential);
   try {
     return await inflightRefresh;
@@ -10529,12 +10597,32 @@ async function doRefresh(credential) {
         "Retry shortly; your saved session has been kept."
       );
     }
-    const refreshed = await refreshTokens({
+    if (Date.now() >= current.refreshExpiresAt) {
+      await clearStoredCredential();
+      throw sessionExpired();
+    }
+    const rotated = await refreshTokens({
       apiUrl: current.apiUrl,
       clientId: current.clientId,
       refreshToken: current.refreshToken
     });
-    await saveOAuthCredential(refreshed);
+    const refreshed = {
+      ...rotated,
+      localSessionId: credentialSessionId(current)
+    };
+    const saved = await loadStoredCredential();
+    if (saved?.kind !== "oauth" || credentialSessionId(saved.credential) !== credentialSessionId(current)) {
+      throw authError(
+        "The original session changed or ended during renewal.",
+        "Restart this command with your current connection."
+      );
+    }
+    if (!await saveOAuthCredential(refreshed)) {
+      throw networkError(
+        "Could not persist the renewed session.",
+        "Check your credential storage before retrying."
+      );
+    }
     return refreshed;
   } catch (err) {
     if (err instanceof RefreshRejected) {
@@ -10678,6 +10766,42 @@ function parseMcpPayload(result) {
   }
 }
 
+// ../../src/lib/observability/scrub-pii.ts
+var EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+var SSN_RE = /\b\d{3}[-.\s]?\d{2}[-.\s]?\d{4}\b/g;
+var CREDIT_CARD_RE = /\b\d(?:[ -]?\d){12,18}\b/g;
+var PHONE_RE = /(?:\+?\b1[-.\s]?)?(?:\([2-9]\d{2}\)\s?|\b[2-9]\d{2}[-.\s]?)\d{3}[-.\s]?\d{4}\b/g;
+function luhnValid(candidate) {
+  const digits2 = candidate.replace(/\D/g, "");
+  if (digits2.length < 13 || digits2.length > 19) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits2.length - 1; i >= 0; i--) {
+    let n = digits2.charCodeAt(i) - 48;
+    if (double) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var SECRET_TOKEN_RE = /\b(?:gad_[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9-]{20,}|Bearer\s+[A-Za-z0-9._~+/=-]{8,})\b/gi;
+var SENSITIVE_QUERY_VALUE_RE = /((?:^|[?&])(?:code|token|access_token|refresh_token|id_token|api_key|apikey|api_secret|apisecret|key|secret|client_secret|password|state)=)[^&#\s]+/gi;
+function scrubPiiFromText(s) {
+  return s.replace(EMAIL_RE, "[redacted-email]").replace(
+    CREDIT_CARD_RE,
+    (m) => luhnValid(m) ? "[redacted-credit-card]" : m
+  ).replace(SSN_RE, "[redacted-ssn]").replace(PHONE_RE, "[redacted-phone]");
+}
+function scrubTelemetryText(s) {
+  return scrubPiiFromText(s).replace(SENSITIVE_QUERY_VALUE_RE, "$1[redacted]").replace(
+    SECRET_TOKEN_RE,
+    (match) => match.toLowerCase().startsWith("bearer ") ? "Bearer [redacted]" : "[redacted-secret]"
+  );
+}
+
 // src/lib/telemetry.ts
 var MAX_EVENTS_PER_PROCESS = 20;
 var MAX_STRING = 240;
@@ -10685,12 +10809,14 @@ var sent = 0;
 function enabled() {
   if (process.env.GAD_TELEMETRY === "0" || process.env.GAD_TELEMETRY === "false")
     return false;
-  return process.env.GAD_TELEMETRY === "1" || process.env.GAD_TELEMETRY === "true";
+  if (process.env.GAD_TELEMETRY === "1" || process.env.GAD_TELEMETRY === "true")
+    return true;
+  return void 0;
 }
 function redact(value, depth = 0) {
   if (depth > 3) return "[redacted]";
   if (typeof value === "string") {
-    const scrubbed = value.replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(
+    const scrubbed = scrubTelemetryText(value).replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(
       /(token|secret|password|authorization)[=:]\s*[^\s,]+/gi,
       "$1=[redacted]"
     );
@@ -10709,7 +10835,9 @@ function redact(value, depth = 0) {
 }
 async function captureCliEvent(input) {
   if (sent >= MAX_EVENTS_PER_PROCESS) return;
-  if (!enabled()) {
+  const envConsent = enabled();
+  if (envConsent === false) return;
+  if (envConsent === void 0) {
     try {
       const config = await loadConfig();
       if (config.telemetry_enabled !== true) return;
@@ -10717,28 +10845,33 @@ async function captureCliEvent(input) {
       return;
     }
   }
+  if (sent >= MAX_EVENTS_PER_PROCESS) return;
   sent++;
   const error = input.error instanceof Error ? { name: input.error.name, message: input.error.message } : input.error;
   const payload = {
     platform: "cli",
     event: input.name,
     level: input.error ? "error" : "info",
-    message: error && typeof error === "object" && "message" in error ? String(error.message) : input.name,
+    message: error && typeof error === "object" && "message" in error ? redact(String(error.message)) : redact(input.name),
     version: process.env.GAD_CLI_VERSION,
     code: input.context?.code,
     context: redact(input.context ?? {}),
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   };
   try {
-    await fetch(`${input.apiUrl.replace(/\/$/, "")}/api/telemetry`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        ...input.token ? { authorization: `Bearer ${input.token}` } : {}
-      },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(1500)
-    });
+    const response = await fetch(
+      `${input.apiUrl.replace(/\/$/, "")}/api/telemetry`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(redact(payload)),
+        signal: AbortSignal.timeout(1500)
+      }
+    );
+    if (!response.ok)
+      debugSwallow("telemetry.send", new Error(`HTTP ${response.status}`));
   } catch (err) {
     debugSwallow("telemetry.send", err);
   }
@@ -10845,12 +10978,14 @@ function sleep(ms) {
 }
 var GadClient = class {
   token;
+  getToken;
   apiUrl;
   repoUrl;
   workspaceId;
   timeout;
   constructor(options) {
     this.token = options.token;
+    this.getToken = options.getToken;
     this.apiUrl = options.apiUrl.replace(/\/$/, "");
     this.repoUrl = options.repoUrl ?? detectGitOrigin();
     this.workspaceId = options.workspaceId?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(this.repoUrl) }) || null;
@@ -10886,8 +11021,28 @@ var GadClient = class {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), effectiveTimeout);
       try {
+        const headers = this.getToken ? new Headers(init.headers) : void 0;
+        if (headers && this.getToken) {
+          const token = await Promise.race([
+            this.getToken(),
+            new Promise((_resolve, reject) => {
+              controller.signal.addEventListener(
+                "abort",
+                () => reject(
+                  networkError(
+                    "Session renewal timed out.",
+                    "Retry shortly; your saved session has been kept."
+                  )
+                ),
+                { once: true }
+              );
+            })
+          ]);
+          headers.set("Authorization", `Bearer ${token}`);
+        }
         const response = await fetch(url, {
           ...init,
+          ...headers ? { headers: Object.fromEntries(headers) } : {},
           signal: controller.signal
         });
         clearTimeout(timer);
@@ -11136,6 +11291,7 @@ function whoamiCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     let result;
@@ -11246,7 +11402,11 @@ var detailFields = [
 ];
 async function buildClient() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function extractPreview(item) {
   if (typeof item.content === "string") {
@@ -11424,7 +11584,11 @@ var memberColumns = [
 ];
 async function createClient() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 var listCommand = new Command("list").description("List all accessible workspaces").option("--json", "Output as JSON").action(async (options) => {
   const jsonFlag = Boolean(
@@ -11618,7 +11782,11 @@ var listCommand2 = new Command("list").description("List open todos sorted by pr
       noColor: parentOpts.noColor || false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const args = {
       status: options.status ?? "open"
     };
@@ -11644,7 +11812,11 @@ var createCommand = new Command("create").description("Create a new todo card").
       noColor: false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const args = { title };
     if (options.priority) {
       args.priority = options.priority;
@@ -11672,7 +11844,11 @@ var doneCommand = new Command("done").description("Mark a todo as done").argumen
     noColor: false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   await client.mcpCall("todo_update", { id, status: "done" });
   fmt.success(`Todo ${id} marked as done.`);
 });
@@ -11691,7 +11867,11 @@ var updateCommand = new Command("update").description("Update a todo's status").
     process.exit(3);
   }
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   await client.mcpCall("todo_update", { id, status: options.status });
   fmt.success(`Todo ${id} updated to status: ${options.status}`);
 });
@@ -11733,7 +11913,11 @@ var getCommand = new Command("get").description("Show one card's full state (ass
     noColor: parentOpts.noColor || false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.mcpCall("todo_get", { id });
   if (!result || typeof result !== "object" || result.error) {
     fmt.error(`Todo ${id} not found in this workspace.`);
@@ -11793,7 +11977,11 @@ var assignCommand = new Command("assign").description("Assign a card to a specia
     process.exit(3);
   }
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.mcpCall("todo_assign", built.args);
   if (isToolError(result)) {
     fmt.error(toolErrorMessage(result));
@@ -11821,7 +12009,11 @@ var runCommand = new Command("run").description("Start the agent already queued
     noColor: false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.post(
     `/api/todos/${encodeURIComponent(id)}/run`,
     {}
@@ -11909,7 +12101,11 @@ var claimCommand = new Command("claim").description("Preflight + atomically clai
       noColor: parentOpts.noColor || false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     if (!options.force) {
       tryGit(["fetch", "--quiet", "origin", "main"]);
       const log = tryGit(["log", "--format=%s", "-n", "10", "origin/main"]) ?? tryGit(["log", "--format=%s", "-n", "10", "FETCH_HEAD"]) ?? "";
@@ -12487,6 +12683,7 @@ function workCommand() {
       }
       const client = new GadClient({
         token: auth.token,
+        getToken: auth.getToken,
         apiUrl: auth.apiUrl
       });
       const data = await client.get("/api/work/status", {
@@ -12511,6 +12708,7 @@ function workCommand() {
       const auth = await resolveAuth();
       const client = new GadClient({
         token: auth.token,
+        getToken: auth.getToken,
         apiUrl: auth.apiUrl
       });
       const report = options.file ? JSON.parse(readFileSync(options.file, "utf8")) : await collectWorkStatus({
@@ -13044,7 +13242,11 @@ function normalizeResponse(value) {
 }
 async function createClient2() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function renderGuardrails(data, cmd) {
   const output = globalOutputOpts(cmd);
@@ -14171,7 +14373,7 @@ async function ensureHookCredential(opts) {
 }
 
 // src/lib/mcp-doctor.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // src/lib/mcp-target.ts
 var GREAT_ARROW_HOSTS = /* @__PURE__ */ new Set([
@@ -14510,7 +14712,7 @@ function connectorGuidance(entries) {
   return 'If you ALSO installed the Great Arrow connector on claude.ai, Claude Code counts it as a second server and nags "needs authentication" forever. Silence the duplicate by adding its name to "deniedMcpServers" in ~/.claude/settings.json ("disabledMcpServers" is not a valid key; "disabledMcpjsonServers" only covers .mcp.json servers).';
 }
 function fingerprint(value) {
-  return createHash2("sha256").update(value).digest("hex").slice(0, 12);
+  return createHash3("sha256").update(value).digest("hex").slice(0, 12);
 }
 function describeStoredCredential(raw) {
   const trimmed = raw?.trim();
@@ -14784,7 +14986,11 @@ async function checkApi(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     await client.get("/api/health");
     return {
@@ -14810,7 +15016,11 @@ async function checkCliVersion(auth) {
       hint: "Fix authentication first, then run 'gad doctor' again."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     const result = await client.get("/api/mcp/version");
     const cli = result.updates?.cli ?? result.cli ?? {};
@@ -14856,7 +15066,11 @@ async function checkIntegrations(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     const result = await client.mcpCall("integrations_list", {});
     const data = result ?? {};
@@ -14897,7 +15111,11 @@ async function checkMcp(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     await client.mcpCall("workspace_introspect", {});
     return {
@@ -15505,7 +15723,11 @@ var integrationListColumns = [
 ];
 async function createClient3() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function formatErrorDetail(rawError) {
   if (rawError === null || rawError === void 0) return null;
@@ -15616,13 +15838,13 @@ var integrationsCommand = new Command("integrations").description("Manage connec
 var integrations_default = integrationsCommand;
 
 // src/commands/mcp.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { hostname } from "node:os";
 
 // src/lib/mcp-bridge.ts
 import { createInterface as createInterface2 } from "node:readline";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var BRIDGE_CLIENT_ID = "gad-cli";
 var DEFAULT_API_URL2 = "https://www.greatarrow.ai";
 var DEFAULT_TIMEOUT_MS3 = 9e4;
@@ -15785,7 +16007,7 @@ async function runStdioBridge(options) {
 `));
   const endpoint = `${options.auth.apiUrl}/api/mcp`;
   const timeoutMs = Number(env4.MEMORY_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS3);
-  const sessionId = (env4.GAD_SESSION_ID ?? env4.MEMORY_SESSION_ID)?.trim() || `${BRIDGE_CLIENT_ID}:${Date.now()}-${randomUUID().slice(0, 8)}`;
+  const sessionId = (env4.GAD_SESSION_ID ?? env4.MEMORY_SESSION_ID)?.trim() || `${BRIDGE_CLIENT_ID}:${Date.now()}-${randomUUID2().slice(0, 8)}`;
   const repoUrl = (env4.GAD_REPO_URL ?? env4.MEMORY_REPO_URL)?.trim() || detectGitOrigin3();
   const workspaceId = (env4.GAD_WORKSPACE_ID ?? env4.GAD_WORKSPACE)?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(repoUrl) });
   const headers = buildBridgeHeaders({
@@ -15949,7 +16171,11 @@ async function mcpJsonAtRiskOfCommit(dir) {
 }
 async function createClient4() {
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   return { client, apiUrl: auth.apiUrl };
 }
 function generateMcpConfig(client, apiUrl, token, repoUrl) {
@@ -15984,7 +16210,7 @@ function generateMcpConfig(client, apiUrl, token, repoUrl) {
     Authorization: `Bearer ${token}`,
     "X-MCP-Client": CLIENT_IDS[client],
     "X-Device-Name": deviceName,
-    "X-Machine-Id": createHash3("sha256").update(rawHost).digest("hex"),
+    "X-Machine-Id": createHash4("sha256").update(rawHost).digest("hex"),
     [GAD_INSTALL_HEADER]: GAD_INSTALL_VERSION,
     ...repoUrl ? { "X-Repo-URL": repoUrl } : {}
   };
@@ -16249,7 +16475,11 @@ var testCommand = new Command("test").description(
   const c = createColor(false);
   const auth = await resolveAuth();
   const apiUrl = auth.apiUrl;
-  const client = new GadClient({ token: auth.token, apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl
+  });
   const verbose = !jsonFlag;
   const checks = [
     await checkDns(apiUrl, verbose, c),
@@ -16788,6 +17018,7 @@ function smokeCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     if (!isJson && !isQuiet) {
@@ -16835,7 +17066,11 @@ var agentListColumns = [
 ];
 async function buildClient2() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function invokeOutcome(data) {
   if (typeof data === "string") {
@@ -16985,6 +17220,7 @@ function askCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     const fmt = createFormatter({
@@ -17977,26 +18213,36 @@ function authHeaders(token) {
 function origin(apiUrl) {
   return apiUrl.replace(/\/+$/, "");
 }
-function appAwareFetch(apiUrl, token, base) {
-  return (input, init) => {
+function appAwareFetch(apiUrl, token, base, getToken2) {
+  return async (input, init) => {
     const target = typeof input === "string" ? input : String(input);
-    if (!target.startsWith("/")) return base(input, init);
-    return base(`${origin(apiUrl)}${target}`, {
+    const relative = target.startsWith("/") && !target.startsWith("//");
+    if (!relative && !target.startsWith(`${origin(apiUrl)}/`))
+      return base(input, init);
+    const currentToken = getToken2 ? await withTimeout(15e3, () => getToken2()) : token;
+    return base(relative ? `${origin(apiUrl)}${target}` : target, {
       ...init,
       headers: {
         ...init?.headers,
-        ...authHeaders(token)
+        ...authHeaders(currentToken)
       }
     });
   };
 }
 async function withTimeout(ms, run2) {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), ms);
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      const error = new DOMException("Request timed out", "AbortError");
+      controller.abort(error);
+      reject(error);
+    }, ms);
+  });
   try {
-    return await run2(controller.signal);
+    return await Promise.race([run2(controller.signal), deadline]);
   } finally {
-    clearTimeout(timer);
+    if (timer) clearTimeout(timer);
   }
 }
 function readHandoff(payload) {
@@ -18061,7 +18307,7 @@ async function askForTheTurn(opts) {
   if (!response.ok) {
     throw new LocalTurnFailed(
       "handoff",
-      response.status === 401 || response.status === 403 ? "Sign in again \u2014 this computer is not allowed to ask for work." : `Great Arrow refused that (${response.status}).`,
+      response.status === 401 ? "Sign in again \u2014 this computer is not allowed to ask for work." : response.status === 403 ? "This connection needs permission. Review its scopes and workspace access at /account/connections." : `Great Arrow refused that (${response.status}).`,
       true
     );
   }
@@ -18123,14 +18369,14 @@ async function handBack(opts) {
 }
 async function answerOnThisComputer(opts) {
   const base = opts.fetchImpl ?? fetch;
-  const doFetch = appAwareFetch(opts.apiUrl, opts.token, base);
+  const doFetch = appAwareFetch(opts.apiUrl, opts.token, base, opts.getToken);
   const handoff = await askForTheTurn({
     apiUrl: opts.apiUrl,
     token: opts.token,
     question: opts.question,
     sessionId: opts.sessionId ?? null,
     timezone: opts.timezone,
-    doFetch: base
+    doFetch
   });
   if (!handoff) {
     return { answeredHere: false, reason: "answered_by_great_arrow" };
@@ -18172,7 +18418,7 @@ async function answerOnThisComputer(opts) {
       outputTokens: result.outputTokens,
       promptCharacters: result.promptCharacters,
       latencyMs: Date.now() - startedAt,
-      doFetch: base
+      doFetch
     });
     return {
       answeredHere: true,
@@ -18192,7 +18438,7 @@ async function answerOnThisComputer(opts) {
       outputTokens: void 0,
       promptCharacters: 0,
       latencyMs: Date.now() - startedAt,
-      doFetch: base
+      doFetch
     });
     throw new LocalTurnFailed(
       "writing",
@@ -18425,7 +18671,11 @@ function checkCommand() {
     const provider = readProvider(options.app);
     const baseUrl = typeof options.url === "string" && options.url ? options.url : LOCAL_PROVIDER_PRESETS[provider].baseUrl;
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const fmt = createFormatter({
       json: g.json,
       quiet: g.quiet,
@@ -18500,7 +18750,11 @@ function statusCommand2() {
   return new Command("status").description("Show what is set up for models on this computer").action(async (_options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const payload = await client.mcpCall(
       "model_local_get",
       {},
@@ -18568,7 +18822,11 @@ function offCommand() {
   return new Command("off").description("Stop answering with a model on this computer").action(async (_options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const fmt = createFormatter({
       json: g.json,
       quiet: g.quiet,
@@ -18599,6 +18857,7 @@ function askHereCommand() {
       report = await answerOnThisComputer({
         apiUrl: auth.apiUrl,
         token: auth.token,
+        getToken: auth.getToken,
         question,
         sessionId: typeof options.session === "string" ? options.session : null,
         timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
@@ -18712,6 +18971,7 @@ function statusCommand3() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     const fmt = createFormatter({
@@ -18889,7 +19149,11 @@ function openCommand() {
   ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const result = await client.mcpCall("surfaces_list", {
       query: surface
     });
@@ -18977,7 +19241,11 @@ function nextCommand() {
       noColor: g.noColor
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     let identityStatus = null;
     try {
       const who = await client.mcpCall("workspace_introspect", {});
@@ -19040,7 +19308,11 @@ function discoverCommand() {
       noColor: g.noColor
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const parsed = opts.limit ? Number.parseInt(opts.limit, 10) : NaN;
     const args = Number.isFinite(parsed) && parsed > 0 ? { limit: parsed } : {};
     const result = await client.mcpCall("did_you_know", args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {