@great-arrow/cli 0.1.53 → 0.1.55

package/dist/index.js

@@ -9402,7 +9402,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.53";
+var CLI_VERSION = "0.1.55";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9411,6 +9411,9 @@ var GAD_CLI_VERSION_HEADER = "X-GAD-CLI-Version";
 // src/commands/login.ts
 import { execFile } from "node:child_process";
 
+// src/lib/credentials.ts
+import { randomUUID } from "node:crypto";
+
 // src/lib/keychain.ts
 import { mkdir, writeFile, readFile, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -9532,7 +9535,12 @@ async function loadStoredCredential() {
   return parseStoredValue(await getToken());
 }
 async function saveOAuthCredential(credential) {
-  return setToken(JSON.stringify(credential));
+  return setToken(
+    JSON.stringify({
+      ...credential,
+      localSessionId: credential.localSessionId || randomUUID()
+    })
+  );
 }
 async function savePatToken(token) {
   return setToken(token);
@@ -9903,14 +9911,33 @@ function toCredential(env4, apiUrl, clientId, now) {
 }
 var TOKEN_POST_TIMEOUT_MS = 8e3;
 async function postToken(apiUrl, form, fetchImpl, timeoutMs = TOKEN_POST_TIMEOUT_MS) {
-  const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
-    method: "POST",
-    headers: TOKEN_HEADERS,
-    body: new URLSearchParams(form).toString(),
-    signal: AbortSignal.timeout(timeoutMs)
+  const controller = new AbortController();
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      const error = new DOMException(
+        "Token exchange timed out.",
+        "TimeoutError"
+      );
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
   });
-  const json = await res.json().catch(() => ({}));
-  return { ok: res.ok, status: res.status, json };
+  const request = async () => {
+    const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
+      method: "POST",
+      headers: TOKEN_HEADERS,
+      body: new URLSearchParams(form).toString(),
+      signal: controller.signal
+    });
+    const json = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, json };
+  };
+  try {
+    return await Promise.race([request(), deadline]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
 }
 async function exchangeCode(opts) {
   const now = opts.now ?? Date.now();
@@ -10364,6 +10391,20 @@ var login_default = loginCommand;
 import { mkdir as mkdir3, open, rm, stat } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import { join as join4 } from "node:path";
+
+// src/lib/oauth/session-identity.ts
+import { createHash as createHash2 } from "node:crypto";
+function credentialSessionId(credential) {
+  return credential.localSessionId || createHash2("sha256").update(
+    JSON.stringify([
+      credential.clientId,
+      credential.apiUrl,
+      credential.refreshToken
+    ])
+  ).digest("hex");
+}
+
+// src/lib/auth.ts
 var REFRESH_SKEW_MS = 12e4;
 var inflightRefresh = null;
 var REFRESH_LOCK_STALE_MS = 15e3;
@@ -10387,7 +10428,12 @@ async function acquireRefreshLock() {
       await handle.close();
       return true;
     } catch (err) {
-      if (err.code !== "EEXIST") return true;
+      if (err.code !== "EEXIST") {
+        throw networkError(
+          "Could not lock session renewal.",
+          "Check local credential storage and retry; your session has been kept."
+        );
+      }
     }
     const age = await stat(path10).then((st) => Date.now() - st.mtimeMs).catch(() => Number.POSITIVE_INFINITY);
     if (age > REFRESH_LOCK_STALE_MS) {
@@ -10416,8 +10462,13 @@ async function storedPairOtherThan(ours) {
   } catch (err) {
     debugSwallow("refresh.reread", err);
   }
-  if (stored?.kind !== "oauth") return null;
-  if (stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
+  if (stored?.kind !== "oauth") {
+    throw authError(
+      "The original session changed or ended during renewal.",
+      "Restart this command with your current connection."
+    );
+  }
+  if (ours.localSessionId && credentialSessionId(stored.credential) !== credentialSessionId(ours) || stored.credential.clientId !== ours.clientId || stored.credential.apiUrl.replace(/\/$/, "") !== ours.apiUrl.replace(/\/$/, "")) {
     throw networkError(
       "The stored session changed while renewing it.",
       "Retry the command with the current session."
@@ -10443,11 +10494,32 @@ async function resolveAuth() {
   if (stored?.kind === "oauth") {
     const fresh = await ensureFreshAccessToken(stored.credential);
     warnLegacyApiUrl(fresh.apiUrl);
+    const originalSessionId = credentialSessionId(fresh);
+    const originalApiUrl = fresh.apiUrl;
+    const originalClientId = fresh.clientId;
     return withWorkspace({
       token: fresh.accessToken,
       apiUrl: fresh.apiUrl,
       tokenType: "oauth",
-      expiresAt: fresh.accessExpiresAt
+      expiresAt: fresh.accessExpiresAt,
+      getToken: async () => {
+        const latestConfig = await loadConfig();
+        const latest = await loadStoredCredential();
+        if ((latestConfig.api_url || DEFAULT_API_URL) !== configApiUrl || (latestConfig.default_workspace || void 0) !== activeWorkspace || process.env.GAD_TOKEN || latest?.kind !== "oauth" || credentialSessionId(latest.credential) !== originalSessionId || latest.credential.apiUrl !== originalApiUrl || latest.credential.clientId !== originalClientId) {
+          throw authError(
+            "The original session or workspace changed or ended.",
+            "Restart this command with your current connection."
+          );
+        }
+        const renewed = await ensureFreshAccessToken(latest.credential);
+        if (credentialSessionId(renewed) !== originalSessionId) {
+          throw authError(
+            "The original session changed.",
+            "Restart this command with your current connection."
+          );
+        }
+        return renewed.accessToken;
+      }
     });
   }
   if (stored?.kind === "pat") {
@@ -10502,10 +10574,6 @@ async function ensureFreshAccessToken(credential) {
   if (Date.now() < credential.accessExpiresAt - REFRESH_SKEW_MS) {
     return credential;
   }
-  if (Date.now() >= credential.refreshExpiresAt) {
-    await clearStoredCredential();
-    throw sessionExpired();
-  }
   inflightRefresh ??= doRefresh(credential);
   try {
     return await inflightRefresh;
@@ -10529,12 +10597,32 @@ async function doRefresh(credential) {
         "Retry shortly; your saved session has been kept."
       );
     }
-    const refreshed = await refreshTokens({
+    if (Date.now() >= current.refreshExpiresAt) {
+      await clearStoredCredential();
+      throw sessionExpired();
+    }
+    const rotated = await refreshTokens({
       apiUrl: current.apiUrl,
       clientId: current.clientId,
       refreshToken: current.refreshToken
     });
-    await saveOAuthCredential(refreshed);
+    const refreshed = {
+      ...rotated,
+      localSessionId: credentialSessionId(current)
+    };
+    const saved = await loadStoredCredential();
+    if (saved?.kind !== "oauth" || credentialSessionId(saved.credential) !== credentialSessionId(current)) {
+      throw authError(
+        "The original session changed or ended during renewal.",
+        "Restart this command with your current connection."
+      );
+    }
+    if (!await saveOAuthCredential(refreshed)) {
+      throw networkError(
+        "Could not persist the renewed session.",
+        "Check your credential storage before retrying."
+      );
+    }
     return refreshed;
   } catch (err) {
     if (err instanceof RefreshRejected) {
@@ -10890,12 +10978,14 @@ function sleep(ms) {
 }
 var GadClient = class {
   token;
+  getToken;
   apiUrl;
   repoUrl;
   workspaceId;
   timeout;
   constructor(options) {
     this.token = options.token;
+    this.getToken = options.getToken;
     this.apiUrl = options.apiUrl.replace(/\/$/, "");
     this.repoUrl = options.repoUrl ?? detectGitOrigin();
     this.workspaceId = options.workspaceId?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(this.repoUrl) }) || null;
@@ -10931,8 +11021,28 @@ var GadClient = class {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), effectiveTimeout);
       try {
+        const headers = this.getToken ? new Headers(init.headers) : void 0;
+        if (headers && this.getToken) {
+          const token = await Promise.race([
+            this.getToken(),
+            new Promise((_resolve, reject) => {
+              controller.signal.addEventListener(
+                "abort",
+                () => reject(
+                  networkError(
+                    "Session renewal timed out.",
+                    "Retry shortly; your saved session has been kept."
+                  )
+                ),
+                { once: true }
+              );
+            })
+          ]);
+          headers.set("Authorization", `Bearer ${token}`);
+        }
         const response = await fetch(url, {
           ...init,
+          ...headers ? { headers: Object.fromEntries(headers) } : {},
           signal: controller.signal
         });
         clearTimeout(timer);
@@ -11070,6 +11180,68 @@ var GadClient = class {
     }
     return payload;
   }
+  /**
+   * Own one chat response through body consumption, with the normal workspace
+   * attribution. A received turn is never replayed. The consumer handles either
+   * the versioned local handoff or the actual frontier stream inside this scope.
+   */
+  async withChatResponse(body, consume, options = {}) {
+    const deadlineMs = options.deadlineMs ?? 3e5;
+    if (!Number.isInteger(deadlineMs) || deadlineMs < 1 || deadlineMs > 3e5) {
+      throw new CliError(
+        "Chat deadline must be between 1 and 300000 milliseconds.",
+        3 /* VALIDATION_ERROR */
+      );
+    }
+    const controller = new AbortController();
+    const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
+    const timer = setTimeout(
+      () => controller.abort(new Error("Chat response deadline exceeded.")),
+      deadlineMs
+    );
+    let rejectAbort;
+    let response;
+    const aborted = new Promise((_, reject) => {
+      rejectAbort = () => reject(signal.reason ?? new Error("Chat stopped."));
+      if (signal.aborted) rejectAbort();
+      else signal.addEventListener("abort", rejectAbort, { once: true });
+    });
+    try {
+      return await Promise.race([
+        (async () => {
+          signal.throwIfAborted();
+          response = await fetch(`${this.apiUrl}/api/chat`, {
+            method: "POST",
+            headers: {
+              ...this.buildHeaders(),
+              Accept: "text/event-stream, application/json"
+            },
+            body: JSON.stringify(body),
+            redirect: "error",
+            cache: "no-store",
+            signal
+          });
+          signal.throwIfAborted();
+          if (!response.ok) await this.handleResponse(response);
+          return consume(response, signal);
+        })(),
+        aborted
+      ]);
+    } finally {
+      clearTimeout(timer);
+      if (rejectAbort) signal.removeEventListener("abort", rejectAbort);
+      controller.abort();
+      const body2 = response?.body;
+      if (body2 && !body2.locked)
+        void (async () => {
+          try {
+            await body2.cancel();
+          } catch (error) {
+            debugSwallow("chat.response.cancel", error);
+          }
+        })();
+    }
+  }
   /**
    * Make a GET request to a REST API endpoint.
    *
@@ -11181,6 +11353,7 @@ function whoamiCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     let result;
@@ -11291,7 +11464,11 @@ var detailFields = [
 ];
 async function buildClient() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function extractPreview(item) {
   if (typeof item.content === "string") {
@@ -11469,7 +11646,11 @@ var memberColumns = [
 ];
 async function createClient() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 var listCommand = new Command("list").description("List all accessible workspaces").option("--json", "Output as JSON").action(async (options) => {
   const jsonFlag = Boolean(
@@ -11663,7 +11844,11 @@ var listCommand2 = new Command("list").description("List open todos sorted by pr
       noColor: parentOpts.noColor || false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const args = {
       status: options.status ?? "open"
     };
@@ -11689,7 +11874,11 @@ var createCommand = new Command("create").description("Create a new todo card").
       noColor: false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const args = { title };
     if (options.priority) {
       args.priority = options.priority;
@@ -11717,7 +11906,11 @@ var doneCommand = new Command("done").description("Mark a todo as done").argumen
     noColor: false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   await client.mcpCall("todo_update", { id, status: "done" });
   fmt.success(`Todo ${id} marked as done.`);
 });
@@ -11736,7 +11929,11 @@ var updateCommand = new Command("update").description("Update a todo's status").
     process.exit(3);
   }
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   await client.mcpCall("todo_update", { id, status: options.status });
   fmt.success(`Todo ${id} updated to status: ${options.status}`);
 });
@@ -11778,7 +11975,11 @@ var getCommand = new Command("get").description("Show one card's full state (ass
     noColor: parentOpts.noColor || false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.mcpCall("todo_get", { id });
   if (!result || typeof result !== "object" || result.error) {
     fmt.error(`Todo ${id} not found in this workspace.`);
@@ -11838,7 +12039,11 @@ var assignCommand = new Command("assign").description("Assign a card to a specia
     process.exit(3);
   }
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.mcpCall("todo_assign", built.args);
   if (isToolError(result)) {
     fmt.error(toolErrorMessage(result));
@@ -11866,7 +12071,11 @@ var runCommand = new Command("run").description("Start the agent already queued
     noColor: false
   });
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   const result = await client.post(
     `/api/todos/${encodeURIComponent(id)}/run`,
     {}
@@ -11954,7 +12163,11 @@ var claimCommand = new Command("claim").description("Preflight + atomically clai
       noColor: parentOpts.noColor || false
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     if (!options.force) {
       tryGit(["fetch", "--quiet", "origin", "main"]);
       const log = tryGit(["log", "--format=%s", "-n", "10", "origin/main"]) ?? tryGit(["log", "--format=%s", "-n", "10", "FETCH_HEAD"]) ?? "";
@@ -12532,6 +12745,7 @@ function workCommand() {
       }
       const client = new GadClient({
         token: auth.token,
+        getToken: auth.getToken,
         apiUrl: auth.apiUrl
       });
       const data = await client.get("/api/work/status", {
@@ -12556,6 +12770,7 @@ function workCommand() {
       const auth = await resolveAuth();
       const client = new GadClient({
         token: auth.token,
+        getToken: auth.getToken,
         apiUrl: auth.apiUrl
       });
       const report = options.file ? JSON.parse(readFileSync(options.file, "utf8")) : await collectWorkStatus({
@@ -13089,7 +13304,11 @@ function normalizeResponse(value) {
 }
 async function createClient2() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function renderGuardrails(data, cmd) {
   const output = globalOutputOpts(cmd);
@@ -14216,7 +14435,7 @@ async function ensureHookCredential(opts) {
 }
 
 // src/lib/mcp-doctor.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // src/lib/mcp-target.ts
 var GREAT_ARROW_HOSTS = /* @__PURE__ */ new Set([
@@ -14555,7 +14774,7 @@ function connectorGuidance(entries) {
   return 'If you ALSO installed the Great Arrow connector on claude.ai, Claude Code counts it as a second server and nags "needs authentication" forever. Silence the duplicate by adding its name to "deniedMcpServers" in ~/.claude/settings.json ("disabledMcpServers" is not a valid key; "disabledMcpjsonServers" only covers .mcp.json servers).';
 }
 function fingerprint(value) {
-  return createHash2("sha256").update(value).digest("hex").slice(0, 12);
+  return createHash3("sha256").update(value).digest("hex").slice(0, 12);
 }
 function describeStoredCredential(raw) {
   const trimmed = raw?.trim();
@@ -14829,7 +15048,11 @@ async function checkApi(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     await client.get("/api/health");
     return {
@@ -14855,7 +15078,11 @@ async function checkCliVersion(auth) {
       hint: "Fix authentication first, then run 'gad doctor' again."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     const result = await client.get("/api/mcp/version");
     const cli = result.updates?.cli ?? result.cli ?? {};
@@ -14901,7 +15128,11 @@ async function checkIntegrations(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     const result = await client.mcpCall("integrations_list", {});
     const data = result ?? {};
@@ -14942,7 +15173,11 @@ async function checkMcp(auth) {
       hint: "Fix authentication first."
     };
   }
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   try {
     await client.mcpCall("workspace_introspect", {});
     return {
@@ -15550,7 +15785,11 @@ var integrationListColumns = [
 ];
 async function createClient3() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function formatErrorDetail(rawError) {
   if (rawError === null || rawError === void 0) return null;
@@ -15661,13 +15900,13 @@ var integrationsCommand = new Command("integrations").description("Manage connec
 var integrations_default = integrationsCommand;
 
 // src/commands/mcp.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { hostname } from "node:os";
 
 // src/lib/mcp-bridge.ts
 import { createInterface as createInterface2 } from "node:readline";
 import { execFileSync as execFileSync6 } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 var BRIDGE_CLIENT_ID = "gad-cli";
 var DEFAULT_API_URL2 = "https://www.greatarrow.ai";
 var DEFAULT_TIMEOUT_MS3 = 9e4;
@@ -15830,7 +16069,7 @@ async function runStdioBridge(options) {
 `));
   const endpoint = `${options.auth.apiUrl}/api/mcp`;
   const timeoutMs = Number(env4.MEMORY_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS3);
-  const sessionId = (env4.GAD_SESSION_ID ?? env4.MEMORY_SESSION_ID)?.trim() || `${BRIDGE_CLIENT_ID}:${Date.now()}-${randomUUID().slice(0, 8)}`;
+  const sessionId = (env4.GAD_SESSION_ID ?? env4.MEMORY_SESSION_ID)?.trim() || `${BRIDGE_CLIENT_ID}:${Date.now()}-${randomUUID2().slice(0, 8)}`;
   const repoUrl = (env4.GAD_REPO_URL ?? env4.MEMORY_REPO_URL)?.trim() || detectGitOrigin3();
   const workspaceId = (env4.GAD_WORKSPACE_ID ?? env4.GAD_WORKSPACE)?.trim() || getCommandWorkspaceTarget({ hasRepo: Boolean(repoUrl) });
   const headers = buildBridgeHeaders({
@@ -15994,7 +16233,11 @@ async function mcpJsonAtRiskOfCommit(dir) {
 }
 async function createClient4() {
   const auth = await resolveAuth();
-  const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
   return { client, apiUrl: auth.apiUrl };
 }
 function generateMcpConfig(client, apiUrl, token, repoUrl) {
@@ -16029,7 +16272,7 @@ function generateMcpConfig(client, apiUrl, token, repoUrl) {
     Authorization: `Bearer ${token}`,
     "X-MCP-Client": CLIENT_IDS[client],
     "X-Device-Name": deviceName,
-    "X-Machine-Id": createHash3("sha256").update(rawHost).digest("hex"),
+    "X-Machine-Id": createHash4("sha256").update(rawHost).digest("hex"),
     [GAD_INSTALL_HEADER]: GAD_INSTALL_VERSION,
     ...repoUrl ? { "X-Repo-URL": repoUrl } : {}
   };
@@ -16294,7 +16537,11 @@ var testCommand = new Command("test").description(
   const c = createColor(false);
   const auth = await resolveAuth();
   const apiUrl = auth.apiUrl;
-  const client = new GadClient({ token: auth.token, apiUrl });
+  const client = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl
+  });
   const verbose = !jsonFlag;
   const checks = [
     await checkDns(apiUrl, verbose, c),
@@ -16833,6 +17080,7 @@ function smokeCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     if (!isJson && !isQuiet) {
@@ -16880,7 +17128,11 @@ var agentListColumns = [
 ];
 async function buildClient2() {
   const auth = await resolveAuth();
-  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+  return new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
 }
 function invokeOutcome(data) {
   if (typeof data === "string") {
@@ -17030,6 +17282,7 @@ function askCommand() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     const fmt = createFormatter({
@@ -18022,26 +18275,36 @@ function authHeaders(token) {
 function origin(apiUrl) {
   return apiUrl.replace(/\/+$/, "");
 }
-function appAwareFetch(apiUrl, token, base) {
-  return (input, init) => {
+function appAwareFetch(apiUrl, token, base, getToken2) {
+  return async (input, init) => {
     const target = typeof input === "string" ? input : String(input);
-    if (!target.startsWith("/")) return base(input, init);
-    return base(`${origin(apiUrl)}${target}`, {
+    const relative = target.startsWith("/") && !target.startsWith("//");
+    if (!relative && !target.startsWith(`${origin(apiUrl)}/`))
+      return base(input, init);
+    const currentToken = getToken2 ? await withTimeout(15e3, () => getToken2()) : token;
+    return base(relative ? `${origin(apiUrl)}${target}` : target, {
       ...init,
       headers: {
         ...init?.headers,
-        ...authHeaders(token)
+        ...authHeaders(currentToken)
       }
     });
   };
 }
 async function withTimeout(ms, run2) {
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), ms);
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      const error = new DOMException("Request timed out", "AbortError");
+      controller.abort(error);
+      reject(error);
+    }, ms);
+  });
   try {
-    return await run2(controller.signal);
+    return await Promise.race([run2(controller.signal), deadline]);
   } finally {
-    clearTimeout(timer);
+    if (timer) clearTimeout(timer);
   }
 }
 function readHandoff(payload) {
@@ -18106,7 +18369,7 @@ async function askForTheTurn(opts) {
   if (!response.ok) {
     throw new LocalTurnFailed(
       "handoff",
-      response.status === 401 || response.status === 403 ? "Sign in again \u2014 this computer is not allowed to ask for work." : `Great Arrow refused that (${response.status}).`,
+      response.status === 401 ? "Sign in again \u2014 this computer is not allowed to ask for work." : response.status === 403 ? "This connection needs permission. Review its scopes and workspace access at /account/connections." : `Great Arrow refused that (${response.status}).`,
       true
     );
   }
@@ -18168,14 +18431,14 @@ async function handBack(opts) {
 }
 async function answerOnThisComputer(opts) {
   const base = opts.fetchImpl ?? fetch;
-  const doFetch = appAwareFetch(opts.apiUrl, opts.token, base);
+  const doFetch = appAwareFetch(opts.apiUrl, opts.token, base, opts.getToken);
   const handoff = await askForTheTurn({
     apiUrl: opts.apiUrl,
     token: opts.token,
     question: opts.question,
     sessionId: opts.sessionId ?? null,
     timezone: opts.timezone,
-    doFetch: base
+    doFetch
   });
   if (!handoff) {
     return { answeredHere: false, reason: "answered_by_great_arrow" };
@@ -18217,7 +18480,7 @@ async function answerOnThisComputer(opts) {
       outputTokens: result.outputTokens,
       promptCharacters: result.promptCharacters,
       latencyMs: Date.now() - startedAt,
-      doFetch: base
+      doFetch
     });
     return {
       answeredHere: true,
@@ -18237,7 +18500,7 @@ async function answerOnThisComputer(opts) {
       outputTokens: void 0,
       promptCharacters: 0,
       latencyMs: Date.now() - startedAt,
-      doFetch: base
+      doFetch
     });
     throw new LocalTurnFailed(
       "writing",
@@ -18470,7 +18733,11 @@ function checkCommand() {
     const provider = readProvider(options.app);
     const baseUrl = typeof options.url === "string" && options.url ? options.url : LOCAL_PROVIDER_PRESETS[provider].baseUrl;
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const fmt = createFormatter({
       json: g.json,
       quiet: g.quiet,
@@ -18545,7 +18812,11 @@ function statusCommand2() {
   return new Command("status").description("Show what is set up for models on this computer").action(async (_options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const payload = await client.mcpCall(
       "model_local_get",
       {},
@@ -18613,7 +18884,11 @@ function offCommand() {
   return new Command("off").description("Stop answering with a model on this computer").action(async (_options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const fmt = createFormatter({
       json: g.json,
       quiet: g.quiet,
@@ -18644,6 +18919,7 @@ function askHereCommand() {
       report = await answerOnThisComputer({
         apiUrl: auth.apiUrl,
         token: auth.token,
+        getToken: auth.getToken,
         question,
         sessionId: typeof options.session === "string" ? options.session : null,
         timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
@@ -18757,6 +19033,7 @@ function statusCommand3() {
     const auth = await resolveAuth();
     const client = new GadClient({
       token: auth.token,
+      getToken: auth.getToken,
       apiUrl: auth.apiUrl
     });
     const fmt = createFormatter({
@@ -18934,7 +19211,11 @@ function openCommand() {
   ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
     const g = globalOutputOpts(command);
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const result = await client.mcpCall("surfaces_list", {
       query: surface
     });
@@ -19022,7 +19303,11 @@ function nextCommand() {
       noColor: g.noColor
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     let identityStatus = null;
     try {
       const who = await client.mcpCall("workspace_introspect", {});
@@ -19085,7 +19370,11 @@ function discoverCommand() {
       noColor: g.noColor
     });
     const auth = await resolveAuth();
-    const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+    const client = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
     const parsed = opts.limit ? Number.parseInt(opts.limit, 10) : NaN;
     const args = Number.isFinite(parsed) && parsed > 0 ? { limit: parsed } : {};
     const result = await client.mcpCall("did_you_know", args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {