@meistrari/tela-cli 1.9.1 → 1.9.2

package/README.md

@@ -40,7 +40,11 @@ tela agent feedback --list --apply <all|select> --json --verbose
 
 `auth login` uses device flow and creates or updates a context backed by the
 same Keychain credential adapter as Dock. `auth token` may refresh that session
-before returning metadata or printing a raw token.
+before returning metadata or printing a raw token. On macOS, renewing a Keychain
+session is delegated to Tela Dock, so sandboxed agents only read the saved
+credential. The CLI opens the installed Dock in the background if needed;
+update both Dock and the CLI to use this flow. A valid access token can still be
+read without Dock. `TELA_HOME` must refer to the same configuration as Dock.
 
 The top-level `api`, `docs`, `update`, `whoami`, and `token` aliases on `tela`
 remain available during migration. Service catalog and per-service environment
@@ -85,7 +89,10 @@ The CLI uses the credential adapter contract from `local-config`.
 - expired user-session access tokens with a refresh token are reported as
   `refreshable`, not as a hard auth failure.
 - `auth token` refreshes expired user-session access tokens when a refresh token
-  is available.
+  is available. For macOS Keychain sessions, Dock performs both the exchange
+  and persistence. If Dock is unavailable or too old, the command fails before
+  trying a direct refresh in the CLI; it never silently falls back to the
+  sandbox write that could consume and lose a rotating refresh token.
 - unsupported providers report diagnostic status instead of exposing secrets.
 
 `auth token --raw` is the explicit token-export escape hatch for shell scripts.
@@ -115,3 +122,18 @@ node scripts/install-skills.cjs --quiet
 
 The published package does not require `tsx`, TypeScript, or esbuild at
 postinstall time.
+
+### Native macOS renewal regression
+
+After `corepack pnpm cli:build`, run:
+
+```bash
+corepack pnpm exec tsx scripts/verify-session-renewal-macos.ts
+```
+
+This uses a disposable Keychain item and a local auth fixture. It reproduces
+`Operation not permitted` with `sandbox-exec`, proves the old path consumed a
+refresh token before failing to save, then runs the compiled CLI under the same
+restriction against Dock's broker implementation. It verifies persistence in
+real Keychain, another expired session, and three concurrent CLI processes. The
+fixture deletes its Keychain item and temporary config afterward.

package/dist/commands/auth.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAuthCommand = runAuthCommand;
 exports.formatDeviceFlowInstructions = formatDeviceFlowInstructions;
+const refresh_session_1 = require("../refresh-session");
 const node_child_process_1 = require("node:child_process");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
@@ -295,7 +296,7 @@ async function resolveToken(options) {
         throw new Error(`Missing credential for Tela context ${resolved.id}`);
     }
     const credential = originalCredential.kind === 'user-session'
-        ? await (0, tela_local_config_1.refreshUserSessionCredential)(resolved.environment, credentialRef, originalCredential, credentials)
+        ? await (0, refresh_session_1.refreshCliSession)(resolved, originalCredential, credentials)
         : originalCredential;
     const refreshed = credential !== originalCredential;
     if (options.kind === 'access-token') {