@neocompose/cli 0.36.12 → 0.36.13

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.36.13] - 2026-08-22
+
+### Fixed
+
+- Refresh short-lived Convex JWTs during long-running commands. History plan
+  polling and other multi-request operations now keep using the existing CLI
+  device session instead of failing when the initial 15-minute JWT expires.
+
 ## [0.36.12] - 2026-08-22
 
 ### Fixed

package/dist/neo.mjs

@@ -105821,6 +105821,7 @@ var init_api = __esm({
 
 // src/convex.ts
 import { ConvexHttpClient } from "convex/browser";
+import { Buffer as Buffer2 } from "node:buffer";
 async function mintConvexJwt(apiBaseUrl) {
   const sessionToken = loadToken(apiBaseUrl);
   if (sessionToken === null) {
@@ -105878,9 +105879,10 @@ async function resolveConvexUrl(workspace) {
 }
 async function createConvexClient(workspace) {
   const convexUrl = await resolveConvexUrl(workspace);
-  const client = new ConvexHttpClient(convexUrl);
-  client.setAuth(await mintConvexJwt(workspace.config.apiBaseUrl));
-  return client;
+  return await createAuthenticatedConvexClient(
+    convexUrl,
+    workspace.config.apiBaseUrl
+  );
 }
 async function createConvexClientForApi(apiBaseUrl) {
   const fromEnv = process.env.NEXT_PUBLIC_CONVEX_URL;
@@ -105898,9 +105900,52 @@ async function createConvexClientForApi(apiBaseUrl) {
     });
     convexUrl = await discoverConvexUrlFromProjectsResponse(response);
   }
-  const client = new ConvexHttpClient(convexUrl);
-  client.setAuth(await mintConvexJwt(apiBaseUrl));
-  return client;
+  return await createAuthenticatedConvexClient(convexUrl, apiBaseUrl);
+}
+async function createAuthenticatedConvexClient(convexUrl, apiBaseUrl) {
+  const tokenCache = new ConvexJwtCache(apiBaseUrl);
+  const initialToken = await tokenCache.getToken();
+  const authenticatedFetch = async (input, init) => {
+    const headers = new Headers(
+      init?.headers ?? (input instanceof Request ? input.headers : void 0)
+    );
+    headers.set("Authorization", `Bearer ${await tokenCache.getToken()}`);
+    return await fetch(input, { ...init, headers });
+  };
+  return new ConvexHttpClient(convexUrl, {
+    auth: initialToken,
+    fetch: authenticatedFetch
+  });
+}
+function convexJwtExpiration(token) {
+  const segments = token.split(".");
+  if (segments.length !== 3) {
+    throw new Error("Convex token response is not a three-segment JWT.");
+  }
+  let payloadJson;
+  try {
+    payloadJson = Buffer2.from(segments[1], "base64url").toString("utf8");
+  } catch {
+    throw new Error(
+      "Convex token response has an invalid JWT payload encoding."
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadJson);
+  } catch {
+    throw new Error("Convex token response has an invalid JWT payload.");
+  }
+  if (typeof payload !== "object" || payload === null) {
+    throw new Error("Convex token response has a non-object JWT payload.");
+  }
+  if (!("exp" in payload)) {
+    throw new Error('Convex token response JWT is missing an "exp" claim.');
+  }
+  if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+    throw new Error('Convex token response JWT has an invalid "exp" claim.');
+  }
+  return payload.exp * 1e3;
 }
 async function discoverConvexUrlFromProjectsResponse(response) {
   const headerUrl = response.headers.get("x-neo-convex-url");
@@ -105925,7 +105970,7 @@ function missingProjectsConvexUrlError() {
     "Could not discover the Convex deployment URL (/api/projects supplied neither a non-empty x-neo-convex-url header nor a non-empty convexUrl JSON field)."
   );
 }
-var generatedApiModule, generatedApiValue, api2;
+var generatedApiModule, generatedApiValue, api2, CONVEX_JWT_REFRESH_LEEWAY_MS, ConvexJwtCache;
 var init_convex = __esm({
   "src/convex.ts"() {
     "use strict";
@@ -105938,6 +105983,38 @@ var init_convex = __esm({
       throw new Error("The generated Convex API module did not export api.");
     }
     api2 = generatedApiValue;
+    CONVEX_JWT_REFRESH_LEEWAY_MS = 6e4;
+    ConvexJwtCache = class {
+      constructor(apiBaseUrl) {
+        this.apiBaseUrl = apiBaseUrl;
+      }
+      apiBaseUrl;
+      token = null;
+      expiresAt = 0;
+      refreshPromise = null;
+      async getToken() {
+        if (this.token !== null && Date.now() + CONVEX_JWT_REFRESH_LEEWAY_MS < this.expiresAt) {
+          return this.token;
+        }
+        const pending = this.refreshPromise ?? this.refresh();
+        this.refreshPromise = pending;
+        try {
+          return await pending;
+        } finally {
+          if (this.refreshPromise === pending) this.refreshPromise = null;
+        }
+      }
+      async refresh() {
+        const token = await mintConvexJwt(this.apiBaseUrl);
+        const expiresAt = convexJwtExpiration(token);
+        if (expiresAt <= Date.now()) {
+          throw new Error("Convex token response contains an expired JWT.");
+        }
+        this.token = token;
+        this.expiresAt = expiresAt;
+        return token;
+      }
+    };
   }
 });
 
@@ -114668,7 +114745,7 @@ var init_registry2 = __esm({
     PROJECT_SCHEMA_CONTRACT = Object.freeze({
       formatVersion: 3,
       contractVersion: "3.14",
-      cliVersion: "0.36.12",
+      cliVersion: "0.36.13",
       projectFileUploadBatchSize: 32,
       documentRecords: {
         member: {
@@ -121287,7 +121364,7 @@ There is no --keep-current: preserving current semantic state defines flatten.
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.command === "--version") {
-    console.log("0.36.12");
+    console.log("0.36.13");
     return;
   }
   if (args.command === null || args.command === "help" || args.command === "--help" || args.command === "-h") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neocompose/cli",
-  "version": "0.36.12",
+  "version": "0.36.13",
   "description": "Neo Compose native project-source CLI with bidirectional sync.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.5.2",
-    "convex": "^1.40.0",
+    "convex": "^1.45.0",
     "ignore": "^7.0.6"
   },
   "devDependencies": {

package/skills/neocompose-cli/SKILL.md

@@ -9,7 +9,7 @@ description: >-
   `@neocompose/cli` or `node cli/bin/neo.mjs` in the neo-compose repository.
 ---
 
-<!-- reviewed-through-cli: 0.36.12 -->
+<!-- reviewed-through-cli: 0.36.13 -->
 
 # Neo Compose CLI
 

package/skills/neocompose-cli/references/cli-development.md

@@ -83,7 +83,7 @@ wrappers.
 The marker near the top of `SKILL.md` must exactly match the package version:
 
 ```html
-<!-- reviewed-through-cli: 0.36.12 -->
+<!-- reviewed-through-cli: 0.36.13 -->
 ```
 
 The quoted version above is checked too, so this instruction cannot go stale

package/skills/neocompose-cli/references/commands-and-sync.md

@@ -146,7 +146,7 @@ Require the release login profile for release operations.
 History rewrites require project owner or admin authority. `prune` and
 `flatten` create immutable plans without deleting anything. `apply` starts the
 destructive run after the plan has sealed. Production also requires the exact
-scope confirmation shown by the plan and a recent configured backup. CLI
+scope confirmation shown by the plan. CLI
 tokens issued before 0.36.12 do not hold the history write grant, so run
 `neo logout` followed by `neo login` once after upgrading.
 
@@ -167,7 +167,9 @@ targeted repair is handed instead of scanning a project to rediscover them.
 The Node CLI talks directly to authenticated Convex APIs through the
 session-gated CAS boundary. Tokens use the OS credential store when available
 and a protected file only as fallback. Use `NEO_COMPOSE_TOKEN` or
-`--token-stdin` in CI. The editor profile cannot publish releases; server
+`--token-stdin` in CI. The CLI automatically re-mints its short-lived Convex
+JWT before expiry during long-running commands; the stored device session
+remains the credential. The editor profile cannot publish releases; server
 scopes remain the security boundary.
 
 `neo logout [--api <url>]` deletes the stored credential for exactly one API