@notis_ai/cli 0.2.8 → 0.2.10

package/src/runtime/output.js

@@ -101,6 +101,13 @@ export class OutputManager {
     process.stderr.write(`${message}\n`);
   }
 
+  note(message) {
+    if (this.isMachineMode()) {
+      return;
+    }
+    process.stderr.write(`${message}\n`);
+  }
+
   emitProgress({ phase, message, requestId = null }) {
     if (this.runtime.quiet) {
       return;

package/src/runtime/profiles.js

@@ -1,4 +1,13 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, parse, resolve } from 'node:path';
 import { CliError, EXIT_CODES } from './errors.js';
@@ -8,14 +17,21 @@ export const CONFIG_DIR = join(homedir(), '.notis');
 export const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
 export const WORKSPACE_DIR = join(CONFIG_DIR, 'workspace');
 export const DEFAULT_API_BASE = 'https://api.notis.ai';
+export const BETA_API_BASE = 'https://api-beta.notis.ai';
 export const DEFAULT_PROFILE = 'default';
 const WORKTREE_RUNTIME_FILENAME = join('.context', 'notis-runtime.json');
 const WORKTREE_ROUTING_FILENAME = join('.context', 'notis-routing.json');
-const LOCAL_DEFAULT_API_BASES = new Set([
-  'http://localhost:3001',
-  'http://127.0.0.1:3001',
-]);
 const LOCAL_API_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const LIVE_API_HOSTS = new Set(['api.notis.ai', 'api-beta.notis.ai']);
+// Cross-process write lock over ~/.notis/config.json. Notis Desktop implements
+// the same protocol independently in electron/src/cli-auth.ts (updateConfig);
+// the `${configFile}.write-lock` directory name and these three timings must
+// stay identical on both sides or `notis login` and desktop syncAuth stop
+// excluding each other and clobber stored OAuth tokens. Guarded by the drift
+// test in packages/cli/test/runtime-auth.test.js.
+const CONFIG_WRITE_LOCK_TIMEOUT_MS = 5_000;
+const CONFIG_WRITE_LOCK_STALE_MS = 2_000;
+const CONFIG_WRITE_LOCK_POLL_MS = 10;
 
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
@@ -33,6 +49,7 @@ export function normalizeConfig(rawConfig = {}) {
       profiles[name] = {
         jwt: typeof profile.jwt === 'string' ? profile.jwt : undefined,
         api_base: typeof profile.api_base === 'string' ? profile.api_base : undefined,
+        beta: typeof profile.beta === 'boolean' ? profile.beta : undefined,
         auth_mode: profile.auth_mode === 'dev_portal' ? profile.auth_mode : undefined,
         refresh_token:
           typeof profile.refresh_token === 'string' ? profile.refresh_token : undefined,
@@ -43,6 +60,28 @@ export function normalizeConfig(rawConfig = {}) {
         desktop_app_name:
           typeof profile.desktop_app_name === 'string' ? profile.desktop_app_name : undefined,
         desktop_pid: typeof profile.desktop_pid === 'number' ? profile.desktop_pid : undefined,
+        oauth_access_token:
+          typeof profile.oauth_access_token === 'string' ? profile.oauth_access_token : undefined,
+        oauth_refresh_token:
+          typeof profile.oauth_refresh_token === 'string' ? profile.oauth_refresh_token : undefined,
+        oauth_access_expires_at:
+          typeof profile.oauth_access_expires_at === 'number' ? profile.oauth_access_expires_at : undefined,
+        oauth_refresh_expires_at:
+          typeof profile.oauth_refresh_expires_at === 'number' ? profile.oauth_refresh_expires_at : undefined,
+        oauth_client_id:
+          typeof profile.oauth_client_id === 'string' ? profile.oauth_client_id : undefined,
+        oauth_issuer:
+          typeof profile.oauth_issuer === 'string' ? profile.oauth_issuer : undefined,
+        oauth_api_base:
+          typeof profile.oauth_api_base === 'string' ? profile.oauth_api_base : undefined,
+        oauth_resource:
+          typeof profile.oauth_resource === 'string' ? profile.oauth_resource : undefined,
+        oauth_scopes:
+          Array.isArray(profile.oauth_scopes)
+            ? profile.oauth_scopes.filter((scope) => typeof scope === 'string')
+            : undefined,
+        oauth_user_id:
+          typeof profile.oauth_user_id === 'string' ? profile.oauth_user_id : undefined,
       };
     }
 
@@ -65,6 +104,7 @@ export function normalizeConfig(rawConfig = {}) {
       [DEFAULT_PROFILE]: {
         jwt: typeof raw.jwt === 'string' ? raw.jwt : undefined,
         api_base: typeof raw.api_base === 'string' ? raw.api_base : undefined,
+        beta: typeof raw.beta === 'boolean' ? raw.beta : undefined,
         auth_mode: raw.auth_mode === 'dev_portal' ? raw.auth_mode : undefined,
         refresh_token: typeof raw.refresh_token === 'string' ? raw.refresh_token : undefined,
         access_expires_at:
@@ -74,6 +114,28 @@ export function normalizeConfig(rawConfig = {}) {
         desktop_app_name:
           typeof raw.desktop_app_name === 'string' ? raw.desktop_app_name : undefined,
         desktop_pid: typeof raw.desktop_pid === 'number' ? raw.desktop_pid : undefined,
+        oauth_access_token:
+          typeof raw.oauth_access_token === 'string' ? raw.oauth_access_token : undefined,
+        oauth_refresh_token:
+          typeof raw.oauth_refresh_token === 'string' ? raw.oauth_refresh_token : undefined,
+        oauth_access_expires_at:
+          typeof raw.oauth_access_expires_at === 'number' ? raw.oauth_access_expires_at : undefined,
+        oauth_refresh_expires_at:
+          typeof raw.oauth_refresh_expires_at === 'number' ? raw.oauth_refresh_expires_at : undefined,
+        oauth_client_id:
+          typeof raw.oauth_client_id === 'string' ? raw.oauth_client_id : undefined,
+        oauth_issuer:
+          typeof raw.oauth_issuer === 'string' ? raw.oauth_issuer : undefined,
+        oauth_api_base:
+          typeof raw.oauth_api_base === 'string' ? raw.oauth_api_base : undefined,
+        oauth_resource:
+          typeof raw.oauth_resource === 'string' ? raw.oauth_resource : undefined,
+        oauth_scopes:
+          Array.isArray(raw.oauth_scopes)
+            ? raw.oauth_scopes.filter((scope) => typeof scope === 'string')
+            : undefined,
+        oauth_user_id:
+          typeof raw.oauth_user_id === 'string' ? raw.oauth_user_id : undefined,
       },
     },
   };
@@ -143,6 +205,14 @@ export function resolveWorktreeRuntime(startDir = process.cwd()) {
   const runtime = readJsonFile(runtimePath);
   const apiBase = typeof runtime?.api_base === 'string' ? runtime.api_base.replace(/\/+$/, '') : '';
   const configFile = typeof runtime?.config_file === 'string' ? runtime.config_file : '';
+  const appDevSessionsFile =
+    typeof runtime?.app_dev_sessions_file === 'string' && runtime.app_dev_sessions_file.trim()
+      ? runtime.app_dev_sessions_file.trim()
+      : join(dirname(runtimePath), 'app-dev-sessions.json');
+  const desktopDeepLinkScheme =
+    typeof runtime?.desktop_deep_link_scheme === 'string'
+      ? runtime.desktop_deep_link_scheme.trim()
+      : '';
   const pid = Number(runtime?.dev_pid);
   if (
     runtime?.mode !== 'local-only' ||
@@ -165,6 +235,8 @@ export function resolveWorktreeRuntime(startDir = process.cwd()) {
     ...runtime,
     api_base: apiBase,
     config_file: resolve(dirname(runtimePath), configFile),
+    app_dev_sessions_file: resolve(dirname(runtimePath), appDevSessionsFile),
+    desktop_deep_link_scheme: desktopDeepLinkScheme || undefined,
     runtime_path: runtimePath,
     routing_path: routingPath,
   };
@@ -198,10 +270,126 @@ export function loadConfig(runtime = null) {
   }
 }
 
-export function saveConfig(config, runtime = null) {
+function writeConfig(configFile, config) {
+  mkdirSync(dirname(configFile), { recursive: true });
+  const temporaryFile = `${configFile}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryFile, JSON.stringify(normalizeConfig(config), null, 2), { mode: 0o600 });
+  renameSync(temporaryFile, configFile);
+}
+
+// The lock records who holds it and when they took it. Reclaiming a stale lock
+// by mtime alone is not safe: the reclaimer cannot tell an abandoned lock from
+// one it is about to steal from a live writer, and the victim's own release
+// would then delete the thief's lock and admit a third writer. Both sides are
+// on the same host, so the stored timestamp and Date.now() share a clock.
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync(join(lockDirectory, 'owner'), 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync(candidateDirectory);
+    writeFileSync(
+      join(candidateDirectory, 'owner'),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 0o600 },
+    );
+    try {
+      renameSync(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync(candidateDirectory, { recursive: true, force: true });
+  }
+}
+
+function withConfigWriteLock(runtime, callback) {
   const configFile = resolveConfigFile(runtime);
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
   mkdirSync(dirname(configFile), { recursive: true });
-  writeFileSync(configFile, JSON.stringify(normalizeConfig(config), null, 2), { mode: 0o600 });
+  for (;;) {
+    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale =
+      owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale =
+      !owner
+      && observedMtime !== null
+      && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id
+          ? currentOwner?.id === owner.id
+          : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        // Losing the reclaim race is normal; fall through and keep waiting.
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS,
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      // Never release a lock that was reclaimed from us while we worked.
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+      // The lock may already have been removed after an interrupted write.
+    }
+  }
+}
+
+export function saveConfig(config, runtime = null) {
+  return withConfigWriteLock(runtime, (configFile) => {
+    writeConfig(configFile, config);
+  });
+}
+
+export function updateConfig(updater, runtime = null) {
+  return withConfigWriteLock(runtime, (configFile) => {
+    const current = loadConfig(runtime);
+    const updated = updater(normalizeConfig(current));
+    const next = normalizeConfig(updated ?? current);
+    writeConfig(configFile, next);
+    return next;
+  });
 }
 
 export function getProfile(config, profileName) {
@@ -237,6 +425,48 @@ function isLocalApiBase(value) {
   }
 }
 
+function isLiveApiBase(value) {
+  if (typeof value !== 'string' || !value) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === 'https:' && LIVE_API_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Pick the live Notis API for this profile.
+ *
+ * Beta users (`users.beta = true`, mirrored onto the CLI profile by Desktop
+ * sync / OAuth against api-beta) hit api-beta.notis.ai; everyone else hits
+ * api.notis.ai. Localhost is never a default — only the worktree test lease
+ * (`./dev.sh` / `/notis-tests`) may retarget the CLI at loopback.
+ */
+export function resolveDefaultLiveApiBase(profile = {}) {
+  if (profile.beta === true) {
+    return BETA_API_BASE;
+  }
+  if (profile.beta === false) {
+    return DEFAULT_API_BASE;
+  }
+  if (profile.desktop_app_name === 'Notis Beta') {
+    return BETA_API_BASE;
+  }
+  if (isLiveApiBase(profile.api_base)) {
+    try {
+      if (new URL(profile.api_base).hostname === 'api-beta.notis.ai') {
+        return BETA_API_BASE;
+      }
+    } catch {
+      // fall through
+    }
+  }
+  return DEFAULT_API_BASE;
+}
+
 export function getApiBase(config, profileName, override) {
   if (override) {
     return override;
@@ -247,20 +477,16 @@ export function getApiBase(config, profileName, override) {
   }
   const profile = getProfile(config, profileName);
   const profileApiBase = profile.api_base;
-  const conductorPort = Number.parseInt(process.env.CONDUCTOR_PORT || '', 10);
 
-  // Conductor assigns dynamic local ports. When a workspace is running under
-  // Conductor, treat saved localhost profile values as stale and transparently
-  // retarget the CLI at the active backend port.
-  if (
-    Number.isInteger(conductorPort) &&
-    conductorPort > 0 &&
-    (!profileApiBase || LOCAL_DEFAULT_API_BASES.has(profileApiBase) || isLocalApiBase(profileApiBase))
-  ) {
-    return `http://localhost:${conductorPort + 1}`;
+  // Prefer an explicit non-loopback API stored on the profile (Desktop sync /
+  // OAuth / custom overrides). Ignore stale localhost values — loopback
+  // routing is owned exclusively by the worktree runtime lease under
+  // `/notis-tests`, not by CONDUCTOR_PORT or leftover local profile state.
+  if (typeof profileApiBase === 'string' && profileApiBase && !isLocalApiBase(profileApiBase)) {
+    return profileApiBase.replace(/\/+$/, '');
   }
 
-  return profileApiBase || DEFAULT_API_BASE;
+  return resolveDefaultLiveApiBase(profile);
 }
 
 export function getJwt(config, profileName) {
@@ -335,6 +561,37 @@ export function parseDebugEntitlementOverride(value = process.env.NOTIS_DEBUG_EN
   });
 }
 
+export function getOAuthResource(profile = {}) {
+  if (typeof profile.oauth_resource === 'string' && profile.oauth_resource) {
+    return profile.oauth_resource.replace(/\/+$/, '');
+  }
+  if (typeof profile.oauth_access_token === 'string' && profile.oauth_access_token) {
+    try {
+      const parts = profile.oauth_access_token.split('.');
+      if (parts.length === 3) {
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+        if (typeof payload.aud === 'string' && payload.aud) {
+          return payload.aud.replace(/\/+$/, '');
+        }
+      }
+    } catch {
+      // Legacy tokens without a readable audience fall back below.
+    }
+  }
+  return null;
+}
+
+export function getOAuthApiBase(profile = {}) {
+  if (typeof profile.oauth_api_base === 'string' && profile.oauth_api_base) {
+    return profile.oauth_api_base.replace(/\/+$/, '');
+  }
+  const resource = getOAuthResource(profile);
+  if (resource?.endsWith('/cli')) {
+    return resource.slice(0, -'/cli'.length);
+  }
+  return null;
+}
+
 export function resolveRuntimeProfile(
   globalOptions = {},
   { requireAuth = true, includeDebugEntitlementOverride = true } = {},
@@ -355,11 +612,81 @@ export function resolveRuntimeProfile(
       hints: [{ message: `Expected local API: ${worktreeRuntime.api_base}` }],
     });
   }
-  const apiBase = worktreeRuntime
+  let apiBase = worktreeRuntime
     ? worktreeRuntime.api_base
     : getApiBase(config, profileName, globalOptions.apiBase);
-  const jwt = worktreeRuntime ? getProfile(config, profileName).jwt : getJwt(config, profileName);
   const profile = getProfile(config, profileName);
+  const envJwt = !worktreeRuntime ? process.env.NOTIS_JWT : undefined;
+  const desktopJwt = profile.jwt;
+  const oauthJwt = profile.oauth_access_token;
+  let jwt;
+  let credentialKind;
+
+  if (worktreeRuntime && desktopJwt) {
+    jwt = desktopJwt;
+    credentialKind = 'worktree';
+  } else if (envJwt) {
+    jwt = envJwt;
+    credentialKind = 'env';
+  } else if (
+    desktopJwt
+    && !credentialIsExpired({ credentialKind: 'desktop', jwt: desktopJwt }, profile)
+  ) {
+    jwt = desktopJwt;
+    credentialKind = 'desktop';
+  } else if (
+    oauthJwt
+    && !credentialIsExpired({ credentialKind: 'oauth', jwt: oauthJwt }, profile)
+  ) {
+    jwt = oauthJwt;
+    credentialKind = 'oauth';
+  } else if (oauthJwt && profile.oauth_refresh_token) {
+    // A lapsed OAuth access token remains usable through its rotating refresh
+    // token and must outrank an abandoned, expired Desktop credential.
+    jwt = oauthJwt;
+    credentialKind = 'oauth';
+  } else if (desktopJwt) {
+    jwt = desktopJwt;
+    credentialKind = 'desktop';
+  } else if (oauthJwt) {
+    // Preserve the OAuth credential so transport can refresh it before use.
+    jwt = oauthJwt;
+    credentialKind = 'oauth';
+  }
+  const oauthApiBase = getOAuthApiBase(profile);
+  const oauthResource = getOAuthResource(profile);
+  const normalizedRequestedApiBase = requestedApiBase
+    ? requestedApiBase.replace(/\/+$/, '')
+    : null;
+  if (
+    requireAuth
+    && credentialKind === 'oauth'
+    && normalizedRequestedApiBase
+    && oauthApiBase
+    && normalizedRequestedApiBase !== oauthApiBase
+  ) {
+    const quoteShellArgument = (value) => `'${String(value).replace(/'/g, `'"'"'`)}'`;
+    throw new CliError({
+      code: 'oauth_api_target_mismatch',
+      message: (
+        `The OAuth credential for profile ${profileName} belongs to ${oauthApiBase}, `
+        + `not ${normalizedRequestedApiBase}`
+      ),
+      exitCode: EXIT_CODES.auth,
+      hints: [{
+        command: [
+          'npx --package @notis_ai/cli@latest -- notis',
+          `--profile ${quoteShellArgument(profileName)}`,
+          `--api-base ${quoteShellArgument(normalizedRequestedApiBase)}`,
+          'login --force',
+        ].join(' '),
+        reason: 'Authorize a separate OAuth grant for the requested Notis environment',
+      }],
+    });
+  }
+  if (credentialKind === 'oauth' && oauthApiBase && !requestedApiBase) {
+    apiBase = oauthApiBase;
+  }
   const agentMode = isAgentMode(globalOptions);
   const nonInteractive = isNonInteractive(globalOptions);
   const outputMode = resolveOutputMode(globalOptions);
@@ -386,7 +713,11 @@ export function resolveRuntimeProfile(
   }
   if (
     worktreeRuntime?.expected_user_id &&
-    getJwtSubject(jwt) !== worktreeRuntime.expected_user_id
+    (
+      credentialKind === 'oauth'
+        ? profile.oauth_user_id
+        : getJwtSubject(jwt)
+    ) !== worktreeRuntime.expected_user_id
   ) {
     throw new CliError({
       code: 'dev_runtime_identity_mismatch',
@@ -401,13 +732,25 @@ export function resolveRuntimeProfile(
 
   // An explicit NOTIS_JWT is a complete credential override. Use it verbatim
   // and never replace it with a token later synced by the desktop profile.
-  const usingEnvJwt = !worktreeRuntime && Boolean(process.env.NOTIS_JWT);
+  const usingEnvJwt = credentialKind === 'env';
   return {
     config,
     profileName,
     apiBase,
+    requestedApiBase: normalizedRequestedApiBase,
     jwt,
-    credentialSource: worktreeRuntime ? 'worktree' : usingEnvJwt ? 'env' : 'profile',
+    credentialKind,
+    credentialSource: credentialKind === 'desktop' ? 'profile' : credentialKind,
+    oauthAccessToken: profile.oauth_access_token,
+    oauthRefreshToken: profile.oauth_refresh_token,
+    oauthAccessExpiresAt: profile.oauth_access_expires_at,
+    oauthRefreshExpiresAt: profile.oauth_refresh_expires_at,
+    oauthClientId: profile.oauth_client_id,
+    oauthIssuer: profile.oauth_issuer,
+    oauthApiBase,
+    oauthResource,
+    oauthScopes: profile.oauth_scopes || [],
+    oauthUserId: profile.oauth_user_id,
     desktopAppName: usingEnvJwt ? undefined : profile.desktop_app_name,
     desktopPid: usingEnvJwt ? undefined : profile.desktop_pid,
     agentMode,
@@ -447,11 +790,68 @@ export function getJwtSubject(jwt) {
   }
 }
 
+export function getJwtCanonicalUserId(jwt) {
+  if (typeof jwt !== 'string' || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split('.');
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+    const candidate = payload?.app_metadata?.app_user_id
+      || payload?.user_metadata?.notis_user_id
+      || payload?.notis_user_id;
+    return typeof candidate === 'string' && candidate ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+
 export function isJwtExpired(jwt, nowSeconds = Math.floor(Date.now() / 1000)) {
   const expiration = getJwtExpiration(jwt);
   return expiration !== null && expiration <= nowSeconds;
 }
 
+export function credentialIsExpired(
+  runtime,
+  profile = {},
+  nowSeconds = Math.floor(Date.now() / 1000),
+) {
+  // Older callers and focused transport tests predate `credentialKind`.
+  // Infer only the legacy desktop/env shapes; OAuth must always opt in
+  // explicitly so a scoped token can never be mistaken for a Supabase JWT.
+  const credentialKind = runtime?.credentialKind
+    || (runtime?.credentialSource === 'env' ? 'env' : 'desktop');
+  switch (credentialKind) {
+    case 'oauth': {
+      const expiration = Number(profile.oauth_access_expires_at);
+      return !Number.isFinite(expiration) || expiration <= nowSeconds;
+    }
+    case 'env':
+      // NOTIS_JWT is a complete override. Never combine it with expiry
+      // metadata left behind by a desktop credential in the same profile.
+      // A token with no readable `exp` is a personal API key, which never
+      // expires, so let the server rather than the CLI reject it.
+      {
+        const expiration = getJwtExpiration(runtime?.jwt);
+        return expiration !== null && expiration <= nowSeconds;
+      }
+    case 'worktree':
+    case 'desktop': {
+      const rawExpiration = profile.access_expires_at ?? getJwtExpiration(runtime?.jwt);
+      // Every selected credential must carry an independently verifiable
+      // expiry. Missing or malformed expiry metadata fails closed.
+      if (rawExpiration === null || rawExpiration === undefined || rawExpiration === '') {
+        return true;
+      }
+      const expiration = Number(rawExpiration);
+      return !Number.isFinite(expiration) || expiration <= nowSeconds;
+    }
+    default:
+      return true;
+  }
+}
+
 export function workspacePath(appId) {
   return join(WORKSPACE_DIR, appId);
 }

package/src/runtime/transport.js

@@ -3,12 +3,14 @@ import { createReadStream } from 'node:fs';
 import { CliError, EXIT_CODES } from './errors.js';
 import {
   DEFAULT_PROFILE,
+  credentialIsExpired,
   getProfile,
   getJwtSubject,
   isJwtExpired,
   loadConfig,
 } from './profiles.js';
 import { createExpiredAuthError, createInvalidAuthHints } from './desktop-auth.js';
+import { refreshOAuthCredential } from './oauth.js';
 
 function escapeMultipartHeaderValue(value) {
   return String(value ?? '')
@@ -155,16 +157,18 @@ function normalizeBackendError(status, payload, runtime) {
   });
 }
 
-function reloadJwtFromConfig(runtime) {
-  if (runtime.credentialSource === 'env') {
+function reloadJwtFromConfig(runtime, loadedProfile = null) {
+  if (runtime.credentialKind === 'env' || runtime.credentialKind === 'oauth') {
     return false;
   }
   const profileName = runtime.profileName || DEFAULT_PROFILE;
-  let profile;
-  try {
-    profile = getProfile(loadConfig(runtime.worktreeRuntime), profileName);
-  } catch {
-    return false;
+  let profile = loadedProfile;
+  if (!profile) {
+    try {
+      profile = getProfile(loadConfig(runtime.worktreeRuntime), profileName);
+    } catch {
+      return false;
+    }
   }
   const nextJwt = typeof profile.jwt === 'string' && profile.jwt ? profile.jwt : null;
   if (!nextJwt || nextJwt === runtime.jwt) {
@@ -183,6 +187,7 @@ function reloadJwtFromConfig(runtime) {
     });
   }
   runtime.jwt = nextJwt;
+  runtime.credentialKind = runtime.worktreeRuntime ? 'worktree' : 'desktop';
   runtime.desktopAppName = profile.desktop_app_name;
   runtime.desktopPid = profile.desktop_pid;
   return true;
@@ -200,8 +205,25 @@ export async function httpRequest({
   // token. Each CLI request only consumes the newest access token it synced to
   // disk, avoiding refresh-token races between independent CLI processes and
   // the running desktop session.
-  reloadJwtFromConfig(runtime);
-  if (requireAuth && isJwtExpired(runtime.jwt)) {
+  let currentProfile;
+  if (runtime.credentialKind === 'oauth') {
+    if (requireAuth && credentialIsExpired(runtime, {
+      oauth_access_expires_at: runtime.oauthAccessExpiresAt,
+    })) {
+      await refreshOAuthCredential(runtime);
+    }
+    currentProfile = getProfile(
+      loadConfig(runtime.worktreeRuntime),
+      runtime.profileName,
+    );
+  } else {
+    currentProfile = getProfile(
+      loadConfig(runtime.worktreeRuntime),
+      runtime.profileName,
+    );
+    reloadJwtFromConfig(runtime, currentProfile);
+  }
+  if (requireAuth && credentialIsExpired(runtime, currentProfile)) {
     throw createExpiredAuthError(runtime);
   }
 
@@ -260,7 +282,9 @@ export async function httpRequest({
     }
 
     if (response.status === 401) {
-      const refreshed = reloadJwtFromConfig(runtime) && !isJwtExpired(runtime.jwt);
+      const refreshed = runtime.credentialKind === 'oauth'
+        ? await refreshOAuthCredential(runtime)
+        : reloadJwtFromConfig(runtime) && !isJwtExpired(runtime.jwt);
       if (refreshed) {
         if (requireAuth && runtime.jwt) {
           headers.Authorization = `Bearer ${runtime.jwt}`;
@@ -285,7 +309,13 @@ export async function httpRequest({
     clearTimeout(timeout);
 
     if (!response.ok) {
-      if (response.status === 401 && isJwtExpired(runtime.jwt)) {
+      if (
+        response.status === 401
+        && credentialIsExpired(
+          runtime,
+          getProfile(loadConfig(runtime.worktreeRuntime), runtime.profileName),
+        )
+      ) {
         throw createExpiredAuthError(runtime);
       }
       throw normalizeBackendError(response.status, payload, runtime);