@vibe-assurance/cli 1.0.4 → 1.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-assurance/cli",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Vibe Assurance CLI - Connect AI coding agents to your governance platform via MCP",
   "main": "src/index.js",
   "bin": {

package/src/config/credentials.js

@@ -90,7 +90,10 @@ async function deleteCredentials() {
 }
 
 /**
- * Check if credentials exist and are valid (not expired)
+ * Check if credentials exist and can be used (valid or refreshable)
+ * Returns true if:
+ * - Access token exists and is not expired, OR
+ * - Access token is expired but refresh token exists (will auto-refresh on API call)
  * @returns {Promise<boolean>}
  */
 async function hasValidCredentials() {
@@ -99,14 +102,19 @@ async function hasValidCredentials() {
     return false;
   }
 
-  // Check if token is expired (with 5 minute buffer)
+  // Check if access token is expired (with 5 minute buffer)
   if (creds.expiresAt) {
     const expiresAt = new Date(creds.expiresAt);
     const now = new Date();
     const bufferMs = 5 * 60 * 1000; // 5 minutes
 
     if (expiresAt.getTime() - bufferMs < now.getTime()) {
-      return false;
+      // Access token expired - check if we have a refresh token
+      // If we do, the API client will auto-refresh on first request
+      if (creds.refreshToken) {
+        return true; // Can refresh, so credentials are usable
+      }
+      return false; // No refresh token, truly expired
     }
   }