@ze-norm/cli 0.11.2 → 0.11.5

package/dist/api/client.d.ts

@@ -11,12 +11,18 @@ export interface AuthContext {
 }
 export declare class ZenormClient {
     private baseUrl;
-    private token;
+    private explicitToken;
     constructor(opts?: ApiClientOptions);
-    private getHeaders;
+    /** Resolve the bearer token for a request, refreshing it if expired. */
+    private resolveRequestToken;
+    private buildHeaders;
     private isLocalBaseUrl;
     /** True when this client targets a localhost API (dev-bypass eligible). */
     isLocalDevTarget(): boolean;
+    /** True when requests will intentionally ignore stored credentials. */
+    isUsingLocalDevBypass(): boolean;
+    private shouldBypassAuthForLocalDev;
+    private sendOnce;
     private request;
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAqBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAgB;gBAEjB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,OAAO,CAAC,UAAU;IA0BlB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;YAIb,OAAO;IAsEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAyBA,kFAAkF;AAClF,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAS;IAIxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,IAAI,CAAC,EAAE,gBAAgB;IAKnC,wEAAwE;YAC1D,mBAAmB;IAMjC,OAAO,CAAC,YAAY;IA0BpB,OAAO,CAAC,cAAc;IAStB,2EAA2E;IAC3E,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,qBAAqB,IAAI,OAAO;IAQhC,OAAO,CAAC,2BAA2B;YAIrB,QAAQ;YAqBR,OAAO;IAqEf,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIjD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAIzC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAG7C"}

package/dist/api/client.js

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { ApiError, AuthError, UpgradeRequiredError } from "../util/errors.js";
-import { resolveToken } from "../auth/store.js";
+import { forceRefreshToken, hasRefreshableCredentials, resolveValidToken, } from "../auth/store.js";
 import { PRODUCTION_API_URL } from "../config/defaults.js";
 import { getCliVersion } from "../util/package.js";
 import { log } from "../util/logger.js";
@@ -40,12 +40,23 @@ function resolveBaseUrl(explicit) {
 }
 export class ZenormClient {
     baseUrl;
-    token;
+    // An explicit token override (e.g. from `login` before creds are persisted).
+    // When set it is used verbatim and never refreshed. When null, the token is
+    // resolved per-request from stored credentials so expiry/refresh is handled.
+    explicitToken;
     constructor(opts) {
         this.baseUrl = resolveBaseUrl(opts?.baseUrl).replace(/\/+$/, "");
-        this.token = opts?.token ?? resolveToken();
+        this.explicitToken = opts?.token ?? null;
     }
-    getHeaders() {
+    /** Resolve the bearer token for a request, refreshing it if expired. */
+    async resolveRequestToken() {
+        if (this.explicitToken)
+            return this.explicitToken;
+        if (this.shouldBypassAuthForLocalDev())
+            return null;
+        return resolveValidToken();
+    }
+    buildHeaders(token) {
         const headers = {
             "Content-Type": "application/json",
             // Always advertise the CLI version so the API can gate stale clients
@@ -54,8 +65,8 @@ export class ZenormClient {
             // authenticated or dev-bypassed.
             "x-zenorm-cli-version": getCliVersion(),
         };
-        if (this.token) {
-            headers["Authorization"] = `Bearer ${this.token}`;
+        if (token) {
+            headers["Authorization"] = `Bearer ${token}`;
             return headers;
         }
         if (this.isLocalBaseUrl()) {
@@ -82,23 +93,47 @@ export class ZenormClient {
     isLocalDevTarget() {
         return this.isLocalBaseUrl();
     }
-    async request(method, path, body) {
-        const url = `${this.baseUrl}${path}`;
+    /** True when requests will intentionally ignore stored credentials. */
+    isUsingLocalDevBypass() {
+        return (this.isLocalBaseUrl() &&
+            process.env["ZENORM_LOCAL_DEV_BYPASS_AUTH"] === "true" &&
+            !process.env["ZENORM_API_TOKEN"]);
+    }
+    shouldBypassAuthForLocalDev() {
+        return this.isUsingLocalDevBypass();
+    }
+    async sendOnce(method, url, token, body) {
         const init = {
             method,
-            headers: this.getHeaders(),
+            headers: this.buildHeaders(token),
         };
         if (body !== undefined) {
             init.body = JSON.stringify(body);
         }
-        let res;
         try {
-            res = await fetch(url, init);
+            return await fetch(url, init);
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             throw new ApiError(`Request failed: ${msg}`, 0, null);
         }
+    }
+    async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        let token = await this.resolveRequestToken();
+        let res = await this.sendOnce(method, url, token, body);
+        // A 401 on a token we resolved from stored credentials may mean the server
+        // revoked it before its stated expiry. Try one forced refresh + retry
+        // before giving up — but never for an explicit/env token we can't refresh.
+        if (res.status === 401 && !this.explicitToken && hasRefreshableCredentials()) {
+            try {
+                token = await forceRefreshToken();
+            }
+            catch {
+                throw new AuthError("Authentication required. Run `zenorm login` first.");
+            }
+            res = await this.sendOnce(method, url, token, body);
+        }
         if (res.status === 401) {
             throw new AuthError("Authentication required. Run `zenorm login` first.");
         }

package/dist/api/types.d.ts

@@ -51,4 +51,12 @@ export interface ListTasksResponse {
 export interface TaskResponse {
     task: SpecTaskRecord;
 }
+/**
+ * Response from `POST /v1/tasks/claim`. The server atomically claims the oldest
+ * ready task for the given repo and flips it to `active`; `task` is `null` when
+ * there is no claimable work right now.
+ */
+export interface ClaimTaskResponse {
+    task: SpecTaskRecord | null;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/api/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,cAAc,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B"}

package/dist/auth/device-flow.d.ts

@@ -1,4 +1,18 @@
 import type { StoredCredentials } from "./store.js";
+/**
+ * Exchange a stored refresh token for a fresh access token at the Clerk token
+ * endpoint (`grant_type=refresh_token`). Clerk may rotate the refresh token, so
+ * the caller must persist whichever refresh token comes back; if the response
+ * omits one, the existing refresh token is still valid and is returned as-is.
+ *
+ * Throws on any non-2xx response — an expired/revoked refresh token means the
+ * caller must fall back to a full `zenorm login`.
+ */
+export declare function refreshAccessToken(refreshToken: string): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}>;
 /**
  * Run the full OAuth 2.0 Authorization Code + PKCE flow.
  *

package/dist/auth/device-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../../src/auth/device-flow.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAkUpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAkDpE"}

package/dist/auth/device-flow.js

@@ -280,6 +280,37 @@ async function exchangeCodeForTokens(code, codeVerifier, redirectUri) {
         expiresIn: data.expires_in ?? 3600,
     };
 }
+/**
+ * Exchange a stored refresh token for a fresh access token at the Clerk token
+ * endpoint (`grant_type=refresh_token`). Clerk may rotate the refresh token, so
+ * the caller must persist whichever refresh token comes back; if the response
+ * omits one, the existing refresh token is still valid and is returned as-is.
+ *
+ * Throws on any non-2xx response — an expired/revoked refresh token means the
+ * caller must fall back to a full `zenorm login`.
+ */
+export async function refreshAccessToken(refreshToken) {
+    const res = await fetch(`${getClerkIssuer()}/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: getClerkClientId(),
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        throw new Error(`Token refresh failed (${res.status}): ${text}`);
+    }
+    const data = (await res.json());
+    return {
+        accessToken: data.access_token,
+        // Clerk rotates refresh tokens; reuse the old one only if none is returned.
+        refreshToken: data.refresh_token ?? refreshToken,
+        expiresIn: data.expires_in ?? 3600,
+    };
+}
 /**
  * Run the full OAuth 2.0 Authorization Code + PKCE flow.
  *

package/dist/auth/store.d.ts

@@ -9,8 +9,38 @@ export declare function loadCredentials(): StoredCredentials | null;
 export declare function saveCredentials(creds: StoredCredentials): void;
 export declare function deleteCredentials(): boolean;
 /**
- * Resolve the current access token.
+ * Resolve the current access token without any network/refresh side effects.
  * Priority: ZENORM_API_TOKEN env var > stored credentials.
+ *
+ * Prefer `resolveValidToken()` for actual API calls — this raw accessor does
+ * NOT check expiry and is kept for callers that only need the literal token
+ * (e.g. displaying it).
  */
 export declare function resolveToken(): string | null;
+/**
+ * Resolve a usable access token, refreshing it first when the stored one is
+ * expired (or about to be). Rotated credentials are persisted.
+ *
+ * Priority: ZENORM_API_TOKEN env var (used as-is, never refreshed) > stored
+ * credentials (refreshed on demand). Returns null when there is nothing to
+ * resolve, leaving the caller to fall back to dev-bypass headers or error.
+ *
+ * A failed refresh (revoked/expired refresh token) throws; the caller surfaces
+ * it as "run `zenorm login`".
+ */
+export declare function resolveValidToken(): Promise<string | null>;
+/**
+ * True when a refresh-token grant is possible: stored credentials with a
+ * refresh token exist and no explicit ZENORM_API_TOKEN override is in play
+ * (an env token is opaque to us and cannot be refreshed).
+ */
+export declare function hasRefreshableCredentials(): boolean;
+/**
+ * Force a refresh regardless of expiry — used after a 401, where the server
+ * rejected a token that may have been revoked before its stated expiry.
+ * Persists rotated credentials and returns the new access token.
+ *
+ * Throws if there is nothing to refresh or the refresh grant fails.
+ */
+export declare function forceRefreshToken(): Promise<string>;
 //# sourceMappingURL=store.d.ts.map

package/dist/auth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAaD,wBAAgB,eAAe,IAAI,iBAAiB,GAAG,IAAI,CAO1D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAM9D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAO3C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAU5C;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,CAezD"}

package/dist/auth/store.js

@@ -1,6 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { refreshAccessToken } from "./device-flow.js";
+import { log } from "../util/logger.js";
+// Refresh the access token this many ms before it actually expires, so an
+// in-flight request never races the expiry boundary.
+const EXPIRY_SKEW_MS = 60_000;
 function getCredentialsPath() {
     return join(homedir(), ".zenorm", "credentials.json");
 }
@@ -34,8 +39,12 @@ export function deleteCredentials() {
     return true;
 }
 /**
- * Resolve the current access token.
+ * Resolve the current access token without any network/refresh side effects.
  * Priority: ZENORM_API_TOKEN env var > stored credentials.
+ *
+ * Prefer `resolveValidToken()` for actual API calls — this raw accessor does
+ * NOT check expiry and is kept for callers that only need the literal token
+ * (e.g. displaying it).
  */
 export function resolveToken() {
     const envToken = process.env["ZENORM_API_TOKEN"];
@@ -48,3 +57,81 @@ export function resolveToken() {
     }
     return null;
 }
+/** True when the stored access token is expired (within the skew window). */
+function isExpired(creds) {
+    const expiresAtMs = Date.parse(creds.expiresAt);
+    // An unparseable expiry is treated as expired so we refresh rather than send
+    // a token we can't reason about.
+    if (Number.isNaN(expiresAtMs))
+        return true;
+    return expiresAtMs - EXPIRY_SKEW_MS <= Date.now();
+}
+/**
+ * Resolve a usable access token, refreshing it first when the stored one is
+ * expired (or about to be). Rotated credentials are persisted.
+ *
+ * Priority: ZENORM_API_TOKEN env var (used as-is, never refreshed) > stored
+ * credentials (refreshed on demand). Returns null when there is nothing to
+ * resolve, leaving the caller to fall back to dev-bypass headers or error.
+ *
+ * A failed refresh (revoked/expired refresh token) throws; the caller surfaces
+ * it as "run `zenorm login`".
+ */
+export async function resolveValidToken() {
+    const envToken = process.env["ZENORM_API_TOKEN"];
+    if (envToken) {
+        return envToken;
+    }
+    const creds = loadCredentials();
+    if (!creds) {
+        return null;
+    }
+    if (!creds.refreshToken || !isExpired(creds)) {
+        return creds.accessToken;
+    }
+    log.debug("Access token expired; refreshing via refresh_token grant");
+    const refreshed = await refreshAccessToken(creds.refreshToken);
+    const updated = {
+        ...creds,
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        expiresAt: new Date(Date.now() + refreshed.expiresIn * 1000).toISOString(),
+    };
+    saveCredentials(updated);
+    log.debug("Access token refreshed", { expiresAt: updated.expiresAt });
+    return refreshed.accessToken;
+}
+/**
+ * True when a refresh-token grant is possible: stored credentials with a
+ * refresh token exist and no explicit ZENORM_API_TOKEN override is in play
+ * (an env token is opaque to us and cannot be refreshed).
+ */
+export function hasRefreshableCredentials() {
+    if (process.env["ZENORM_API_TOKEN"])
+        return false;
+    const creds = loadCredentials();
+    return Boolean(creds?.refreshToken);
+}
+/**
+ * Force a refresh regardless of expiry — used after a 401, where the server
+ * rejected a token that may have been revoked before its stated expiry.
+ * Persists rotated credentials and returns the new access token.
+ *
+ * Throws if there is nothing to refresh or the refresh grant fails.
+ */
+export async function forceRefreshToken() {
+    const creds = loadCredentials();
+    if (!creds?.refreshToken) {
+        throw new Error("No refresh token available");
+    }
+    log.debug("Forcing token refresh after 401");
+    const refreshed = await refreshAccessToken(creds.refreshToken);
+    const updated = {
+        ...creds,
+        accessToken: refreshed.accessToken,
+        refreshToken: refreshed.refreshToken,
+        expiresAt: new Date(Date.now() + refreshed.expiresIn * 1000).toISOString(),
+    };
+    saveCredentials(updated);
+    return refreshed.accessToken;
+}

package/dist/commands/whoami.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAIA,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlE"}
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAIA,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBlE"}

package/dist/commands/whoami.js

@@ -2,15 +2,20 @@ import { loadCredentials, resolveToken } from "../auth/store.js";
 import { ZenormClient } from "../api/client.js";
 import { log } from "../util/logger.js";
 export async function whoamiCommand(_argv) {
-    const token = resolveToken();
-    const client = new ZenormClient({ token: token ?? undefined });
+    // Let the client resolve (and refresh if needed) the stored token itself —
+    // passing an explicit token here would bypass expiry handling.
+    const client = new ZenormClient();
     const ctx = await client.getAuthContext();
+    const token = resolveToken();
     log.info(`User:    ${ctx.userId}`);
     log.info(`Org:     ${ctx.orgId}`);
     log.info(`Admin:   ${ctx.isAdmin ? "yes" : "no"}`);
     // Show token expiry from stored credentials (not available for env token)
     const creds = loadCredentials();
-    if (creds?.expiresAt) {
+    if (client.isUsingLocalDevBypass()) {
+        log.dim("Using local development mode.");
+    }
+    else if (creds?.expiresAt) {
         log.info(`Expires: ${creds.expiresAt}`);
     }
     else if (process.env["ZENORM_API_TOKEN"]) {

package/dist/commands/work-render.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Agent-output renderers for `zenorm work`.
+ *
+ * Background: `zenorm work` runs each claimed task by spawning a headless coding
+ * agent (`claude` / `codex`). Those agents' *interactive* TUIs show a clean,
+ * readable transcript (assistant prose + one-line tool calls). Their headless
+ * modes do NOT: `claude -p` text mode hides every tool call, and the JSON event
+ * streams (`--output-format stream-json`, `codex exec --json`) are raw JSONL —
+ * unreadable noise.
+ *
+ * These renderers consume the JSON event streams and re-emit a compact transcript
+ * that mirrors what you'd see in each agent's interactive session — a read-only
+ * view of the agent working — while dropping protocol/metadata noise (hooks,
+ * init banners, token counts, rate-limit pings, raw tool-result bodies).
+ *
+ * Pure functions over single events so they can be unit-tested without spawning
+ * anything. The caller (`AgentRunner`) feeds newline-delimited stdout chunks to a
+ * `LineSplitter` + `renderClaudeEvent` / `renderCodexEvent`.
+ */
+/** A single rendered transcript line (no trailing newline). */
+export type RenderedLine = string;
+/**
+ * Accumulates raw stdout bytes and yields complete lines. The agent JSON streams
+ * are newline-delimited JSON; a chunk may split a line, so we buffer the tail.
+ */
+export declare class LineSplitter {
+    private buffer;
+    /** Push a chunk; returns any newly-completed lines (without the newline). */
+    push(chunk: string): string[];
+    /** Flush any buffered partial line at end-of-stream. */
+    flush(): string[];
+}
+/**
+ * Render ONE parsed Claude `--output-format stream-json` event into transcript
+ * lines (possibly empty). We render off the *complete* `assistant` events (not
+ * the partial `stream_event` deltas) so each block is whole; everything else —
+ * `system`/`stream_event`/`rate_limit_event`/`user` tool-result bodies — is
+ * dropped as noise. The final `result` event is summarized as a dim footer.
+ */
+export declare function renderClaudeEvent(event: unknown): RenderedLine[];
+/**
+ * Render ONE parsed Codex `exec --json` event (JSONL) into transcript lines.
+ * Codex emits `thread.started` / `turn.started` / `item.*` / `turn.completed` /
+ * `error`. We surface assistant messages, command/file-change items, and a dim
+ * completion/error footer; thread/turn lifecycle + token metadata are dropped.
+ */
+export declare function renderCodexEvent(event: unknown): RenderedLine[];
+/** Per-agent line renderer: parse JSONL safely, then dispatch. */
+export type EventRenderer = (jsonLine: string) => RenderedLine[];
+export declare const claudeRenderer: EventRenderer;
+export declare const codexRenderer: EventRenderer;
+/**
+ * The dim footer that closes each agent's transcript. Done turns green with a
+ * check; an errored/aborted turn turns red with a cross. `meta` is the trailing
+ * detail (turns/duration, or an error message). Kept as a shared helper so the
+ * Claude `result` and Codex `turn.completed`/`error` footers render alike.
+ *
+ * NOTE: the literal words "done"/"error" are asserted by the renderer tests, so
+ * keep them as the leading token.
+ */
+export declare function transcriptFooter(isError: boolean, meta: string[]): RenderedLine;
+/**
+ * Heavy task header printed once when a task starts. The leading rule + blank
+ * line give multi-task runs clear visual separation (tasks stop blurring into
+ * one another); `index` is the 1-based run counter within this session.
+ */
+export declare function taskHeader(shortTaskId: string, title: string, agentName: string, index?: number): string;
+/**
+ * The full multi-line splash logo (no surrounding blank lines): the rasterized
+ * brand mark on the left (brand-cyan half-blocks), the `ZeNorm` wordmark on the
+ * right (3D-extruded, 5-space gutter). The icon stands one row taller than the
+ * wordmark (9 vs 8), so the shorter wordmark is vertically centered against it
+ * with blank padding. Under NO_COLOR the color escapes collapse to "" (the
+ * half-block mark and the wordmark's box outline still draw). Exported so it can
+ * be rendered/asserted on its own.
+ */
+export declare function splashLogo(): string;
+/**
+ * The startup banner for the daemon. Shown once at launch (not just under
+ * `--dry-run`) so a real run announces what it's doing instead of sitting
+ * silently until the first task lands. Leads with the ZeNorm splash logo, then
+ * the run parameters.
+ */
+export declare function daemonBanner(opts: {
+    agent: string;
+    repo: string;
+    intervalSeconds: number;
+    once: boolean;
+    dryRun: boolean;
+}): string;
+/** A spinner-free, dim status line for the daemon's idle/lifecycle states. */
+export declare function statusLine(message: string): string;
+/**
+ * The per-task outcome line printed after a task's transcript closes: a bold
+ * green check for success or a bold red cross for failure, with the title, id,
+ * and wall-clock duration. This is the daemon's own verdict (distinct from the
+ * agent's transcript footer) so the run log reads as a sequence of outcomes.
+ */
+export declare function taskOutcome(opts: {
+    ok: boolean;
+    shortTaskId: string;
+    title: string;
+    durationMs: number;
+}): string;
+/**
+ * A loud, framed failure banner for a task that threw. Spells out which task
+ * failed, the error, and that it was released back to `todo` so the failure is
+ * impossible to miss in a scrolling daemon log (vs. a single dim line).
+ */
+export declare function failureBanner(opts: {
+    shortTaskId: string;
+    title: string;
+    error: string;
+}): string;
+/**
+ * The session summary printed when the daemon shuts down (Ctrl-C or `--once`
+ * exhausted). Closes the run with a rule + a one-line tally so the user sees the
+ * total instead of having to count outcome lines by eye.
+ */
+export declare function sessionSummary(opts: {
+    completed: number;
+    failed: number;
+}): string;
+//# sourceMappingURL=work-render.d.ts.map

package/dist/commands/work-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-render.d.ts","sourceRoot":"","sources":["../../src/commands/work-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAoBH,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AA2DlC;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE;IAQ7B,wDAAwD;IACxD,KAAK,IAAI,MAAM,EAAE;CAMlB;AA+ED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAkChE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,EAAE,CAoE/D;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;AAuBjE,eAAO,MAAM,cAAc,EAAE,aAA+C,CAAC;AAC7E,eAAO,MAAM,aAAa,EAAE,aAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,CAI/E;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAMR;AA2JD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAenC;AAoBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAsBT;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAKT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAKT"}