recess-cli 3.0.0 → 3.2.0

package/README.md

@@ -77,13 +77,19 @@ Create an approved `OAuthClient` row in each Recess environment. This remains a
 
 The production row ID (`c7e34138-18f9-45b1-a2fb-26a4e3a6d739`) is the CLI's built-in default, so production login needs no client-ID setup. `--client-id`, `RECESS_CLI_OAUTH_CLIENT_ID`, and a stored client ID remain overrides for local/staging clients. The web-server decodes the assertion audience, loads that exact `OAuthClient`, and requires both `approved` and `adminCliEnabled`; there is no separate server environment allowlist. Production redirect validation is exact, so a different callback port must also be explicitly registered.
 
-The browser SSO assertion is exchanged once and discarded. The CLI stores a separate 12-hour signed Recess session at `~/.recess-cli/config.json` with mode `0600`. A guardian must hold the live `access:ai` permission; removing it immediately invalidates session checks. Guardian sessions cannot call `/admin` routes and every target is independently restricted to their family. A KID session has `village_home` scope: application-level and shared-auth fences permit only session inspection and Village assertion minting, denying every other backend route.
+The browser SSO assertion is exchanged once and discarded. The CLI stores a separate signed Recess session (12 hours by default) at `~/.recess-cli/config.json` with mode `0600`. A guardian must hold the live `access:ai` permission; removing it immediately invalidates session checks. Guardian sessions cannot call `/admin` routes and every target is independently restricted to their family. A KID session has `village_home` scope: application-level and shared-auth fences permit only session inspection and Village assertion minting, denying every other backend route.
 
 ```bash
 recess --json auth login
 recess --json doctor --reason "Verify CLI connectivity, identity, and scope"
 ```
 
+Sessions default to 12 hours. Admins can request 30 days locally with
+`recess --json auth login --duration 30d`, or remotely with
+`recess --json auth request --duration 30d --label "remote agent"`, approve the link as an
+admin, then run `recess --json auth poll`. The approval page shows the requested duration;
+the link still expires after 10 minutes. Non-admins cannot authorize 30-day sessions.
+
 ## Testing against a local server
 
 `auth login` opens production SSO, so local iteration uses the env-cookie hatch instead:

package/dist/args.js

@@ -6,6 +6,7 @@ import { CliError } from "./errors.js";
  */
 export const REPEATABLE_FLAGS = new Set(["kid", "unassign"]);
 const BOOLEAN_FLAGS = new Set([
+    "allow-assigned-edits",
     "all-references",
     "allow-strand",
     "cancel-subscriptions",

package/dist/auth.js

@@ -77,7 +77,11 @@ export async function login(config, options) {
     const assertion = await callback;
     const response = await fetch(new URL("/auth/admin-cli/exchange/", config.apiOrigin), {
         method: "POST",
-        headers: cliRequestHeaders({ authorization: `Bearer ${assertion}` }),
+        headers: cliRequestHeaders({
+            authorization: `Bearer ${assertion}`,
+            "content-type": "application/json",
+        }),
+        body: JSON.stringify({ sessionDuration: options.sessionDuration }),
     });
     const body = (await response.json());
     if (!response.ok)
@@ -109,7 +113,7 @@ export async function requestDeviceAuth(config, options) {
     const response = await fetch(new URL("/auth/admin-cli/device/authorize/", config.apiOrigin), {
         method: "POST",
         headers: cliRequestHeaders({ "content-type": "application/json" }),
-        body: JSON.stringify(options.label ? { label: options.label } : {}),
+        body: JSON.stringify(options),
     });
     const body = (await response.json());
     if (!response.ok)
@@ -128,7 +132,8 @@ export async function requestDeviceAuth(config, options) {
         userCode: authorize.userCode,
         expiresAt: authorize.expiresAt,
         interval: authorize.interval,
-        instructions: `Open ${authorize.approvalUrl} in a browser and approve it while signed in to Recess as the person this agent should act as — the session takes on THAT account's scope, so a guardian grants family-only access. Then run \`recess auth poll\`.`,
+        sessionDuration: options.sessionDuration ?? "12h",
+        instructions: `Open ${authorize.approvalUrl} in a browser and approve it while signed in to Recess ${options.sessionDuration === "30d" ? "as an admin to authorize 30 days of access" : "as the person this agent should act as"} — the session takes on THAT account's scope, so a guardian grants family-only access. Then run \`recess auth poll\`.`,
     };
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));