sentinelayer-cli 0.44.0 → 0.45.0

package/src/session/sync.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import process from "node:process";
 import { randomUUID } from "node:crypto";
 
+import { credentialedRequest, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { isSessionControlEvent } from "./control-events.js";
@@ -378,7 +379,8 @@ function recordCircuitFailure(circuit, nowMs) {
 
 // 401 and 403 refuse one credential (an expired, revoked or narrower agent admission, or
 // an identity the account has not granted). They say nothing about API health, so they
-// never count toward the machine-wide outbound breaker; every other failure does.
+// never count toward either machine-wide breaker (inbound or outbound): one agent's
+// refusals must not pause another agent's traffic. Network errors, timeouts and 5xx do.
 function isCredentialRefusal(response) {
   return Boolean(response) && (response.status === 401 || response.status === 403);
 }
@@ -388,6 +390,11 @@ function recordOutboundFailure(response, nowMs) {
   recordCircuitFailure(outboundCircuit, nowMs);
 }
 
+function recordInboundFailure(response, nowMs) {
+  if (isCredentialRefusal(response)) return;
+  recordCircuitFailure(inboundCircuit, nowMs);
+}
+
 function recordCircuitSuccess(circuit) {
   if (!circuit) {
     return;
@@ -671,13 +678,21 @@ export async function fetchJsonWithFullTimeout(
   const controller = new AbortController();
   const startedAtMs = Date.now();
   let response = null;
+  // A credential (src/auth/credential-destinations.js) is sent only to its own origin, by
+  // credentialedRequest; fetchImpl is the transport that it calls.
+  const { credential = null, ...init } = options || {};
   const requestOptions = {
-    ...options,
+    ...init,
     signal: combineAbortSignals([options?.signal, controller.signal]),
   };
+  const sent = credential
+    ? credentialedRequest(credential, url, requestOptions, {
+        fetchImpl: (target, request) => fetchImpl(target, request, resolvedTimeoutMs),
+      })
+    : fetchImpl(url, requestOptions, resolvedTimeoutMs);
 
   response = await withTimeout(
-    fetchImpl(url, requestOptions, resolvedTimeoutMs),
+    sent,
     resolvedTimeoutMs,
     {
       reason: "request_timeout",
@@ -1003,7 +1018,7 @@ export async function syncSessionEventToApi(
     return { synced: false, reason: "no_session" };
   }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { synced: false, reason: "not_authenticated" };
   }
 
@@ -1017,8 +1032,8 @@ export async function syncSessionEventToApi(
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: `Bearer ${session.token}`,
     },
+    credential: await credentialFor(session),
     body: requestBody,
   };
   const resolvedTimeoutMs = normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS);
@@ -1078,8 +1093,8 @@ export async function syncSessionEventToApi(
               method: "POST",
               headers: {
                 "Content-Type": "application/json",
-                Authorization: `Bearer ${session.token}`,
               },
+              credential: await credentialFor(session),
               body: JSON.stringify({
                 agent_id: agentId,
                 role: grantRole,
@@ -1201,7 +1216,7 @@ async function syncSessionAuxPayload(
   } catch {
     return { synced: false, reason: "no_session" };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { synced: false, reason: "not_authenticated" };
   }
 
@@ -1214,8 +1229,8 @@ async function syncSessionAuxPayload(
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${session.token}`,
         },
+        credential: await credentialFor(session),
         body: JSON.stringify({
           ...payload,
           source: "cli",
@@ -1320,7 +1335,7 @@ export async function pollHumanMessages(
       cursor: normalizeString(since) || null,
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -1344,14 +1359,14 @@ export async function pollHumanMessages(
       {
         method: "GET",
         headers: {
-          Authorization: `Bearer ${session.token}`,
         },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
     );
     if (!response || !response.ok) {
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -1487,7 +1502,7 @@ export async function pollSessionEvents(
       cursor: normalizeString(since) || null,
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -1518,7 +1533,7 @@ export async function pollSessionEvents(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
@@ -1536,7 +1551,7 @@ export async function pollSessionEvents(
           cursor: normalizedSince || null,
         };
       }
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -1655,7 +1670,7 @@ export async function fetchSessionPresence(
       present: [],
     };
   }
-  if (!session?.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -1672,7 +1687,7 @@ export async function fetchSessionPresence(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
@@ -1698,7 +1713,7 @@ export async function fetchSessionPresence(
           present: [],
         };
       }
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -1807,7 +1822,7 @@ export async function renewSessionPresence(
       recorded: false,
     };
   }
-  if (!session?.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -1836,8 +1851,8 @@ export async function renewSessionPresence(
         method: "PUT",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${session.token}`,
         },
+        credential: await credentialFor(session),
         body: JSON.stringify(body),
         signal,
       },
@@ -1932,7 +1947,7 @@ export async function requestSessionListenerStop(
   } catch {
     return { ok: false, reason: "no_session", recorded: false };
   }
-  if (!session?.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", recorded: false };
   }
 
@@ -1952,9 +1967,9 @@ export async function requestSessionListenerStop(
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${session.token}`,
           "Idempotency-Key": normalizedIdempotencyKey,
         },
+        credential: await credentialFor(session),
         body: JSON.stringify(body),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
@@ -2060,7 +2075,7 @@ export async function updateSessionReadCursor(
   } catch {
     return { ok: false, reason: "no_session", updated: false };
   }
-  if (!session?.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", updated: false };
   }
 
@@ -2081,8 +2096,8 @@ export async function updateSessionReadCursor(
         method: "PUT",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${session.token}`,
         },
+        credential: await credentialFor(session),
         body: JSON.stringify(body),
         signal,
       },
@@ -2194,7 +2209,7 @@ export async function streamSessionEvents(
       errorCount: 0,
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -2244,18 +2259,18 @@ export async function streamSessionEvents(
 
   let response;
   try {
-    response = await fetchImpl(
+    response = await credentialedRequest(
+      await credentialFor(session),
       endpoint,
       {
         method: "GET",
         headers: {
           Accept: "text/event-stream",
-          Authorization: `Bearer ${session.token}`,
           ...(normalizedSince ? { "Last-Event-ID": normalizedSince } : {}),
         },
         signal: controller.signal,
       },
-      normalizedTimeoutMs
+      { fetchImpl: (target, init) => fetchImpl(target, init, normalizedTimeoutMs) },
     );
   } catch (error) {
     clearTimeout(timeoutHandle);
@@ -2415,7 +2430,7 @@ export async function pollSessionEventsBefore(
       beforeSequence: null,
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -2442,7 +2457,7 @@ export async function pollSessionEventsBefore(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
@@ -2460,7 +2475,7 @@ export async function pollSessionEventsBefore(
           beforeSequence: Number.isFinite(normalizedBeforeSequence) ? normalizedBeforeSequence : null,
         };
       }
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -2538,7 +2553,7 @@ export async function listSessionMessageActions(
   } catch {
     return { ok: false, reason: "no_session", actions: [], count: 0, projection: null };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", actions: [], count: 0, projection: null };
   }
 
@@ -2563,13 +2578,13 @@ export async function listSessionMessageActions(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
     );
     if (!response || !response.ok) {
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -2643,7 +2658,7 @@ export async function fetchSessionUsageLedger(
   } catch {
     return { ok: false, reason: "no_session", status: 0, payload: null };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", status: 0, payload: null };
   }
 
@@ -2660,13 +2675,13 @@ export async function fetchSessionUsageLedger(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
     );
     if (!response || !response.ok) {
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -2842,9 +2857,9 @@ export async function editSessionMessage(sessionId, {
   let auth;
   try { auth = await resolveAuthSession({ cwd: targetPath, env: process.env, autoRotate: false }); }
   catch { return { ok: false, reason: "no_session" }; }
-  if (!auth?.token) return { ok: false, reason: "not_authenticated" };
+  if (!isAuthenticated(auth)) return { ok: false, reason: "not_authenticated" };
   const base = `${resolveApiBaseUrl(auth)}/api/v1/sessions/${encodeURIComponent(sid)}`;
-  const headers = { Authorization: `Bearer ${auth.token}` };
+  const credential = await credentialFor(auth);
   const failure = (response, payload) => {
     const code = normalizeString(payload?.detail?.code || payload?.error?.code || payload?.code);
     // Client/schema/ownership conflicts are terminal and must not poison unrelated writes.
@@ -2857,7 +2872,7 @@ export async function editSessionMessage(sessionId, {
       const resource = replyId ? `replies/${encodeURIComponent(replyId)}` : messageId
         ? `messages/${encodeURIComponent(messageId)}` : `messages/by-sequence/${sequence}`;
       const authorQuery = normalizeString(agentId) ? `?agentId=${encodeURIComponent(normalizeString(agentId))}` : "";
-      const { response, payload } = await fetchJsonWithFullTimeout(`${base}/${resource}${authorQuery}`, { method: "GET", headers, signal }, timeoutMs, fetchImpl, { readErrorBody: true });
+      const { response, payload } = await fetchJsonWithFullTimeout(`${base}/${resource}${authorQuery}`, { method: "GET", credential, signal }, timeoutMs, fetchImpl, { readErrorBody: true });
       if (!response?.ok || payload?.ok === false) return failure(response, payload);
       const current = replyId ? payload?.reply : payload?.event;
       const fetchedRevision = Number(current?.messageRevision ?? 1);
@@ -2871,11 +2886,12 @@ export async function editSessionMessage(sessionId, {
     const { response, payload } = await fetchJsonWithFullTimeout(`${base}/${resource}`, {
       method: "PATCH",
       headers: {
-        ...createSessionMutationHeaders({ bearerToken: auth.token, sessionId: sid, routeId: replyId
+        ...createSessionMutationHeaders({ credential, sessionId: sid, routeId: replyId
           ? "PATCH /api/v1/sessions/{session_id}/replies/{action_id}"
           : "PATCH /api/v1/sessions/{session_id}/messages/{message_id}", idempotencyKey: mutationKey }),
         "Content-Type": "application/json", "Idempotency-Key": mutationKey,
       },
+      credential,
       body: JSON.stringify(body),
       signal,
     }, timeoutMs, fetchImpl, { readErrorBody: true });
@@ -2964,7 +2980,7 @@ export async function createSessionMessageAction(
   } catch {
     return { ok: false, reason: "no_session", action: null };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", action: null };
   }
 
@@ -3002,8 +3018,8 @@ export async function createSessionMessageAction(
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${session.token}`,
         },
+        credential: await credentialFor(session),
         body: JSON.stringify(body),
         signal,
       },
@@ -3104,7 +3120,7 @@ export async function searchSessionEvents(
       nextBeforeSequence: null,
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -3134,13 +3150,13 @@ export async function searchSessionEvents(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
     );
     if (!response || !response.ok) {
-      recordCircuitFailure(inboundCircuit, normalizedNowMs);
+      recordInboundFailure(response, normalizedNowMs);
       return {
         ok: false,
         reason: `api_${response ? response.status : "no_response"}`,
@@ -3226,7 +3242,7 @@ export async function listSessionsFromApi({
       warnings: [],
     };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return {
       ok: false,
       reason: "not_authenticated",
@@ -3262,7 +3278,7 @@ export async function listSessionsFromApi({
         endpoint,
         {
           method: "GET",
-          headers: { Authorization: `Bearer ${session.token}` },
+          credential: await credentialFor(session),
         },
         normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
         fetchImpl,
@@ -3368,7 +3384,7 @@ export async function fetchSessionFromApi(
   } catch {
     return { ok: false, reason: "no_session", session: null };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { ok: false, reason: "not_authenticated", session: null, status: 401 };
   }
 
@@ -3382,7 +3398,7 @@ export async function fetchSessionFromApi(
       endpoint,
       {
         method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session),
       },
       normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
       fetchImpl,
@@ -3447,7 +3463,7 @@ export async function probeSessionAccess(
   } catch {
     return { accessible: false, reason: "no_session" };
   }
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { accessible: false, reason: "not_authenticated" };
   }
 
@@ -3458,13 +3474,11 @@ export async function probeSessionAccess(
 
   let response;
   try {
-    response = await fetchImpl(
+    response = await credentialedRequest(
+      await credentialFor(session),
       endpoint,
-      {
-        method: "GET",
-        headers: { Authorization: `Bearer ${session.token}` },
-      },
-      normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS),
+      { method: "GET" },
+      { fetchImpl: (target, init) => fetchImpl(target, init, normalizePositiveInteger(timeoutMs, DEFAULT_SYNC_TIMEOUT_MS)) },
     );
   } catch (err) {
     return {

package/src/session/tickets.js

@@ -19,6 +19,7 @@ import os from "node:os";
 import path from "node:path";
 import process from "node:process";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { requestJson, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 
@@ -70,8 +71,8 @@ async function writeState(filePath, state) {
 
 async function auth(targetPath, resolveAuthSession) {
   const session = await resolveAuthSession({ cwd: targetPath, env: process.env, autoRotate: false });
-  if (!session?.token || !session?.apiUrl) throw new Error("Not authenticated for this session.");
-  return { token: session.token, apiUrl: normalizeString(session.apiUrl).replace(/\/+$/, "") };
+  if (!isAuthenticated(session) || !session?.apiUrl) throw new Error("Not authenticated for this session.");
+  return { credential: await credentialFor(session), apiUrl: normalizeString(session.apiUrl).replace(/\/+$/, "") };
 }
 
 function ticketsUrl(apiUrl, sessionId, suffix = "") {
@@ -155,7 +156,7 @@ export async function listTickets(
     maxPages = SNAPSHOT_MAX_PAGES,
   } = {}
 ) {
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
   const items = [];
   let cursor = null;
   let afterId = null;
@@ -164,9 +165,9 @@ export async function listTickets(
     const query = new URLSearchParams({ limit: String(pageSize) });
     if (afterId) query.set("afterId", afterId);
     const body = validatedSnapshotPage(
-      await requestRead(`${ticketsUrl(apiUrl, sessionId, "/snapshot")}?${query}`, {
+      await checkedTransport(requestRead)(`${ticketsUrl(apiUrl, sessionId, "/snapshot")}?${query}`, {
         method: "GET",
-        headers: { Authorization: `Bearer ${token}` },
+        credential,
       }),
       { first: page === 0, afterId },
     );
@@ -192,19 +193,20 @@ export async function ticketEvents(
   sessionId,
   { after = 0, targetPath = process.cwd(), resolveAuthSession = resolveActiveAuthSession, requestRead = requestJson } = {}
 ) {
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
-  return requestRead(`${ticketsUrl(apiUrl, sessionId, "/events")}?after=${encodeURIComponent(String(after))}`, {
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
+  return checkedTransport(requestRead)(`${ticketsUrl(apiUrl, sessionId, "/events")}?after=${encodeURIComponent(String(after))}`, {
     method: "GET",
-    headers: { Authorization: `Bearer ${token}` },
+    credential,
   });
 }
 
-async function mutate(url, { token, key, operation, body, requestMutation }) {
-  return requestMutation(url, {
+async function mutate(url, { credential, key, operation, body, requestMutation }) {
+  return checkedTransport(requestMutation)(url, {
     method: "POST",
     operationName: `session.ticket_${operation}`,
     idempotencyKey: key,
-    headers: { Authorization: `Bearer ${token}`, "Idempotency-Key": key },
+    credential,
+    headers: { "Idempotency-Key": key },
     body,
   });
 }
@@ -222,10 +224,10 @@ export async function claimTicket(
   } = {}
 ) {
   const statePath = ticketLeasePath(sessionId, ticketId, identity, { homeDir });
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
   const { key } = await operationKey(statePath, "claim", String(expectedVersion ?? "any"));
   const response = await mutate(ticketsUrl(apiUrl, sessionId, `/${encodeURIComponent(ticketId)}/claim`), {
-    token, key, operation: "claim", requestMutation,
+    credential, key, operation: "claim", requestMutation,
     body: expectedVersion == null ? {} : { expectedVersion: Number(expectedVersion) },
   });
   // The lease is recorded here only if the server says it is held by the identity that
@@ -258,10 +260,10 @@ export async function renewTicketLease(
 ) {
   const statePath = ticketLeasePath(sessionId, ticketId, identity, { homeDir });
   const held = await heldLease(statePath);
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
   const { key } = await operationKey(statePath, "renew", `${held.leaseId}:${held.fence}:${held.ticketVersion}`);
   const response = await mutate(ticketsUrl(apiUrl, sessionId, `/${encodeURIComponent(ticketId)}/lease/renew`), {
-    token, key, operation: "renew", requestMutation, body: { leaseId: held.leaseId, fence: held.fence },
+    credential, key, operation: "renew", requestMutation, body: { leaseId: held.leaseId, fence: held.fence },
   });
   await writeState(statePath, leaseState(response));
   return response;
@@ -274,10 +276,10 @@ export async function releaseTicketLease(
 ) {
   const statePath = ticketLeasePath(sessionId, ticketId, identity, { homeDir });
   const held = await heldLease(statePath);
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
   const { key } = await operationKey(statePath, "release", `${held.leaseId}:${held.fence}:${held.ticketVersion}`);
   const response = await mutate(ticketsUrl(apiUrl, sessionId, `/${encodeURIComponent(ticketId)}/lease/release`), {
-    token, key, operation: "release", requestMutation,
+    credential, key, operation: "release", requestMutation,
     body: { leaseId: held.leaseId, fence: held.fence, expectedVersion: held.ticketVersion, ...(reason ? { reason } : {}) },
   });
   await fsp.rm(statePath, { force: true });
@@ -299,10 +301,10 @@ export async function submitTicket(
 ) {
   const statePath = ticketLeasePath(sessionId, ticketId, identity, { homeDir });
   const held = await heldLease(statePath);
-  const { token, apiUrl } = await auth(targetPath, resolveAuthSession);
+  const { credential, apiUrl } = await auth(targetPath, resolveAuthSession);
   const { key } = await operationKey(statePath, "submit", `${held.leaseId}:${held.fence}:${held.ticketVersion}`);
   const response = await mutate(ticketsUrl(apiUrl, sessionId, `/${encodeURIComponent(ticketId)}/submit`), {
-    token, key, operation: "submit", requestMutation,
+    credential, key, operation: "submit", requestMutation,
     body: {
       leaseId: held.leaseId,
       fence: held.fence,

package/src/session/title-sync.js

@@ -1,5 +1,6 @@
 import process from "node:process";
 
+import { checkedTransport, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { SentinelayerApiError, requestJsonMutation } from "../auth/http.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { recordSessionRemoteTitleSync } from "./store.js";
@@ -66,7 +67,7 @@ export async function pushSessionTitleToApi(
       env,
       autoRotate,
     });
-    if (!session?.token || !session?.apiUrl) {
+    if (!isAuthenticated(session) || !session?.apiUrl) {
       await recordRemoteTitleSync(normalizedSessionId, {
         targetPath,
         title: normalizedTitle,
@@ -76,12 +77,12 @@ export async function pushSessionTitleToApi(
       return { synced: false, reason: "not_authenticated" };
     }
     const apiUrl = String(session.apiUrl).replace(/\/+$/, "");
-    const result = await requestMutation(
+    const result = await checkedTransport(requestMutation)(
       `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}/title`,
       {
         method: "POST",
         operationName: "session.set_title",
-        headers: { Authorization: `Bearer ${session.token}` },
+        credential: await credentialFor(session, { env }),
         body: { title: normalizedTitle },
         timeoutMs,
         maxRetries,

package/src/telemetry/sync.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
+import { credentialedRequest, credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 
 // Read CLI version from package.json at module load
@@ -71,7 +72,7 @@ export async function syncRunToDashboard(runData) {
     return { synced: false, reason: "no_session" };
   }
 
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     return { synced: false, reason: "not_authenticated" };
   }
 
@@ -121,14 +122,12 @@ export async function syncRunToDashboard(runData) {
       },
     };
 
-    const response = await fetchWithTimeout(apiUrl + "/api/v1/telemetry", {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Authorization: "Bearer " + session.token,
-      },
-      body: JSON.stringify(payload),
-    }, SYNC_TIMEOUT_MS);
+    const response = await credentialedRequest(
+      await credentialFor(session),
+      apiUrl + "/api/v1/telemetry",
+      { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) },
+      { fetchImpl: (target, init) => fetchWithTimeout(target, init, SYNC_TIMEOUT_MS) },
+    );
 
     if (!response.ok) {
       consecutiveFailures++;