shakers-cli 0.15.0 → 0.17.0

package/src/agents-client.js

@@ -3,7 +3,7 @@
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError, WORKS_CODE_TO_REASON } = require('./skills-client');
 
-// Talent-agent client for `start`'s "Add agent" route (talents-ai-score Phase 2).
+// Talent-agent client for `start`'s "Add agent" route.
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -88,14 +88,14 @@ async function requestDeclareAgent(
 
   const json = parseJson(res.raw);
   if (!json || json.status !== 'OK') return { ok: false, reason: 'bad-response' };
-  // Thread the created agent's id back (relayed from Hub's declare response) so the relate step can PATCH `.../agents/:id/portfolios` (ADR-041).
+  // Thread the created agent's id back (relayed from Hub's declare response) so the relate step can PATCH `.../agents/:id/portfolios`.
   const data = json.data && typeof json.data === 'object' ? json.data : null;
   const rawId = data ? data.id : null;
   const agentId = typeof rawId === 'string' || typeof rawId === 'number' ? String(rawId) : null;
   return { ok: true, agentId };
 }
 
-// DIRECT to Hub (ADR-041), replace-set.
+// DIRECT to Hub, replace-set.
 async function requestRelateAgentPortfolios(
   { agentId, items, hubAccessToken } = {},
   { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
@@ -124,7 +124,7 @@ async function requestRelateAgentPortfolios(
 }
 
 // `POST .../agents/draft-fields` -> { ok, whatItDoes, humanDecides } | { ok:false, reason }.
-// No X-Hub-Token. The CALLER gates consent (ADR-052), so `consent:true` is always sent.
+// No X-Hub-Token. The CALLER gates consent, so `consent:true` is always sent.
 async function requestDraftAgentFields(
   { name, tools, model, parent, definition, accessToken } = {},
   { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},

package/src/ai-usage-review.js

@@ -0,0 +1,101 @@
+'use strict';
+
+const path = require('path');
+const { derivePayload } = require('./share-payload');
+const { classify } = require('./maturity');
+const { reviewCopy } = require('./signup-copy');
+const { sanitizeRenderText } = require('./sanitize-network-text');
+
+function repoName(repo) {
+  return path.basename(String(repo)) || String(repo);
+}
+
+function uploadFacts({ report, maturity, repos = [] }) {
+  const payload = derivePayload(report, maturity);
+  const sessions = payload.sessions || {};
+  const conversationExcerpts =
+    (payload.steering ? payload.steering.redactedSteeringExcerpts.length : 0)
+    + (payload.decisions ? payload.decisions.redactedDecisionExcerpts.length : 0);
+  const commandExcerpts = Array.isArray(sessions.redactedCommandSample) ? sessions.redactedCommandSample.length : 0;
+  return {
+    tools: (report.tools || []).filter((t) => t && t.detected).map((t) => t.name || t.id),
+    technologies: payload.technologies.filter((t) => typeof t === 'string'),
+    sessionCount: sessions.sessionCount || 0,
+    activeDaysPerWeek: typeof sessions.activeDaysPerWeek === 'number' ? sessions.activeDaysPerWeek : null,
+    commitCount: payload.gitActivity ? payload.gitActivity.commitCount : 0,
+    repos: repos.map(repoName),
+    agents: payload.agents.map((a) => a.name),
+    agentDefinitions: payload.agents.filter((a) => a.definition).length,
+    agentSummaries: payload.agentSynthesis.filter((a) => a.whatItDoes || a.symbolicName).length,
+    conversationExcerpts,
+    commandExcerpts,
+  };
+}
+
+function keepNamed(list, excluded) {
+  return Array.isArray(list) ? list.filter((x) => !(x && excluded.has(x.name))) : list;
+}
+
+function withoutExcluded(report, { agents = [], excerpts = true } = {}) {
+  const excluded = new Set(agents);
+  const next = structuredClone(report);
+  if (excluded.size > 0) {
+    next.agents = keepNamed(next.agents, excluded)
+      .map((a) => (a && excluded.has(a.parent) ? { ...a, parent: null } : a));
+    next.agentDefinitions = keepNamed(next.agentDefinitions, excluded);
+    next.agentDescriptions = keepNamed(next.agentDescriptions, excluded);
+    if (next.agentEvaluation) next.agentEvaluation.evaluations = keepNamed(next.agentEvaluation.evaluations, excluded);
+    if (next.agentSynthesis) next.agentSynthesis.agents = keepNamed(next.agentSynthesis.agents, excluded);
+    if (next.detectionEvidence) next.detectionEvidence.agents = keepNamed(next.detectionEvidence.agents, excluded);
+    if (next.agentUsage && next.agentUsage.byAgent) {
+      for (const name of excluded) delete next.agentUsage.byAgent[name];
+    }
+    if (next.agentCounts) next.agentCounts.agents = Array.isArray(next.agents) ? next.agents.length : 0;
+  }
+  if (!excerpts) {
+    if (next.steering) next.steering.redactedSteeringExcerpts = [];
+    if (next.decisions) next.decisions.redactedDecisionExcerpts = [];
+    if (next.sessions) next.sessions.redactedCommandSample = [];
+  }
+  return { report: next, maturity: classify(next) };
+}
+
+function joined(list) {
+  return list.join(', ');
+}
+
+function summaryText(lang, facts, { sent = false } = {}) {
+  const c = reviewCopy(lang);
+  return [
+    sent ? c.sentTitle : c.title,
+    facts.tools.length ? c.tools(joined(facts.tools)) : null,
+    facts.technologies.length ? c.technologies(joined(facts.technologies)) : null,
+    c.activity(facts.sessionCount, facts.activeDaysPerWeek),
+    facts.repos.length ? c.repos(joined(facts.repos), facts.commitCount) : null,
+    facts.agents.length ? c.agents(joined(facts.agents), facts.agentDefinitions, facts.agentSummaries) : null,
+    facts.conversationExcerpts + facts.commandExcerpts > 0 ? c.excerpts(facts.conversationExcerpts, facts.commandExcerpts) : c.noExcerpts,
+    c.notSent,
+  ].filter(Boolean).map((line, i) => (i === 0 ? line : `- ${line}`)).join('\n');
+}
+
+function explanationText(lang) {
+  const c = reviewCopy(lang);
+  return [c.explanationTitle, ...c.explanation, c.afterwards].join('\n\n');
+}
+
+function resultText(lang, preview) {
+  const c = reviewCopy(lang);
+  if (!preview) return [c.resultPending, c.afterwards].join('\n\n');
+  const m = preview.matrix || {};
+  const lines = [
+    c.resultTitle,
+    m.setupLevel ? c.setupLevel(c.levels[m.setupLevel] || m.setupLevel) : null,
+    preview.setup && preview.setup.explanation,
+    m.usageLevel ? c.usageLevel(c.levels[m.usageLevel] || m.usageLevel) : null,
+    preview.usage && preview.usage.explanation,
+    m.cell ? c.cell(m.cell) : null,
+  ].filter(Boolean).map(sanitizeRenderText);
+  return [lines.join('\n'), c.explanation[0], c.afterwards].join('\n\n');
+}
+
+module.exports = { uploadFacts, withoutExcluded, repoName, summaryText, explanationText, resultText };

package/src/ai.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// The single named surface for every model-backed (LLM) call this CLI makes (talents-ai-score, arch-cleanup #4).
+// The single named surface for every model-backed (LLM) call this CLI makes.
 
 const agentSynthesis = require('./agent-synthesis');
 const agentEvaluation = require('./agent-evaluation');

package/src/ansi.js

@@ -3,7 +3,7 @@
 const { isInteractive } = require('./terminal-progress');
 const { BRAND_ANSI } = require('./brand-ansi');
 
-// THE ONE GATE for terminal colour (talents-ai-score).
+// THE ONE GATE for terminal colour.
 
 // `NO_COLOR` per the de-facto standard: present and non-empty disables colour, whatever the value.
 function noColorRequested(env = process.env) {

package/src/auth-client.js

@@ -2,9 +2,10 @@
 
 const { postJsonWithTimeout, extractSetCookie } = require('./backend-request');
 
-// Login / token acquisition against the Hub's better-auth email engine (owner decision, supersedes ADR-031 for the email path).
+// Login / token acquisition against the Hub's better-auth email engine.
 
 const DEFAULT_TIMEOUT_MS = 20000;
+const SIGN_OUT_TIMEOUT_MS = 3000;
 const SESSION_COOKIE_NAME = 'better-auth.session_token';
 // Refresh the cookie session's own validity from the Set-Cookie Max-Age; fall
 // back to 7 days (better-auth's default) when the attribute is absent.
@@ -88,12 +89,13 @@ function normalizeSignIn(status, raw, headers) {
 }
 
 // Mints a hub JWT from a better-auth session cookie: `GET {tokenEndpoint}` with the `Cookie` header.
-async function requestAuthToken({ cookie } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!cookie) return { ok: false, reason: 'no-cookie' };
+  if (!cookie && !sessionToken) return { ok: false, reason: 'no-cookie' };
+  const credential = cookie ? { Cookie: cookie } : { Authorization: `Bearer ${sessionToken}` };
   let res;
   try {
-    res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, { Cookie: cookie });
+    res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, credential);
   } catch (e) {
     return { ok: false, reason: (e && e.kind) || 'network-error' };
   }
@@ -133,7 +135,19 @@ async function requestLogin(
   };
 }
 
+async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin = null, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
+  if (!endpoint || (!cookie && !sessionToken)) return { ok: false, reason: 'no-credential' };
+  const credential = cookie ? { Cookie: cookie, ...(origin ? { Origin: origin } : {}) } : { Authorization: `Bearer ${sessionToken}` };
+  try {
+    const res = await postJsonWithTimeout(endpoint, {}, timeoutMs, 'POST', null, credential);
+    return { ok: res.status >= 200 && res.status < 300, status: res.status };
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+}
+
 module.exports = {
+  requestSignOut,
   requestLogin,
   requestAuthToken,
   normalizeSignIn,

package/src/auth-method-picker.js

@@ -3,7 +3,7 @@
 const { runInteractiveMultiSelect } = require('./interactive-select');
 const { methodsForFlow, methodLabel } = require('./auth-methods');
 
-// The shared interactive method picker for the CLI (talents-ai-score).
+// The shared interactive method picker for the CLI.
 async function askNumberedChoice(ask, promptText, count) {
   const raw = (await ask(promptText)).trim();
   if (!raw) return null;

package/src/auth-methods.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// The SINGLE source of truth for which auth methods exist and where each one is offered (talents-ai-score).
+// The SINGLE source of truth for which auth methods exist and where each one is offered.
 const AUTH_METHODS = [
   { id: 'email', labelKey: 'methodEmail', availableFor: { login: true, register: true } },
   { id: 'google', labelKey: 'methodGoogle', availableFor: { login: true, register: true } },

package/src/auth-session-store.js

@@ -4,8 +4,9 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
-// `~/.config/shakers/auth-session.json` — the logged-in Talent's session (talents-ai-score, issue 122 / ADR-044).
+// `~/.config/shakers/auth-session.json` — the logged-in Talent's session.
 
 // Hub's `UserSubtypeEnum` (shared/domain/enum/user-subtype.enum.ts), copied VERBATIM — this repo never invents a value the wire does not send.
 const PLATFORM_TALENT_USER_TYPES = new Set(['WORKS_TALENT', 'WORKS_PARTNER']);
@@ -89,12 +90,12 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
   const hubAccessToken = explicitHubToken || (typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null);
 
   const cookie = typeof session.cookie === 'string' && session.cookie ? session.cookie : null;
+  const sessionToken = typeof session.sessionToken === 'string' && session.sessionToken ? session.sessionToken : null;
   let expiresAt;
   let accessTokenExpiresAt;
-  if (cookie) {
-    expiresAt = (typeof session.cookieExpiresAt === 'string' && session.cookieExpiresAt)
-      ? session.cookieExpiresAt
-      : (typeof session.expiresAt === 'string' && session.expiresAt ? session.expiresAt : null);
+  if (cookie || sessionToken) {
+    expiresAt = [session.cookieExpiresAt, session.sessionExpiresAt, session.expiresAt]
+      .find((v) => typeof v === 'string' && v) || expiresAtFromToken(session.accessToken);
     accessTokenExpiresAt = (typeof session.accessTokenExpiresAt === 'string' && session.accessTokenExpiresAt)
       ? session.accessTokenExpiresAt
       : expiresAtFromToken(session.accessToken);
@@ -109,6 +110,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
       expiresAt: expiresAt ?? null,
       accessTokenExpiresAt: accessTokenExpiresAt ?? null,
       cookie,
+      sessionToken,
       email: (typeof session.email === 'string' && session.email ? session.email : null)
         || emailFromHubToken(hubAccessToken),
       hubAccessToken,
@@ -140,6 +142,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
     try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
     throw e;
   }
+  recordAccountMarker(cookie ? 'email' : sessionToken ? 'device' : 'token', env, { fs: fsImpl });
   return target;
 }
 
@@ -157,7 +160,8 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   // better-auth) or a JWT (Google/legacy, or an email session whose JWT is cached).
   const hasCookie = typeof parsed.cookie === 'string' && parsed.cookie;
   const hasToken = typeof parsed.accessToken === 'string' && parsed.accessToken;
-  if (!hasCookie && !hasToken) return null;
+  const sessionToken = typeof parsed.sessionToken === 'string' && parsed.sessionToken ? parsed.sessionToken : null;
+  if (!hasCookie && !hasToken && !sessionToken) return null;
   const hubAccessToken = typeof parsed.hubAccessToken === 'string' && parsed.hubAccessToken ? parsed.hubAccessToken : null;
   const email = (typeof parsed.email === 'string' && parsed.email ? parsed.email : null) || emailFromHubToken(hubAccessToken);
   return {
@@ -165,12 +169,17 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
     expiresAt: typeof parsed.expiresAt === 'string' ? parsed.expiresAt : null,
     accessTokenExpiresAt: typeof parsed.accessTokenExpiresAt === 'string' ? parsed.accessTokenExpiresAt : null,
     cookie: hasCookie ? parsed.cookie : null,
+    sessionToken,
     email,
     hubAccessToken,
     userType: typeof parsed.userType === 'string' && KNOWN_USER_TYPES.has(parsed.userType) ? parsed.userType : null,
   };
 }
 
+function hasAuthSessionFile(env = process.env, { fs: fsImpl = fs } = {}) {
+  return fsImpl.existsSync(authSessionPath(env));
+}
+
 // Removes the file. Idempotent and never throws — `logout` on no session is a
 // no-op, not a failure.
 function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
@@ -184,8 +193,8 @@ function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
 
 // `none | active | expired`, the three states the caller needs to give the Talent a true message.
 function sessionStatus(session, now = Date.now()) {
-  // A credential is either the durable cookie (email) or a JWT (Google/legacy).
-  const hasCred = !!(session && ((typeof session.accessToken === 'string' && session.accessToken) || (typeof session.cookie === 'string' && session.cookie)));
+  // A credential is a durable cookie or session token, or a JWT (Google/legacy).
+  const hasCred = !!(session && [session.accessToken, session.cookie, session.sessionToken].some((v) => typeof v === 'string' && v));
   if (!hasCred) return 'none';
   const expiry = Date.parse(String(session.expiresAt || ''));
   if (!Number.isFinite(expiry)) return 'expired';
@@ -204,6 +213,7 @@ module.exports = {
   authSessionPath,
   saveAuthSession,
   loadAuthSession,
+  hasAuthSessionFile,
   clearAuthSession,
   sessionStatus,
   isLoggedIn,

package/src/authorship-mismatch.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Display-only authorship-transparency check (talents-ai-score).
+// Display-only authorship-transparency check.
 //
 // Warns the talent when their commits in the selected repos are authored under
 // an email that is not their Shakers account email, so their own work would be

package/src/authorship.js

@@ -3,7 +3,7 @@
 const { execFileSync } = require('child_process');
 const path = require('path');
 
-// Git AUTHORSHIP + provenance for the certify phase (skill-code-certification, ADR-017).
+// Git AUTHORSHIP + provenance for the certify phase.
 
 const { takePrefetchedGitLog } = require('./git-log-prefetch');
 
@@ -164,7 +164,7 @@ function buildAttributionPredicate(verifiedEmail, authorizedSet) {
   };
 }
 
-// Applies the ADR-017 gate (with the ADR-023 widening for test identities) to ONE sampled Skill.
+// Applies the authorship gate (widened for test identities) to ONE sampled Skill.
 function attributeSample(sample, verifiedEmail, authorship, authorizedSet = null) {
   const isAttributable = buildAttributionPredicate(verifiedEmail, authorizedSet);
   const files = Array.isArray(sample.files) ? sample.files : [];

package/src/automations-detector.js

@@ -5,7 +5,7 @@ const path = require('path');
 const { execFileSync } = require('child_process');
 const { getHomeDir } = require('./env-paths');
 
-// Deterministic (no-LLM) automations detector (talents-ai-score, issue 017 / ADR-013-014).
+// Deterministic (no-LLM) automations detector.
 
 const AI_CLI_NAMES = ['claude', 'aider', 'gemini', 'codex'];
 const AI_CLI_RE = new RegExp(`\\b(${AI_CLI_NAMES.join('|')})\\b`, 'i');

package/src/backend-request.js

@@ -5,7 +5,7 @@ const https = require('https');
 const crypto = require('crypto');
 const { getHubBase } = require('./config');
 
-// ONE BACKEND: the certifications service (talents-ai-score, ADR-042).
+// ONE BACKEND: the certifications service.
 
 const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 
@@ -31,7 +31,7 @@ function profileUpdateSourceHeader(url, method) {
   return { 'X-Profile-Update-Source': clientIdentity };
 }
 
-// Extra request headers, sanitized (talents-ai-score, issue 038 — the agent certification interview needs `Authorization: Bearer <sessionToken>`).
+// Extra request headers, sanitized (the agent certification interview needs `Authorization: Bearer <sessionToken>`).
 const UNSAFE_HEADER_VALUE_RE = /[\r\n\0]/;
 
 function sanitizeExtraHeaders(extraHeaders) {
@@ -71,6 +71,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';
@@ -151,6 +152,7 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';
@@ -183,7 +185,7 @@ async function requestBackend({
     throw Object.assign(new Error('no endpoint configured'), { kind: 'no-endpoint' });
   }
 
-  // Optional trace (talents-ai-score, issue 109).
+  // Optional trace.
   const note = (entry) => {
     if (Array.isArray(trace)) trace.push(entry);
   };

package/src/brand-ansi.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// BRAND_ANSI — the Shakers brand palette, reincarnated as ANSI 256-colour SGR codes (talents-ai-score, terminal design-consistency pass).
+// BRAND_ANSI — the Shakers brand palette, reincarnated as ANSI 256-colour SGR codes.
 
 const BRAND_ANSI = {
   primary: '\x1b[38;5;73m',

package/src/browser-tools-detector.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Deterministic (no-LLM) browser tools detector (talents-ai-score, issue 018 / ADR-013-014).
+// Deterministic (no-LLM) browser tools detector.
 
 const BROWSER_DEPENDENCY_NAMES = new Set(['playwright', '@playwright/test', 'puppeteer', 'puppeteer-core']);
 

package/src/certify-disclaimer.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Legal disclaimer + EXPLICIT acceptance gate (ADR-001), shown before egress. Skill-code certify was retired (certify is now a dimension LiveKit interview); consumers today are the add-skill/add-agent/add-project consent gates.
+// Legal disclaimer + EXPLICIT acceptance gate, shown before egress. Skill-code certify was retired (certify is now a dimension LiveKit interview); consumers today are the add-skill/add-agent/add-project consent gates.
 
 const { renderLegalNotice } = require('./legal-notice');
 const { styleQuestion } = require('./ansi');

package/src/certify-remediation-prompt.js

@@ -2,7 +2,7 @@
 
 const { getCatalog } = require('./i18n');
 
-// Client-side "remediation prompt" for the certify report (skill-code- certification, issue 011).
+// Client-side "remediation prompt" for the certify report.
 function buildRemediationPrompt(item, lang) {
   const r = getCatalog(lang).certify.report;
   const improvements =

package/src/cli-args.js

@@ -39,7 +39,7 @@ function parseArgs(argv) {
     repo: false,
     scope: null,
     noAi: false,
-    // Issue 103: turns the section reveal off. Same name in both parsers, and the
+    // Turns the section reveal off. Same name in both parsers, and the
     // env var `NO_ANIMATION` does the same thing (the `NO_COLOR` pattern of 079).
     noAnimation: false,
   };
@@ -59,7 +59,7 @@ function parseArgs(argv) {
     else if (a === '--show-endpoint') opts.showEndpoint = true;
     else if (a === '--build-next-level') opts.buildNextLevel = true;
     else if (a === '--force') opts.force = true;
-    // ADR-016: the tier roadmap / "next steps" block is removed from the
+    // The tier roadmap / "next steps" block is removed from the
     // default footprint output; `--roadmap` (alias `--next`) shows it again.
     else if (a === '--roadmap' || a === '--next') opts.roadmap = true;
     else if (a === '--lang') opts.lang = VALID_LANGS.has(argv[++i]) ? argv[i] : null;

package/src/command-audit.js

@@ -3,7 +3,7 @@
 const os = require('os');
 const path = require('path');
 const { scrubSecrets } = require('./agent-synthesis');
-const { loadAuthSession } = require('./auth-session-store');
+const { loadAuthSession, decodeJwtPayload } = require('./auth-session-store');
 const { getCertsBase } = require('./config');
 const { postJsonWithTimeout } = require('./backend-request');
 
@@ -46,6 +46,11 @@ function machineHint() {
   return { osUser, hostname };
 }
 
+function jwtExpired(token, now) {
+  const payload = decodeJwtPayload(token);
+  return !!payload && typeof payload.exp === 'number' && payload.exp * 1000 <= now;
+}
+
 // Builds the record + headers; returns null when there is no endpoint to post to.
 function buildAudit(command, argv, env) {
   let base;
@@ -57,10 +62,8 @@ function buildAudit(command, argv, env) {
   if (!base) return null;
 
   const session = loadAuthSession(env);
-  const token =
-    session && (session.accessToken || session.hubAccessToken)
-      ? session.accessToken || session.hubAccessToken
-      : null;
+  const stored = (session && (session.accessToken || session.hubAccessToken)) || null;
+  const token = stored && !jwtExpired(stored, Date.now()) ? stored : null;
 
   const body = {
     command: String(command || 'unknown').slice(0, 100),

package/src/config-dir.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { getHomeDir, readEnv } = require('./env-paths');
 
-// Single source of truth for the CLI's config directory (ADR-045).
+// Single source of truth for the CLI's config directory.
 
 const DIR_NAME = 'shakers';
 const LEGACY_DIR_NAME = 'ai-footprint';