Function refreshAgentToken

src/cli/auth-session.ts:370–404

(options: {
  session: CliSessionRecord;
  flags: CliFlags;
  env: EnvMap;
  io?: AuthIo;
})

}

async function refreshAgentToken(options: {
  session: CliSessionRecord;
  flags: CliFlags;
  env: EnvMap;
  io?: AuthIo;
}): Promise<{ accessToken: string; expiresAt?: string }> {
  const cloudBaseUrl = resolveCloudBaseUrl(options.env, options.session.cloudBaseUrl);
  const response = await postJson<CliSessionRefreshResponse>({
    baseUrl: cloudBaseUrl,
    pathName: CLI_SESSION_REFRESH_PATH,
    body: {
      refreshCredential: options.session.refreshCredential,
      tenant: options.flags.tenant,
      runId: options.flags.runId,
      daemonBaseUrl: options.flags.daemonBaseUrl,
      session: options.flags.session,
    },
    fetchImpl: options.io?.fetch,
  });
  if (hasToken(response.accessToken)) {
    return { accessToken: response.accessToken, expiresAt: response.expiresAt };
  }
  if (response.status === 'revoked' || response.error === 'revoked') {
    throw new AppError('UNAUTHORIZED', 'Stored cloud CLI session was revoked.', {
      hint: 'Run agent-device auth login again, or set AGENT_DEVICE_DAEMON_AUTH_TOKEN.',
      status: response.status,
      error: response.error,
    });
  }
  throw new AppError('UNAUTHORIZED', 'Failed to refresh CLI session.', {
    hint: 'Run agent-device auth login again, or set AGENT_DEVICE_DAEMON_AUTH_TOKEN.',
    status: response.status,
    error: response.error,
  });
}

async function pollDeviceAuth(options: {
  cloudBaseUrl: string;