Repository navigation
Report when the saved login ends; keep 403 apart from sign-in failures (0.3.15) - #27
Open
MainSequenceDev wants to merge 1 commit into
Open
MainSequenceDev wants to merge 1 commit into
MainSequenceDev wants to merge 1 commit into
Conversation
…s (0.3.15)
The backend ends a CLI/desktop login a fixed time after sign-in (five days by default,
ADR-0006 in tdag-django) and does not rotate refresh tokens, so the refresh token's `exp`
is the login's end. Until now the offline status ignored it: every host showed the user
signed in until a request failed.
- `status()` reads the refresh token's expiry: it returns `sessionEndsAt` and, once that
has passed, `authenticated: false` without contacting the backend. A checked status,
every request and `refresh-token` answer "The saved session for … ended on … UTC.
Sign in again." and send nothing. An access token still inside its five minutes does
not outlive the login it belongs to.
- `auth-status` names the end in its summary ("usable until …", "ended on … Sign in
again.").
- HTTP 403 is `FORBIDDEN` (a new error code), for the platform API and project MCP
endpoints: no renewal, no retry and no sign-in prompt. 401 stays `AUTH_REJECTED`; the
backend answers 401 for every expired, revoked or unknown login, including the MCP
gateway.
Tests cover the ended session (no request sent, session kept), the live session's end
date, a revoked session refused by the backend, and the 403 split.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
MainSequence CLI/desktop logins end a fixed time after sign-in (
CLI_LOGIN_SESSION_LIFETIME_SECONDS, five days by default; ADR-0006 in tdag-django). The backend does not rotate refresh tokens, so the refresh token'sexpis when the login ends. devtools' offline status ignored that claim, so the Claude, Codex and VS Code hosts, and the CLI, all showed the user as signed in until a request failed. devtools also treated a 403 like a dead login: it renewed, retried, then said "Sign in again" for what was really a missing permission.What changes
status()reads the refresh token's expiry. It returnssessionEndsAt. Once that time has passed, it returnsauthenticated: falsewithout contacting the backend.refresh-tokenanswer "The saved session for … ended on … UTC. Sign in again." and send nothing. The saved session is kept, so the next sign-in replaces it.auth-statussummary names the end: "usable until …" or "ended on … Sign in again."FORBIDDEN, a new error code, for the platform API and for project MCP endpoints. It triggers no renewal, no retry and no sign-in prompt. 401 staysAUTH_REJECTED. The backend answers 401 for every expired, revoked or unknown login, and so does the MCP gateway (mcp_gateway/authentication/asgi.py).Verification
npm run release:checkpasses: 186 tests, docs check, pack and package verification.FORBIDDEN.http://local-backend:8000:auth-statusreportssessionEndsAt: 2026-11-06T12:30:58Z, the same expiry measured on the refresh token, both offline and with--check.Hosts
Claude Desktop 0.4.25 (mainsequence-claude-desktop, branch
claude/expired-login-visible) builds on this. It warns a day ahead, shows the session as signed out at the end, and raises one notice across sessions. The Codex plugin and VS Code extension already treat onlyAUTH_REJECTEDandNOT_AUTHENTICATEDas sign-in failures, so a 403 stops asking them to sign in as soon as they take this version.🤖 Generated with Claude Code