CLI bearer tokens (HMAC-signed JWTs, kid: cli-v1, iss: shared-memory:cli) were hardcoded to a 30-day expiry. This makes the lifetime configurable with a longer default.
Change
New env var CLI_TOKEN_TTL_DAYS controls the lifetime of newly minted CLI tokens.
Default: 90 days (up from the previous hardcoded 30).
Value must be a positive integer number of days; if unset, blank, or invalid it safely falls back to 90.
All other token claims (iss, aud, sub, jti, oidc_iss, oidc_sub, kid, etc.) are unchanged.
Documented in .env.example.
apps/web/lib/auth/cli-token.ts — CLI_TOKEN_TTL_SECONDS is now derived from the env var via a small safe parser instead of the constant 60 * 60 * 24 * 30.
Important: existing tokens are unaffected
This only changes the exp of tokens minted from now on. Already-issued tokens keep their original expiry. To get the longer TTL, mint a fresh token from the Settings / tokens page.
Verification
tsc --noEmit (apps/web typecheck) passes.
## What
CLI bearer tokens (HMAC-signed JWTs, `kid: cli-v1`, `iss: shared-memory:cli`) were hardcoded to a **30-day** expiry. This makes the lifetime configurable with a longer default.
## Change
- New env var **`CLI_TOKEN_TTL_DAYS`** controls the lifetime of newly minted CLI tokens.
- **Default: 90 days** (up from the previous hardcoded 30).
- Value must be a **positive integer** number of days; if unset, blank, or invalid it safely falls back to 90.
- All other token claims (`iss`, `aud`, `sub`, `jti`, `oidc_iss`, `oidc_sub`, `kid`, etc.) are unchanged.
- Documented in `.env.example`.
`apps/web/lib/auth/cli-token.ts` — `CLI_TOKEN_TTL_SECONDS` is now derived from the env var via a small safe parser instead of the constant `60 * 60 * 24 * 30`.
## Important: existing tokens are unaffected
This only changes the `exp` of tokens **minted from now on**. Already-issued tokens keep their original expiry. To get the longer TTL, mint a fresh token from the Settings / tokens page.
## Verification
`tsc --noEmit` (apps/web `typecheck`) passes.
CLI tokens were hardcoded to a 30-day expiry. Make the lifetime
configurable via the CLI_TOKEN_TTL_DAYS env var, with a longer default
of 90 days. The value must be a positive integer number of days; unset
or invalid input falls back to 90. All other token claims are unchanged.
Only affects newly minted tokens — already-issued tokens keep their
original exp.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jknapp
merged commit 2a94acddf3 into main2026-06-12 19:01:41 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What
CLI bearer tokens (HMAC-signed JWTs,
kid: cli-v1,iss: shared-memory:cli) were hardcoded to a 30-day expiry. This makes the lifetime configurable with a longer default.Change
CLI_TOKEN_TTL_DAYScontrols the lifetime of newly minted CLI tokens.iss,aud,sub,jti,oidc_iss,oidc_sub,kid, etc.) are unchanged..env.example.apps/web/lib/auth/cli-token.ts—CLI_TOKEN_TTL_SECONDSis now derived from the env var via a small safe parser instead of the constant60 * 60 * 24 * 30.Important: existing tokens are unaffected
This only changes the
expof tokens minted from now on. Already-issued tokens keep their original expiry. To get the longer TTL, mint a fresh token from the Settings / tokens page.Verification
tsc --noEmit(apps/webtypecheck) passes.