fix(cli): refresh expired agent tokens; fix --once approval hang

Address heskew's two remaining non-blocking review notes on #1553:

- `harper agent` hard-failed on an expired stored operation token instead
  of self-healing via the refresh_token, unlike cliOperations.ts. Extract
  the refresh logic into a shared `refreshExpiredOperationToken` helper in
  cliOperations.ts and call it from both cliOperations and agentCli, so the
  two transports can't drift again.
- `--once` against a real TTY drains stdin via readAllStdin() before the
  first turn; if that turn then needed approval, resolveApprovals() built a
  new readline on the already-ended stdin and question() never resolved.
  Track actual stdin consumption (opts.stdinConsumed) instead of relying on
  isTTY, and fail loudly in that case like the non-TTY path already does.

Refs #1553

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: kriszyp

bin/agentCli.ts

@@ -16,6 +16,7 @@
 
 import * as readline from 'node:readline';
 import { loadCredentials, normalizeTarget } from './cliCredentials.ts';
+import { refreshExpiredOperationToken } from './cliOperations.ts';
 import { httpRequest } from '../utility/common_utils.ts';
 import { getHdbPid } from '../utility/processManagement/processManagement.js';
 import { initConfig, getConfigPath } from '../config/configUtils.ts';
@@ -32,6 +33,7 @@ interface CliOptions {
 	json: boolean;
 	once: boolean;
 	message?: string;
+	stdinConsumed?: boolean;
 }
 
 interface Connection {
@@ -65,7 +67,7 @@ export async function runAgentCli(argv: string[]): Promise<number> {
 
 	let connection: Connection;
 	try {
-		connection = resolveConnection(opts);
+		connection = await resolveConnection(opts);
 	} catch (err) {
 		console.error((err as Error).message);
 		return 1;
@@ -78,6 +80,7 @@ export async function runAgentCli(argv: string[]): Promise<number> {
 		} else if (opts.once || !process.stdin.isTTY) {
 			// Piped input / --once: treat all of stdin as a single prompt.
 			const piped = await readAllStdin();
+			opts.stdinConsumed = true;
 			if (!piped.trim()) {
 				console.error('No prompt provided.');
 				return 1;
@@ -139,7 +142,7 @@ function parseArgs(argv: string[]): CliOptions {
  * or Bearer auth, else the local domain socket. Mirrors the core of `cliOperations` without the
  * deploy-specific transport concerns.
  */
-function resolveConnection(opts: CliOptions): Connection {
+async function resolveConnection(opts: CliOptions): Promise<Connection> {
 	const credentials = loadCredentials();
 	const rawTarget =
 		opts.target || process.env.HARPER_CLI_TARGET || process.env.CLI_TARGET || (credentials && credentials.last_target);
@@ -170,6 +173,7 @@ function resolveConnection(opts: CliOptions): Connection {
 		} else {
 			const tokens = credentials?.targets?.[resolved];
 			if (tokens?.operation_token) {
+				await refreshExpiredOperationToken(options, tokens, resolved);
 				options.headers.Authorization = `Bearer ${tokens.operation_token}`;
 			} else if (username) {
 				options.headers.Authorization = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
@@ -325,9 +329,10 @@ class AgentClient {
 	private async resolveApprovals(session: any, rl?: readline.Interface): Promise<boolean> {
 		const pending = (session.pendingApprovals || []).filter((a: any) => a && !a.resolved);
 		if (!pending.length) return false;
-		// One-shot/piped paths have already read stdin to EOF (or there is no TTY), so a fresh readline
-		// on process.stdin would never resolve `question()` and the turn would hang forever. Fail loudly.
-		if (!rl && !process.stdin.isTTY) {
+		// One-shot/piped paths have already read stdin to EOF (no TTY, or `--once` drained a real
+		// TTY via readAllStdin), so a fresh readline on process.stdin would never resolve
+		// `question()` and the turn would hang forever. Fail loudly instead.
+		if (!rl && (this.opts.stdinConsumed || !process.stdin.isTTY)) {
 			throw new Error(
 				'Tool approval required, but no interactive terminal is available; re-run interactively to approve.'
 			);

bin/cliOperations.ts

@@ -249,7 +249,7 @@ function redactCredentials(req: any): any {
 	return redacted;
 }
 
-export { cliOperations, buildRequest, redactCredentials };
+export { cliOperations, buildRequest, redactCredentials, refreshExpiredOperationToken };
 const PREPARE_OPERATION: any = {
 	deploy_component: async (req) => {
 		if (req.package) {
@@ -327,6 +327,50 @@ function resolveTarget(req, allCredentials) {
 	);
 }
 
+/**
+ * If `tokens.operation_token` is expired and a `refresh_token` is on hand, refreshes it via
+ * `refresh_operation_token`, persisting the new token to the credentials file and updating
+ * `tokens.operation_token` in place. Shared by `cliOperations` and any other CLI transport
+ * (e.g. `harper agent`) authenticating with stored `harper login` tokens, so refresh behavior
+ * stays in one place instead of drifting between callers.
+ */
+async function refreshExpiredOperationToken(
+	options: any,
+	tokens: { operation_token: string; refresh_token: string },
+	lookupKey: string
+): Promise<void> {
+	if (!tokens.refresh_token || !isJWTExpired(tokens.operation_token)) return;
+	console.error('Operation token expired, attempting to refresh...');
+	try {
+		// Always use the standard operation timeout for this call, even when the caller's
+		// own options carry the longer SSE timeout (e.g. a deploy_component retry) — the
+		// refresh call itself is a small, fast request, not the streaming operation.
+		const refreshOptions = { ...options, timeout: CLI_OPERATION_TIMEOUT_MS };
+		refreshOptions.headers = { ...options.headers, Authorization: `Bearer ${tokens.refresh_token}` };
+		const refreshResponse = await httpRequest(refreshOptions, {
+			operation: 'refresh_operation_token',
+		});
+		if (refreshResponse.statusCode === 200) {
+			const refreshData = JSON.parse(refreshResponse.body);
+			if (refreshData.operation_token) {
+				tokens.operation_token = refreshData.operation_token;
+				saveCredentials(lookupKey, {
+					operation_token: tokens.operation_token,
+					refresh_token: tokens.refresh_token,
+				});
+				console.error('Operation token refreshed successfully.');
+			}
+		} else if (refreshResponse.statusCode === 401) {
+			console.error('Refresh token expired or invalid. Please run harper login again.');
+			process.exit(1);
+		} else {
+			console.error(`Failed to refresh operation token: ${refreshResponse.statusCode}`);
+		}
+	} catch (refreshErr) {
+		console.error(`Error refreshing operation token: ${refreshErr.message}`);
+	}
+}
+
 /**
  * Using a unix domain socket will send a request to hdb operations API server
  * @param req
@@ -403,36 +447,7 @@ async function cliOperations(req: any, skipResponseLog = false) {
 			}
 
 			if (tokens?.operation_token) {
-				if (tokens.refresh_token && isJWTExpired(tokens.operation_token)) {
-					console.error('Operation token expired, attempting to refresh...');
-					try {
-						const refreshOptions = { ...options, timeout: CLI_OPERATION_TIMEOUT_MS };
-						refreshOptions.headers = { ...options.headers, Authorization: `Bearer ${tokens.refresh_token}` };
-						const refreshResponse = await httpRequest(refreshOptions, {
-							operation: 'refresh_operation_token',
-						});
-						if (refreshResponse.statusCode === 200) {
-							const refreshData = JSON.parse(refreshResponse.body);
-							if (refreshData.operation_token) {
-								tokens.operation_token = refreshData.operation_token;
-								saveCredentials(lookupKey || target?.resolvedTarget, {
-									operation_token: tokens.operation_token,
-									refresh_token: tokens.refresh_token,
-								});
-								console.error('Operation token refreshed successfully.');
-								// Update the original request's authorization header with the new token
-								options.headers.Authorization = `Bearer ${tokens.operation_token}`;
-							}
-						} else if (refreshResponse.statusCode === 401) {
-							console.error('Refresh token expired or invalid. Please run harper login again.');
-							process.exit(1);
-						} else {
-							console.error(`Failed to refresh operation token: ${refreshResponse.statusCode}`);
-						}
-					} catch (refreshErr) {
-						console.error(`Error refreshing operation token: ${refreshErr.message}`);
-					}
-				}
+				await refreshExpiredOperationToken(options, tokens, lookupKey || target?.resolvedTarget);
 				options.headers.Authorization = `Bearer ${tokens.operation_token}`;
 			}
 		}