fix(cli): refresh the CAS upload token before it expires

Merged
JI
21d ago
+298-5

The CAS upload token expires 30 seconds after the control plane issues it. The CLI requested the token before it crafted a material. When crafting took longer than 30 seconds, the upload failed with a "JWT expired" error. Secret redaction of big AI coding sessions (#3368) is one example: it can take minutes.

This change makes the CLI get the CAS token when each upload starts:

  • grpcconn has a new WithTokenProvider option. The connection asks the provider for the bearer token on each call.
  • The CLI caches the CAS token. If the cached token expires in less than 10 seconds, the CLI requests a new token from the control plane.

The crafter and the CAS client are unchanged.

Fixes PFM-7428

AI disclosure: this change was produced with the assistance of Claude Code.