From the #134 code review (residual finding #9, P3, agent-native lens).
All four auth-failure shapes — never authenticated, expired stored session, expired ANDAMIO_JWT, expired dev session — collapse to `{"error": "", "kind": "auth"}` (exit 3). The expiry timestamp is rendered RFC1123-local inside the message, and the recovery action (`user login` vs unset `ANDAMIO_JWT` vs `dev refresh`) is only recoverable by substring matching, which is exactly how our own tests assert it.
Proposal (contract change — needs owner sign-off before 1.x): add optional structured fields to the JSON error envelope for auth failures, e.g. `expires_at` (RFC3339, matching `session_expires_at`) and `recovery` (a stable enum: `user_login`, `env_jwt`, `dev_refresh`, `dev_login`), or alternatively finer kinds (`auth_missing` vs `auth_expired`). Additive, so existing consumers keep working.
Not a 1.0 blocker; `user status --output json`'s `session_expired` covers the pre-flight probe case today.
Review artifact: ce-code-review run 20260731-075336-3e991fdd.
From the #134 code review (residual finding #9, P3, agent-native lens).
All four auth-failure shapes — never authenticated, expired stored session, expired ANDAMIO_JWT, expired dev session — collapse to `{"error": "", "kind": "auth"}` (exit 3). The expiry timestamp is rendered RFC1123-local inside the message, and the recovery action (`user login` vs unset `ANDAMIO_JWT` vs `dev refresh`) is only recoverable by substring matching, which is exactly how our own tests assert it.
Proposal (contract change — needs owner sign-off before 1.x): add optional structured fields to the JSON error envelope for auth failures, e.g. `expires_at` (RFC3339, matching `session_expires_at`) and `recovery` (a stable enum: `user_login`, `env_jwt`, `dev_refresh`, `dev_login`), or alternatively finer kinds (`auth_missing` vs `auth_expired`). Additive, so existing consumers keep working.
Not a 1.0 blocker; `user status --output json`'s `session_expired` covers the pre-flight probe case today.
Review artifact: ce-code-review run 20260731-075336-3e991fdd.