arthur-onboard-platform-token

name	arthur-onboard-platform-token
description	Arthur onboarding helper — Refresh Arthur Platform OAuth2 token using arthur_client. Reads CLIENT_ID/SECRET from .arthur-engine.env, writes ARTHUR_PLATFORM_TOKEN back to state.
allowed-tools	Bash
version	1.0.0

Arthur Onboard — Platform Token Refresh

Goal: Write a fresh ARTHUR_PLATFORM_TOKEN to .arthur-engine.env using stored service account credentials.

python3 -c "import arthur_client" 2>/dev/null || pip install arthur-client -q

ARTHUR_PLATFORM_URL=$(grep '^ARTHUR_PLATFORM_URL=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)
CLIENT_ID=$(grep '^ARTHUR_PLATFORM_CLIENT_ID=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)
CLIENT_SECRET=$(grep '^ARTHUR_PLATFORM_CLIENT_SECRET=' .arthur-engine.env 2>/dev/null | cut -d= -f2-)

if [ -z "$CLIENT_SECRET" ]; then
  echo "TOKEN_REFRESH=MISSING_CREDENTIALS"
else
  export _AE_URL="$ARTHUR_PLATFORM_URL"
  export _AE_CLIENT_ID="$CLIENT_ID"
  export _AE_CLIENT_SECRET="$CLIENT_SECRET"

  ARTHUR_PLATFORM_TOKEN=$(python3 - <<'PYEOF'
import sys, os
try:
    from arthur_client.auth import ArthurClientCredentialsAPISession, ArthurOIDCMetadata
    metadata = ArthurOIDCMetadata(os.environ["_AE_URL"])
    session = ArthurClientCredentialsAPISession(
        client_id=os.environ["_AE_CLIENT_ID"],
        client_secret=os.environ["_AE_CLIENT_SECRET"],
        metadata=metadata,
    )
    print(session.token()["access_token"])
except Exception as e:
    print(f"ERROR: {e}", file=sys.stderr)
    sys.exit(1)
PYEOF
  )
  if [ -n "$ARTHUR_PLATFORM_TOKEN" ]; then
    grep -v '^ARTHUR_PLATFORM_TOKEN=' .arthur-engine.env > /tmp/ae_env_tmp && mv /tmp/ae_env_tmp .arthur-engine.env
    echo "ARTHUR_PLATFORM_TOKEN=$ARTHUR_PLATFORM_TOKEN" >> .arthur-engine.env
    echo "TOKEN_REFRESH=OK"
  else
    echo "TOKEN_REFRESH=FAILED"
  fi
fi

• TOKEN_REFRESH=OK → token acquired and saved to .arthur-engine.env; exit this skill
• TOKEN_REFRESH=MISSING_CREDENTIALS → CLIENT_ID or CLIENT_SECRET not in state; caller must invoke arthur-onboard-platform-access first
• TOKEN_REFRESH=FAILED → arthur_client raised an error (invalid credentials, network error, etc.); caller should re-invoke arthur-onboard-platform-access to re-authenticate