Agent status token: 12 h (founder decision 65d8aed4, exception to SI-14 for nk-agent-status)

make agent-status-token requests --duration=12h and prints the real expiry from the token's exp claim
(tools/agent-status/token_expiry.py, never the token), since the API server may cap a duration.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0

tools/agent-status/tests/test_token_expiry.py

@@ -0,0 +1,38 @@
+"""token_expiry.py on synthetic JWTs (NK-WP-0058-T05): only the expiry is printed."""
+import base64
+import datetime as dt
+import importlib.util
+import json
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[3]
+spec = importlib.util.spec_from_file_location('token_expiry', REPO / 'tools/agent-status/token_expiry.py')
+te = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(te)
+
+
+def jwt(exp):
+    enc = lambda d: base64.urlsafe_b64encode(json.dumps(d).encode()).decode().rstrip('=')
+    return f"{enc({'alg': 'RS256'})}.{enc({'exp': exp, 'sub': 'synthetic'})}.c2lnbmF0dXJl"
+
+
+def test_prints_expiry_only(tmp_path, capsys):
+    exp = int((dt.datetime.now(dt.timezone.utc) + dt.timedelta(hours=12)).timestamp())
+    token = tmp_path / 't'
+    token.write_text(jwt(exp) + '\n')
+    assert te.main([str(token)]) == 0
+    out = capsys.readouterr().out
+    assert out.startswith('agent-status-token: valid until ')
+    assert '(12.0 h)' in out or '(11.9 h)' in out
+    assert jwt(exp) not in out and 'synthetic' not in out
+
+
+def test_expired_missing_and_malformed_fail(tmp_path, capsys):
+    old = tmp_path / 'old'
+    old.write_text(jwt(int(dt.datetime(2020, 1, 1, tzinfo=dt.timezone.utc).timestamp())))
+    assert te.main([str(old)]) == 1
+    bad = tmp_path / 'bad'
+    bad.write_text('not-a-token')
+    assert te.main([str(bad)]) == 1
+    assert te.main([str(tmp_path / 'absent')]) == 1
+    assert 'not-a-token' not in capsys.readouterr().out