Every HTTP request the CLI makes now times out after 10 s. A refresh makes at most three requests, so the refresh lock's stale time is raised to 60 s and the wait for another process's refresh to 40 s; a slow refresh is no longer mistaken for a dead one and its refresh token spent twice. The same client adds the authorities DIDBOT_EXTRA_CA_CERTS names to its roots, so the CLI reaches a didbot .localhost zone (the rest of 3mwixdqkpbq2j is #113).
A session file's name now encodes every non-alphanumeric byte of the DID as _ and two hex digits, so did:web:a-b.x and did:web:a.b.x get separate files. Session::load falls back to the old name and refuses a file that holds another DID's session.
--open is removed. The help text and module doc now say that a didbot sign-in is approved with didbot oauth approve, and that a browser opening the URL sees a page that waits for that approval. Fixes 3mwixd3fuwa2f and 3mwiycjjsha25 (https://tangled.org/permadeath.com/vibescrobble.com/issues).
🤖 Generated with Claude Code