[mscoutermarsh]

Add pscale service-token update so a service token's name or expiry can be changed without rotating its secret.

Details

Decisions

• pscale service-token update <id> sends PATCH to /v1/organizations/{org}/service-tokens/{id}, the member path get and delete already use.
• The body includes only the flags that were passed: name and ttl. The id stays in the path. Grants are not sent. There is no secret field, so the secret is neither printed nor rotated.
• --name and --ttl are each optional. At least one is required. A flag that is left off is left out of the body, so that value stays as it is.
• --ttl is a number of seconds, the same unit as service-token create. Create's integer flag treats 0 as no expiry by omitting ttl. Update cannot use omission for that, because an omitted --ttl means leave the expiry. --ttl never sends ttl as JSON null to clear it. Any other integer, including 0, is sent as that number.
• The one-year cap, and rejection of an expired or revoked token, stay on the server. The CLI prints that response the same way the other service-token commands print API errors. A missing token is reported the same way as show and duplicate.
• Output uses the existing service-token details printer, which has no secret column. Create's printer is only for a secret that was just minted.
• An explicit --name "" is sent as an empty string.

Test

TestServiceToken_UpdateCmd in internal/cmd/token/create_test.go. It runs service-token update through the real client and checks the PATCH body is {"name":"renamed","ttl":3600} and does not contain the secret. The printed JSON also omits the secret the server returned.

Checked against a local API: rename leaves the secret, id, and grants in place; --ttl seconds sets expiry; --ttl never clears it; --ttl 0 is rejected.

Skipped

Interactive prompts, a new HTTP client, shell completions beyond what the sibling commands already get, duration strings such as 30m (create takes raw seconds), documentation, and any change to grants or the secret.

Risks

--ttl never is encoded as JSON null. The local API accepts that and clears expires_at. The focused test does not cover --ttl never, a name-only update, or the one-year and expired-token errors.

  

[cursor]

Risk: medium. Approved. Cursor Bugbot completed with no findings; Cursor Security Agent was not running, so that signal was skipped. Human review is not required.

  

_{Sent by Cursor Approval Agent: cli-reviewer}