Exclude close() from CLI auto-registration.

Adding Groundlight.close for token-refresh lifecycle made the CLI crash on KeyError because close was not in _COMMAND_GROUPS. Also harden expires_at timezone comparisons.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Tim Huff

src/groundlight/cli.py

@@ -168,6 +168,7 @@ def wrapper(*args, **kwargs):
 # Methods that should not be exposed as CLI commands. Add a method here if its signature
 # cannot be cleanly represented as CLI arguments or if it is not useful as a shell command.
 _CLI_EXCLUDED_METHODS = {
+    "close",  # lifecycle helper for the SDK client; not useful as a shell command
     "create_roi",  # returns an ROI object that must be passed to another API call; not useful standalone
     "get_raw_headers",  # returns the API token in plaintext
     "make_generic_api_request",

src/groundlight/token_manager.py

@@ -358,7 +358,10 @@ def _install_slot(self, slot: TokenSlot) -> None:
         self._set_api_token(slot.current.raw_key)
 
     def _is_expired(self, token: CachedToken) -> bool:
-        return _utcnow() >= token.expires_at
+        expires_at = token.expires_at
+        if expires_at.tzinfo is None:
+            expires_at = expires_at.replace(tzinfo=timezone.utc)
+        return _utcnow() >= expires_at.astimezone(timezone.utc)
 
     def _read_slot(self) -> Optional[TokenSlot]:
         if not self._slot_path.exists():