fix(openbao-session): always pass -ttl so session tokens stay short-lived

Without an explicit -ttl the role path could mint ~32-day session tokens.
Pass SESSION_TTL in both role and policy modes. Bump 0.1.3.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/openbao-session/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openbao-session",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
   "author": { "name": "Senkensha" },
   "hooks": "./hooks/claude-codex-hooks.json"

plugins/openbao-session/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "openbao-session",
-  "version": "0.1.2+codex.20260901112838",
+  "version": "0.1.3+codex.20260901113700",
   "description": "Provisions a short-lived OpenBao session token for interactive agent sessions.",
   "author": {
     "name": "Local developer"

plugins/openbao-session/hooks/bao-session.sh

@@ -110,10 +110,10 @@ mint_session_token() {
     create_args+=(-role="$SESSION_ROLE")
     [ -n "$SESSION_ENTITY" ] && create_args+=(-entity-alias="$SESSION_ENTITY")
   else
-    create_args+=(-policy="$SESSION_POLICY" -ttl="$SESSION_TTL")
+    create_args+=(-policy="$SESSION_POLICY")
   fi
   json="$(BAO_ADDR="$BAO_ADDR_URL" BAO_CACERT="$CACERT" BAO_TLS_SERVER_NAME="$TLS_NAME" BAO_TOKEN="$bootstrap" \
-    "$BAO_BIN" token create "${create_args[@]}" -renewable \
+    "$BAO_BIN" token create "${create_args[@]}" -ttl="$SESSION_TTL" -renewable \
     -display-name="openbao-session-$(hostname)" -format=json)" || { log "token create failed"; return 1; }
   SESSION_TOKEN="$(printf '%s' "$json" | jq -r '.auth.client_token // empty')"
   [ -n "$SESSION_TOKEN" ] || { log "no client_token in token create response"; return 1; }