API - CODEX AGENTS: bearer session auth

README.md

@@ -25,6 +25,7 @@ All writes go through NODE.DC Agent Gateway, are scoped by agent grants, and are
 - Postgres migrations for agents, grants, token hashes, pairing codes, audit events, and idempotency keys.
 - Internal REST endpoints for agent profile, grant, and token lifecycle.
 - Opaque agent tokens are generated once and stored only as SHA-256 hashes.
+- Authenticated agent-session endpoint returns effective grants/scopes for future MCP calls.
 - MCP and Tasker write execution are documented but not implemented yet.
 
 ## Local development
@@ -54,4 +55,15 @@ curl -X POST http://127.0.0.1:4100/api/v1/agents \
   -d '{"owner_user_id":"local-user","owner_email":"local@example.test","display_name":"Local Codex"}'
 ```
 
+Create a token and inspect effective agent session:
+
+```bash
+TOKEN=$(curl -sS -X POST http://127.0.0.1:4100/api/v1/agents/<agent-id>/tokens \
+  -H 'Content-Type: application/json' \
+  -d '{"name":"Local Codex token"}' | jq -r .token)
+
+curl http://127.0.0.1:4100/api/v1/agent-session \
+  -H "Authorization: Bearer $TOKEN"
+```
+
 Do not expose these lifecycle endpoints publicly before the Launcher/internal auth layer is added.