@agentteams/cli 0.1.83 → 0.1.84

package/dist/commands/auth.js

@@ -0,0 +1,245 @@
+/**
+ * `agentteams auth login | status | logout`.
+ *
+ * The default authentication path for new projects and the migration path for
+ * legacy configs. The stored credential is picked up by `resolveCredential()`
+ * when the config has no `key_`, or when a migrated legacy project carries
+ * `authMode: 'personal-token'`.
+ */
+import open from 'open';
+import { getPersonalTokenClient, PersonalTokenError } from '../auth/personalTokenClient.js';
+import { startAuthorizationCodeServer, createAuthState, createPkcePair } from '../utils/authServer.js';
+import { DEFAULT_API_URL, findProjectConfig, loadProjectConfig, resolveCredential, setProjectAuthMode, } from '../utils/config.js';
+import { createSpinner } from '../utils/spinner.js';
+import { withCommandContext } from '../utils/commandContext.js';
+const AUTH_BASE_URL = process.env.AGENTTEAMS_WEB_URL || 'https://agentteams.run';
+/**
+ * Where to log in. Unlike the legacy `init` path this honours the project's own
+ * `apiUrl`, because a refresh token issued by the dev API is worthless against
+ * production and storing it under the wrong server would silently fail later.
+ */
+export function resolveAuthApiUrl(options) {
+    const candidate = (typeof options?.apiUrl === 'string' && options.apiUrl.length > 0 ? options.apiUrl : undefined) ??
+        process.env.AGENTTEAMS_API_URL ??
+        loadProjectConfig()?.apiUrl ??
+        DEFAULT_API_URL;
+    return candidate.replace(/\/+$/, '');
+}
+export function buildPersonalTokenAuthorizeUrl(input) {
+    const params = new URLSearchParams({
+        port: String(input.port),
+        state: input.state,
+        code_challenge: input.codeChallenge,
+    });
+    if (input.projectName) {
+        params.set('projectName', input.projectName);
+    }
+    return `${AUTH_BASE_URL.replace(/\/+$/, '')}/cli/authorize?${params.toString()}`;
+}
+function isSshEnvironment() {
+    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY);
+}
+async function tryOpenBrowser(url) {
+    console.log('🔐 Complete the AgentTeams login in your browser:');
+    console.log(url);
+    // Headless and SSH sessions have no browser to open; the printed URL is the
+    // whole interface there, exactly as in `init`.
+    if (isSshEnvironment()) {
+        return;
+    }
+    try {
+        await open(url);
+    }
+    catch {
+        // Already printed.
+    }
+}
+/**
+ * Run the browser round trip and exchange the resulting code for tokens.
+ *
+ * Exported so `init --auth personal-token` reuses the identical flow rather than
+ * growing a second copy of the PKCE handshake.
+ */
+export async function performPersonalTokenLogin(input) {
+    const client = getPersonalTokenClient(input.apiUrl);
+    const pkce = createPkcePair();
+    const authContext = await startAuthorizationCodeServer({ state: createAuthState() });
+    const authUrl = buildPersonalTokenAuthorizeUrl({
+        port: authContext.port,
+        state: authContext.state,
+        codeChallenge: pkce.challenge,
+        ...(input.projectName ? { projectName: input.projectName } : {}),
+    });
+    await tryOpenBrowser(authUrl);
+    const spinner = createSpinner('Waiting for authorization... (Ctrl+C to cancel)');
+    try {
+        const callback = await authContext.waitForCallback();
+        spinner?.succeed();
+        const session = await client.exchangeAuthorizationCode({
+            code: callback.code,
+            codeVerifier: pkce.verifier,
+            // Must match the redirect the web registered the code against.
+            redirectUri: `http://localhost:${authContext.port}/callback`,
+        });
+        const state = client.state();
+        return {
+            authUrl,
+            identity: session.identity,
+            persisted: state.persisted,
+            storeBackend: state.storeBackend,
+            storeReason: state.storeReason,
+        };
+    }
+    catch (error) {
+        spinner?.fail();
+        throw error;
+    }
+    finally {
+        if (authContext.server.listening) {
+            authContext.server.close();
+        }
+    }
+}
+async function login(options) {
+    const requestedApiUrl = typeof options.apiUrl === 'string' ? options.apiUrl : undefined;
+    const apiUrl = resolveAuthApiUrl({ apiUrl: requestedApiUrl });
+    // What every later command will resolve against. The refresh token is filed
+    // under the server that issued it, so logging in to a different one would
+    // store the credential in a slot nothing ever reads — a "success" that makes
+    // the very next command fail.
+    const projectApiUrl = resolveAuthApiUrl();
+    if (apiUrl !== projectApiUrl) {
+        throw new PersonalTokenError('TRANSIENT', `This project talks to ${projectApiUrl}, so a login to ${apiUrl} would be stored where no command looks for it. ` +
+            `Point the project at that server first (set apiUrl in .agentteams/config.json or AGENTTEAMS_API_URL), then run 'agentteams auth login' without --api-url.`);
+    }
+    const outcome = await performPersonalTokenLogin({ apiUrl });
+    const configPath = findProjectConfig(process.cwd());
+    // Opting the project in is what makes later commands prefer this credential.
+    // Only ever done for a credential that outlives this process: flipping the
+    // project over to a login the next command cannot find would lock it out
+    // entirely when there is no `key_` left to fall back to.
+    const opted = configPath && outcome.persisted ? setProjectAuthMode(configPath, 'personal-token') : false;
+    const result = {
+        success: true,
+        authUrl: outcome.authUrl,
+        apiUrl,
+        identity: outcome.identity,
+        persisted: outcome.persisted,
+        storeBackend: outcome.storeBackend,
+        storeReason: outcome.storeReason,
+        configPath: opted ? configPath : null,
+        authMode: 'personal-token',
+    };
+    if (!outcome.persisted) {
+        result.warning =
+            'The login is kept in memory for this process only, so this project was left on its existing credential. ' +
+                'For CI and headless machines, keep using an API key (AGENTTEAMS_API_KEY).';
+    }
+    else if (!opted) {
+        result.warning =
+            "No project config was found, so nothing was switched to the personal login. Run 'agentteams init' in the project first, then run this again.";
+    }
+    return result;
+}
+async function status(options = {}) {
+    const apiUrl = resolveAuthApiUrl({ apiUrl: typeof options.apiUrl === 'string' ? options.apiUrl : undefined });
+    const projectConfig = loadProjectConfig();
+    const client = getPersonalTokenClient(apiUrl);
+    // Reading the state must not require a working network: a token that cannot
+    // be refreshed right now is still worth reporting as present.
+    const tokenState = client.state();
+    let credentialSource = null;
+    let problem;
+    try {
+        // The same apiUrl this command reports, so `apiUrl` and `credentialSource`
+        // can never describe two different servers.
+        credentialSource = (await resolveCredential({ apiUrl }))?.source ?? null;
+    }
+    catch (error) {
+        problem = error instanceof Error ? error.message : String(error);
+    }
+    const refreshedState = client.state();
+    const result = {
+        apiUrl,
+        configPath: findProjectConfig(process.cwd()),
+        credentialSource,
+        authMode: projectConfig?.authMode ?? null,
+        hasProjectApiKey: typeof projectConfig?.apiKey === 'string' && projectConfig.apiKey.length > 0,
+        personalToken: {
+            connected: tokenState.connected,
+            persisted: tokenState.persisted,
+            storeBackend: tokenState.storeBackend,
+            storeReason: tokenState.storeReason,
+            reconnectRequired: refreshedState.reconnectRequired,
+            identity: refreshedState.identity,
+            expiresAt: refreshedState.expiresAt ? new Date(refreshedState.expiresAt).toISOString() : null,
+        },
+    };
+    if (problem)
+        result.problem = problem;
+    return result;
+}
+/**
+ * Leave the personal-token path.
+ *
+ * Reverting `authMode` is the part that must always be reachable: a project
+ * left on `personal-token` with no credential fails every command, so a missing
+ * keychain entry or an unreachable server cannot be allowed to trap the user in
+ * a state only a hand-edited config file gets out of.
+ */
+async function logout(options = {}) {
+    const apiUrl = resolveAuthApiUrl({ apiUrl: typeof options.apiUrl === 'string' ? options.apiUrl : undefined });
+    const client = getPersonalTokenClient(apiUrl);
+    const localOnly = options.local === true;
+    let revokedOnServer = false;
+    let warning;
+    if (!client.hasCredential()) {
+        warning = `No AgentTeams login was stored for ${apiUrl}; only the project setting was reverted.`;
+    }
+    else if (localOnly) {
+        client.forgetLocalCredential();
+        warning =
+            'The local credential was removed without contacting the server, so the token is still valid there. ' +
+                'Revoke it from the AgentTeams web app if you no longer want it.';
+    }
+    else {
+        try {
+            // Server first: clearing locally and then failing the revoke would leave a
+            // live refresh token the owner can no longer see or cancel.
+            await client.revoke();
+            revokedOnServer = true;
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new PersonalTokenError('REVOKE_FAILED', `${detail} Run 'agentteams auth logout --local' to leave the personal login path anyway.`);
+        }
+    }
+    const configPath = findProjectConfig(process.cwd());
+    const reverted = configPath ? setProjectAuthMode(configPath, null) : false;
+    const projectConfig = loadProjectConfig();
+    const result = {
+        success: true,
+        apiUrl,
+        configPath: reverted ? configPath : null,
+        revokedOnServer,
+        fellBackToApiKey: typeof projectConfig?.apiKey === 'string' && projectConfig.apiKey.length > 0,
+    };
+    if (warning)
+        result.warning = warning;
+    return result;
+}
+export async function executeAuthCommand(action, options = {}) {
+    return withCommandContext(`auth:${action}`, async () => {
+        switch (action) {
+            case 'login':
+                return login(options);
+            case 'status':
+                return status(options);
+            case 'logout':
+                return logout(options);
+            default:
+                throw new Error(`Unknown action: ${action}. Expected one of: login, status, logout.`);
+        }
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAE5F,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;AAmDjF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,SAAS,GACb,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,iBAAiB,EAAE,EAAE,MAAM;QAC3B,eAAe,CAAC;IAClB,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAK9C;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK,CAAC,aAAa;KACpC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW;IACvC,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEjB,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA+C;IAO7F,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,8BAA8B,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,iDAAiD,CAAC,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,CAAC;QAEnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC;YACrD,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,YAAY,EAAE,IAAI,CAAC,QAAQ;YAC3B,+DAA+D;YAC/D,WAAW,EAAE,oBAAoB,WAAW,CAAC,IAAI,WAAW;SAC7D,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAgC;IACnD,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9D,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAE1C,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,yBAAyB,aAAa,mBAAmB,MAAM,kDAAkD;YAC/G,2JAA2J,CAC9J,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,KAAK,GAAG,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAEzG,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACrC,QAAQ,EAAE,gBAAgB;KAC3B,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO;YACZ,0GAA0G;gBAC1G,2EAA2E,CAAC;IAChF,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,OAAO;YACZ,8IAA8I,CAAC;IACnJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,UAAmC,EAAE;IACzD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9G,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE9C,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAElC,IAAI,gBAAgB,GAA4B,IAAI,CAAC;IACrD,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,2EAA2E;QAC3E,4CAA4C;QAC5C,gBAAgB,GAAG,CAAC,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAqB;QAC/B,MAAM;QACN,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC5C,gBAAgB;QAChB,QAAQ,EAAE,aAAa,EAAE,QAAQ,IAAI,IAAI;QACzC,gBAAgB,EAAE,OAAO,aAAa,EAAE,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAC9F,aAAa,EAAE;YACb,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;YACnD,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;SAC9F;KACF,CAAC;IAEF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,MAAM,CAAC,UAAmC,EAAE;IACzD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IAEzC,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,OAA2B,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;QAC5B,OAAO,GAAG,sCAAsC,MAAM,0CAA0C,CAAC;IACnG,CAAC;SAAM,IAAI,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,qBAAqB,EAAE,CAAC;QAC/B,OAAO;YACL,qGAAqG;gBACrG,iEAAiE,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,2EAA2E;YAC3E,4DAA4D;YAC5D,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,GAAG,MAAM,gFAAgF,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAqB;QAC/B,OAAO,EAAE,IAAI;QACb,MAAM;QACN,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACxC,eAAe;QACf,gBAAgB,EAAE,OAAO,aAAa,EAAE,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;KAC/F,CAAC;IACF,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,UAAmC,EAAE;IAC5F,OAAO,kBAAkB,CAAC,QAAQ,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;QACrD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;YACxB,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB;gBACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,2CAA2C,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAEA,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CA0BvE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAEA,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAyCvE"}

package/dist/commands/config.js

@@ -1,16 +1,28 @@
-import { findProjectConfig, loadConfig } from '../utils/config.js';
+import { findProjectConfig, loadConfigWithCredential, loadProjectConfig } from '../utils/config.js';
 export async function executeConfigCommand(action) {
     switch (action) {
         case 'whoami': {
             const configPath = findProjectConfig(process.cwd());
-            const config = loadConfig();
+            const authMode = loadProjectConfig()?.authMode ?? null;
+            // `whoami` is the command people run *because* something is wrong, so a
+            // credential that cannot be resolved is reported, never thrown.
+            let config = null;
+            let problem;
+            try {
+                config = await loadConfigWithCredential();
+            }
+            catch (error) {
+                problem = error instanceof Error ? error.message : String(error);
+            }
             if (!config) {
                 return {
                     apiUrl: process.env.AGENTTEAMS_API_URL,
                     projectId: process.env.AGENTTEAMS_PROJECT_ID,
                     teamId: process.env.AGENTTEAMS_TEAM_ID,
                     hasApiKey: Boolean(process.env.AGENTTEAMS_API_KEY),
+                    authMode,
                     configPath,
+                    ...(problem ? { problem } : {}),
                 };
             }
             return {
@@ -18,6 +30,8 @@ export async function executeConfigCommand(action) {
                 projectId: config.projectId,
                 teamId: config.teamId,
                 hasApiKey: Boolean(config.apiKey),
+                credentialSource: config.credentialSource,
+                authMode,
                 configPath,
             };
         }

package/dist/commands/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;oBAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAClD,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACjC,UAAU;aACX,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,iBAAiB,EAAE,EAAE,QAAQ,IAAI,IAAI,CAAC;YAEvD,wEAAwE;YACxE,gEAAgE;YAChE,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC;YAC5C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBACtC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;oBAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;oBACtC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;oBAClD,QAAQ;oBACR,UAAU;oBACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,QAAQ;gBACR,UAAU;aACX,CAAC;QACJ,CAAC;QACD;YACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/commands/convention.d.ts

@@ -49,6 +49,12 @@ export type ConventionStatusResult = {
     hints: string[];
     /** One-line human-readable summary. */
     summary: string;
+    /**
+     * Set when the project *is* configured but its credential could not be
+     * resolved. Distinguishes "nothing to check" from "could not check" — the
+     * latter must never read as "up to date".
+     */
+    credentialProblem?: string;
 };
 export declare function buildStatusSummary(result: ConventionFreshnessResult): string;
 /**
@@ -58,6 +64,11 @@ export declare function buildStatusSummary(result: ConventionFreshnessResult): s
  * update is available — it never downloads or mutates anything. Degrades gracefully
  * (exit 0, updateAvailable=false) when the project is not configured or has no local
  * conventions yet, so callers can safely "check then skip when unavailable".
+ *
+ * "Not configured" and "configured but the credential failed" are reported
+ * differently on purpose. The platform convention makes this the session-start
+ * freshness gate, so a project whose login is broken must say so instead of
+ * quietly claiming its rules are current.
  */
 export declare function conventionStatus(options?: ConventionCommandOptions): Promise<ConventionStatusResult>;
 export declare function conventionList(): Promise<any>;

package/dist/commands/convention.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convention.d.ts","sourceRoot":"","sources":["../../src/commands/convention.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAWhD,KAAK,wBAAwB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAqBF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAkBF,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;CAChD,CAAC;AA0PF,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,CAiBnD;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC,CA6DpC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,kGAAkG;IAClG,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IACnC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAW5E;AAmGD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB1G;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,CAwBnD;AA8HD,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqG5F;AAWD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgGxF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2GxF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6DxF"}
+{"version":3,"file":"convention.d.ts","sourceRoot":"","sources":["../../src/commands/convention.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAWhD,KAAK,wBAAwB,GAAG;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAqBF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG,wBAAwB,GAAG;IACxD,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAkBF,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;CAChD,CAAC;AA6PF,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,CAiBnD;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,CAAC,CA6DpC;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,kGAAkG;IAClG,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,yBAAyB,EAAE,OAAO,CAAC;IACnC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,yBAAyB,EAAE,CAAC;IAC/C,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,2DAA2D;IAC3D,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IACF,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAW5E;AAyGD;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiC1G;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,CAwBnD;AA8HD,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqG5F;AAWD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgGxF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2GxF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6DxF"}

package/dist/commands/convention.js

@@ -7,7 +7,7 @@ import { isAxiosError } from 'axios';
 import { downloadAllConventions, listConventions } from '../api/convention.js';
 import matter from 'gray-matter';
 import { diffLines, createTwoFilesPatch } from 'diff';
-import { loadConfig, findProjectConfig, getConfigurationNotFoundMessage } from '../utils/config.js';
+import { loadConfigWithCredential, findProjectConfig, getConfigurationNotFoundMessage } from '../utils/config.js';
 import { withSpinner } from '../utils/spinner.js';
 import { withoutJsonContentType } from '../utils/httpHeaders.js';
 import { compareVersions, getLatestCliVersion } from '../utils/updateCheck.js';
@@ -28,8 +28,11 @@ function findProjectRoot(cwd) {
 function getApiBaseUrl(apiUrl) {
     return apiUrl.endsWith('/') ? apiUrl.slice(0, -1) : apiUrl;
 }
-function getApiConfigOrThrow(options) {
-    const config = options?.config ?? loadConfig();
+async function getApiConfigOrThrow(options) {
+    // Credential-aware: a personal-token project keeps no `apiKey` on disk, and
+    // the conventions these commands sync become always-on agent rules — reading
+    // "not initialized" there would silently freeze a project's rules.
+    const config = options?.config ?? (await loadConfigWithCredential());
     if (!config) {
         throw new Error(getConfigurationNotFoundMessage(options?.cwd));
     }
@@ -216,7 +219,7 @@ function toOptionalStringOrNullIfPresent(data, key) {
     return undefined;
 }
 export async function conventionShow() {
-    const { config, apiUrl, headers } = getApiConfigOrThrow();
+    const { config, apiUrl, headers } = await getApiConfigOrThrow();
     const conventions = await fetchConventionsWithContent(apiUrl, config.projectId, headers);
     if (!conventions || conventions.length === 0) {
         throw new Error('No conventions found for this project. Create one via the web dashboard first.');
@@ -342,10 +345,14 @@ function buildStatusResult(params) {
     if (conventionUpdateAvailable) {
         hints.push(`ACTION REQUIRED: Sync conventions now: ${actions.syncConventions}. After syncing, re-read .agentteams/convention.md and any changed rule files before continuing.`);
     }
+    else if (params.credentialProblem) {
+        hints.push(`WARNING: Convention freshness was NOT checked — ${params.credentialProblem} Conventions may be stale; fix the login, then re-run 'agentteams convention status'.`);
+    }
     else {
         hints.push('OK: Conventions and platform guides are up to date.');
     }
     return {
+        ...(params.credentialProblem ? { credentialProblem: params.credentialProblem } : {}),
         updateAvailable: conventionUpdateAvailable,
         conventionUpdateAvailable,
         platformGuidesChanged: params.freshness.platformGuidesChanged,
@@ -353,7 +360,7 @@ function buildStatusResult(params) {
         cliUpdateAvailable: params.cliUpdateAvailable,
         currentCliVersion: params.currentCliVersion,
         latestCliVersion: params.latestCliVersion,
-        actionRequired: conventionUpdateAvailable || params.cliUpdateAvailable,
+        actionRequired: conventionUpdateAvailable || params.cliUpdateAvailable || Boolean(params.credentialProblem),
         actions,
         hints,
         summary: buildCombinedStatusSummary({
@@ -371,16 +378,33 @@ function buildStatusResult(params) {
  * update is available — it never downloads or mutates anything. Degrades gracefully
  * (exit 0, updateAvailable=false) when the project is not configured or has no local
  * conventions yet, so callers can safely "check then skip when unavailable".
+ *
+ * "Not configured" and "configured but the credential failed" are reported
+ * differently on purpose. The platform convention makes this the session-start
+ * freshness gate, so a project whose login is broken must say so instead of
+ * quietly claiming its rules are current.
  */
 export async function conventionStatus(options) {
-    const config = options?.config ?? loadConfig();
     const projectRoot = findProjectRoot(options?.cwd);
     const cliStatus = await resolveCliUpdateStatus(options);
+    let config = options?.config ?? null;
+    let credentialProblem;
+    if (!config) {
+        try {
+            config = await loadConfigWithCredential();
+        }
+        catch (error) {
+            credentialProblem = error instanceof Error ? error.message : String(error);
+        }
+    }
     // Not configured or no local conventions → nothing to compare; treat as up to date.
     if (!config || !projectRoot) {
         return buildStatusResult({
             freshness: { platformGuidesChanged: false, conventionChanges: [] },
             ...cliStatus,
+            // Only a project that exists locally can have a credential problem worth
+            // reporting; without a project root there is nothing to be stale.
+            ...(credentialProblem && projectRoot ? { credentialProblem } : {}),
         });
     }
     const apiUrl = getApiBaseUrl(config.apiUrl);
@@ -392,7 +416,7 @@ export async function conventionStatus(options) {
     return buildStatusResult({ freshness, ...cliStatus });
 }
 export async function conventionList() {
-    const { config, apiUrl, headers } = getApiConfigOrThrow();
+    const { config, apiUrl, headers } = await getApiConfigOrThrow();
     const conventions = await fetchAllConventions(apiUrl, config.projectId, headers);
     if (!Array.isArray(conventions)) {
         return { data: conventions };
@@ -504,7 +528,7 @@ async function downloadReportingTemplate(projectRoot, config, apiUrl, headers) {
     return true;
 }
 export async function conventionDownload(options) {
-    const { config, apiUrl, headers } = getApiConfigOrThrow(options);
+    const { config, apiUrl, headers } = await getApiConfigOrThrow(options);
     const projectRoot = findProjectRoot(options?.cwd);
     if (!projectRoot) {
         throw new Error("No .agentteams directory found. Run 'agentteams init' first.");
@@ -590,7 +614,7 @@ function parseConventionMarkdown(fileRelativePath, markdown) {
     }
 }
 export async function conventionCreate(options) {
-    const { config, apiUrl, headers } = getApiConfigOrThrow(options);
+    const { config, apiUrl, headers } = await getApiConfigOrThrow(options);
     const projectRoot = findProjectRoot(options?.cwd);
     if (!projectRoot) {
         throw new Error("No .agentteams directory found. Run 'agentteams init' first.");
@@ -670,7 +694,7 @@ export async function conventionCreate(options) {
     return results.join('\n');
 }
 export async function conventionUpdate(options) {
-    const { config, apiUrl, headers } = getApiConfigOrThrow(options);
+    const { config, apiUrl, headers } = await getApiConfigOrThrow(options);
     const projectRoot = findProjectRoot(options?.cwd);
     if (!projectRoot) {
         throw new Error("No .agentteams directory found. Run 'agentteams init' first.");
@@ -748,7 +772,7 @@ export async function conventionUpdate(options) {
     return results.join('\n\n');
 }
 export async function conventionDelete(options) {
-    const { config, apiUrl, headers } = getApiConfigOrThrow(options);
+    const { config, apiUrl, headers } = await getApiConfigOrThrow(options);
     const projectRoot = findProjectRoot(options?.cwd);
     if (!projectRoot) {
         throw new Error("No .agentteams directory found. Run 'agentteams init' first.");