@aisa-one/cli 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -7,6 +7,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-09-10
+
+### Changed
+
+- Browser login stores OAuth access/refresh tokens and the client ID instead
+  of minting a permanent API key. Refresh near expiry and retry once after 401.
+- Serialize credential refresh, replacement, and logout across CLI processes.
+  Logout and replacement revoke the previous refresh token; preserve pending
+  grants for cleanup when login or persistence fails.
+- Keep `AISA_API_KEY` and `login --key` static; migrate `~/.aisa/key` and retain
+  legacy credential mirrors. Credentials are stored atomically with mode 0600.
+- Handle async credential errors consistently in logout, whoami, and MCP setup;
+  reject incomplete OAuth login responses before replacing existing credentials.
+
+### Known limitations
+
+- Already-issued access tokens remain valid until expiry after logout.
+- Third-party client configurations receive a fixed access-token snapshot;
+  CLI refresh does not update those configurations.
+
+## [0.5.2] — 2026-09-10
+
+Compatible patch on published `0.5.1`. Expanded `aisa login --help` for Agent
+sign-in handoff, plus a default-off login-help evaluation. No auth runtime,
+credential-precedence, or command-surface changes.
+
+### Changed
+
+- `aisa login --help` owns accessible-browser vs persistent headless TTY, live
+  URL relay, one-time paste into the same living process, reuse of a running
+  login, stale-session recovery, no-TTY native MCP OAuth, and connected-only
+  after a successful balance check.
+
+### Added
+
+- Default-off `eval/agent-quickstart/login-handoff/`. Excluded from the npm
+  package; does not run in default CI or against production AIsa credentials.
+
 ## [0.5.1] — 2026-09-10
 
 Compatible patch on published `0.5.0`. Browser-login-first onboarding
@@ -406,7 +444,9 @@ supports today; nothing here depends on a backend change.
 - Config commands (`aisa config get|set|list|reset`) and auth
   (`aisa login|logout|whoami`).
 
-[Unreleased]: https://github.com/AIsa-team/cli/compare/v0.5.1...HEAD
+[Unreleased]: https://github.com/AIsa-team/cli/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/AIsa-team/cli/compare/v0.5.2...v0.6.0
+[0.5.2]: https://github.com/AIsa-team/cli/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/AIsa-team/cli/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/AIsa-team/cli/compare/v0.3.0...v0.5.0
 [0.4.0]: https://github.com/AIsa-team/cli/compare/v0.3.0...b5c0b04b2a7a2cb9efcb568be5ee5440d7f7d94d

package/README.md

@@ -14,7 +14,7 @@ npm install -g @aisa-one/cli
 ## Quick Start
 
 ```bash
-# Sign in (browser; stores a CLI key — no key to copy)
+# Sign in (browser; stores OAuth tokens — no key to copy)
 aisa login
 
 # Discover published tools (Router; search/schema may be anonymous)
@@ -29,7 +29,7 @@ aisa api show financial
 aisa quote --input '{"calls":[{"call_id":"c1","tool":"get_financial_company_facts","arguments":{"ticker":"AAPL"}}]}' --json
 ```
 
-`aisa login` opens a browser, signs you in, and stores a CLI key. You do not
+`aisa login` opens a browser, signs you in, and stores OAuth tokens. You do not
 need to create or paste a key from the console. For CI or scripts, set
 `AISA_API_KEY` or run `aisa login --key <key>`. New accounts receive $5 in
 free credits.
@@ -64,7 +64,7 @@ and `aisa manifest search` / `schema` / `quote` / `call` expose `mcp`, `auth`,
 Recommended sequence: discover a tool → `aisa schema` when
 `has_full_schema=false` → `aisa quote` → `aisa call`. Quote and call share
 one request shape. **Enforced:** invalid local input exits 2 and is not sent;
-quote and call refuse to run without a configured AIsa API key. **Not
+quote and call refuse to run without an OAuth session or static AIsa API key. **Not
 enforced:** the CLI does not record quotes, approvals, or budget caps and
 does not reject an unquoted call. **Instruction:** do not execute unquoted
 calls; the caller must ensure a matching quote and approval. Quote is a
@@ -74,7 +74,7 @@ not spending approval. Do not invent tool names or guess required values.
 cost is not a limit. If a hard monetary cap is required, do not execute
 calls with no guaranteed maximum. A partial quote is not a full-batch total;
 call only an independently approved successful subset, and do not silently
-retry. Without a configured AIsa API key, do not invent a business result.
+retry. Without an OAuth session or static AIsa API key, do not invent a business result.
 
 `--input` is inline JSON (no file required). Documented shell examples use
 POSIX single quotes so apostrophes, Unicode, `$()`, and backticks stay
@@ -104,9 +104,12 @@ HTTP error; `3` means the Router returned a batch with at least one failed
 item.
 
 `search` and `schema` may be anonymous. `quote` and `call` require a
-configured AIsa API key. Sign in with `aisa login` first; it mints and stores
-a CLI key. Resolution order is unchanged: `AISA_API_KEY`, then `~/.aisa/key`,
-then legacy login. `AISA_API_KEY` still takes precedence over the stored key.
+stored OAuth session or static API key. `aisa login` stores access and refresh
+tokens in `~/.aisa/tokens.json` (0600), along with the OAuth client ID and
+`expiresAt` (Unix milliseconds). Access tokens refresh within 60 seconds of
+expiry; a 401 triggers one refresh and retry. `AISA_API_KEY` takes precedence
+and never refreshes. Legacy `~/.aisa/key` files migrate on first read; conf
+`apiKey` is a write-only compatibility mirror.
 For CI, set `AISA_API_KEY` or use `aisa login --key <key>`. The default Router
 origin is `https://tools.aisa.one` (independent of `baseUrl` /
 `https://api.aisa.one`). Point a test Router at `AISA_ROUTER_BASE_URL` (origin
@@ -323,7 +326,12 @@ Settings:
   independent of `baseUrl`); overridden by `AISA_ROUTER_BASE_URL`
 - `outputFormat` — `text` or `json`
 
-`aisa login` stores a CLI key in `~/.aisa/key`. Environment variables:
+`aisa login` stores OAuth credentials in `~/.aisa/tokens.json`.
+`aisa login --key <key>` stores a static credential without refresh metadata.
+Legacy mirrors contain the current access token; older CLIs cannot refresh it.
+Third-party client configurations written by `aisa connect` also contain a
+snapshot of the credential, not a refresh-capable OAuth session.
+Environment variables:
 `AISA_API_KEY` takes precedence over the stored key.
 `AISA_ROUTER_BASE_URL` is the Router origin/prefix before
 `/v1/tool-router/...` and overrides the default `https://tools.aisa.one`.
@@ -367,3 +375,20 @@ catalog metadata, not an execution recipe.
 ## License
 
 MIT. See [LICENSE](LICENSE). Copyright (c) 2026 AIsa Team.
+
+`aisa logout` revokes the stored OAuth refresh token at Clerk before deleting
+local credentials and compatibility mirrors. If revocation fails, it exits
+with an error and retains the credentials so you can retry. Already-issued
+JWT access tokens remain valid until expiry. Static API keys are only removed
+locally; an `AISA_API_KEY` environment variable must be unset separately.
+
+Credential reads and changes use a cross-process file lock with heartbeat and
+stale-lock recovery. Re-running `aisa login` or switching to `--key` revokes
+the previous stored OAuth grant before replacing it. Failed replacements
+retain pending credentials in a private `.pending-tokens.json` recovery file;
+the next login or logout cleans up those grants before completing.
+
+If a login cannot acquire the credential lock, the newly issued grant is kept
+in a private `.pending-login-*.json` file for the next login/logout to clean up.
+Refresh persists the new credentials before optional rotation hints and legacy
+mirrors; failure to save the primary token file is reported explicitly.

package/dist/api.d.ts

@@ -44,8 +44,8 @@ export interface RequestOptions {
     /** Overrides the default 30s budget for a slow endpoint. */
     timeoutMs?: number;
 }
-export declare function apiRequest<T = unknown>(apiKey: string, endpoint: string, options?: RequestOptions): Promise<ApiResponse<T>>;
-export declare function apiRequestRaw(apiKey: string, endpoint: string, options?: RequestOptions): Promise<Response>;
+export declare function apiRequest<T = unknown>(accessToken: string, endpoint: string, options?: RequestOptions): Promise<ApiResponse<T>>;
+export declare function apiRequestRaw(accessToken: string, endpoint: string, options?: RequestOptions): Promise<Response>;
 /**
  * Cache namespace for data served by the configured gateway. Catalog, model
  * and coin-list caches must be keyed by the host they came from: a fixed key

package/dist/api.js

@@ -1,3 +1,4 @@
+import { authenticatedFetch } from "./utils/auth-http.js";
 import { BASE_URL } from "./constants.js";
 import { httpFetch, INFO_TIMEOUT_MS } from "./utils/http.js";
 import { getConfig } from "./config.js";
@@ -41,7 +42,7 @@ export function parseCost(res) {
     };
     return Object.values(cost).some((v) => v !== undefined) ? cost : undefined;
 }
-export async function apiRequest(apiKey, endpoint, options = {}) {
+export async function apiRequest(accessToken, endpoint, options = {}) {
     const { method = "GET", query, body, headers: extraHeaders, domain } = options;
     const bases = resolveBases();
     const baseUrl = domain ? bases.domain : bases.llm;
@@ -51,12 +52,12 @@ export async function apiRequest(apiKey, endpoint, options = {}) {
         url += `?${params.toString()}`;
     }
     const headers = {
-        Authorization: `Bearer ${apiKey}`,
+        Authorization: `Bearer ${accessToken}`,
         "Content-Type": "application/json",
         "x-aisa-source": "cli",
         ...extraHeaders,
     };
-    const res = await httpFetch(url, {
+    const res = await authenticatedFetch(url, {
         method,
         headers,
         body: body ? JSON.stringify(body) : undefined,
@@ -78,7 +79,7 @@ export async function apiRequest(apiKey, endpoint, options = {}) {
     const data = (await res.json());
     return { success: true, data, cost: parseCost(res) };
 }
-export async function apiRequestRaw(apiKey, endpoint, options = {}) {
+export async function apiRequestRaw(accessToken, endpoint, options = {}) {
     const { method = "GET", query, body, headers: extraHeaders, domain } = options;
     const bases = resolveBases();
     const baseUrl = domain ? bases.domain : bases.llm;
@@ -88,12 +89,12 @@ export async function apiRequestRaw(apiKey, endpoint, options = {}) {
         url += `?${params.toString()}`;
     }
     const headers = {
-        Authorization: `Bearer ${apiKey}`,
+        Authorization: `Bearer ${accessToken}`,
         "Content-Type": "application/json",
         "x-aisa-source": "cli",
         ...extraHeaders,
     };
-    return httpFetch(url, {
+    return authenticatedFetch(url, {
         method,
         headers,
         body: body ? JSON.stringify(body) : undefined,

package/dist/commands/account.js

@@ -1,6 +1,6 @@
 import { run } from "../utils/exec.js";
 import chalk from "chalk";
-import { requireApiKey } from "../config.js";
+import { requireAccessToken } from "../config.js";
 import { apiRequest } from "../api.js";
 import { formatJson, hint, info, error } from "../utils/display.js";
 import { CONSOLE_BILLING_URL } from "../constants.js";
@@ -17,7 +17,7 @@ export function formatMicrosUSD(micros) {
     return `${negative ? "-" : ""}$${dollars.toString()}.${cents.toString().padStart(2, "0")}`;
 }
 export async function balanceAction(options = {}) {
-    const key = requireApiKey();
+    const key = await requireAccessToken();
     const res = await apiRequest(key, "credits/balance");
     if (!res.success || !res.data) {
         throw new Error(res.error || "Failed to fetch balance");
@@ -79,7 +79,7 @@ export function topupAction(amount, options = {}) {
     hint("Credit lands in your account as soon as the payment completes");
 }
 export async function usageAction(_options) {
-    requireApiKey();
+    await requireAccessToken();
     // The gateway does not serve /v1/credits/usage yet — it 404s in production
     // even though /v1/credits/balance on the same route group works.
     console.log(chalk.yellow("  Usage API is not yet available on the gateway."));

package/dist/commands/auth.d.ts

@@ -2,5 +2,5 @@ export declare function loginAction(options: {
     key?: string;
     browser?: boolean;
 }): Promise<void>;
-export declare function logoutAction(): void;
-export declare function whoamiAction(): void;
+export declare function logoutAction(): Promise<void>;
+export declare function whoamiAction(): Promise<void>;

package/dist/commands/auth.js

@@ -1,11 +1,11 @@
 import chalk from "chalk";
-import { setApiKey, clearApiKey, getApiKey, getKeySource, maskKey, AUTH_SETUP_GUIDANCE } from "../config.js";
+import { replaceTokens, revokeAndClearTokens, getAccessToken, getKeySource, maskKey, AUTH_SETUP_GUIDANCE } from "../config.js";
 import { success, info } from "../utils/display.js";
 import { CONSOLE_URL, ENV_VAR_NAME } from "../constants.js";
 export async function loginAction(options) {
     const key = options.key || process.env[ENV_VAR_NAME];
     if (key) {
-        setApiKey(key);
+        await replaceTokens(key);
         success(`Authenticated: ${maskKey(key)}`);
         await proveItWorks();
         return;
@@ -20,18 +20,7 @@ export async function loginAction(options) {
     await oauthLogin(options.browser === false ? { open: false } : {});
     await proveItWorks();
 }
-/**
- * Use the key we just stored, and show what came back.
- *
- * "Signed in — key stored" says a file was written. It does not say the key
- * works, and those are different claims: a pasted key can be the wrong one, a
- * minted one can belong to an account with no credit. Ending on a balance
- * turns the question "did that work?" into something already answered on
- * screen, which is what someone finishing a sign-in actually wants to know.
- *
- * Failure here is not a failed sign-in — the key is stored either way — so it
- * says what it could not do and points at the command to retry with.
- */
+/** Show the balance after storing credentials; a balance failure does not undo login. */
 async function proveItWorks() {
     try {
         const { balanceAction } = await import("./account.js");
@@ -46,18 +35,22 @@ async function proveItWorks() {
     // cannot show. Written out so it can be remembered, not just clicked.
     console.log(chalk.gray(`  Account, usage and top-ups — ${chalk.cyan(CONSOLE_URL)}`));
 }
-export function logoutAction() {
-    clearApiKey();
-    success("Logged out. API key removed.");
+export async function logoutAction() {
+    const revoked = await revokeAndClearTokens();
+    success(revoked ? "Logged out. OAuth refresh token revoked and stored tokens removed." : "Logged out. Stored tokens removed.");
+    if (revoked)
+        info("Already-issued access tokens remain valid until they expire.");
+    if (process.env[ENV_VAR_NAME])
+        info(`${ENV_VAR_NAME} is still set. Unset it to stop using that API key.`);
 }
-export function whoamiAction() {
-    const key = getApiKey();
+export async function whoamiAction() {
+    const key = await getAccessToken();
     const source = getKeySource();
     if (!key) {
         info("Not authenticated.");
         console.log(chalk.gray(`  ${AUTH_SETUP_GUIDANCE}`));
         return;
     }
-    console.log(`  Key:    ${maskKey(key)}`);
-    console.log(`  Source: ${source === "env" ? `${ENV_VAR_NAME} env var` : "stored config"}`);
+    console.log(`  Token:  ${maskKey(key)}`);
+    console.log(`  Source: ${source === "env" ? `${ENV_VAR_NAME} env var` : "~/.aisa/tokens.json"}`);
 }

package/dist/commands/chat.js

@@ -1,11 +1,11 @@
 import ora from "ora";
 import chalk from "chalk";
-import { requireApiKey, getConfig } from "../config.js";
+import { requireAccessToken, getConfig } from "../config.js";
 import { apiRequest, apiRequestRaw } from "../api.js";
 import { error } from "../utils/display.js";
 import { handleSSEStream } from "../utils/streaming.js";
 export async function chatAction(message, options) {
-    const key = requireApiKey();
+    const key = await requireAccessToken();
     // Read from stdin if no message provided
     let text = message;
     if (!text) {

package/dist/commands/configCmd.js

@@ -38,6 +38,8 @@ export function configGetAction(key) {
 export function configListAction() {
     const all = listConfig();
     const display = { ...all };
+    if (display.tokens)
+        display.tokens = "****";
     if (display.apiKey) {
         display.apiKey = "****";
     }

package/dist/commands/connect.js

@@ -8,12 +8,12 @@ import chalk from "chalk";
 import { error } from "../utils/display.js";
 import { expandHome } from "../utils/file.js";
 import { MCP_CONFIGS, MCP_DEFAULT_SLUGS, AISA_PROVIDER_ID } from "../constants.js";
-import { getApiKey, getConfig, setConfig } from "../config.js";
+import { getAccessToken, getConfig, setConfig } from "../config.js";
 import { fetchLiveServers, writeClientConfig, buildEntry, stripped } from "./mcp.js";
 import { INSTALLERS, installAgent, isInstalled, supported } from "./install.js";
 import { writeCodexLLM, writeClaudeCodeLLM, writeOpencodeLLM, writeCodexAisaProfile, writeOpencodeAisaBackup, defaultModelsFor, patchCodexMCPAuth, DEFAULT_MODELS, } from "./llm-config.js";
 import { writeClaudeAisaSettings, installWrappers } from "./wrappers.js";
-import { mintCliKey } from "./oauth-login.js";
+import { signInAndStoreTokens } from "./oauth-login.js";
 import { canOpenBrowser } from "../utils/browser.js";
 import { vscodeDetected, vscodeUserDir, writeVSCodeLLM, writeVSCodeMCP, installVSCodeExtension, launchVSCode, VSCODE_MODELS } from "./vscode.js";
 import { formatMicrosUSD } from "./account.js";
@@ -62,9 +62,9 @@ export function resolveTemplate(flag) {
  *   sign in, exit. No daemon, no terminal takeover, no prompt or skill
  *   injection into the user's agent. The user stays in their own Claude Code.
  * - Sign-in is one OAuth round for everything: with no key stored, the run
- *   starts with the same browser approval `aisa login` uses, which mints the
- *   durable "aisa cli" key (POST /v1/keys/mint). Every MCP entry is then
- *   written as a bearer and the model provider gets the same key — zero
+ *   starts with the same browser approval `aisa login` uses. Every MCP entry
+ *   is written with the current access token and the model provider gets
+ *   the same token — zero
  *   per-server authorization popups. Only if that sign-in fails do we fall
  *   back to each client's own OAuth machinery (`claude mcp login <name>` per
  *   server; `codex mcp add` runs its own flow), which still works but costs
@@ -408,7 +408,7 @@ const SIGNIN_CATCH_TIMEOUT_MS = 10 * 60 * 1000;
 const CODEX_KEY_ENV_VAR = "AISA_API_KEY";
 /** Below this the balance step lingers and nudges towards a top-up. */
 const LOW_BALANCE_MICROS = 5_000_000;
-/** The manual fallback when the inline sign-in cannot mint a key. */
+/** The manual fallback when the inline sign-in cannot obtain an access token. */
 const CONSOLE_KEYS_URL = "https://console.aisa.one/api-keys";
 const pause = (ms) => new Promise((r) => setTimeout(r, ms));
 /** Mutate one step in place; the page picks it up on its next poll. */
@@ -450,7 +450,7 @@ function buildPlan(input) {
             : "npm install -g @aisa-one/cli — the aisa command for balance, top-up and key rotation",
     });
     // One sign-in, before anything that wants a credential: the browser
-    // approval mints the durable CLI key, and with it every MCP entry is a
+    // approval obtains the access token, and with it every MCP entry is a
     // bearer and the model provider can be written — no per-server popups.
     // If it fails at run time the per-server OAuth rounds come back as a
     // fallback (added to the plan then, not promised now).
@@ -466,7 +466,7 @@ function buildPlan(input) {
             // they had signed in before.
             detail: input.keyRejected
                 ? "your stored key is no longer accepted — one browser approval replaces it"
-                : "one browser approval — it mints your CLI key",
+                : "one browser approval — it stores your OAuth session",
         });
     }
     const web = input.clients[0] === "claude-ai";
@@ -666,7 +666,7 @@ async function runPlan(state, input, log) {
                 ok("signin", "dry run — the browser approval would open here");
             }
             else {
-                key = await mintCliKey({ lang: input.lang, catcher: input.catcher });
+                key = await signInAndStoreTokens({ lang: input.lang, catcher: input.catcher });
                 // Two facts, in the order they matter to the person who just left
                 // the page to go and do this: it worked, and here is what it got
                 // them. The old line led with the artifact — "your CLI key is
@@ -810,7 +810,7 @@ async function runPlan(state, input, log) {
         }
         else if (!key) {
             // Only reachable when the sign-in above failed (or was declined): the
-            // normal path mints a key before this step runs. A provider entry has
+            // normal path obtains an access token before this step runs. A provider entry has
             // nowhere to put an OAuth token, so without a key the fallback is the
             // console page that hands them out, with exact instructions.
             setStep(state, "llm", {
@@ -1151,10 +1151,10 @@ function renderPage(servers, clients, token, keyed, canInstall) {
     // Named per client so the page can say which model a pick actually gets.
     const modelByClient = Object.fromEntries(clients.map((c) => [c.id, defaultModelsFor(c.id).model]));
     const authCopy = keyed
-        ? `Your configured AIsa API key is written into each entry — <b>no sign-in needed</b>.`
+        ? `Your current AIsa credential is written into each entry — <b>no sign-in needed</b>.`
         : `<b>One sign-in, nothing to paste.</b> Your browser opens the AIsa approval
-       <b>once</b>; it issues a long-lived key for this machine, and every server
-       and model below is configured with it — no further popups.`;
+       <b>once</b>; every server and model below is configured with the current
+       access token. Reconnect when that token expires.`;
     const body = `
 <div class="eyebrow">Connect</div>
 <h1><em>AIsa MCP</em> — powerful real-world reach for your agent</h1>
@@ -2256,7 +2256,7 @@ export async function connectAction(options) {
         process.exitCode = 1;
         return;
     }
-    const key = getApiKey();
+    const key = await getAccessToken();
     // A key that exists is not a key that works. One revoked from the console,
     // or belonging to a deleted account, sits in ~/.aisa/key looking exactly
     // like a good one — and the run then skipped the sign-in, wrote the dead

package/dist/commands/flow.js

@@ -408,12 +408,12 @@ export const STEP_INSTALL = {
         zh: "下面是将要发生的全部事情,按顺序列出。它会自动开始;每一步完成后都会汇报,结果会在最后一步打开。",
     },
     authKeyed: {
-        en: "Your configured AIsa API key is written into each entry — <b>no sign-in needed</b>.",
-        zh: "你已配置的 AIsa API key 会写进每一条配置 —— <b>无需登录</b>。",
+        en: "Your current AIsa credential is written into each entry — <b>no sign-in needed</b>.",
+        zh: "你当前的 AIsa 凭证会写进每一条配置 —— <b>无需登录</b>。",
     },
     authFresh: {
-        en: "<b>One sign-in, nothing to paste.</b> Your browser opens the AIsa approval once; it issues a long-lived key for this machine, and every server and model is configured with it.",
-        zh: "<b>登录一次,不用粘贴任何东西。</b>浏览器会打开一次 AIsa 授权页;它会为这台机器签发一把长期有效的 key,所有 server 和模型都用它来配置。",
+        en: "<b>One sign-in, nothing to paste.</b> Your browser opens the AIsa approval once; every server and model is configured with the current access token. Reconnect when that token expires.",
+        zh: "<b>登录一次,不用粘贴任何东西。</b>浏览器会打开一次 AIsa 授权页;所有 server 和模型都使用当前 access token 配置。token 过期后请重新连接。",
     },
 };
 // ── step 6: done ────────────────────────────────────────────────────────────

package/dist/commands/mcp.js

@@ -4,7 +4,7 @@ import { success, error, info, hint } from "../utils/display.js";
 import { expandHome, ensureDir } from "../utils/file.js";
 import { MCP_CONFIGS, MCP_MANIFEST_URL, MCP_CATALOG_URL, DOCS_MCP_URL, MCP_DEFAULT_SLUGS } from "../constants.js";
 import { httpFetch, MAX_ATTEMPTS } from "../utils/http.js";
-import { getApiKey } from "../config.js";
+import { getAccessToken } from "../config.js";
 import { detectClients } from "./connect.js";
 import { join } from "node:path";
 export const stripped = (name) => name.replace(/^AIsa\s+/i, "");
@@ -153,7 +153,7 @@ export async function mcpSetupAction(options) {
         ? servers
         : servers.filter((s) => MCP_DEFAULT_SLUGS.includes(s.slug));
     const skipped = servers.length - chosen.length;
-    const key = getApiKey();
+    const key = await getAccessToken();
     if (key) {
         info("Using your configured API key (Bearer). It will be written into each client's config file.");
     }

package/dist/commands/models.js

@@ -1,6 +1,6 @@
 import ora from "ora";
 import chalk from "chalk";
-import { requireApiKey } from "../config.js";
+import { requireAccessToken } from "../config.js";
 import { apiRequest } from "../api.js";
 import { error, badge } from "../utils/display.js";
 import { writeCache } from "../cache.js";
@@ -8,7 +8,7 @@ import { cacheScope } from "../api.js";
 const modelsCacheKey = () => `models/${cacheScope()}.json`;
 const MODELS_TTL_MS = 24 * 60 * 60 * 1000;
 export async function modelsListAction(options) {
-    const key = requireApiKey();
+    const key = await requireAccessToken();
     const spinner = ora("Fetching models...").start();
     const res = await apiRequest(key, "models");
     if (!res.success || !res.data) {
@@ -47,7 +47,7 @@ export async function modelsListAction(options) {
     console.log(chalk.gray("  Run 'aisa models show <model-id>' for details"));
 }
 export async function modelsShowAction(modelId) {
-    const key = requireApiKey();
+    const key = await requireAccessToken();
     const spinner = ora(`Loading ${modelId}...`).start();
     const res = await apiRequest(key, `models/${modelId}`);
     if (!res.success || !res.data) {

package/dist/commands/oauth-login.d.ts

@@ -1,7 +1,7 @@
 import { type Lang } from "./flow.js";
 /**
  * The whole sign-in, as a function other commands can embed: browser (or
- * paste-back) OAuth, then the mint. Stores the key and returns it; throws on
+ * paste-back) OAuth. Stores tokens and returns the access token; throws on
  * any failure. `aisa login` wraps this with CLI messaging; `aisa connect`
  * runs it as its "Sign in to AIsa" step.
  */
@@ -22,11 +22,13 @@ export interface OAuthCatcher {
     /** Resolves with the authorization code, or rejects with why it will not. */
     wait(expectedState: string): Promise<string>;
 }
-export declare function mintCliKey(options?: {
+export declare function signInAndStoreTokens(options?: {
     open?: boolean;
     lang?: Lang;
     catcher?: OAuthCatcher;
 }): Promise<string>;
+/** Commander after-help for `aisa login`. Mechanics only; runtime is unchanged. */
+export declare function loginHelpAfter(): string;
 export declare function oauthLogin(options?: {
     open?: boolean;
     lang?: Lang;