@aisa-one/cli 0.6.5 → 0.6.6

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.6] — 2026-09-30
+
+### Fixed
+
+- Open the browser on Windows. `start` is built into cmd.exe, so running it
+  directly failed with ENOENT and the error was swallowed: `aisa login`,
+  `aisa connect` and `aisa topup` never opened a page, and sign-in waited
+  for an approval that could not arrive. The browser now opens through
+  cmd.exe, with `&` and other special characters escaped so the whole URL
+  gets through.
+
 ## [0.6.5] — 2026-09-30
 
 ### Added

package/dist/commands/account.js

@@ -1,4 +1,4 @@
-import { run } from "../utils/exec.js";
+import { openBrowser } from "../utils/browser.js";
 import chalk from "chalk";
 import { requireAccessToken } from "../config.js";
 import { apiRequest } from "../api.js";
@@ -92,8 +92,7 @@ export function topupAction(amount, options = {}) {
     console.log(`  ${chalk.cyan(url)}`);
     if (options.open === false)
         return;
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    void run(cmd, [url], { timeout: 30_000 }).catch(() => { });
+    openBrowser(url);
     hint("Credit lands in your account as soon as the payment completes");
 }
 /** Gateway caps GET /v1/usage at 31 days; buckets are fixed at one day. */

package/dist/commands/connect.js

@@ -14,7 +14,7 @@ import { INSTALLERS, installAgent, isInstalled, supported } from "./install.js";
 import { writeCodexLLM, writeClaudeCodeLLM, writeOpencodeLLM, writeCodexAisaProfile, writeOpencodeAisaBackup, defaultModelsFor, patchCodexMCPAuth, DEFAULT_MODELS, } from "./llm-config.js";
 import { writeClaudeAisaSettings, installWrappers } from "./wrappers.js";
 import { signInAndStoreTokens } from "./oauth-login.js";
-import { canOpenBrowser } from "../utils/browser.js";
+import { canOpenBrowser, openBrowser } from "../utils/browser.js";
 import { vscodeDetected, vscodeUserDir, writeVSCodeLLM, writeVSCodeMCP, installVSCodeExtension, launchVSCode, VSCODE_MODELS } from "./vscode.js";
 import { formatMicrosUSD } from "./account.js";
 import { apiRequest } from "../api.js";
@@ -1812,10 +1812,6 @@ function launchCursor(dir) {
 function withBrowserEarly() {
     return canOpenBrowser();
 }
-function openBrowser(url) {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    void run(cmd, [url], { timeout: 30_000 }).catch(() => { });
-}
 /**
  * Where a live run leaves its address, so a second `aisa connect` can offer
  * the first one's page instead of starting a rival server. Ephemeral by

package/dist/commands/oauth-login.js

@@ -1,5 +1,4 @@
 import chalk from "chalk";
-import { run } from "../utils/exec.js";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import { createInterface } from "node:readline/promises";
@@ -7,7 +6,7 @@ import { error, hint, info, success } from "../utils/display.js";
 import { replaceTokens, tokenExpiresAt } from "../config.js";
 import { maskKey } from "../config.js";
 import { httpFetch } from "../utils/http.js";
-import { canOpenBrowser } from "../utils/browser.js";
+import { canOpenBrowser, openBrowser } from "../utils/browser.js";
 import { SIGNIN, t } from "./flow.js";
 import { renderSignInPage } from "./signin-page.js";
 import { handOverSignInPage, SIGNIN_PAGE_TTL_MS } from "./serve-signin.js";
@@ -220,10 +219,6 @@ async function waitForPaste(expectedState, lang) {
     /* c8 ignore next */
     throw new Error(t(SIGNIN.badPaste, lang));
 }
-function openBrowser(url) {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    void run(cmd, [url], { timeout: 30_000 }).catch(() => { });
-}
 export async function signInAndStoreTokens(options = {}) {
     const lang = options.lang ?? "en";
     // Unset means "work it out": a server has no browser to open and waiting

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.6.5";
+export declare const VERSION = "0.6.6";
 /** Default for chat when no model is configured or supplied explicitly. */
 export declare const DEFAULT_CHAT_MODEL = "deepseek-v4.1-flash";
 /** Root of the platform. Per-surface bases are derived in api.ts#resolveBases. */

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.6.5";
+export const VERSION = "0.6.6";
 /** Default for chat when no model is configured or supplied explicitly. */
 export const DEFAULT_CHAT_MODEL = "deepseek-v4.1-flash";
 /** Root of the platform. Per-surface bases are derived in api.ts#resolveBases. */

package/dist/utils/browser.d.ts

@@ -17,3 +17,29 @@
  * for a click nobody will ever make.
  */
 export declare function canOpenBrowser(): boolean;
+/**
+ * The command that hands a URL to the default browser on this platform.
+ *
+ * Windows is the one that needs care. Its opener, `start`, is not a program
+ * but a command built into cmd.exe, so running it directly fails with
+ * ENOENT, and the failure used to be swallowed: the browser never opened,
+ * and `aisa login` sat waiting for an approval that could not arrive.
+ * Going through cmd.exe fixes that, with two details:
+ *
+ *   · `start` reads its first quoted argument as a window title, so an empty
+ *     title goes first; otherwise a quoted URL would become the title.
+ *   · cmd.exe reads `&` in a query string as "run the next command", which
+ *     would cut the URL at its second parameter. Its special characters are
+ *     escaped with `^` so the whole URL reaches the browser.
+ */
+export declare function browserCommand(url: string, platform?: NodeJS.Platform): {
+    file: string;
+    args: string[];
+};
+/**
+ * Open a URL in the default browser, without waiting and without failing.
+ *
+ * Every caller prints the URL as well, so a browser that does not open
+ * costs the user a click, not the command.
+ */
+export declare function openBrowser(url: string): void;

package/dist/utils/browser.js

@@ -1,3 +1,4 @@
+import { run } from "./exec.js";
 /**
  * Can this machine put a page in front of the person using it?
  *
@@ -29,3 +30,36 @@ export function canOpenBrowser() {
         return true;
     return Boolean(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
 }
+/**
+ * The command that hands a URL to the default browser on this platform.
+ *
+ * Windows is the one that needs care. Its opener, `start`, is not a program
+ * but a command built into cmd.exe, so running it directly fails with
+ * ENOENT, and the failure used to be swallowed: the browser never opened,
+ * and `aisa login` sat waiting for an approval that could not arrive.
+ * Going through cmd.exe fixes that, with two details:
+ *
+ *   · `start` reads its first quoted argument as a window title, so an empty
+ *     title goes first; otherwise a quoted URL would become the title.
+ *   · cmd.exe reads `&` in a query string as "run the next command", which
+ *     would cut the URL at its second parameter. Its special characters are
+ *     escaped with `^` so the whole URL reaches the browser.
+ */
+export function browserCommand(url, platform = process.platform) {
+    if (platform === "darwin")
+        return { file: "open", args: [url] };
+    if (platform === "win32") {
+        return { file: "cmd", args: ["/c", "start", "", url.replace(/[\^&|<>()]/g, "^$&")] };
+    }
+    return { file: "xdg-open", args: [url] };
+}
+/**
+ * Open a URL in the default browser, without waiting and without failing.
+ *
+ * Every caller prints the URL as well, so a browser that does not open
+ * costs the user a click, not the command.
+ */
+export function openBrowser(url) {
+    const { file, args } = browserCommand(url);
+    void run(file, args, { timeout: 30_000 }).catch(() => { });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aisa-one/cli",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "CLI for the AIsa unified AI infrastructure platform - one API key for 80+ LLMs and 900+ endpoints across finance, search, social, and video APIs",
   "type": "module",
   "main": "dist/index.js",