@kendoo.agentdesk/agentdesk 0.18.2 → 0.18.3

package/CHANGELOG.md

@@ -8,6 +8,11 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.18.3] — 2026-04-18
+
+### Fixed
+- `[CLI]` Tracker credentials: if a project has credentials stored both locally (`.env`) and on the server, the local value now wins. Previously the server's copy overrode `.env`, which meant that rotating a Jira / Linear / GitHub token locally didn't take effect while the server still held the old one.
+
 ## [0.18.2] — 2026-04-18
 
 ### Fixed

package/cli/init.mjs

@@ -246,7 +246,8 @@ async function verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker,
   const dotEnv = loadDotEnv(cwd);
   const apiKey = loadApiKey(cwd);
   const serverCreds = await fetchServerCreds(apiKey, finalProjectKey);
-  const credentials = resolveCredentialsFromEnv({ ...dotEnv, ...serverCreds });
+  // .env wins over server credentials — fresh local rotation beats stale server state.
+  const credentials = resolveCredentialsFromEnv({ ...serverCreds, ...dotEnv });
   const check = await checkTrackerPermissions({ tracker, config, credentials });
   if (!check.ok) {
     console.log("  ⚠  " + (check.errors[0] || "Verification failed"));

package/cli/team.mjs

@@ -112,7 +112,9 @@ export async function runTeam(taskId, opts = {}) {
       } catch {}
     }
 
-    const credentials = resolveCredentialsFromEnv({ ...projectEnvVars, ...serverCreds });
+    // .env wins over server credentials — a freshly-rotated token in the
+    // user's project should beat a stale one left behind on the server.
+    const credentials = resolveCredentialsFromEnv({ ...serverCreds, ...projectEnvVars });
     const check = await checkTrackerPermissions({ tracker, config, credentials });
 
     if (!check.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {