@lanonasis/cli 3.9.10 → 3.9.12

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.11] - 2026-03-27
+
+### 🐛 Bug Fixes
+
+- **`memory stats` no longer crashes on wrapped responses**: The CLI now normalizes both flat and `{ data: ... }` stats payloads and safely defaults optional fields like `total_size_bytes` and `avg_access_count` when the backend omits them.
+- **Secure storage no longer initializes on every command startup**: Vendor key storage is now lazy-loaded, which prevents unnecessary keychain fallback warnings on CLI commands that do not access vendor key storage.
+- **Bundled auth client updated to `@lanonasis/oauth-client@2.0.4`**: Pulls in the ESM-safe native keychain loader fix and semver-compliant optional React peer metadata.
+
 ## [3.9.8] - 2026-02-25
 
 ### ✨ New Features

package/README.md

@@ -1,11 +1,11 @@
-# @lanonasis/cli v3.9.7 - OAuth PKCE Auth & whoami
+# @lanonasis/cli v3.9.11 - Stable Stats & Cleaner Startup
 
 [![NPM Version](https://img.shields.io/npm/v/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![Downloads](https://img.shields.io/npm/dt/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Golden Contract](https://img.shields.io/badge/Onasis--Core-v0.1%20Compliant-gold)](https://api.lanonasis.com/.well-known/onasis.json)
 
-🎉 **NEW IN v3.9.7**: Full OAuth PKCE session support across CLI and API gateway. New `onasis whoami` command. `auth status` now shows live user profile and probes real memory API access. Seven auth verification fixes eliminate false-positive "Authenticated: Yes" reports.
+🎉 **NEW IN v3.9.11**: `onasis memory stats` now handles wrapped/partial backend responses without crashing, vendor key secure storage is lazy-loaded so unrelated commands no longer trigger noisy fallback warnings, and the bundled `@lanonasis/oauth-client` is updated to `2.0.4` for the ESM-safe keychain loader fix.
 
 ## 🚀 Quick Start
 

package/dist/commands/api-keys.js

@@ -15,6 +15,24 @@ const colors = {
     muted: chalk.gray,
     highlight: chalk.white.bold
 };
+const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+function unwrapApiResponse(response) {
+    if (response && typeof response === 'object' && 'data' in response) {
+        return response.data ?? response;
+    }
+    return response;
+}
+function parseScopes(scopes) {
+    if (!scopes) {
+        return undefined;
+    }
+    const parsed = scopes
+        .split(',')
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : undefined;
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -65,7 +83,8 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const project = await apiClient.post('/api-keys/projects', projectData);
+        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
         console.log(chalk.blue(`Name: ${project.name}`));
@@ -85,12 +104,12 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = await apiClient.get('/api-keys/projects');
+        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
         }
-        if (projects.length === 0) {
+        if (!Array.isArray(projects) || projects.length === 0) {
             console.log(chalk.yellow('No projects found'));
             return;
         }
@@ -122,30 +141,29 @@ apiKeysCommand
     .command('create')
     .description('Create a new API key')
     .option('-n, --name <name>', 'API key name')
-    .option('-v, --value <value>', 'API key value')
-    .option('-t, --type <type>', 'Key type (api_key, database_url, oauth_token, etc.)')
-    .option('-e, --environment <env>', 'Environment (development, staging, production)')
-    .option('-p, --project-id <id>', 'Project ID')
-    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--expires-at <date>', 'Expiration date (ISO format)')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days', '90')
+    .option('-d, --description <description>', 'API key description (optional)')
+    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
+    .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
+        const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const expiresInDays = parseInt(options.expiresInDays, 10);
+        if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+            throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+            throw new Error('expires-in-days must be a positive integer up to 3650');
+        }
         let keyData = {
             name: options.name,
-            value: options.value,
-            keyType: options.type,
-            environment: options.environment || 'development',
-            projectId: options.projectId,
-            accessLevel: options.accessLevel || 'team',
-            tags: options.tags ? options.tags.split(',').map((tag) => tag.trim()) : [],
-            expiresAt: options.expiresAt,
-            rotationFrequency: parseInt(options.rotationFrequency)
+            access_level: accessLevel,
+            expires_in_days: expiresInDays,
+            description: options.description?.trim() || undefined,
+            scopes: parseScopes(options.scopes)
         };
-        if (options.interactive || !keyData.name || !keyData.value || !keyData.projectId) {
-            const projects = await apiClient.get('/api-keys/projects');
+        if (options.interactive || !keyData.name) {
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -155,85 +173,62 @@ apiKeysCommand
                     validate: (input) => input.length > 0 || 'Name is required'
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'API key value:',
-                    when: !keyData.value,
-                    validate: (input) => input.length > 0 || 'Value is required'
-                },
-                {
-                    type: 'select',
-                    name: 'keyType',
-                    message: 'Key type:',
-                    when: !keyData.keyType,
-                    choices: [
-                        'api_key',
-                        'database_url',
-                        'oauth_token',
-                        'certificate',
-                        'ssh_key',
-                        'webhook_secret',
-                        'encryption_key'
-                    ]
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    choices: ['development', 'staging', 'production'],
-                    default: 'development'
-                },
-                {
-                    type: 'select',
-                    name: 'projectId',
-                    message: 'Select project:',
-                    when: !keyData.projectId && projects.length > 0,
-                    choices: projects.map((p) => ({ name: `${p.name} (${p.id})`, value: p.id }))
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: keyData.description || ''
                 },
                 {
                     type: 'select',
-                    name: 'accessLevel',
+                    name: 'access_level',
                     message: 'Access level:',
-                    choices: ['public', 'authenticated', 'team', 'admin', 'enterprise'],
-                    default: 'team'
+                    choices: VALID_ACCESS_LEVELS,
+                    default: keyData.access_level
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated, optional):',
-                    filter: (input) => input ? input.split(',').map((tag) => tag.trim()) : []
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: keyData.expires_in_days,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
                     type: 'input',
-                    name: 'expiresAt',
-                    message: 'Expiration date (YYYY-MM-DD, optional):',
-                    validate: (input) => {
-                        if (!input)
-                            return true;
-                        const date = new Date(input);
-                        return !isNaN(date.getTime()) || 'Please enter a valid date';
-                    },
-                    filter: (input) => input ? new Date(input).toISOString() : undefined
-                },
-                {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: 90,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days'
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (keyData.scopes || []).join(', ')
                 }
             ]);
-            keyData = { ...keyData, ...answers };
+            keyData = {
+                ...keyData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || undefined
+                    : keyData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? keyData.scopes
+            };
         }
-        const apiKey = await apiClient.post('/api-keys', keyData);
+        const apiKey = unwrapApiResponse(await apiClient.post(AUTH_API_KEYS_BASE, keyData));
         console.log(colors.success('🔐 API key created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
+        }
+        if (keyData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(keyData.description)}`);
+        }
         console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('⚠️  The key value is securely encrypted and cannot be retrieved later.'));
+        if (apiKey.key) {
+            console.log(`${colors.highlight('API Key:')} ${colors.primary(apiKey.key)}`);
+            console.log(colors.warning('⚠️  Save this key now. It will not be shown again.'));
+        }
+        else {
+            console.log(colors.warning('⚠️  Key value was not returned. If newly created, it cannot be retrieved later.'));
+        }
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -245,15 +240,12 @@ apiKeysCommand
     .command('list')
     .alias('ls')
     .description('List API keys')
-    .option('-p, --project-id <id>', 'Filter by project ID')
+    .option('--all', 'Include inactive keys')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys';
-        if (options.projectId) {
-            url += `?projectId=${options.projectId}`;
-        }
-        const apiKeys = await apiClient.get(url);
+        const query = options.all ? '?active_only=false' : '';
+        const apiKeys = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}${query}`));
         if (options.json) {
             console.log(JSON.stringify(apiKeys, null, 2));
             return;
@@ -266,20 +258,19 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Type', 'Environment', 'Status', 'Usage', 'Last Rotated'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
-            const statusColor = key.status === 'active' ? colors.success :
-                key.status === 'rotating' ? colors.warning : colors.error;
+            const statusColor = key.is_active ? colors.success : colors.error;
             table.push([
                 truncateText(key.id, 20),
                 key.name,
-                key.keyType,
-                key.environment,
-                statusColor(key.status),
-                colors.highlight(key.usageCount.toString()),
-                formatDate(key.lastRotated)
+                key.access_level,
+                truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
+                key.service || 'all',
+                statusColor(key.is_active ? 'active' : 'inactive'),
+                key.expires_at ? formatDate(key.expires_at) : colors.muted('Never')
             ]);
         });
         console.log(table.toString());
@@ -299,7 +290,7 @@ apiKeysCommand
     .option('--json', 'Output as JSON')
     .action(async (keyId, options) => {
     try {
-        const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+        const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
         if (options.json) {
             console.log(JSON.stringify(apiKey, null, 2));
             return;
@@ -308,21 +299,20 @@ apiKeysCommand
         console.log(colors.info('═'.repeat(60)));
         console.log(`${colors.highlight('ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
-        console.log(`${colors.highlight('Project ID:')} ${colors.muted(apiKey.projectId)}`);
-        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.accessLevel)}`);
-        const statusColor = apiKey.status === 'active' ? colors.success :
-            apiKey.status === 'rotating' ? colors.warning : colors.error;
-        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.status)}`);
-        console.log(`${colors.highlight('Usage Count:')} ${colors.accent(apiKey.usageCount)}`);
-        console.log(`${colors.highlight('Tags:')} ${colors.muted(apiKey.tags.join(', ') || 'None')}`);
-        console.log(`${colors.highlight('Rotation Frequency:')} ${colors.info(apiKey.rotationFrequency)} days`);
-        console.log(`${colors.highlight('Last Rotated:')} ${colors.muted(formatDate(apiKey.lastRotated))}`);
-        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.createdAt))}`);
-        console.log(`${colors.highlight('Updated:')} ${colors.muted(formatDate(apiKey.updatedAt))}`);
-        if (apiKey.expiresAt) {
-            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expiresAt))}`);
+        if (apiKey.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
+        }
+        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
+        const statusColor = apiKey.is_active ? colors.success : colors.error;
+        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.is_active ? 'active' : 'inactive')}`);
+        if (apiKey.last_used_at) {
+            console.log(`${colors.highlight('Last Used:')} ${colors.muted(formatDate(apiKey.last_used_at))}`);
+        }
+        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.created_at))}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
         }
         console.log(colors.info('═'.repeat(60)));
     }
@@ -337,23 +327,39 @@ apiKeysCommand
     .description('Update an API key')
     .argument('<keyId>', 'API key ID')
     .option('-n, --name <name>', 'New name')
-    .option('-v, --value <value>', 'New value')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days')
+    .option('-d, --description <description>', 'New description')
+    .option('--access-level <level>', 'New access level')
+    .option('--expires-in-days <days>', 'Set a new expiry in days')
+    .option('--clear-expiry', 'Remove the current expiry')
+    .option('--scopes <scopes>', 'Replace scopes with a comma-separated list')
     .option('--interactive', 'Interactive mode')
     .action(async (keyId, options) => {
     try {
         let updateData = {};
         if (options.name)
             updateData.name = options.name;
-        if (options.value)
-            updateData.value = options.value;
-        if (options.tags)
-            updateData.tags = options.tags.split(',').map((tag) => tag.trim());
-        if (options.rotationFrequency)
-            updateData.rotationFrequency = parseInt(options.rotationFrequency);
+        if (options.description !== undefined)
+            updateData.description = options.description.trim() || null;
+        if (options.accessLevel) {
+            const accessLevel = options.accessLevel.toLowerCase();
+            if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+                throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+            }
+            updateData.access_level = accessLevel;
+        }
+        if (options.expiresInDays) {
+            const expiresInDays = parseInt(options.expiresInDays, 10);
+            if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+                throw new Error('expires-in-days must be a positive integer up to 3650');
+            }
+            updateData.expires_in_days = expiresInDays;
+        }
+        if (options.clearExpiry)
+            updateData.clear_expiry = true;
+        if (options.scopes)
+            updateData.scopes = parseScopes(options.scopes);
         if (options.interactive || Object.keys(updateData).length === 0) {
-            const current = await apiClient.get(`/api-keys/${keyId}`);
+            const current = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -362,47 +368,75 @@ apiKeysCommand
                     default: current.name,
                     when: !updateData.name
                 },
+                {
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: current.description || '',
+                    when: !updateData.description
+                },
+                {
+                    type: 'select',
+                    name: 'access_level',
+                    message: 'Access level:',
+                    choices: VALID_ACCESS_LEVELS,
+                    default: current.access_level,
+                    when: !updateData.access_level
+                },
                 {
                     type: 'confirm',
-                    name: 'updateValue',
-                    message: 'Update the key value?',
+                    name: 'changeExpiry',
+                    message: 'Change expiry?',
                     default: false,
-                    when: !updateData.value
+                    when: updateData.expires_in_days === undefined && !updateData.clear_expiry
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'New key value:',
-                    when: (answers) => answers.updateValue
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: current.expires_at ? 365 : 365,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated):',
-                    default: current.tags.join(', '),
-                    filter: (input) => input.split(',').map((tag) => tag.trim()),
-                    when: !updateData.tags
+                    type: 'confirm',
+                    name: 'clear_expiry',
+                    message: 'Clear expiry instead?',
+                    default: false,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry && Boolean(current.expires_at)
                 },
                 {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: current.rotationFrequency,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days',
-                    when: !updateData.rotationFrequency
+                    type: 'input',
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (current.permissions || []).join(', '),
+                    when: !updateData.scopes
                 }
             ]);
-            updateData = { ...updateData, ...answers };
-            delete updateData.updateValue;
+            updateData = {
+                ...updateData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || null
+                    : updateData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? updateData.scopes
+            };
+            delete updateData.changeExpiry;
+        }
+        if (Object.keys(updateData).length === 0) {
+            console.log(colors.warning('🚫 Nothing to update'));
+            return;
         }
-        const updatedKey = await apiClient.put(`/api-keys/${keyId}`, updateData);
+        const updatedKey = unwrapApiResponse(await apiClient.put(`${AUTH_API_KEYS_BASE}/${keyId}`, updateData));
         console.log(colors.success('🔄 API key updated successfully!'));
         console.log(colors.info('━'.repeat(40)));
         console.log(`${colors.highlight('Name:')} ${colors.accent(updatedKey.name)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.success(updatedKey.status)}`);
-        if (updateData.value) {
-            console.log(colors.warning('⚠️  The key value has been updated and re-encrypted.'));
+        if (updatedKey.description || updateData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(updatedKey.description || updateData.description)}`);
         }
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(updatedKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((updatedKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Expires:')} ${updatedKey.expires_at ? colors.warning(formatDate(updatedKey.expires_at)) : colors.muted('Never')}`);
         console.log(colors.info('━'.repeat(40)));
     }
     catch (error) {
@@ -420,7 +454,7 @@ apiKeysCommand
     .action(async (keyId, options) => {
     try {
         if (!options.force) {
-            const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+            const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const { confirm } = await inquirer.prompt([
                 {
                     type: 'confirm',
@@ -434,7 +468,7 @@ apiKeysCommand
                 return;
             }
         }
-        await apiClient.delete(`/api-keys/${keyId}`);
+        await apiClient.delete(`${AUTH_API_KEYS_BASE}/${keyId}`);
         console.log(colors.success('🗑️  API key deleted successfully!'));
     }
     catch (error) {
@@ -564,7 +598,7 @@ mcpCommand
             delete toolData.maxConcurrentSessions;
             delete toolData.maxSessionDuration;
         }
-        const tool = await apiClient.post('/api-keys/mcp/tools', toolData);
+        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
         console.log(colors.success('🤖 MCP tool registered successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
@@ -584,12 +618,12 @@ mcpCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const tools = await apiClient.get('/api-keys/mcp/tools');
+        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
         if (options.json) {
             console.log(JSON.stringify(tools, null, 2));
             return;
         }
-        if (tools.length === 0) {
+        if (!Array.isArray(tools) || tools.length === 0) {
             console.log(colors.warning('⚠️  No MCP tools found'));
             console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
             return;
@@ -644,7 +678,8 @@ mcpCommand
         };
         if (options.interactive || !requestData.toolId || !requestData.organizationId ||
             requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const tools = await apiClient.get('/api-keys/mcp/tools');
+            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
+            const tools = Array.isArray(mcpTools) ? mcpTools : [];
             const answers = await inquirer.prompt([
                 {
                     type: 'select',
@@ -695,7 +730,7 @@ mcpCommand
             ]);
             requestData = { ...requestData, ...answers };
         }
-        const response = await apiClient.post('/api-keys/mcp/request-access', requestData);
+        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
         console.log(colors.success('🔐 Access request created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
@@ -721,7 +756,7 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/usage';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
         const params = new URLSearchParams();
         if (options.keyId)
             params.append('keyId', options.keyId);
@@ -730,12 +765,12 @@ analyticsCommand
         if (params.toString()) {
             url += `?${params.toString()}`;
         }
-        const analytics = await apiClient.get(url);
+        const analytics = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(analytics, null, 2));
             return;
         }
-        if (analytics.length === 0) {
+        if (!Array.isArray(analytics) || analytics.length === 0) {
             console.log(chalk.yellow('No usage data found'));
             return;
         }
@@ -770,16 +805,16 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/security-events';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
         if (options.severity) {
             url += `?severity=${options.severity}`;
         }
-        const events = await apiClient.get(url);
+        const events = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(events, null, 2));
             return;
         }
-        if (events.length === 0) {
+        if (!Array.isArray(events) || events.length === 0) {
             console.log(colors.success('✅ No security events found'));
             return;
         }

package/dist/commands/auth.js

@@ -712,12 +712,8 @@ async function handleOAuthFlow(config) {
         await config.set('refresh_token', tokens.refresh_token);
         await config.set('token_expires_at', Date.now() + (tokens.expires_in * 1000));
         await config.set('authMethod', 'oauth');
-        // The OAuth access token from auth-gateway works as the API token for all services
-        // Store it as the vendor key equivalent for MCP and API access
         spinner.text = 'Configuring unified access...';
         spinner.start();
-        // Use the OAuth access token directly - it's already an auth-gateway token
-        await config.setVendorKey(tokens.access_token);
         spinner.succeed('Unified authentication configured');
         console.log();
         console.log(chalk.green('✓ OAuth2 authentication successful'));

package/dist/commands/mcp.js

@@ -439,6 +439,12 @@ export function mcpCommands(program) {
             if (options.args) {
                 try {
                     args = JSON.parse(options.args);
+                    // Validate that args is a plain object (not array or primitive)
+                    if (typeof args !== 'object' || args === null || Array.isArray(args)) {
+                        spinner.fail('Arguments must be a JSON object, not an array or primitive value');
+                        console.log(chalk.yellow('Example: --args \'{"key": "value"}\''));
+                        process.exit(1);
+                    }
                 }
                 catch {
                     spinner.fail('Invalid JSON arguments');

package/dist/commands/memory.js

@@ -103,12 +103,20 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         if (!tool) {
             throw new Error(`${fieldName}[${index}].tool is required`);
         }
-        const parsed = { tool };
-        if (entry.params !== undefined) {
-            if (!isPlainObject(entry.params)) {
-                throw new Error(`${fieldName}[${index}].params must be a JSON object`);
+        const outcome = typeof entry.outcome === 'string' ? entry.outcome.trim() : '';
+        if (!['success', 'partial', 'failed'].includes(outcome)) {
+            throw new Error(`${fieldName}[${index}].outcome must be success, partial, or failed`);
+        }
+        const parsed = {
+            tool,
+            outcome: outcome,
+        };
+        const rawParameters = entry.parameters ?? entry.params;
+        if (rawParameters !== undefined) {
+            if (!isPlainObject(rawParameters)) {
+                throw new Error(`${fieldName}[${index}].parameters must be a JSON object`);
             }
-            parsed.params = entry.params;
+            parsed.parameters = rawParameters;
         }
         if (entry.timestamp !== undefined) {
             if (typeof entry.timestamp !== 'string' || !entry.timestamp.trim()) {
@@ -127,6 +135,33 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         return parsed;
     });
 };
+const ensureCompletedSteps = (value, fieldName) => {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${fieldName} must be a JSON array`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry === 'string') {
+            const normalized = entry.trim();
+            if (!normalized) {
+                throw new Error(`${fieldName}[${index}] must be a non-empty string`);
+            }
+            return normalized;
+        }
+        if (isPlainObject(entry)) {
+            const tool = typeof entry.tool === 'string'
+                ? entry.tool?.trim()
+                : '';
+            if (!tool) {
+                throw new Error(`${fieldName}[${index}].tool must be a non-empty string`);
+            }
+            return tool;
+        }
+        throw new Error(`${fieldName}[${index}] must be a string or an object with a tool field`);
+    });
+};
 const clampThreshold = (value) => {
     if (!Number.isFinite(value))
         return 0.55;
@@ -235,8 +270,16 @@ const createIntelligenceTransport = async () => {
                 }),
             };
         }
-        // Legacy key path: use CLI API client auth middleware directly.
-        return { mode: 'api' };
+        // Pre-hashed key (64 hex chars from oauth-client normalizeApiKey): inject via header.
+        // The edge functions accept pre-hashed keys after the auth.ts shared utility update.
+        return {
+            mode: 'sdk',
+            client: new MemoryIntelligenceClient({
+                apiUrl,
+                allowMissingAuth: true,
+                headers: { 'X-API-Key': apiKey },
+            }),
+        };
     }
     throw new Error('Authentication required. Run "lanonasis auth login" first.');
 };
@@ -1207,7 +1250,7 @@ export function memoryCommands(program) {
         .description('Suggest next actions from learned behavior patterns')
         .requiredOption('--task <text>', 'Current task description')
         .option('--state <json>', 'Additional current state JSON object')
-        .option('--completed-steps <json>', 'Completed steps JSON array')
+        .option('--completed-steps <json>', 'Completed steps JSON array (strings preferred)')
         .option('--max-suggestions <number>', 'Maximum suggestions', '3')
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
@@ -1218,9 +1261,7 @@ export function memoryCommands(program) {
             const parsedState = parseJsonOption(options.state, '--state');
             const state = ensureJsonObject(parsedState, '--state') || {};
             const parsedCompletedSteps = parseJsonOption(options.completedSteps, '--completed-steps');
-            const completedSteps = parsedCompletedSteps === undefined
-                ? undefined
-                : ensureBehaviorActions(parsedCompletedSteps, '--completed-steps', { allowEmpty: true });
+            const completedSteps = ensureCompletedSteps(parsedCompletedSteps, '--completed-steps');
             const result = await postIntelligenceEndpoint(transport, '/intelligence/behavior-suggest', {
                 user_id: userId,
                 current_state: {

package/dist/index.js

@@ -280,10 +280,16 @@ authCmd
             const profileClient = new APIClient();
             profileClient.noExit = true;
             const profile = await profileClient.getUserProfile();
+            await cliConfig.updateCurrentUserProfile(profile);
+            const organizationId = profile.organization_id || profile.organizationId;
             console.log(`Email: ${profile.email}`);
             if (profile.name)
                 console.log(`Name: ${profile.name}`);
+            if (organizationId)
+                console.log(`Organization: ${organizationId}`);
             console.log(`Role: ${profile.role}`);
+            if (profile.plan)
+                console.log(`Plan: ${profile.plan}`);
             if (profile.provider)
                 console.log(`Provider: ${profile.provider}`);
             if (profile.last_sign_in_at) {
@@ -736,13 +742,21 @@ program
         const profileClient = new APIClient();
         profileClient.noExit = true;
         const profile = await profileClient.getUserProfile();
+        await cliConfig.updateCurrentUserProfile(profile);
+        const organizationId = profile.organization_id || profile.organizationId;
         console.log(chalk.blue.bold('👤 Current User'));
         console.log('━'.repeat(40));
         console.log(`Email:      ${chalk.white(profile.email)}`);
         if (profile.name) {
             console.log(`Name:       ${chalk.white(profile.name)}`);
         }
+        if (organizationId) {
+            console.log(`Organization: ${chalk.white(organizationId)}`);
+        }
         console.log(`Role:       ${chalk.white(profile.role)}`);
+        if (profile.plan) {
+            console.log(`Plan:       ${chalk.white(profile.plan)}`);
+        }
         if (profile.provider) {
             console.log(`Provider:   ${chalk.white(profile.provider)}`);
         }

package/dist/utils/api.d.ts

@@ -169,7 +169,10 @@ export interface UserProfile {
     email: string;
     name: string | null;
     avatar_url: string | null;
+    organization_id?: string | null;
+    organizationId?: string | null;
     role: string;
+    plan?: string | null;
     provider: string | null;
     project_scope: string | null;
     platform: string | null;
@@ -185,7 +188,10 @@ export declare class APIClient {
     private config;
     /** When true, throw on 401/403 instead of printing+exiting (for callers that handle errors) */
     noExit: boolean;
+    private isLikelyHashedCredential;
     private normalizeMemoryEntry;
+    private tryNormalizeMemoryEntry;
+    private normalizeMemoryStats;
     private shouldUseLegacyMemoryRpcFallback;
     private shouldRetryViaApiGateway;
     private shouldRetryViaSupabaseMemoryFunctions;

package/dist/utils/api.js

@@ -2,11 +2,22 @@ import axios from 'axios';
 import chalk from 'chalk';
 import { randomUUID } from 'crypto';
 import { CLIConfig } from './config.js';
+const MEMORY_TYPES = [
+    'context',
+    'project',
+    'knowledge',
+    'reference',
+    'personal',
+    'workflow'
+];
 export class APIClient {
     client;
     config;
     /** When true, throw on 401/403 instead of printing+exiting (for callers that handle errors) */
     noExit = false;
+    isLikelyHashedCredential(value) {
+        return typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value.trim());
+    }
     normalizeMemoryEntry(payload) {
         // API responses are inconsistent across gateways:
         // - Some return the memory entry directly
@@ -27,13 +38,77 @@ export class APIClient {
         }
         return payload;
     }
+    tryNormalizeMemoryEntry(payload) {
+        if (!payload || typeof payload !== 'object') {
+            return undefined;
+        }
+        const normalized = this.normalizeMemoryEntry(payload);
+        if (!normalized || typeof normalized !== 'object') {
+            return undefined;
+        }
+        const normalizedRecord = normalized;
+        return typeof normalizedRecord.id === 'string' ? normalized : undefined;
+    }
+    normalizeMemoryStats(payload) {
+        if (!payload || typeof payload !== 'object') {
+            throw new Error('Memory stats endpoint returned an invalid response.');
+        }
+        const envelope = payload;
+        const rawStats = envelope.data && typeof envelope.data === 'object' && !Array.isArray(envelope.data)
+            ? envelope.data
+            : envelope;
+        const rawByType = rawStats.memories_by_type && typeof rawStats.memories_by_type === 'object' && !Array.isArray(rawStats.memories_by_type)
+            ? rawStats.memories_by_type
+            : rawStats.by_type && typeof rawStats.by_type === 'object' && !Array.isArray(rawStats.by_type)
+                ? rawStats.by_type
+                : {};
+        const memoriesByType = MEMORY_TYPES.reduce((accumulator, memoryType) => {
+            const value = rawByType[memoryType];
+            accumulator[memoryType] = typeof value === 'number' ? value : 0;
+            return accumulator;
+        }, {});
+        const recentMemories = Array.isArray(rawStats.recent_memories)
+            ? rawStats.recent_memories
+                .map((entry) => this.tryNormalizeMemoryEntry(entry))
+                .filter((entry) => entry !== undefined)
+            : [];
+        const totalMemories = typeof rawStats.total_memories === 'number'
+            ? rawStats.total_memories
+            : Object.values(memoriesByType).reduce((sum, count) => sum + count, 0);
+        return {
+            total_memories: totalMemories,
+            memories_by_type: memoriesByType,
+            total_size_bytes: typeof rawStats.total_size_bytes === 'number' ? rawStats.total_size_bytes : 0,
+            avg_access_count: typeof rawStats.avg_access_count === 'number' ? rawStats.avg_access_count : 0,
+            most_accessed_memory: this.tryNormalizeMemoryEntry(rawStats.most_accessed_memory),
+            recent_memories: recentMemories
+        };
+    }
     shouldUseLegacyMemoryRpcFallback(error) {
         const status = error?.response?.status;
         const errorData = error?.response?.data;
         const message = `${errorData?.error || ''} ${errorData?.message || ''}`.toLowerCase();
+        const rawRequestUrl = String(error?.config?.url || '');
+        const requestPath = (() => {
+            try {
+                if (/^https?:\/\//i.test(rawRequestUrl)) {
+                    return new URL(rawRequestUrl).pathname;
+                }
+            }
+            catch {
+                // Fall back to the raw URL if URL parsing fails.
+            }
+            return rawRequestUrl;
+        })();
+        const normalizedRequestUrl = requestPath.startsWith('/memory')
+            ? this.normalizeMcpPathToApi(requestPath)
+            : requestPath;
         if (status === 405) {
             return true;
         }
+        if (status === 404 && /^\/api\/v1\/memories\/[^/?#]+$/.test(normalizedRequestUrl)) {
+            return true;
+        }
         if (status === 400 && message.includes('memory id is required')) {
             return true;
         }
@@ -238,6 +313,9 @@ export class APIClient {
             const forceDirectApi = forceApiFromEnv || forceApiFromConfig || forceDirectApiRetry;
             const prefersTokenAuth = Boolean(token) && (authMethod === 'jwt' || authMethod === 'oauth' || authMethod === 'oauth2');
             const useVendorKeyAuth = Boolean(vendorKey) && !prefersTokenAuth;
+            if (authMethod === 'vendor_key' && this.isLikelyHashedCredential(vendorKey)) {
+                throw new Error('Stored vendor key is in legacy hashed format. Run "lanonasis auth login --vendor-key <your-key>" to refresh secure storage.');
+            }
             // Determine the correct API base URL:
             // - Auth endpoints -> auth.lanonasis.com
             // - Memory/MCP operations (JWT or vendor key) -> mcp.lanonasis.com (the memory service)
@@ -567,7 +645,7 @@ export class APIClient {
             return this.normalizeMemoryEntry(response.data);
         }
         catch (error) {
-            if (this.shouldUseLegacyMemoryRpcFallback(error)) {
+            if (this.shouldUseLegacyMemoryRpcFallback(error) || error?.response?.status === 404) {
                 const fallback = await this.client.post('/api/v1/memory/update', {
                     id,
                     ...data
@@ -585,7 +663,7 @@ export class APIClient {
             await this.client.delete(`/api/v1/memories/${id}`);
         }
         catch (error) {
-            if (this.shouldUseLegacyMemoryRpcFallback(error)) {
+            if (this.shouldUseLegacyMemoryRpcFallback(error) || error?.response?.status === 404) {
                 await this.client.post('/api/v1/memory/delete', { id });
                 return;
             }
@@ -601,7 +679,7 @@ export class APIClient {
     }
     async getMemoryStats() {
         const response = await this.client.get('/api/v1/memories/stats');
-        return response.data;
+        return this.normalizeMemoryStats(response.data);
     }
     async bulkDeleteMemories(memoryIds) {
         const response = await this.client.post('/api/v1/memories/bulk/delete', {

package/dist/utils/config.d.ts

@@ -48,9 +48,15 @@ export declare class CLIConfig {
     private static readonly CONFIG_VERSION;
     private authCheckCache;
     private readonly AUTH_CACHE_TTL;
-    private apiKeyStorage;
+    private apiKeyStorage?;
     private vendorKeyCache?;
+    private isLegacyHashedCredential;
+    private getLegacyHashedVendorKeyReason;
+    private normalizeOptionalString;
+    private extractOrganizationId;
+    private buildUserProfile;
     constructor();
+    private getApiKeyStorage;
     /**
      * Overrides the configuration storage directory. Primarily used for tests.
      */
@@ -117,6 +123,7 @@ export declare class CLIConfig {
     getToken(): string | undefined;
     getAuthMethod(): string | undefined;
     getCurrentUser(): Promise<UserProfile | undefined>;
+    updateCurrentUserProfile(profile: Record<string, unknown>): Promise<void>;
     isAuthenticated(): Promise<boolean>;
     logout(): Promise<void>;
     clear(): Promise<void>;

package/dist/utils/config.js

@@ -15,12 +15,51 @@ export class CLIConfig {
     AUTH_CACHE_TTL = 5 * 60 * 1000; // 5 minutes
     apiKeyStorage;
     vendorKeyCache;
+    isLegacyHashedCredential(value) {
+        return typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value.trim());
+    }
+    getLegacyHashedVendorKeyReason() {
+        return 'Stored vendor key is in legacy hashed format. Run "lanonasis auth login --vendor-key <your-key>" to refresh secure storage.';
+    }
+    normalizeOptionalString(value) {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            return trimmed.length > 0 ? trimmed : undefined;
+        }
+        if (value === null || value === undefined) {
+            return undefined;
+        }
+        return String(value);
+    }
+    extractOrganizationId(source) {
+        return this.normalizeOptionalString(source.organization_id)
+            ?? this.normalizeOptionalString(source.organizationId);
+    }
+    buildUserProfile(source, existing) {
+        const email = this.normalizeOptionalString(source.email) ?? existing?.email ?? '';
+        const organization_id = this.extractOrganizationId(source) ?? existing?.organization_id ?? '';
+        const role = this.normalizeOptionalString(source.role) ?? existing?.role ?? '';
+        const plan = this.normalizeOptionalString(source.plan) ?? existing?.plan ?? '';
+        if (!email && !organization_id && !role && !plan) {
+            return existing;
+        }
+        return {
+            email,
+            organization_id,
+            role,
+            plan
+        };
+    }
     constructor() {
         this.configDir = path.join(os.homedir(), '.maas');
         this.configPath = path.join(this.configDir, 'config.json');
         this.lockFile = path.join(this.configDir, 'config.lock');
-        // Initialize secure storage for vendor keys using oauth-client's ApiKeyStorage
-        this.apiKeyStorage = new ApiKeyStorage();
+    }
+    getApiKeyStorage() {
+        if (!this.apiKeyStorage) {
+            this.apiKeyStorage = new ApiKeyStorage();
+        }
+        return this.apiKeyStorage;
     }
     /**
      * Overrides the configuration storage directory. Primarily used for tests.
@@ -627,6 +666,13 @@ export class CLIConfig {
         await this.discoverServices();
         const token = this.getToken();
         const vendorKey = await this.getVendorKeyAsync();
+        if (this.config.authMethod === 'vendor_key' && this.isLegacyHashedCredential(vendorKey)) {
+            return {
+                valid: false,
+                method: 'vendor_key',
+                reason: this.getLegacyHashedVendorKeyReason()
+            };
+        }
         if (this.config.authMethod === 'vendor_key' && vendorKey) {
             return this.verifyVendorKeyWithAuthGateway(vendorKey);
         }
@@ -710,8 +756,9 @@ export class CLIConfig {
         }
         // Initialize and store using ApiKeyStorage from @lanonasis/oauth-client
         // This handles encryption automatically (AES-256-GCM with machine-derived key)
-        await this.apiKeyStorage.initialize();
-        await this.apiKeyStorage.store({
+        const apiKeyStorage = this.getApiKeyStorage();
+        await apiKeyStorage.initialize();
+        await apiKeyStorage.store({
             apiKey: trimmedKey,
             organizationId: this.config.user?.organization_id,
             userId: this.config.user?.email,
@@ -835,8 +882,9 @@ export class CLIConfig {
      */
     async getVendorKeyAsync() {
         try {
-            await this.apiKeyStorage.initialize();
-            const stored = await this.apiKeyStorage.retrieve();
+            const apiKeyStorage = this.getApiKeyStorage();
+            await apiKeyStorage.initialize();
+            const stored = await apiKeyStorage.retrieve();
             if (stored) {
                 this.vendorKeyCache = stored.apiKey;
                 return this.vendorKeyCache;
@@ -878,12 +926,7 @@ export class CLIConfig {
                 this.config.tokenExpiry = decoded.exp;
             }
             // Store user info
-            this.config.user = {
-                email: String(decoded.email || ''),
-                organization_id: String(decoded.organizationId || ''),
-                role: String(decoded.role || ''),
-                plan: String(decoded.plan || '')
-            };
+            this.config.user = this.buildUserProfile(decoded, this.config.user);
         }
         catch {
             // Invalid token, don't store user info or expiry
@@ -902,6 +945,23 @@ export class CLIConfig {
     async getCurrentUser() {
         return this.config.user;
     }
+    async updateCurrentUserProfile(profile) {
+        const nextUser = this.buildUserProfile(profile, this.config.user);
+        if (!nextUser) {
+            return;
+        }
+        const currentUser = this.config.user;
+        const changed = !currentUser
+            || currentUser.email !== nextUser.email
+            || currentUser.organization_id !== nextUser.organization_id
+            || currentUser.role !== nextUser.role
+            || currentUser.plan !== nextUser.plan;
+        if (!changed) {
+            return;
+        }
+        this.config.user = nextUser;
+        await this.save();
+    }
     async isAuthenticated() {
         // Attempt refresh for OAuth sessions before checks (prevents intermittent auth dropouts).
         // This is safe to call even when not using OAuth; it will no-op.
@@ -912,6 +972,13 @@ export class CLIConfig {
             const vendorKey = await this.getVendorKeyAsync();
             if (!vendorKey)
                 return false;
+            if (this.isLegacyHashedCredential(vendorKey)) {
+                if (process.env.CLI_VERBOSE === 'true') {
+                    console.warn(`⚠️  ${this.getLegacyHashedVendorKeyReason()}`);
+                }
+                this.authCheckCache = { isValid: false, timestamp: Date.now() };
+                return false;
+            }
             // Check in-memory cache first (5-minute TTL)
             if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
                 return this.authCheckCache.isValid;
@@ -1146,10 +1213,13 @@ export class CLIConfig {
         this.vendorKeyCache = undefined;
         this.config.vendorKey = undefined;
         this.config.authMethod = undefined;
+        this.config.refresh_token = undefined;
+        this.config.token_expires_at = undefined;
         try {
-            await this.apiKeyStorage.initialize();
+            const apiKeyStorage = this.getApiKeyStorage();
+            await apiKeyStorage.initialize();
             // ApiKeyStorage may implement clear() to remove encrypted secrets
-            const storage = this.apiKeyStorage;
+            const storage = apiKeyStorage;
             if (typeof storage.clear === 'function') {
                 await storage.clear();
             }
@@ -1270,14 +1340,6 @@ export class CLIConfig {
                 if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
                     this.config.token_expires_at = Date.now() + (expiresIn * 1000);
                 }
-                // Keep the encrypted "vendor key" in sync for MCP/WebSocket clients that use X-API-Key.
-                // This does not change authMethod away from oauth (setVendorKey guards against that).
-                try {
-                    await this.setVendorKey(accessToken);
-                }
-                catch {
-                    // Non-fatal: bearer token refresh still helps API calls.
-                }
                 await this.save().catch(() => { });
                 return;
             }
@@ -1327,9 +1389,23 @@ export class CLIConfig {
         this.config.user = undefined;
         this.config.authMethod = undefined;
         this.config.tokenExpiry = undefined;
+        this.config.refresh_token = undefined;
+        this.config.token_expires_at = undefined;
         this.config.lastValidated = undefined;
         this.config.authFailureCount = 0;
         this.config.lastAuthFailure = undefined;
+        this.vendorKeyCache = undefined;
+        try {
+            const apiKeyStorage = this.getApiKeyStorage();
+            await apiKeyStorage.initialize();
+            const storage = apiKeyStorage;
+            if (typeof storage.clear === 'function') {
+                await storage.clear();
+            }
+        }
+        catch {
+            // Ignore secure storage cleanup failures while invalidating credentials
+        }
         await this.save();
     }
     async incrementFailureCount() {

package/dist/utils/mcp-client.js

@@ -360,6 +360,10 @@ export class MCPClient {
         const authMethod = String(this.config.get('authMethod') || '').toLowerCase();
         const token = this.config.get('token');
         const vendorKey = await this.config.getVendorKeyAsync();
+        const isLikelyHashedCredential = typeof vendorKey === 'string' && /^[a-f0-9]{64}$/i.test(vendorKey.trim());
+        if (authMethod === 'vendor_key' && isLikelyHashedCredential) {
+            throw new Error('AUTHENTICATION_INVALID: Stored vendor key is in legacy hashed format. Run "lanonasis auth login --vendor-key <your-key>" to refresh secure storage.');
+        }
         if (authMethod === 'vendor_key' && typeof vendorKey === 'string' && vendorKey.trim().length > 0) {
             return { value: vendorKey.trim(), source: 'vendor_key' };
         }

package/dist/ux/implementations/ConnectionManagerImpl.js

@@ -51,9 +51,21 @@ export class ConnectionManagerImpl {
         try {
             // Load persisted configuration first
             await this.loadConfig();
-            // First, try to detect the server path
+            // Prefer a configured path only if the file exists (ignore stale machine-specific commits)
             const configuredPath = this.config.localServerPath?.trim();
-            const serverPath = configuredPath || (await this.detectServerPath());
+            let serverPath = null;
+            if (configuredPath) {
+                try {
+                    await fs.access(configuredPath);
+                    serverPath = configuredPath;
+                }
+                catch {
+                    serverPath = await this.detectServerPath();
+                }
+            }
+            else {
+                serverPath = await this.detectServerPath();
+            }
             if (!serverPath) {
                 return {
                     success: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.10",
+  "version": "3.9.12",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -52,11 +52,11 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@lanonasis/mem-intel-sdk": "2.0.3",
-    "@lanonasis/oauth-client": "2.0.0",
+    "@lanonasis/mem-intel-sdk": "2.0.6",
+    "@lanonasis/oauth-client": "2.0.4",
     "@lanonasis/security-sdk": "1.0.5",
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "axios": "^1.13.5",
+    "@modelcontextprotocol/sdk": "^1.28.0",
+    "axios": "^1.13.6",
     "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
     "cli-table3": "^0.6.5",
@@ -64,26 +64,40 @@
     "date-fns": "^4.1.0",
     "dotenv": "^17.3.1",
     "eventsource": "^4.1.0",
-    "inquirer": "^13.2.5",
+    "inquirer": "^13.3.2",
     "jwt-decode": "^4.0.0",
     "open": "^11.0.0",
     "ora": "^9.3.0",
     "table": "^6.9.0",
     "word-wrap": "^1.2.5",
-    "ws": "^8.19.0",
+    "ws": "^8.20.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@jest/globals": "^30.2.0",
+    "@jest/globals": "^30.3.0",
     "@types/cli-progress": "^3.11.6",
     "@types/inquirer": "^9.0.9",
-    "@types/node": "^25.3.0",
+    "@types/node": "^25.5.0",
     "@types/ws": "^8.18.1",
-    "fast-check": "^4.5.3",
-    "jest": "^30.2.0",
+    "fast-check": "^4.6.0",
+    "jest": "^30.3.0",
     "rimraf": "^6.1.3",
     "ts-jest": "^29.4.6",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.2"
+  },
+  "overrides": {
+    "@jest/transform": "^30.3.0",
+    "@hono/node-server": "^1.19.10",
+    "ajv": "^8.18.0",
+    "babel-jest": "^30.3.0",
+    "brace-expansion": "^1.1.13",
+    "express-rate-limit": "^8.2.2",
+    "handlebars": "^4.7.9",
+    "hono": "^4.12.8",
+    "jest-util": "^30.3.0",
+    "picomatch": "^2.3.2",
+    "qs": "^6.15.0",
+    "test-exclude": "^8.0.0"
   },
   "scripts": {
     "build": "rimraf dist && tsc -p tsconfig.json && chmod +x dist/index.js dist/mcp-server-entry.js 2>/dev/null || true",