@lanonasis/cli 3.9.11 → 3.9.13

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.13] - 2026-04-02
+
+### 🐛 Bug Fixes
+
+- **JWT/password sessions now refresh through the real auth-gateway contract**: Expiring CLI sessions no longer call the nonexistent `/v1/auth/refresh` route. Refreshable JWT and OAuth sessions now use `POST /oauth/token` with `grant_type=refresh_token`, matching the live auth-gateway implementation.
+- **Password login now persists refresh metadata**: Username/password authentication now saves `refresh_token` and `token_expires_at` from the login response, so successful JWT sessions can actually refresh instead of silently falling back to re-login loops.
+- **MCP client refresh flow no longer drifts from the main CLI auth flow**: Removed the stale `/auth/refresh` path and incorrect `refreshToken` config key lookup in favor of the shared `CLIConfig.refreshTokenIfNeeded()` implementation.
+
+### 🔄 Dependency Updates
+
+- **Bundled `@lanonasis/mem-intel-sdk` updated to `2.1.0`**: Aligns the CLI with the newly published scoped intelligence query contract and predictive route support.
+
 ## [3.9.11] - 2026-03-27
 
 ### 🐛 Bug Fixes

package/README.md

@@ -1,11 +1,11 @@
-# @lanonasis/cli v3.9.11 - Stable Stats & Cleaner Startup
+# @lanonasis/cli v3.9.13 - Auth Refresh Reliability
 
 [![NPM Version](https://img.shields.io/npm/v/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![Downloads](https://img.shields.io/npm/dt/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Golden Contract](https://img.shields.io/badge/Onasis--Core-v0.1%20Compliant-gold)](https://api.lanonasis.com/.well-known/onasis.json)
 
-🎉 **NEW IN v3.9.11**: `onasis memory stats` now handles wrapped/partial backend responses without crashing, vendor key secure storage is lazy-loaded so unrelated commands no longer trigger noisy fallback warnings, and the bundled `@lanonasis/oauth-client` is updated to `2.0.4` for the ESM-safe keychain loader fix.
+🎉 **NEW IN v3.9.13**: JWT/password CLI sessions now refresh through the real auth-gateway OAuth token contract, password login persists refresh metadata correctly, the MCP client no longer uses stale refresh routes, and the bundled `@lanonasis/mem-intel-sdk` is updated to `2.1.0` for scoped intelligence query support.
 
 ## 🚀 Quick Start
 

package/dist/commands/api-keys.js

@@ -15,6 +15,24 @@ const colors = {
     muted: chalk.gray,
     highlight: chalk.white.bold
 };
+const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+function unwrapApiResponse(response) {
+    if (response && typeof response === 'object' && 'data' in response) {
+        return response.data ?? response;
+    }
+    return response;
+}
+function parseScopes(scopes) {
+    if (!scopes) {
+        return undefined;
+    }
+    const parsed = scopes
+        .split(',')
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : undefined;
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -65,7 +83,8 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const project = await apiClient.post('/api-keys/projects', projectData);
+        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
         console.log(chalk.blue(`Name: ${project.name}`));
@@ -85,12 +104,12 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = await apiClient.get('/api-keys/projects');
+        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
         }
-        if (projects.length === 0) {
+        if (!Array.isArray(projects) || projects.length === 0) {
             console.log(chalk.yellow('No projects found'));
             return;
         }
@@ -122,30 +141,29 @@ apiKeysCommand
     .command('create')
     .description('Create a new API key')
     .option('-n, --name <name>', 'API key name')
-    .option('-v, --value <value>', 'API key value')
-    .option('-t, --type <type>', 'Key type (api_key, database_url, oauth_token, etc.)')
-    .option('-e, --environment <env>', 'Environment (development, staging, production)')
-    .option('-p, --project-id <id>', 'Project ID')
-    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--expires-at <date>', 'Expiration date (ISO format)')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days', '90')
+    .option('-d, --description <description>', 'API key description (optional)')
+    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
+    .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
+        const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const expiresInDays = parseInt(options.expiresInDays, 10);
+        if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+            throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+            throw new Error('expires-in-days must be a positive integer up to 3650');
+        }
         let keyData = {
             name: options.name,
-            value: options.value,
-            keyType: options.type,
-            environment: options.environment || 'development',
-            projectId: options.projectId,
-            accessLevel: options.accessLevel || 'team',
-            tags: options.tags ? options.tags.split(',').map((tag) => tag.trim()) : [],
-            expiresAt: options.expiresAt,
-            rotationFrequency: parseInt(options.rotationFrequency)
+            access_level: accessLevel,
+            expires_in_days: expiresInDays,
+            description: options.description?.trim() || undefined,
+            scopes: parseScopes(options.scopes)
         };
-        if (options.interactive || !keyData.name || !keyData.value || !keyData.projectId) {
-            const projects = await apiClient.get('/api-keys/projects');
+        if (options.interactive || !keyData.name) {
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -155,85 +173,62 @@ apiKeysCommand
                     validate: (input) => input.length > 0 || 'Name is required'
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'API key value:',
-                    when: !keyData.value,
-                    validate: (input) => input.length > 0 || 'Value is required'
-                },
-                {
-                    type: 'select',
-                    name: 'keyType',
-                    message: 'Key type:',
-                    when: !keyData.keyType,
-                    choices: [
-                        'api_key',
-                        'database_url',
-                        'oauth_token',
-                        'certificate',
-                        'ssh_key',
-                        'webhook_secret',
-                        'encryption_key'
-                    ]
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    choices: ['development', 'staging', 'production'],
-                    default: 'development'
-                },
-                {
-                    type: 'select',
-                    name: 'projectId',
-                    message: 'Select project:',
-                    when: !keyData.projectId && projects.length > 0,
-                    choices: projects.map((p) => ({ name: `${p.name} (${p.id})`, value: p.id }))
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: keyData.description || ''
                 },
                 {
                     type: 'select',
-                    name: 'accessLevel',
+                    name: 'access_level',
                     message: 'Access level:',
-                    choices: ['public', 'authenticated', 'team', 'admin', 'enterprise'],
-                    default: 'team'
+                    choices: VALID_ACCESS_LEVELS,
+                    default: keyData.access_level
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated, optional):',
-                    filter: (input) => input ? input.split(',').map((tag) => tag.trim()) : []
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: keyData.expires_in_days,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
                     type: 'input',
-                    name: 'expiresAt',
-                    message: 'Expiration date (YYYY-MM-DD, optional):',
-                    validate: (input) => {
-                        if (!input)
-                            return true;
-                        const date = new Date(input);
-                        return !isNaN(date.getTime()) || 'Please enter a valid date';
-                    },
-                    filter: (input) => input ? new Date(input).toISOString() : undefined
-                },
-                {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: 90,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days'
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (keyData.scopes || []).join(', ')
                 }
             ]);
-            keyData = { ...keyData, ...answers };
+            keyData = {
+                ...keyData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || undefined
+                    : keyData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? keyData.scopes
+            };
         }
-        const apiKey = await apiClient.post('/api-keys', keyData);
+        const apiKey = unwrapApiResponse(await apiClient.post(AUTH_API_KEYS_BASE, keyData));
         console.log(colors.success('🔐 API key created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
+        }
+        if (keyData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(keyData.description)}`);
+        }
         console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('⚠️  The key value is securely encrypted and cannot be retrieved later.'));
+        if (apiKey.key) {
+            console.log(`${colors.highlight('API Key:')} ${colors.primary(apiKey.key)}`);
+            console.log(colors.warning('⚠️  Save this key now. It will not be shown again.'));
+        }
+        else {
+            console.log(colors.warning('⚠️  Key value was not returned. If newly created, it cannot be retrieved later.'));
+        }
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -245,15 +240,12 @@ apiKeysCommand
     .command('list')
     .alias('ls')
     .description('List API keys')
-    .option('-p, --project-id <id>', 'Filter by project ID')
+    .option('--all', 'Include inactive keys')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys';
-        if (options.projectId) {
-            url += `?projectId=${options.projectId}`;
-        }
-        const apiKeys = await apiClient.get(url);
+        const query = options.all ? '?active_only=false' : '';
+        const apiKeys = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}${query}`));
         if (options.json) {
             console.log(JSON.stringify(apiKeys, null, 2));
             return;
@@ -266,20 +258,19 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Type', 'Environment', 'Status', 'Usage', 'Last Rotated'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
-            const statusColor = key.status === 'active' ? colors.success :
-                key.status === 'rotating' ? colors.warning : colors.error;
+            const statusColor = key.is_active ? colors.success : colors.error;
             table.push([
                 truncateText(key.id, 20),
                 key.name,
-                key.keyType,
-                key.environment,
-                statusColor(key.status),
-                colors.highlight(key.usageCount.toString()),
-                formatDate(key.lastRotated)
+                key.access_level,
+                truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
+                key.service || 'all',
+                statusColor(key.is_active ? 'active' : 'inactive'),
+                key.expires_at ? formatDate(key.expires_at) : colors.muted('Never')
             ]);
         });
         console.log(table.toString());
@@ -299,7 +290,7 @@ apiKeysCommand
     .option('--json', 'Output as JSON')
     .action(async (keyId, options) => {
     try {
-        const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+        const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
         if (options.json) {
             console.log(JSON.stringify(apiKey, null, 2));
             return;
@@ -308,21 +299,20 @@ apiKeysCommand
         console.log(colors.info('═'.repeat(60)));
         console.log(`${colors.highlight('ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
-        console.log(`${colors.highlight('Project ID:')} ${colors.muted(apiKey.projectId)}`);
-        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.accessLevel)}`);
-        const statusColor = apiKey.status === 'active' ? colors.success :
-            apiKey.status === 'rotating' ? colors.warning : colors.error;
-        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.status)}`);
-        console.log(`${colors.highlight('Usage Count:')} ${colors.accent(apiKey.usageCount)}`);
-        console.log(`${colors.highlight('Tags:')} ${colors.muted(apiKey.tags.join(', ') || 'None')}`);
-        console.log(`${colors.highlight('Rotation Frequency:')} ${colors.info(apiKey.rotationFrequency)} days`);
-        console.log(`${colors.highlight('Last Rotated:')} ${colors.muted(formatDate(apiKey.lastRotated))}`);
-        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.createdAt))}`);
-        console.log(`${colors.highlight('Updated:')} ${colors.muted(formatDate(apiKey.updatedAt))}`);
-        if (apiKey.expiresAt) {
-            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expiresAt))}`);
+        if (apiKey.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
+        }
+        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
+        const statusColor = apiKey.is_active ? colors.success : colors.error;
+        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.is_active ? 'active' : 'inactive')}`);
+        if (apiKey.last_used_at) {
+            console.log(`${colors.highlight('Last Used:')} ${colors.muted(formatDate(apiKey.last_used_at))}`);
+        }
+        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.created_at))}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
         }
         console.log(colors.info('═'.repeat(60)));
     }
@@ -337,23 +327,39 @@ apiKeysCommand
     .description('Update an API key')
     .argument('<keyId>', 'API key ID')
     .option('-n, --name <name>', 'New name')
-    .option('-v, --value <value>', 'New value')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days')
+    .option('-d, --description <description>', 'New description')
+    .option('--access-level <level>', 'New access level')
+    .option('--expires-in-days <days>', 'Set a new expiry in days')
+    .option('--clear-expiry', 'Remove the current expiry')
+    .option('--scopes <scopes>', 'Replace scopes with a comma-separated list')
     .option('--interactive', 'Interactive mode')
     .action(async (keyId, options) => {
     try {
         let updateData = {};
         if (options.name)
             updateData.name = options.name;
-        if (options.value)
-            updateData.value = options.value;
-        if (options.tags)
-            updateData.tags = options.tags.split(',').map((tag) => tag.trim());
-        if (options.rotationFrequency)
-            updateData.rotationFrequency = parseInt(options.rotationFrequency);
+        if (options.description !== undefined)
+            updateData.description = options.description.trim() || null;
+        if (options.accessLevel) {
+            const accessLevel = options.accessLevel.toLowerCase();
+            if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+                throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+            }
+            updateData.access_level = accessLevel;
+        }
+        if (options.expiresInDays) {
+            const expiresInDays = parseInt(options.expiresInDays, 10);
+            if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+                throw new Error('expires-in-days must be a positive integer up to 3650');
+            }
+            updateData.expires_in_days = expiresInDays;
+        }
+        if (options.clearExpiry)
+            updateData.clear_expiry = true;
+        if (options.scopes)
+            updateData.scopes = parseScopes(options.scopes);
         if (options.interactive || Object.keys(updateData).length === 0) {
-            const current = await apiClient.get(`/api-keys/${keyId}`);
+            const current = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -362,47 +368,75 @@ apiKeysCommand
                     default: current.name,
                     when: !updateData.name
                 },
+                {
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: current.description || '',
+                    when: !updateData.description
+                },
+                {
+                    type: 'select',
+                    name: 'access_level',
+                    message: 'Access level:',
+                    choices: VALID_ACCESS_LEVELS,
+                    default: current.access_level,
+                    when: !updateData.access_level
+                },
                 {
                     type: 'confirm',
-                    name: 'updateValue',
-                    message: 'Update the key value?',
+                    name: 'changeExpiry',
+                    message: 'Change expiry?',
                     default: false,
-                    when: !updateData.value
+                    when: updateData.expires_in_days === undefined && !updateData.clear_expiry
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'New key value:',
-                    when: (answers) => answers.updateValue
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: current.expires_at ? 365 : 365,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated):',
-                    default: current.tags.join(', '),
-                    filter: (input) => input.split(',').map((tag) => tag.trim()),
-                    when: !updateData.tags
+                    type: 'confirm',
+                    name: 'clear_expiry',
+                    message: 'Clear expiry instead?',
+                    default: false,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry && Boolean(current.expires_at)
                 },
                 {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: current.rotationFrequency,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days',
-                    when: !updateData.rotationFrequency
+                    type: 'input',
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (current.permissions || []).join(', '),
+                    when: !updateData.scopes
                 }
             ]);
-            updateData = { ...updateData, ...answers };
-            delete updateData.updateValue;
+            updateData = {
+                ...updateData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || null
+                    : updateData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? updateData.scopes
+            };
+            delete updateData.changeExpiry;
+        }
+        if (Object.keys(updateData).length === 0) {
+            console.log(colors.warning('🚫 Nothing to update'));
+            return;
         }
-        const updatedKey = await apiClient.put(`/api-keys/${keyId}`, updateData);
+        const updatedKey = unwrapApiResponse(await apiClient.put(`${AUTH_API_KEYS_BASE}/${keyId}`, updateData));
         console.log(colors.success('🔄 API key updated successfully!'));
         console.log(colors.info('━'.repeat(40)));
         console.log(`${colors.highlight('Name:')} ${colors.accent(updatedKey.name)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.success(updatedKey.status)}`);
-        if (updateData.value) {
-            console.log(colors.warning('⚠️  The key value has been updated and re-encrypted.'));
+        if (updatedKey.description || updateData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(updatedKey.description || updateData.description)}`);
         }
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(updatedKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((updatedKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Expires:')} ${updatedKey.expires_at ? colors.warning(formatDate(updatedKey.expires_at)) : colors.muted('Never')}`);
         console.log(colors.info('━'.repeat(40)));
     }
     catch (error) {
@@ -420,7 +454,7 @@ apiKeysCommand
     .action(async (keyId, options) => {
     try {
         if (!options.force) {
-            const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+            const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const { confirm } = await inquirer.prompt([
                 {
                     type: 'confirm',
@@ -434,7 +468,7 @@ apiKeysCommand
                 return;
             }
         }
-        await apiClient.delete(`/api-keys/${keyId}`);
+        await apiClient.delete(`${AUTH_API_KEYS_BASE}/${keyId}`);
         console.log(colors.success('🗑️  API key deleted successfully!'));
     }
     catch (error) {
@@ -564,7 +598,7 @@ mcpCommand
             delete toolData.maxConcurrentSessions;
             delete toolData.maxSessionDuration;
         }
-        const tool = await apiClient.post('/api-keys/mcp/tools', toolData);
+        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
         console.log(colors.success('🤖 MCP tool registered successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
@@ -584,12 +618,12 @@ mcpCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const tools = await apiClient.get('/api-keys/mcp/tools');
+        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
         if (options.json) {
             console.log(JSON.stringify(tools, null, 2));
             return;
         }
-        if (tools.length === 0) {
+        if (!Array.isArray(tools) || tools.length === 0) {
             console.log(colors.warning('⚠️  No MCP tools found'));
             console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
             return;
@@ -644,7 +678,8 @@ mcpCommand
         };
         if (options.interactive || !requestData.toolId || !requestData.organizationId ||
             requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const tools = await apiClient.get('/api-keys/mcp/tools');
+            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
+            const tools = Array.isArray(mcpTools) ? mcpTools : [];
             const answers = await inquirer.prompt([
                 {
                     type: 'select',
@@ -695,7 +730,7 @@ mcpCommand
             ]);
             requestData = { ...requestData, ...answers };
         }
-        const response = await apiClient.post('/api-keys/mcp/request-access', requestData);
+        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
         console.log(colors.success('🔐 Access request created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
@@ -721,7 +756,7 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/usage';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
         const params = new URLSearchParams();
         if (options.keyId)
             params.append('keyId', options.keyId);
@@ -730,12 +765,12 @@ analyticsCommand
         if (params.toString()) {
             url += `?${params.toString()}`;
         }
-        const analytics = await apiClient.get(url);
+        const analytics = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(analytics, null, 2));
             return;
         }
-        if (analytics.length === 0) {
+        if (!Array.isArray(analytics) || analytics.length === 0) {
             console.log(chalk.yellow('No usage data found'));
             return;
         }
@@ -770,16 +805,16 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/security-events';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
         if (options.severity) {
             url += `?severity=${options.severity}`;
         }
-        const events = await apiClient.get(url);
+        const events = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(events, null, 2));
             return;
         }
-        if (events.length === 0) {
+        if (!Array.isArray(events) || events.length === 0) {
             console.log(colors.success('✅ No security events found'));
             return;
         }

package/dist/commands/auth.js

@@ -815,8 +815,16 @@ async function handleCredentialsFlow(options, config) {
         if (process.env.CLI_VERBOSE === 'true') {
             console.log(chalk.dim(`   JWT received (length: ${authToken.length})`));
         }
+        const refreshToken = response.refresh_token;
+        const expiresIn = response.expires_in;
         // Store JWT token for API authentication
         await config.setToken(authToken);
+        if (typeof refreshToken === 'string' && refreshToken.length > 0) {
+            config.set('refresh_token', refreshToken);
+        }
+        if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
+            config.set('token_expires_at', Date.now() + (expiresIn * 1000));
+        }
         await config.setAndSave('authMethod', 'jwt');
         spinner.succeed('Login successful');
         console.log();

package/dist/commands/mcp.js

@@ -439,6 +439,12 @@ export function mcpCommands(program) {
             if (options.args) {
                 try {
                     args = JSON.parse(options.args);
+                    // Validate that args is a plain object (not array or primitive)
+                    if (typeof args !== 'object' || args === null || Array.isArray(args)) {
+                        spinner.fail('Arguments must be a JSON object, not an array or primitive value');
+                        console.log(chalk.yellow('Example: --args \'{"key": "value"}\''));
+                        process.exit(1);
+                    }
                 }
                 catch {
                     spinner.fail('Invalid JSON arguments');

package/dist/commands/memory.js

@@ -22,6 +22,12 @@ const MEMORY_TYPE_CHOICES = [
     'personal',
     'workflow',
 ];
+const QUERY_SCOPE_CHOICES = [
+    'personal',
+    'team',
+    'organization',
+    'hybrid',
+];
 const coerceMemoryType = (value) => {
     if (typeof value !== 'string')
         return undefined;
@@ -34,6 +40,48 @@ const coerceMemoryType = (value) => {
     }
     return undefined;
 };
+const coerceQueryScope = (value) => {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (QUERY_SCOPE_CHOICES.includes(normalized)) {
+        return normalized;
+    }
+    return undefined;
+};
+const parseMemoryTypesOption = (value) => {
+    if (!value?.trim())
+        return undefined;
+    const parsed = value
+        .split(',')
+        .map((entry) => coerceMemoryType(entry))
+        .filter((entry) => Boolean(entry));
+    if (parsed.length === 0) {
+        return undefined;
+    }
+    return [...new Set(parsed)];
+};
+const buildIntelligenceContextPayload = (options) => {
+    const payload = {};
+    if (options.organizationId?.trim()) {
+        payload.organization_id = options.organizationId.trim();
+    }
+    if (options.topicId?.trim()) {
+        payload.topic_id = options.topicId.trim();
+    }
+    if (options.scope) {
+        const scope = coerceQueryScope(options.scope);
+        if (!scope) {
+            throw new Error(`Invalid scope \"${options.scope}\". Expected one of: ${QUERY_SCOPE_CHOICES.join(', ')}`);
+        }
+        payload.query_scope = scope;
+    }
+    const memoryTypes = parseMemoryTypesOption(options.memoryTypes);
+    if (memoryTypes?.length) {
+        payload.memory_types = memoryTypes;
+    }
+    return payload;
+};
 const resolveInputMode = async () => {
     const config = new CLIConfig();
     await config.init();
@@ -103,12 +151,20 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         if (!tool) {
             throw new Error(`${fieldName}[${index}].tool is required`);
         }
-        const parsed = { tool };
-        if (entry.params !== undefined) {
-            if (!isPlainObject(entry.params)) {
-                throw new Error(`${fieldName}[${index}].params must be a JSON object`);
+        const outcome = typeof entry.outcome === 'string' ? entry.outcome.trim() : '';
+        if (!['success', 'partial', 'failed'].includes(outcome)) {
+            throw new Error(`${fieldName}[${index}].outcome must be success, partial, or failed`);
+        }
+        const parsed = {
+            tool,
+            outcome: outcome,
+        };
+        const rawParameters = entry.parameters ?? entry.params;
+        if (rawParameters !== undefined) {
+            if (!isPlainObject(rawParameters)) {
+                throw new Error(`${fieldName}[${index}].parameters must be a JSON object`);
             }
-            parsed.params = entry.params;
+            parsed.parameters = rawParameters;
         }
         if (entry.timestamp !== undefined) {
             if (typeof entry.timestamp !== 'string' || !entry.timestamp.trim()) {
@@ -127,6 +183,33 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         return parsed;
     });
 };
+const ensureCompletedSteps = (value, fieldName) => {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${fieldName} must be a JSON array`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry === 'string') {
+            const normalized = entry.trim();
+            if (!normalized) {
+                throw new Error(`${fieldName}[${index}] must be a non-empty string`);
+            }
+            return normalized;
+        }
+        if (isPlainObject(entry)) {
+            const tool = typeof entry.tool === 'string'
+                ? entry.tool?.trim()
+                : '';
+            if (!tool) {
+                throw new Error(`${fieldName}[${index}].tool must be a non-empty string`);
+            }
+            return tool;
+        }
+        throw new Error(`${fieldName}[${index}] must be a string or an object with a tool field`);
+    });
+};
 const clampThreshold = (value) => {
     if (!Number.isFinite(value))
         return 0.55;
@@ -980,13 +1063,21 @@ export function memoryCommands(program) {
     intelligence
         .command('health-check')
         .description('Run memory intelligence health check')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
             const spinner = ora('Running intelligence health check...').start();
             const transport = await createIntelligenceTransport();
             const userId = await resolveCurrentUserId();
-            const result = await postIntelligenceEndpoint(transport, '/intelligence/health-check', { user_id: userId, response_format: 'json' });
+            const result = await postIntelligenceEndpoint(transport, '/intelligence/health-check', {
+                user_id: userId,
+                response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
+            });
             spinner.stop();
             printIntelligenceResult('🩺 Intelligence Health Check', result, options);
         }
@@ -1001,6 +1092,9 @@ export function memoryCommands(program) {
         .description('Suggest tags for a memory')
         .argument('<memory-id>', 'Memory ID')
         .option('--max <number>', 'Maximum suggestions', '8')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (memoryId, options) => {
         try {
@@ -1014,6 +1108,7 @@ export function memoryCommands(program) {
                 max_suggestions: maxSuggestions,
                 include_existing_tags: true,
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🏷️ Tag Suggestions', result, options);
@@ -1030,6 +1125,10 @@ export function memoryCommands(program) {
         .argument('<memory-id>', 'Source memory ID')
         .option('--limit <number>', 'Maximum related memories', '5')
         .option('--threshold <number>', 'Similarity threshold (0-1)', '0.7')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated candidate memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (memoryId, options) => {
         try {
@@ -1042,6 +1141,7 @@ export function memoryCommands(program) {
                 limit: Math.max(1, Math.min(20, parseInt(options.limit || '5', 10))),
                 similarity_threshold: Math.max(0, Math.min(1, parseFloat(options.threshold || '0.7'))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🔗 Related Memories', result, options);
@@ -1057,6 +1157,10 @@ export function memoryCommands(program) {
         .description('Detect duplicate memory entries')
         .option('--threshold <number>', 'Similarity threshold (0-1)', '0.88')
         .option('--max-pairs <number>', 'Maximum duplicate pairs to inspect', '100')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1068,6 +1172,7 @@ export function memoryCommands(program) {
                 similarity_threshold: Math.max(0, Math.min(1, parseFloat(options.threshold || '0.88'))),
                 max_pairs: Math.max(10, Math.min(500, parseInt(options.maxPairs || '100', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🧬 Duplicate Detection', result, options);
@@ -1084,6 +1189,10 @@ export function memoryCommands(program) {
         .option('--topic <topic>', 'Optional topic filter')
         .option('--type <type>', `Optional memory type filter (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--max-memories <number>', 'Maximum memories to analyze', '50')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1100,6 +1209,7 @@ export function memoryCommands(program) {
                 memory_type: memoryType,
                 max_memories: Math.max(5, Math.min(200, parseInt(options.maxMemories || '50', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('💡 Memory Insights', result, options);
@@ -1114,6 +1224,10 @@ export function memoryCommands(program) {
         .command('analyze-patterns')
         .description('Analyze memory usage patterns')
         .option('--days <number>', 'Days to include in analysis', '30')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1124,6 +1238,7 @@ export function memoryCommands(program) {
                 user_id: userId,
                 time_range_days: Math.max(1, Math.min(365, parseInt(options.days || '30', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('📈 Pattern Analysis', result, options);
@@ -1215,7 +1330,7 @@ export function memoryCommands(program) {
         .description('Suggest next actions from learned behavior patterns')
         .requiredOption('--task <text>', 'Current task description')
         .option('--state <json>', 'Additional current state JSON object')
-        .option('--completed-steps <json>', 'Completed steps JSON array')
+        .option('--completed-steps <json>', 'Completed steps JSON array (strings preferred)')
         .option('--max-suggestions <number>', 'Maximum suggestions', '3')
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
@@ -1226,9 +1341,7 @@ export function memoryCommands(program) {
             const parsedState = parseJsonOption(options.state, '--state');
             const state = ensureJsonObject(parsedState, '--state') || {};
             const parsedCompletedSteps = parseJsonOption(options.completedSteps, '--completed-steps');
-            const completedSteps = parsedCompletedSteps === undefined
-                ? undefined
-                : ensureBehaviorActions(parsedCompletedSteps, '--completed-steps', { allowEmpty: true });
+            const completedSteps = ensureCompletedSteps(parsedCompletedSteps, '--completed-steps');
             const result = await postIntelligenceEndpoint(transport, '/intelligence/behavior-suggest', {
                 user_id: userId,
                 current_state: {

package/dist/index.js

@@ -280,10 +280,16 @@ authCmd
             const profileClient = new APIClient();
             profileClient.noExit = true;
             const profile = await profileClient.getUserProfile();
+            await cliConfig.updateCurrentUserProfile(profile);
+            const organizationId = profile.organization_id || profile.organizationId;
             console.log(`Email: ${profile.email}`);
             if (profile.name)
                 console.log(`Name: ${profile.name}`);
+            if (organizationId)
+                console.log(`Organization: ${organizationId}`);
             console.log(`Role: ${profile.role}`);
+            if (profile.plan)
+                console.log(`Plan: ${profile.plan}`);
             if (profile.provider)
                 console.log(`Provider: ${profile.provider}`);
             if (profile.last_sign_in_at) {
@@ -736,13 +742,21 @@ program
         const profileClient = new APIClient();
         profileClient.noExit = true;
         const profile = await profileClient.getUserProfile();
+        await cliConfig.updateCurrentUserProfile(profile);
+        const organizationId = profile.organization_id || profile.organizationId;
         console.log(chalk.blue.bold('👤 Current User'));
         console.log('━'.repeat(40));
         console.log(`Email:      ${chalk.white(profile.email)}`);
         if (profile.name) {
             console.log(`Name:       ${chalk.white(profile.name)}`);
         }
+        if (organizationId) {
+            console.log(`Organization: ${chalk.white(organizationId)}`);
+        }
         console.log(`Role:       ${chalk.white(profile.role)}`);
+        if (profile.plan) {
+            console.log(`Plan:       ${chalk.white(profile.plan)}`);
+        }
         if (profile.provider) {
             console.log(`Provider:   ${chalk.white(profile.provider)}`);
         }

package/dist/utils/api.d.ts

@@ -9,8 +9,11 @@ export interface AuthResponse {
         created_at: string;
         updated_at: string;
     };
-    token: string;
-    expires_at: string;
+    token?: string;
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    expires_at?: string;
 }
 export interface RegisterRequest {
     email: string;
@@ -169,7 +172,10 @@ export interface UserProfile {
     email: string;
     name: string | null;
     avatar_url: string | null;
+    organization_id?: string | null;
+    organizationId?: string | null;
     role: string;
+    plan?: string | null;
     provider: string | null;
     project_scope: string | null;
     platform: string | null;

package/dist/utils/config.d.ts

@@ -27,6 +27,8 @@ interface CLIConfigData {
     lastManualEndpointUpdate?: string;
     vendorKey?: string | undefined;
     authMethod?: 'jwt' | 'vendor_key' | 'oauth' | 'oauth2' | undefined;
+    refresh_token?: string | undefined;
+    token_expires_at?: number | string | undefined;
     tokenExpiry?: number | undefined;
     lastValidated?: string | undefined;
     deviceId?: string;
@@ -52,6 +54,9 @@ export declare class CLIConfig {
     private vendorKeyCache?;
     private isLegacyHashedCredential;
     private getLegacyHashedVendorKeyReason;
+    private normalizeOptionalString;
+    private extractOrganizationId;
+    private buildUserProfile;
     constructor();
     private getApiKeyStorage;
     /**
@@ -120,12 +125,14 @@ export declare class CLIConfig {
     getToken(): string | undefined;
     getAuthMethod(): string | undefined;
     getCurrentUser(): Promise<UserProfile | undefined>;
+    updateCurrentUserProfile(profile: Record<string, unknown>): Promise<void>;
     isAuthenticated(): Promise<boolean>;
     logout(): Promise<void>;
     clear(): Promise<void>;
     exists(): Promise<boolean>;
     validateStoredCredentials(): Promise<boolean>;
     refreshTokenIfNeeded(): Promise<void>;
+    private refreshViaOAuthTokenEndpoint;
     clearInvalidCredentials(): Promise<void>;
     incrementFailureCount(): Promise<void>;
     resetFailureCount(): Promise<void>;

package/dist/utils/config.js

@@ -21,6 +21,35 @@ export class CLIConfig {
     getLegacyHashedVendorKeyReason() {
         return 'Stored vendor key is in legacy hashed format. Run "lanonasis auth login --vendor-key <your-key>" to refresh secure storage.';
     }
+    normalizeOptionalString(value) {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            return trimmed.length > 0 ? trimmed : undefined;
+        }
+        if (value === null || value === undefined) {
+            return undefined;
+        }
+        return String(value);
+    }
+    extractOrganizationId(source) {
+        return this.normalizeOptionalString(source.organization_id)
+            ?? this.normalizeOptionalString(source.organizationId);
+    }
+    buildUserProfile(source, existing) {
+        const email = this.normalizeOptionalString(source.email) ?? existing?.email ?? '';
+        const organization_id = this.extractOrganizationId(source) ?? existing?.organization_id ?? '';
+        const role = this.normalizeOptionalString(source.role) ?? existing?.role ?? '';
+        const plan = this.normalizeOptionalString(source.plan) ?? existing?.plan ?? '';
+        if (!email && !organization_id && !role && !plan) {
+            return existing;
+        }
+        return {
+            email,
+            organization_id,
+            role,
+            plan
+        };
+    }
     constructor() {
         this.configDir = path.join(os.homedir(), '.maas');
         this.configPath = path.join(this.configDir, 'config.json');
@@ -897,12 +926,7 @@ export class CLIConfig {
                 this.config.tokenExpiry = decoded.exp;
             }
             // Store user info
-            this.config.user = {
-                email: String(decoded.email || ''),
-                organization_id: String(decoded.organizationId || ''),
-                role: String(decoded.role || ''),
-                plan: String(decoded.plan || '')
-            };
+            this.config.user = this.buildUserProfile(decoded, this.config.user);
         }
         catch {
             // Invalid token, don't store user info or expiry
@@ -921,6 +945,23 @@ export class CLIConfig {
     async getCurrentUser() {
         return this.config.user;
     }
+    async updateCurrentUserProfile(profile) {
+        const nextUser = this.buildUserProfile(profile, this.config.user);
+        if (!nextUser) {
+            return;
+        }
+        const currentUser = this.config.user;
+        const changed = !currentUser
+            || currentUser.email !== nextUser.email
+            || currentUser.organization_id !== nextUser.organization_id
+            || currentUser.role !== nextUser.role
+            || currentUser.plan !== nextUser.plan;
+        if (!changed) {
+            return;
+        }
+        this.config.user = nextUser;
+        await this.save();
+    }
     async isAuthenticated() {
         // Attempt refresh for OAuth sessions before checks (prevents intermittent auth dropouts).
         // This is safe to call even when not using OAuth; it will no-op.
@@ -1242,9 +1283,9 @@ export class CLIConfig {
             if (String(this.config.authMethod || '').toLowerCase() === 'vendor_key') {
                 return;
             }
+            const refreshToken = this.get('refresh_token');
             // OAuth token refresh (opaque tokens + refresh_token + token_expires_at)
-            if (this.config.authMethod === 'oauth') {
-                const refreshToken = this.get('refresh_token');
+            if (this.config.authMethod === 'oauth' || this.config.authMethod === 'oauth2') {
                 if (!refreshToken) {
                     return;
                 }
@@ -1269,37 +1310,7 @@ export class CLIConfig {
                     return;
                 }
                 await this.discoverServices();
-                const authBase = this.getDiscoveredApiUrl();
-                const resp = await axios.post(`${authBase}/oauth/token`, {
-                    grant_type: 'refresh_token',
-                    refresh_token: refreshToken,
-                    client_id: 'lanonasis-cli'
-                }, {
-                    headers: { 'Content-Type': 'application/json' },
-                    timeout: 10000,
-                    proxy: false
-                });
-                // Some gateways wrap responses as `{ data: { ... } }`.
-                const raw = resp?.data;
-                const payload = raw && typeof raw === 'object' && raw.data && typeof raw.data === 'object'
-                    ? raw.data
-                    : raw;
-                const accessToken = payload?.access_token ?? payload?.token;
-                const refreshedRefreshToken = payload?.refresh_token;
-                const expiresIn = payload?.expires_in;
-                if (typeof accessToken !== 'string' || accessToken.length === 0) {
-                    throw new Error('Token refresh response missing access_token');
-                }
-                // setToken() assumes JWT by default; ensure authMethod stays oauth after storing.
-                await this.setToken(accessToken);
-                this.config.authMethod = 'oauth';
-                if (typeof refreshedRefreshToken === 'string' && refreshedRefreshToken.length > 0) {
-                    this.config.refresh_token = refreshedRefreshToken;
-                }
-                if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
-                    this.config.token_expires_at = Date.now() + (expiresIn * 1000);
-                }
-                await this.save().catch(() => { });
+                await this.refreshViaOAuthTokenEndpoint(refreshToken, this.getDiscoveredApiUrl(), 'oauth');
                 return;
             }
             // Check if token is JWT and if it's close to expiry
@@ -1318,20 +1329,11 @@ export class CLIConfig {
             const exp = typeof decoded.exp === 'number' ? decoded.exp : 0;
             // Refresh if token expires within 5 minutes
             if (exp > 0 && (exp - now) < 300) {
-                // Import axios dynamically
-                await this.discoverServices();
-                const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-                // Attempt token refresh
-                const response = await axios.post(`${authBase}/v1/auth/refresh`, {}, {
-                    headers: {
-                        'Authorization': `Bearer ${token}`,
-                        'X-Project-Scope': 'lanonasis-maas'
-                    },
-                    timeout: 10000
-                });
-                if (response.data.token) {
-                    await this.setToken(response.data.token);
+                if (!refreshToken) {
+                    return;
                 }
+                await this.discoverServices();
+                await this.refreshViaOAuthTokenEndpoint(refreshToken, this.getDiscoveredApiUrl(), 'jwt');
             }
         }
         catch (err) {
@@ -1342,6 +1344,36 @@ export class CLIConfig {
             }
         }
     }
+    async refreshViaOAuthTokenEndpoint(refreshToken, authBase, authMethod) {
+        const resp = await axios.post(`${authBase}/oauth/token`, {
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: 'lanonasis-cli'
+        }, {
+            headers: { 'Content-Type': 'application/json' },
+            timeout: 10000,
+            proxy: false
+        });
+        const raw = resp?.data;
+        const payload = raw && typeof raw === 'object' && raw.data && typeof raw.data === 'object'
+            ? raw.data
+            : raw;
+        const accessToken = payload?.access_token ?? payload?.token;
+        const refreshedRefreshToken = payload?.refresh_token;
+        const expiresIn = payload?.expires_in;
+        if (typeof accessToken !== 'string' || accessToken.length === 0) {
+            throw new Error('Token refresh response missing access_token');
+        }
+        await this.setToken(accessToken);
+        this.config.authMethod = authMethod;
+        if (typeof refreshedRefreshToken === 'string' && refreshedRefreshToken.length > 0) {
+            this.config.refresh_token = refreshedRefreshToken;
+        }
+        if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
+            this.config.token_expires_at = Date.now() + (expiresIn * 1000);
+        }
+        await this.save().catch(() => { });
+    }
     async clearInvalidCredentials() {
         this.config.token = undefined;
         this.config.vendorKey = undefined;

package/dist/utils/mcp-client.js

@@ -451,20 +451,11 @@ export class MCPClient {
      * Refresh token if needed
      */
     async refreshTokenIfNeeded() {
-        const refreshToken = this.config.get('refreshToken');
-        if (!refreshToken) {
-            throw new Error('No refresh token available. Please re-authenticate.');
-        }
         try {
-            const axios = (await import('axios')).default;
-            const authUrl = this.config.get('authUrl') ?? 'https://api.lanonasis.com';
-            const response = await axios.post(`${authUrl}/auth/refresh`, {
-                refresh_token: refreshToken
-            }, {
-                timeout: 10000
-            });
-            if (response.data.access_token) {
-                await this.config.setAndSave('token', response.data.access_token);
+            const previousToken = this.config.getToken();
+            await this.config.refreshTokenIfNeeded();
+            const currentToken = this.config.getToken();
+            if (currentToken && currentToken !== previousToken) {
                 console.log(chalk.green('✓ Token refreshed successfully'));
             }
         }

package/dist/ux/implementations/ConnectionManagerImpl.js

@@ -51,9 +51,21 @@ export class ConnectionManagerImpl {
         try {
             // Load persisted configuration first
             await this.loadConfig();
-            // First, try to detect the server path
+            // Prefer a configured path only if the file exists (ignore stale machine-specific commits)
             const configuredPath = this.config.localServerPath?.trim();
-            const serverPath = configuredPath || (await this.detectServerPath());
+            let serverPath = null;
+            if (configuredPath) {
+                try {
+                    await fs.access(configuredPath);
+                    serverPath = configuredPath;
+                }
+                catch {
+                    serverPath = await this.detectServerPath();
+                }
+            }
+            else {
+                serverPath = await this.detectServerPath();
+            }
             if (!serverPath) {
                 return {
                     success: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.11",
+  "version": "3.9.13",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -52,11 +52,11 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@lanonasis/mem-intel-sdk": "2.0.6",
+    "@lanonasis/mem-intel-sdk": "2.1.0",
     "@lanonasis/oauth-client": "2.0.4",
     "@lanonasis/security-sdk": "1.0.5",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "axios": "^1.13.6",
+    "axios": "^1.14.0",
     "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
     "cli-table3": "^0.6.5",