@notis_ai/cli 0.2.22 → 0.2.24

package/dist/skill-sync-worker.mjs

@@ -153,32 +153,46 @@ function withConfigFileWriteLock(configFile, callback) {
 }
 
 // src/runtime/channel.js
-var RELEASE_CHANNELS = ["stable", "beta"];
-var CHANNEL_TAGS = { stable: "latest", beta: "beta" };
+var RELEASE_CHANNELS = ["stable", "nightly"];
+var CHANNEL_TAGS = { stable: "latest", nightly: "nightly" };
+var API_HOST_CHANNELS = {
+  "api.notis.ai": "stable",
+  "api-beta.notis.ai": "nightly",
+  "api-nightly.notis.ai": "nightly"
+};
 var CLI_PACKAGE_NAME = "@notis_ai/cli";
 function isReleaseChannel(value) {
   return RELEASE_CHANNELS.includes(value);
 }
+function normalizeReleaseChannel(value) {
+  if (value === "beta") return "nightly";
+  return isReleaseChannel(value) ? value : null;
+}
+function channelFromApiBase(apiBase) {
+  if (typeof apiBase !== "string" || !apiBase) return null;
+  try {
+    return API_HOST_CHANNELS[new URL(apiBase).hostname] || null;
+  } catch {
+    return null;
+  }
+}
 function packageTagForChannel(channel) {
   return CHANNEL_TAGS[channel] || CHANNEL_TAGS.stable;
 }
 function cliCommandForChannel(channel) {
   return `npx --package ${CLI_PACKAGE_NAME}@${packageTagForChannel(channel)} -- notis`;
 }
-function channelFromProfile(profile = {}) {
-  if (isReleaseChannel(profile.channel)) {
-    return profile.channel;
-  }
-  if (profile.beta === true) return "beta";
+function pinnedReleaseChannel(profile = {}) {
+  if (profile.beta === true) return "nightly";
   if (profile.beta === false) return "stable";
+  return normalizeReleaseChannel(profile.channel) || normalizeReleaseChannel(profile.release_channel);
+}
+function channelFromProfile(profile = {}) {
+  const pinned = pinnedReleaseChannel(profile);
+  if (pinned) return pinned;
   for (const candidate of [profile.oauth_api_base, profile.api_base]) {
-    if (typeof candidate !== "string" || !candidate) continue;
-    try {
-      const { hostname } = new URL(candidate);
-      if (hostname === "api-beta.notis.ai") return "beta";
-      if (hostname === "api.notis.ai") return "stable";
-    } catch {
-    }
+    const channel = channelFromApiBase(candidate);
+    if (channel) return channel;
   }
   return null;
 }
@@ -241,7 +255,7 @@ var CONFIG_DIR = join2(homedir2(), ".notis");
 var CONFIG_FILE = join2(CONFIG_DIR, "config.json");
 var WORKSPACE_DIR = join2(CONFIG_DIR, "workspace");
 var DEFAULT_API_BASE = "https://api.notis.ai";
-var BETA_API_BASE = "https://api-beta.notis.ai";
+var NIGHTLY_API_BASE = "https://api-nightly.notis.ai";
 var DEFAULT_PROFILE = "default";
 var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var LEGACY_DESKTOP_PROFILE_KEYS = [
@@ -256,7 +270,7 @@ var LEGACY_DESKTOP_PROFILE_KEYS = [
 var WORKTREE_RUNTIME_FILENAME = join2(".context", "notis-runtime.json");
 var WORKTREE_ROUTING_FILENAME = join2(".context", "notis-routing.json");
 var LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
-var LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-beta.notis.ai"]);
+var LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-nightly.notis.ai", "api-beta.notis.ai"]);
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
@@ -283,11 +297,10 @@ function normalizeProfile(rawProfile = {}) {
   const raw = rawProfile && typeof rawProfile === "object" ? rawProfile : {};
   return {
     api_base: typeof raw.api_base === "string" ? raw.api_base : void 0,
-    beta: typeof raw.beta === "boolean" ? raw.beta : void 0,
-    // Which published CLI build this profile runs, as the deployment reported
-    // it at login. Unknown values are dropped rather than trusted: this key
-    // decides which code executes on the next run.
-    channel: isReleaseChannel(raw.channel) ? raw.channel : void 0,
+    // Which published CLI build this profile runs (`stable` | `nightly`), as
+    // the account reported it at login. Unknown values are dropped rather
+    // than trusted: this key decides which code executes on the next run.
+    release_channel: pinnedReleaseChannel(raw) || void 0,
     label: typeof raw.label === "string" ? raw.label : void 0,
     dev_access_token: typeof raw.dev_access_token === "string" ? raw.dev_access_token : void 0,
     dev_access_expires_at: typeof raw.dev_access_expires_at === "number" ? raw.dev_access_expires_at : void 0,
@@ -546,21 +559,8 @@ function isLiveApiBase(value) {
   }
 }
 function resolveDefaultLiveApiBase(profile = {}) {
-  if (profile.beta === true) {
-    return BETA_API_BASE;
-  }
-  if (profile.beta === false) {
-    return DEFAULT_API_BASE;
-  }
-  if (isLiveApiBase(profile.api_base)) {
-    try {
-      if (new URL(profile.api_base).hostname === "api-beta.notis.ai") {
-        return BETA_API_BASE;
-      }
-    } catch {
-    }
-  }
-  return DEFAULT_API_BASE;
+  const channel = pinnedReleaseChannel(profile) || (isLiveApiBase(profile.api_base) ? channelFromProfile({ api_base: profile.api_base }) : null);
+  return channel === "nightly" ? NIGHTLY_API_BASE : DEFAULT_API_BASE;
 }
 function getApiBase(config, profileName, override) {
   if (override) {
@@ -1238,14 +1238,6 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
   const now = Math.floor(Date.now() / 1e3);
   const payload = decodeJwtPayload(tokenResponse.access_token);
   const oauthApiBase = (metadata.apiBase || runtime.apiBase || "").replace(/\/+$/, "");
-  let beta;
-  try {
-    const hostname = new URL(oauthApiBase).hostname;
-    if (hostname === "api-beta.notis.ai") beta = true;
-    else if (hostname === "api.notis.ai") beta = false;
-  } catch {
-    beta = void 0;
-  }
   const config = updateConfig((latest) => {
     const next = ensureProfile(latest, runtime.profileName);
     const profile = next.profiles[runtime.profileName];
@@ -1255,11 +1247,12 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
       // one API, and the environment the user just authorized against is the
       // only endpoint the resulting token is accepted by.
       api_base: oauthApiBase || profile.api_base,
-      beta: beta ?? profile.beta,
       // The deployment that just authorized this profile also names the
       // published build that belongs to it. Pinning it here is what lets the
       // next run correct itself without the user knowing a channel exists.
-      channel: isReleaseChannel(metadata.channel) ? metadata.channel : channelFromProfile({ ...profile, beta: beta ?? profile.beta, api_base: oauthApiBase }) ?? profile.channel,
+      // followAccountReleaseChannel then replaces it with the account's own
+      // answer once the new grant can ask for it.
+      release_channel: metadata.channel || channelFromApiBase(oauthApiBase) || profile.release_channel,
       oauth_api_base: oauthApiBase || profile.oauth_api_base,
       oauth_resource: metadata.resource,
       oauth_access_token: tokenResponse.access_token,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@notis_ai/cli",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "Agent-first Notis CLI for Spaces, Skills and generic tool execution",
   "type": "module",
   "bin": {
@@ -52,8 +52,8 @@
     "react-dom": "19.3.0"
   },
   "notisRelease": {
-    "sourceSha": "82af83a450ae64171067fd28ff951e7392320a12",
+    "sourceSha": "a7010008e66c7091ebc496a82627bd42a1c5ead6",
     "channel": "stable"
   },
-  "gitHead": "82af83a450ae64171067fd28ff951e7392320a12"
+  "gitHead": "a7010008e66c7091ebc496a82627bd42a1c5ead6"
 }

package/src/cli.js

@@ -13,6 +13,7 @@ import { withSkillSyncLock } from './runtime/sync-skills.js';
 import { maybeInstallSkillSyncService } from './runtime/skill-sync-service.js';
 import {
   CHANNEL_SWITCH_ENV,
+  CHANNEL_SWITCHED,
   resolveChannelSwitch,
 } from './runtime/channel.js';
 import {
@@ -270,8 +271,8 @@ export function channelProfileForArgs(
   { config: suppliedConfig, worktreeRuntime: suppliedWorktreeRuntime } = {},
 ) {
   // An explicit endpoint overrides the stored profile for this run, so it also
-  // decides the build: `--api-base https://api-beta.notis.ai` on a production
-  // profile is a deliberate one-off beta call.
+  // decides the build: `--api-base https://api-nightly.notis.ai` on a stable
+  // profile is a deliberate one-off nightly call.
   const { profile: profileName, apiBase } = readChannelRelevantFlags(args);
   if (apiBase) {
     return { api_base: apiBase };
@@ -313,7 +314,7 @@ export function executeChannelSwitch(
   env,
   { spawn = spawnSync } = {},
 ) {
-  const childEnv = { ...env, [CHANNEL_SWITCH_ENV]: '1' };
+  const childEnv = { ...env, [CHANNEL_SWITCH_ENV]: CHANNEL_SWITCHED };
   // First make npm resolve and boot the target package without executing the
   // requested command. That distinguishes an unavailable tag/network from a
   // legitimate non-zero exit of the handed-off CLI, which must be propagated

package/src/command-specs/auth.js

@@ -1,8 +1,13 @@
 import { loginWithOAuth, logoutOAuth } from '../runtime/oauth.js';
+import { followAccountReleaseChannel } from '../runtime/release-channel.js';
 import { installLocalAgentContext } from './agents.js';
 
 async function loginHandler(ctx) {
-  const result = await loginWithOAuth(ctx.runtime, ctx.options, ctx.output);
+  const result = await followAccountReleaseChannel(
+    ctx.runtime,
+    await loginWithOAuth(ctx.runtime, ctx.options, ctx.output),
+    { login: loginWithOAuth, options: ctx.options, output: ctx.output },
+  );
   if (result.agentAuthorization) {
     const presentation = loginAgentAuthorizationPresentation(result.agentAuthorization);
     return ctx.output.emitSuccess({
@@ -115,7 +120,7 @@ export const authCommandSpecs = [
     examples: [
       'notis login',
       'notis login --profile work',
-      'notis login --profile beta --api-base https://api-beta.notis.ai',
+      'notis login --profile nightly --api-base https://api-nightly.notis.ai',
       'notis login --no-browser --print-url',
       'notis login --mode browser',
       'notis login --mode code',

package/src/command-specs/meta.js

@@ -28,7 +28,7 @@ export function doctorChannelSummary(
   const decision = resolveChannelSwitch({
     runningVersion: runtime.cliVersion,
     profile: {
-      channel: runtime.channel,
+      release_channel: runtime.channel,
       api_base: runtime.apiBase,
     },
     moduleDirectory,

package/src/command-specs/onboarding.js

@@ -10,6 +10,7 @@ import {
   loadConfig,
 } from '../runtime/profiles.js';
 import { ensureFreshOAuthCredential, loginWithOAuth } from '../runtime/oauth.js';
+import { followAccountReleaseChannel } from '../runtime/release-channel.js';
 import { runToolCommand } from './helpers.js';
 import { loginAgentAuthorizationPresentation } from './auth.js';
 import { installLocalAgentContext } from './agents.js';
@@ -207,8 +208,30 @@ async function startHandler(ctx) {
     }
   }
 
+  // An agent confirms a browser sign-in by re-running start, so a profile
+  // that is already signed in still has to land on its account's channel.
+  const followChannel = (result) => followAccountReleaseChannel(runtime, result, {
+    login: loginWithOAuth,
+    options: { browser: true, mode: options.mode },
+    output,
+  });
+  const authorizationResult = (authorization) => {
+    const presentation = loginAgentAuthorizationPresentation(authorization.agentAuthorization);
+    return output.emitSuccess({
+      command: 'start',
+      data: {
+        authenticated: false,
+        profile: runtime.profileName,
+        ...authorization.agentAuthorization,
+      },
+      ...presentation,
+    });
+  };
+
   // Safe to re-run: an already-authorized profile skips straight to the brief.
   if (isAuthenticated(runtime)) {
+    const followed = await followChannel({ profile: getProfile(loadConfig(), runtime.profileName) });
+    if (followed?.agentAuthorization) return authorizationResult(followed);
     return authenticatedResult(ctx);
   }
 
@@ -224,22 +247,13 @@ async function startHandler(ctx) {
   // Browser authorization is the whole signup path: it creates the account when
   // the address is new and authorizes this machine either way. There is nothing
   // for the CLI to collect up front, and nothing to wait on afterwards.
-  const authorization = await loginWithOAuth(
+  const authorization = await followChannel(await loginWithOAuth(
     runtime,
     { browser: true, mode: options.mode, reusePersistedCredential: true },
     output,
-  );
+  ));
   if (authorization?.agentAuthorization) {
-    const presentation = loginAgentAuthorizationPresentation(authorization.agentAuthorization);
-    return output.emitSuccess({
-      command: 'start',
-      data: {
-        authenticated: false,
-        profile: runtime.profileName,
-        ...authorization.agentAuthorization,
-      },
-      ...presentation,
-    });
+    return authorizationResult(authorization);
   }
 
   // A failed authorization leaves whatever stale credential got us here in

package/src/command-specs/tools.js

@@ -26,6 +26,23 @@ import {
   validateArguments,
 } from './helpers.js';
 
+// The backend's META_BRIDGE_TOOL_NAMES are router helpers, not batch targets.
+const ROUTER_HELPERS = new Set([
+  COMPOSIO_SEARCH_TOOLS,
+  COMPOSIO_GET_TOOL_SCHEMAS,
+  COMPOSIO_MULTI_EXECUTE_TOOL,
+  'COMPOSIO_MANAGE_CONNECTIONS',
+  'COMPOSIO_WAIT_FOR_CONNECTIONS',
+  'COMPOSIO_REMOTE_WORKBENCH',
+  'COMPOSIO_REMOTE_BASH_TOOL',
+]);
+
+function executionRequest(toolName, arguments_) {
+  return ROUTER_HELPERS.has(toolName)
+    ? { toolName, arguments_ }
+    : { toolName: COMPOSIO_MULTI_EXECUTE_TOOL, arguments_: { tools: [{ tool_slug: toolName, arguments: arguments_ }] } };
+}
+
 export async function resolveJsonInput(value, label) {
   if (!value) return undefined;
 
@@ -464,10 +481,7 @@ async function toolsExecHandler(ctx) {
 
   const result = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-    arguments_: {
-      tools: [{ tool_slug: requestedToolName, arguments: args }],
-    },
+    ...executionRequest(requestedToolName, args),
     // The server is authoritative about provider/MCP effects. A tool name that
     // looks like a read is not proof of read-only behavior, so generic
     // executions always carry a key and use mutation-safe transport retries.
@@ -558,8 +572,7 @@ async function confirmAndApply(ctx, { requestedToolName, args, preview, result,
   ctx.output.emitProgress({ phase: 'execute', message: `Applying ${requestedToolName}` });
   const applied = await runToolCommand({
     runtime: ctx.runtime,
-    toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-    arguments_: { tools: [{ tool_slug: requestedToolName, arguments: decision.arguments }] },
+    ...executionRequest(requestedToolName, decision.arguments),
     mutating: true,
     idempotencyKey: confirmKey,
     fileBindings,
@@ -594,10 +607,7 @@ async function toolsExecParallelHandler(ctx) {
     calls.map((call) =>
       runToolCommand({
         runtime: ctx.runtime,
-        toolName: COMPOSIO_MULTI_EXECUTE_TOOL,
-        arguments_: {
-          tools: [{ tool_slug: localNotisToolSlug(call.tool_name), arguments: call.arguments || {} }],
-        },
+        ...executionRequest(localNotisToolSlug(call.tool_name), call.arguments || {}),
         mutating: true,
         idempotencyKey: nextIdempotencyKey(ctx.globalOptions),
       })

package/src/runtime/channel.js

@@ -3,25 +3,56 @@
  *
  * The npm tag has to be chosen before the CLI starts, and the CLI only learns
  * which Notis it talks to after it reads the profile — so a single documented
- * install command can never be right for both environments on its own. The
- * deployment answers the question at login (`notis_cli_channel` in the CLI
- * protected-resource metadata), the answer is pinned on the profile, and every
- * later run re-executes the matching build. `@notis_ai/cli@latest` therefore
- * stays the one command worth documenting, including for beta accounts.
+ * install command can never be right for both environments on its own. Login
+ * asks the account which release channel it belongs to (`GET /release_channel`),
+ * the answer is pinned on the profile as `release_channel`, and every later run
+ * re-executes the matching build. `@notis_ai/cli@latest` therefore stays the
+ * one command worth documenting, including for nightly accounts.
  */
 
-export const RELEASE_CHANNELS = ['stable', 'beta'];
-const CHANNEL_TAGS = { stable: 'latest', beta: 'beta' };
+export const RELEASE_CHANNELS = ['stable', 'nightly'];
+// Keep equal to the dist-tags in scripts/release-channels.cjs (a test checks).
+const CHANNEL_TAGS = { stable: 'latest', nightly: 'nightly' };
+// Live API hosts and the channel each one serves.
+const API_HOST_CHANNELS = {
+  'api.notis.ai': 'stable',
+  'api-beta.notis.ai': 'nightly',
+  'api-nightly.notis.ai': 'nightly',
+};
 export const CLI_PACKAGE_NAME = '@notis_ai/cli';
 // Set on the child so a build that disagrees about its own channel — a bad
 // version string, a half-published tag — cannot bounce the process forever.
+// Builds from before the nightly channel wrote `1` and resolved channels from
+// the old profile fields, so a child that sees `1` may correct them once more.
 export const CHANNEL_SWITCH_ENV = 'NOTIS_CLI_CHANNEL_SWITCHED';
+export const CHANNEL_SWITCHED = '2';
+const LEGACY_CHANNEL_SWITCHED = '1';
 export const CHANNEL_DISABLE_ENV = 'NOTIS_CLI_AUTO_CHANNEL';
 
 export function isReleaseChannel(value) {
   return RELEASE_CHANNELS.includes(value);
 }
 
+/**
+ * A channel name as any Notis component may still spell it. `beta` is what
+ * deployments, profiles and builds called the nightly channel before it was
+ * renamed, so it reads as nightly; anything else unknown is dropped.
+ */
+export function normalizeReleaseChannel(value) {
+  if (value === 'beta') return 'nightly';
+  return isReleaseChannel(value) ? value : null;
+}
+
+export function channelFromApiBase(apiBase) {
+  if (typeof apiBase !== 'string' || !apiBase) return null;
+  try {
+    return API_HOST_CHANNELS[new URL(apiBase).hostname] || null;
+  } catch {
+    // A malformed endpoint says nothing about the channel.
+    return null;
+  }
+}
+
 export function packageTagForChannel(channel) {
   return CHANNEL_TAGS[channel] || CHANNEL_TAGS.stable;
 }
@@ -33,37 +64,42 @@ export function cliCommandForChannel(channel) {
 /**
  * The channel of the build that is currently running.
  *
- * The publish pipeline stamps beta releases as prereleases
- * (`0.2.0-beta.129.1`) and production releases as plain semver (`0.2.10`), so
- * the manifest version is the only channel marker that cannot drift from what
- * npm actually served.
+ * The publish pipeline stamps nightly releases as prereleases
+ * (`0.2.0-nightly.129.1`, `0.2.0-beta.129.1` before the rename) and stable
+ * releases as plain semver (`0.2.10`), so the manifest version is the only
+ * channel marker that cannot drift from what npm actually served.
  */
 export function channelFromVersion(version) {
-  return String(version || '').includes('-') ? 'beta' : 'stable';
+  return String(version || '').includes('-') ? 'nightly' : 'stable';
 }
 
 /**
- * The channel a profile is pinned to.
+ * The channel a stored profile's fields pin it to, or null.
  *
- * `channel` is written at login from the deployment's own metadata. The
- * `beta` flag and the endpoint host are the fallbacks that let a profile
- * authorized by an older CLI resolve without a second login.
+ * This CLI writes only `release_channel`. Notis Desktop and older CLIs wrote a
+ * `beta` flag and a `channel` pin (`stable` | `beta`) instead; normalization
+ * drops those on every write, so when one is present it was written after this
+ * CLI last touched the profile and is the fresher answer. Desktop always sets
+ * `beta` from the API it just authorized, which makes it the most reliable.
  */
-export function channelFromProfile(profile = {}) {
-  if (isReleaseChannel(profile.channel)) {
-    return profile.channel;
-  }
-  if (profile.beta === true) return 'beta';
+export function pinnedReleaseChannel(profile = {}) {
+  if (profile.beta === true) return 'nightly';
   if (profile.beta === false) return 'stable';
+  return normalizeReleaseChannel(profile.channel)
+    || normalizeReleaseChannel(profile.release_channel);
+}
+
+/**
+ * The channel a profile belongs to: its pin, else the live API it talks to.
+ * The host fallback lets a profile authorized before channels existed resolve
+ * without a second login.
+ */
+export function channelFromProfile(profile = {}) {
+  const pinned = pinnedReleaseChannel(profile);
+  if (pinned) return pinned;
   for (const candidate of [profile.oauth_api_base, profile.api_base]) {
-    if (typeof candidate !== 'string' || !candidate) continue;
-    try {
-      const { hostname } = new URL(candidate);
-      if (hostname === 'api-beta.notis.ai') return 'beta';
-      if (hostname === 'api.notis.ai') return 'stable';
-    } catch {
-      // A malformed endpoint says nothing about the channel.
-    }
+    const channel = channelFromApiBase(candidate);
+    if (channel) return channel;
   }
   return null;
 }
@@ -115,7 +151,11 @@ export function resolveChannelSwitch({
   const targetChannel = channelFromProfile(profile);
   const stay = (reason) => ({ switch: false, reason, runningChannel, targetChannel });
 
-  if (env[CHANNEL_SWITCH_ENV] === '1') return stay('already_switched');
+  // A pre-nightly build may have handed over on its own reading of the
+  // profile (`1`); that hop may be corrected once, never more.
+  if (env[CHANNEL_SWITCH_ENV] && env[CHANNEL_SWITCH_ENV] !== LEGACY_CHANNEL_SWITCHED) {
+    return stay('already_switched');
+  }
   if (env[CHANNEL_DISABLE_ENV] === '0') return stay('disabled');
   if (!targetChannel) return stay('profile_channel_unknown');
   if (targetChannel === runningChannel) return stay('channel_matches');

package/src/runtime/oauth.js

@@ -26,9 +26,10 @@ import { CliError, EXIT_CODES, usageError } from './errors.js';
 import { readComputerIdentity } from './computer-identity.js';
 import { getAuthRecovery, getRetryRecovery, quoteShellArgument } from './auth-recovery.js';
 import {
+  channelFromApiBase,
   channelFromProfile,
   cliCommandForChannel,
-  isReleaseChannel,
+  normalizeReleaseChannel,
 } from './channel.js';
 import {
   credentialIsExpired,
@@ -408,10 +409,9 @@ export async function discoverCliOAuth(apiBase, fetchImpl = fetch) {
     copyPasteRedirectUri: protectedResource.notis_cli_copy_paste_redirect_uri,
     // A deployment that predates channel advertising, or a local one with no
     // published build, leaves this null and the profile keeps resolving its
-    // channel from the endpoint it authorized against.
-    channel: isReleaseChannel(protectedResource.notis_cli_channel)
-      ? protectedResource.notis_cli_channel
-      : null,
+    // channel from the endpoint it authorized against. Deployments from before
+    // the rename still answer `beta`, which is the nightly channel.
+    channel: normalizeReleaseChannel(protectedResource.notis_cli_channel),
     authorizationEndpoint: authorizationServer.authorization_endpoint,
     tokenEndpoint: authorizationServer.token_endpoint,
     revocationEndpoint: authorizationServer.revocation_endpoint,
@@ -995,14 +995,6 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
   const now = Math.floor(Date.now() / 1000);
   const payload = decodeJwtPayload(tokenResponse.access_token);
   const oauthApiBase = (metadata.apiBase || runtime.apiBase || '').replace(/\/+$/, '');
-  let beta;
-  try {
-    const hostname = new URL(oauthApiBase).hostname;
-    if (hostname === 'api-beta.notis.ai') beta = true;
-    else if (hostname === 'api.notis.ai') beta = false;
-  } catch {
-    beta = undefined;
-  }
   const config = updateConfig((latest) => {
     const next = ensureProfile(latest, runtime.profileName);
     const profile = next.profiles[runtime.profileName];
@@ -1012,14 +1004,14 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
       // one API, and the environment the user just authorized against is the
       // only endpoint the resulting token is accepted by.
       api_base: oauthApiBase || profile.api_base,
-      beta: beta ?? profile.beta,
       // The deployment that just authorized this profile also names the
       // published build that belongs to it. Pinning it here is what lets the
       // next run correct itself without the user knowing a channel exists.
-      channel: isReleaseChannel(metadata.channel)
-        ? metadata.channel
-        : channelFromProfile({ ...profile, beta: beta ?? profile.beta, api_base: oauthApiBase })
-          ?? profile.channel,
+      // followAccountReleaseChannel then replaces it with the account's own
+      // answer once the new grant can ask for it.
+      release_channel: metadata.channel
+        || channelFromApiBase(oauthApiBase)
+        || profile.release_channel,
       oauth_api_base: oauthApiBase || profile.oauth_api_base,
       oauth_resource: metadata.resource,
       oauth_access_token: tokenResponse.access_token,
@@ -1968,14 +1960,16 @@ function confirmCommand(profileName, channel, apiBase) {
   return [
     cliCommandForChannel(channel),
     `--profile ${quoteShellArgument(profileName || 'default')}`,
-    `--api-base ${quoteShellArgument(apiBase)}`,
+    // Only an explicit route is repeated: without one, confirming must stay
+    // free to follow the account to its release channel.
+    ...(apiBase ? [`--api-base ${quoteShellArgument(apiBase)}`] : []),
     'start',
   ].join(' ');
 }
 
 function authorizationChannel(metadata, runtime, pending = null) {
   return metadata.channel
-    || pending?.channel
+    || normalizeReleaseChannel(pending?.channel)
     || channelFromProfile({ api_base: pending?.api_base || runtime.apiBase });
 }
 
@@ -2063,6 +2057,11 @@ async function redeemAuthorizationCode(runtime, code, fetchImpl) {
     // repeating --api-base must not persist a token under a different backend.
     if (pending.api_base) {
       runtime.apiBase = pending.api_base;
+      // An explicit --api-base login stays explicit through its redemption,
+      // so the account's release channel does not reroute it either.
+      if (pending.api_base_explicit && !runtime.requestedApiBase) {
+        runtime.requestedApiBase = pending.api_base;
+      }
     }
     metadata = {
       apiBase: pending.api_base,
@@ -2072,7 +2071,7 @@ async function redeemAuthorizationCode(runtime, code, fetchImpl) {
       tokenEndpoint: pending.token_endpoint,
       revocationEndpoint: pending.revocation_endpoint
         || `${String(pending.issuer || '').replace(/\/+$/, '')}/oauth/revoke`,
-      channel: pending.channel,
+      channel: normalizeReleaseChannel(pending.channel),
     };
     if (!metadata.issuer || !metadata.resource || !metadata.clientId || !metadata.tokenEndpoint) {
       throw oauthError(
@@ -2337,7 +2336,7 @@ export async function loginWithOAuth(
           confirm_command: confirmCommand(
             runtime.profileName,
             authorizationChannel(metadata, runtime),
-            live.api_base,
+            runtime.requestedApiBase ? live.api_base : null,
           ),
         },
       };
@@ -2471,6 +2470,7 @@ export async function loginWithOAuth(
     savePendingAuthorization(runtime, {
       profile: runtime.profileName,
       api_base: runtime.apiBase,
+      api_base_explicit: Boolean(runtime.requestedApiBase),
       verifier,
       state,
       redirect_uri: redirectUri,
@@ -2543,7 +2543,7 @@ export async function loginWithOAuth(
           confirm_command: confirmCommand(
             runtime.profileName,
             authorizationChannel(metadata, runtime),
-            runtime.apiBase,
+            runtime.requestedApiBase ? runtime.apiBase : null,
           ),
         },
       };