@oxygen-agent/cli 1.285.53 → 1.286.13

package/README.md

@@ -34,4 +34,4 @@ oxygen update
 
 For product documentation, visit https://oxygen-agent.com/docs. For support, visit https://oxygen-agent.com.
 
-Version: 1.285.53
+Version: 1.286.13

package/dist/credentials.js

@@ -10,8 +10,22 @@ const ACCOUNT_NAME = "default";
 const DEFAULT_API_URL = "https://oxygen-agent.com";
 const DEFAULT_PROFILE_NAME = "default";
 const WINDOWS_CREDENTIAL_PAYLOAD_ENV = "OXYGEN_CLI_WINDOWS_CREDENTIAL_PAYLOAD";
+function readEnvApiUrl(env) {
+    const apiUrl = env.OXYGEN_API_URL?.trim();
+    return apiUrl ? normalizeApiUrl(apiUrl) : null;
+}
 export function defaultApiUrl(env = process.env) {
-    return normalizeApiUrl(env.OXYGEN_API_URL ?? DEFAULT_API_URL);
+    return readEnvApiUrl(env) ?? DEFAULT_API_URL;
+}
+// OXYGEN_API_URL names the deployment every command must talk to, so it has to
+// win over a stored profile's persisted apiUrl (which defaults to production).
+// Reading it only on the env-token branch made `OXYGEN_API_URL=<dev>` a no-op
+// for anyone logged in, silently pointing verification runs at prod (OXY-3550).
+function withApiUrlOverride(credentials, env) {
+    const override = readEnvApiUrl(env);
+    if (!override || override === credentials.apiUrl)
+        return credentials;
+    return { ...credentials, apiUrl: override };
 }
 export async function loadCredentials(env = process.env) {
     const envToken = readEnvToken(env);
@@ -33,14 +47,15 @@ export async function loadCredentials(env = process.env) {
     const activeProfile = requestedProfile ?? readProfileName(document.activeProfile) ?? DEFAULT_PROFILE_NAME;
     const profileCredentials = profiles[activeProfile];
     if (profileCredentials)
-        return profileCredentials;
+        return withApiUrlOverride(profileCredentials, env);
     if (requestedProfile) {
         throw new OxygenError("profile_not_found", `Oxygen CLI profile "${requestedProfile}" is not stored.`, {
             details: { profile: requestedProfile },
             exitCode: 1,
         });
     }
-    return parseStoredCredentialsObject(document);
+    const storedCredentials = parseStoredCredentialsObject(document);
+    return storedCredentials ? withApiUrlOverride(storedCredentials, env) : null;
 }
 export async function saveCredentials(credentials, env = process.env, options = {}) {
     const normalized = normalizeStoredCredentialsRecord(credentials);
@@ -135,7 +150,8 @@ export async function resolveActiveProfile(env = process.env) {
     const profiles = document ? readProfiles(document) : {};
     const fileActive = readProfileName(document?.activeProfile);
     const candidate = envProfile ?? fileActive ?? DEFAULT_PROFILE_NAME;
-    const credentials = profiles[candidate] ?? null;
+    const stored = profiles[candidate];
+    const credentials = stored ? withApiUrlOverride(stored, env) : null;
     const source = envProfile
         ? "env"
         : fileActive

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.285.53";
+export declare const OXYGEN_VERSION = "1.286.13";
 export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.181.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,4 +1,4 @@
-export const OXYGEN_VERSION = "1.285.53";
+export const OXYGEN_VERSION = "1.286.13";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
 // 1.181.0: paid table action runs and background columns run require
 // approved=true in addition to max_credits; older CLIs cannot send the flag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.285.53",
+  "version": "1.286.13",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",