sentinelayer-cli 0.43.0 → 0.45.0

package/src/cli.js

@@ -242,6 +242,11 @@ export async function buildCliProgram({
 }
 
 export async function runCli(rawArgs = process.argv.slice(2)) {
+  // Where the user's credentials may go is decided once, here, from the real environment and the
+  // global config, and frozen: nothing that changes process.env later can move it.
+  const { freezeProcessTrustContext } = await import("./auth/credential-destinations.js");
+  await freezeProcessTrustContext();
+
   // Normalize slash commands (/omargate → omargate, /audit → audit, etc.)
   const normalizedArgs = normalizeSlashArgs(rawArgs);
 
@@ -269,15 +274,18 @@ export async function runCli(rawArgs = process.argv.slice(2)) {
   // the subcommand (say, post-agent, observe, locks, checkpoints, ...), so no
   // subcommand, present or future, can reach the human token. A tombstoned
   // admission refuses here, before any request.
-  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } = await import(
-    "./session/admission-auth.js"
-  );
+  const { assertDispatchMatchesScope, resolveAgentAdmissionTarget, withAgentAdmission } =
+    await import("./session/admission-auth.js");
   const target = await resolveAgentAdmissionTarget(normalizedArgs);
-  // Execution must match authorization: before ANY action runs, re-derive the identity
-  // from Commander's resolved options and compare it with the scope in force.
+  // Execution must match authorization: before ANY action runs, decide on Commander's parsed
+  // arguments and options -- the values the action will use. Through the MCP CLI bridge in an
+  // agent context the action binds to its session's admission, runs a legacy data-plane route
+  // as before, or is refused (src/session/route-classes.js); and the identity it resolves must
+  // be the one whose scope is in force.
   program.hook("preAction", (_hooked, actionCommand) => assertDispatchMatchesScope(actionCommand));
   if (target) {
-    await withAgentAdmission(target.sessionId, target.agentId, dispatch);
+    // An admission seen above that is gone by the time it is read refuses: never a fallback.
+    await withAgentAdmission(target.sessionId, target.agentId, dispatch, { requireStored: true });
     return;
   }
   await dispatch();

package/src/commands/ai/provision-governance.js

@@ -25,8 +25,7 @@ import {
 import { listSites, recordTemporarySite } from "../../ai/site-store.js";
 import { getIdentityById, recordProvisionedIdentity } from "../../ai/identity-store.js";
 import { resolveOutputRoot } from "../../config/service.js";
-import { readStoredSession } from "../../auth/session-store.js";
-import { fetchAidenIdCredentials } from "../../auth/service.js";
+import { fetchAidenIdCredentials, resolveActiveAuthSession } from "../../auth/service.js";
 import {
   buildCurlPreview,
   normalizeIdempotencyKey,
@@ -37,6 +36,7 @@ import {
   stableTimestampForFile,
   writeArtifact,
 } from "./shared.js";
+import { isAuthenticated } from "../../auth/credential-destinations.js";
 
 function addProvisionEmailOptions(cmd) {
   return cmd
@@ -92,12 +92,13 @@ async function provisionEmailAction(options, command) {
       payload,
     });
 
-    let session = null;
-    try { session = await readStoredSession(); } catch { /* no session */ }
+    const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+      () => null,
+    );
 
     const makeFetcher = () => {
-      if (!session || !session.token) return null;
-      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, token: session.token });
+      if (!isAuthenticated(session)) return null;
+      return () => fetchAidenIdCredentials({ apiUrl: session.apiUrl, auth: session });
     };
 
     const resolvedCredentials = await resolveAidenIdCredentials({

package/src/commands/init.js

@@ -1,25 +1,26 @@
 import process from "node:process";
 
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 
-function applyConfigEnvDefaults(resolvedConfig) {
-  if (!process.env.SENTINELAYER_API_URL && resolvedConfig.apiUrl) {
-    process.env.SENTINELAYER_API_URL = resolvedConfig.apiUrl;
-  }
+// Config values the scaffold flow reads from the environment. The API it talks to and the token
+// it sends are never set here: they come from the trust context and the auth service
+// (src/auth/credential-destinations.js), so a workspace .sentinelayer.yml cannot choose them,
+// and child processes inherit neither.
+// Provider keys come from the user's own config (global, or the environment), never the workspace.
+function applyConfigEnvDefaults(config) {
+  const resolvedConfig = config.resolved;
+  const userValues = userConfigValues(config);
   if (!process.env.SENTINELAYER_WEB_URL && resolvedConfig.webUrl) {
-    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl;
-  }
-  if (!process.env.SENTINELAYER_TOKEN && resolvedConfig.sentinelayerToken) {
-    process.env.SENTINELAYER_TOKEN = resolvedConfig.sentinelayerToken;
+    process.env.SENTINELAYER_WEB_URL = resolvedConfig.webUrl; // printed as a link only
   }
-  if (!process.env.OPENAI_API_KEY && resolvedConfig.openaiApiKey) {
-    process.env.OPENAI_API_KEY = resolvedConfig.openaiApiKey;
+  if (!process.env.OPENAI_API_KEY && userValues.openaiApiKey) {
+    process.env.OPENAI_API_KEY = userValues.openaiApiKey;
   }
-  if (!process.env.ANTHROPIC_API_KEY && resolvedConfig.anthropicApiKey) {
-    process.env.ANTHROPIC_API_KEY = resolvedConfig.anthropicApiKey;
+  if (!process.env.ANTHROPIC_API_KEY && userValues.anthropicApiKey) {
+    process.env.ANTHROPIC_API_KEY = userValues.anthropicApiKey;
   }
-  if (!process.env.GOOGLE_API_KEY && resolvedConfig.googleApiKey) {
-    process.env.GOOGLE_API_KEY = resolvedConfig.googleApiKey;
+  if (!process.env.GOOGLE_API_KEY && userValues.googleApiKey) {
+    process.env.GOOGLE_API_KEY = userValues.googleApiKey;
   }
 }
 
@@ -30,9 +31,11 @@ export function registerInitCommand(program, invokeLegacy) {
     .option("--non-interactive", "Disable prompts and require interview payload")
     .option("--interview-file <path>", "Load interview JSON from file")
     .option("--skip-browser-open", "Do not auto-open browser during auth")
+    .option("--inject-secret", "Set the project token as a GitHub Actions secret on this directory's git remote")
+    .option("--inject-openai-key", "Also set OPENAI_API_KEY from your environment as a GitHub Actions secret there")
     .action(async (projectName, options) => {
       const config = await loadConfig();
-      applyConfigEnvDefaults(config.resolved);
+      applyConfigEnvDefaults(config);
 
       const legacyArgs = [];
       const normalizedProjectName = String(projectName || "").trim();
@@ -49,6 +52,12 @@ export function registerInitCommand(program, invokeLegacy) {
       if (options.skipBrowserOpen) {
         legacyArgs.push("--skip-browser-open");
       }
+      if (options.injectSecret) {
+        legacyArgs.push("--inject-secret");
+      }
+      if (options.injectOpenaiKey) {
+        legacyArgs.push("--inject-openai-key");
+      }
 
       await invokeLegacy(legacyArgs);
     });

package/src/commands/scan.js

@@ -12,7 +12,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { loadConfig, resolveOutputRoot } from "../config/service.js";
+import { loadConfig, resolveOutputRoot, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateModelCost } from "../cost/tracker.js";
@@ -34,6 +34,7 @@ import { detectRepoSlug, setupSecrets } from "../scan/gh-secrets.js";
 import { appendRunEvent, deriveStopClassFromBudget } from "../telemetry/ledger.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { exportCredentialToken, isAuthenticated } from "../auth/credential-destinations.js";
 
 const LEGACY_SCAN_WORKFLOW_PATH = ".github/workflows/security-review.yml";
 
@@ -578,7 +579,7 @@ export function registerScanCommand(program) {
         configModel: config.resolved.defaultModelId,
       });
       const explicitApiKey = String(options.apiKey || "").trim();
-      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+      const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
       const prompt = buildAiPreScanPrompt({
         targetPath,
@@ -856,8 +857,9 @@ export function registerScanCommand(program) {
           env: process.env,
           autoRotate: false,
         });
-        if (session && session.token) {
-          tokenValue = session.token;
+        if (isAuthenticated(session)) {
+          // the one reviewed export of the token: to a GitHub Actions secret, through gh
+          tokenValue = exportCredentialToken(session.credential, { purpose: "github-actions-secret" });
         }
       } catch {
         /* no active auth session */

package/src/commands/session.js

@@ -7,6 +7,7 @@ import { spawn as defaultSpawn } from "node:child_process";
 
 import pc from "picocolors";
 
+import { credentialFor, isAuthenticated } from "../auth/credential-destinations.js";
 import { SentinelayerApiError, requestJsonMutation } from "../auth/http.js";
 import {
   buildProvisionEmailPayload,
@@ -15,7 +16,6 @@ import {
   resolveAidenIdCredentials,
 } from "../ai/aidenid.js";
 import { recordProvisionedIdentity } from "../ai/identity-store.js";
-import { readStoredSession } from "../auth/session-store.js";
 import { fetchAidenIdCredentials } from "../auth/service.js";
 import { resolveActiveAuthSession } from "../auth/service.js";
 import { resolveOutputRoot } from "../config/service.js";
@@ -111,6 +111,11 @@ import {
   currentAdmittedAgent,
   withAgentAdmission,
 } from "../session/admission-auth.js";
+import {
+  SESSION_REACTION_TYPES,
+  isSessionReactionType,
+  submitSessionReaction,
+} from "../session/reactions.js";
 import {
   claimTicket,
   listTickets,
@@ -564,10 +569,16 @@ const SESSION_MESSAGE_ACTION_TYPES = new Set([
   "reply",
   "like",
   "dislike",
+  "unlike",
+  "undislike",
   "disregard",
   "view",
 ]);
 
+// like/dislike/unlike/undislike all go through src/session/reactions.js, the path the
+// local MCP server shares; `ack` keeps the plain message-action path.
+const SESSION_REACT_COMMAND_TYPES = Object.freeze(["ack", ...SESSION_REACTION_TYPES]);
+
 const SESSION_MESSAGE_ACTION_ALIASES = new Map([
   ["comment", "reply"],
 ]);
@@ -599,6 +610,16 @@ const SESSION_MESSAGE_ACTION_DESCRIPTIONS = Object.freeze([
     command: "sl session react <id> dislike --target-sequence <n>",
     description: "Negative lightweight feedback. Use --target-action-id <uuid> to react to a threaded reply.",
   },
+  {
+    type: "unlike",
+    command: "sl session react <id> unlike --target-sequence <n>",
+    description: "Retract your own active like. Refused when you have none; needs a server with reaction undo.",
+  },
+  {
+    type: "undislike",
+    command: "sl session react <id> undislike --target-sequence <n>",
+    description: "Retract your own active dislike. Refused when you have none; needs a server with reaction undo.",
+  },
   {
     type: "disregard",
     command: "sl session action <id> disregard --target-sequence <n>",
@@ -630,7 +651,7 @@ function shortSha256(value) {
 
 function actionEventType(actionType) {
   if (actionType === "reply") return "session_reply";
-  if (actionType === "like" || actionType === "dislike") return "session_reaction";
+  if (isSessionReactionType(actionType)) return "session_reaction";
   return "session_action";
 }
 
@@ -686,6 +707,7 @@ function buildSessionActionEvent(sessionId, action = {}) {
       }),
     );
   const actorId = actionActorId(action);
+  const collapsedIntoActionId = normalizeString(action.collapsedIntoActionId ?? action.collapsed_into_action_id);
   const event = createAgentEvent({
     event: actionEventType(actionType),
     agent: {
@@ -710,6 +732,8 @@ function buildSessionActionEvent(sessionId, action = {}) {
       metadata: action.metadata && typeof action.metadata === "object" ? action.metadata : undefined,
       message: actionDisplayMessage(action),
       source: "session_action",
+      // A retained no-op reaction key (sentinelayer-api#914): evidence, not a reaction.
+      ...(collapsedIntoActionId ? { collapsedIntoActionId } : {}),
     },
   });
   event.eventId = `session-action-${id}`;
@@ -1298,19 +1322,11 @@ async function resolveSessionRemoteSyncState({ dashboardUrl } = {}) {
     };
   }
 
-  let storedSession = null;
-  try {
-    storedSession = await readStoredSession();
-  } catch {
-    storedSession = null;
-  }
-  const apiUrl =
-    normalizeString(storedSession?.apiUrl) ||
-    normalizeString(process.env.SENTINELAYER_API_URL) ||
-    "https://api.sentinelayer.com";
-  const hasToken = Boolean(
-    normalizeString(storedSession?.token) || normalizeString(process.env.SENTINELAYER_TOKEN),
+  const auth = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
+    () => null,
   );
+  const apiUrl = normalizeString(auth?.apiUrl) || "https://api.sentinelayer.com";
+  const hasToken = isAuthenticated(auth);
   if (!hasToken) {
     return {
       status: "auth_required",
@@ -1434,12 +1450,12 @@ async function findReusableSessionCandidate({
 //   - When `SENTINELAYER_SKIP_REMOTE_SYNC=1` (test bootstrap), short-circuits
 //     to `{ ok: true, source: "skipped", session: null }` so unit tests
 //     can exercise the local materialization path without a real API.
-async function fetchRemoteSessionDetail(endpoint, headers) {
+async function fetchRemoteSessionDetail(endpoint, credential) {
   let response;
   let payload;
   try {
     ({ response, payload } = await fetchJsonWithFullTimeout(
-      endpoint, { method: "GET", headers, redirect: "error" }, 2_000,
+      endpoint, { method: "GET", credential, redirect: "error" }, 2_000,
     ));
   } catch (err) {
     return {
@@ -1492,7 +1508,7 @@ async function verifyRemoteSession(sessionId, { targetPath } = {}) {
   } catch {
     return { ok: false, reason: "no_session" };
   }
-  if (!auth || !auth.token) {
+  if (!isAuthenticated(auth)) {
     return { ok: false, reason: "not_authenticated", status: 401 };
   }
   const apiUrl = String(auth.apiUrl || "").replace(/\/+$/, "");
@@ -1500,10 +1516,10 @@ async function verifyRemoteSession(sessionId, { targetPath } = {}) {
     return { ok: false, reason: "no_api_url" };
   }
   const endpoint = `${apiUrl}/api/v1/sessions/${encodeURIComponent(normalizedSessionId)}`;
-  const headers = { Authorization: `Bearer ${auth.token}` };
-  const firstAttempt = await fetchRemoteSessionDetail(endpoint, headers);
+  const credential = await credentialFor(auth);
+  const firstAttempt = await fetchRemoteSessionDetail(endpoint, credential);
   const detail = firstAttempt.retryable
-    ? await fetchRemoteSessionDetail(endpoint, headers)
+    ? await fetchRemoteSessionDetail(endpoint, credential)
     : firstAttempt;
   if (detail.ok) {
     return {
@@ -2758,7 +2774,7 @@ async function resolveAdminApiSession({ targetPath, explicitApiUrl }) {
     explicitApiUrl,
     autoRotate: true,
   });
-  if (!session || !session.token) {
+  if (!isAuthenticated(session)) {
     throw new Error(`No active auth token found. Run \`${authLoginHint()}\` first.`);
   }
   return session;
@@ -2778,10 +2794,8 @@ async function postAdminSessionMutation({
   return requestJsonMutation(`${apiUrl}${pathSuffix}`, {
     method: "POST",
     operationName,
-    headers: {
-      Authorization: `Bearer ${normalizeString(session.token)}`,
-      ...headers,
-    },
+    credential: await credentialFor(session),
+    headers,
     body,
   });
 }
@@ -3282,7 +3296,7 @@ export function registerSessionCommand(program) {
         env: process.env,
         autoRotate: false,
       });
-      if (!session?.token || !session?.apiUrl) {
+      if (!isAuthenticated(session) || !session?.apiUrl) {
         throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
       }
       const apiUrl = String(session.apiUrl).replace(/\/+$/, "");
@@ -3291,7 +3305,7 @@ export function registerSessionCommand(program) {
         {
           method: "POST",
           operationName: "session.set_title",
-          headers: { Authorization: `Bearer ${session.token}` },
+          credential: session.credential,
           body: { title: normalizedTitle },
         },
       );
@@ -3332,7 +3346,7 @@ export function registerSessionCommand(program) {
         env: process.env,
         autoRotate: false,
       });
-      if (!session?.token || !session?.apiUrl) {
+      if (!isAuthenticated(session) || !session?.apiUrl) {
         throw new Error(`Not authenticated. Run \`${authLoginHint()}\` first.`);
       }
       const apiUrl = String(session.apiUrl).replace(/\/+$/, "");
@@ -3341,7 +3355,7 @@ export function registerSessionCommand(program) {
         {
           method: "POST",
           operationName: "session.sweep_empty",
-          headers: { Authorization: `Bearer ${session.token}` },
+          credential: session.credential,
           body: {
             cutoffMinutes,
             maxEvents,
@@ -4282,6 +4296,21 @@ export function registerSessionCommand(program) {
       );
     }
     const agentId = identity.agentId;
+    if (isSessionReactionType(normalizedActionType)) {
+      return runReactionCommand({
+        sessionId: normalizedSessionId,
+        reaction: normalizedActionType,
+        agentId,
+        targetPath,
+        targetSequenceId,
+        targetCursor,
+        targetActionId,
+        note,
+        options,
+        command,
+        commandName,
+      });
+    }
     const idempotencyKey =
       normalizeString(options.idempotencyKey) ||
       defaultActionIdempotencyKey({
@@ -4364,6 +4393,89 @@ export function registerSessionCommand(program) {
     return payload;
   }
 
+  // like/dislike/unlike/undislike: the shared reaction path (src/session/reactions.js)
+  // decides admission, the operation key and the outcome; this only mirrors and prints.
+  // `--idempotency-key` is a RETRY of the intent that minted that key.
+  async function runReactionCommand({
+    sessionId,
+    reaction,
+    agentId,
+    targetPath,
+    targetSequenceId,
+    targetCursor,
+    targetActionId,
+    note,
+    options,
+    command,
+    commandName,
+  }) {
+    const outcome = await submitSessionReaction({
+      surface: "cli",
+      sessionId,
+      agentId,
+      reaction,
+      targetSequenceId,
+      targetCursor,
+      targetActionId,
+      note,
+      idempotencyKey: options.idempotencyKey,
+      targetPath,
+    });
+    let event = null;
+    let localAppend = { appended: false, reason: "not_recorded" };
+    if (outcome.action) {
+      const appended = await appendActionEventIfMissing(
+        sessionId,
+        buildSessionActionEvent(sessionId, outcome.action),
+        { targetPath },
+      );
+      event = appended.event;
+      localAppend = { appended: Boolean(appended.appended), reason: appended.reason || "" };
+    }
+    let evidenceEvent = null;
+    if (outcome.collapsedActionId && outcome.action) {
+      // Mirror the server's retained no-op row: this request's key, collapsed into
+      // the active reaction it repeated.
+      const appended = await appendActionEventIfMissing(
+        sessionId,
+        buildSessionActionEvent(sessionId, {
+          id: outcome.collapsedActionId,
+          actionType: reaction,
+          targetSequenceId: outcome.action.targetSequenceId,
+          targetCursor: outcome.action.targetCursor,
+          targetActionId: outcome.action.targetActionId,
+          actorKind: outcome.action.actorKind,
+          actorId: outcome.action.actorId,
+          actorRole: outcome.action.actorRole,
+          idempotencyKey: outcome.operationKey,
+          collapsedIntoActionId: outcome.action.id,
+        }),
+        { targetPath },
+      );
+      evidenceEvent = appended.event;
+    }
+    const payload = {
+      command: commandName,
+      targetPath,
+      ...outcome,
+      event,
+      evidenceEvent,
+      localAppend,
+    };
+    if (!outcome.ok) process.exitCode = 1;
+    if (shouldEmitJson(options, command)) {
+      console.log(JSON.stringify(payload, null, 2));
+      return payload;
+    }
+    if (!outcome.ok) {
+      console.error(pc.yellow(outcome.message));
+      return payload;
+    }
+    if (event) console.log(formatEventLine(event));
+    if (outcome.outcome !== "applied" || !event) console.log(pc.gray(outcome.message));
+    return payload;
+  }
+
   session
     .command("actions")
     .description("List supported low-noise message actions with examples")
@@ -4390,7 +4502,7 @@ export function registerSessionCommand(program) {
   session
     .command("action <sessionId> <actionType>")
     .description(
-      "Create a message action for a target session event (ack, working_on, reply/comment, like, dislike, disregard, view)",
+      "Create a message action for a target session event (ack, working_on, reply/comment, like, dislike, unlike, undislike, disregard, view)",
     )
     .option("--target-sequence <n>", "Target event sequence id")
     .option("--target-cursor <cursor>", "Target event cursor")
@@ -4406,18 +4518,23 @@ export function registerSessionCommand(program) {
 
   session
     .command("react <sessionId> <reaction>")
-    .description("React to or acknowledge a target session event with ack, like, or dislike")
+    .description(
+      "React to or acknowledge a target session event with ack, like, or dislike; retract your own like/dislike with unlike/undislike",
+    )
     .option("--target-sequence <n>", "Target event sequence id")
     .option("--target-cursor <cursor>", "Target event cursor")
     .option("--target-action-id <uuid>", "Target a threaded reply/action by action UUID")
     .option("--agent <id>", "Agent id authoring the action (defaults to the joined session agent)")
-    .option("--idempotency-key <key>", "Explicit idempotency key")
+    .option(
+      "--idempotency-key <key>",
+      "Retry an earlier reaction as the SAME intent by resending its operationKey (without it, each call is a new intent)",
+    )
     .option("--path <path>", "Workspace path for the session", ".")
     .option("--json", "Emit machine-readable output")
     .action(async (sessionId, reaction, options, command) => {
       const normalizedReaction = normalizeSessionMessageActionType(reaction);
-      if (!["ack", "like", "dislike"].includes(normalizedReaction)) {
-        throw new Error("reaction must be one of: ack, like, dislike.");
+      if (!SESSION_REACT_COMMAND_TYPES.includes(normalizedReaction)) {
+        throw new Error(`reaction must be one of: ${SESSION_REACT_COMMAND_TYPES.join(", ")}.`);
       }
       await runMessageActionCommand({
         sessionId,
@@ -6273,7 +6390,7 @@ export function registerSessionCommand(program) {
           env: process.env,
           autoRotate: false,
         });
-        if (!authSession || !authSession.token) {
+        if (!isAuthenticated(authSession)) {
           throw new Error(`Remote session read requires authentication. Run \`${authLoginHint()}\` first.`);
         }
         hydration = await hydrateSessionFromRemote({
@@ -6547,13 +6664,13 @@ export function registerSessionCommand(program) {
           autoRotate: false,
         }).catch(() => null);
         const apiBaseUrl = session?.apiUrl || "";
-        const token = session?.token || "";
+        const credential = session?.credential || null;
         try {
           for await (const item of mergeLiveSources({
             sessionId: normalizedSessionId,
             targetPath,
             apiBaseUrl: apiBaseUrl || undefined,
-            token: token || undefined,
+            credential: credential || undefined,
             signal: ac.signal,
           })) {
             if (item.event) {
@@ -8476,21 +8593,19 @@ export function registerSessionCommand(program) {
         return;
       }
 
-      let storedSession = null;
-      try {
-        storedSession = await readStoredSession();
-      } catch {
-        storedSession = null;
-      }
+      const storedSession = await resolveActiveAuthSession({
+        cwd: process.cwd(),
+        env: process.env,
+        autoRotate: false,
+      }).catch(() => null);
 
-      const fetchCredentials =
-        storedSession && storedSession.token
-          ? () =>
-              fetchAidenIdCredentials({
-                apiUrl: storedSession.apiUrl,
-                token: storedSession.token,
-              })
-          : null;
+      const fetchCredentials = isAuthenticated(storedSession)
+        ? () =>
+            fetchAidenIdCredentials({
+              apiUrl: storedSession.apiUrl,
+              auth: storedSession,
+            })
+        : null;
       const credentials = await resolveAidenIdCredentials({
         apiKey: options.apiKey,
         orgId: options.orgId,

package/src/commands/spec.js

@@ -10,7 +10,7 @@ import {
   resolveProvider,
 } from "../ai/client.js";
 import { recordCliLlmSessionUsage, usageNumber } from "../billing/llm-session-usage.js";
-import { loadConfig } from "../config/service.js";
+import { loadConfig, userConfigValues } from "../config/service.js";
 import { evaluateBudget } from "../cost/budget.js";
 import { appendCostEntry, summarizeCostHistory } from "../cost/history.js";
 import { estimateModelCost } from "../cost/tracker.js";
@@ -265,7 +265,7 @@ async function maybeEnhanceSpecWithAi({
     configModel: config.resolved.defaultModelId,
   });
   const explicitApiKey = String(options.apiKey || "").trim();
-  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, config.resolved);
+  const configuredApiKey = resolveConfiguredApiKey(resolvedProvider, userConfigValues(config));
 
   const prompt = buildAiSpecPrompt({
     baseSpecMarkdown,

package/src/commands/watch.js

@@ -13,6 +13,7 @@ import {
 } from "../auth/service.js";
 import { resolveOutputRoot } from "../config/service.js";
 import { authLoginHint } from "../ui/command-hints.js";
+import { isAuthenticated } from "../auth/credential-destinations.js";
 
 const TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "cancelled"]);
 
@@ -369,7 +370,7 @@ export function registerWatchCommand(program) {
         throw new Error(formatApiError(error));
       }
 
-      if (!session || !session.token) {
+      if (!isAuthenticated(session)) {
         throw new Error(`No active auth token found. Run \`${authLoginHint()}\` first.`);
       }
 
@@ -395,7 +396,7 @@ export function registerWatchCommand(program) {
         while (true) {
           const response = await listRuntimeRunEvents({
             apiUrl: session.apiUrl,
-            authToken: session.token,
+            credential: session.credential,
             runId,
             afterEventId,
           });
@@ -428,7 +429,7 @@ export function registerWatchCommand(program) {
 
           const statusResponse = await getRuntimeRunStatus({
             apiUrl: session.apiUrl,
-            authToken: session.token,
+            credential: session.credential,
             runId,
           });
           latestStatus = String(statusResponse?.status || "unknown").trim().toLowerCase();