[Simon Liang (AgentWings)]

The CLI now uses the regenerated authentication runtime for credential storage, refresh, and provider revocation. Logout sends the stored public-client client_id, revokes refresh and access tokens, and removes local credentials even when the provider is unavailable. Browser callbacks retain a small guard rejecting repeated state, iss, code, or error parameters before token exchange.

Preserve the SSH shortcut and scoped diagnostics integrations, use spaced nested commands such as machines executions list, and run the full test suite against the installed package. Test artifacts retain the production API default; alternate endpoints must be supplied at runtime.

The public package still offers API-key sign-in only. Browser sign-in requires a configured OAuth provider and client registration.

Validation

• ESM and CJS TypeScript builds passed.
• Source tests: 54 passed, 0 failed, 0 skipped.
• Installed-package tests: 54 passed, 0 failed, 0 skipped.
• Five SSH picker terminal scenarios passed.
• Generated CI workflow matches its source.
• Callback fixtures cover issuer/state binding, duplicate parameters, PKCE, refresh, and revocation with client identification.
• Credential-boundary fixtures cover explicit credentials, saved credentials, API isolation, and corrupt stores.
• Source and packaged archive checked for non-production endpoint literals.

Repro / Showcase

N/A (no visual surface changed)