v0.2.0

Authentication diagnostics and credential safety.

A customer with a Google-only account was blocked for ~12 days on "cannot authenticate". Two things were wrong: the server never sent them back to the CLI after signing in, and every error the CLI showed them pointed somewhere useless. Both are fixed — the server side in modelslab-frontend-v2#2831, the CLI side here.

⚠️ Breaking

• Every command now exits with its documented code instead of always 1. Auth failure is 3, usage 2, rate limit 4, not found 5, payment 6. Scripts testing for -eq 1 need updating.
• A project-level .modelslab/config.toml no longer supplies base_url, api_key or token. Use --base-url or MODELSLAB_BASE_URL. Other preferences still merge.

🔒 Security

.modelslab/config.toml is read from the current working directory and was merged wholesale. A committed base_url in any repository you cloned and cd'd into redirected the next modelslab command — with your stored bearer token in the Authorization header — to that host. No prompt, no warning.

Fixed

• Failed logins printed the raw JSON error envelope instead of the message.
• The login hint said "check your email and password" to Google and GitHub accounts, which have no password at all. It now points at --browser.
• A 502 during a deploy was reported as invalid credentials, sending people to reset a password that was never the problem.
• auth login printed "✓ Logged in" even when the credential write failed, so every later command 401'd for no visible reason.
• The authorize URL was never shown when the browser failed to open — on a headless box you waited five minutes for a timeout and never saw the link you could have pasted.
• Piped and CI logins died with inappropriate ioctl for device, leaving --password on the command line as the only option.
• The MCP server's auth-login returned a token without applying it, so every later tool call in the process stayed unauthenticated.
• 429 now honours Retry-After and keeps the server's own message instead of a blanket "try again later".
• Prompts read a whole line — auth signup recorded "Ada" for "Ada Lovelace" — and reject empty input.

Install

npm install -g modelslab-cli
pip install modelslab-cli
curl -fsSL https://modelslab.sh/install.sh | bash

Homebrew and Scoop are still on v0.1.4 while their publishing tokens are rotated.

v0.1.4

Changelog

• eeb6305 fix(release): publish with relative paths, and stop skipping the wheel build (#6)

v0.1.3

Changelog

• 13c6679 fix(npm): scope the platform packages to sidestep npm spam detection (#5)
• 57d77eb fix(release): make registry publishing re-runnable and independent (#4)

v0.1.2

Changelog

• bd44984 feat(packaging): publish the CLI to npm and PyPI (#2)
• 6cb4915 fix(release): grant id-token write for npm provenance (#3)

v0.1.1

Changelog

• 93bb05e Add browser OAuth login and CLI updater
• ea81114 Add signup and auth lifecycle docs to README
• a7506ca Update README.md
• 0671b35 Use modelslab.sh for install script URL in README

v0.1.0

Changelog

• a23e03f Fix integration tests to auto-build binary and use portable paths
• 40a87b9 Fix module path to match repo name and add Homebrew tap
• 10a5dd6 Initial commit
• bf9f2f2 Update homepage URLs to modelslab.sh
• 3a1fa06 fix CI
• e663a61 inital commit
• ee435b9 more commands