release(2.0.36): OTP login + UI hardening

Bumps version across package.json, rust/Cargo.toml, ink-tui/package.json,
ink-tui banner test, docs/version.js, vscode-extension/package.json, and
the Cargo.lock. CHANGELOG documents the new \`openanalyst account login\`
flow, the web console Account tab, the manual-vs-OAuth chooser, the new
/me/auth/* endpoints, the stop button fix, env-key filter, path
cleaning, heartbeat + offline cache, and the lazy SSE work.

Author: 10x-Anit

CHANGELOG.md

@@ -4,6 +4,87 @@ All notable changes to OpenAnalyst CLI are documented here. The
 format loosely follows [Keep a Changelog](https://keepachangelog.com)
 and the project uses semver.
 
+## 2.0.36
+
+OTP sign-in lands as a first-class credential mode. A fresh
+`npm install -g @openanalystinc/openanalyst-cli` user can now sign in
+to their openanalyst.com account using just an email and a 6-digit
+code — no browser, no API key juggling — and immediately call the full
+OpenAnalyst-routed model catalog (Beta, Max, GPT, Claude, Gemini)
+against their account's credits and plan.
+
+The web console gains a Settings → Account tab that drives the same
+flow in the browser, plus a manual-vs-OAuth chooser when both
+credentials are present so users explicitly pick which one inference
+uses. The CLI's hard-stop, env-key filtering, path cleaning,
+heartbeat + offline cache, and lazy SSE work from the previous
+sprint also ship here.
+
+### Added
+- `openanalyst account login [--email <addr>]` — interactive email/OTP
+  flow. Stores the issued OpenAnalyst access token under the
+  `OPENANALYST_AUTH_TOKEN` slot in `~/.openanalyst/credentials.json`
+  with `auth_method="oauth"`. Picked up automatically by subsequent
+  CLI invocations.
+- `openanalyst account logout` — wipes the stored OAuth credential.
+- `openanalyst account status` — prints plan name + credits remaining
+  by calling `api.openanalyst.com/api/v1/credits/balance` with the
+  stored bearer.
+- Web console **Settings → Account** tab (default tab on open) —
+  email/OTP sign-in, signed-in summary (email/plan/credits), 60s
+  auto-refresh of balance, refresh & logout buttons.
+- Web console **Settings → Account** radio chooser when both an
+  OAuth login AND a manual `sk-oa-v1-*` key are configured. The
+  selection persists server-side so inference always uses the chosen
+  credential.
+- `POST /me/auth/otp/start`, `POST /me/auth/otp/verify`,
+  `GET /me/auth/status`, `POST /me/auth/logout`,
+  `PUT /me/providers/openanalyst/preferred-source` — server-side
+  endpoints proxying onto `ai.10x.in/v2/auth/passwordless/*` and
+  `api.openanalyst.com/api/v1/credits/balance`. The web UI never
+  talks to either upstream host directly.
+- Web UI stop button now interrupts an in-flight LLM stream
+  immediately via tokio `JoinHandle::abort()` (previously it only
+  flipped a flag the next tool call would notice).
+- Web UI **TopBar connection pill** — polls `/health` every 3/5/10s
+  with backoff, shows green/amber/red status, click-to-retry on
+  disconnect, tooltip with latency + last-OK time.
+- Web UI **offline session cache** — 200 messages × 50 sessions in
+  `localStorage` (LRU eviction). History stays visible when the CLI
+  is offline; reconnect repaints from the server when it comes back.
+- New providers in Settings: **Stability AI**, **Google Imagen (via
+  Gemini)**, **OpenAI Images** for image generation;
+  **Brave Search**, **Tavily**, **Serper**, **Exa** for web search.
+
+### Fixed
+- Env-discovered API keys no longer pollute the model picker. If
+  `--serve` was launched from a shell where `ANTHROPIC_API_KEY` was
+  set, those models used to surface in the web UI even though the
+  user hadn't explicitly added the provider. They're now tagged
+  `source="env"` and hidden from the picker.
+- Windows extended-length path prefix (`\\?\`) stripped from the
+  workspace banner in the web UI for clean display.
+- Web UI permission-mode chip no longer inserts a slash-command
+  message into the chat; mode change happens silently via a dedicated
+  endpoint.
+- Turn status line ("thinking…") now stops as soon as the turn
+  completes; 30s stall safety net auto-hides it if upstream goes
+  quiet without a terminal event.
+- Single-active SSE: switching sessions in the sidebar now closes
+  the previous stream instead of keeping 50+ subscriptions open.
+
+### Internal
+- New `rust/crates/server/src/auth_otp.rs` module — full
+  HTTP-upstream client + handlers for the OTP flow. Auto-refreshes
+  the access token when it's within 60s of expiry by hitting
+  `POST /v2/auth/refresh` with the stored `_10x_admin_refresh` cookie.
+- `provider_credentials` rows can now distinguish OAuth-issued
+  tokens (`auth_method="oauth"`, stored in `auth_token` slot, sent
+  as `Authorization: Bearer`) from manual API keys
+  (`auth_method="api_key"`, stored in `api_key` slot, sent as
+  `x-api-key`). Settings JSON carries `refresh_cookie`,
+  `expires_at_ms`, `email`, and `preferred_source`.
+
 ## 2.0.35
 
 Windows ARM64 lands as a first-class target. `cargo` cross-compiles

docs/version.js

@@ -11,7 +11,7 @@
  */
 (function () {
   var REPO = 'OpenAnalystInc/cli';
-  var DEFAULT_VERSION = 'v2.0.35';
+  var DEFAULT_VERSION = 'v2.0.36';
   var CACHE_KEY = 'oa_cli_version';
   var CACHE_TTL = 300000;
   var ICON_URL = 'https://openanalyst.com/images/new-logo.png';

ink-tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openanalyst/ink-tui",
-  "version": "2.0.35",
+  "version": "2.0.36",
   "description": "OpenAnalyst CLI terminal UI - React + Ink",
   "license": "Apache-2.0",
   "type": "module",

ink-tui/src/components/banner.test.tsx

@@ -16,7 +16,7 @@ function BannerScene(): React.ReactElement {
 
   return (
     <Banner
-      version="2.0.35"
+      version="2.0.36"
       username="Anit"
       workingDir="D:\\Openanalyst CLI"
       provider="anthropic"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openanalystinc/openanalyst-cli",
-  "version": "2.0.35",
+  "version": "2.0.36",
   "description": "OpenAnalyst CLI - The Universal AI Agent for Your Terminal. 8 providers (OpenAnalyst, Anthropic Claude, OpenAI GPT, Google Gemini, xAI Grok, OpenRouter, Amazon Bedrock, Stability AI), 65+ slash commands, 22 built-in tools, smart model routing, multi-agent orchestration, hosted session APIs, and a full interactive TUI.",
   "bin": {
     "openanalyst": "bin/cli.js",

rust/Cargo.lock

@@ -4,7 +4,7 @@ exclude = ["crates/tui-widgets"]  # Archived - ratatui widget library replaced b
 resolver = "2"
 
 [workspace.package]
-version = "2.0.35"
+version = "2.0.36"
 edition = "2021"
 license = "Apache-2.0"
 publish = false

rust/Cargo.toml

@@ -2,7 +2,7 @@
   "name": "openanalyst-cli-vscode",
   "displayName": "OpenAnalyst CLI",
   "description": "Enable OpenAnalyst CLI with direct access to your IDE workspace.",
-  "version": "2.0.35",
+  "version": "2.0.36",
   "publisher": "openanalystinc",
   "icon": "assets/icon.png",
   "repository": {