fix: accept api_token as an alias for token in sf login

[sigmachirality]

Summary

• Accept either token or api_token in the getSession polling response so the CLI is forward- and backward-compatible across the cutover.

Motivation

Field rename — the polling response uses api_token on console where the old site used token. The newer rust CLI already tolerates both; this PR brings the standalone sf cli in line so it keeps working both before and after the DNS flip to sfcompute.com -> console.sfcompute.com.

Testing

• bun run check — clean.
• bunx biome ci . — clean (only pre-existing warnings).
• bun run test — 9 / 9 pass.
• Manual sf login end-to-end against console pending from a human; @Gii2000 already verified the JWT flow on both sites.

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
src/lib/login.ts	17% smaller

[indent]

PR Summary

Makes the sf login polling code forward-compatible with a potential server-side rename of the auth-token field, without changing any URLs or defaults. Scope was reduced from the original PR (which also flipped webapp_url to console.sfcompute.com and prefixed the session paths with /api) to just this single defensive change.

• getSession in src/lib/login.ts now reads data.token ?? data.api_token so the CLI keeps working if the field is renamed to api_token server-side.

Issues

All clear! No issues remaining. 🎉

1 issue already resolved

• Upgraded users with a persisted webapp_url will break on sf login: loadConfig lets the on-disk value shadow the new default, and several call sites (src/index.ts:56, src/lib/images/utils.ts, src/lib/posthog.ts, clearAuthFromConfig) already persist the merged config containing the old https://sfcompute.com, so the CLI will POST to https://sfcompute.com/api/cli/session (old host, new path) and fail unless the marketing domain proxies it. (fixed by commit dfdc781)

CI Checks

All CI checks passed on 7f48f08.

[capy-ai]

Capy auto-review is paused for this organization because the monthly auto-review limit has been reached. Increase the limit or turn it off in billing settings to resume automatic reviews.

[Gii2000]

Just spitballing an alternative, but we can make the Console just reply with token instead of api_token to match the old website. I have no idea why we renamed it in the first place

[Gii2000]

Looks good!

[sigmachirality]

Just spitballing an alternative, but we can make the Console just reply with token instead of api_token to match the old website. I have no idea why we renamed it in the first place

I'd like to ship this as well to get defense in depth