fix: update companion app URL from mcp.abs.xyz to cli.abs.xyz

The domain was changed; the old URL redirects with a 308 which the
CLI's fetch doesn't follow, causing a 403 on onboarding.

Bumps CLI to 0.1.2.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jarrodwatts

README.md

@@ -78,7 +78,7 @@ Instead, AGW CLI generates a local **device authorization key** and registers it
 │           │────────────────────────────────────▶┌──────────────┐
 │           │                                     │  Companion   │
 │           │  3. User connects AGW, approves      │  App         │
-│           │     signer + selects policy preset   │  mcp.abs.xyz │
+│           │     signer + selects policy preset   │  cli.abs.xyz │
 │           │                                     └──────┬───────┘
 │           │                                            │
 │           │  4. Signed callback token (EdDSA)          │
@@ -267,7 +267,7 @@ No. The Privy policy attached to your signer defines hard limits enforced server
 
 ### What is the companion app?
 
-The companion app ([mcp.abs.xyz](https://mcp.abs.xyz)) is a hosted web interface where you approve or revoke agent signers. It handles the Privy signer registration flow and sends a cryptographically signed callback token back to the CLI. You only need it during `auth init` and `auth revoke` — normal CLI usage does not require the browser.
+The companion app ([cli.abs.xyz](https://cli.abs.xyz)) is a hosted web interface where you approve or revoke agent signers. It handles the Privy signer registration flow and sends a cryptographically signed callback token back to the CLI. You only need it during `auth init` and `auth revoke` — normal CLI usage does not require the browser.
 
 ### Can I use AGW CLI without an AI agent?
 

packages/agw-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abstract-foundation/agw-cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Agent-first CLI for Abstract Global Wallet workflows",
   "license": "MIT",

packages/agw-core/src/auth/bootstrap-internals.ts

@@ -16,7 +16,7 @@ export interface BootstrapLockHandle {
 const AUTH_KEY_FILENAME = "privy-auth.key";
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 const BOOTSTRAP_LOCK_STALE_MS = 30 * 60 * 1000;
-const DEFAULT_ONBOARDING_APP_URL = "https://mcp.abs.xyz";
+const DEFAULT_ONBOARDING_APP_URL = "https://cli.abs.xyz";
 
 function ensurePrivateDir(dir: string): void {
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });

test/bootstrap.test.ts

@@ -270,7 +270,7 @@ describe("bootstrap callback/signer bundle flow", () => {
     }
   });
 
-  it("defaults to mcp.abs.xyz when onboarding app URL is not configured", async () => {
+  it("defaults to cli.abs.xyz when onboarding app URL is not configured", async () => {
     // #given
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "agw-cli-bootstrap-flow-"));
     const previous = process.env.AGW_APP_URL;
@@ -290,7 +290,7 @@ describe("bootstrap callback/signer bundle flow", () => {
 
       openMock.mockImplementation(async (url: string) => {
         const launchUrl = new URL(url);
-        expect(`${launchUrl.origin}${launchUrl.pathname}`).toBe("https://mcp.abs.xyz/session/new");
+        expect(`${launchUrl.origin}${launchUrl.pathname}`).toBe("https://cli.abs.xyz/session/new");
         const authPublicKey = launchUrl.searchParams.get("auth_pubkey")!;
         const callbackState = new URL(launchUrl.searchParams.get("callback_url")!).searchParams.get("state")!;
         const signerFingerprint = computePublicKeyFingerprint(authPublicKey);
@@ -334,7 +334,7 @@ describe("bootstrap callback/signer bundle flow", () => {
         runBootstrapFlow(createLogger(), {
           chainId: 11124,
           homeDir: tmpDir,
-          appUrl: "http://mcp.abs.xyz",
+          appUrl: "http://cli.abs.xyz",
         }),
       ).rejects.toThrow("Refusing insecure app URL over http for non-loopback host");
     } finally {