Files
An old
~/.papyrus/ is moved to ~/.nisa/ once, on first run.
Environment variables
Precedence
Credential:RAPIDREVIEW_KEY → api_key in credentials.json → OAuth token in credentials.json (auto-refreshed). Every request sends Authorization: Bearer <credential>. nisa doctor --json reports the winner as auth.source (RAPIDREVIEW_KEY · stored_api_key · oauth_credentials · none). One consequence: while a key wins, nisa keys … answers 403 API key management requires browser login.
API URL: --api-url (before the subcommand) → NISA_API_URL → config.json → default.
nisa doctor --json
ok, version, platform{os,arch,target}, install{current_exe,install_dir_on_path}, backend{api_url}, config{config_dir,config_dir_writable,credentials_file,credentials_file_exists}, auth{usable,source,rapidreview_key_set,stored_api_key_present,oauth_credentials_present,legacy_papyrus_api_key_set}, fixes[]. Never prints secrets.
Install and upgrade
macOS arm64/x86_64, Linux x86_64/arm64 (static musl); no Windows. The installer verifies a SHA-256 checksum, self-testsnisa --version, and prints a PATH hint if needed. Fallback URL if api.rapidreview.io/cli/* is unreachable: https://storage.googleapis.com/rr_cli_releases/install.sh. nisa upgrade re-runs the installer in place (--check exits 1 if newer exists). nisa logout deletes the local file only — revoke keys with nisa keys revoke <id>.