@amdahl/cli 0.3.0 → 0.3.1

package/README.md

@@ -60,36 +60,48 @@ The quickest way to start is `npx amdahl` with nothing after it, in a
 terminal. It walks you through setup:
 
 ```
-Amdahl, predictive ML for GTM
-Found on this machine: Claude Code ✓  Cursor ✓  Codex –
-Set up Amdahl in:
+$ npx amdahl
+Amdahl · predictive ML for GTM
+Set up in:
 > [x] Claude Code
-  [x] Cursor
+  [ ] Cursor
   [ ] Codex
 (Use the arrow keys, Space to tick or untick, then Enter)
+Opening your browser…
+✓ Signed in · Acme
+✓ Added to Claude Code
+Try it: in Claude Code, run /mcp once to connect, then say "make this email sound less like AI"
 ```
 
 It finds Claude Code, Cursor and Codex by their command on your PATH
 (`claude`, `cursor`, `codex`) or their folder in your home folder (`.claude`,
 `.cursor`, `.codex`), and ticks the ones it finds. Enter accepts. If you are
-not signed in, it signs you in through the browser first; otherwise it prints
-`Signed in as <email> (workspace: <name>)`. If the server rejects a key set in
+not signed in, it signs you in through the browser first. It prints the
+sign-in link only if the browser could not be opened, or nothing came back
+within 5 seconds, and it waits up to 15 minutes, so someone new can create
+their workspace on the way and land back in the same setup. If the server
+rejects a key set in
 `AMDAHL_KEY` (or `AMDAHL_API_KEY`, `AMDAHL_ACCESS_TOKEN`, `--api-key`), it says
 so and skips the browser sign-in, since that key would still win. Then it
-runs `amdahl install` for each client you ticked. A client that fails prints
+sets up each client you ticked the way `amdahl install` does, one line each.
+A client that fails prints
 its error and the rest still run; the exit code is the first failure's. It
-ends with something to try, such as
-`Try it: open Claude Code and say "make this email sound less like AI"`
-(for Codex, it first says to run `codex mcp login amdahl`).
+ends with something to try in the first client it set up. Each client then
+signs in to Amdahl itself, once, the first time it connects: `/mcp` in
+Claude Code, `codex mcp login amdahl` for Codex (always named, since the CLI
+cannot tell whether it ran), and Cursor asks on first use.
+`npx amdahl --verbose` also prints the files it wrote, the profile and where
+the sign-in is stored.
 Run it again once you are set up and it says `You're set up in Claude Code
-and Cursor.` with the same line to try, and asks nothing; if it cannot reach
+and Cursor.` with a line to try, and asks nothing; if it cannot reach
 Amdahl to check your sign-in, it still says so. Ctrl+C at the question stops
 it with nothing written (exit 130).
 
 It only does this for a person at a terminal. When stdin, stdout or stderr
 (where the menu draws) is not a terminal, `CI` is set, an agent runs it (`CLAUDECODE` or `CURSOR_AGENT` is
-set), `AMDAHL_NO_PROMPT=1` is set, or any flag is given (such as `--json`),
-bare `amdahl` prints the usage to stderr and exits 2, as before.
+set), `AMDAHL_NO_PROMPT=1` is set, or any flag other than `--verbose` is given
+(such as `--json`), bare `amdahl` prints the usage to stderr and exits 2, as
+before.
 
 To connect one AI client yourself, run `amdahl install claude-code` (or `codex`,
 `cursor`). It adds the Amdahl MCP server and also installs the Amdahl skill,
@@ -124,8 +136,14 @@ amdahl install claude-code   # connect an AI client and add the Amdahl skill (al
 amdahl skills add <publisher>/<skill>   # add a skill from amdahl.ai/skills to this project
 ```
 
-No workspace yet? `amdahl login` prints the console link where you can
-create one or join the beta. The CLI never creates or joins a workspace.
+No workspace yet? With a work email, the sign-in page offers to create your
+company's workspace and then finishes signing you in. If you signed in with
+an address Amdahl can't use, the browser tab and the terminal say what to do
+and link a new sign-in ("Sign in with your work email", "Sign in again" for
+a subdomain address, "Try again" once you've confirmed your email), and the
+terminal keeps waiting for it. Anything
+else exits 5 with the one next step (ask your company's admins, try again
+tomorrow, and so on). The CLI itself never creates or joins a workspace.
 
 On a server or in CI, skip `login` and set an API key in `AMDAHL_KEY`.
 
@@ -325,7 +343,8 @@ the default profile). `whoami` names the source that won. `keys create`,
   tokens.
 - Tokens: the OS keychain (service `amdahl-cli`; macOS `security`, Linux
   `secret-tool`), passed on stdin, never on argv. Without a keychain:
-  `credentials.json` (mode 0600) with a one-time warning.
+  `credentials.json` (mode 0600), named under `--verbose`. If that file is
+  ever readable by other users, the CLI makes it owner-only and warns.
   `AMDAHL_CREDENTIAL_STORE=keychain|file` forces either.
 
 ## Keys

package/dist/amdahl.js

@@ -7567,7 +7567,7 @@ function realIo() {
     run: runProcess,
     openUrl: async (url) => {
       const [cmd, args] = openerFor(process.platform, url);
-      await runProcess(cmd, args);
+      return (await runProcess(cmd, args)).code === 0;
     },
     homedir: homedir(),
     cwd: process.cwd(),
@@ -7575,7 +7575,8 @@ function realIo() {
     hostname: hostname(),
     now: () => Date.now(),
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-    loginTimeoutMs: 3e5,
+    loginTimeoutMs: 9e5,
+    browserGraceMs: 5e3,
     fetchTimeoutMs: 15e3
   };
 }
@@ -7654,7 +7655,8 @@ var GLOBAL_OPTIONS = {
   json: { type: "boolean" },
   "no-color": { type: "boolean" },
   help: { type: "boolean", short: "h" },
-  version: { type: "boolean", short: "v" }
+  version: { type: "boolean", short: "v" },
+  verbose: { type: "boolean" }
 };
 var COMMAND_OPTIONS = {
   login: {
@@ -7753,6 +7755,7 @@ var USAGE = `Usage: amdahl <command> [options]
 What you can do:
   amdahl                         Set up Claude Code, Cursor or Codex, in a terminal: it asks
                                  which, signs you in, and runs install for each one
+                                 (--verbose shows the files and profile it used)
   amdahl optimize draft.md       Rewrite an outbound email or LinkedIn message
   amdahl status                  Check that this workspace is set up to optimize
   amdahl keys create --name ci   Make an API key for a server or CI
@@ -7793,6 +7796,7 @@ Global options:
   --api-key <key>    Use an API key for this command (prefer AMDAHL_KEY: argv is visible to other users)
   --json             Data on stdout as JSON, messages on stderr
   --no-color         No colour (NO_COLOR is honoured too)
+  --verbose          Say more: files written, the profile, where the sign-in is stored
   -h, --help         Show this help
   -v, --version      Show the version
 `;
@@ -8087,6 +8091,46 @@ function authorizeUrl(endpoints, input) {
   const query = params.map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join("&");
   return `${endpoints.authorization_endpoint}?${query}`;
 }
+var SIGN_IN_AGAIN = {
+  not_work_email: { why: "Amdahl needs your work email.", label: "Sign in with your work email" },
+  subdomain_email: { why: "Use your main company email.", label: "Sign in again" },
+  email_unconfirmed: { why: "Check your inbox to confirm your email, then try again.", label: "Try again" }
+};
+function signInAgainLine(reason, url) {
+  const again = SIGN_IN_AGAIN[reason];
+  return again ? `${again.why} ${again.label}:
+
+  ${url}
+` : "";
+}
+function noBusinessMessage(consoleUrl, mayCreate, reason) {
+  switch (reason) {
+    case void 0:
+      return mayCreate ? `You're signed in, but you don't have a workspace yet. Create one at ${consoleUrl}/new, then run \`amdahl login\` again.` : `You're signed in, but you don't have access yet. Amdahl is in beta: join the waitlist at ${consoleUrl}/new, then run \`amdahl login\` again once you're in.`;
+    case "domain_has_workspace":
+      return `Your company already has an Amdahl workspace. Ask its admins to let you in at ${consoleUrl}, then try again.`;
+    case "invite_only":
+      return "Your company's Amdahl workspace is invite-only. Ask a colleague in it to invite you, then try again.";
+    case "not_work_email":
+    case "subdomain_email":
+    case "email_unconfirmed": {
+      const again = SIGN_IN_AGAIN[reason];
+      return `${again.why} Run this again, then choose "${again.label}" in the browser.`;
+    }
+    case "daily_cap":
+      return "Amdahl isn't taking more new workspaces today. Try again tomorrow.";
+    case "paused":
+      return "New workspaces are paused for now. Try again later.";
+    case "domain_used":
+      return "Your company already used its free workspace. Email hello@amdahl.ai to get access.";
+    default:
+      return "Amdahl couldn't create your workspace just now. Try again in a few minutes.";
+  }
+}
+function signInAgainUrl(authorize) {
+  const url = new URL(authorize);
+  return `${url.origin}/login?redirect=${encodeURIComponent(`${url.pathname}${url.search}`)}`;
+}
 function html(text) {
   return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
 }
@@ -8094,6 +8138,8 @@ function page(body) {
   return `<!doctype html><html><head><meta charset="utf-8"><title>Amdahl CLI</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;line-height:1.5">${body}</body></html>`;
 }
 async function startLoopback(io, input) {
+  let authorize = null;
+  let refused = null;
   let settle;
   let fail;
   const result = new Promise((resolve, reject) => {
@@ -8120,9 +8166,18 @@ async function startLoopback(io, input) {
     const error = url.searchParams.get("error");
     const code = url.searchParams.get("code");
     if (error === "no_business") {
-      const newUrl = `${input.consoleUrl}/new`;
-      send2(200, `<p>You're signed in, but you don't have a workspace yet.</p><p><a href="${html(newUrl)}">Go to ${html(newUrl)}</a>, then run <code>amdahl login</code> again.</p>`);
-      settle({ kind: "no_business", mayCreate: url.searchParams.get("may_create") === "true" });
+      const mayCreate = url.searchParams.get("may_create") === "true";
+      const reason = url.searchParams.get("reason") ?? void 0;
+      const again = reason ? SIGN_IN_AGAIN[reason] : void 0;
+      if (again && authorize) {
+        refused = reason;
+        const retry = signInAgainUrl(authorize);
+        send2(200, `<p>${html(again.why)}</p><p><a href="${html(retry)}">${html(again.label)} \u2192</a></p>`);
+        input.onSignInAgain?.(reason, retry);
+        return;
+      }
+      send2(200, `<p>${html(noBusinessMessage(input.consoleUrl, mayCreate, reason))}</p>`);
+      settle({ kind: "no_business", mayCreate, reason });
     } else if (error) {
       send2(400, `<p>Sign-in failed: ${html(url.searchParams.get("error_description") ?? error)}</p>`);
       settle({ kind: "error", error, description: url.searchParams.get("error_description") ?? void 0 });
@@ -8150,12 +8205,17 @@ async function startLoopback(io, input) {
   });
   const port = server.address().port;
   const timer = setTimeout(() => {
-    fail(new CliError("login_timeout", "Timed out waiting for the browser sign-in.", EXIT.general, "Run `amdahl login` again."));
+    fail(
+      refused ? new CliError("no_business", noBusinessMessage(input.consoleUrl, false, refused), EXIT.noWorkspace) : new CliError("login_timeout", "Timed out waiting for the browser sign-in.", EXIT.general, "Run `amdahl login` again.")
+    );
   }, input.timeoutMs);
   timer.unref?.();
   return {
     redirectUri: `http://127.0.0.1:${port}/callback`,
     result,
+    setAuthorizeUrl: (url) => {
+      authorize = url;
+    },
     close: () => {
       clearTimeout(timer);
       server.closeAllConnections?.();
@@ -8173,7 +8233,7 @@ function consoleUrlFor(io, apiUrl) {
 }
 
 // src/secrets.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, rmSync } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync2, readFileSync as readFileSync2, rmSync, statSync } from "fs";
 import { join as join2 } from "path";
 var KEYCHAIN_SERVICE = "amdahl-cli";
 function keychainAccount(apiUrl, profile) {
@@ -8260,10 +8320,28 @@ function readCredentials(path) {
     return { version: 1, accounts: {} };
   }
 }
-function fileStore(io, warn) {
+function fileStore(io, note) {
   const path = credentialsPath(io);
+  let checked = false;
+  const checkMode = () => {
+    if (checked || io.platform === "win32" || !existsSync2(path)) return;
+    checked = true;
+    if ((statSync(path).mode & 63) === 0) return;
+    try {
+      chmodSync2(path, 384);
+    } catch {
+      io.stderr(`Warning: ${path} can be read by other users on this machine, and this CLI cannot change that. Run \`chmod 600 ${path}\` as its owner.
+`);
+      return;
+    }
+    io.stderr(
+      `Warning: ${path} was readable by other users on this machine. It is private now; to be safe, run \`amdahl logout\` and sign in again.
+`
+    );
+  };
   return {
     async get(account) {
+      checkMode();
       return asSecrets(readCredentials(path).accounts[account]);
     },
     async set(account, secrets) {
@@ -8271,11 +8349,9 @@ function fileStore(io, warn) {
       const file = readCredentials(path);
       file.accounts[account] = secrets;
       writePrivateJson(path, file);
-      if (!existed && warn) {
-        io.stderr(
-          `Warning: no OS keychain is available, so your sign-in is stored in ${path} (readable only by you).
-`
-        );
+      if (!existed && note) {
+        io.stderr(`No OS keychain here, so your sign-in is stored in ${path} (readable only by you).
+`);
       }
     },
     async delete(account) {
@@ -8287,7 +8363,7 @@ function fileStore(io, warn) {
     }
   };
 }
-function createSecretStore(io) {
+function createSecretStore(io, options = {}) {
   const forced = io.env.AMDAHL_CREDENTIAL_STORE;
   if (forced && forced !== "keychain" && forced !== "file") {
     throw new CliError(
@@ -8314,7 +8390,7 @@ function createSecretStore(io) {
       }
     };
   }
-  const file = fileStore(io, true);
+  const file = fileStore(io, options.verbose === true);
   if (!keychain) return file;
   return {
     async get(account) {
@@ -8366,7 +8442,7 @@ function createCtx(io, out, flags) {
     profile,
     apiUrl: normaliseApiUrl(rawApi),
     nonInteractive: !io.stdinIsTTY || io.env.AMDAHL_NO_PROMPT === "1",
-    secrets: () => store ??= createSecretStore(io),
+    secrets: () => store ??= createSecretStore(io, { verbose: flags.verbose === true }),
     saveConfig: () => saveConfig(io, config)
   };
 }
@@ -8464,15 +8540,45 @@ async function call(fn) {
   }
 }
 
+// src/output.ts
+var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/g;
+function printable(text) {
+  return text.replace(CONTROL_RE, "");
+}
+function createOutput(io, json, noColor) {
+  const color = !noColor && !io.env.NO_COLOR && io.env.TERM !== "dumb" && io.stderrIsTTY && !json;
+  return {
+    json,
+    color,
+    result(data, human) {
+      if (json) {
+        io.stdout(`${JSON.stringify(data)}
+`);
+      } else if (human !== void 0) {
+        io.stdout(human.endsWith("\n") ? human : `${human}
+`);
+      }
+    },
+    info(text) {
+      io.stderr(text.endsWith("\n") ? text : `${text}
+`);
+    },
+    event(data) {
+      if (json) io.stderr(`${JSON.stringify(data)}
+`);
+    },
+    bold(text) {
+      return color ? `\x1B[1m${text}\x1B[22m` : text;
+    }
+  };
+}
+
 // src/commands/auth.ts
 var PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-function noBusinessMessage(consoleUrl, mayCreate) {
-  return mayCreate ? `You're signed in, but you don't have a workspace yet. Create one at ${consoleUrl}/new, then run \`amdahl login\` again.` : `You're signed in, but you don't have access yet. Amdahl is in beta: join the waitlist at ${consoleUrl}/new, then run \`amdahl login\` again once you're in.`;
-}
 function tokenPreview(token) {
   return `${token.slice(0, 10)}...`;
 }
-async function login(ctx) {
+async function browserSignIn(ctx) {
   const { io, out, flags } = ctx;
   const workspace = str(flags.workspace);
   const rawPort = str(flags.port);
@@ -8487,35 +8593,52 @@ async function login(ctx) {
   const endpoints = await discover(ctx.apiUrl);
   const pkce = createPkce();
   const consoleUrl = consoleUrlFor(io, ctx.apiUrl);
+  let timer;
+  let linkShown = false;
   const loopback = await startLoopback(io, {
     port,
     state: pkce.state,
     consoleUrl,
-    timeoutMs: io.loginTimeoutMs
+    timeoutMs: io.loginTimeoutMs,
+    // The page carries the way on; the authorize link would only sign in as the same address again.
+    onSignInAgain: (reason, retry) => {
+      clearTimeout(timer);
+      linkShown = true;
+      out.info(signInAgainLine(reason, retry));
+    }
   });
   try {
     const url = authorizeUrl(endpoints, { redirectUri: loopback.redirectUri, pkce, workspace });
+    loopback.setAuthorizeUrl(url);
     out.event({ event: "open_url", url });
-    if (flags["no-browser"]) {
-      out.info(`Open this URL in a browser to sign in:
+    const showLink = (lead) => {
+      if (linkShown) return;
+      linkShown = true;
+      out.info(`${lead}
 
   ${url}
 `);
+    };
+    if (flags["no-browser"]) {
+      showLink("Open this URL in a browser to sign in:");
     } else {
-      out.info(`Opening your browser to sign in. If it does not open, visit:
-
-  ${url}
-`);
-      void io.openUrl(url);
+      out.info("Opening your browser\u2026");
+      void io.openUrl(url).then((opened) => {
+        if (!opened) showLink("Your browser did not open. Open this link to sign in:");
+      });
+      timer = setTimeout(() => showLink("Finish in your browser, or open this link:"), io.browserGraceMs);
+      timer.unref?.();
     }
     const callback = await loopback.result;
+    clearTimeout(timer);
+    linkShown = true;
     if (callback.kind === "no_business") {
-      throw new CliError("no_business", noBusinessMessage(consoleUrl, callback.mayCreate), EXIT.noWorkspace);
+      throw new CliError("no_business", noBusinessMessage(consoleUrl, callback.mayCreate, callback.reason), EXIT.noWorkspace);
     }
     if (callback.kind === "error") {
       throw new CliError(
         callback.error,
-        `Sign-in failed: ${callback.description ?? callback.error}`,
+        `Sign-in failed: ${printable(callback.description ?? callback.error)}`,
         callback.error === "access_denied" ? EXIT.forbidden : EXIT.general
       );
     }
@@ -8539,22 +8662,31 @@ async function login(ctx) {
     };
     ctx.config.default_profile = name;
     ctx.saveConfig();
-    out.result(
-      {
-        ok: true,
-        profile: name,
-        user: { id: me.user_id, email: me.email ?? null },
-        workspace: ws,
-        scopes: me.scopes,
-        api_url: ctx.apiUrl
-      },
-      `Signed in as ${me.email ?? me.user_id} to ${out.bold(ws.name)} (${ws.slug}). Profile: ${name}.`
-    );
-    return EXIT.ok;
+    return { profile: name, me, workspace: ws };
   } finally {
+    clearTimeout(timer);
     loopback.close();
   }
 }
+function signedInLine(ctx, { profile, me, workspace }) {
+  return `Signed in as ${printable(me.email ?? me.user_id)} to ${ctx.out.bold(printable(workspace.name))} (${printable(workspace.slug)}). Profile: ${profile}.`;
+}
+async function login(ctx) {
+  const signedIn = await browserSignIn(ctx);
+  const { profile, me, workspace } = signedIn;
+  ctx.out.result(
+    {
+      ok: true,
+      profile,
+      user: { id: me.user_id, email: me.email ?? null },
+      workspace,
+      scopes: me.scopes,
+      api_url: ctx.apiUrl
+    },
+    signedInLine(ctx, signedIn)
+  );
+  return EXIT.ok;
+}
 async function logout(ctx) {
   const { config, out } = ctx;
   const names = ctx.flags.all ? Object.keys(config.profiles) : ctx.profileName && config.profiles[ctx.profileName] ? [ctx.profileName] : [];
@@ -8736,14 +8868,16 @@ async function isInstalled(ctx, client) {
     return false;
   }
 }
+async function installClient(ctx, client, print) {
+  const mcp = await installMcp(ctx, client, print);
+  return { mcp, skill: installSkill(ctx, client, print) };
+}
 async function install(ctx, args) {
   const client = args[0];
   if (!client || args.length > 1 || !CLIENTS.includes(client)) {
     throw usageError(`Usage: amdahl install ${CLIENTS.join("|")} [--print] [--force]`);
   }
-  const print = ctx.flags.print === true;
-  const mcp = await installMcp(ctx, client, print);
-  const skill = installSkill(ctx, client, print);
+  const { mcp, skill } = await installClient(ctx, client, ctx.flags.print === true);
   const human = [mcp.human.replace(/\n$/, ""), skill.human].filter(Boolean).join("\n");
   ctx.out.result({ ...mcp.data, skill: skill.data }, human);
   for (const note of [...mcp.notes, ...skill.notes]) ctx.out.info(note);
@@ -9120,7 +9254,7 @@ import { dirname as dirname3, join as join6, relative, sep } from "path";
 
 // src/commands/skills-install.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync2, lstatSync, mkdirSync as mkdirSync3, mkdtempSync, readdirSync, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync as chmodSync3, lstatSync, mkdirSync as mkdirSync3, mkdtempSync, readdirSync, readFileSync as readFileSync5, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname2, join as join5 } from "path";
 function skillDirs(targets, name) {
   const dirs = [];
@@ -9237,7 +9371,7 @@ function stage(target, name, archive, staged) {
   s.createdParent = mkdirSync3(dirname2(target), { recursive: true }) ?? void 0;
   refuseLinks(target);
   s.temp = mkdtempSync(join5(dirname2(target), `.${name}.amdahl-tmp-`));
-  chmodSync2(s.temp, 493);
+  chmodSync3(s.temp, 493);
   for (const dir of archive.dirs) mkdirSync3(join5(s.temp, dir));
   for (const file of archive.files) writeFileSync3(join5(s.temp, file.path), file.bytes, { flag: "wx", mode: file.mode });
 }
@@ -9398,9 +9532,11 @@ var SHOWN = [
   { client: "cursor", name: "Cursor" },
   { client: "codex", name: "Codex" }
 ];
-function tryItLine(name) {
+function tryItLine(name, connect = false) {
   const ask2 = 'say "make this email sound less like AI"';
-  return name === "Codex" ? `Try it: run \`codex mcp login amdahl\`, then open Codex and ${ask2}` : `Try it: open ${name} and ${ask2}`;
+  if (connect && name === "Claude Code") return `Try it: in Claude Code, run /mcp once to connect, then ${ask2}`;
+  if (name === "Codex") return `Try it: run \`codex mcp login amdahl\`, then open Codex and ${ask2}`;
+  return `Try it: open ${name} and ${ask2}`;
 }
 function shouldSetUp(io) {
   const { env } = io;
@@ -9417,7 +9553,7 @@ async function signIn(ctx) {
   }
   try {
     const me = await call(() => apiClient(ctx, credential).cli.whoami());
-    return { kind: "in", email: me.email ?? me.user_id, workspace: me.workspace?.name ?? me.business_id };
+    return { kind: "in", email: printable(me.email ?? me.user_id), workspace: printable(me.workspace?.name ?? me.business_id) };
   } catch (err) {
     if (!(err instanceof CliError && err.exit === EXIT.unauthenticated)) throw err;
     return credential.source === "profile" ? { kind: "out" } : { kind: "rejected", source: credential.source };
@@ -9425,9 +9561,13 @@ async function signIn(ctx) {
 }
 async function setup(ctx) {
   const { io, out } = ctx;
+  const verbose = ctx.flags.verbose === true;
   const say = (line) => io.stdout(`${line}
 `);
-  say(`${out.bold("Amdahl")}, predictive ML for GTM`);
+  const detail = (text) => {
+    if (verbose && text) say(text.replace(/^/gm, "  "));
+  };
+  say(`${out.bold("Amdahl")} \xB7 predictive ML for GTM`);
   const found = await detectClients(ctx);
   const detected = SHOWN.filter((c) => found[c.client]);
   let who;
@@ -9448,31 +9588,33 @@ async function setup(ctx) {
       }
     }
   }
-  say(`Found on this machine: ${SHOWN.map((c) => `${c.name} ${found[c.client] ? "\u2713" : "\u2013"}`).join("  ")}`);
-  if (detected.length === 0) {
-    say("None of them found here. Tick the ones you use with Space, then press Enter.");
-  }
   const picks = await io.multiSelect(
-    "Set up Amdahl in:",
+    "Set up in:",
     SHOWN.map((c) => c.name),
     { ticked: SHOWN.map((c) => found[c.client]), color: out.color }
   );
   if (picks.length === 0) {
-    say("Nothing picked, so nothing changed. To set one up later: amdahl install claude-code|codex|cursor");
+    say("Nothing picked, so nothing changed.");
     return EXIT.ok;
   }
   who ??= await signIn(ctx);
-  if (who.kind === "in") say(`Signed in as ${who.email} (workspace: ${who.workspace})`);
-  else if (who.kind === "out") await login(ctx);
-  else {
+  if (who.kind === "in") {
+    say(`\u2713 Signed in \xB7 ${who.workspace}`);
+    detail(`Signed in as ${who.email}.`);
+  } else if (who.kind === "out") {
+    const signedIn = await browserSignIn(ctx);
+    say(`\u2713 Signed in \xB7 ${printable(signedIn.workspace.name)}`);
+    detail(signedInLine(ctx, signedIn));
+  } else {
     const name = who.source === "flag" ? "--api-key" : who.source.slice("env:".length);
     out.info(`Amdahl rejected the key in ${name}. Skipping the browser sign-in, because that key would still be used instead. Fix it, or unset it and run \`amdahl login\`.`);
   }
   let exit = EXIT.ok;
   let ready = null;
   for (const { client, name } of picks.flatMap((i) => SHOWN[i] ?? [])) {
+    let steps;
     try {
-      await install(ctx, [client]);
+      steps = await installClient(ctx, client, false);
     } catch (raw) {
       const err = raw instanceof CliError ? raw : new CliError("install_failed", `Could not set up ${name}: ${raw instanceof Error ? raw.message : String(raw)}`, EXIT.general);
       io.stderr(`Error: ${err.message}
@@ -9481,9 +9623,18 @@ ${err.hint ? `${err.hint}
       if (exit === EXIT.ok) exit = err.exit;
       continue;
     }
-    if (ready === null && (client !== "claude-code" || await onPath(ctx, "claude"))) ready = name;
+    const action = steps.mcp.data.action;
+    if (action === "printed") {
+      say(`! ${name}: \`claude\` is not on your PATH. Once it is, run:
+  ${String(steps.mcp.data.command)}`);
+    } else {
+      say(action === "unchanged" ? `\u2713 ${name} already has Amdahl` : `\u2713 Added to ${name}`);
+      ready ??= { name, connect: action !== "unchanged" };
+    }
+    const mcpDetail = action === "printed" ? [] : [steps.mcp.human, ...steps.mcp.notes];
+    detail([...mcpDetail, steps.skill.human, ...steps.skill.notes].filter(Boolean).join("\n"));
   }
-  if (ready) say(tryItLine(ready));
+  if (ready) say(tryItLine(ready.name, ready.connect));
   return exit;
 }
 
@@ -9491,39 +9642,6 @@ ${err.hint ? `${err.hint}
 var import_yaml = __toESM(require_dist(), 1);
 import { createHash as createHash4 } from "crypto";
 
-// src/output.ts
-var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/g;
-function printable(text) {
-  return text.replace(CONTROL_RE, "");
-}
-function createOutput(io, json, noColor) {
-  const color = !noColor && !io.env.NO_COLOR && io.env.TERM !== "dumb" && io.stderrIsTTY && !json;
-  return {
-    json,
-    color,
-    result(data, human) {
-      if (json) {
-        io.stdout(`${JSON.stringify(data)}
-`);
-      } else if (human !== void 0) {
-        io.stdout(human.endsWith("\n") ? human : `${human}
-`);
-      }
-    },
-    info(text) {
-      io.stderr(text.endsWith("\n") ? text : `${text}
-`);
-    },
-    event(data) {
-      if (json) io.stderr(`${JSON.stringify(data)}
-`);
-    },
-    bold(text) {
-      return color ? `\x1B[1m${text}\x1B[22m` : text;
-    }
-  };
-}
-
 // src/tar-gz.ts
 import { inflateRawSync } from "zlib";
 var MAX_ARCHIVE_FILES = 200;
@@ -10130,7 +10248,7 @@ async function workspaceUse(ctx, args) {
 }
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.1";
 
 // src/main.ts
 var COMMANDS = {
@@ -10165,7 +10283,7 @@ async function runCli(argv, io) {
       return EXIT.ok;
     }
     if (!parsed.command) {
-      if (argv.length === 0 && shouldSetUp(io)) return await setup(createCtx(io, out, parsed.flags));
+      if (argv.every((a) => a === "--verbose") && shouldSetUp(io)) return await setup(createCtx(io, out, parsed.flags));
       io.stderr(USAGE);
       return EXIT.usage;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amdahl/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "description": "The amdahl command line: sign in, check setup, optimize messages, manage API keys, connect MCP clients.",
   "license": "Apache-2.0",