@cargo-ai/cli 1.0.45 → 1.0.47

package/build/commands/billing/addPaymentMethod.js

@@ -0,0 +1,57 @@
+import { openBrowser } from "../../utils/openBrowser.js";
+import { failWith, handleApiCall, info, outputJson, sleep, success, } from "../runHandler.js";
+export const DEFAULT_TIMEOUT_SECONDS = 300;
+export const DEFAULT_POLL_INTERVAL_SECONDS = 3;
+/**
+ * Hands card entry off to Stripe's hosted billing portal and waits for the card
+ * on file to change.
+ *
+ * The card never touches this process: the CLI only ever sees the last four
+ * digits that the API already exposes. Polling is what makes the handoff usable
+ * from a script — the caller gets a definite answer instead of having to guess
+ * whether the human finished.
+ */
+export async function runAddPaymentMethod(api, opts) {
+    const before = await handleApiCall(() => api.billing.subscription.getCreditCard());
+    const { portalSession } = await handleApiCall(() => api.billing.subscription.createPortalSession());
+    info("");
+    info("To add or replace your card, open this URL in a browser:");
+    info(`  ${portalSession.url}`);
+    info("");
+    info("Waiting for the card on file to change...");
+    info("");
+    if (opts.open === true) {
+        openBrowser(portalSession.url);
+    }
+    const deadline = Date.now() + opts.timeout * 1000;
+    const beforeFingerprint = fingerprintCard(before.creditCard);
+    while (Date.now() < deadline) {
+        await sleep(opts.pollInterval * 1000);
+        const current = await handleApiCall(() => api.billing.subscription.getCreditCard(), { spinner: false });
+        if (fingerprintCard(current.creditCard) !== beforeFingerprint) {
+            const { creditCard } = current;
+            success(creditCard !== undefined
+                ? `Payment method updated: ${creditCard.brand} ending ${creditCard.last4}.`
+                : "Payment method removed.");
+            outputJson({ ok: true, status: "updated", creditCard });
+            return;
+        }
+    }
+    failWith(`Timed out after ${String(opts.timeout)}s waiting for the card to change. If you finished in the browser, check with: cargo-ai billing subscription get-credit-card`);
+}
+/**
+ * Stripe never exposes a raw card number here, so a change is detected from the
+ * fields the API does return. Replacing a card with the very same one is
+ * therefore indistinguishable from doing nothing, and the command times out.
+ */
+export function fingerprintCard(card) {
+    if (card === undefined) {
+        return "none";
+    }
+    return [
+        card.brand,
+        card.last4,
+        String(card.expMonth),
+        String(card.expYear),
+    ].join("|");
+}

package/build/commands/billing/subscription.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../../src/commands/billing/subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAGxC,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAsPN"}
+{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../../src/commands/billing/subscription.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAQxC,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAqSN"}

package/build/commands/billing/subscription.js

@@ -1,4 +1,5 @@
-import { handleApiCall, outputJson } from "../runHandler.js";
+import { handleApiCall, outputJson, parsePositiveInt } from "../runHandler.js";
+import { DEFAULT_POLL_INTERVAL_SECONDS, DEFAULT_TIMEOUT_SECONDS, runAddPaymentMethod, } from "./addPaymentMethod.js";
 export function registerSubscriptionCommands(parent, getApi) {
     const subscription = parent
         .command("subscription")
@@ -49,6 +50,32 @@ Example:
         const result = await handleApiCall(() => api.billing.subscription.createSetupIntent());
         outputJson(result);
     });
+    subscription
+        .command("add-payment-method")
+        .description("Add or replace the card on file via Stripe's hosted portal, then wait for it to land")
+        .option("--timeout <seconds>", `How long to wait for the card to change (default: ${String(DEFAULT_TIMEOUT_SECONDS)})`)
+        .option("--poll-interval <seconds>", `How often to check for the new card (default: ${String(DEFAULT_POLL_INTERVAL_SECONDS)})`)
+        .option("--no-open", "Print the URL without launching a browser")
+        .addHelpText("after", `
+Examples:
+  $ cargo-ai billing subscription add-payment-method
+  $ cargo-ai billing subscription add-payment-method --no-open --timeout 600
+
+Card details are entered on Stripe's hosted portal and never pass through this
+CLI. The URL is printed as well as opened, so this works over SSH and in
+sandboxes — relay the link and the command will detect the new card itself.`)
+        .action(async (opts) => {
+        const api = getApi();
+        await runAddPaymentMethod(api, {
+            timeout: opts.timeout !== undefined
+                ? parsePositiveInt(opts.timeout, "--timeout")
+                : DEFAULT_TIMEOUT_SECONDS,
+            pollInterval: opts.pollInterval !== undefined
+                ? parsePositiveInt(opts.pollInterval, "--poll-interval")
+                : DEFAULT_POLL_INTERVAL_SECONDS,
+            open: opts.open,
+        });
+    });
     subscription
         .command("update-payment-method")
         .description("Replace the workspace's payment method")

package/build/commands/doctor.js

@@ -55,13 +55,13 @@ function buildSkillsPinCheck(currentVersion) {
     };
 }
 async function checkApi(config) {
-    if (config.accessToken === undefined) {
+    if (config.getAccessToken === undefined) {
         return {
             check: {
                 ok: false,
                 error: {
                     status: "no-credentials",
-                    message: 'Not authenticated. Run "cargo-ai login --token <token>" or "cargo-ai login --oauth".',
+                    message: 'Not authenticated. Run "cargo-ai login --email <email>" (no browser needed) or "cargo-ai login --oauth".',
                 },
             },
             exitCode: ExitCodes.NotAuthenticated,
@@ -69,7 +69,7 @@ async function checkApi(config) {
     }
     const client = createApi({
         baseUrl: config.baseUrl,
-        accessToken: config.accessToken,
+        getAccessToken: config.getAccessToken,
         workspaceUuid: config.workspaceUuid,
     });
     try {

package/build/commands/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAqD3E"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAoD3E"}

package/build/commands/mcp.js

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { SessionExpiredError } from "@cargo-ai/cdk/cli";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { getConfig } from "../config.js";
@@ -32,14 +33,13 @@ Environment:
 Reads auth from the same place as every other command (CARGO_API_TOKEN or the
 credentials file). stdout carries the MCP protocol; all logs go to stderr.`)
         .action(async (opts) => {
-        const { accessToken, baseUrl, workspaceUuid } = getConfig();
-        if (accessToken === undefined) {
-            failWith('Not authenticated. Run "cargo-ai login --token <token>" or "cargo-ai login --oauth".', { code: ExitCodes.NotAuthenticated });
+        const { getAccessToken, baseUrl, workspaceUuid } = getConfig();
+        if (getAccessToken === undefined) {
+            failWith('Not authenticated. Run "cargo-ai login --email <email>" (no browser needed) or "cargo-ai login --oauth".', { code: ExitCodes.NotAuthenticated });
         }
         const serverUuid = await resolveServerUuid(opts.server, getApi);
         const endpoint = resolveMcpEndpoint(baseUrl, serverUuid);
         const headers = {
-            authorization: `Bearer ${accessToken}`,
             "x-cargo-origin": "cli",
             "x-cargo-origin-version": version,
         };
@@ -47,7 +47,7 @@ credentials file). stdout carries the MCP protocol; all logs go to stderr.`)
             headers["selected-workspace-uuid"] = workspaceUuid;
         }
         info(`Cargo MCP bridge -> ${endpoint}`);
-        await runBridge(endpoint, headers);
+        await runBridge(endpoint, headers, getAccessToken);
     });
 }
 const resolveServerUuid = async (explicit, getApi) => {
@@ -101,13 +101,40 @@ const mapApiHostToMcp = (baseUrl) => {
 // MCP client) and the remote streamable-HTTP client (facing Cargo). Forwarding raw
 // JSON-RPC keeps the bridge transparent — tools, resources, and long-running-tool
 // progress notifications all pass through without enumerating capabilities here.
-const runBridge = async (endpoint, headers) => {
+const runBridge = async (endpoint, headers, getAccessToken) => {
     // Prefer a proxied fetch when HTTPS_PROXY/HTTP_PROXY applies — Node's
     // built-in fetch ignores those env vars, so without this the bridge would
     // fail in proxied environments even though server discovery (Axios) works.
+    const proxyFetch = getProxyFetch(endpoint);
+    // The transport reports every failure as an error of its own making, so the
+    // reason a request could not be sent is lost by the time the bridge tears
+    // down. Hold on to an expired session here: it is the one failure the user
+    // can act on, and it has to keep its exit code.
+    let sessionExpired;
+    // A bridge stays open far longer than an access token lives, so the
+    // Authorization header is rebuilt per request instead of being captured once
+    // in `requestInit` — that is what lets the session renew mid-session.
+    const authenticatedFetch = async (url, init) => {
+        let accessToken;
+        try {
+            accessToken = await getAccessToken();
+        }
+        catch (error) {
+            if (error instanceof SessionExpiredError) {
+                sessionExpired = error;
+            }
+            throw error;
+        }
+        const merged = new Headers(init !== undefined ? init.headers : undefined);
+        merged.set("authorization", `Bearer ${accessToken}`);
+        const request = { ...init, headers: merged };
+        return proxyFetch !== undefined
+            ? proxyFetch(url, request)
+            : fetch(url, request);
+    };
     const remote = new StreamableHTTPClientTransport(new URL(endpoint), {
         requestInit: { headers },
-        fetch: getProxyFetch(endpoint),
+        fetch: authenticatedFetch,
     });
     const local = new StdioServerTransport();
     await new Promise((resolve, reject) => {
@@ -147,7 +174,7 @@ const runBridge = async (endpoint, headers) => {
                 return;
             state.closed = true;
             teardown();
-            reject(new Error(message));
+            reject(sessionExpired !== undefined ? sessionExpired : new Error(message));
         };
         // Forward raw JSON-RPC both ways. A failing transport reports the reason via
         // onerror (which fires before the send rejection), so the reason is logged

package/build/commands/runHandler.d.ts

@@ -39,8 +39,14 @@ export declare function applyRecordsLimit<T>(records: T[], limit: number): {
 };
 type HandleApiCallOpts = {
     spinner?: string | false;
+    /**
+     * Replaces the default "run cargo-ai login" advice on a 401 — which reads as
+     * a loop when the failing call is itself part of signing in.
+     */
+    notAuthenticatedHint?: string;
 };
 export declare function handleApiCall<T>(fn: () => Promise<T>, opts?: HandleApiCallOpts): Promise<T>;
+export declare function sleep(ms: number): Promise<void>;
 export declare function pollRunUntilFinished<T>(getResult: () => Promise<T>, getStatus: (result: T) => string, intervalMs: number): Promise<T>;
 export declare function pollBatchUntilFinished<T>(getResult: () => Promise<T>, getStatus: (result: T) => string, intervalMs: number): Promise<T>;
 export declare function pollMessageUntilFinished<T>(getResult: () => Promise<T>, getFinishedAt: (result: T) => string | null | undefined, intervalMs: number): Promise<T>;

package/build/commands/runHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAclE,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAID,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CAyBpE;AAKD,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAEF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA6CrD;AAGD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC1B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAmFD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,EACvD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAWZ"}
+{"version":3,"file":"runHandler.d.ts","sourceRoot":"","sources":["../../src/commands/runHandler.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,SAAS;;;;;;;CAOZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAclE,eAAO,MAAM,MAAM;aACR,MAAM,KAAG,MAAM;eACb,MAAM,KAAG,MAAM;gBACd,MAAM,KAAG,MAAM;cACjB,MAAM,KAAG,MAAM;aAChB,MAAM,KAAG,MAAM;cACd,MAAM,KAAG,MAAM;CAC1B,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAM/C;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAE7C;AAID,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUhE;AAED,KAAK,YAAY,GAAG;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAEF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,KAAK,CAgCpE;AAKD,MAAM,MAAM,OAAO,GAAG;IAEpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGlC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB,CAAC;AAIF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAuBrD;AAkDD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAQhE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CASxD;AAKD,KAAK,iBAAiB,GAAG;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,wBAAsB,aAAa,CAAC,CAAC,EACnC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,CAAC,CAAC,CAqDZ;AAuED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAgBD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,EACvD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,CAAC,CAWZ"}

package/build/commands/runHandler.js

@@ -57,6 +57,12 @@ export function failWith(message, opts) {
         ? opts.code
         : ExitCodes.GenericError;
     const extra = opts !== undefined ? opts.extra : undefined;
+    // This exits the process, so a `finally { spinner.stop() }` around the failing
+    // call never runs. Stop it here or the error prints onto a spinning line and
+    // the terminal is left with a hidden cursor.
+    if (activeSpinner !== undefined) {
+        activeSpinner.stop();
+    }
     if (process.stderr.isTTY === true) {
         process.stderr.write(`${colors.red("✗")} ${message}\n`);
         if (extra !== undefined) {
@@ -77,7 +83,28 @@ export function failWith(message, opts) {
 }
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 const SPINNER_INTERVAL_MS = 80;
+let activeSpinner;
 export function startSpinner(message) {
+    // Only one spinner can own the line, so retire any predecessor: otherwise its
+    // interval keeps redrawing underneath this one and never gets cleared.
+    if (activeSpinner !== undefined) {
+        activeSpinner.stop();
+    }
+    const spinner = createSpinner(message);
+    const tracked = {
+        update: spinner.update,
+        log: spinner.log,
+        stop: () => {
+            if (activeSpinner === tracked) {
+                activeSpinner = undefined;
+            }
+            spinner.stop();
+        },
+    };
+    activeSpinner = tracked;
+    return tracked;
+}
+function createSpinner(message) {
     if (process.stderr.isTTY !== true) {
         // Non-TTY (CI, piped): no animation — just emit each line so progress is
         // still visible in logs.
@@ -182,7 +209,7 @@ export async function handleApiCall(fn, opts) {
             const parsedError = error;
             const status = parsedError.status;
             const body = parsedError.body !== undefined ? parsedError.body : String(error);
-            const { message, code } = describeApiError(status, body);
+            const { message, code } = describeApiError(status, body, opts !== undefined ? opts.notAuthenticatedHint : undefined);
             failWith(message, {
                 code,
                 extra: { status: status !== undefined ? status : "unknown", body },
@@ -191,12 +218,15 @@ export async function handleApiCall(fn, opts) {
         throw error;
     }
 }
-function describeApiError(status, body) {
+function describeApiError(status, body, notAuthenticatedHint) {
     const detail = extractApiErrorDetail(body);
     const detailSuffix = detail !== undefined ? `: ${detail}` : "";
     if (status === 401) {
+        const hint = notAuthenticatedHint !== undefined
+            ? notAuthenticatedHint
+            : "Run `cargo-ai login` to refresh credentials.";
         return {
-            message: `Not authenticated${detailSuffix}. Run \`cargo-ai login\` to refresh credentials.`,
+            message: `Not authenticated${detailSuffix}. ${hint}`,
             code: ExitCodes.NotAuthenticated,
         };
     }
@@ -247,7 +277,7 @@ function extractApiErrorDetail(body) {
     }
     return undefined;
 }
-function sleep(ms) {
+export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 const TERMINAL_RUN_STATUSES = new Set([

package/build/config.d.ts

@@ -1,9 +1,30 @@
+import type { AccessTokenProvider } from "@cargo-ai/cdk/cli";
 export type ConfigSource = "environment" | "credentials-file" | "none";
 export type Config = {
-    accessToken: string | undefined;
+    /**
+     * Resolves the token for each request, renewing the session first when it is
+     * about to expire. `undefined` means no credential at all.
+     */
+    getAccessToken: AccessTokenProvider | undefined;
     baseUrl: string;
     workspaceUuid: string | undefined;
     source: ConfigSource;
 };
 export declare function getConfig(): Config;
+/**
+ * An API token is bound to one workspace by the server, which derives the
+ * workspace from the token and ignores the one we send alongside it. Pointing
+ * CARGO_WORKSPACE_UUID somewhere else would therefore run against the token's
+ * workspace while looking like it worked, so refuse instead of silently
+ * touching the wrong data. A signed-in session carries no such binding: the
+ * server honours the workspace header, so the override just works.
+ *
+ * Exported for tests; `getConfig` is the only production caller.
+ */
+export declare function describeWorkspaceOverrideConflict(opts: {
+    isWorkspaceBoundToken: boolean;
+    tokenSource: ConfigSource;
+    credentialsWorkspaceUuid: string | undefined;
+    requestedWorkspaceUuid: string | undefined;
+}): string | undefined;
 //# sourceMappingURL=config.d.ts.map

package/build/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,MAAM,GAAG;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,wBAAgB,SAAS,IAAI,MAAM,CAclC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO7D,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAEvE,MAAM,MAAM,MAAM,GAAG;IACnB;;;OAGG;IACH,cAAc,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB,CAAC;AAEF,wBAAgB,SAAS,IAAI,MAAM,CA0BlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE;IACtD,qBAAqB,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,YAAY,CAAC;IAC1B,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,GAAG,MAAM,GAAG,SAAS,CA0BrB"}

package/build/config.js

@@ -1,15 +1,56 @@
-import { loadProjectEnv, resolveAuthConfig } from "@cargo-ai/cdk/cli";
+import { loadProjectEnv, resolveAuth } from "@cargo-ai/cdk/cli";
+import { ExitCodes, failWith } from "./commands/runHandler.js";
 import { loadCredentials } from "./credentials.js";
 export function getConfig() {
     // Fold project `.env` into the environment first (never overriding explicit
     // exports): a repo pinned to one workspace must win over a personal login.
     loadProjectEnv();
     const credentials = loadCredentials();
-    const resolved = resolveAuthConfig(process.env, credentials);
+    const resolved = resolveAuth(process.env, credentials);
+    const conflict = describeWorkspaceOverrideConflict({
+        isWorkspaceBoundToken: resolved.isWorkspaceBoundToken,
+        tokenSource: resolved.tokenSource,
+        credentialsWorkspaceUuid: credentials !== undefined ? credentials.workspaceUuid : undefined,
+        requestedWorkspaceUuid: resolved.workspaceUuid,
+    });
+    if (conflict !== undefined) {
+        failWith(conflict, { code: ExitCodes.InvalidUsage });
+    }
     return {
-        accessToken: resolved.accessToken,
+        getAccessToken: resolved.getAccessToken,
         baseUrl: resolved.baseUrl,
         workspaceUuid: resolved.workspaceUuid,
         source: resolved.tokenSource,
     };
 }
+/**
+ * An API token is bound to one workspace by the server, which derives the
+ * workspace from the token and ignores the one we send alongside it. Pointing
+ * CARGO_WORKSPACE_UUID somewhere else would therefore run against the token's
+ * workspace while looking like it worked, so refuse instead of silently
+ * touching the wrong data. A signed-in session carries no such binding: the
+ * server honours the workspace header, so the override just works.
+ *
+ * Exported for tests; `getConfig` is the only production caller.
+ */
+export function describeWorkspaceOverrideConflict(opts) {
+    if (opts.isWorkspaceBoundToken === false) {
+        return undefined;
+    }
+    if (opts.tokenSource !== "credentials-file") {
+        return undefined;
+    }
+    if (opts.credentialsWorkspaceUuid === undefined ||
+        opts.requestedWorkspaceUuid === undefined) {
+        return undefined;
+    }
+    if (opts.requestedWorkspaceUuid === opts.credentialsWorkspaceUuid) {
+        return undefined;
+    }
+    return [
+        `Workspace ${opts.requestedWorkspaceUuid} was requested, but the saved credential is an API token scoped to workspace ${opts.credentialsWorkspaceUuid}.`,
+        "The server takes the workspace from the token, so the request would silently run against the token's workspace.",
+        `Sign in for that workspace instead: cargo-ai login --email <email> --workspace-uuid ${opts.requestedWorkspaceUuid}`,
+        "Or unset CARGO_WORKSPACE_UUID to use the workspace the saved token belongs to.",
+    ].join(" ");
+}

package/build/credentials.d.ts

@@ -1,11 +1,2 @@
-export type Credentials = {
-    accessToken: string;
-    workspaceUuid?: string;
-    baseUrl?: string;
-};
-export declare function loadCredentials(): Credentials | undefined;
-export declare function saveCredentials(creds: Credentials): void;
-export declare function clearCredentials(): boolean;
-export declare function getCredentialsPath(): string;
-export declare function getConfigDir(): string;
+export { clearCredentials, type StoredCredentials as Credentials, getConfigDir, getCredentialsPath, loadCredentials, type RefreshableSession, saveCredentials, } from "@cargo-ai/cdk/cli";
 //# sourceMappingURL=credentials.d.ts.map

package/build/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,WAAW,GAAG;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAKF,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAQzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAKxD;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAI1C;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,IAAI,WAAW,EACrC,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/build/credentials.js

@@ -1,34 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-const CONFIG_DIR = join(homedir(), ".config", "cargo-ai");
-const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
-export function loadCredentials() {
-    if (existsSync(CREDENTIALS_FILE) === false)
-        return undefined;
-    try {
-        const raw = readFileSync(CREDENTIALS_FILE, "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-export function saveCredentials(creds) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + "\n", {
-        mode: 0o600,
-    });
-}
-export function clearCredentials() {
-    if (existsSync(CREDENTIALS_FILE) === false)
-        return false;
-    unlinkSync(CREDENTIALS_FILE);
-    return true;
-}
-export function getCredentialsPath() {
-    return CREDENTIALS_FILE;
-}
-export function getConfigDir() {
-    return CONFIG_DIR;
-}
+// The credentials file is shared with `cargo-cdk`, so its format and access
+// live in @cargo-ai/cdk/cli — one login serves both binaries and neither can
+// drift from the other's idea of what is on disk.
+export { clearCredentials, getConfigDir, getCredentialsPath, loadCredentials, saveCredentials, } from "@cargo-ai/cdk/cli";

package/build/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { registerCommands as registerCdkCommands, registerManifestCommands, } from "@cargo-ai/cdk/cli";
+import { registerCommands as registerCdkCommands, registerManifestCommands, SessionExpiredError, } from "@cargo-ai/cdk/cli";
 import { Command } from "commander";
 import { createApi } from "./api.js";
 import { registerAiCommands } from "./commands/ai/index.js";
@@ -35,8 +35,9 @@ program
     .version(version)
     .addHelpText("after", `
 Authentication:
-  With API token:     cargo-ai login --token <your-token>
+  Emailed code:       cargo-ai login --email you@company.com  (no browser; signs you up on first use)
   Browser sign-in:    cargo-ai login --oauth
+  With API token:     cargo-ai login --token <your-token>
   Use env variables:  CARGO_API_TOKEN, CARGO_WORKSPACE_UUID, CARGO_BASE_URL
   Check status:       cargo-ai whoami
 
@@ -53,11 +54,11 @@ Exit codes:
 Run "cargo-ai <command> --help" for details on a specific command group.
 Run "cargo-ai <command> <subcommand> --help" for details on a subcommand.`);
 const getApi = () => {
-    const { baseUrl, accessToken, workspaceUuid } = getConfig();
-    if (accessToken === undefined) {
-        failWith("Not authenticated. Run 'cargo-ai login --token <token>' or 'cargo-ai login --oauth'.", { code: ExitCodes.NotAuthenticated });
+    const { baseUrl, getAccessToken, workspaceUuid } = getConfig();
+    if (getAccessToken === undefined) {
+        failWith("Not authenticated. Run 'cargo-ai login --email <email>' (no browser needed) or 'cargo-ai login --oauth'.", { code: ExitCodes.NotAuthenticated });
     }
-    return createApi({ baseUrl, accessToken, workspaceUuid });
+    return createApi({ baseUrl, getAccessToken, workspaceUuid });
 };
 registerAuthCommands(program, getApi);
 registerVersionCommand(program, version);
@@ -89,5 +90,11 @@ program
     .parseAsync()
     .then(() => maybeNotifyUpdate(version))
     .catch((err) => {
-    failWith(err instanceof Error ? err.message : String(err));
+    // An expired session is the ordinary way to lose authentication, so it has
+    // to carry the documented exit code rather than the generic one.
+    failWith(err instanceof Error ? err.message : String(err), {
+        code: err instanceof SessionExpiredError
+            ? ExitCodes.NotAuthenticated
+            : undefined,
+    });
 });

package/build/oauthConfig.d.ts

@@ -4,10 +4,5 @@ export type OAuthConfig = {
     audience: string;
     scope: string;
 };
-export type OAuthConfigOverrides = {
-    domain?: string;
-    clientId?: string;
-    audience?: string;
-};
-export declare function getOAuthConfig(overrides: OAuthConfigOverrides): OAuthConfig;
+export declare function getOAuthConfig(): OAuthConfig;
 //# sourceMappingURL=oauthConfig.d.ts.map

package/build/oauthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthConfig.d.ts","sourceRoot":"","sources":["../src/oauthConfig.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,wBAAgB,cAAc,CAAC,SAAS,EAAE,oBAAoB,GAAG,WAAW,CAO3E"}
+{"version":3,"file":"oauthConfig.d.ts","sourceRoot":"","sources":["../src/oauthConfig.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAOF,wBAAgB,cAAc,IAAI,WAAW,CAO5C"}

package/build/oauthConfig.js

@@ -1,17 +1,12 @@
-const DEFAULT_DOMAIN = "auth.getcargo.io";
-const DEFAULT_AUDIENCE = "https://api.getcargo.io";
-const DEFAULT_SCOPE = "openid profile email offline_access";
-const DEFAULT_CLIENT_ID = "oUc99KlLSMAYUAPgxTUyqazef0sxR93b";
-export function getOAuthConfig(overrides) {
+const DOMAIN = "auth.getcargo.io";
+const AUDIENCE = "https://api.getcargo.io";
+const SCOPE = "openid profile email offline_access";
+const CLIENT_ID = "oUc99KlLSMAYUAPgxTUyqazef0sxR93b";
+export function getOAuthConfig() {
     return {
-        domain: pickString(overrides.domain, DEFAULT_DOMAIN),
-        audience: pickString(overrides.audience, DEFAULT_AUDIENCE),
-        clientId: pickString(overrides.clientId, DEFAULT_CLIENT_ID),
-        scope: DEFAULT_SCOPE,
+        domain: DOMAIN,
+        audience: AUDIENCE,
+        clientId: CLIENT_ID,
+        scope: SCOPE,
     };
 }
-const pickString = (override, fallback) => {
-    if (override !== undefined && override.length > 0)
-        return override;
-    return fallback;
-};

package/build/utils/openBrowser.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Best-effort browser launch. Every caller also prints the URL, so a failure
+ * here is never fatal: headless boxes and sandboxes simply fall back to the
+ * user opening the link themselves.
+ */
+export declare function openBrowser(url: string): void;
+//# sourceMappingURL=openBrowser.d.ts.map

package/build/utils/openBrowser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openBrowser.d.ts","sourceRoot":"","sources":["../../src/utils/openBrowser.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAc7C"}

package/build/utils/openBrowser.js

@@ -0,0 +1,29 @@
+import { spawn } from "node:child_process";
+import { platform } from "node:process";
+/**
+ * Best-effort browser launch. Every caller also prints the URL, so a failure
+ * here is never fatal: headless boxes and sandboxes simply fall back to the
+ * user opening the link themselves.
+ */
+export function openBrowser(url) {
+    const command = pickOpenCommand();
+    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    try {
+        const child = spawn(command, args, {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.on("error", () => undefined);
+        child.unref();
+    }
+    catch {
+        // Intentionally ignored — see above.
+    }
+}
+function pickOpenCommand() {
+    if (platform === "darwin")
+        return "open";
+    if (platform === "win32")
+        return "cmd";
+    return "xdg-open";
+}

package/build/utils/prompt.d.ts

@@ -0,0 +1,12 @@
+/// <reference types="node" resolution-mode="require"/>
+export type PromptInput = {
+    stream: NodeJS.ReadableStream;
+    close: () => void;
+};
+export declare function openPromptInput(): PromptInput | undefined;
+/**
+ * Asks a single question on the controlling terminal. Prompts are written to
+ * stderr so that piping stdout to `jq` keeps working.
+ */
+export declare function askQuestion(input: NodeJS.ReadableStream, question: string): Promise<string | undefined>;
+//# sourceMappingURL=prompt.d.ts.map

package/build/utils/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../src/utils/prompt.ts"],"names":[],"mappings":";AAIA,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,CAAC;AAMF,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAYzD;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe7B"}