@catalyst-cloud/cli 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.15.4
+
+- Setup shows a colour mark and clearer progress, with a plain display when your terminal needs it.
+- Setup separates your next steps from tasks waiting on an owner or admin, and reports when it stops waiting for an account connection.
+- Setup wraps long text by words and keeps numbered steps in order.
+
+## 0.15.3
+
+- Setup can finish once the steps needed to run work are ready. It lists optional next steps and keeps your first-ticket choice when you resume.
+- Setup shows one progress display with numbered steps and the reason a step needs attention.
+- When the Connect accounts page is available, setup uses it to finish account connections. Any usable AI account counts without a test request.
+- Setup offers API keys by default. Subscription account options appear only when your workspace enables them.
+
 ## 0.15.2
 
 - `catalyst setup` is the command to set up Catalyst. It runs the same steps as `catalyst onboard`, which still works.

package/README.md

@@ -111,7 +111,7 @@ The command is `catalyst`. `catalyst-skills` still works as a deprecated alias,
 
 ## What this is
 
-A set of skills that let your coding agent run your own Catalyst Cloud account (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your account through the Catalyst Cloud SDK, write to it through the account's agent proxy, and never compose a URL or run a tool of their own; every read, write and subscription is a `catalyst` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
+A set of skills that let your coding agent run your own Catalyst Cloud account (https://staging.catalystcloud.dev) from your seat: what is happening, what needs you, and what to do about it. They read your account through the Catalyst Cloud SDK, write to it through the account's agent proxy, and never compose a URL or run a tool of their own; every read, write and live watch is a `catalyst` verb with `--help`. Every skill is plain Markdown under `skills/<name>/SKILL.md` in this repository, and your own login — a keyless device-code session, or a personal key — is the only credential. Your agent acts as you: the asks it raises and the comments it posts carry your name, and "what needs me" means you.
 
 ## What connecting does
 
@@ -133,6 +133,8 @@ catalyst onboard
 catalyst ready --onboarding --json
 ```
 
+`catalyst setup` opens with the Catalyst Cloud mark in your terminal's colours. It asks the terminal whether its background is light or dark; set `CATALYST_THEME=light` or `CATALYST_THEME=dark` when it guesses wrong. `--no-color` or `NO_COLOR` prints plain text without the mark.
+
 The dry run writes no files. `--only <step>` runs one step and reports its scope separately from full onboarding. Exit 10 means a failed step, 11 means waiting, and 12 means a guard refused the action. The private receipt is `install/last-run.json` under your machine's Catalyst state directory; credentials stay in the login config. A fake HOME reports old services and keeps them intact.
 
 ### Headless setup (CI, image builds, agent VMs)
@@ -231,7 +233,7 @@ Some of these only read, and some write: a comment, a card move, an ask, a relea
 
 ## What a key cannot see yet
 
-Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, window usage, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
+Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, usage limits, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
 
 - Read pull-request labels or the reviewer's reaction. The mirror does not carry them; GitHub's own page does.
 - Compute a flow number — cycle time, throughput, or how long pull requests have been open. Nothing serves those yet, so say they are not computed rather than counting something else and calling it that.

package/dist/args.js

@@ -64,6 +64,10 @@ export const FLAG_TABLES = {
             value: false,
             help: "do not run Catalyst's work on this machine, and do not ask",
         },
+        "no-color": {
+            value: false,
+            help: "print setup in plain text, without colour or the Catalyst Cloud mark",
+        },
         "resume-from": {
             value: true,
             help: "resume at a verified onboarding step",
@@ -459,7 +463,7 @@ export const FLAG_TABLES = {
 export const VERB_USAGE = {
     setup: "setup [onboard options]   (sets up Catalyst step by step; same as catalyst onboard) | setup --engine <file> --engine-sha256 <hex> [-- <install options>]   (run by install.sh; install.sh --help lists the options)",
     login: "login [--base-url <url>] [--start-replica]   (keyless; or --key <personal-key> / CATALYST_CLOUD_TOKEN)",
-    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--runner|--no-runner] [--yes] [--dry-run] [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--json]",
+    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--runner|--no-runner] [--no-color] [--yes] [--dry-run] [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--json]",
     install: "install [--skills-dir <dir>] [--force]",
     status: "status",
     notice: "notice",

package/dist/cli.js

@@ -1,6 +1,6 @@
 // cli.ts — the `catalyst` dispatcher (npm: @catalyst-cloud/cli). Verbs live in
 // their own modules; this file keeps every export the 0.1 tests and the bin import.
-import { createSetupRenderer } from "./setup-render.js";
+import { createSetupRenderer, setupBanner, } from "./setup-render.js";
 import { existsSync, openSync, closeSync } from "node:fs";
 import { ReadStream as TerminalInput } from "node:tty";
 import { Writable } from "node:stream";
@@ -44,12 +44,12 @@ import { cmdRepo } from "./repo.js";
 import { cmdLegacy } from "./legacy.js";
 import { cmdIdentity } from "./identity.js";
 import { cmdConnections } from "./connections.js";
-import { cmdOnboard, onboardErrorJournal, onboardRequiredStepsWaiting, } from "./onboard.js";
+import { cmdOnboard, onboardErrorJournal, } from "./onboard.js";
 import { createClackOnboardUi, shouldUseOnboardUi, } from "./onboard-ui.js";
 import { createOnboardRuntime } from "./onboard-runtime.js";
 import { argvRequestsHeadless, headlessOnboardDeps, headlessUsageRefusal, onboardHeadlessRequested, runOnboardHeadless, } from "./onboard-headless.js";
 import { savedOnboardBaseUrl } from "./onboard-next.js";
-import { onboardingReadyReport, observeCloudOnboarding, } from "./onboard-ready.js";
+import { onboardingReadyReport, onboardReadyStep, observeCloudOnboarding, } from "./onboard-ready.js";
 import { selectedOnboardTeam } from "./onboard-existing.js";
 export { CONFIG_MODE, DEFAULT_BASE_URL, FIRST_STAMPED_VERSION, LEGACY_PACKAGE_NAME, PACKAGE_NAME, PROVENANCE_MARKER, CliError, MeError, UsageError, configPathFor, contractPathFor, defaultCtx, defaultReplicaDbFor, defaultSkillsDirFor, fetchMe, formatMode, installedBundleVersion, installSkills, loadConfig, modernCliPath, normalizeBaseUrl, parseArgs, parseChangelogEntry, parseProvenanceVersion, readChangelog, readManifest, resolveSkillsDir, saveConfig, skillsSourceDir, updateNoticeLine, writeConfig, };
 export const CUSTOMER_SKILLS = [
@@ -210,6 +210,7 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
     // CTC-4625: setup passes the install options through to its engine untouched, so they never meet
     // this CLI's own flag tables. CTC-4680: without --engine, `setup` is the name a person types for
     // the onboard flow, so it runs exactly that.
+    const viaSetup = drawsMark(argv);
     if (argv[0] === "setup") {
         const rest = argv.slice(1);
         const own = rest.indexOf("--") === -1 ? rest : rest.slice(0, rest.indexOf("--"));
@@ -278,6 +279,9 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                 // Headless runs drop the terminal UI, browser sign-in and every browser action (CTC-4633).
                 const runOnboard = async (args, ctx, headless) => {
                     let ui = headless ? undefined : deps.setupUi;
+                    // --no-color reaches the renderer as NO_COLOR, so the banner and every step row go plain.
+                    const noColor = args.flags["no-color"] === true;
+                    const rendererEnv = noColor ? { ...ctx.env, NO_COLOR: "1" } : ctx.env;
                     let terminal;
                     let input = process.stdin;
                     const originalRaw = Boolean(input.isRaw);
@@ -300,12 +304,21 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                         }
                         if (input.isTTY) {
                             try {
+                                const banner = await setupBanner({
+                                    setup: viaSetup,
+                                    env: rendererEnv,
+                                    input,
+                                    stdout: process.stdout,
+                                    stream: bannerStream(ctx),
+                                    noColor,
+                                });
                                 ui = createClackOnboardUi(await import("@clack/prompts"), { input, output: process.stdout }, {
                                     baseUrl: () => savedOnboardBaseUrl(ctx.home),
                                     verbose: args.flags.verbose === true,
-                                    renderer: createSetupRenderer(process.stdout, ctx.env),
+                                    renderer: createSetupRenderer(process.stdout, rendererEnv, banner),
                                     disposeRenderer: true,
                                     signinTimeoutMs: deps.onboardSigninTimeoutMs,
+                                    version: manifest.version,
                                 });
                             }
                             catch (error) {
@@ -325,9 +338,17 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                             });
                         ui = createClackOnboardUi(await import("@clack/prompts"), { input: process.stdin, output }, {
                             baseUrl: () => savedOnboardBaseUrl(ctx.home),
-                            renderer: createSetupRenderer(output, ctx.env),
+                            renderer: createSetupRenderer(output, rendererEnv, await setupBanner({
+                                setup: viaSetup,
+                                env: rendererEnv,
+                                input: process.stdin,
+                                stdout: process.stdout,
+                                stream: bannerStream(ctx),
+                                noColor,
+                            })),
                             disposeRenderer: true,
                             signinTimeoutMs: deps.onboardSigninTimeoutMs,
+                            version: manifest.version,
                             interactive: false,
                             verbose: args.flags.verbose === true,
                         });
@@ -395,21 +416,7 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                                         localSync: journal?.localSync ?? args.flags["local-sync"] === true,
                                         observe: observeCloudOnboarding,
                                     });
-                                    const failed = report.checks.some((check) => check.required && check.state === "fail") && !onboardRequiredStepsWaiting(journal);
-                                    return {
-                                        state: report.state === "complete"
-                                            ? "done"
-                                            : failed
-                                                ? "failed"
-                                                : "waiting",
-                                        reason: report.state === "complete"
-                                            ? undefined
-                                            : "onboarding_checks_pending",
-                                        evidence: {
-                                            checks: report.checks.length,
-                                            passed: report.checks.filter((check) => check.state === "pass").length,
-                                        },
-                                    };
+                                    return onboardReadyStep(report, journal);
                                 },
                                 legacy: deps.legacy,
                                 openBrowser: deps.openBrowser,
@@ -572,6 +579,23 @@ const VERB_HELP_KNOWN = Object.fromEntries([
     "legacy",
     "onboard",
 ].map((v) => [v, true]));
+/** CTC-4680: the Pixel Nucleus mark belongs to `catalyst setup` alone. `setup` runs the onboard
+ *  flow, so this is read from the verb typed, before setup becomes onboard. */
+export function drawsMark(argv) {
+    return argv[0] === "setup";
+}
+/** CTC-4680: the banner goes to stderr, through ctx when stderr is not a terminal. */
+function bannerStream(ctx) {
+    if (process.stderr.isTTY === true)
+        return process.stderr;
+    return {
+        write(chunk) {
+            for (const line of chunk.replace(/\n$/, "").split("\n"))
+                ctx.stderr(line);
+            return true;
+        },
+    };
+}
 /** CTC-4625: `catalyst setup`, wired to this terminal, @clack/prompts and the keyless login. */
 async function runSetup(argv, ctx, deps) {
     if (argv[0] === "--help" || argv[0] === "-h") {

package/dist/oauth.js

@@ -156,7 +156,7 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
                         throw new Error("browser-unavailable");
                     await deps.openBrowser(auth.verification_uri_complete ?? auth.verification_uri);
                     browserOpened = true;
-                    ctx.stdout("Opened your browser to that page — approve there, or use the code above.");
+                    ctx.stdout("Opened your browser to that page. Approve there, or use the code above.");
                 }
                 catch {
                     // a browser that will not open is not a failure; the code and URL still work

package/dist/onboard-accounts.js

@@ -3,7 +3,6 @@ import { readExistingOnboardJson } from "./onboard-existing.js";
 import { pollConsent } from "./onboard-consent.js";
 import { verifyOnboardRoutes } from "./onboard-capabilities.js";
 const listPath = "/api/v1/coding-accounts";
-const validatePath = "/api/v1/coding-accounts/:slot/validate";
 const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
     ? value
     : null;
@@ -94,195 +93,92 @@ async function inventory(ctx, journal, signal) {
     }
     return { slots, identity };
 }
-/** Verify one existing Claude slot per run. A stored login, cached poll or Codex shape is not
- * fresh provider access. Enrollment and a phase's actual lease eligibility remain separate. */
+/** Why one account cannot take work, or null when it can. The Connect page's AI-account rule
+ * (the server's isUsableCodingAccount): any provider, any member's account, and a canceled
+ * subscription keeps working until its paid access ends. */
+function unusableCause(row, now) {
+    if (row.declaredState !== "active")
+        return "coding_account_inactive";
+    if (row.revokedAtMs !== null ||
+        (row.accessEndsAtMs !== null && row.accessEndsAtMs <= now))
+        return "coding_account_ended";
+    if (row.needsCredential)
+        return "coding_account_needs_login";
+    if (row.quarantined)
+        return "coding_account_quarantined";
+    if (row.walled)
+        return "coding_account_walled";
+    return null;
+}
+export function usableAiAccount(row, now) {
+    return unusableCause(row, now) === null;
+}
+/** CTC-4680: the step is done when the workspace has at least one usable AI account, from any
+ * provider. With --coding-account, that named account is the one that must be usable. */
 export function onboardAccountsAdapter(input = {}) {
-    let proof = null;
-    let attempted = false;
-    const candidate = (slots, now) => slots
+    const usable = (slots, now) => slots
         .filter((row) => (input.slot === undefined || row.accountSlot === input.slot) &&
-        row.provider === "claude" &&
-        row.declaredState === "active" &&
-        row.ownedByMe &&
-        !row.needsCredential &&
-        !row.walled &&
-        !row.quarantined &&
-        row.renewalStatus !== "canceled" &&
-        row.revokedAtMs === null &&
-        (row.accessEndsAtMs === null || row.accessEndsAtMs > now))
+        usableAiAccount(row, now))
         .sort((a, b) => a.accountSlot.localeCompare(b.accountSlot))[0];
     const check = async (ctx, journal, signal) => {
         const live = await inventory(ctx, journal, signal);
         if ("reason" in live)
             return waiting(live.reason);
-        const selected = candidate(live.slots, ctx.now().getTime());
-        if (proof &&
-            equal(live.identity, proof) &&
-            live.slots.some((row) => row.accountSlot === proof.slot &&
-                row.provider === proof.provider &&
-                row.declaredState === "active" &&
-                row.ownedByMe &&
-                !row.needsCredential &&
-                !row.walled &&
-                !row.quarantined &&
-                row.renewalStatus !== "canceled" &&
-                row.revokedAtMs === null &&
-                (row.accessEndsAtMs === null ||
-                    row.accessEndsAtMs > ctx.now().getTime())) &&
-            proof.checkedAtMs <= ctx.now().getTime() + 5000 &&
-            proof.checkedAtMs >= ctx.now().getTime() - 30000)
+        const selected = usable(live.slots, ctx.now().getTime());
+        if (selected)
             return {
                 state: "done",
                 evidence: {
-                    accountSlot: proof.slot,
-                    provider: proof.provider,
-                    checkedAt: new Date(proof.checkedAtMs).toISOString(),
+                    provider: selected.provider,
+                    checkedAt: ctx.now().toISOString(),
                 },
             };
-        proof = null;
-        if (!live.slots.length)
-            return input.waitForAccount &&
-                ["owner", "admin"].includes(live.identity.role)
-                ? { state: "pending" }
-                : waiting("account_enrollment_required");
-        if (input.slot !== undefined &&
-            !live.slots.some((row) => row.accountSlot === input.slot))
-            return waiting("coding_account_not_found");
-        if (!selected)
-            return waiting(live.slots.some((row) => row.provider === "codex")
-                ? "codex_provider_access_unverified"
-                : "account_provider_access_unverified");
-        if (attempted)
-            return waiting("account_provider_access_unverified");
-        const cfg = loadConfig(ctx.home);
-        if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
-            return waiting("account_validation_admin_required");
-        return { state: "pending" };
+        if (input.slot !== undefined) {
+            const named = live.slots.find((row) => row.accountSlot === input.slot);
+            // A named account speaks for itself: other accounts in the workspace may be fine.
+            return waiting(named
+                ? (unusableCause(named, ctx.now().getTime()) ?? "coding_account_not_found")
+                : "coding_account_not_found");
+        }
+        if (input.waitForAccount &&
+            ["owner", "admin"].includes(live.identity.role))
+            return { state: "pending" };
+        return waiting(live.slots.length ? "ai_account_not_usable" : "account_enrollment_required");
     };
     return {
         check,
         act: async (ctx, journal, external) => {
-            if (attempted)
-                return waiting("account_provider_access_unverified");
             const initial = await inventory(ctx, journal, external);
             if ("reason" in initial)
                 return waiting(initial.reason);
-            let live = initial;
-            if (!live.slots.length &&
-                input.waitForAccount &&
-                ["owner", "admin"].includes(live.identity.role)) {
-                const result = await input.waitForAccount(() => pollConsent({
-                    timeoutMs: input.accountWaitMs,
-                    signal: external,
-                    sleep: input.sleep,
-                    readStatus: async (signal) => {
-                        const current = await inventory(ctx, journal, signal);
-                        if ("reason" in current)
-                            return { outcome: "waiting", reason: current.reason };
-                        live = current;
-                        return { outcome: current.slots.length ? "connected" : "absent" };
-                    },
-                }));
-                if (result.state !== "done")
-                    return waiting(result.reason === "consent_timeout"
-                        ? "account_enrollment_required"
-                        : (result.reason ?? "account_enrollment_required"));
-            }
-            const selected = candidate(live.slots, ctx.now().getTime());
-            if (!selected)
-                return waiting("account_provider_access_unverified");
-            const support = await verifyOnboardRoutes(ctx, journal, [{ method: "POST", path: validatePath }], external);
-            if ("reason" in support)
-                return waiting(support.reason);
-            const cfg = loadConfig(ctx.home);
-            if (!equal(binding(ctx, journal), live.identity) ||
-                !cfg?.user ||
-                !["owner", "admin"].includes(cfg.user.role))
-                return waiting("account_identity_unverified");
-            const expiry = cfg.auth
-                ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
-                : 0;
-            const bearer = cfg.key ||
-                (cfg.auth && Number.isFinite(expiry) && expiry > 30000
-                    ? cfg.auth.accessToken
-                    : undefined);
-            if (!bearer)
-                return waiting("account_login_refresh_required");
-            input.message?.("Checking one stored Claude account with a one-token provider request. This may use Claude quota. Codex credentials are not refreshed. Phase eligibility is checked separately.");
-            // A display callback must not be able to switch the identity used for this request.
-            if (!equal(binding(ctx, journal), live.identity))
-                return waiting("account_identity_unverified");
-            const deadline = new AbortController();
-            const signal = external
-                ? AbortSignal.any([external, deadline.signal])
-                : deadline.signal;
-            const timer = setTimeout(() => deadline.abort(), 15000);
-            let remove = () => { };
-            try {
-                return await new Promise((resolve) => {
-                    const stopped = () => resolve(waiting(external?.aborted
-                        ? "interrupted"
-                        : "account_validation_unavailable"));
-                    if (signal.aborted) {
-                        stopped();
-                        return;
-                    }
-                    signal.addEventListener("abort", stopped, { once: true });
-                    remove = () => signal.removeEventListener("abort", stopped);
-                    Promise.resolve()
-                        .then(async () => {
-                        if (signal.aborted)
-                            return waiting("interrupted");
-                        // UI callbacks can queue a config change before this deferred send executes.
-                        if (!equal(binding(ctx, journal), live.identity))
-                            return waiting("account_identity_unverified");
-                        attempted = true;
-                        const response = await ctx.fetch(`${support.origin}/api/v1/coding-accounts/${encodeURIComponent(selected.accountSlot)}/validate`, {
-                            method: "POST",
-                            redirect: "error",
-                            signal,
-                            headers: {
-                                authorization: `Bearer ${bearer}`,
-                                accept: "application/json",
-                            },
-                        });
-                        if (response.status !== 200)
-                            return waiting("account_validation_unavailable");
-                        const body = object(await response.json());
-                        if (signal.aborted ||
-                            !equal(binding(ctx, journal), live.identity))
-                            return waiting("account_identity_unverified");
-                        const now = ctx.now().getTime();
-                        if (!body ||
-                            body.provider !== selected.provider ||
-                            typeof body.checkedAtMs !== "number" ||
-                            !Number.isSafeInteger(body.checkedAtMs) ||
-                            body.checkedAtMs > now + 5000 ||
-                            body.checkedAtMs < now - 30000 ||
-                            !["working", "walled", "rejected", "inconclusive"].includes(String(body.result)))
-                            return waiting("account_validation_unverified");
-                        if (body.result !== "working")
-                            return waiting(body.result === "walled"
-                                ? "account_provider_walled"
-                                : body.result === "rejected"
-                                    ? "account_provider_rejected"
-                                    : "account_provider_access_unverified");
-                        proof = {
-                            ...live.identity,
-                            slot: selected.accountSlot,
-                            provider: selected.provider,
-                            checkedAtMs: body.checkedAtMs,
-                        };
-                        input.message?.("Claude provider access was verified. This does not reserve a runner or prove that a phase can start.");
-                        return check(ctx, journal, signal);
-                    })
-                        .then((result) => (signal.aborted ? stopped() : resolve(result)), () => stopped());
-                });
-            }
-            finally {
-                clearTimeout(timer);
-                remove();
-            }
+            if (!input.waitForAccount ||
+                !["owner", "admin"].includes(initial.identity.role))
+                return check(ctx, journal, external);
+            let enrolled = initial.slots.length > 0;
+            const result = await input.waitForAccount(() => pollConsent({
+                timeoutMs: input.accountWaitMs,
+                signal: external,
+                sleep: input.sleep,
+                readStatus: async (signal) => {
+                    const current = await inventory(ctx, journal, signal);
+                    if ("reason" in current)
+                        return { outcome: "waiting", reason: current.reason };
+                    enrolled = current.slots.length > 0;
+                    return {
+                        outcome: usable(current.slots, ctx.now().getTime())
+                            ? "connected"
+                            : "absent",
+                    };
+                },
+            }));
+            if (result.state === "done")
+                return check(ctx, journal, external);
+            // A wait that ran out holds the step and offers another try (round 5).
+            return waiting(result.reason !== "consent_timeout"
+                ? (result.reason ?? "account_enrollment_required")
+                : enrolled
+                    ? "ai_account_not_usable"
+                    : "account_enrollment_required");
         },
     };
 }