@coopcli/specplan 2026.902.1 → 2026.904.1

package/README.md

@@ -1,7 +1,9 @@
 # @coopcli/specplan
 
-Plan a project as a DAG of **specs** and **user stories** on a React Flow canvas, and generate OpenSpec changes per spec card. Local-only: the server binds to 127.0.0.1 and model calls run with your own Anthropic credentials.
+> **There is no login command.** The CLI logins were retired (`retire-cli-login`): the browser flow opens `/cli-auth` on an origin whose Clerk instance moved to specsesh.com, so it cannot complete. Credentials already in `~/.coopcli/config.json` keep working — reading them outlives writing them.
+
 
+Plan a project as a DAG of **specs** and **user stories** on a React Flow canvas, and generate OpenSpec changes per spec card. Local-only: the server binds to 127.0.0.1 and model calls run with your own Anthropic credentials.
 ```bash
 npx @coopcli/specplan ./openspec
 ```
@@ -15,12 +17,10 @@ npx @coopcli/specplan ./openspec
 - **Layered YAML storage** — the DAG lives at `<root>/specplan.yaml`, plus one `specplan.yaml` per change directory (stories, dependencies, generation hash). Comments in hand-edited files survive round trips; the filesystem is the source of truth.
 
 ## CLI
-
 ```
 specplan [rootDir] [--port <n>]           # launch the browser app (default ./openspec, port 8789)
 specplan generate <specId> [rootDir]      # headless generation; exit non-zero on strict-validation failure
 specplan validate [rootDir]               # schema + acyclicity + story-formula check, named errors
-specplan login [--profile] [--web-url]    # CoopCLI account (browser OAuth, ~/.coopcli/config.json)
 ```
 
 ## Credentials
@@ -39,7 +39,6 @@ Chat and generation need Anthropic credentials on the machine — `ANTHROPIC_API
 | `@` references don't find your files | The `@` scope is the directory you launched `specplan` from, not the plan root — launch from the repo root |
 
 ## Development (repo)
-
 ```bash
 pnpm --filter @coopcli/specplan dev      # vite HMR (:5173-ish) + API on :8789
 pnpm --filter @coopcli/specplan check    # tsc

package/dist/cli/index.js

@@ -2,10 +2,10 @@
 
 // server/cli.ts
 import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync as readdirSync5 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, extname, join as join14, normalize as normalize2, resolve as resolve6 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname7, extname, join as join13, normalize as normalize2, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseArgs as parseArgs2 } from "node:util";
+import { parseArgs } from "node:util";
 import { serve } from "@hono/node-server";
 import Anthropic from "@anthropic-ai/sdk";
 
@@ -3431,728 +3431,6 @@ ${renderPlanContext(chatPlan, statuses)}`;
   return app;
 }
 
-// server/login.ts
-import { parseArgs } from "node:util";
-
-// ../shared/src/cli-config.ts
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { homedir as homedir2, hostname } from "node:os";
-import { join as join12, dirname as dirname7 } from "node:path";
-
-// ../shared/src/schemas.ts
-import { z as z5 } from "zod";
-var planTierSchema = z5.enum(["hobby", "squad", "org"]);
-var jurisdictionSchema = z5.enum(["eu", "fedramp"]);
-var locationHintSchema = z5.enum([
-  "wnam",
-  "enam",
-  "weur",
-  "eeur",
-  "apac",
-  "oc",
-  "afr",
-  "me",
-  "sam"
-]);
-var sessionNameSchema = z5.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Session name must be lowercase alphanumeric with hyphens, starting with a letter or digit"
-);
-var teamNameSchema = z5.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Team name must be lowercase alphanumeric with hyphens"
-);
-var messageKindSchema = z5.enum(["text", "context", "request", "system"]);
-var messageContentSchema = z5.object({
-  kind: messageKindSchema,
-  // No .max() here: the 10 000-char body limit is business logic owned by the
-  // SessionActor (MAX_BODY_BYTES), which rejects with 413 MESSAGE_TOO_LARGE on
-  // both REST and WS. A schema cap would pre-empt it as a generic 400.
-  body: z5.string().min(1),
-  // Two-arg z.record: identical semantics in zod 3, required form in zod 4
-  // (specsketch bundles this file against zod 4 — keep every construct dual-safe).
-  metadata: z5.record(z5.string(), z5.unknown()).optional()
-});
-var createTeamInputSchema = z5.object({
-  name: teamNameSchema
-});
-var createSessionInputSchema = z5.object({
-  name: sessionNameSchema,
-  teamId: z5.string().optional(),
-  jurisdiction: jurisdictionSchema.optional(),
-  locationHint: locationHintSchema.optional()
-});
-var sendMessageInputSchema = z5.object({
-  content: messageContentSchema
-});
-var inviteInputSchema = z5.object({
-  email: z5.string().email(),
-  role: z5.enum(["admin", "member"]).default("member")
-});
-var joinTeamInputSchema = z5.object({
-  inviteCode: z5.string().min(1)
-});
-var markReadInputSchema = z5.object({
-  notificationIds: z5.array(z5.string().min(1))
-});
-var pollQuerySchema = z5.object({
-  since: z5.string().optional(),
-  limit: z5.coerce.number().int().min(1).max(100).default(50),
-  session: z5.string().optional()
-});
-var messagesQuerySchema = z5.object({
-  cursor: z5.string().optional(),
-  limit: z5.coerce.number().int().min(1).max(100).default(50)
-});
-var teamTypeSchema = z5.enum(["personal", "shared"]);
-var teamRoleSchema = z5.enum(["owner", "admin", "member"]);
-var accessPermissionSchema = z5.enum(["read", "write", "admin"]);
-var accessGrantInputSchema = z5.object({
-  userId: z5.string().min(1),
-  sessionName: sessionNameSchema.nullable().default(null),
-  // null = general
-  permission: accessPermissionSchema
-});
-var machineIdSchema = z5.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Machine ID must be lowercase alphanumeric with hyphens, starting with a letter or digit"
-);
-var clerkProfileInputSchema = z5.object({
-  email: z5.string().email().nullable(),
-  displayName: z5.string().min(1).max(100),
-  avatarUrl: z5.string().url().nullable(),
-  provider: z5.string().min(1).max(50),
-  providerUserId: z5.string().min(1).max(100)
-});
-var sessionEnrollmentSchema = z5.object({
-  sessionId: z5.string(),
-  team: z5.string(),
-  teamName: z5.string().optional(),
-  key: z5.string().startsWith("api_"),
-  enrolledAt: z5.string().datetime(),
-  apiUrl: z5.string().url().optional(),
-  machineId: z5.string().optional()
-});
-var authConfigSchema = z5.object({
-  key: z5.string().startsWith("api_"),
-  userId: z5.string().min(1),
-  displayName: z5.string().nullable().optional().default(null),
-  email: z5.string().email().nullable(),
-  machineId: z5.string().nullable(),
-  authenticatedAt: z5.string().datetime()
-});
-var configBaseFields = {
-  apiUrl: z5.string().url(),
-  machineId: z5.string().nullable(),
-  sessions: z5.record(z5.string(), sessionEnrollmentSchema),
-  defaults: z5.object({
-    team: z5.string().nullable(),
-    session: z5.string().nullable()
-  }),
-  poll: z5.object({
-    lastPollAt: z5.string().datetime().nullable()
-  })
-};
-var coopConfigV1Schema = z5.object({
-  version: z5.literal(1),
-  ...configBaseFields
-});
-var coopConfigV2Schema = z5.object({
-  version: z5.literal(2),
-  ...configBaseFields,
-  auth: authConfigSchema.optional()
-});
-var profileNameSchema = z5.string().regex(
-  /^[a-z0-9][a-z0-9_-]{0,63}$/,
-  "Profile name must be lowercase alphanumeric with dashes/underscores, max 64 chars"
-);
-var coopProfileSchema = z5.object({
-  apiUrl: z5.string().url(),
-  auth: authConfigSchema.optional(),
-  sessions: z5.record(z5.string(), sessionEnrollmentSchema),
-  defaults: z5.object({
-    team: z5.string().nullable(),
-    session: z5.string().nullable()
-  }),
-  poll: z5.object({
-    lastPollAt: z5.string().datetime().nullable()
-  })
-});
-var coopConfigV3ObjectSchema = z5.object({
-  version: z5.literal(3),
-  machineId: z5.string().nullable(),
-  defaultProfile: z5.string(),
-  profiles: z5.record(profileNameSchema, coopProfileSchema)
-});
-function requireDefaultProfilePointer(config, ctx) {
-  if (!(config.defaultProfile in config.profiles)) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["defaultProfile"],
-      message: `defaultProfile "${config.defaultProfile}" does not name an existing profile`
-    });
-  }
-}
-var coopConfigV3Schema = coopConfigV3ObjectSchema.superRefine(
-  requireDefaultProfilePointer
-);
-var coopConfigSchema = z5.discriminatedUnion("version", [
-  coopConfigV1Schema,
-  coopConfigV2Schema,
-  coopConfigV3ObjectSchema
-]).superRefine((config, ctx) => {
-  if (config.version === 3) {
-    requireDefaultProfilePointer(config, ctx);
-  }
-});
-var hookStdinSchema = z5.object({
-  session_id: z5.string().optional(),
-  cwd: z5.string().optional(),
-  hook_event_name: z5.string().optional()
-}).passthrough();
-var wsClientMessageSchema = z5.discriminatedUnion("type", [
-  z5.object({ type: z5.literal("message"), content: messageContentSchema }),
-  z5.object({ type: z5.literal("ack"), data: z5.object({ messageId: z5.string() }) }),
-  z5.object({ type: z5.literal("presence_request") }),
-  z5.object({ type: z5.literal("ping") })
-]);
-var workKindSchema = z5.enum(["implement", "generate"]);
-var workCompletionStatusSchema = z5.enum(["succeeded", "failed"]);
-var poolJoinInputSchema = z5.object({}).passthrough();
-var poolCheckInInputSchema = z5.object({}).passthrough();
-var poolCompleteInputSchema = z5.object({
-  workId: z5.string().min(1),
-  status: workCompletionStatusSchema,
-  resultRef: z5.string().max(512),
-  assignmentSeq: z5.number().int().nonnegative()
-});
-var poolEnqueueInputSchema = z5.object({
-  kind: workKindSchema,
-  source: z5.string().min(1),
-  dedupKey: z5.string().min(1).max(512).optional()
-});
-var poolCancelInputSchema = z5.object({
-  workId: z5.string().min(1)
-});
-
-// ../shared/src/cli-config.ts
-var DEFAULT_CONFIG_DIR = join12(homedir2(), ".coopcli");
-var DEFAULT_CONFIG_PATH = join12(DEFAULT_CONFIG_DIR, "config.json");
-var PROD_API_URL = "https://api.coopcli.com";
-function emptyProfile(apiUrl) {
-  return {
-    apiUrl,
-    sessions: {},
-    defaults: { team: null, session: null },
-    poll: { lastPollAt: null }
-  };
-}
-var DEFAULT_CONFIG = {
-  version: 3,
-  machineId: hostname(),
-  defaultProfile: "default",
-  profiles: { default: emptyProfile(PROD_API_URL) }
-};
-function upgradeToV3(parsed) {
-  if (parsed.version === 3) return parsed;
-  const profile = {
-    apiUrl: parsed.apiUrl,
-    ...parsed.version === 2 && parsed.auth ? { auth: parsed.auth } : {},
-    sessions: parsed.sessions,
-    defaults: parsed.defaults,
-    poll: parsed.poll
-  };
-  return {
-    version: 3,
-    machineId: parsed.machineId,
-    defaultProfile: "default",
-    profiles: { default: profile }
-  };
-}
-function profileFromEnv(env, envVars) {
-  for (const name of envVars) {
-    const value = env[name];
-    if (value) return value;
-  }
-  return null;
-}
-var ConfigStore = class {
-  config = null;
-  selectedProfile = null;
-  configPath;
-  configDir;
-  constructor(configPath) {
-    this.configPath = configPath ?? DEFAULT_CONFIG_PATH;
-    this.configDir = dirname7(this.configPath);
-  }
-  /**
-   * Select the profile this store operates on for the rest of the process
-   * (--profile flag / COOP_PROFILE env). Without a selection, the
-   * defaultProfile pointer applies.
-   */
-  selectProfile(name) {
-    this.selectedProfile = name;
-  }
-  activeProfileName(config) {
-    return this.selectedProfile ?? config.defaultProfile;
-  }
-  view(config) {
-    const profileName = this.activeProfileName(config);
-    const profile = config.profiles[profileName];
-    if (!profile) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${profileName}". Available profiles: ${available}`);
-    }
-    return { profileName, machineId: config.machineId, ...profile };
-  }
-  /** Returns the active-profile view of the previously loaded config. Throws if load() hasn't been called. */
-  cached() {
-    return this.view(this.cachedRaw());
-  }
-  /** Returns the full previously loaded config. Throws if load() hasn't been called. */
-  cachedRaw() {
-    if (this.config === null) {
-      throw new Error("Config not loaded yet. Call load() first.");
-    }
-    return this.config;
-  }
-  /** Load the config file and return the active profile's view. */
-  async load() {
-    return this.view(await this.loadRaw());
-  }
-  /** Load the config file, normalized to v3. Legacy v1/v2 files upgrade in memory (persisted on next save). */
-  async loadRaw() {
-    if (this.config !== null) {
-      return this.config;
-    }
-    try {
-      const raw = await readFile(this.configPath, "utf8");
-      const parsed = upgradeToV3(coopConfigSchema.parse(JSON.parse(raw)));
-      if (!parsed.machineId) {
-        parsed.machineId = hostname();
-      }
-      this.config = parsed;
-      return parsed;
-    } catch (err) {
-      if (isNodeError(err) && err.code === "ENOENT") {
-        this.config = structuredClone(DEFAULT_CONFIG);
-        return this.config;
-      }
-      if (err instanceof SyntaxError || err?.name === "ZodError") {
-        throw new Error(`Config file (${this.configPath}) is corrupt. Reset with: rm ${this.configPath}`);
-      }
-      throw err;
-    }
-  }
-  async save(config) {
-    await mkdir(this.configDir, { recursive: true, mode: 448 });
-    const content = JSON.stringify(config, null, 2);
-    const tmpPath = this.configPath + ".tmp";
-    await writeFile(tmpPath, content, { mode: 384 });
-    const { rename } = await import("node:fs/promises");
-    await rename(tmpPath, this.configPath);
-    try {
-      await chmod(this.configPath, 384);
-    } catch {
-    }
-    this.config = config;
-  }
-  /** Load, transform the active profile, and save — the single write path for profile-scoped state. */
-  async saveProfile(mutate) {
-    const config = await this.loadRaw();
-    const name = this.activeProfileName(config);
-    const profile = config.profiles[name];
-    if (!profile) {
-      throw new Error(`Profile "${name}" not found in config (${this.configPath})`);
-    }
-    await this.save({
-      ...config,
-      profiles: { ...config.profiles, [name]: mutate(profile) }
-    });
-  }
-  /** Validate config for common misconfigurations. Returns warning strings. */
-  validate() {
-    if (!this.config) return [];
-    let view;
-    try {
-      view = this.view(this.config);
-    } catch {
-      return [];
-    }
-    const warnings = [];
-    try {
-      const url = new URL(view.apiUrl);
-      if (!["http:", "https:"].includes(url.protocol)) {
-        warnings.push(`apiUrl protocol "${url.protocol}" is not http/https`);
-      }
-    } catch {
-      warnings.push(`apiUrl "${view.apiUrl}" is not a valid URL`);
-    }
-    if (this.selectedProfile === null && (view.apiUrl.includes("localhost") || view.apiUrl.includes("127.0.0.1"))) {
-      warnings.push(
-        `profile "${view.profileName}" points to localhost \u2014 select it explicitly with --profile, or run coop login`
-      );
-    }
-    return warnings;
-  }
-  async enrollSession(name, enrollment) {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      sessions: { ...profile.sessions, [name]: enrollment }
-    }));
-  }
-  async unenrollSession(name) {
-    await this.saveProfile((profile) => {
-      const sessions = { ...profile.sessions };
-      delete sessions[name];
-      const defaults = { ...profile.defaults };
-      if (defaults.session === name) {
-        defaults.session = null;
-      }
-      return { ...profile, sessions, defaults };
-    });
-  }
-  async setDefault(key, value) {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      defaults: { ...profile.defaults, [key]: value }
-    }));
-  }
-  async getDefaultSession() {
-    const view = await this.load();
-    return view.defaults.session;
-  }
-  async getSessionKey(sessionName) {
-    const view = await this.load();
-    const enrollment = view.sessions[sessionName];
-    if (!enrollment) {
-      throw new Error(`Not enrolled in session "${sessionName}". Join it first.`);
-    }
-    return enrollment.key;
-  }
-  /** Resolve the API URL for a session, falling back to the active profile's apiUrl. */
-  async getApiUrl(sessionName) {
-    const view = await this.load();
-    if (sessionName) {
-      const enrollment = view.sessions[sessionName];
-      if (enrollment?.apiUrl) return enrollment.apiUrl;
-    }
-    return view.apiUrl;
-  }
-  /** Resolve the machine ID for a session, falling back to the global machineId or the profile's auth. */
-  async getMachineId(sessionName) {
-    const view = await this.load();
-    if (sessionName) {
-      const enrollment = view.sessions[sessionName];
-      if (enrollment?.machineId) return enrollment.machineId;
-    }
-    if (view.machineId) return view.machineId;
-    if (view.auth?.machineId) return view.auth.machineId;
-    return null;
-  }
-  async setMachineId(machineId) {
-    const config = await this.loadRaw();
-    await this.save({ ...config, machineId });
-  }
-  /** Set the active profile's API base URL. */
-  async setApiUrl(apiUrl) {
-    await this.saveProfile((profile) => ({ ...profile, apiUrl }));
-  }
-  /** Create the active profile (empty, at the given endpoint) if it does not exist yet. */
-  async ensureActiveProfile(apiUrl) {
-    const config = await this.loadRaw();
-    const name = this.activeProfileName(config);
-    if (config.profiles[name]) return;
-    await this.save({
-      ...config,
-      profiles: { ...config.profiles, [name]: emptyProfile(apiUrl) }
-    });
-  }
-  /** Re-point the defaultProfile fallback. The target must exist. */
-  async setDefaultProfile(name) {
-    const config = await this.loadRaw();
-    if (!config.profiles[name]) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
-    }
-    await this.save({ ...config, defaultProfile: name });
-  }
-  /** True if any profile holds an auth block (used to detect the first login). */
-  async hasAnyAuth() {
-    const config = await this.loadRaw();
-    return Object.values(config.profiles).some((profile) => profile.auth !== void 0);
-  }
-  /**
-   * Remove a profile including its credentials and enrollments. The
-   * defaultProfile pointer target cannot be deleted — re-point first.
-   */
-  async deleteProfile(name) {
-    const config = await this.loadRaw();
-    if (!config.profiles[name]) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
-    }
-    if (config.defaultProfile === name) {
-      throw new Error(
-        `Profile "${name}" is the default profile. Re-point it first: coop profile set-default <other>`
-      );
-    }
-    const profiles = { ...config.profiles };
-    delete profiles[name];
-    await this.save({ ...config, profiles });
-  }
-  async updateLastPoll() {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      poll: { lastPollAt: (/* @__PURE__ */ new Date()).toISOString() }
-    }));
-  }
-  /** Returns true if the active profile has an auth block. */
-  isAuthenticated() {
-    if (this.config === null) return false;
-    return this.view(this.config).auth !== void 0;
-  }
-  /** Returns the user-scoped API key, or throws if not authenticated. */
-  getAuthKey() {
-    const auth = this.config === null ? void 0 : this.view(this.config).auth;
-    if (!auth) {
-      throw new Error("Not authenticated. Run `coop login` first.");
-    }
-    return auth.key;
-  }
-  /** Returns the user ID, or throws if not authenticated. */
-  getUserId() {
-    const auth = this.config === null ? void 0 : this.view(this.config).auth;
-    if (!auth) {
-      throw new Error("Not authenticated. Run `coop login` first.");
-    }
-    return auth.userId;
-  }
-  /**
-   * Saves the auth block into the active profile. Legacy v1/v2 files are
-   * normalized to v3 by load(), so the write always persists v3.
-   */
-  async setAuth(auth) {
-    await this.saveProfile((profile) => ({ ...profile, auth }));
-  }
-  /**
-   * Returns true if the user should be nudged to run `coop login`:
-   * the active profile has no auth block.
-   */
-  needsLoginNudge() {
-    if (this.config === null) return true;
-    return this.view(this.config).auth === void 0;
-  }
-  /**
-   * Removes the auth block from the active profile (for `coop logout`).
-   * Sessions are preserved.
-   */
-  async clearAuth() {
-    await this.saveProfile((profile) => {
-      const { auth: _removed, ...rest } = profile;
-      return rest;
-    });
-  }
-};
-function isNodeError(err) {
-  return err instanceof Error && "code" in err;
-}
-
-// ../shared/src/cli-auth.ts
-import { exec } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { hostname as hostname2 } from "node:os";
-import { URL as URL2 } from "node:url";
-function resolveDisplayName(name, email, userId) {
-  if (name && !name.startsWith("user_")) return name;
-  if (email) return email.split("@")[0];
-  if (userId) return userId.slice(0, 12);
-  if (name) return name.slice(0, 12);
-  return "unknown";
-}
-async function openBrowser(url) {
-  const escaped = url.replace(/"/g, '\\"');
-  const cmd = process.platform === "darwin" ? `open "${escaped}"` : process.platform === "win32" ? `start "" "${escaped}"` : `xdg-open "${escaped}"`;
-  return new Promise((resolve7) => {
-    exec(cmd, () => resolve7());
-  });
-}
-var PAGE_STYLE = "body{background:#0f0f0f;color:#e8e8e8;font-family:system-ui;display:flex;justify-content:center;padding-top:4rem}";
-function htmlPage(title, body) {
-  return `<!DOCTYPE html><html><head><title>${title}</title><style>${PAGE_STYLE}</style></head><body><div><h2>${title}</h2><p>${body}</p></div></body></html>`;
-}
-function startLocalhostServer(options) {
-  const timeout = options.timeout ?? 12e4;
-  const loginCommand = options.loginCommand ?? "coop login";
-  return new Promise((resolveServer, rejectServer) => {
-    let resolveCallback;
-    let rejectCallback;
-    const callbackPromise = new Promise((res, rej) => {
-      resolveCallback = res;
-      rejectCallback = rej;
-    });
-    const timer = setTimeout(() => {
-      rejectCallback(new Error(`Login timed out. No browser callback received. Check your browser and try \`${loginCommand}\` again.`));
-      server.close();
-    }, timeout);
-    const server = createServer((req, res) => {
-      const url = new URL2(req.url ?? "/", `http://127.0.0.1`);
-      if (url.pathname === "/") {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(htmlPage("Waiting for Authentication", `This page was opened by <code>${loginCommand}</code>. Complete sign-in in the browser window.`));
-        return;
-      }
-      if (url.pathname === "/callback") {
-        const state = url.searchParams.get("state") ?? "";
-        if (state !== options.expectedState) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("State Mismatch", `Possible CSRF attack. Try <code>${loginCommand}</code> again.`));
-          return;
-        }
-        const key = url.searchParams.get("key") ?? "";
-        if (!key) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("Missing Key", `No API key received. Try <code>${loginCommand}</code> again.`));
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(htmlPage("Authentication Complete", "You can close this tab."));
-        clearTimeout(timer);
-        resolveCallback({
-          key,
-          userId: url.searchParams.get("userId") ?? "",
-          email: url.searchParams.get("email") ?? "",
-          displayName: url.searchParams.get("displayName") ?? "",
-          state,
-          apiUrl: url.searchParams.get("apiUrl") ?? ""
-        });
-        return;
-      }
-      res.writeHead(404, { "Content-Type": "text/plain" });
-      res.end("Not Found");
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveServer({
-        port,
-        close: () => {
-          clearTimeout(timer);
-          server.close();
-        },
-        waitForCallback: () => callbackPromise
-      });
-    });
-    server.on("error", (err) => {
-      clearTimeout(timer);
-      rejectServer(err);
-    });
-  });
-}
-function deriveApiUrl(webUrl) {
-  const url = new URL2(webUrl);
-  if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-    return "http://localhost:8788";
-  }
-  return `https://api.${url.hostname}`;
-}
-async function login(input, deps) {
-  const state = randomBytes(16).toString("hex");
-  const machineId = input.machine ?? hostname2();
-  const log = deps.log ?? ((message) => void process.stderr.write(message));
-  const server = await startLocalhostServer({ expectedState: state, loginCommand: input.loginCommand });
-  try {
-    const webUrl = input.webUrl ?? "https://coopcli.com";
-    const authUrl = `${webUrl}/cli-auth?port=${server.port}&state=${state}&machine=${encodeURIComponent(machineId)}`;
-    log(`Opening browser for authentication...
-`);
-    await deps.openBrowser(authUrl);
-    log(`Waiting for callback on port ${server.port}...
-`);
-    const params = await server.waitForCallback();
-    const displayName = resolveDisplayName(params.displayName, params.email, params.userId);
-    const resolvedApiUrl = input.apiUrl ?? (params.apiUrl || deriveApiUrl(webUrl));
-    const isFirstLogin = !await deps.config.hasAnyAuth();
-    await deps.config.ensureActiveProfile(resolvedApiUrl);
-    await deps.config.setAuth({
-      key: params.key,
-      userId: params.userId,
-      displayName,
-      email: params.email || null,
-      machineId,
-      authenticatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const config = await deps.config.load();
-    if (params.apiUrl && config.apiUrl && params.apiUrl !== config.apiUrl) {
-      log(
-        `
-Backend mismatch: you authenticated against ${params.apiUrl}
-  but your config points to ${config.apiUrl}
-  Updating config to ${resolvedApiUrl}
-
-`
-      );
-    }
-    if (resolvedApiUrl !== config.apiUrl) {
-      await deps.config.setApiUrl(resolvedApiUrl);
-    }
-    if (isFirstLogin) {
-      await deps.config.setDefaultProfile(config.profileName);
-    }
-    return {
-      userId: params.userId,
-      email: params.email || null,
-      displayName
-    };
-  } finally {
-    server.close();
-  }
-}
-
-// server/login.ts
-var LOGIN_USAGE = `Usage: specplan login [--profile <name>] [--web-url <url>]
-
-Opens your browser to sign in to CoopCLI and saves credentials to
-~/.coopcli/config.json \u2014 the same file and format \`coop login\` uses.
-
---profile   config profile to log into (default: SPECPLAN_COOP_PROFILE,
-            then COOP_PROFILE, then the config's default profile). A profile
-            that doesn't exist yet is created.
---web-url   web app URL for browser auth (default: https://coopcli.com)`;
-var LoginUsageError = class extends Error {
-};
-function parseLoginArgs(argv) {
-  let parsed;
-  try {
-    parsed = parseArgs({
-      args: argv,
-      options: { profile: { type: "string" }, "web-url": { type: "string" } },
-      allowPositionals: true
-    });
-  } catch (err) {
-    throw new LoginUsageError(err instanceof Error ? err.message : String(err));
-  }
-  if (parsed.positionals.length > 0) {
-    throw new LoginUsageError(`unexpected argument: ${parsed.positionals[0]}`);
-  }
-  return {
-    profile: parsed.values.profile ?? null,
-    ...parsed.values["web-url"] !== void 0 ? { webUrl: parsed.values["web-url"] } : {}
-  };
-}
-async function runLogin(args, deps = {}) {
-  const env = deps.env ?? process.env;
-  const config = deps.config ?? new ConfigStore();
-  const profile = args.profile ?? profileFromEnv(env, ["SPECPLAN_COOP_PROFILE", "COOP_PROFILE"]);
-  if (profile) config.selectProfile(profile);
-  const result = await login(
-    { webUrl: args.webUrl, loginCommand: "specplan login" },
-    { config, openBrowser: deps.openBrowser ?? openBrowser }
-  );
-  (deps.log ?? console.log)(`Authenticated as ${result.email ?? result.userId}. Credentials saved.`);
-}
-
 // server/validate.ts
 function collectTreeErrors(rootDir) {
   const store = new PlanStore(rootDir);
@@ -4203,7 +3481,7 @@ function validateCommand(rootDir, log = console.log, logError = console.error) {
 }
 
 // server/workspace.ts
-import { join as join13, resolve as resolve5 } from "node:path";
+import { join as join12, resolve as resolve5 } from "node:path";
 var SIDECAR_FILE = "specplan-ui.json";
 var PlanWorkspace = class {
   /** Resolved openspec root directory. */
@@ -4217,7 +3495,7 @@ var PlanWorkspace = class {
   }
   // ── Sidecar ──────────────────────────────────────────────────────────────
   readSidecar() {
-    const raw = this.fsx.readIfExists(join13(this.dir, SIDECAR_FILE));
+    const raw = this.fsx.readIfExists(join12(this.dir, SIDECAR_FILE));
     if (!raw) return {};
     try {
       return JSON.parse(raw);
@@ -4232,7 +3510,7 @@ var PlanWorkspace = class {
     delete next.positions;
     next.createdAt ??= now;
     next.updatedAt = now;
-    this.fsx.writeAtomicFile(join13(this.dir, SIDECAR_FILE), JSON.stringify(next, null, 2));
+    this.fsx.writeAtomicFile(join12(this.dir, SIDECAR_FILE), JSON.stringify(next, null, 2));
   }
   readModel() {
     return this.readSidecar().model;
@@ -4280,13 +3558,12 @@ var PlanWorkspace = class {
 };
 
 // server/cli.ts
-var CLI_VERSION = true ? "2026.09.02.1" : "dev";
+var CLI_VERSION = true ? "2026.09.04.1" : "dev";
 var USAGE = `Usage: specplan [rootDir] [--port <n>]
        specplan --version
        specplan generate <specId> [rootDir]
        specplan apply <proposalId> [rootDir] [--confirm-hand-edit]
        specplan validate [rootDir]
-       specplan login [--profile <name>] [--web-url <url>]
 
   specplan                       # plan ./openspec in the browser
   specplan ../other-repo/openspec --port 9000
@@ -4307,9 +3584,7 @@ Pass --confirm-hand-edit to fold a body edited since it was last generated.
 
 validate checks the plan files (schema, acyclicity, containment, story
 formula, id references) and exits non-zero with named errors.
-
-login authenticates this machine against your CoopCLI account (opens a
-browser, saves credentials to ~/.coopcli/config.json).`;
+`;
 var UsageError = class extends Error {
 };
 var DEFAULT_ROOT_DIR = "./openspec";
@@ -4376,7 +3651,7 @@ ${USAGE}`
 function parseCliArgs(argv) {
   let parsed;
   try {
-    parsed = parseArgs2({
+    parsed = parseArgs({
       args: argv,
       options: { port: { type: "string" } },
       allowPositionals: true
@@ -4417,15 +3692,15 @@ var MIME = {
   ".woff": "font/woff"
 };
 function resolveClientDir(moduleUrl) {
-  const here = dirname8(fileURLToPath(moduleUrl));
+  const here = dirname7(fileURLToPath(moduleUrl));
   const candidates = [
-    join14(here, "..", "client"),
+    join13(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join14(here, "..", "dist", "client")
+    join13(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync7(join14(dir, "index.html"))) return dir;
+    if (existsSync7(join13(dir, "index.html"))) return dir;
   }
   return null;
 }
@@ -4433,7 +3708,7 @@ function staticResponse(clientDir, pathname) {
   const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
   const target = resolve6(clientDir, rel === "" ? "index.html" : rel);
   if (!target.startsWith(resolve6(clientDir))) return null;
-  const file = existsSync7(target) && extname(target) ? target : join14(clientDir, "index.html");
+  const file = existsSync7(target) && extname(target) ? target : join13(clientDir, "index.html");
   if (!existsSync7(file)) return null;
   return new Response(readFileSync5(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
@@ -4447,11 +3722,11 @@ but chat and "Generate OpenSpec" need one of:
   \u2022 or the Anthropic CLI's login profile (no key handling needed):
       brew install anthropics/tap/ant   # macOS
       ant auth login`;
-function detectCredentialSource(env = process.env, home = homedir3()) {
+function detectCredentialSource(env = process.env, home = homedir2()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join14(home, ".config", "anthropic", "credentials");
+    const dir = join13(home, ".config", "anthropic", "credentials");
     if (readdirSync5(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }
@@ -4471,26 +3746,6 @@ async function main(argv) {
     return;
   }
   preflight();
-  if (argv[0] === "login") {
-    let loginArgs;
-    try {
-      loginArgs = parseLoginArgs(argv.slice(1));
-    } catch (err) {
-      console.error(
-        err instanceof LoginUsageError ? `specplan: ${err.message}
-
-${LOGIN_USAGE}` : err
-      );
-      process.exit(1);
-    }
-    try {
-      await runLogin(loginArgs);
-    } catch (err) {
-      console.error(`specplan: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    }
-    return;
-  }
   if (argv[0] === "validate") {
     const [rootDir = DEFAULT_ROOT_DIR, ...rest] = argv.slice(1);
     if (rest.length > 0 || rootDir.startsWith("-")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coopcli/specplan",
-  "version": "2026.902.1",
+  "version": "2026.904.1",
   "description": "coopcli specplan \u2014 plan your project as a DAG of specs and user stories on a React Flow canvas, generate OpenSpec changes per spec card. Local-only.",
   "type": "module",
   "bin": {