@coopcli/specsketch 2026.902.1 → 2026.904.1

package/README.md

@@ -1,5 +1,8 @@
 # coopcli specsketch
 
+> **There is no login command.** The CLI logins were retired (`retire-cli-login`): the browser flow opens `/cli-auth` on an origin whose Clerk instance moved to specsesh.com, so it cannot complete. Credentials already in `~/.coopcli/config.json` keep working — reading them outlives writing them.
+
+
 Draw the system. Get the spec.
 
 An Excalidraw canvas that turns architecture diagrams into **OpenSpec** change proposals —
@@ -8,7 +11,6 @@ them, ready for an implementing agent. Local-only: the server binds to 127.0.0.1
 generation runs with your own Anthropic credentials.
 
 ## Quick start
-
 ```bash
 npx @coopcli/specsketch ./openspec/changes/new-feature-change
 # or: npm install -g @coopcli/specsketch && specsketch ./openspec/changes/new-feature-change
@@ -16,7 +18,6 @@ npx @coopcli/specsketch ./openspec/changes/new-feature-change
 
 Open the printed URL, draw labeled boxes and arrows (loose text becomes design notes), and
 press **Generate Spec**. The change directory is the workspace:
-
 ```
 openspec/changes/new-feature-change/
 ├── diagram.excalidraw      ← the drawing, autosaved, agent-readable
@@ -103,10 +104,8 @@ The right-hand panel has a menu with three options:
   ```
 
 ## CLI reference
-
 ```
 specsketch <path-to-openspec-change-dir> [--port <n>] [--share]
-specsketch login [--profile <name>] [--web-url <url>]
 ```
 
 - The directory is created if it doesn't exist; its basename becomes the change name.
@@ -121,9 +120,7 @@ specsketch login [--profile <name>] [--web-url <url>]
   retention.
 
 ## Shared sessions (`--share`)
-
 ```bash
-specsketch login                                                 # once per machine
 specsketch ./openspec/changes/new-feature-change --share
 ```
 
@@ -135,8 +132,6 @@ live pill with the participant count and a copy-link button.
 
 Worth knowing:
 
-- The host needs a CoopCLI account (`specsketch login` — opens a browser, saves
-  credentials to `~/.coopcli/config.json`, the same file `coop login` writes); guests
   never do. The link itself is the capability: anyone holding it can view **and edit**
   until the session ends. The server stores only a hash of the link token.
 - The local server still binds to 127.0.0.1 only — sharing runs over a single outbound
@@ -158,7 +153,7 @@ Worth knowing:
 | "Node NN detected — specsketch needs Node >= 22" | Upgrade Node (https://nodejs.org) |
 | Port already in use | Handled automatically — the server moves to the next free port and prints it; `--port <n>` sets the preferred starting port |
 | Regeneration changed a file you hand-edited | Expected when the drawing implicates it — the diagram is the source of truth; use `git diff`/`git checkout` to recover, and keep change dirs in version control |
-| `--share` says it needs login | Run `specsketch login` once on the hosting machine; `--profile` selects a non-default CoopCLI config profile |
+
 | Share link says it no longer works | The host ended the session (Ctrl-C) or it idled out — ask for a fresh link |
 
 More: [product page](https://coopcli.com/products/specsketch) ·

package/dist/cli/index.js

@@ -2,10 +2,10 @@
 
 // server/cli.ts
 import { existsSync as existsSync10, readFileSync as readFileSync8, readdirSync as readdirSync8 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname6, extname, join as join12, normalize as normalize2, resolve as resolve4 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname5, extname, join as join11, normalize as normalize2, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseArgs as parseArgs2 } from "node:util";
+import { parseArgs } from "node:util";
 import { serve } from "@hono/node-server";
 import Anthropic from "@anthropic-ai/sdk";
 
@@ -1181,730 +1181,6 @@ ${refContext}` : "");
   return app;
 }
 
-// ../shared/src/cli-auth.ts
-import { exec } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { hostname as hostname2 } from "node:os";
-import { URL as URL2 } from "node:url";
-
-// ../shared/src/cli-config.ts
-import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
-import { homedir as homedir2, hostname } from "node:os";
-import { join as join3, dirname } from "node:path";
-
-// ../shared/src/schemas.ts
-import { z as z3 } from "zod";
-var planTierSchema = z3.enum(["hobby", "squad", "org"]);
-var jurisdictionSchema = z3.enum(["eu", "fedramp"]);
-var locationHintSchema = z3.enum([
-  "wnam",
-  "enam",
-  "weur",
-  "eeur",
-  "apac",
-  "oc",
-  "afr",
-  "me",
-  "sam"
-]);
-var sessionNameSchema = z3.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Session name must be lowercase alphanumeric with hyphens, starting with a letter or digit"
-);
-var teamNameSchema = z3.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Team name must be lowercase alphanumeric with hyphens"
-);
-var messageKindSchema = z3.enum(["text", "context", "request", "system"]);
-var messageContentSchema = z3.object({
-  kind: messageKindSchema,
-  // No .max() here: the 10 000-char body limit is business logic owned by the
-  // SessionActor (MAX_BODY_BYTES), which rejects with 413 MESSAGE_TOO_LARGE on
-  // both REST and WS. A schema cap would pre-empt it as a generic 400.
-  body: z3.string().min(1),
-  // Two-arg z.record: identical semantics in zod 3, required form in zod 4
-  // (specsketch bundles this file against zod 4 — keep every construct dual-safe).
-  metadata: z3.record(z3.string(), z3.unknown()).optional()
-});
-var createTeamInputSchema = z3.object({
-  name: teamNameSchema
-});
-var createSessionInputSchema = z3.object({
-  name: sessionNameSchema,
-  teamId: z3.string().optional(),
-  jurisdiction: jurisdictionSchema.optional(),
-  locationHint: locationHintSchema.optional()
-});
-var sendMessageInputSchema = z3.object({
-  content: messageContentSchema
-});
-var inviteInputSchema = z3.object({
-  email: z3.string().email(),
-  role: z3.enum(["admin", "member"]).default("member")
-});
-var joinTeamInputSchema = z3.object({
-  inviteCode: z3.string().min(1)
-});
-var markReadInputSchema = z3.object({
-  notificationIds: z3.array(z3.string().min(1))
-});
-var pollQuerySchema = z3.object({
-  since: z3.string().optional(),
-  limit: z3.coerce.number().int().min(1).max(100).default(50),
-  session: z3.string().optional()
-});
-var messagesQuerySchema = z3.object({
-  cursor: z3.string().optional(),
-  limit: z3.coerce.number().int().min(1).max(100).default(50)
-});
-var teamTypeSchema = z3.enum(["personal", "shared"]);
-var teamRoleSchema = z3.enum(["owner", "admin", "member"]);
-var accessPermissionSchema = z3.enum(["read", "write", "admin"]);
-var accessGrantInputSchema = z3.object({
-  userId: z3.string().min(1),
-  sessionName: sessionNameSchema.nullable().default(null),
-  // null = general
-  permission: accessPermissionSchema
-});
-var machineIdSchema = z3.string().min(1).max(63).regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "Machine ID must be lowercase alphanumeric with hyphens, starting with a letter or digit"
-);
-var clerkProfileInputSchema = z3.object({
-  email: z3.string().email().nullable(),
-  displayName: z3.string().min(1).max(100),
-  avatarUrl: z3.string().url().nullable(),
-  provider: z3.string().min(1).max(50),
-  providerUserId: z3.string().min(1).max(100)
-});
-var sessionEnrollmentSchema = z3.object({
-  sessionId: z3.string(),
-  team: z3.string(),
-  teamName: z3.string().optional(),
-  key: z3.string().startsWith("api_"),
-  enrolledAt: z3.string().datetime(),
-  apiUrl: z3.string().url().optional(),
-  machineId: z3.string().optional()
-});
-var authConfigSchema = z3.object({
-  key: z3.string().startsWith("api_"),
-  userId: z3.string().min(1),
-  displayName: z3.string().nullable().optional().default(null),
-  email: z3.string().email().nullable(),
-  machineId: z3.string().nullable(),
-  authenticatedAt: z3.string().datetime()
-});
-var configBaseFields = {
-  apiUrl: z3.string().url(),
-  machineId: z3.string().nullable(),
-  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
-  defaults: z3.object({
-    team: z3.string().nullable(),
-    session: z3.string().nullable()
-  }),
-  poll: z3.object({
-    lastPollAt: z3.string().datetime().nullable()
-  })
-};
-var coopConfigV1Schema = z3.object({
-  version: z3.literal(1),
-  ...configBaseFields
-});
-var coopConfigV2Schema = z3.object({
-  version: z3.literal(2),
-  ...configBaseFields,
-  auth: authConfigSchema.optional()
-});
-var profileNameSchema = z3.string().regex(
-  /^[a-z0-9][a-z0-9_-]{0,63}$/,
-  "Profile name must be lowercase alphanumeric with dashes/underscores, max 64 chars"
-);
-var coopProfileSchema = z3.object({
-  apiUrl: z3.string().url(),
-  auth: authConfigSchema.optional(),
-  sessions: z3.record(z3.string(), sessionEnrollmentSchema),
-  defaults: z3.object({
-    team: z3.string().nullable(),
-    session: z3.string().nullable()
-  }),
-  poll: z3.object({
-    lastPollAt: z3.string().datetime().nullable()
-  })
-});
-var coopConfigV3ObjectSchema = z3.object({
-  version: z3.literal(3),
-  machineId: z3.string().nullable(),
-  defaultProfile: z3.string(),
-  profiles: z3.record(profileNameSchema, coopProfileSchema)
-});
-function requireDefaultProfilePointer(config, ctx) {
-  if (!(config.defaultProfile in config.profiles)) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["defaultProfile"],
-      message: `defaultProfile "${config.defaultProfile}" does not name an existing profile`
-    });
-  }
-}
-var coopConfigV3Schema = coopConfigV3ObjectSchema.superRefine(
-  requireDefaultProfilePointer
-);
-var coopConfigSchema = z3.discriminatedUnion("version", [
-  coopConfigV1Schema,
-  coopConfigV2Schema,
-  coopConfigV3ObjectSchema
-]).superRefine((config, ctx) => {
-  if (config.version === 3) {
-    requireDefaultProfilePointer(config, ctx);
-  }
-});
-var hookStdinSchema = z3.object({
-  session_id: z3.string().optional(),
-  cwd: z3.string().optional(),
-  hook_event_name: z3.string().optional()
-}).passthrough();
-var wsClientMessageSchema = z3.discriminatedUnion("type", [
-  z3.object({ type: z3.literal("message"), content: messageContentSchema }),
-  z3.object({ type: z3.literal("ack"), data: z3.object({ messageId: z3.string() }) }),
-  z3.object({ type: z3.literal("presence_request") }),
-  z3.object({ type: z3.literal("ping") })
-]);
-var workKindSchema = z3.enum(["implement", "generate"]);
-var workCompletionStatusSchema = z3.enum(["succeeded", "failed"]);
-var poolJoinInputSchema = z3.object({}).passthrough();
-var poolCheckInInputSchema = z3.object({}).passthrough();
-var poolCompleteInputSchema = z3.object({
-  workId: z3.string().min(1),
-  status: workCompletionStatusSchema,
-  resultRef: z3.string().max(512),
-  assignmentSeq: z3.number().int().nonnegative()
-});
-var poolEnqueueInputSchema = z3.object({
-  kind: workKindSchema,
-  source: z3.string().min(1),
-  dedupKey: z3.string().min(1).max(512).optional()
-});
-var poolCancelInputSchema = z3.object({
-  workId: z3.string().min(1)
-});
-
-// ../shared/src/cli-config.ts
-var DEFAULT_CONFIG_DIR = join3(homedir2(), ".coopcli");
-var DEFAULT_CONFIG_PATH = join3(DEFAULT_CONFIG_DIR, "config.json");
-var PROD_API_URL = "https://api.coopcli.com";
-function emptyProfile(apiUrl) {
-  return {
-    apiUrl,
-    sessions: {},
-    defaults: { team: null, session: null },
-    poll: { lastPollAt: null }
-  };
-}
-var DEFAULT_CONFIG = {
-  version: 3,
-  machineId: hostname(),
-  defaultProfile: "default",
-  profiles: { default: emptyProfile(PROD_API_URL) }
-};
-function upgradeToV3(parsed) {
-  if (parsed.version === 3) return parsed;
-  const profile = {
-    apiUrl: parsed.apiUrl,
-    ...parsed.version === 2 && parsed.auth ? { auth: parsed.auth } : {},
-    sessions: parsed.sessions,
-    defaults: parsed.defaults,
-    poll: parsed.poll
-  };
-  return {
-    version: 3,
-    machineId: parsed.machineId,
-    defaultProfile: "default",
-    profiles: { default: profile }
-  };
-}
-function profileFromEnv(env, envVars) {
-  for (const name of envVars) {
-    const value = env[name];
-    if (value) return value;
-  }
-  return null;
-}
-var ConfigStore = class {
-  config = null;
-  selectedProfile = null;
-  configPath;
-  configDir;
-  constructor(configPath) {
-    this.configPath = configPath ?? DEFAULT_CONFIG_PATH;
-    this.configDir = dirname(this.configPath);
-  }
-  /**
-   * Select the profile this store operates on for the rest of the process
-   * (--profile flag / COOP_PROFILE env). Without a selection, the
-   * defaultProfile pointer applies.
-   */
-  selectProfile(name) {
-    this.selectedProfile = name;
-  }
-  activeProfileName(config) {
-    return this.selectedProfile ?? config.defaultProfile;
-  }
-  view(config) {
-    const profileName = this.activeProfileName(config);
-    const profile = config.profiles[profileName];
-    if (!profile) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${profileName}". Available profiles: ${available}`);
-    }
-    return { profileName, machineId: config.machineId, ...profile };
-  }
-  /** Returns the active-profile view of the previously loaded config. Throws if load() hasn't been called. */
-  cached() {
-    return this.view(this.cachedRaw());
-  }
-  /** Returns the full previously loaded config. Throws if load() hasn't been called. */
-  cachedRaw() {
-    if (this.config === null) {
-      throw new Error("Config not loaded yet. Call load() first.");
-    }
-    return this.config;
-  }
-  /** Load the config file and return the active profile's view. */
-  async load() {
-    return this.view(await this.loadRaw());
-  }
-  /** Load the config file, normalized to v3. Legacy v1/v2 files upgrade in memory (persisted on next save). */
-  async loadRaw() {
-    if (this.config !== null) {
-      return this.config;
-    }
-    try {
-      const raw = await readFile(this.configPath, "utf8");
-      const parsed = upgradeToV3(coopConfigSchema.parse(JSON.parse(raw)));
-      if (!parsed.machineId) {
-        parsed.machineId = hostname();
-      }
-      this.config = parsed;
-      return parsed;
-    } catch (err) {
-      if (isNodeError(err) && err.code === "ENOENT") {
-        this.config = structuredClone(DEFAULT_CONFIG);
-        return this.config;
-      }
-      if (err instanceof SyntaxError || err?.name === "ZodError") {
-        throw new Error(`Config file (${this.configPath}) is corrupt. Reset with: rm ${this.configPath}`);
-      }
-      throw err;
-    }
-  }
-  async save(config) {
-    await mkdir(this.configDir, { recursive: true, mode: 448 });
-    const content = JSON.stringify(config, null, 2);
-    const tmpPath = this.configPath + ".tmp";
-    await writeFile(tmpPath, content, { mode: 384 });
-    const { rename } = await import("node:fs/promises");
-    await rename(tmpPath, this.configPath);
-    try {
-      await chmod(this.configPath, 384);
-    } catch {
-    }
-    this.config = config;
-  }
-  /** Load, transform the active profile, and save — the single write path for profile-scoped state. */
-  async saveProfile(mutate) {
-    const config = await this.loadRaw();
-    const name = this.activeProfileName(config);
-    const profile = config.profiles[name];
-    if (!profile) {
-      throw new Error(`Profile "${name}" not found in config (${this.configPath})`);
-    }
-    await this.save({
-      ...config,
-      profiles: { ...config.profiles, [name]: mutate(profile) }
-    });
-  }
-  /** Validate config for common misconfigurations. Returns warning strings. */
-  validate() {
-    if (!this.config) return [];
-    let view;
-    try {
-      view = this.view(this.config);
-    } catch {
-      return [];
-    }
-    const warnings = [];
-    try {
-      const url = new URL(view.apiUrl);
-      if (!["http:", "https:"].includes(url.protocol)) {
-        warnings.push(`apiUrl protocol "${url.protocol}" is not http/https`);
-      }
-    } catch {
-      warnings.push(`apiUrl "${view.apiUrl}" is not a valid URL`);
-    }
-    if (this.selectedProfile === null && (view.apiUrl.includes("localhost") || view.apiUrl.includes("127.0.0.1"))) {
-      warnings.push(
-        `profile "${view.profileName}" points to localhost \u2014 select it explicitly with --profile, or run coop login`
-      );
-    }
-    return warnings;
-  }
-  async enrollSession(name, enrollment) {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      sessions: { ...profile.sessions, [name]: enrollment }
-    }));
-  }
-  async unenrollSession(name) {
-    await this.saveProfile((profile) => {
-      const sessions = { ...profile.sessions };
-      delete sessions[name];
-      const defaults = { ...profile.defaults };
-      if (defaults.session === name) {
-        defaults.session = null;
-      }
-      return { ...profile, sessions, defaults };
-    });
-  }
-  async setDefault(key, value) {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      defaults: { ...profile.defaults, [key]: value }
-    }));
-  }
-  async getDefaultSession() {
-    const view = await this.load();
-    return view.defaults.session;
-  }
-  async getSessionKey(sessionName) {
-    const view = await this.load();
-    const enrollment = view.sessions[sessionName];
-    if (!enrollment) {
-      throw new Error(`Not enrolled in session "${sessionName}". Join it first.`);
-    }
-    return enrollment.key;
-  }
-  /** Resolve the API URL for a session, falling back to the active profile's apiUrl. */
-  async getApiUrl(sessionName) {
-    const view = await this.load();
-    if (sessionName) {
-      const enrollment = view.sessions[sessionName];
-      if (enrollment?.apiUrl) return enrollment.apiUrl;
-    }
-    return view.apiUrl;
-  }
-  /** Resolve the machine ID for a session, falling back to the global machineId or the profile's auth. */
-  async getMachineId(sessionName) {
-    const view = await this.load();
-    if (sessionName) {
-      const enrollment = view.sessions[sessionName];
-      if (enrollment?.machineId) return enrollment.machineId;
-    }
-    if (view.machineId) return view.machineId;
-    if (view.auth?.machineId) return view.auth.machineId;
-    return null;
-  }
-  async setMachineId(machineId) {
-    const config = await this.loadRaw();
-    await this.save({ ...config, machineId });
-  }
-  /** Set the active profile's API base URL. */
-  async setApiUrl(apiUrl) {
-    await this.saveProfile((profile) => ({ ...profile, apiUrl }));
-  }
-  /** Create the active profile (empty, at the given endpoint) if it does not exist yet. */
-  async ensureActiveProfile(apiUrl) {
-    const config = await this.loadRaw();
-    const name = this.activeProfileName(config);
-    if (config.profiles[name]) return;
-    await this.save({
-      ...config,
-      profiles: { ...config.profiles, [name]: emptyProfile(apiUrl) }
-    });
-  }
-  /** Re-point the defaultProfile fallback. The target must exist. */
-  async setDefaultProfile(name) {
-    const config = await this.loadRaw();
-    if (!config.profiles[name]) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
-    }
-    await this.save({ ...config, defaultProfile: name });
-  }
-  /** True if any profile holds an auth block (used to detect the first login). */
-  async hasAnyAuth() {
-    const config = await this.loadRaw();
-    return Object.values(config.profiles).some((profile) => profile.auth !== void 0);
-  }
-  /**
-   * Remove a profile including its credentials and enrollments. The
-   * defaultProfile pointer target cannot be deleted — re-point first.
-   */
-  async deleteProfile(name) {
-    const config = await this.loadRaw();
-    if (!config.profiles[name]) {
-      const available = Object.keys(config.profiles).join(", ");
-      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
-    }
-    if (config.defaultProfile === name) {
-      throw new Error(
-        `Profile "${name}" is the default profile. Re-point it first: coop profile set-default <other>`
-      );
-    }
-    const profiles = { ...config.profiles };
-    delete profiles[name];
-    await this.save({ ...config, profiles });
-  }
-  async updateLastPoll() {
-    await this.saveProfile((profile) => ({
-      ...profile,
-      poll: { lastPollAt: (/* @__PURE__ */ new Date()).toISOString() }
-    }));
-  }
-  /** Returns true if the active profile has an auth block. */
-  isAuthenticated() {
-    if (this.config === null) return false;
-    return this.view(this.config).auth !== void 0;
-  }
-  /** Returns the user-scoped API key, or throws if not authenticated. */
-  getAuthKey() {
-    const auth = this.config === null ? void 0 : this.view(this.config).auth;
-    if (!auth) {
-      throw new Error("Not authenticated. Run `coop login` first.");
-    }
-    return auth.key;
-  }
-  /** Returns the user ID, or throws if not authenticated. */
-  getUserId() {
-    const auth = this.config === null ? void 0 : this.view(this.config).auth;
-    if (!auth) {
-      throw new Error("Not authenticated. Run `coop login` first.");
-    }
-    return auth.userId;
-  }
-  /**
-   * Saves the auth block into the active profile. Legacy v1/v2 files are
-   * normalized to v3 by load(), so the write always persists v3.
-   */
-  async setAuth(auth) {
-    await this.saveProfile((profile) => ({ ...profile, auth }));
-  }
-  /**
-   * Returns true if the user should be nudged to run `coop login`:
-   * the active profile has no auth block.
-   */
-  needsLoginNudge() {
-    if (this.config === null) return true;
-    return this.view(this.config).auth === void 0;
-  }
-  /**
-   * Removes the auth block from the active profile (for `coop logout`).
-   * Sessions are preserved.
-   */
-  async clearAuth() {
-    await this.saveProfile((profile) => {
-      const { auth: _removed, ...rest } = profile;
-      return rest;
-    });
-  }
-};
-function isNodeError(err) {
-  return err instanceof Error && "code" in err;
-}
-
-// ../shared/src/cli-auth.ts
-function resolveDisplayName(name, email, userId) {
-  if (name && !name.startsWith("user_")) return name;
-  if (email) return email.split("@")[0];
-  if (userId) return userId.slice(0, 12);
-  if (name) return name.slice(0, 12);
-  return "unknown";
-}
-async function openBrowser(url) {
-  const escaped = url.replace(/"/g, '\\"');
-  const cmd = process.platform === "darwin" ? `open "${escaped}"` : process.platform === "win32" ? `start "" "${escaped}"` : `xdg-open "${escaped}"`;
-  return new Promise((resolve5) => {
-    exec(cmd, () => resolve5());
-  });
-}
-var PAGE_STYLE = "body{background:#0f0f0f;color:#e8e8e8;font-family:system-ui;display:flex;justify-content:center;padding-top:4rem}";
-function htmlPage(title, body) {
-  return `<!DOCTYPE html><html><head><title>${title}</title><style>${PAGE_STYLE}</style></head><body><div><h2>${title}</h2><p>${body}</p></div></body></html>`;
-}
-function startLocalhostServer(options) {
-  const timeout = options.timeout ?? 12e4;
-  const loginCommand = options.loginCommand ?? "coop login";
-  return new Promise((resolveServer, rejectServer) => {
-    let resolveCallback;
-    let rejectCallback;
-    const callbackPromise = new Promise((res, rej) => {
-      resolveCallback = res;
-      rejectCallback = rej;
-    });
-    const timer = setTimeout(() => {
-      rejectCallback(new Error(`Login timed out. No browser callback received. Check your browser and try \`${loginCommand}\` again.`));
-      server.close();
-    }, timeout);
-    const server = createServer((req, res) => {
-      const url = new URL2(req.url ?? "/", `http://127.0.0.1`);
-      if (url.pathname === "/") {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(htmlPage("Waiting for Authentication", `This page was opened by <code>${loginCommand}</code>. Complete sign-in in the browser window.`));
-        return;
-      }
-      if (url.pathname === "/callback") {
-        const state = url.searchParams.get("state") ?? "";
-        if (state !== options.expectedState) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("State Mismatch", `Possible CSRF attack. Try <code>${loginCommand}</code> again.`));
-          return;
-        }
-        const key = url.searchParams.get("key") ?? "";
-        if (!key) {
-          res.writeHead(400, { "Content-Type": "text/html" });
-          res.end(htmlPage("Missing Key", `No API key received. Try <code>${loginCommand}</code> again.`));
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(htmlPage("Authentication Complete", "You can close this tab."));
-        clearTimeout(timer);
-        resolveCallback({
-          key,
-          userId: url.searchParams.get("userId") ?? "",
-          email: url.searchParams.get("email") ?? "",
-          displayName: url.searchParams.get("displayName") ?? "",
-          state,
-          apiUrl: url.searchParams.get("apiUrl") ?? ""
-        });
-        return;
-      }
-      res.writeHead(404, { "Content-Type": "text/plain" });
-      res.end("Not Found");
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr ? addr.port : 0;
-      resolveServer({
-        port,
-        close: () => {
-          clearTimeout(timer);
-          server.close();
-        },
-        waitForCallback: () => callbackPromise
-      });
-    });
-    server.on("error", (err) => {
-      clearTimeout(timer);
-      rejectServer(err);
-    });
-  });
-}
-function deriveApiUrl(webUrl) {
-  const url = new URL2(webUrl);
-  if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-    return "http://localhost:8788";
-  }
-  return `https://api.${url.hostname}`;
-}
-async function login(input, deps) {
-  const state = randomBytes(16).toString("hex");
-  const machineId = input.machine ?? hostname2();
-  const log = deps.log ?? ((message) => void process.stderr.write(message));
-  const server = await startLocalhostServer({ expectedState: state, loginCommand: input.loginCommand });
-  try {
-    const webUrl = input.webUrl ?? "https://coopcli.com";
-    const authUrl = `${webUrl}/cli-auth?port=${server.port}&state=${state}&machine=${encodeURIComponent(machineId)}`;
-    log(`Opening browser for authentication...
-`);
-    await deps.openBrowser(authUrl);
-    log(`Waiting for callback on port ${server.port}...
-`);
-    const params = await server.waitForCallback();
-    const displayName = resolveDisplayName(params.displayName, params.email, params.userId);
-    const resolvedApiUrl = input.apiUrl ?? (params.apiUrl || deriveApiUrl(webUrl));
-    const isFirstLogin = !await deps.config.hasAnyAuth();
-    await deps.config.ensureActiveProfile(resolvedApiUrl);
-    await deps.config.setAuth({
-      key: params.key,
-      userId: params.userId,
-      displayName,
-      email: params.email || null,
-      machineId,
-      authenticatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    const config = await deps.config.load();
-    if (params.apiUrl && config.apiUrl && params.apiUrl !== config.apiUrl) {
-      log(
-        `
-Backend mismatch: you authenticated against ${params.apiUrl}
-  but your config points to ${config.apiUrl}
-  Updating config to ${resolvedApiUrl}
-
-`
-      );
-    }
-    if (resolvedApiUrl !== config.apiUrl) {
-      await deps.config.setApiUrl(resolvedApiUrl);
-    }
-    if (isFirstLogin) {
-      await deps.config.setDefaultProfile(config.profileName);
-    }
-    return {
-      userId: params.userId,
-      email: params.email || null,
-      displayName
-    };
-  } finally {
-    server.close();
-  }
-}
-
-// server/login.ts
-import { parseArgs } from "node:util";
-var LOGIN_USAGE = `Usage: specsketch login [--profile <name>] [--web-url <url>]
-
-Opens your browser to sign in to CoopCLI and saves credentials to
-~/.coopcli/config.json \u2014 the same file and format \`coop login\` uses.
-
---profile   config profile to log into (default: SPECSKETCH_COOP_PROFILE,
-            then COOP_PROFILE, then the config's default profile). A profile
-            that doesn't exist yet is created.
---web-url   web app URL for browser auth (default: https://coopcli.com)`;
-var LoginUsageError = class extends Error {
-};
-function parseLoginArgs(argv) {
-  let parsed;
-  try {
-    parsed = parseArgs({
-      args: argv,
-      options: { profile: { type: "string" }, "web-url": { type: "string" } },
-      allowPositionals: true
-    });
-  } catch (err) {
-    throw new LoginUsageError(err instanceof Error ? err.message : String(err));
-  }
-  if (parsed.positionals.length > 0) {
-    throw new LoginUsageError(`unexpected argument: ${parsed.positionals[0]}`);
-  }
-  return {
-    profile: parsed.values.profile ?? null,
-    ...parsed.values["web-url"] !== void 0 ? { webUrl: parsed.values["web-url"] } : {}
-  };
-}
-async function runLogin(args, deps = {}) {
-  const env = deps.env ?? process.env;
-  const config = deps.config ?? new ConfigStore();
-  const profile = args.profile ?? profileFromEnv(env, ["SPECSKETCH_COOP_PROFILE", "COOP_PROFILE"]);
-  if (profile) config.selectProfile(profile);
-  const result = await login(
-    { webUrl: args.webUrl, loginCommand: "specsketch login" },
-    // Forward the writer too, so a caller supplying one gets ALL of login's output
-    // rather than just this command's closing line (issue #1).
-    { config, openBrowser: deps.openBrowser ?? openBrowser, log: deps.log }
-  );
-  (deps.log ?? console.log)(`Authenticated as ${result.email ?? result.userId}. Credentials saved.`);
-}
-
 // server/workspace.ts
 import { createHash as createHash2 } from "node:crypto";
 import {
@@ -1915,20 +1191,20 @@ import {
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+import { basename as basename2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
 
 // ../shared/src/openspec-change-meta.ts
 import { createHash } from "node:crypto";
 import { existsSync as existsSync3, readdirSync as readdirSync3, realpathSync as realpathSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 import { Document, parseDocument } from "yaml";
-import { z as z4 } from "zod";
+import { z as z3 } from "zod";
 
 // ../shared/src/fs-atomic.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname } from "node:path";
 function writeAtomicFile(target, content) {
-  mkdirSync(dirname2(target), { recursive: true });
+  mkdirSync(dirname(target), { recursive: true });
   const tmp = `${target}.tmp`;
   writeFileSync(tmp, content, "utf8");
   renameSync(tmp, target);
@@ -1964,12 +1240,12 @@ var sha256 = (s) => createHash("sha256").update(s).digest("hex");
 function listBodyFiles(changeDir, fsx = nodeChangeMetaFs) {
   const files = [];
   for (const name of ["proposal.md", "design.md", "tasks.md"]) {
-    if (fsx.exists(join4(changeDir, name))) files.push(name);
+    if (fsx.exists(join3(changeDir, name))) files.push(name);
   }
-  const specsDir = join4(changeDir, "specs");
+  const specsDir = join3(changeDir, "specs");
   for (const entry of fsx.readdir(specsDir).sort((a, b) => a.name.localeCompare(b.name))) {
-    const rel = join4("specs", entry.name, "spec.md");
-    if (entry.directory && fsx.exists(join4(changeDir, rel))) files.push(rel);
+    const rel = join3("specs", entry.name, "spec.md");
+    if (entry.directory && fsx.exists(join3(changeDir, rel))) files.push(rel);
   }
   return files;
 }
@@ -1978,24 +1254,24 @@ function bodyHash(changeDir, fsx = nodeChangeMetaFs) {
   if (files.length === 0) return null;
   const parts = files.map(
     (rel) => `${rel}
-${sha256(fsx.readIfExists(join4(changeDir, rel)) ?? "")}`
+${sha256(fsx.readIfExists(join3(changeDir, rel)) ?? "")}`
   );
   return `sha256:${sha256(parts.join("\n"))}`;
 }
 var SPEC_STATUSES = ["draft", "in-progress"];
-var SpecStatus = z4.enum(SPEC_STATUSES);
+var SpecStatus = z3.enum(SPEC_STATUSES);
 var LEGACY_STATUS_COERCION = {
   active: "in-progress",
   done: "in-progress",
   deferred: "draft"
 };
-var StoredSpecStatus = z4.enum([...SPEC_STATUSES, "active", "done", "deferred"]).transform(
+var StoredSpecStatus = z3.enum([...SPEC_STATUSES, "active", "done", "deferred"]).transform(
   (s) => s in LEGACY_STATUS_COERCION ? LEGACY_STATUS_COERCION[s] : s
 );
-var SpecMetaSchema = z4.object({
-  specId: z4.string(),
-  userStories: z4.array(z4.string()),
-  dependencies: z4.array(z4.string()),
+var SpecMetaSchema = z3.object({
+  specId: z3.string(),
+  userStories: z3.array(z3.string()),
+  dependencies: z3.array(z3.string()),
   /** Working state (retired values coerce on read); absent = draft. */
   status: StoredSpecStatus.optional(),
   /**
@@ -2004,18 +1280,18 @@ var SpecMetaSchema = z4.object({
    * into specs/ and archived (apply-first: the fold happens at approval).
    * Absent = not-approved.
    */
-  approved: z4.boolean().optional(),
+  approved: z3.boolean().optional(),
   /**
    * Legacy spelling of the fold axis (pre-rename metadata files). Read-only
    * compatibility: readers treat `applied: true` as `approved: true`; no
    * writer ever sets this field again.
    */
-  applied: z4.boolean().optional(),
+  applied: z3.boolean().optional(),
   /**
    * Build flag — user-set, independent of the fold: true once the code has
    * been built to match the approved diff. Absent = not-implemented.
    */
-  implemented: z4.boolean().optional(),
+  implemented: z3.boolean().optional(),
   /**
    * Minimal implementation-task record written on fold (specplan-timeline-apply
    * "Implementation task record on fold"): the creation time and a reference to
@@ -2024,18 +1300,18 @@ var SpecMetaSchema = z4.object({
    * state — task execution/dispatch is a separate, not-yet-defined concern. A
    * field addition to this sidecar, not a redefinition of its format.
    */
-  task: z4.object({
-    createdAt: z4.string(),
-    source: z4.string()
+  task: z3.object({
+    createdAt: z3.string(),
+    source: z3.string()
   }).optional(),
-  generation: z4.object({
+  generation: z3.object({
     /** sha256 of the last generated body files — detects hand edits. */
-    lastGeneratedBodyHash: z4.string(),
-    lastGeneratedAt: z4.string()
+    lastGeneratedBodyHash: z3.string(),
+    lastGeneratedAt: z3.string()
   }).optional()
 });
 function writeChangeMeta(fsx, changeDir, meta) {
-  const path = join4(changeDir, CHANGE_META_FILE);
+  const path = join3(changeDir, CHANGE_META_FILE);
   const raw = fsx.readIfExists(path);
   const doc = raw === void 0 ? new Document({
     specId: meta.specId,
@@ -2078,14 +1354,14 @@ var ChangeWorkspace = class {
     if (options.create !== false) mkdirSync2(this.dir, { recursive: true });
   }
   writeAtomic(relPath, content) {
-    const target = join5(this.dir, relPath);
-    mkdirSync2(dirname3(target), { recursive: true });
+    const target = join4(this.dir, relPath);
+    mkdirSync2(dirname2(target), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync2(tmp, content, "utf8");
     renameSync2(tmp, target);
   }
   readIfExists(relPath) {
-    const target = join5(this.dir, relPath);
+    const target = join4(this.dir, relPath);
     return existsSync4(target) ? readFileSync3(target, "utf8") : void 0;
   }
   // ── Scene ────────────────────────────────────────────────────────────────
@@ -2147,11 +1423,11 @@ var ChangeWorkspace = class {
   /** Current artifact files, however they were authored. */
   readArtifacts() {
     const specs = [];
-    const specsDir = join5(this.dir, "specs");
+    const specsDir = join4(this.dir, "specs");
     if (existsSync4(specsDir)) {
       for (const entry of readdirSync4(specsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const spec = this.readIfExists(join5("specs", entry.name, "spec.md"));
+        const spec = this.readIfExists(join4("specs", entry.name, "spec.md"));
         if (spec !== void 0) specs.push({ capability: entry.name, spec });
       }
     }
@@ -2185,7 +1461,7 @@ var ChangeWorkspace = class {
       "design.md": bundle.design,
       "tasks.md": bundle.tasks
     };
-    for (const s of bundle.specs) files[join5("specs", s.capability, "spec.md")] = s.spec;
+    for (const s of bundle.specs) files[join4("specs", s.capability, "spec.md")] = s.spec;
     const written = [];
     const manifest = {};
     for (const [relPath, content] of Object.entries(files)) {
@@ -2236,11 +1512,11 @@ var ChangeWorkspace = class {
 
 // server/workbench-host.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname5, join as join11, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, join as join10, resolve as resolve3 } from "node:path";
 
 // src/workbench/core/capability-store.ts
 import { readFileSync as readFileSync4, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { join as join5 } from "node:path";
 
 // src/workbench/core/spec-parse.ts
 var REQUIREMENT_HEADING = /^###[ \t]+Requirement:[ \t]*(.*)$/;
@@ -2382,8 +1658,8 @@ function readIfPresent(path) {
   return readFileSync4(path, "utf8");
 }
 function createFoldedSpecReader(repoRoot) {
-  const specsDir = join6(repoRoot, "openspec", "specs");
-  const specPath = (name) => join6(specsDir, name, SPEC_FILE);
+  const specsDir = join5(repoRoot, "openspec", "specs");
+  const specPath = (name) => join5(specsDir, name, SPEC_FILE);
   const readCapability = (name) => {
     const invalid = validateCapabilityName(name);
     if (invalid) throw new RangeError(invalid);
@@ -2512,22 +1788,22 @@ function agentRailProfile() {
 
 // src/workbench/agent/credential-probe.ts
 import { existsSync as existsSync5, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { delimiter, join as join7 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { delimiter, join as join6 } from "node:path";
 function claudeOnPath(env) {
   const path = env["PATH"];
   if (path === void 0 || path === "") return false;
   for (const dir of path.split(delimiter)) {
     if (dir === "") continue;
     try {
-      if (statSync3(join7(dir, "claude")).isFile()) return true;
+      if (statSync3(join6(dir, "claude")).isFile()) return true;
     } catch {
     }
   }
   return false;
 }
 function antAuthProfile(home) {
-  const dir = join7(home, ".config", "anthropic", "credentials");
+  const dir = join6(home, ".config", "anthropic", "credentials");
   try {
     return readdirSync6(dir).some((f) => f.endsWith(".json")) ? "token" : "empty-profile";
   } catch {
@@ -2535,7 +1811,7 @@ function antAuthProfile(home) {
   }
 }
 function subscriptionStatus(home, installed) {
-  if (existsSync5(join7(home, ".claude", ".credentials.json"))) return { kind: "available" };
+  if (existsSync5(join6(home, ".claude", ".credentials.json"))) return { kind: "available" };
   return {
     kind: "unavailable",
     reason: installed ? "installed-not-authenticated" : "not-installed"
@@ -2564,7 +1840,7 @@ function antAuthStatus(env, home) {
 }
 function probeMachineCredentials(input = {}) {
   const env = input.env ?? process.env;
-  const home = input.home ?? homedir3();
+  const home = input.home ?? homedir2();
   const installed = input.claudeInstalled ?? claudeOnPath(env);
   const rejected = new Set(input.rejected ?? []);
   const statuses = {
@@ -2664,7 +1940,7 @@ async function runRailTurn(input, deps = {}) {
 }
 
 // src/workbench/agent/tools.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 var ROOT_ARTIFACTS = ["proposal.md", "design.md", "tasks.md"];
 var SPEC_ARTIFACT = /^specs\/([a-z0-9]+(?:-[a-z0-9]+)*)\/spec\.md$/;
 var AGENT_PROPOSAL_TOOLS = [
@@ -2681,22 +1957,22 @@ var AGENT_PROPOSAL_TOOLS = [
     description: "Propose a requirement, appended to a delta spec. `capability` must be one the change already has a delta spec for. `block` must be full markdown: a `### Requirement:` heading, RFC-2119 SHALL text, and at least one `#### Scenario:` with WHEN/THEN steps."
   }
 ];
-var proposalCall = z5.object({
-  tool: z5.enum(AGENT_PROPOSAL_TOOLS.map((t) => t.name)).describe("Which kind of edit to propose."),
-  artifact: z5.string().optional().describe("edit_artifact: the artifact this edit is against."),
-  mode: z5.string().optional().describe("edit_artifact: `replace` or `append`. Defaults to append."),
-  text: z5.string().optional().describe("edit_artifact: the markdown, exactly as it should read."),
-  title: z5.string().optional().describe("add_task_group: the group heading."),
-  tasks: z5.array(z5.string()).optional().describe("add_task_group: task titles, one per task, each one concrete action."),
-  capability: z5.string().optional().describe("add_requirement: the delta spec\u2019s capability. add_task_group: the citation\u2019s."),
-  requirement: z5.string().optional().describe("add_task_group: the exact requirement name, as it appears after `### Requirement:`."),
-  block: z5.string().optional().describe("add_requirement: the complete requirement block, in markdown.")
+var proposalCall = z4.object({
+  tool: z4.enum(AGENT_PROPOSAL_TOOLS.map((t) => t.name)).describe("Which kind of edit to propose."),
+  artifact: z4.string().optional().describe("edit_artifact: the artifact this edit is against."),
+  mode: z4.string().optional().describe("edit_artifact: `replace` or `append`. Defaults to append."),
+  text: z4.string().optional().describe("edit_artifact: the markdown, exactly as it should read."),
+  title: z4.string().optional().describe("add_task_group: the group heading."),
+  tasks: z4.array(z4.string()).optional().describe("add_task_group: task titles, one per task, each one concrete action."),
+  capability: z4.string().optional().describe("add_requirement: the delta spec\u2019s capability. add_task_group: the citation\u2019s."),
+  requirement: z4.string().optional().describe("add_task_group: the exact requirement name, as it appears after `### Requirement:`."),
+  block: z4.string().optional().describe("add_requirement: the complete requirement block, in markdown.")
 });
-var agentTurnResult = z5.object({
-  answer: z5.string().describe("Brief prose for the author: what you proposed and why, or your answer if nothing."),
-  proposals: z5.array(proposalCall).describe("The edits to propose. Empty when the turn only answers.")
+var agentTurnResult = z4.object({
+  answer: z4.string().describe("Brief prose for the author: what you proposed and why, or your answer if nothing."),
+  proposals: z4.array(proposalCall).describe("The edits to propose. Empty when the turn only answers.")
 });
-var AGENT_TURN_SCHEMA = z5.toJSONSchema(agentTurnResult, {
+var AGENT_TURN_SCHEMA = z4.toJSONSchema(agentTurnResult, {
   target: "draft-7"
 });
 function knownArtifacts(shape) {
@@ -2901,7 +2177,7 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { dirname as dirname4, join as join8 } from "node:path";
+import { dirname as dirname3, join as join7 } from "node:path";
 
 // src/workbench/shell/lifecycle.ts
 var SPEC_DRIVEN = Object.freeze({
@@ -2941,7 +2217,7 @@ function resolveSchema(yamlText, known = [SPEC_DRIVEN]) {
 
 // server/change-files.ts
 function changeDirectory(repoRoot, changeId) {
-  return join8(repoRoot, "openspec", "changes", changeId);
+  return join7(repoRoot, "openspec", "changes", changeId);
 }
 var ROOT_ARTIFACTS2 = Object.freeze(["proposal.md", "design.md", "tasks.md"]);
 var CAPABILITY = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -2977,7 +2253,7 @@ function readArtifact(changeDir, name, io = REAL_IO) {
   if (artifact === null) {
     return { outcome: "refused", artifact: name, reason: notAnArtifact(name) };
   }
-  const path = join8(changeDir, artifact);
+  const path = join7(changeDir, artifact);
   let size;
   try {
     const stat = statSync4(path);
@@ -3011,17 +2287,17 @@ function readArtifact(changeDir, name, io = REAL_IO) {
 function listArtifacts(changeDir) {
   const found = [];
   for (const name of ROOT_ARTIFACTS2) {
-    if (existsSync6(join8(changeDir, name))) found.push(name);
+    if (existsSync6(join7(changeDir, name))) found.push(name);
   }
   let capabilities = [];
   try {
-    capabilities = readdirSync7(join8(changeDir, "specs"), { withFileTypes: true }).filter((e) => e.isDirectory() && CAPABILITY.test(e.name)).map((e) => e.name).sort();
+    capabilities = readdirSync7(join7(changeDir, "specs"), { withFileTypes: true }).filter((e) => e.isDirectory() && CAPABILITY.test(e.name)).map((e) => e.name).sort();
   } catch {
     capabilities = [];
   }
   for (const capability of capabilities) {
     const artifact = `specs/${capability}/spec.md`;
-    if (existsSync6(join8(changeDir, artifact))) found.push(artifact);
+    if (existsSync6(join7(changeDir, artifact))) found.push(artifact);
   }
   return found;
 }
@@ -3030,14 +2306,14 @@ function writeArtifact(changeDir, name, content, options = {}) {
   if (artifact === null) {
     return { outcome: "refused", artifact: name, reason: notAnArtifact(name) };
   }
-  const path = join8(changeDir, artifact);
+  const path = join7(changeDir, artifact);
   if (options.expected !== void 0 && options.overwrite !== true) {
     const conflict = conflictWith(path, artifact, options.expected);
     if (conflict) return conflict;
   }
   const materialised = !existsSync6(changeDir);
   try {
-    mkdirSync3(dirname4(path), { recursive: true });
+    mkdirSync3(dirname3(path), { recursive: true });
     writeFileSync3(path, Buffer.from(content, "utf8"));
     writeSchemaFile(changeDir);
   } catch (err) {
@@ -3073,7 +2349,7 @@ function conflictWith(path, artifact, expected) {
   };
 }
 function writeSchemaFile(changeDir) {
-  const path = join8(changeDir, ".openspec.yaml");
+  const path = join7(changeDir, ".openspec.yaml");
   if (existsSync6(path)) return;
   writeFileSync3(path, `schema: ${SPEC_DRIVEN.name}
 `, "utf8");
@@ -3099,7 +2375,7 @@ function describeErrno(artifact, err) {
 // server/openspec-validate.ts
 import { spawnSync } from "node:child_process";
 import { existsSync as existsSync7 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join8 } from "node:path";
 
 // src/workbench/core/validate.ts
 var QUOTED_SUBJECT = /"([^"]+)"/;
@@ -3136,7 +2412,7 @@ function openSpecFindings(issues, changeId = "") {
 
 // server/openspec-validate.ts
 var runOpenSpecValidate = (repoRoot, changeId) => {
-  const local = join9(repoRoot, "node_modules", ".bin", "openspec");
+  const local = join8(repoRoot, "node_modules", ".bin", "openspec");
   const command = existsSync7(local) ? local : "openspec";
   const run = spawnSync(command, ["validate", changeId, "--strict", "--json", "--no-interactive"], {
     cwd: repoRoot,
@@ -3189,13 +2465,13 @@ function validateChangeOnDisk(repoRoot, changeId, run = runOpenSpecValidate) {
 
 // server/approvals.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6, statSync as statSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join9 } from "node:path";
 var SIDECAR = ".specsketch.json";
 var OVERLAY_DECLARATION = "authoring-overlay \u2014 specsketch only, never lifecycle truth";
 var STAGE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var REAL_IO2 = { readText: (path) => readFileSync6(path, "utf8") };
 function readApprovals(changeDir, io = REAL_IO2) {
-  const path = join10(changeDir, SIDECAR);
+  const path = join9(changeDir, SIDECAR);
   let size;
   try {
     const stat = statSync5(path);
@@ -3281,7 +2557,7 @@ function setApproval(changeDir, stage, approved, now = /* @__PURE__ */ new Date(
   else delete next[stage];
   try {
     writeFileSync4(
-      join10(changeDir, SIDECAR),
+      join9(changeDir, SIDECAR),
       `${JSON.stringify({ overlay: OVERLAY_DECLARATION, approvals: next }, null, "	")}
 `,
       "utf8"
@@ -3311,7 +2587,7 @@ function changeContextFor(target, source) {
   let changeText = "";
   if (!target.resuming) return { read, changeText };
   for (const name of ["proposal.md", "tasks.md"]) {
-    const file = join11(target.changeDir, name);
+    const file = join10(target.changeDir, name);
     if (!existsSync9(file)) continue;
     changeText += `
 
@@ -3320,7 +2596,7 @@ ${readFileSync7(file, "utf8")}`;
     read.push(name);
   }
   for (const capability of source.openCapabilities ?? []) {
-    const file = join11(target.changeDir, "specs", capability, "spec.md");
+    const file = join10(target.changeDir, "specs", capability, "spec.md");
     if (!existsSync9(file)) continue;
     changeText += `
 
@@ -3347,8 +2623,8 @@ var WorkbenchHostError = class extends Error {
 function findRepoRoot(start) {
   let dir = resolve3(start);
   for (; ; ) {
-    if (existsSync9(join11(dir, "openspec"))) return dir;
-    const parent = dirname5(dir);
+    if (existsSync9(join10(dir, "openspec"))) return dir;
+    const parent = dirname4(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -3373,7 +2649,7 @@ function resolveTarget(cwd, changeId) {
 }
 function readSchema(target) {
   try {
-    return resolveSchema(readFileSync7(join11(target.changeDir, ".openspec.yaml"), "utf8"));
+    return resolveSchema(readFileSync7(join10(target.changeDir, ".openspec.yaml"), "utf8"));
   } catch {
     return { kind: "unknown-schema", name: "" };
   }
@@ -3500,9 +2776,8 @@ function mountWorkbenchHost(app, options) {
 }
 
 // server/cli.ts
-var CLI_VERSION = true ? "2026.09.02.1" : "dev";
+var CLI_VERSION = true ? "2026.09.04.1" : "dev";
 var USAGE = `Usage: specsketch <change-id> [--port <n>] [--fixture]
-       specsketch login [--profile <name>] [--web-url <url>]
        specsketch --version
 
   specsketch add-user-search
@@ -3527,7 +2802,7 @@ var UsageError = class extends Error {
 function parseCliArgs(argv) {
   let parsed;
   try {
-    parsed = parseArgs2({
+    parsed = parseArgs({
       args: argv,
       options: { port: { type: "string" }, fixture: { type: "boolean" } },
       allowPositionals: true
@@ -3573,15 +2848,15 @@ var MIME = {
   ".woff": "font/woff"
 };
 function resolveClientDir(moduleUrl) {
-  const here = dirname6(fileURLToPath(moduleUrl));
+  const here = dirname5(fileURLToPath(moduleUrl));
   const candidates = [
-    join12(here, "..", "client"),
+    join11(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join12(here, "..", "dist", "client")
+    join11(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync10(join12(dir, "index.html"))) return dir;
+    if (existsSync10(join11(dir, "index.html"))) return dir;
   }
   return null;
 }
@@ -3589,7 +2864,7 @@ function staticResponse(clientDir, pathname) {
   const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
   const target = resolve4(clientDir, rel === "" ? "index.html" : rel);
   if (!target.startsWith(resolve4(clientDir))) return null;
-  const file = existsSync10(target) && extname(target) ? target : join12(clientDir, "index.html");
+  const file = existsSync10(target) && extname(target) ? target : join11(clientDir, "index.html");
   if (!existsSync10(file)) return null;
   return new Response(readFileSync8(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
@@ -3603,11 +2878,11 @@ but "Generate Spec" needs one of:
   \u2022 or the Anthropic CLI's login profile (no key handling needed):
       brew install anthropics/tap/ant   # macOS
       ant auth login`;
-function detectCredentialSource(env = process.env, home = homedir4()) {
+function detectCredentialSource(env = process.env, home = homedir3()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join12(home, ".config", "anthropic", "credentials");
+    const dir = join11(home, ".config", "anthropic", "credentials");
     if (readdirSync8(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }
@@ -3627,26 +2902,6 @@ async function main(argv) {
     return;
   }
   preflight();
-  if (argv[0] === "login") {
-    let loginArgs;
-    try {
-      loginArgs = parseLoginArgs(argv.slice(1));
-    } catch (err) {
-      console.error(
-        err instanceof LoginUsageError ? `specsketch: ${err.message}
-
-${LOGIN_USAGE}` : err
-      );
-      process.exit(1);
-    }
-    try {
-      await runLogin(loginArgs);
-    } catch (err) {
-      console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
-      process.exit(1);
-    }
-    return;
-  }
   let args;
   try {
     args = parseCliArgs(argv);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@coopcli/specsketch",
-	"version": "2026.902.1",
+	"version": "2026.904.1",
 	"description": "coopcli specsketch — draw an architecture diagram, generate an OpenSpec change proposal into your openspec/ change directory. Local-only.",
 	"type": "module",
 	"bin": {