@dosu/cli 0.14.2 → 0.15.1

package/bin/dosu.js

@@ -4341,7 +4341,7 @@ function getSupabaseAnonKey() {
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.14.2";
+var VERSION = "0.15.1";
 
 // src/debug/logger.ts
 import {
@@ -6655,9 +6655,535 @@ var init_skill = __esm(() => {
   import_picocolors10 = __toESM(require_picocolors(), 1);
 });
 
+// src/mcp/constants.ts
+var MCP_PROVIDER_SLUG = "dosu_mcp";
+
+// node_modules/imurmurhash/imurmurhash.js
+var require_imurmurhash = __commonJS((exports, module) => {
+  (function() {
+    var cache;
+    function MurmurHash3(key, seed) {
+      var m2 = this instanceof MurmurHash3 ? this : cache;
+      m2.reset(seed);
+      if (typeof key === "string" && key.length > 0) {
+        m2.hash(key);
+      }
+      if (m2 !== this) {
+        return m2;
+      }
+    }
+    MurmurHash3.prototype.hash = function(key) {
+      var h1, k1, i, top, len;
+      len = key.length;
+      this.len += len;
+      k1 = this.k1;
+      i = 0;
+      switch (this.rem) {
+        case 0:
+          k1 ^= len > i ? key.charCodeAt(i++) & 65535 : 0;
+        case 1:
+          k1 ^= len > i ? (key.charCodeAt(i++) & 65535) << 8 : 0;
+        case 2:
+          k1 ^= len > i ? (key.charCodeAt(i++) & 65535) << 16 : 0;
+        case 3:
+          k1 ^= len > i ? (key.charCodeAt(i) & 255) << 24 : 0;
+          k1 ^= len > i ? (key.charCodeAt(i++) & 65280) >> 8 : 0;
+      }
+      this.rem = len + this.rem & 3;
+      len -= this.rem;
+      if (len > 0) {
+        h1 = this.h1;
+        while (true) {
+          k1 = k1 * 11601 + (k1 & 65535) * 3432906752 & 4294967295;
+          k1 = k1 << 15 | k1 >>> 17;
+          k1 = k1 * 13715 + (k1 & 65535) * 461832192 & 4294967295;
+          h1 ^= k1;
+          h1 = h1 << 13 | h1 >>> 19;
+          h1 = h1 * 5 + 3864292196 & 4294967295;
+          if (i >= len) {
+            break;
+          }
+          k1 = key.charCodeAt(i++) & 65535 ^ (key.charCodeAt(i++) & 65535) << 8 ^ (key.charCodeAt(i++) & 65535) << 16;
+          top = key.charCodeAt(i++);
+          k1 ^= (top & 255) << 24 ^ (top & 65280) >> 8;
+        }
+        k1 = 0;
+        switch (this.rem) {
+          case 3:
+            k1 ^= (key.charCodeAt(i + 2) & 65535) << 16;
+          case 2:
+            k1 ^= (key.charCodeAt(i + 1) & 65535) << 8;
+          case 1:
+            k1 ^= key.charCodeAt(i) & 65535;
+        }
+        this.h1 = h1;
+      }
+      this.k1 = k1;
+      return this;
+    };
+    MurmurHash3.prototype.result = function() {
+      var k1, h1;
+      k1 = this.k1;
+      h1 = this.h1;
+      if (k1 > 0) {
+        k1 = k1 * 11601 + (k1 & 65535) * 3432906752 & 4294967295;
+        k1 = k1 << 15 | k1 >>> 17;
+        k1 = k1 * 13715 + (k1 & 65535) * 461832192 & 4294967295;
+        h1 ^= k1;
+      }
+      h1 ^= this.len;
+      h1 ^= h1 >>> 16;
+      h1 = h1 * 51819 + (h1 & 65535) * 2246770688 & 4294967295;
+      h1 ^= h1 >>> 13;
+      h1 = h1 * 44597 + (h1 & 65535) * 3266445312 & 4294967295;
+      h1 ^= h1 >>> 16;
+      return h1 >>> 0;
+    };
+    MurmurHash3.prototype.reset = function(seed) {
+      this.h1 = typeof seed === "number" ? seed : 0;
+      this.rem = this.k1 = this.len = 0;
+      return this;
+    };
+    cache = new MurmurHash3;
+    if (typeof module != "undefined") {
+      module.exports = MurmurHash3;
+    } else {
+      this.MurmurHash3 = MurmurHash3;
+    }
+  })();
+});
+
+// node_modules/signal-exit/dist/cjs/signals.js
+var require_signals = __commonJS((exports) => {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.signals = undefined;
+  exports.signals = [];
+  exports.signals.push("SIGHUP", "SIGINT", "SIGTERM");
+  if (process.platform !== "win32") {
+    exports.signals.push("SIGALRM", "SIGABRT", "SIGVTALRM", "SIGXCPU", "SIGXFSZ", "SIGUSR2", "SIGTRAP", "SIGSYS", "SIGQUIT", "SIGIOT");
+  }
+  if (process.platform === "linux") {
+    exports.signals.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT");
+  }
+});
+
+// node_modules/signal-exit/dist/cjs/index.js
+var require_cjs = __commonJS((exports) => {
+  var _a;
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.unload = exports.load = exports.onExit = exports.signals = undefined;
+  var signals_js_1 = require_signals();
+  Object.defineProperty(exports, "signals", { enumerable: true, get: function() {
+    return signals_js_1.signals;
+  } });
+  var processOk = (process3) => !!process3 && typeof process3 === "object" && typeof process3.removeListener === "function" && typeof process3.emit === "function" && typeof process3.reallyExit === "function" && typeof process3.listeners === "function" && typeof process3.kill === "function" && typeof process3.pid === "number" && typeof process3.on === "function";
+  var kExitEmitter = Symbol.for("signal-exit emitter");
+  var global = globalThis;
+  var ObjectDefineProperty = Object.defineProperty.bind(Object);
+
+  class Emitter {
+    emitted = {
+      afterExit: false,
+      exit: false
+    };
+    listeners = {
+      afterExit: [],
+      exit: []
+    };
+    count = 0;
+    id = Math.random();
+    constructor() {
+      if (global[kExitEmitter]) {
+        return global[kExitEmitter];
+      }
+      ObjectDefineProperty(global, kExitEmitter, {
+        value: this,
+        writable: false,
+        enumerable: false,
+        configurable: false
+      });
+    }
+    on(ev, fn) {
+      this.listeners[ev].push(fn);
+    }
+    removeListener(ev, fn) {
+      const list = this.listeners[ev];
+      const i = list.indexOf(fn);
+      if (i === -1) {
+        return;
+      }
+      if (i === 0 && list.length === 1) {
+        list.length = 0;
+      } else {
+        list.splice(i, 1);
+      }
+    }
+    emit(ev, code, signal) {
+      if (this.emitted[ev]) {
+        return false;
+      }
+      this.emitted[ev] = true;
+      let ret = false;
+      for (const fn of this.listeners[ev]) {
+        ret = fn(code, signal) === true || ret;
+      }
+      if (ev === "exit") {
+        ret = this.emit("afterExit", code, signal) || ret;
+      }
+      return ret;
+    }
+  }
+
+  class SignalExitBase {
+  }
+  var signalExitWrap = (handler) => {
+    return {
+      onExit(cb, opts) {
+        return handler.onExit(cb, opts);
+      },
+      load() {
+        return handler.load();
+      },
+      unload() {
+        return handler.unload();
+      }
+    };
+  };
+
+  class SignalExitFallback extends SignalExitBase {
+    onExit() {
+      return () => {};
+    }
+    load() {}
+    unload() {}
+  }
+
+  class SignalExit extends SignalExitBase {
+    #hupSig = process2.platform === "win32" ? "SIGINT" : "SIGHUP";
+    #emitter = new Emitter;
+    #process;
+    #originalProcessEmit;
+    #originalProcessReallyExit;
+    #sigListeners = {};
+    #loaded = false;
+    constructor(process3) {
+      super();
+      this.#process = process3;
+      this.#sigListeners = {};
+      for (const sig of signals_js_1.signals) {
+        this.#sigListeners[sig] = () => {
+          const listeners = this.#process.listeners(sig);
+          let { count } = this.#emitter;
+          const p2 = process3;
+          if (typeof p2.__signal_exit_emitter__ === "object" && typeof p2.__signal_exit_emitter__.count === "number") {
+            count += p2.__signal_exit_emitter__.count;
+          }
+          if (listeners.length === count) {
+            this.unload();
+            const ret = this.#emitter.emit("exit", null, sig);
+            const s = sig === "SIGHUP" ? this.#hupSig : sig;
+            if (!ret)
+              process3.kill(process3.pid, s);
+          }
+        };
+      }
+      this.#originalProcessReallyExit = process3.reallyExit;
+      this.#originalProcessEmit = process3.emit;
+    }
+    onExit(cb, opts) {
+      if (!processOk(this.#process)) {
+        return () => {};
+      }
+      if (this.#loaded === false) {
+        this.load();
+      }
+      const ev = opts?.alwaysLast ? "afterExit" : "exit";
+      this.#emitter.on(ev, cb);
+      return () => {
+        this.#emitter.removeListener(ev, cb);
+        if (this.#emitter.listeners["exit"].length === 0 && this.#emitter.listeners["afterExit"].length === 0) {
+          this.unload();
+        }
+      };
+    }
+    load() {
+      if (this.#loaded) {
+        return;
+      }
+      this.#loaded = true;
+      this.#emitter.count += 1;
+      for (const sig of signals_js_1.signals) {
+        try {
+          const fn = this.#sigListeners[sig];
+          if (fn)
+            this.#process.on(sig, fn);
+        } catch (_3) {}
+      }
+      this.#process.emit = (ev, ...a) => {
+        return this.#processEmit(ev, ...a);
+      };
+      this.#process.reallyExit = (code) => {
+        return this.#processReallyExit(code);
+      };
+    }
+    unload() {
+      if (!this.#loaded) {
+        return;
+      }
+      this.#loaded = false;
+      signals_js_1.signals.forEach((sig) => {
+        const listener = this.#sigListeners[sig];
+        if (!listener) {
+          throw new Error("Listener not defined for signal: " + sig);
+        }
+        try {
+          this.#process.removeListener(sig, listener);
+        } catch (_3) {}
+      });
+      this.#process.emit = this.#originalProcessEmit;
+      this.#process.reallyExit = this.#originalProcessReallyExit;
+      this.#emitter.count -= 1;
+    }
+    #processReallyExit(code) {
+      if (!processOk(this.#process)) {
+        return 0;
+      }
+      this.#process.exitCode = code || 0;
+      this.#emitter.emit("exit", this.#process.exitCode, null);
+      return this.#originalProcessReallyExit.call(this.#process, this.#process.exitCode);
+    }
+    #processEmit(ev, ...args) {
+      const og = this.#originalProcessEmit;
+      if (ev === "exit" && processOk(this.#process)) {
+        if (typeof args[0] === "number") {
+          this.#process.exitCode = args[0];
+        }
+        const ret = og.call(this.#process, ev, ...args);
+        this.#emitter.emit("exit", this.#process.exitCode, null);
+        return ret;
+      } else {
+        return og.call(this.#process, ev, ...args);
+      }
+    }
+  }
+  var process2 = globalThis.process;
+  _a = signalExitWrap(processOk(process2) ? new SignalExit(process2) : new SignalExitFallback), exports.onExit = _a.onExit, exports.load = _a.load, exports.unload = _a.unload;
+});
+
+// node_modules/write-file-atomic/lib/index.js
+var require_lib = __commonJS((exports, module) => {
+  var __filename = "/home/runner/work/dosu-cli/dosu-cli/node_modules/write-file-atomic/lib/index.js";
+  module.exports = writeFile;
+  module.exports.sync = writeFileSync4;
+  module.exports._getTmpname = getTmpname;
+  module.exports._cleanupOnExit = cleanupOnExit;
+  var fs = __require("fs");
+  var MurmurHash3 = require_imurmurhash();
+  var { onExit } = require_cjs();
+  var path = __require("path");
+  var { promisify } = __require("util");
+  var activeFiles = {};
+  var threadId = function getId() {
+    try {
+      const workerThreads = __require("worker_threads");
+      return workerThreads.threadId;
+    } catch (e2) {
+      return 0;
+    }
+  }();
+  var invocations = 0;
+  function getTmpname(filename) {
+    return filename + "." + MurmurHash3(__filename).hash(String(process.pid)).hash(String(threadId)).hash(String(++invocations)).result();
+  }
+  function cleanupOnExit(tmpfile) {
+    return () => {
+      try {
+        fs.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
+      } catch {}
+    };
+  }
+  function serializeActiveFile(absoluteName) {
+    return new Promise((resolve) => {
+      if (!activeFiles[absoluteName]) {
+        activeFiles[absoluteName] = [];
+      }
+      activeFiles[absoluteName].push(resolve);
+      if (activeFiles[absoluteName].length === 1) {
+        resolve();
+      }
+    });
+  }
+  function isChownErrOk(err) {
+    if (err.code === "ENOSYS") {
+      return true;
+    }
+    const nonroot = !process.getuid || process.getuid() !== 0;
+    if (nonroot) {
+      if (err.code === "EINVAL" || err.code === "EPERM") {
+        return true;
+      }
+    }
+    return false;
+  }
+  async function writeFileAsync(filename, data, options = {}) {
+    if (typeof options === "string") {
+      options = { encoding: options };
+    }
+    let fd;
+    let tmpfile;
+    const removeOnExitHandler = onExit(cleanupOnExit(() => tmpfile));
+    const absoluteName = path.resolve(filename);
+    try {
+      await serializeActiveFile(absoluteName);
+      const truename = await promisify(fs.realpath)(filename).catch(() => filename);
+      tmpfile = getTmpname(truename);
+      if (!options.mode || !options.chown) {
+        const stats = await promisify(fs.stat)(truename).catch(() => {});
+        if (stats) {
+          if (options.mode == null) {
+            options.mode = stats.mode;
+          }
+          if (options.chown == null && process.getuid) {
+            options.chown = { uid: stats.uid, gid: stats.gid };
+          }
+        }
+      }
+      fd = await promisify(fs.open)(tmpfile, "w", options.mode);
+      if (options.tmpfileCreated) {
+        await options.tmpfileCreated(tmpfile);
+      }
+      if (ArrayBuffer.isView(data)) {
+        await promisify(fs.write)(fd, data, 0, data.length, 0);
+      } else if (data != null) {
+        await promisify(fs.write)(fd, String(data), 0, String(options.encoding || "utf8"));
+      }
+      if (options.fsync !== false) {
+        await promisify(fs.fsync)(fd);
+      }
+      await promisify(fs.close)(fd);
+      fd = null;
+      if (options.chown) {
+        await promisify(fs.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
+          if (!isChownErrOk(err)) {
+            throw err;
+          }
+        });
+      }
+      if (options.mode) {
+        await promisify(fs.chmod)(tmpfile, options.mode).catch((err) => {
+          if (!isChownErrOk(err)) {
+            throw err;
+          }
+        });
+      }
+      await promisify(fs.rename)(tmpfile, truename);
+    } finally {
+      if (fd) {
+        await promisify(fs.close)(fd).catch(() => {});
+      }
+      removeOnExitHandler();
+      await promisify(fs.unlink)(tmpfile).catch(() => {});
+      activeFiles[absoluteName].shift();
+      if (activeFiles[absoluteName].length > 0) {
+        activeFiles[absoluteName][0]();
+      } else {
+        delete activeFiles[absoluteName];
+      }
+    }
+  }
+  async function writeFile(filename, data, options, callback) {
+    if (options instanceof Function) {
+      callback = options;
+      options = {};
+    }
+    const promise = writeFileAsync(filename, data, options);
+    if (callback) {
+      try {
+        const result = await promise;
+        return callback(result);
+      } catch (err) {
+        return callback(err);
+      }
+    }
+    return promise;
+  }
+  function writeFileSync4(filename, data, options) {
+    if (typeof options === "string") {
+      options = { encoding: options };
+    } else if (!options) {
+      options = {};
+    }
+    try {
+      filename = fs.realpathSync(filename);
+    } catch (ex) {}
+    const tmpfile = getTmpname(filename);
+    if (!options.mode || !options.chown) {
+      try {
+        const stats = fs.statSync(filename);
+        options = Object.assign({}, options);
+        if (!options.mode) {
+          options.mode = stats.mode;
+        }
+        if (!options.chown && process.getuid) {
+          options.chown = { uid: stats.uid, gid: stats.gid };
+        }
+      } catch (ex) {}
+    }
+    let fd;
+    const cleanup = cleanupOnExit(tmpfile);
+    const removeOnExitHandler = onExit(cleanup);
+    let threw = true;
+    try {
+      fd = fs.openSync(tmpfile, "w", options.mode || 438);
+      if (options.tmpfileCreated) {
+        options.tmpfileCreated(tmpfile);
+      }
+      if (ArrayBuffer.isView(data)) {
+        fs.writeSync(fd, data, 0, data.length, 0);
+      } else if (data != null) {
+        fs.writeSync(fd, String(data), 0, String(options.encoding || "utf8"));
+      }
+      if (options.fsync !== false) {
+        fs.fsyncSync(fd);
+      }
+      fs.closeSync(fd);
+      fd = null;
+      if (options.chown) {
+        try {
+          fs.chownSync(tmpfile, options.chown.uid, options.chown.gid);
+        } catch (err) {
+          if (!isChownErrOk(err)) {
+            throw err;
+          }
+        }
+      }
+      if (options.mode) {
+        try {
+          fs.chmodSync(tmpfile, options.mode);
+        } catch (err) {
+          if (!isChownErrOk(err)) {
+            throw err;
+          }
+        }
+      }
+      fs.renameSync(tmpfile, filename);
+      threw = false;
+    } finally {
+      if (fd) {
+        try {
+          fs.closeSync(fd);
+        } catch (ex) {}
+      }
+      removeOnExitHandler();
+      if (threw) {
+        cleanup();
+      }
+    }
+  }
+});
+
 // src/mcp/config-helpers.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5 } from "node:fs";
-import { createRequire as createRequire2 } from "node:module";
 import { dirname } from "node:path";
 function mcpURL(deploymentID) {
   return `${getBackendURL()}/v1/mcp/deployments/${deploymentID}`;
@@ -6772,10 +7298,10 @@ function removeJSONServer(configPath, topKey) {
   }
   saveJSONConfig(configPath, jsonCfg);
 }
-var require2, writeFileAtomic;
+var import_write_file_atomic, writeFileAtomic;
 var init_config_helpers = __esm(() => {
-  require2 = createRequire2(import.meta.url);
-  writeFileAtomic = require2("write-file-atomic");
+  import_write_file_atomic = __toESM(require_lib(), 1);
+  writeFileAtomic = import_write_file_atomic.default;
 });
 
 // src/mcp/detect.ts
@@ -10325,7 +10851,7 @@ ${dim(targetOrg.name)}`);
 async function resolveOnboardingDeployment(apiClient, targetOrg) {
   const deployments = await fetchDeployments(apiClient);
   const orgDeployments = deployments.filter((deployment) => deployment.org_id === targetOrg.org_id);
-  return orgDeployments.find((deployment) => deployment.provider_slug === "dosu_mcp") ?? orgDeployments[0] ?? null;
+  return orgDeployments.find((deployment) => deployment.provider_slug === MCP_PROVIDER_SLUG) ?? orgDeployments[0] ?? null;
 }
 async function resolveDeployment(apiClient, cfg, opts) {
   if (opts.deploymentID) {
@@ -10982,6 +11508,509 @@ var init_tui = __esm(() => {
   import_picocolors25 = __toESM(require_picocolors(), 1);
 });
 
+// src/auth/ticket.ts
+function buildTicketAuthURL(ticket) {
+  const base = getWebAppURL();
+  const params = new URLSearchParams({ ticket });
+  return `${base}/cli/auth?${params}`;
+}
+async function mintTicket() {
+  const url = `${getBackendURL()}/v1/cli/auth/tickets`;
+  logger.debug("auth.ticket", `Minting ticket via ${url}`);
+  const resp = await fetchWithTimeout(url, { method: "POST" });
+  if (resp.status !== 200 && resp.status !== 201) {
+    const detail = await readErrorBody2(resp);
+    throw new Error(`failed to mint ticket (status ${resp.status}): ${detail}`);
+  }
+  const data = await resp.json();
+  logger.info("auth.ticket", `Minted ticket (ttl=${data.expires_in}s)`);
+  return {
+    ticket: data.ticket,
+    expires_in: data.expires_in,
+    url: buildTicketAuthURL(data.ticket)
+  };
+}
+async function exchangeTicket(ticket) {
+  const path2 = `/v1/cli/auth/tickets/${encodeURIComponent(ticket)}/exchange`;
+  const url = `${getBackendURL()}${path2}`;
+  logger.debug("auth.ticket", `Exchanging ticket via ${url}`);
+  const resp = await fetchWithTimeout(url, { method: "POST" });
+  if (resp.status !== 200) {
+    const detail = await readErrorBody2(resp);
+    throw new Error(`ticket exchange failed (status ${resp.status}): ${detail}`);
+  }
+  const data = await resp.json();
+  return {
+    status: data.status,
+    access_token: data.access_token ?? undefined,
+    refresh_token: data.refresh_token ?? undefined,
+    expires_in: data.expires_in ?? undefined,
+    email: data.email ?? undefined
+  };
+}
+async function fetchWithTimeout(url, init) {
+  const controller = new AbortController;
+  const timeout = setTimeout(() => controller.abort(), 1e4);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function readErrorBody2(resp) {
+  try {
+    return (await resp.text()).slice(0, 512);
+  } catch {
+    return "";
+  }
+}
+var init_ticket = __esm(() => {
+  init_logger();
+});
+
+// src/agent/output.ts
+var exports_output = {};
+__export(exports_output, {
+  emitStep: () => emitStep,
+  emitNeedUserAction: () => emitNeedUserAction,
+  emitJSONLine: () => emitJSONLine,
+  emitError: () => emitError
+});
+function emitJSONLine(value) {
+  console.log(JSON.stringify(value));
+}
+function emitNeedUserAction(opts) {
+  emitJSONLine({
+    step: opts.step,
+    status: "need_user_action",
+    url: opts.url,
+    ticket: opts.ticket,
+    resume_command: opts.resume_command,
+    expires_in: opts.expires_in,
+    agent_next_steps: opts.agent_next_steps
+  });
+}
+function emitError(opts) {
+  const { step, reason, agent_next_steps, ...rest } = opts;
+  emitJSONLine({
+    step,
+    status: "error",
+    reason,
+    ...rest,
+    agent_next_steps
+  });
+}
+function emitStep(opts) {
+  const { step, status = "ok", ...rest } = opts;
+  emitJSONLine({ step, status, ...rest });
+}
+
+// src/agent/login-commands.ts
+var exports_login_commands = {};
+__export(exports_login_commands, {
+  runLoginRequest: () => runLoginRequest,
+  runLoginCheck: () => runLoginCheck
+});
+async function runLoginRequest(opts) {
+  try {
+    const minted = await mintTicket();
+    const checkCommand = `${CHECK_COMMAND_PREFIX} ${minted.ticket}${opts.json ? " --json" : ""}`;
+    if (opts.json) {
+      emitJSONLine({
+        ticket: minted.ticket,
+        url: minted.url,
+        check_command: checkCommand,
+        expires_in: minted.expires_in,
+        agent_next_steps: "Give the URL to the user so they can authorize. Once the user confirms they've signed in, run check_command to retrieve the token."
+      });
+    } else {
+      console.log("Open this URL in your browser to authorize:");
+      console.log(`  ${minted.url}`);
+      console.log("");
+      console.log("After signing in, complete the login with:");
+      console.log(`  ${checkCommand}`);
+      console.log("");
+      console.log(`Ticket expires in ${Math.floor(minted.expires_in / 60)} minutes.`);
+    }
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      emitError({
+        step: "request",
+        reason: "mint_failed",
+        agent_next_steps: `Could not mint a login ticket: ${msg}. Check connectivity and retry.`
+      });
+    } else {
+      console.error(`Failed to mint login ticket: ${msg}`);
+    }
+    return 1;
+  }
+}
+async function runLoginCheck(opts) {
+  let result;
+  try {
+    result = await exchangeTicket(opts.ticket);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (opts.json) {
+      emitError({
+        step: "check",
+        reason: "exchange_failed",
+        agent_next_steps: `Ticket exchange failed: ${msg}. Retry, or run 'dosu login --request' to get a fresh ticket.`
+      });
+    } else {
+      console.error(`Ticket exchange failed: ${msg}`);
+    }
+    return 1;
+  }
+  if (result.status === "authenticated") {
+    const cfg = loadConfig();
+    cfg.access_token = result.access_token ?? "";
+    cfg.refresh_token = result.refresh_token ?? "";
+    cfg.expires_at = Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600);
+    saveConfig(cfg);
+    logger.info("auth.ticket", "Ticket redeemed via dosu login --check");
+    if (opts.json) {
+      emitStep({
+        step: "check",
+        status: "authenticated",
+        email: result.email,
+        agent_next_steps: "Authentication complete. You can now run authenticated commands like 'dosu setup' or 'dosu status'."
+      });
+    } else {
+      console.log("Successfully authenticated!");
+      if (result.email)
+        console.log(`Signed in as ${result.email}`);
+    }
+    return 0;
+  }
+  if (result.status === "pending") {
+    if (opts.json) {
+      emitStep({
+        step: "check",
+        status: "pending",
+        ticket: opts.ticket,
+        agent_next_steps: "User hasn't completed sign-in yet. Ask the user to confirm they've signed in via the URL from --request, then run this check command again."
+      });
+    } else {
+      console.log("Still waiting for the user to complete sign-in. Run --check again later.");
+    }
+    return 0;
+  }
+  if (opts.json) {
+    emitStep({
+      step: "check",
+      status: "expired",
+      agent_next_steps: "Ticket has expired or was already redeemed. Run 'dosu login --request --json' to get a fresh ticket."
+    });
+  } else {
+    console.error("Ticket has expired or was already used. Run 'dosu login --request' for a new one.");
+  }
+  return 1;
+}
+var CHECK_COMMAND_PREFIX = "dosu login --check";
+var init_login_commands = __esm(() => {
+  init_ticket();
+  init_config();
+  init_logger();
+});
+
+// src/agent/flow.ts
+var exports_flow3 = {};
+__export(exports_flow3, {
+  runAgentSetup: () => runAgentSetup,
+  listAgentSupportedToolIDs: () => listAgentSupportedToolIDs,
+  buildResumeCommand: () => buildResumeCommand
+});
+async function runAgentSetup(opts) {
+  const provider = allSetupProviders().find((p2) => p2.id() === opts.tool.toLowerCase());
+  if (!provider) {
+    const available = allSetupProviders().filter((p2) => !isStdioOnly(p2)).map((p2) => p2.id()).join(", ");
+    emitError({
+      step: "setup",
+      reason: "unknown_tool",
+      agent_next_steps: `'${opts.tool}' is not a supported tool. Choose one of: ${available}. Re-run with --tool <id>.`
+    });
+    return 2;
+  }
+  if (isStdioOnly(provider)) {
+    emitError({
+      step: "setup",
+      reason: "tool_unsupported_in_agent_mode",
+      agent_next_steps: `${provider.name()} is not supported by agent setup. Tell the user to run 'dosu mcp add ${provider.id()}' manually after signing in.`
+    });
+    return 2;
+  }
+  let cfg = loadConfig();
+  if (opts.loginTicket) {
+    const redeemed = await redeemTicket(opts.loginTicket, cfg);
+    if (redeemed.code !== 0 || redeemed.exit)
+      return redeemed.code;
+    cfg = redeemed.cfg;
+  } else {
+    const verified = await verifyOrMint(cfg, opts);
+    if (verified.code !== 0 || verified.exit)
+      return verified.code;
+    cfg = verified.cfg;
+  }
+  const client = new Client(cfg);
+  const deploymentResult = await resolveDeployment2(client, cfg, opts);
+  if (deploymentResult.code !== 0)
+    return deploymentResult.code;
+  cfg = deploymentResult.cfg;
+  const keyResult = await ensureAPIKey(client, cfg);
+  if (keyResult.code !== 0)
+    return keyResult.code;
+  cfg = keyResult.cfg;
+  try {
+    provider.install(cfg, true);
+    emitStep({
+      step: "mcp_install",
+      tool: provider.id(),
+      tool_name: provider.name(),
+      config_path: provider.globalConfigPath()
+    });
+  } catch (err) {
+    emitError({
+      step: "mcp_install",
+      reason: "install_failed",
+      agent_next_steps: `Failed to install Dosu MCP into ${provider.name()}: ${err instanceof Error ? err.message : String(err)}. Tell the user to retry or run 'dosu mcp add ${provider.id()}' manually.`
+    });
+    return 1;
+  }
+  emitStep({
+    step: "done",
+    agent_next_steps: `Dosu MCP is configured for ${provider.name()}. Tell the user setup is complete and they can ask their agent a Dosu question. Run 'dosu status' to verify.`
+  });
+  return 0;
+}
+async function redeemTicket(ticket, cfg) {
+  try {
+    const result = await exchangeTicket(ticket);
+    if (result.status === "expired") {
+      emitError({
+        step: "auth",
+        reason: "ticket_expired",
+        agent_next_steps: "Ticket expired or already redeemed. Re-run the agent setup command without --login-ticket to mint a fresh one."
+      });
+      return { code: 1, cfg };
+    }
+    if (result.status === "pending") {
+      emitStep({
+        step: "auth",
+        status: "pending",
+        agent_next_steps: "User hasn't completed sign-in yet. Ask the user to confirm they've signed in, then run the same command again."
+      });
+      return { code: 0, cfg, exit: true };
+    }
+    cfg.access_token = result.access_token ?? "";
+    cfg.refresh_token = result.refresh_token ?? "";
+    cfg.expires_at = Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600);
+    saveConfig(cfg);
+    logger.info("agent.flow", "Ticket redeemed; session saved");
+    emitStep({ step: "auth", email: result.email });
+    return { code: 0, cfg };
+  } catch (err) {
+    emitError({
+      step: "auth",
+      reason: "ticket_exchange_failed",
+      agent_next_steps: `Failed to exchange ticket: ${err instanceof Error ? err.message : String(err)}. Re-run without --login-ticket to start over.`
+    });
+    return { code: 1, cfg };
+  }
+}
+async function verifyOrMint(cfg, opts) {
+  if (cfg.access_token) {
+    try {
+      const client = new Client(cfg);
+      const resp = await client.doRequestRaw("GET", "/v1/mcp/deployments");
+      if (resp.status === 200) {
+        emitStep({ step: "auth" });
+        return { code: 0, cfg };
+      }
+      try {
+        await client.refreshToken();
+        const fresh = loadConfig();
+        emitStep({ step: "auth" });
+        return { code: 0, cfg: fresh };
+      } catch {}
+    } catch {}
+  }
+  try {
+    const minted = await mintTicket();
+    emitNeedUserAction({
+      step: "auth",
+      url: minted.url,
+      ticket: minted.ticket,
+      resume_command: buildResumeCommand(opts.tool, minted.ticket, opts.deploymentID),
+      expires_in: minted.expires_in,
+      agent_next_steps: "Give the URL to the user so they can sign in. Wait for the user to confirm they've signed in, then run resume_command to finish setup."
+    });
+    return { code: 0, cfg, exit: true };
+  } catch (err) {
+    emitError({
+      step: "auth",
+      reason: "ticket_mint_failed",
+      agent_next_steps: `Could not mint a login ticket: ${err instanceof Error ? err.message : String(err)}. Check connectivity and retry.`
+    });
+    return { code: 1, cfg };
+  }
+}
+async function resolveDeployment2(client, cfg, opts) {
+  if (opts.deploymentID) {
+    try {
+      const deployments = await client.getDeployments();
+      const d3 = deployments.find((dep) => dep.deployment_id === opts.deploymentID);
+      if (!d3) {
+        emitError({
+          step: "deployment",
+          reason: "not_found",
+          agent_next_steps: `Deployment '${opts.deploymentID}' is not accessible. Run 'dosu deployments list --json' to see options and try again with a valid id.`
+        });
+        return { code: 1, cfg };
+      }
+      cfg.deployment_id = d3.deployment_id;
+      cfg.deployment_name = d3.name;
+      cfg.org_id = d3.org_id;
+      cfg.space_id = d3.space_id;
+      cfg.mode = undefined;
+      saveConfig(cfg);
+      emitStep({
+        step: "deployment",
+        deployment_id: d3.deployment_id,
+        name: d3.name
+      });
+      return { code: 0, cfg };
+    } catch (err) {
+      emitError({
+        step: "deployment",
+        reason: "fetch_failed",
+        agent_next_steps: `Failed to load deployments: ${err instanceof Error ? err.message : String(err)}.`
+      });
+      return { code: 1, cfg };
+    }
+  }
+  if (cfg.deployment_id) {
+    emitStep({
+      step: "deployment",
+      deployment_id: cfg.deployment_id,
+      name: cfg.deployment_name
+    });
+    return { code: 0, cfg };
+  }
+  try {
+    const allDeployments = await client.getDeployments();
+    if (allDeployments.length === 0) {
+      emitError({
+        step: "deployment",
+        reason: "no_deployments",
+        agent_next_steps: "No Dosu deployments are accessible to this account. Tell the user to create one at https://app.dosu.dev before retrying."
+      });
+      return { code: 1, cfg };
+    }
+    const mcpDeployments = allDeployments.filter((d3) => d3.provider_slug === MCP_PROVIDER_SLUG);
+    if (mcpDeployments.length === 0) {
+      emitError({
+        step: "deployment",
+        reason: "no_mcp_deployment",
+        agent_next_steps: "Account has deployments but none of them back an MCP server. Tell the user to create an MCP deployment at https://app.dosu.dev, or pass --deployment <id> to target a specific deployment."
+      });
+      return { code: 1, cfg };
+    }
+    if (mcpDeployments.length === 1) {
+      const d3 = mcpDeployments[0];
+      cfg.deployment_id = d3.deployment_id;
+      cfg.deployment_name = d3.name;
+      cfg.org_id = d3.org_id;
+      cfg.space_id = d3.space_id;
+      cfg.mode = undefined;
+      saveConfig(cfg);
+      emitStep({
+        step: "deployment",
+        deployment_id: d3.deployment_id,
+        name: d3.name
+      });
+      return { code: 0, cfg };
+    }
+    const candidates = mcpDeployments.map((d3) => ({
+      deployment_id: d3.deployment_id,
+      name: d3.name,
+      org_id: d3.org_id,
+      org_name: d3.org_name
+    }));
+    emitError({
+      step: "deployment",
+      reason: "multiple_deployments",
+      candidates,
+      agent_next_steps: `User has ${mcpDeployments.length} MCP deployments. Show these options to the user and re-run the same command with \`--deployment <id>\`:
+${formatCandidates(mcpDeployments)}`
+    });
+    return { code: 1, cfg };
+  } catch (err) {
+    emitError({
+      step: "deployment",
+      reason: "fetch_failed",
+      agent_next_steps: `Failed to load deployments: ${err instanceof Error ? err.message : String(err)}.`
+    });
+    return { code: 1, cfg };
+  }
+}
+function formatCandidates(deployments) {
+  return deployments.map((d3) => `  - ${d3.name} (${d3.org_name}) — ${d3.deployment_id}`).join(`
+`);
+}
+async function ensureAPIKey(client, cfg) {
+  if (!cfg.deployment_id) {
+    emitError({
+      step: "api_key",
+      reason: "no_deployment",
+      agent_next_steps: "Internal error: tried to mint an API key without a deployment. Re-run setup from scratch."
+    });
+    return { code: 1, cfg };
+  }
+  try {
+    if (cfg.api_key) {
+      const valid = await client.validateAPIKey(cfg.api_key, cfg.deployment_id);
+      if (valid) {
+        emitStep({ step: "api_key", reused: true });
+        return { code: 0, cfg };
+      }
+    }
+    const resp = await client.createAPIKey(cfg.deployment_id, "dosu-cli");
+    cfg.api_key = resp.api_key;
+    saveConfig(cfg);
+    emitStep({ step: "api_key", reused: false });
+    return { code: 0, cfg };
+  } catch (err) {
+    emitError({
+      step: "api_key",
+      reason: "create_failed",
+      agent_next_steps: `Failed to create an API key: ${err instanceof Error ? err.message : String(err)}.`
+    });
+    return { code: 1, cfg };
+  }
+}
+function buildResumeCommand(tool, ticket, deploymentID) {
+  const parts = [NPX_INVOCATION, "setup", "--agent", "--tool", tool, "--login-ticket", ticket];
+  if (deploymentID) {
+    parts.push("--deployment", deploymentID);
+  }
+  return parts.join(" ");
+}
+function listAgentSupportedToolIDs() {
+  return allSetupProviders().filter((p2) => !isStdioOnly(p2)).map((p2) => p2.id());
+}
+var NPX_INVOCATION = "npx @dosu/cli@latest";
+var init_flow3 = __esm(() => {
+  init_ticket();
+  init_client();
+  init_config();
+  init_logger();
+  init_providers();
+  init_flow2();
+});
+
 // src/cli/cli.ts
 init_esm();
 import { readFileSync as readFileSync8, unlinkSync as unlinkSync2 } from "node:fs";
@@ -12603,7 +13632,25 @@ function createProgram() {
     const { runTUI: runTUI2 } = await Promise.resolve().then(() => (init_tui(), exports_tui));
     await runTUI2();
   });
-  program2.command("login").description("Authenticate with Dosu via OAuth").action(async () => {
+  program2.command("login").description("Authenticate with Dosu via OAuth").option("--request", "Mint a login ticket for agent / human-in-the-loop auth (prints URL and exits)").option("--check <ticket>", "Exchange a login ticket created with --request for a token").option("--json", "Emit machine-readable JSON output (use with --request or --check)").action(async (opts) => {
+    if (opts.request && opts.check !== undefined) {
+      console.error("--request and --check cannot be combined.");
+      process.exitCode = 2;
+      return;
+    }
+    if (opts.request) {
+      const { runLoginRequest: runLoginRequest2 } = await Promise.resolve().then(() => (init_login_commands(), exports_login_commands));
+      process.exitCode = await runLoginRequest2({ json: opts.json === true });
+      return;
+    }
+    if (opts.check !== undefined) {
+      const { runLoginCheck: runLoginCheck2 } = await Promise.resolve().then(() => (init_login_commands(), exports_login_commands));
+      process.exitCode = await runLoginCheck2({
+        ticket: opts.check,
+        json: opts.json === true
+      });
+      return;
+    }
     const cfg = loadConfig();
     if (isAuthenticated(cfg) && !isTokenExpired(cfg)) {
       console.log("You are already logged in.");
@@ -12745,7 +13792,30 @@ Use 'dosu mcp add <agent>' to add Dosu MCP to a tool.`);
   program2.addCommand(tagsCommand());
   program2.addCommand(threadsCommand());
   program2.addCommand(skillCommand());
-  program2.command("setup").description("Set up Dosu MCP for your AI tools").option("--deployment <id>", "Skip to tool configuration for a specific MCP").option("--mode <mode>", "Force OSS or Cloud mode, skipping the interactive prompt (oss|cloud)").action(async (opts) => {
+  program2.command("setup").description("Set up Dosu MCP for your AI tools").option("--deployment <id>", "Skip to tool configuration for a specific MCP").option("--mode <mode>", "Force OSS or Cloud mode, skipping the interactive prompt (oss|cloud)").option("--agent", "Run non-interactive setup designed for coding agents (requires --tool)").option("--tool <id>", "Configure a single AI tool by id (claude, cursor, codex, …). Required with --agent.").option("--login-ticket <ticket>", "Resume an --agent setup by redeeming a ticket from a previous run").action(async (opts) => {
+    if (opts.agent) {
+      if (!opts.tool) {
+        const { emitError: emitError2 } = await Promise.resolve().then(() => exports_output);
+        const { listAgentSupportedToolIDs: listAgentSupportedToolIDs2 } = await Promise.resolve().then(() => (init_flow3(), exports_flow3));
+        emitError2({
+          step: "setup",
+          reason: "missing_tool",
+          agent_next_steps: `Pass --tool <id> when using --agent. Supported ids: ${listAgentSupportedToolIDs2().join(", ")}.`
+        });
+        process.exitCode = 2;
+        return;
+      }
+      const { runAgentSetup: runAgentSetup2 } = await Promise.resolve().then(() => (init_flow3(), exports_flow3));
+      process.exitCode = await runAgentSetup2({
+        tool: opts.tool,
+        loginTicket: opts.loginTicket,
+        deploymentID: opts.deployment
+      });
+      return;
+    }
+    if (opts.tool || opts.loginTicket) {
+      throw new Error("--tool and --login-ticket require --agent");
+    }
     const { runSetup: runSetup2 } = await Promise.resolve().then(() => (init_flow2(), exports_flow2));
     let mode;
     if (opts.mode !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dosu/cli",
-  "version": "0.14.2",
+  "version": "0.15.1",
   "type": "module",
   "description": "Dosu CLI - Manage MCP servers for AI tools",
   "license": "MIT",
@@ -20,6 +20,7 @@
     "dev": "bun run src/index.ts",
     "dev:local": "DOSU_DEV=true bun run src/index.ts",
     "build": "bun --env-file=.env.production run scripts/build-compile.ts",
+    "build:dev": "bun --env-file=.env.development run scripts/build-compile.ts",
     "build:npm": "bun --env-file=.env.production run scripts/build-npm.ts",
     "build:all": "bun --env-file=.env.production run scripts/build-all.ts",
     "test": "bunx vitest run",