@great-arrow/cli 0.1.46 → 0.1.48

package/README.md

@@ -38,6 +38,13 @@ gad whoami
 
 # Revoke the session server-side and remove stored credentials
 gad logout
+
+# For tools, not humans: print a fresh access token through the CLI's locked
+# refresh path (~/.great-arrow/refresh.lock), so other programs never refresh
+# this credential themselves. --json prints {accessToken, accessExpiresAt,
+# apiUrl}. Exit 2: session expired or not signed in. Exit 3: the stored
+# credential is a personal token (nothing to refresh).
+gad auth token [--json]
 ```
 
 Credentials live in your OS keychain (Keychain Access / libsecret / Credential

package/dist/index.js

@@ -1964,7 +1964,7 @@ var require_minimist = __commonJS({
 var require_rc = __commonJS({
   "node_modules/.pnpm/rc@1.2.8/node_modules/rc/index.js"(exports, module) {
     var cc = require_utils();
-    var join8 = __require("path").join;
+    var join9 = __require("path").join;
     var deepExtend = require_deep_extend();
     var etc = "/etc";
     var win = process.platform === "win32";
@@ -1989,15 +1989,15 @@ var require_rc = __commonJS({
       }
       if (!win)
         [
-          join8(etc, name, "config"),
-          join8(etc, name + "rc")
+          join9(etc, name, "config"),
+          join9(etc, name + "rc")
         ].forEach(addConfigFile);
       if (home)
         [
-          join8(home, ".config", name, "config"),
-          join8(home, ".config", name),
-          join8(home, "." + name, "config"),
-          join8(home, "." + name + "rc")
+          join9(home, ".config", name, "config"),
+          join9(home, ".config", name),
+          join9(home, "." + name, "config"),
+          join9(home, "." + name + "rc")
         ].forEach(addConfigFile);
       addConfigFile(cc.find("." + name + "rc"));
       if (env4.config) addConfigFile(env4.config);
@@ -9399,7 +9399,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.46";
+var CLI_VERSION = "0.1.48";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9538,10 +9538,55 @@ async function clearStoredCredential() {
   await deleteToken();
 }
 
+// src/lib/cli-locator.ts
+import {
+  chmodSync,
+  mkdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+function writeCliLocator(home = homedir2(), entry = process.argv[1]) {
+  if (!entry) return;
+  const dir = join2(home, ".great-arrow");
+  const target = join2(dir, "cli-bin.json");
+  const tmp = `${target}.${process.pid}.tmp`;
+  try {
+    let resolved = entry;
+    try {
+      resolved = realpathSync(entry);
+    } catch (err) {
+      debugSwallow("cli-locator.realpath", err);
+    }
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(
+      tmp,
+      JSON.stringify({
+        node: process.execPath,
+        entry: resolved,
+        version: CLI_VERSION
+      }),
+      { mode: 384 }
+    );
+    chmodSync(tmp, 384);
+    renameSync(tmp, target);
+  } catch (err) {
+    debugSwallow("cli-locator.write", err);
+    try {
+      rmSync(tmp, { force: true });
+    } catch (cleanupErr) {
+      debugSwallow("cli-locator.cleanup", cleanupErr);
+    }
+  }
+}
+
 // src/lib/config.ts
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { join as join2, dirname as dirname2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join3, dirname as dirname2 } from "node:path";
 var DEFAULTS = {
   api_url: "https://www.greatarrow.ai",
   default_workspace: "",
@@ -9552,7 +9597,7 @@ var DEFAULTS = {
   telemetry_enabled: false
 };
 function getConfigPath() {
-  return join2(homedir2(), ".gadrc");
+  return join3(homedir3(), ".gadrc");
 }
 function parseConfig(content) {
   const config = {};
@@ -9820,6 +9865,10 @@ function trimSlash(url) {
 }
 
 // src/lib/oauth/token-exchange.ts
+var TOKEN_HEADERS = {
+  "content-type": "application/x-www-form-urlencoded",
+  "user-agent": `gad-cli/${CLI_VERSION}`
+};
 var RefreshRejected = class extends Error {
   constructor(message) {
     super(message);
@@ -9849,11 +9898,13 @@ function toCredential(env4, apiUrl, clientId, now) {
     apiUrl: trimSlash2(apiUrl)
   };
 }
-async function postToken(apiUrl, form, fetchImpl) {
+var TOKEN_POST_TIMEOUT_MS = 8e3;
+async function postToken(apiUrl, form, fetchImpl, timeoutMs = TOKEN_POST_TIMEOUT_MS) {
   const res = await fetchImpl(`${trimSlash2(apiUrl)}/api/oauth/token`, {
     method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(form).toString()
+    headers: TOKEN_HEADERS,
+    body: new URLSearchParams(form).toString(),
+    signal: AbortSignal.timeout(timeoutMs)
   });
   const json = await res.json().catch(() => ({}));
   return { ok: res.ok, status: res.status, json };
@@ -9893,8 +9944,9 @@ async function revokeToken(opts) {
   try {
     const res = await doFetch(`${trimSlash2(opts.apiUrl)}/api/oauth/revoke`, {
       method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams(form).toString()
+      headers: TOKEN_HEADERS,
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(TOKEN_POST_TIMEOUT_MS)
     });
     return res.ok;
   } catch {
@@ -9910,7 +9962,8 @@ async function refreshTokens(opts) {
       client_id: opts.clientId,
       refresh_token: opts.refreshToken
     },
-    opts.fetchImpl ?? fetch
+    opts.fetchImpl ?? fetch,
+    opts.timeoutMs
   );
   if (!ok) {
     const desc = String(json.error_description ?? json.error ?? "unknown");
@@ -10284,6 +10337,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
         process.exitCode = 1;
         return;
       }
+      writeCliLocator();
       config.cli_client_id = result.clientId;
       config.cli_redirect_uri = result.redirectUri;
       config.api_url = DEFAULT_API_URL;
@@ -10303,52 +10357,22 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
 );
 var login_default = loginCommand;
 
-// src/commands/logout.ts
-var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
-  const parent = cmd.parent;
-  const json = parent?.opts().json ?? false;
-  const quiet = parent?.opts().quiet ?? false;
-  const noColor = parent?.opts().noColor ?? false;
-  const fmt = createFormatter({
-    json,
-    quiet,
-    isTTY: isTTY(),
-    noColor
-  });
-  const stored = await loadStoredCredential();
-  if (stored?.kind === "oauth") {
-    await revokeToken({
-      apiUrl: stored.credential.apiUrl,
-      clientId: stored.credential.clientId,
-      token: stored.credential.refreshToken,
-      tokenTypeHint: "refresh_token"
-    });
-  }
-  await clearStoredCredential();
-  const config = await loadConfig();
-  if (config.token) {
-    config.token = "";
-    await saveConfig(config);
-  }
-  fmt.success("Logged out successfully.");
-});
-
 // src/lib/auth.ts
 import { mkdir as mkdir3, open, rm, stat } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { join as join3 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join4 } from "node:path";
 var REFRESH_SKEW_MS = 12e4;
 var inflightRefresh = null;
 var REFRESH_LOCK_STALE_MS = 15e3;
 var REFRESH_LOCK_WAIT_MS = 5e3;
 var REFRESH_LOCK_POLL_MS = 100;
 function refreshLockPath() {
-  return join3(homedir3(), ".great-arrow", "refresh.lock");
+  return join4(homedir4(), ".great-arrow", "refresh.lock");
 }
 async function acquireRefreshLock() {
   const path10 = refreshLockPath();
   try {
-    await mkdir3(join3(homedir3(), ".great-arrow"), { recursive: true });
+    await mkdir3(join4(homedir4(), ".great-arrow"), { recursive: true });
   } catch (err) {
     debugSwallow("refresh-lock.mkdir", err);
   }
@@ -10382,7 +10406,7 @@ async function releaseRefreshLock() {
     debugSwallow("refresh-lock.release", err);
   }
 }
-async function rotatedByAnotherProcess(ours) {
+async function storedPairOtherThan(ours) {
   let stored = null;
   try {
     stored = await loadStoredCredential();
@@ -10390,8 +10414,11 @@ async function rotatedByAnotherProcess(ours) {
     debugSwallow("refresh.reread", err);
   }
   if (stored?.kind !== "oauth") return null;
-  const theirs = stored.credential;
-  if (theirs.refreshToken === ours.refreshToken) return null;
+  return stored.credential.refreshToken === ours.refreshToken ? null : stored.credential;
+}
+async function rotatedByAnotherProcess(ours) {
+  const theirs = await storedPairOtherThan(ours);
+  if (!theirs) return null;
   if (Date.now() >= theirs.accessExpiresAt - REFRESH_SKEW_MS) return null;
   return theirs;
 }
@@ -10434,11 +10461,40 @@ async function resolveAuth() {
       tokenType: "personal"
     });
   }
+  const codexEnvToken = process.env.GREAT_ARROW_TOKEN;
+  if (codexEnvToken) {
+    return withWorkspace({
+      token: codexEnvToken,
+      apiUrl: configApiUrl,
+      tokenType: "personal"
+    });
+  }
   throw authError(
     "No authentication token found.",
     "Run 'gad login' to authenticate, or set the GAD_TOKEN environment variable."
   );
 }
+var NotOAuthCredential = class extends Error {
+  code = "not_oauth";
+};
+async function getFreshOAuthAccessToken() {
+  const stored = await loadStoredCredential();
+  if (!stored) {
+    throw authError(
+      "Session expired. Not signed in.",
+      "Run 'gad login' to authenticate."
+    );
+  }
+  if (stored.kind !== "oauth") {
+    throw new NotOAuthCredential("stored credential is not OAuth");
+  }
+  const fresh = await ensureFreshAccessToken(stored.credential);
+  return {
+    accessToken: fresh.accessToken,
+    accessExpiresAt: fresh.accessExpiresAt,
+    apiUrl: fresh.apiUrl
+  };
+}
 async function ensureFreshAccessToken(credential) {
   if (Date.now() < credential.accessExpiresAt - REFRESH_SKEW_MS) {
     return credential;
@@ -10468,6 +10524,8 @@ async function doRefresh(credential) {
     return refreshed;
   } catch (err) {
     if (err instanceof RefreshRejected) {
+      const theirs = await storedPairOtherThan(credential);
+      if (theirs) return theirs;
       await clearStoredCredential();
       throw sessionExpired();
     }
@@ -10480,6 +10538,70 @@ function sessionExpired() {
   return authError("Session expired.", "Run 'gad login' to re-authenticate.");
 }
 
+// src/commands/auth.ts
+var EXIT_SESSION_EXPIRED = 2;
+var EXIT_NOT_OAUTH = 3;
+function authCommand() {
+  const cmd = new Command("auth").description("Authentication helpers");
+  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options) => {
+    try {
+      const t = await getFreshOAuthAccessToken();
+      writeCliLocator();
+      process.stdout.write(
+        options.json ? `${JSON.stringify(t)}
+` : `${t.accessToken}
+`
+      );
+    } catch (error) {
+      if (error instanceof NotOAuthCredential) {
+        process.stderr.write(`${error.message}
+`);
+        process.exitCode = EXIT_NOT_OAUTH;
+        return;
+      }
+      if (error instanceof CliError && error.code === 1) {
+        const hint = error.hint ? ` ${error.hint}` : "";
+        process.stderr.write(`${error.message}${hint}
+`);
+        process.exitCode = EXIT_SESSION_EXPIRED;
+        return;
+      }
+      throw error;
+    }
+  });
+  return cmd;
+}
+
+// src/commands/logout.ts
+var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
+  const parent = cmd.parent;
+  const json = parent?.opts().json ?? false;
+  const quiet = parent?.opts().quiet ?? false;
+  const noColor = parent?.opts().noColor ?? false;
+  const fmt = createFormatter({
+    json,
+    quiet,
+    isTTY: isTTY(),
+    noColor
+  });
+  const stored = await loadStoredCredential();
+  if (stored?.kind === "oauth") {
+    await revokeToken({
+      apiUrl: stored.credential.apiUrl,
+      clientId: stored.credential.clientId,
+      token: stored.credential.refreshToken,
+      tokenTypeHint: "refresh_token"
+    });
+  }
+  await clearStoredCredential();
+  const config = await loadConfig();
+  if (config.token) {
+    config.token = "";
+    await saveConfig(config);
+  }
+  fmt.success("Logged out successfully.");
+});
+
 // src/lib/client.ts
 import { execSync } from "node:child_process";
 
@@ -10641,6 +10763,46 @@ function isRetryable(error) {
   }
   return false;
 }
+var RETRY_SAFE_TOOLS = /* @__PURE__ */ new Set([
+  "workspace_introspect",
+  "mcp_capabilities",
+  "tools_discover",
+  "memory_search",
+  "memory_list",
+  "memory_get",
+  "memory_tags",
+  "todo_list",
+  "todo_get",
+  "workspace_list",
+  "workspace_settings_get",
+  "surfaces_list",
+  "agent_list",
+  "engineering_guardrails_list",
+  "model_local_get",
+  "glance",
+  "did_you_know"
+]);
+var CONNECTION_PHASE_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "UND_ERR_CONNECT_TIMEOUT"
+]);
+function hasConnectionPhaseCode(value) {
+  if (!value || typeof value !== "object") return false;
+  const errors = value.errors;
+  if (Array.isArray(errors) && errors.length > 0) {
+    return errors.every(hasConnectionPhaseCode);
+  }
+  const code = value.code;
+  return typeof code === "string" && CONNECTION_PHASE_CODES.has(code);
+}
+function isConnectionPhaseFailure(error) {
+  if (!(error instanceof TypeError)) return false;
+  return hasConnectionPhaseCode(error.cause);
+}
 function isRetryableStatus(status) {
   return status >= 500 && status < 600;
 }
@@ -10696,7 +10858,7 @@ var GadClient = class {
   /**
    * Execute a fetch request with timeout and retry logic.
    */
-  async fetchWithRetry(url, init, timeoutMs) {
+  async fetchWithRetry(url, init, timeoutMs, policy = "transient") {
     const effectiveTimeout = timeoutMs ?? this.timeout;
     let lastError;
     for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
@@ -10708,7 +10870,7 @@ var GadClient = class {
           signal: controller.signal
         });
         clearTimeout(timer);
-        if (isRetryableStatus(response.status)) {
+        if (policy === "transient" && isRetryableStatus(response.status)) {
           lastError = response;
           if (attempt < MAX_RETRIES - 1) {
             await sleep(retryDelay(attempt));
@@ -10720,7 +10882,8 @@ var GadClient = class {
       } catch (error) {
         clearTimeout(timer);
         lastError = error;
-        if (isRetryable(error) && attempt < MAX_RETRIES - 1) {
+        const retryable = policy === "transient" ? isRetryable(error) : isConnectionPhaseFailure(error);
+        if (retryable && attempt < MAX_RETRIES - 1) {
           await sleep(retryDelay(attempt));
           continue;
         }
@@ -10789,7 +10952,8 @@ var GadClient = class {
           headers: this.buildHeaders(),
           body
         },
-        timeoutMs
+        timeoutMs,
+        RETRY_SAFE_TOOLS.has(toolName) ? "transient" : "connection-only"
       );
     } catch (error) {
       if (error instanceof CliError) throw error;
@@ -10881,11 +11045,16 @@ var GadClient = class {
     const url = `${this.apiUrl}${path10}`;
     let response;
     try {
-      response = await this.fetchWithRetry(url, {
-        method: "POST",
-        headers: this.buildHeaders(),
-        body: JSON.stringify(body)
-      });
+      response = await this.fetchWithRetry(
+        url,
+        {
+          method: "POST",
+          headers: this.buildHeaders(),
+          body: JSON.stringify(body)
+        },
+        void 0,
+        "connection-only"
+      );
     } catch (error) {
       if (error instanceof CliError) throw error;
       void captureCliEvent({
@@ -12302,8 +12471,8 @@ var work_default = workCommand;
 
 // src/commands/worktree.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync, readFileSync as readFileSync2, statSync, writeFileSync } from "node:fs";
-import { basename, dirname as dirname3, isAbsolute, join as join4, resolve } from "node:path";
+import { existsSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename, dirname as dirname3, isAbsolute, join as join5, resolve } from "node:path";
 var realExec = (cmd, args, opts) => {
   const out = execFileSync3(cmd, args, {
     cwd: opts?.cwd,
@@ -12325,9 +12494,9 @@ function parseDefaultBranch(symbolicRef) {
   return match ? match[1] : null;
 }
 function detectPackageManager(repoRoot) {
-  if (existsSync(join4(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join4(repoRoot, "bun.lockb"))) return "bun";
-  if (existsSync(join4(repoRoot, "yarn.lock"))) return "yarn";
+  if (existsSync(join5(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join5(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync(join5(repoRoot, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function defaultWorktreeDir(repoRoot, branch) {
@@ -12335,7 +12504,7 @@ function defaultWorktreeDir(repoRoot, branch) {
     /[^A-Za-z0-9._-]+/g,
     "-"
   );
-  return join4(dirname3(repoRoot), `${basename(repoRoot)}-${slug}`);
+  return join5(dirname3(repoRoot), `${basename(repoRoot)}-${slug}`);
 }
 var AGENT_PROCESS_RE = /(^|\/)(claude|kiro|cursor|codex)/i;
 function psField(pid, field) {
@@ -12358,7 +12527,7 @@ function findAgentPid(startPid) {
   return null;
 }
 function ownGitDir(worktreeDir) {
-  const dotGit = join4(worktreeDir, ".git");
+  const dotGit = join5(worktreeDir, ".git");
   if (!existsSync(dotGit)) return null;
   if (statSync(dotGit).isDirectory()) return dotGit;
   const match = readFileSync2(dotGit, "utf8").trim().match(/^gitdir:\s*(.+)$/m);
@@ -12372,8 +12541,8 @@ function stampWorktreeOwner(worktreeDir) {
     if (!gitDir) return null;
     const ownerPid = findAgentPid(process.ppid);
     if (!ownerPid) return null;
-    writeFileSync(
-      join4(gitDir, "agent-owner.json"),
+    writeFileSync2(
+      join5(gitDir, "agent-owner.json"),
       JSON.stringify(
         {
           ownerPid,
@@ -12467,7 +12636,7 @@ function createTaskWorktree(opts) {
   const stampedPid = opts.stamp === false ? null : stampWorktreeOwner(dir);
   const packageManager = detectPackageManager(repoRoot);
   let installed = false;
-  if (opts.install !== false && existsSync(join4(repoRoot, "package.json"))) {
+  if (opts.install !== false && existsSync(join5(repoRoot, "package.json"))) {
     exec2(packageManager, ["install"], { cwd: dir, inherit: true });
     installed = true;
   }
@@ -12530,13 +12699,13 @@ var worktree_default = worktreeCommand;
 // src/commands/install-hooks.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import {
-  chmodSync,
+  chmodSync as chmodSync2,
   existsSync as existsSync2,
-  mkdirSync,
+  mkdirSync as mkdirSync2,
   readFileSync as readFileSync3,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join5, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join6, resolve as resolve2 } from "node:path";
 var GUARD_MARKER = "# gad-agent-guard v1";
 var SCHEMA_AUDIT_MARKER = "# gad-schema-audit v1";
 var GUARD_FILE = "gad-commit-guard.mjs";
@@ -12719,28 +12888,28 @@ function installCommitGuard(opts) {
     );
   }
   if (!isAbsolute2(commonDir)) commonDir = resolve2(repoRoot, commonDir);
-  const hooksDir = join5(commonDir, "hooks");
-  mkdirSync(hooksDir, { recursive: true });
-  const guardPath = join5(hooksDir, GUARD_FILE);
-  writeFileSync2(guardPath, buildGuardScript());
-  chmodSync(guardPath, 493);
-  const huskyHook = join5(repoRoot, ".husky", "pre-commit");
-  const hookPath = existsSync2(huskyHook) ? huskyHook : join5(hooksDir, "pre-commit");
+  const hooksDir = join6(commonDir, "hooks");
+  mkdirSync2(hooksDir, { recursive: true });
+  const guardPath = join6(hooksDir, GUARD_FILE);
+  writeFileSync3(guardPath, buildGuardScript());
+  chmodSync2(guardPath, 493);
+  const huskyHook = join6(repoRoot, ".husky", "pre-commit");
+  const hookPath = existsSync2(huskyHook) ? huskyHook : join6(hooksDir, "pre-commit");
   const existing = existsSync2(hookPath) ? readFileSync3(hookPath, "utf8") : null;
   const plan = planHookInstall(existing);
   if (plan.action !== "noop") {
-    writeFileSync2(hookPath, plan.content);
+    writeFileSync3(hookPath, plan.content);
   }
-  chmodSync(hookPath, 493);
-  const huskyDir = join5(repoRoot, ".husky");
-  const huskyPrePush = join5(huskyDir, "pre-push");
-  const schemaAuditHookPath = existsSync2(huskyPrePush) || existsSync2(huskyDir) ? huskyPrePush : join5(hooksDir, "pre-push");
+  chmodSync2(hookPath, 493);
+  const huskyDir = join6(repoRoot, ".husky");
+  const huskyPrePush = join6(huskyDir, "pre-push");
+  const schemaAuditHookPath = existsSync2(huskyPrePush) || existsSync2(huskyDir) ? huskyPrePush : join6(hooksDir, "pre-push");
   const existingSchemaAuditHook = existsSync2(schemaAuditHookPath) ? readFileSync3(schemaAuditHookPath, "utf8") : null;
   const schemaAuditPlan = planSchemaAuditHookInstall(existingSchemaAuditHook);
   if (schemaAuditPlan.action !== "noop") {
-    writeFileSync2(schemaAuditHookPath, schemaAuditPlan.content);
+    writeFileSync3(schemaAuditHookPath, schemaAuditPlan.content);
   }
-  chmodSync(schemaAuditHookPath, 493);
+  chmodSync2(schemaAuditHookPath, 493);
   return {
     guardPath,
     hookPath,
@@ -12858,8 +13027,8 @@ function guardrailsCommand() {
 // src/commands/doctor.ts
 import { existsSync as existsSync3 } from "node:fs";
 import { copyFile, mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/lib/codex-config.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
@@ -14390,7 +14559,7 @@ async function checkMcp(auth) {
   }
 }
 function defaultCodexConfigPath() {
-  return join6(homedir4(), ".codex", "config.toml");
+  return join7(homedir5(), ".codex", "config.toml");
 }
 function codexIssuesToChecks(issues) {
   return issues.map((issue) => {
@@ -14528,12 +14697,12 @@ function claudeCommand() {
       isTTY: isTTY(),
       noColor: g.noColor
     });
-    const home = homedir4();
-    const gaDir = join6(home, ".great-arrow");
-    const userConfigPath = join6(home, ".claude.json");
-    const settingsPath = join6(home, ".claude", "settings.json");
-    const hookConfigPath = join6(gaDir, "hook-config.json");
-    const glanceHookPath = join6(gaDir, "claude-glance-hook.mjs");
+    const home = homedir5();
+    const gaDir = join7(home, ".great-arrow");
+    const userConfigPath = join7(home, ".claude.json");
+    const settingsPath = join7(home, ".claude", "settings.json");
+    const hookConfigPath = join7(gaDir, "hook-config.json");
+    const glanceHookPath = join7(gaDir, "claude-glance-hook.mjs");
     const checks = [];
     const repairs = [];
     const backups = [];
@@ -14741,8 +14910,8 @@ function claudeCommand() {
           file: "/Library/Application Support/ClaudeCode/managed-settings.json"
         },
         { scope: "user", file: settingsPath },
-        { scope: "project", file: join6(cwd, ".claude", "settings.json") },
-        { scope: "local", file: join6(cwd, ".claude", "settings.local.json") }
+        { scope: "project", file: join7(cwd, ".claude", "settings.json") },
+        { scope: "local", file: join7(cwd, ".claude", "settings.local.json") }
       ];
       const configured = [];
       for (const { scope, file } of scopes) {
@@ -14811,12 +14980,12 @@ function claudeCommand() {
   });
 }
 function defaultJsonClientConfigs() {
-  const home = homedir4();
+  const home = homedir5();
   return [
-    { name: "Claude Code", path: join6(home, ".claude.json") },
-    { name: "Cursor", path: join6(home, ".cursor", "mcp.json") },
-    { name: "Kiro", path: join6(home, ".kiro", "settings", "mcp.json") },
-    { name: "Gemini CLI", path: join6(home, ".gemini", "settings.json") }
+    { name: "Claude Code", path: join7(home, ".claude.json") },
+    { name: "Cursor", path: join7(home, ".cursor", "mcp.json") },
+    { name: "Kiro", path: join7(home, ".kiro", "settings", "mcp.json") },
+    { name: "Gemini CLI", path: join7(home, ".gemini", "settings.json") }
   ];
 }
 function clientsCommand() {
@@ -15462,12 +15631,12 @@ async function pathExists(path10) {
   }
 }
 async function installCodexConfig(apiUrl, token, repoUrl) {
-  const { homedir: homedir6 } = await import("node:os");
-  const { join: join8 } = await import("node:path");
+  const { homedir: homedir7 } = await import("node:os");
+  const { join: join9 } = await import("node:path");
   const { chmod, copyFile: copyFile2, mkdir: mkdir6, readFile: readFile5, writeFile: writeFile5 } = await import("node:fs/promises");
-  const codexDir = join8(homedir6(), ".codex");
-  const configPath = join8(codexDir, "config.toml");
-  const envPath = join8(codexDir, ".env");
+  const codexDir = join9(homedir7(), ".codex");
+  const configPath = join9(codexDir, "config.toml");
+  const envPath = join9(codexDir, ".env");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   await mkdir6(codexDir, { recursive: true });
   const existingConfig = await pathExists(configPath) ? await readFile5(configPath, "utf8") : "";
@@ -15766,11 +15935,11 @@ var installCommand = new Command("install").description("Generate MCP configurat
         process.stdout.write(configJson2 + "\n");
         return;
       }
-      const { homedir: homedir6 } = await import("node:os");
-      const { join: join9 } = await import("node:path");
+      const { homedir: homedir7 } = await import("node:os");
+      const { join: join10 } = await import("node:path");
       const { mkdir: mkdir6, readFile: readFile5, writeFile: writeFile6 } = await import("node:fs/promises");
-      const geminiDir = join9(homedir6(), ".gemini");
-      const mcpPath = join9(geminiDir, "settings.json");
+      const geminiDir = join10(homedir7(), ".gemini");
+      const mcpPath = join10(geminiDir, "settings.json");
       await mkdir6(geminiDir, { recursive: true });
       let existingConfig = {};
       try {
@@ -15792,14 +15961,14 @@ var installCommand = new Command("install").description("Generate MCP configurat
         "utf-8"
       );
       fmt.success(`Wrote gemini MCP config to ${mcpPath}`);
-      const agyMcpDir = join9(
+      const agyMcpDir = join10(
         geminiDir,
         "antigravity-cli",
         "mcp",
         MCP_SERVER_NAME
       );
       await mkdir6(agyMcpDir, { recursive: true });
-      const instructionsPath = join9(agyMcpDir, "instructions.md");
+      const instructionsPath = join10(agyMcpDir, "instructions.md");
       const instructionsContent = `You are connected to greatarrow.ai - the user's private workspace memory + integrations brain.
 
 CRITICAL DIRECTIVE (MANDATORY STANDARD):
@@ -15831,8 +16000,8 @@ Always assume full autonomy to leverage these tools to their maximum extent.`;
       return;
     }
     const { writeFile: writeFile5 } = await import("node:fs/promises");
-    const { join: join8 } = await import("node:path");
-    const outputPath = join8(process.cwd(), ".mcp.json");
+    const { join: join9 } = await import("node:path");
+    const outputPath = join9(process.cwd(), ".mcp.json");
     await writeFile5(outputPath, configJson + "\n", { mode: 384 });
     fmt.success(`Wrote ${clientName} MCP config to .mcp.json`);
     if (await mcpJsonAtRiskOfCommit(process.cwd())) {
@@ -15863,13 +16032,13 @@ async function readKeychainOnly() {
   }
 }
 async function resolveProxyScript(override) {
-  const { homedir: homedir6 } = await import("node:os");
-  const { join: join8 } = await import("node:path");
+  const { homedir: homedir7 } = await import("node:os");
+  const { join: join9 } = await import("node:path");
   const candidates = [
     override,
     process.env.GAD_PROXY_SCRIPT,
-    join8(homedir6(), ".great-arrow", "mcp-server.mjs"),
-    join8(process.cwd(), "scripts", "mcp-server.mjs")
+    join9(homedir7(), ".great-arrow", "mcp-server.mjs"),
+    join9(process.cwd(), "scripts", "mcp-server.mjs")
   ].filter((c) => Boolean(c));
   for (const candidate of candidates) {
     if (await pathExists(candidate)) return candidate;
@@ -15893,13 +16062,13 @@ async function runProxyDiagnostics(scriptPath) {
   }
 }
 async function findLegacyStores(cwd) {
-  const { join: join8 } = await import("node:path");
+  const { join: join9 } = await import("node:path");
   const { readdir } = await import("node:fs/promises");
   const dirs = /* @__PURE__ */ new Set([cwd]);
   try {
-    const worktreeRoot = join8(cwd, ".claude", "worktrees");
+    const worktreeRoot = join9(cwd, ".claude", "worktrees");
     for (const entry of await readdir(worktreeRoot, { withFileTypes: true })) {
-      if (entry.isDirectory()) dirs.add(join8(worktreeRoot, entry.name));
+      if (entry.isDirectory()) dirs.add(join9(worktreeRoot, entry.name));
     }
   } catch (err) {
     debugSwallow("mcp.findLegacyStores(worktrees)", err);
@@ -15921,18 +16090,18 @@ async function findLegacyStores(cwd) {
   }
   const stores = [];
   for (const dir of dirs) {
-    const path10 = join8(dir, ".mcp", OAUTH_CRED_FILENAME);
+    const path10 = join9(dir, ".mcp", OAUTH_CRED_FILENAME);
     const raw = await readIfExists(path10);
     if (raw !== null) stores.push({ path: path10, raw });
   }
   return stores;
 }
 async function scanConnections() {
-  const { homedir: homedir6 } = await import("node:os");
-  const { join: join8 } = await import("node:path");
-  const home = homedir6();
+  const { homedir: homedir7 } = await import("node:os");
+  const { join: join9 } = await import("node:path");
+  const home = homedir7();
   const hookSettings = await readIfExists(
-    join8(home, ".claude", "settings.json")
+    join9(home, ".claude", "settings.json")
   );
   const hooksInstalled = hookSettings ? hasGreatArrowHooks(hookSettings) : false;
   const entries = [];
@@ -15965,16 +16134,16 @@ async function probeEndpoint() {
   }
 }
 async function applyMigration(plan) {
-  const { homedir: homedir6 } = await import("node:os");
-  const { join: join8 } = await import("node:path");
+  const { homedir: homedir7 } = await import("node:os");
+  const { join: join9 } = await import("node:path");
   const { mkdir: mkdir6, rename, writeFile: writeFile5 } = await import("node:fs/promises");
   const applied = [];
-  const dir = join8(homedir6(), ".great-arrow");
+  const dir = join9(homedir7(), ".great-arrow");
   await mkdir6(dir, { recursive: true, mode: 448 });
   if (plan.seedFrom) {
     const raw = await readIfExists(plan.seedFrom);
     if (raw !== null) {
-      const target = join8(dir, OAUTH_CRED_FILENAME);
+      const target = join9(dir, OAUTH_CRED_FILENAME);
       const tmp = `${target}.tmp`;
       await writeFile5(tmp, raw, { mode: 384 });
       await rename(tmp, target);
@@ -15984,7 +16153,7 @@ async function applyMigration(plan) {
   if (plan.syncKeychainToFile) {
     const raw = await readKeychainOnly();
     if (raw) {
-      const target = join8(dir, "credential");
+      const target = join9(dir, "credential");
       const tmp = `${target}.tmp`;
       await writeFile5(tmp, raw, { mode: 384 });
       await rename(tmp, target);
@@ -16010,19 +16179,19 @@ var doctorSubcommand = new Command("doctor").description(
       noColor: false
     });
     const c = createColor(jsonFlag);
-    const { homedir: homedir6 } = await import("node:os");
-    const { join: join8 } = await import("node:path");
-    const home = homedir6();
+    const { homedir: homedir7 } = await import("node:os");
+    const { join: join9 } = await import("node:path");
+    const home = homedir7();
     const proxyPath = await resolveProxyScript(options.proxy);
     const diagnostics = proxyPath ? await runProxyDiagnostics(proxyPath) : null;
     const entries = await scanConnections();
     const duplicates = detectDuplicates(entries);
     const keychain = await readKeychainOnly();
     const credentialFile = await readIfExists(
-      join8(home, ".great-arrow", "credential")
+      join9(home, ".great-arrow", "credential")
     );
     const userStore = await readIfExists(
-      join8(home, ".great-arrow", OAUTH_CRED_FILENAME)
+      join9(home, ".great-arrow", OAUTH_CRED_FILENAME)
     );
     const legacyStores = await findLegacyStores(process.cwd());
     const findings = [
@@ -16447,8 +16616,8 @@ function askCommand() {
 
 // src/lib/glance-footer.ts
 import { readFile as readFile4, writeFile as writeFile4, mkdir as mkdir5 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { join as join7, dirname as dirname5 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+import { join as join8, dirname as dirname5 } from "node:path";
 
 // src/lib/seen.ts
 var SEEN_TIMEOUT_MS = 1e3;
@@ -16835,7 +17004,7 @@ function shouldRequestTip(input) {
   return now - state.lastTipAt >= TIP_THROTTLE_INTERVAL_MS;
 }
 function getGlanceStatePath() {
-  return join7(homedir5(), ".gad", "glance-state.json");
+  return join8(homedir6(), ".gad", "glance-state.json");
 }
 async function loadGlanceState() {
   try {
@@ -19082,9 +19251,9 @@ node_default(Temp.purgeSyncAll);
 var temp_default = Temp;
 
 // node_modules/.pnpm/atomically@2.1.1/node_modules/atomically/dist/index.js
-function writeFileSync3(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
+function writeFileSync4(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
   if (isString(options))
-    return writeFileSync3(filePath, data, { encoding: options });
+    return writeFileSync4(filePath, data, { encoding: options });
   const timeout2 = options.timeout ?? DEFAULT_TIMEOUT_SYNC;
   const retryOptions = { timeout: timeout2 };
   let tempDisposer = null;
@@ -19411,7 +19580,7 @@ var Configstore = class {
       }
       if (error.name === "SyntaxError") {
         if (this._clearInvalidConfig) {
-          writeFileSync3(this._path, "", writeFileOptions);
+          writeFileSync4(this._path, "", writeFileOptions);
           return {};
         }
         throw error;
@@ -19423,7 +19592,7 @@ var Configstore = class {
   set all(value) {
     try {
       import_graceful_fs.default.mkdirSync(path5.dirname(this._path), mkdirOptions);
-      writeFileSync3(this._path, JSON.stringify(value, void 0, "	"), writeFileOptions);
+      writeFileSync4(this._path, JSON.stringify(value, void 0, "	"), writeFileOptions);
     } catch (error) {
       handlePermissionError(error);
     }
@@ -22130,6 +22299,7 @@ void captureCliEvent({
 });
 program2.addCommand(login_default);
 program2.addCommand(logoutCommand);
+program2.addCommand(authCommand());
 program2.addCommand(whoamiCommand());
 program2.addCommand(memoryCommand);
 program2.addCommand(workspace_default);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {