@halyard/cli 0.1.2 → 0.2.0

package/README.md

@@ -1,6 +1,8 @@
 # @halyard/cli
 
-Command-line companion for [Halyard](https://usehalyard.ai) — scaffold Halyard into your repo for Claude Code, Cursor, and Codex, and sync your coding session logs back to the platform.
+Command-line companion for [Halyard](https://usehalyard.ai) — scaffold Halyard into your repo for Claude Code, Cursor, and Codex, and sync your coding-agent sessions back to the platform.
+
+`halyard sync` discovers sessions from **Claude Code** (`~/.claude/projects/`), **Codex CLI** (`~/.codex/sessions/`), **Gemini CLI** (`~/.gemini/tmp/*/chats/`), **OpenCode** (via `opencode export`), and **GitHub Copilot CLI** (`~/.copilot/session-store.db`, Node ≥ 22.13). Each session becomes searchable knowledge plus per-person work metrics — cost (USD), turns, duration, tokens, and tool activity.
 
 ## Install
 
@@ -18,10 +20,95 @@ halyard setup     # Scaffold Halyard into the current repo (alias: init)
 halyard login     # Authenticate via your browser
 halyard sync      # Upload new session logs to Halyard
 halyard push      # Push a single session file
+halyard whoami    # Show the authenticated user, org, and repo binding
+halyard skills    # Discover local agent skills (SKILL.md folders) and sync them to Halyard
 ```
 
 Run `halyard --help` for the full list of flags.
 
+## Repo binding (`.halyard.json`)
+
+A committed `.halyard.json` at the repo root binds the repo to one organization:
+
+```json
+{ "org": "halyard-studio" }
+```
+
+Create it with `halyard setup --org <slug>` (add `--force` to rebind an already-bound
+repo). The binding is discovered by walking up from the current directory; detached
+git worktrees fall back to the main checkout's binding via `git rev-parse
+--git-common-dir`.
+
+In a bound repo:
+
+- `halyard sync` uploads only sessions whose working directory resolves to the same
+  repository (matched by git common dir, then by normalized `remote.origin.url`).
+  Sessions whose repo can't be determined are skipped and counted; `halyard sync --all`
+  restores machine-wide sync.
+- `halyard sync` and `halyard push` print `Syncing <scope> → <org>` before uploading
+  and hard-fail if your credentials belong to a different org than the binding —
+  re-run `halyard login` inside the repo to fix that.
+- `halyard login` stores workspace-scoped credentials for the bound org (see below).
+
+Without a binding, `sync` keeps the old machine-wide behavior and prints a notice.
+
+## Credentials
+
+Resolution order for every command:
+
+1. `HALYARD_TOKEN` env var — an `sk_halyard_...` API key (or raw token) for
+   headless/CI use. API keys are bound to one org server-side; the CLI cannot
+   verify that org against a repo binding, so it warns instead of hard-failing.
+2. `~/.halyard/credentials/<orgId>.json` — per-org OAuth chains, matched against
+   the repo binding's org slug. Written by `halyard login` inside a bound repo.
+3. `~/.halyard/credentials.json` — the legacy/default chain, written by
+   `halyard login` outside a bound repo and used by `halyard orgs switch`.
+
+Token refresh always writes back to the same file the credentials were read from.
+Set `HALYARD_HOME` to relocate the state directory (defaults to `~/.halyard`).
+
+## Environment variables
+
+| Variable          | Purpose                                                       |
+| ----------------- | ------------------------------------------------------------- |
+| `HALYARD_TOKEN`   | API key / token override for headless use (beats stored auth) |
+| `HALYARD_API_URL` | Default for `--api-url` (the flag still wins)                 |
+| `HALYARD_HOME`    | State directory override (default `~/.halyard`)               |
+
+## Upload every session automatically
+
+```bash
+halyard setup --org <your-org-slug>
+```
+
+`setup --org` binds the repo (see above) and writes a launcher, `.halyard/hook.sh`, plus session-start / session-end hook config for **Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, OpenCode and Grok Build**. Each hook runs `halyard hook`, which uploads the transcript that just finished at session end and sweeps this repo's earlier transcripts that never uploaded at session start. Commit the generated files and every clone gets the behaviour. Re-running `setup` is idempotent; `--no-hooks` skips this part.
+
+`halyard hook` reads the client's hook payload from stdin, resolves credentials the same way `sync` and `push` do (`HALYARD_TOKEN` from the environment or the repo's `.env`, then the per-org login for the bound org, then the default login), skips instead of uploading when login credentials belong to another org than `.halyard.json`, never blocks the agent, and logs to `~/.halyard/hooks.log`. Claude and Codex sweeps use the same repo-scoped matching as `halyard sync`. Run `halyard hook --help` for the flags.
+
+Upload happens at session **end**, not on every turn: the ingest endpoint keeps the first upload it sees for a session id. See [`docs/agent-session-upload.md`](https://github.com/halyard-labs/halyard/blob/main/docs/agent-session-upload.md) for the per-client details.
+
+## Sync your agent skills
+
+```bash
+halyard skills list              # every SKILL.md folder on this machine, with its fingerprint
+halyard skills sync              # upload new or changed skills to the bound org
+halyard skills sync --scope project --dry-run
+```
+
+`skills sync` scans the directories every harness reads — user-level (`~/.claude/skills`, `~/.agents/skills`, `~/.codex/skills`, `~/.cursor/skills`, `~/.gemini/skills`, `~/.copilot/skills`, OpenCode, Amp, Windsurf, Grok, Kiro, Cline, Factory) and repo-level (`.claude/skills`, `.agents/skills`, `.github/skills`, …) — de-duplicates symlink aliases by real path, fingerprints each folder (sha256 over every file, not just `SKILL.md`), and uploads what changed. Each skill becomes a `PROCESS` knowledge entry, searchable by every agent connected to the org. Re-runs are free: unchanged skills are skipped from the local ledger, and the server compares the fingerprint again for anything the ledger missed. The session-start hook syncs the repo's committed skills automatically (`HALYARD_SKILLS_SYNC=0` turns that off); personal skills only go up when you run the command. See [`docs/agent-skills-sync.md`](https://github.com/halyard-labs/halyard/blob/main/docs/agent-skills-sync.md).
+
+### Headless and cloud environments
+
+Set `HALYARD_TOKEN` to an API key in the environment (one key per environment; keys are bound to one organization):
+
+```bash
+halyard api-keys create --name "my-repo-ci"      # prints sk_halyard_… once
+export HALYARD_TOKEN=sk_halyard_…
+halyard sync --provider claude                   # or push <file>
+```
+
+Where to set it: Claude Code on the web → environment variables; Codex Cloud → environment variables (not secrets, which are removed before the agent phase); Cursor cloud agents → dashboard Secrets; GitHub Copilot coding agent → Agents secrets; GitHub Actions → `secrets.HALYARD_TOKEN` and a final `if: always()` step running `halyard sync`.
+
 ## Learn more
 
 - Product: [usehalyard.ai](https://usehalyard.ai)

package/dist/cli.js

@@ -6,16 +6,39 @@ import { loginCommand } from './commands/login.js';
 import { syncCommand } from './commands/sync.js';
 import { pushCommand } from './commands/push.js';
 import { setupCommand } from './commands/setup.js';
-const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf-8'));
+import { whoamiCommand } from './commands/whoami.js';
+import { apiKeysCommand } from './commands/api-keys.js';
+import { usersCommand } from './commands/users.js';
+import { orgsCommand } from './commands/orgs.js';
+import { sessionsCommand } from './commands/sessions.js';
+import { hookCommand } from './commands/hook.js';
+import { skillsCommand } from './commands/skills.js';
+function resolveVersion() {
+    try {
+        const packageJson = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf-8'));
+        return packageJson.version;
+    }
+    catch {
+        return typeof __HALYARD_CLI_VERSION__ === 'string' ? __HALYARD_CLI_VERSION__ : '0.0.0-dev';
+    }
+}
 const program = new Command();
 program
     .name('halyard')
-    .description('Set up Halyard in your repo and sync coding session logs')
-    .version(packageJson.version)
-    .option('--api-url <url>', 'Halyard API URL', DEFAULT_API_URL);
+    .description('Set up Halyard in your repo and sync coding session logs and agent skills')
+    .version(resolveVersion())
+    .option('--api-url <url>', 'Halyard API URL (env: HALYARD_API_URL)', process.env['HALYARD_API_URL'] ?? DEFAULT_API_URL)
+    .option('--json', 'Output raw JSON');
 program.addCommand(setupCommand());
 program.addCommand(loginCommand());
 program.addCommand(syncCommand());
 program.addCommand(pushCommand());
+program.addCommand(whoamiCommand());
+program.addCommand(apiKeysCommand());
+program.addCommand(usersCommand());
+program.addCommand(orgsCommand());
+program.addCommand(sessionsCommand());
+program.addCommand(hookCommand());
+program.addCommand(skillsCommand());
 program.parse();
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAC5C,CAAA;AAExB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;KAC5B,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAA;AAEhE,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AAEjC,OAAO,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAMpD,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAC5C,CAAA;QACxB,OAAO,WAAW,CAAC,OAAO,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW,CAAA;IAC5F,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,2EAA2E,CAAC;KACxF,OAAO,CAAC,cAAc,EAAE,CAAC;KACzB,MAAM,CACL,iBAAiB,EACjB,wCAAwC,EACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,eAAe,CAClD;KACA,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAA;AAEtC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAA;AACnC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAA;AACrC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAA;AAEnC,OAAO,CAAC,KAAK,EAAE,CAAA"}

package/dist/commands/api-keys.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function apiKeysCommand(): Command;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/commands/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/commands/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAsBnC,wBAAgB,cAAc,IAAI,OAAO,CAkGxC"}

package/dist/commands/api-keys.js

@@ -0,0 +1,90 @@
+import { Command } from 'commander';
+import { apiFetch, ApiError } from '../lib/http.js';
+import { printTable, printJson, formatDate, confirm, fail } from '../lib/output.js';
+export function apiKeysCommand() {
+    const apiKeys = new Command('api-keys').description('Manage API keys (requires `halyard login`; keys belong to the current organization)');
+    apiKeys
+        .command('create')
+        .description('Create a new API key. The secret is shown once and cannot be retrieved again.')
+        .requiredOption('--name <name>', 'Display name for the key')
+        .action(async function () {
+        const globalOpts = this.optsWithGlobals();
+        const apiUrl = globalOpts.apiUrl;
+        const name = this.opts().name;
+        let key;
+        try {
+            key = await apiFetch(apiUrl, '/api/v1/api-keys', {
+                method: 'POST',
+                body: { name },
+            });
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+        if (globalOpts.json) {
+            printJson(key);
+            return;
+        }
+        console.log(`Created API key "${key.name}" (${key.id})`);
+        console.log('');
+        console.log(`  ${key.secret}`);
+        console.log('');
+        console.log('Store this secret now - it will not be shown again.');
+        console.log('Use it via the HALYARD_TOKEN environment variable.');
+    });
+    apiKeys
+        .command('list')
+        .description('List your active API keys')
+        .action(async function () {
+        const globalOpts = this.optsWithGlobals();
+        const apiUrl = globalOpts.apiUrl;
+        let response;
+        try {
+            response = await apiFetch(apiUrl, '/api/v1/api-keys');
+        }
+        catch (err) {
+            fail(err instanceof Error ? err.message : String(err));
+        }
+        if (globalOpts.json) {
+            printJson(response);
+            return;
+        }
+        if (response.keys.length === 0) {
+            console.log('No API keys. Create one with `halyard api-keys create --name <name>`.');
+            return;
+        }
+        printTable(response.keys, [
+            { key: 'id', header: 'ID' },
+            { key: 'name', header: 'NAME' },
+            { key: 'prefix', header: 'PREFIX', format: (v) => `${String(v)}...` },
+            { key: 'lastUsedAt', header: 'LAST USED', format: formatDate },
+            { key: 'createdAt', header: 'CREATED', format: formatDate },
+        ]);
+    });
+    apiKeys
+        .command('revoke')
+        .description('Revoke an API key (immediate; the key stops authenticating on its next use)')
+        .argument('<id>', 'API key ID (from `halyard api-keys list`)')
+        .option('-f, --force', 'Skip the confirmation prompt')
+        .action(async function (id) {
+        const globalOpts = this.optsWithGlobals();
+        const apiUrl = globalOpts.apiUrl;
+        const force = !!this.opts().force;
+        const confirmed = await confirm(`Revoke API key ${id}? This cannot be undone.`, { force });
+        if (!confirmed) {
+            fail('Aborted.');
+        }
+        try {
+            await apiFetch(apiUrl, `/api/v1/api-keys/${id}`, { method: 'DELETE' });
+        }
+        catch (err) {
+            if (err instanceof ApiError && err.status === 404) {
+                fail('API key not found (or not yours).');
+            }
+            fail(err instanceof Error ? err.message : String(err));
+        }
+        console.log('Key revoked.');
+    });
+    return apiKeys;
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/commands/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/commands/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAoBnF,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CACjD,qFAAqF,CACtF,CAAA;IAED,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+EAA+E,CAAC;SAC5F,cAAc,CAAC,eAAe,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,KAAK;QACX,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAgB,CAAA;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAc,CAAA;QAEvC,IAAI,GAAe,CAAA;QACnB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAa,MAAM,EAAE,kBAAkB,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE;aACf,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,CAAC,CAAA;YACd,OAAM;QACR,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,KAAK;QACX,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAgB,CAAA;QAE1C,IAAI,QAAyB,CAAA;QAC7B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAkB,MAAM,EAAE,kBAAkB,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,SAAS,CAAC,QAAQ,CAAC,CAAA;YACnB,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAA;YACpF,OAAM;QACR,CAAC;QAED,UAAU,CAAC,QAAQ,CAAC,IAA4C,EAAE;YAChE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3B,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;YAC/B,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;YACrE,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;YAC9D,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE;SAC5D,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEJ,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6EAA6E,CAAC;SAC1F,QAAQ,CAAC,MAAM,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,aAAa,EAAE,8BAA8B,CAAC;SACrD,MAAM,CAAC,KAAK,WAA0B,EAAU;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAgB,CAAA;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;QAEjC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,CAAA;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAClD,IAAI,CAAC,mCAAmC,CAAC,CAAA;YAC3C,CAAC;YACD,IAAI,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACxD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEJ,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/commands/hook.d.ts

@@ -0,0 +1,6 @@
+import { Command } from 'commander';
+/** The parent passes the hook payload to its detached child through this
+ *  variable, because the child has no stdin. */
+export declare const HOOK_INPUT_ENV = "HALYARD_HOOK_INPUT";
+export declare function hookCommand(): Command;
+//# sourceMappingURL=hook.d.ts.map

package/dist/commands/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAYnC;gDACgD;AAChD,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAoFlD,wBAAgB,WAAW,IAAI,OAAO,CA0BrC"}

package/dist/commands/hook.js

@@ -0,0 +1,106 @@
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { Command } from 'commander';
+import { halyardDir } from '../lib/config.js';
+import { HOOK_CLIENTS, isHookClient, normalizeEvent, parseHookInput, } from '../lib/hook-input.js';
+import { HookLogger, runHook } from '../lib/hook-runner.js';
+/** The parent passes the hook payload to its detached child through this
+ *  variable, because the child has no stdin. */
+export const HOOK_INPUT_ENV = 'HALYARD_HOOK_INPUT';
+const STDIN_TIMEOUT_MS = 2000;
+function readStdin(timeoutMs) {
+    return new Promise((resolve) => {
+        let data = '';
+        const finish = () => {
+            clearTimeout(timer);
+            process.stdin.pause();
+            resolve(data);
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on('end', finish);
+        process.stdin.on('error', finish);
+    });
+}
+function parseEvent(value) {
+    if (value === 'start' || value === 'end' || value === 'sweep')
+        return value;
+    return value ? normalizeEvent(value) : null;
+}
+function childArgs(opts, apiUrl, event) {
+    const args = [process.argv[1] ?? '', '--api-url', apiUrl, 'hook', '--event', event];
+    if (opts.client)
+        args.push('--client', opts.client);
+    if (opts.root)
+        args.push('--root', opts.root);
+    if (opts.transcript)
+        args.push('--transcript', opts.transcript);
+    if (opts.dryRun)
+        args.push('--dry-run');
+    return args;
+}
+/** Run the upload in a background process so the host's hook budget is never
+ *  hit (Codex caps SessionEnd at 3s) and session start is never delayed. */
+function detach(args, input) {
+    const child = spawn(process.execPath, args, {
+        detached: true,
+        stdio: 'ignore',
+        env: { ...process.env, [HOOK_INPUT_ENV]: input },
+    });
+    child.unref();
+}
+async function execute(opts, apiUrl) {
+    if (process.env['HALYARD_SESSION_UPLOAD'] === '0')
+        return;
+    const input = process.env[HOOK_INPUT_ENV] ?? (process.stdin.isTTY ? '' : await readStdin(STDIN_TIMEOUT_MS));
+    const event = parseEvent(opts.event) ?? normalizeEvent(parseHookInput(input).event);
+    if (!event)
+        return;
+    const client = opts.client && isHookClient(opts.client) ? opts.client : undefined;
+    if (event === 'start' || (event === 'end' && opts.detach)) {
+        detach(childArgs(opts, apiUrl, event === 'start' ? 'sweep' : 'end'), input);
+        return;
+    }
+    await runHook({
+        input,
+        client,
+        event,
+        root: opts.root,
+        transcript: opts.transcript,
+        dryRun: !!opts.dryRun,
+        apiUrl,
+        halyardDir: halyardDir(),
+        homeDir: homedir(),
+        env: process.env,
+        cwd: process.cwd(),
+    });
+}
+export function hookCommand() {
+    return new Command('hook')
+        .description('Agent lifecycle hook: upload the session that just ended, or sweep unsynced ones (wired by `halyard setup`)')
+        .option('--client <name>', `Client (${HOOK_CLIENTS.join(', ')}); auto-detected when omitted`)
+        .option('--event <event>', 'start | end | sweep (defaults to the event in the hook payload)')
+        .option('--root <dir>', "Repository root (defaults to the client's project dir or cwd)")
+        .option('--transcript <path>', 'Transcript to upload (defaults to the hook payload)')
+        .option('--detach', 'Upload in a background process and return immediately')
+        .option('--dry-run', 'Log what would be uploaded without uploading')
+        .action(async function () {
+        const opts = this.opts();
+        const apiUrl = this.optsWithGlobals().apiUrl;
+        try {
+            await execute(opts, apiUrl);
+        }
+        catch (err) {
+            new HookLogger(join(halyardDir(), 'hooks.log'), `${opts.client ?? '?'}/${opts.event ?? '?'}`).log(`error: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // Gemini CLI blocks unless a hook prints JSON on stdout.
+        if (opts.client === 'gemini' || process.env['GEMINI_PROJECT_DIR'])
+            console.log('{}');
+        process.exitCode = 0;
+    });
+}
+//# sourceMappingURL=hook.js.map

package/dist/commands/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/commands/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,GAGf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE3D;gDACgD;AAChD,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAClD,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAW7B,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACrB,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAC3C,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,IAAI,KAAK,CAAA;QACf,CAAC,CAAC,CAAA;QACF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,IAAoB,EAAE,MAAc,EAAE,KAAgB;IACvE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACnF,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACnD,IAAI,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/D,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACvC,OAAO,IAAI,CAAA;AACb,CAAC;AAED;4EAC4E;AAC5E,SAAS,MAAM,CAAC,IAAc,EAAE,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC1C,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE;KACjD,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAoB,EAAE,MAAc;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,GAAG;QAAE,OAAM;IACzD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC/F,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;IACnF,IAAI,CAAC,KAAK;QAAE,OAAM;IAElB,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAC3E,OAAM;IACR,CAAC;IAED,MAAM,OAAO,CAAC;QACZ,KAAK;QACL,MAAM;QACN,KAAK;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACrB,MAAM;QACN,UAAU,EAAE,UAAU,EAAE;QACxB,OAAO,EAAE,OAAO,EAAE;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;SACvB,WAAW,CACV,6GAA6G,CAC9G;SACA,MAAM,CAAC,iBAAiB,EAAE,WAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;SAC5F,MAAM,CAAC,iBAAiB,EAAE,iEAAiE,CAAC;SAC5F,MAAM,CAAC,cAAc,EAAE,+DAA+D,CAAC;SACvF,MAAM,CAAC,qBAAqB,EAAE,qDAAqD,CAAC;SACpF,MAAM,CAAC,UAAU,EAAE,uDAAuD,CAAC;SAC3E,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;SACnE,MAAM,CAAC,KAAK;QACX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAoB,CAAA;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,MAAgB,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CACZ,IAAI,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,EAC/B,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAC7C,CAAC,GAAG,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,yDAAyD;QACzD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/login.d.ts

@@ -1,3 +1,20 @@
 import { Command } from 'commander';
+import { refreshToken, type Credentials } from '../lib/auth.js';
+import { type RepoBinding } from '../lib/repo-binding.js';
 export declare function loginCommand(): Command;
+export interface PersistLoginOptions {
+    creds: Credentials;
+    binding: RepoBinding | null;
+    /** Injectable for tests */
+    fetchImpl?: typeof fetch;
+    refreshImpl?: typeof refreshToken;
+}
+/**
+ * Persist freshly exchanged tokens. In an unbound repo this is the legacy
+ * behavior (write ~/.halyard/credentials.json). In a bound repo, resolve the
+ * binding's org slug against /api/v1/organizations, reissue workspace-scoped
+ * tokens when needed, and save to the per-org store.
+ * Returns the success message to print; throws on failure.
+ */
+export declare function persistLogin(options: PersistLoginOptions): Promise<string>;
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkBnC,wBAAgB,YAAY,IAAI,OAAO,CA4KtC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAEL,YAAY,EAGZ,KAAK,WAAW,EACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAA;AA8D1E,wBAAgB,YAAY,IAAI,OAAO,CA6KtC;AASD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,WAAW,CAAA;IAClB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAA;IAC3B,2BAA2B;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,WAAW,CAAC,EAAE,OAAO,YAAY,CAAA;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF"}

package/dist/commands/login.js

@@ -2,7 +2,8 @@ import { createServer } from 'node:http';
 import { randomBytes, createHash } from 'node:crypto';
 import { Command } from 'commander';
 import open from 'open';
-import { saveCredentials } from '../lib/auth.js';
+import { perOrgCredentialsPath, refreshToken, saveCredentials, savePerOrgCredentials, } from '../lib/auth.js';
+import { findRepoBinding } from '../lib/repo-binding.js';
 /**
  * Generate a PKCE code verifier (RFC 7636)
  */
@@ -15,6 +16,51 @@ function generateCodeVerifier() {
 function generateCodeChallenge(verifier) {
     return createHash('sha256').update(verifier).digest('base64url');
 }
+/**
+ * Branded OAuth return page. Fully self-contained (inline sail mark, system
+ * font fallbacks, prefers-color-scheme dark) because it is served from the
+ * loopback listener with no asset pipeline. Values mirror the design tokens in
+ * packages/ui/src/styles/brand-tokens.css; the desktop app serves the same page
+ * from apps/desktop/src-tauri/src/oauth.rs — keep the two in step.
+ */
+function returnPage(ok, msg) {
+    const escaped = msg.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${ok ? 'Halyard — signed in' : 'Halyard — sign-in failed'}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: #fdfbf7; color: #2b180a; font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; -webkit-font-smoothing: antialiased; }
+  main { text-align: center; padding: 56px 64px; max-width: 420px; border: 1px solid #ede4da; border-radius: 14px; background: #faf7f1; box-shadow: 0 1px 3px rgba(43, 24, 10, 0.05); }
+  h1 { font-family: 'Playfair Display', Georgia, 'Times New Roman', serif; font-weight: 500; font-size: 30px; letter-spacing: -0.01em; margin: 24px 0 10px; }
+  p { color: #796758; font-size: 15px; line-height: 1.55; margin: 0; }
+  .rule { width: 40px; height: 2px; border-radius: 1px; background: #8b6914; opacity: 0.55; margin: 26px auto 0; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #131210; color: #ebe5db; }
+    main { border-color: #312e28; background: #1a1815; box-shadow: none; }
+    p { color: #7d766a; }
+    .rule { background: #d4a017; }
+  }
+</style>
+</head>
+<body>
+<main>
+  <svg width="56" height="56" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="Halyard">
+    <rect width="48" height="48" rx="10" fill="#1C1A16"/>
+    <path d="M 18.000,24.750 Q 18.000,22.500 16.821,24.416 L 7.179,40.085 Q 6.000,42.000 8.250,42.000 L 15.750,42.000 Q 18.000,42.000 18.000,39.750 Z" fill="#E8DFD0" opacity="0.8"/>
+    <path d="M 42.000,8.250 Q 42.000,6.000 40.808,7.908 L 20.693,40.092 Q 19.500,42.000 21.750,42.000 L 39.750,42.000 Q 42.000,42.000 42.000,39.750 Z" fill="#E8DFD0"/>
+  </svg>
+  <h1>${ok ? 'You&rsquo;re signed in' : 'Sign-in didn&rsquo;t complete'}</h1>
+  <p>${escaped}</p>
+  <div class="rule"></div>
+</main>
+</body>
+</html>
+`;
+}
 export function loginCommand() {
     return new Command('login')
         .description('Authenticate with Halyard via browser login')
@@ -72,7 +118,7 @@ export function loginCommand() {
                     const error = url.searchParams.get('error');
                     if (error) {
                         res.writeHead(200, { 'Content-Type': 'text/html' });
-                        res.end('<html><body><h1>Login failed</h1><p>You can close this tab.</p></body></html>');
+                        res.end(returnPage(false, 'You can close this tab and try again from the terminal.'));
                         clearTimeout(timeout);
                         server.close();
                         reject(new Error(`OAuth error: ${error}`));
@@ -80,7 +126,7 @@ export function loginCommand() {
                     }
                     if (returnedState !== state) {
                         res.writeHead(200, { 'Content-Type': 'text/html' });
-                        res.end('<html><body><h1>Login failed</h1><p>State mismatch. You can close this tab.</p></body></html>');
+                        res.end(returnPage(false, 'State mismatch. You can close this tab.'));
                         clearTimeout(timeout);
                         server.close();
                         reject(new Error('OAuth state mismatch'));
@@ -88,14 +134,14 @@ export function loginCommand() {
                     }
                     if (!code) {
                         res.writeHead(200, { 'Content-Type': 'text/html' });
-                        res.end('<html><body><h1>Login failed</h1><p>No auth code received. You can close this tab.</p></body></html>');
+                        res.end(returnPage(false, 'No auth code received. You can close this tab.'));
                         clearTimeout(timeout);
                         server.close();
                         reject(new Error('No authorization code received'));
                         return;
                     }
                     res.writeHead(200, { 'Content-Type': 'text/html' });
-                    res.end('<html><body><h1>Login successful!</h1><p>You can close this tab and return to the terminal.</p></body></html>');
+                    res.end(returnPage(true, 'You can close this tab and return to the terminal.'));
                     clearTimeout(timeout);
                     server.close();
                     resolve(code);
@@ -124,6 +170,7 @@ export function loginCommand() {
         }
         // Step 5: Exchange auth code for tokens
         console.log('Exchanging authorization code...');
+        let tokenData;
         try {
             const tokenRes = await fetch(`${apiUrl}/oauth/token`, {
                 method: 'POST',
@@ -140,21 +187,71 @@ export function loginCommand() {
                 const body = await tokenRes.text();
                 throw new Error(`Token exchange failed (${tokenRes.status}): ${body}`);
             }
-            const tokenData = (await tokenRes.json());
-            saveCredentials({
-                accessToken: tokenData.access_token,
-                refreshToken: tokenData.refresh_token,
-                clientId,
-                expiresAt: Date.now() + tokenData.expires_in * 1000,
-                apiUrl,
-            });
-            console.log('Login successful! Credentials saved to ~/.halyard/credentials.json');
+            tokenData = (await tokenRes.json());
         }
         catch (err) {
             console.error('Token exchange failed:', err instanceof Error ? err.message : err);
             process.exit(1);
         }
+        // Step 6: Persist credentials (org-aware when the repo is bound)
+        try {
+            const message = await persistLogin({
+                creds: {
+                    accessToken: tokenData.access_token,
+                    refreshToken: tokenData.refresh_token,
+                    clientId,
+                    expiresAt: Date.now() + tokenData.expires_in * 1000,
+                    apiUrl,
+                },
+                binding: findRepoBinding(),
+            });
+            console.log(message);
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+/**
+ * Persist freshly exchanged tokens. In an unbound repo this is the legacy
+ * behavior (write ~/.halyard/credentials.json). In a bound repo, resolve the
+ * binding's org slug against /api/v1/organizations, reissue workspace-scoped
+ * tokens when needed, and save to the per-org store.
+ * Returns the success message to print; throws on failure.
+ */
+export async function persistLogin(options) {
+    const { creds, binding, fetchImpl = fetch, refreshImpl = refreshToken } = options;
+    if (!binding) {
+        saveCredentials(creds);
+        return 'Login successful! Credentials saved to ~/.halyard/credentials.json';
+    }
+    const res = await fetchImpl(`${creds.apiUrl}/api/v1/organizations`, {
+        headers: { Authorization: `Bearer ${creds.accessToken}` },
     });
+    if (!res.ok) {
+        throw new Error(`Could not list organizations (${res.status}): ${await res.text()}`);
+    }
+    const { organizations } = (await res.json());
+    const target = organizations.find((org) => org.slug === binding.org);
+    if (!target) {
+        const available = organizations.map((org) => `  ${org.slug}`).join('\n');
+        throw new Error(`This repo is bound to organization "${binding.org}" (${binding.rootDir}/.halyard.json), ` +
+            `but your account has no access to it.\nAvailable organizations:\n${available}`);
+    }
+    if (target.isCurrent) {
+        // Token is already scoped to the bound org - save it as-is.
+        savePerOrgCredentials({ ...creds, orgId: target.id, orgSlug: target.slug });
+    }
+    else {
+        // Workspace-scoped reissue, persisted straight into the per-org store.
+        await refreshImpl(creds.refreshToken, creds.clientId, creds.apiUrl, target.id, {
+            filePath: perOrgCredentialsPath(target.id),
+            orgId: target.id,
+            orgSlug: target.slug,
+        });
+    }
+    return `Logged in to Halyard (${target.slug}) for this repo`;
 }
 /**
  * Find an available port for the OAuth callback server.