@keynv/cli 0.1.0-rc.10 → 0.1.0-rc.11

package/dist/index.js

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import 'crypto';
 import { readFileSync, existsSync, statSync, writeFileSync, unlinkSync, mkdirSync, rmSync, readdirSync } from 'fs';
-import { homedir } from 'os';
+import { hostname, platform, homedir } from 'os';
 import { isAbsolute, resolve, join, dirname, basename } from 'path';
 import { Entry } from '@napi-rs/keyring';
 import { styleText } from 'util';
@@ -579,16 +579,16 @@ var require_lib = __commonJS({
     }
     var TypeAssertionError = class extends Error {
       constructor({ errors } = {}) {
-        let errorMessage = `Type mismatch`;
+        let errorMessage2 = `Type mismatch`;
         if (errors && errors.length > 0) {
-          errorMessage += `
+          errorMessage2 += `
 `;
           for (const error of errors) {
-            errorMessage += `
+            errorMessage2 += `
 - ${error}`;
           }
         }
-        super(errorMessage);
+        super(errorMessage2);
       }
     };
     function assert(val, validator) {
@@ -1056,7 +1056,7 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.10" ;
+    VERSION = "0.1.0-rc.11" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
@@ -1695,15 +1695,15 @@ var init_parseUtil = __esm({
           message: issueData.message
         };
       }
-      let errorMessage = "";
+      let errorMessage2 = "";
       const maps = errorMaps.filter((m) => !!m).slice().reverse();
       for (const map of maps) {
-        errorMessage = map(fullIssue, { data, defaultError: errorMessage }).message;
+        errorMessage2 = map(fullIssue, { data, defaultError: errorMessage2 }).message;
       }
       return {
         ...issueData,
         path: fullPath,
-        message: errorMessage
+        message: errorMessage2
       };
     };
     EMPTY_PATH = [];
@@ -5604,6 +5604,7 @@ function buildUrl(base, path, query) {
   return url.toString();
 }
 async function tryRefresh(creds) {
+  if (creds.auth_kind === "cli_token" || creds.refresh_token.length === 0) return null;
   const res = await fetch(buildUrl(creds.server_url, "/v1/auth/refresh"), {
     method: "POST",
     headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
@@ -5748,7 +5749,7 @@ function parseEnvFile(content, filename) {
         `invalid key '${name}' (must match /^[A-Za-z_][A-Za-z0-9_]*$/)`
       );
     }
-    let valueRaw = body.slice(eq + 1);
+    const valueRaw = body.slice(eq + 1);
     let value;
     const valueLeading = valueRaw.replace(/^\s+/, "");
     const firstCh = valueLeading.charAt(0);
@@ -5854,19 +5855,6 @@ var init_envFile = __esm({
   }
 });
 
-// src/ui/helpers/tty.ts
-var tty_exports = {};
-__export(tty_exports, {
-  isInteractive: () => isInteractive
-});
-function isInteractive() {
-  return process.stdin.isTTY === true && process.stdout.isTTY === true;
-}
-var init_tty = __esm({
-  "src/ui/helpers/tty.ts"() {
-  }
-});
-
 // ../../node_modules/.pnpm/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
 var getCodePointsLength, isFullWidth, isWideNotCJKTNotEmoji;
 var init_utils = __esm({
@@ -7021,6 +7009,95 @@ ${c2}
     } }).prompt();
   }
 });
+function aiContextBody() {
+  return `## keynv (secrets)
+
+This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
+
+### Mental model
+
+- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
+- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
+- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
+- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
+
+### What you should do
+
+When the user asks about secrets or env vars, follow this decision tree:
+
+| User intent | Run / suggest |
+|---|---|
+| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
+| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
+| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
+| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
+| "Rotate this key" | \`keynv secret rotate @alias\` |
+| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
+| "Who has access?" | \`keynv member list <project>\` |
+
+### Hard rules \u2014 do not violate
+
+1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
+2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
+3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
+4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
+5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
+6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
+
+### Quick reference
+
+\`\`\`bash
+keynv                       # interactive TUI menu (pick projects, secrets, members)
+keynv exec -- <cmd>         # run cmd with .keynv.env loaded
+keynv secret create         # walk through creating a new secret
+keynv secret list <project> # list aliases (no values)
+keynv whoami                # who am I logged in as
+keynv --help                # full command list
+\`\`\`
+
+If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
+}
+function renderKeynvBlock() {
+  return `${KEYNV_BLOCK_START}
+${aiContextBody()}
+${KEYNV_BLOCK_END}`;
+}
+function writeAiContext(rootPath) {
+  const path = join(rootPath, AGENTS_FILE_BASENAME);
+  const block = renderKeynvBlock();
+  if (!existsSync(path)) {
+    const initial = `# Agent guidance for this project
+
+${block}
+`;
+    writeFileSync(path, initial);
+    return "created";
+  }
+  const existing = readFileSync(path, "utf8");
+  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
+  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
+  if (startIdx >= 0 && endIdx > startIdx) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
+    const next = `${before}${block}${after}`;
+    if (next === existing) return "unchanged";
+    writeFileSync(path, next);
+    return "updated";
+  }
+  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
+  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
+`);
+  return "appended";
+}
+var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
+var init_aiContext = __esm({
+  "src/init/aiContext.ts"() {
+    AGENTS_FILE_BASENAME = "AGENTS.md";
+    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
+    KEYNV_BLOCK_END = "<!-- keynv:end -->";
+  }
+});
 function findProjectRoot(startDir) {
   let dir = resolve(startDir);
   for (let i = 0; i < 64; i++) {
@@ -7051,16 +7128,20 @@ function buildRoot(dir, marker) {
       }
       if (pkg.scripts && typeof pkg.scripts === "object") {
         scripts = Object.fromEntries(
-          Object.entries(pkg.scripts).filter(
-            ([, v2]) => typeof v2 === "string"
-          )
+          Object.entries(pkg.scripts).filter(([, v2]) => typeof v2 === "string")
         );
       }
     } catch {
       invalid = true;
     }
   }
-  return { path: dir, suggestedName, marker, packageJsonScripts: scripts, packageJsonInvalid: invalid };
+  return {
+    path: dir,
+    suggestedName,
+    marker,
+    packageJsonScripts: scripts,
+    packageJsonInvalid: invalid
+  };
 }
 function findEnvFiles(rootDir) {
   let entries;
@@ -7134,95 +7215,6 @@ var init_detect = __esm({
     KEYNV_ENV_BASENAME = ".keynv.env";
   }
 });
-function aiContextBody() {
-  return `## keynv (secrets)
-
-This project uses [keynv](https://keynv.dev) for secrets. There is a \`.keynv.env\` file at the project root containing **alias references** like \`OPENAI_API_KEY=@projectname.dev.openai-key\` \u2014 these are NOT real values, they are references to secrets stored in the keynv vault.
-
-### Mental model
-
-- **\`.keynv.env\`** \u2014 checked into git, contains aliases. Safe to read, edit, commit.
-- **Vault** \u2014 holds the real values. The \`keynv\` CLI reads it on demand.
-- **\`keynv exec -- <command>\`** \u2014 forks the command in a subprocess where the real values are injected into env vars. The parent process (where you, the AI agent, run) NEVER sees the real values.
-- **Redactor** \u2014 pipes subprocess stdout/stderr through a masker before they reach this terminal. Even if a script accidentally echoes a secret, you see \`<REDACTED:...>\` here.
-
-### What you should do
-
-When the user asks about secrets or env vars, follow this decision tree:
-
-| User intent | Run / suggest |
-|---|---|
-| "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
-| "I have a \`.env\`, migrate it" | \`keynv init\` (you're seeing this file because that already happened) |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias\` \u2014 but copy to clipboard, do NOT print the value into chat / terminal |
-| "Rotate this key" | \`keynv secret rotate @alias\` |
-| "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
-| "Who has access?" | \`keynv member list <project>\` |
-
-### Hard rules \u2014 do not violate
-
-1. **Never print resolved secret values** to the chat, terminal, log, or any file. The user's editor / scrollback / chat history is an attack surface.
-2. **Never write a \`.env\` file** (or any file) containing real secret values. The whole point of keynv is that those don't exist on disk.
-3. **Never edit \`.keynv.env\` to substitute resolved values for aliases.** The file should only ever contain \`@project.env.key\` references and plain non-secret literals.
-4. **Use \`keynv exec --\` to run commands that need env vars.** Don't try to load \`.keynv.env\` yourself by parsing it manually; the wrapper handles resolution + redaction + subprocess isolation.
-5. **If a tool fails with "blocked by keynv-guard" or similar**, do NOT try to work around it. Tell the user \u2014 that's a sign of a misconfiguration, not an obstacle to bypass.
-6. **Treat the alias literal (\`@project.env.key\`) as the canonical reference**, never the resolved value. When you write code, configs, or commands that need a secret, write the alias.
-
-### Quick reference
-
-\`\`\`bash
-keynv                       # interactive TUI menu (pick projects, secrets, members)
-keynv exec -- <cmd>         # run cmd with .keynv.env loaded
-keynv secret create         # walk through creating a new secret
-keynv secret list <project> # list aliases (no values)
-keynv whoami                # who am I logged in as
-keynv --help                # full command list
-\`\`\`
-
-If \`.keynv.env\` is missing or empty, the user probably hasn't run \`keynv init\` yet \u2014 suggest they do so before they paste a secret into a \`.env\`.`;
-}
-function renderKeynvBlock() {
-  return `${KEYNV_BLOCK_START}
-${aiContextBody()}
-${KEYNV_BLOCK_END}`;
-}
-function writeAiContext(rootPath) {
-  const path = join(rootPath, AGENTS_FILE_BASENAME);
-  const block = renderKeynvBlock();
-  if (!existsSync(path)) {
-    const initial = `# Agent guidance for this project
-
-${block}
-`;
-    writeFileSync(path, initial);
-    return "created";
-  }
-  const existing = readFileSync(path, "utf8");
-  const startIdx = existing.indexOf(KEYNV_BLOCK_START);
-  const endIdx = existing.indexOf(KEYNV_BLOCK_END);
-  if (startIdx >= 0 && endIdx > startIdx) {
-    const before = existing.slice(0, startIdx);
-    const after = existing.slice(endIdx + KEYNV_BLOCK_END.length);
-    const next = `${before}${block}${after}`;
-    if (next === existing) return "unchanged";
-    writeFileSync(path, next);
-    return "updated";
-  }
-  const sep = existing.length === 0 ? "" : existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
-  const trailingNewline = existing.endsWith("\n") ? "" : "\n";
-  writeFileSync(path, `${existing}${trailingNewline}${sep}${block}
-`);
-  return "appended";
-}
-var AGENTS_FILE_BASENAME, KEYNV_BLOCK_START, KEYNV_BLOCK_END;
-var init_aiContext = __esm({
-  "src/init/aiContext.ts"() {
-    AGENTS_FILE_BASENAME = "AGENTS.md";
-    KEYNV_BLOCK_START = "<!-- keynv:start -- generated by `keynv init`; safe to leave intact, will be refreshed on re-run -->";
-    KEYNV_BLOCK_END = "<!-- keynv:end -->";
-  }
-});
 
 // src/init/heuristics.ts
 function shannonEntropyBits(s) {
@@ -7641,7 +7633,9 @@ ${detail}`
   }
   const totalEntries = [...perEnv.values()].reduce((n, arr) => n + arr.length, 0);
   if (totalEntries === 0) {
-    R2.info("All env files were empty or only contained framework-managed vars. Nothing to upload.");
+    R2.info(
+      "All env files were empty or only contained framework-managed vars. Nothing to upload."
+    );
     ye("Done.");
     return { exitCode: 0 };
   }
@@ -7693,10 +7687,10 @@ ${detail}`
   const planSummary = [
     `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
     `Environments:      ${distinctEnvs.join(", ")}`,
-    `Per-env breakdown:`,
+    "Per-env breakdown:",
     perEnvCounts,
     `Script wraps:      ${scriptWrapSelection.length}`,
-    `Original .env:     delete after upload`,
+    "Original .env:     delete after upload",
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
   Se(planSummary, "About to apply");
@@ -7731,7 +7725,11 @@ ${detail}`
             method: "POST",
             body: { env: env2, key: aliasKey, value: e2.value }
           });
-          const alias2 = buildAlias({ project: projectChoice.name, environment: env2, key: aliasKey });
+          const alias2 = buildAlias({
+            project: projectChoice.name,
+            environment: env2,
+            key: aliasKey
+          });
           if (alias2 === null) {
             failed.push({
               env: env2,
@@ -7753,7 +7751,9 @@ ${detail}`
     if (failed.length === 0) {
       s.stop(`Uploaded ${totalToUpload} secret${totalToUpload === 1 ? "" : "s"}`);
     } else {
-      s.error(`${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`);
+      s.error(
+        `${totalToUpload - failed.length}/${totalToUpload} uploaded; ${failed.length} failed`
+      );
       for (const f of failed) R2.warn(`  [${f.env}] ${f.name}: ${f.reason}`);
     }
   }
@@ -7968,7 +7968,9 @@ async function ensureProjectAndEnvs(client, projectChoice, distinctEnvs) {
         body: envBodyFor(envName)
       });
     } catch (err) {
-      s.error(`Failed to add env "${envName}": ${err instanceof Error ? err.message : String(err)}`);
+      s.error(
+        `Failed to add env "${envName}": ${err instanceof Error ? err.message : String(err)}`
+      );
       return null;
     }
   }
@@ -8014,7 +8016,7 @@ function composeKeynvEnv(opts) {
     }
   }
   if (mergeWithExisting !== null) {
-    lines.push(`# <<< keynv init <<<`);
+    lines.push("# <<< keynv init <<<");
   }
   return lines;
 }
@@ -8035,11 +8037,11 @@ function updatePackageJsonScripts(path, originalScripts, selectedNames) {
 }
 var init_init = __esm({
   "src/ui/flows/init.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_envFile();
-    init_detect();
     init_aiContext();
+    init_detect();
     init_heuristics();
     init_scriptWrap();
     init_cancel();
@@ -8047,30 +8049,103 @@ var init_init = __esm({
   }
 });
 
-// src/ui/helpers/pickSecret.ts
-async function listSecrets(client, projectId2) {
-  const data = await client.request(
-    `/v1/projects/${projectId2}/secrets`
-  );
-  return data.secrets;
+// src/ui/helpers/tty.ts
+var tty_exports = {};
+__export(tty_exports, {
+  isInteractive: () => isInteractive
+});
+function isInteractive() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
-async function pickSecret(client, projectId2, message = "Secret:") {
-  const secrets = await listSecrets(client, projectId2);
-  if (secrets.length === 0) return null;
-  const value = await Ee({
-    message,
-    options: secrets.map((s) => ({
-      value: s.alias,
-      label: s.alias,
-      hint: `v${s.version}`
-    }))
+var init_tty = __esm({
+  "src/ui/helpers/tty.ts"() {
+  }
+});
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function errorMessage(res, fallback) {
+  const text = await res.text();
+  if (!text) return fallback;
+  try {
+    const parsed = JSON.parse(text);
+    return parsed.error?.message ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+function openBrowser(url) {
+  try {
+    const os = platform();
+    const command = os === "win32" ? "cmd" : os === "darwin" ? "open" : "xdg-open";
+    const args = os === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function runBrowserAuth(serverUrl) {
+  const startRes = await fetch(new URL("/v1/auth/cli/browser/start", serverUrl).toString(), {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+    body: JSON.stringify({ device_name: hostname() })
   });
-  if (q(value)) return null;
-  return secrets.find((s) => s.alias === value) ?? null;
+  if (!startRes.ok) {
+    throw new BrowserAuthError(
+      await errorMessage(startRes, `Browser auth failed to start (${startRes.status}).`)
+    );
+  }
+  const start = await startRes.json();
+  const opened = openBrowser(start.verification_uri_complete);
+  if (!opened) {
+    throw new BrowserAuthError(`Open this URL in your browser: ${start.verification_uri_complete}`);
+  }
+  const deadline = Date.now() + start.expires_in * 1e3;
+  const intervalMs = Math.max(1, start.interval) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const pollRes = await fetch(new URL("/v1/auth/cli/browser/poll", serverUrl).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
+      body: JSON.stringify({ device_code: start.device_code })
+    });
+    if (pollRes.status === 202) continue;
+    if (!pollRes.ok) {
+      throw new BrowserAuthError(
+        await errorMessage(pollRes, `Browser auth failed (${pollRes.status}).`)
+      );
+    }
+    const data = await pollRes.json();
+    return {
+      auth_kind: "session",
+      server_url: serverUrl,
+      user_id: data.user.id,
+      email: data.user.email,
+      org_id: data.user.org_id,
+      org_role: data.user.org_role,
+      access_token: data.access_token,
+      refresh_token: data.refresh_token,
+      access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
+    };
+  }
+  throw new BrowserAuthError("Browser auth timed out. Run `keynv login` to try again.");
 }
-var init_pickSecret = __esm({
-  "src/ui/helpers/pickSecret.ts"() {
-    init_dist5();
+var BrowserAuthError;
+var init_browser_auth = __esm({
+  "src/client/browser-auth.ts"() {
+    init_version();
+    BrowserAuthError = class extends Error {
+    };
+  }
+});
+
+// src/client/defaults.ts
+var DEFAULT_SERVER_URL;
+var init_defaults = __esm({
+  "src/client/defaults.ts"() {
+    DEFAULT_SERVER_URL = "https://api.keynv.dev";
   }
 });
 
@@ -8098,6 +8173,33 @@ var init_pickEnv = __esm({
     init_dist5();
   }
 });
+
+// src/ui/helpers/pickSecret.ts
+async function listSecrets(client, projectId2) {
+  const data = await client.request(
+    `/v1/projects/${projectId2}/secrets`
+  );
+  return data.secrets;
+}
+async function pickSecret(client, projectId2, message = "Secret:") {
+  const secrets = await listSecrets(client, projectId2);
+  if (secrets.length === 0) return null;
+  const value = await Ee({
+    message,
+    options: secrets.map((s) => ({
+      value: s.alias,
+      label: s.alias,
+      hint: `v${s.version}`
+    }))
+  });
+  if (q(value)) return null;
+  return secrets.find((s) => s.alias === value) ?? null;
+}
+var init_pickSecret = __esm({
+  "src/ui/helpers/pickSecret.ts"() {
+    init_dist5();
+  }
+});
 async function runSecretsFlow(client, project) {
   let target = project;
   if (!target) {
@@ -8161,7 +8263,10 @@ async function runSecretMenu(client, project, alias2) {
       }
     } else if (choice === "rotate") {
       const newValue = unwrap(
-        await Ce({ message: "New value", validate: (v2) => v2 && v2.length ? void 0 : "required" })
+        await Ce({
+          message: "New value",
+          validate: (v2) => v2?.length ? void 0 : "required"
+        })
       );
       const data = await client.request(`${path}/rotate`, {
         method: "POST",
@@ -8169,9 +8274,7 @@ async function runSecretMenu(client, project, alias2) {
       });
       R2.success(`Rotated ${data.alias} \u2192 v${data.version}`);
     } else if (choice === "delete") {
-      const confirmed = unwrap(
-        await ue({ message: `Delete ${alias2}?`, initialValue: false })
-      );
+      const confirmed = unwrap(await ue({ message: `Delete ${alias2}?`, initialValue: false }));
       if (!confirmed) continue;
       await client.request(path, { method: "DELETE" });
       R2.success(`Deleted ${alias2}`);
@@ -8180,11 +8283,13 @@ async function runSecretMenu(client, project, alias2) {
   }
 }
 async function copyToClipboard(value) {
-  const platform = process.platform;
-  const cmd = platform === "darwin" ? ["pbcopy", []] : platform === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
+  const platform2 = process.platform;
+  const cmd = platform2 === "darwin" ? ["pbcopy", []] : platform2 === "win32" ? ["clip", []] : ["xclip", ["-selection", "clipboard"]];
   return new Promise((resolve3) => {
     try {
-      const child = spawn(cmd[0], cmd[1], { stdio: ["pipe", "ignore", "ignore"] });
+      const child = spawn(cmd[0], cmd[1], {
+        stdio: ["pipe", "ignore", "ignore"]
+      });
       child.on("error", () => resolve3(false));
       child.on("exit", (code) => resolve3(code === 0));
       child.stdin.end(value);
@@ -8211,7 +8316,7 @@ async function promptNewSecret(client, project) {
       }),
       value: () => Ce({
         message: "Value (hidden)",
-        validate: (v2) => v2 && v2.length ? void 0 : "required"
+        validate: (v2) => v2?.length ? void 0 : "required"
       })
     },
     {
@@ -8240,8 +8345,8 @@ async function createSecretInteractive(client, project) {
 }
 var init_secret = __esm({
   "src/ui/flows/secret.ts"() {
-    init_dist();
     init_dist5();
+    init_dist();
     init_cancel();
     init_pickEnv();
     init_pickProject();
@@ -28980,11 +29085,11 @@ var require_pg_connection_string = __commonJS({
         config.client_encoding = result.searchParams.get("encoding");
         return config;
       }
-      const hostname = dummyHost ? "" : result.hostname;
+      const hostname2 = dummyHost ? "" : result.hostname;
       if (!config.host) {
-        config.host = decodeURIComponent(hostname);
-      } else if (hostname && /^%2f/i.test(hostname)) {
-        result.pathname = hostname + result.pathname;
+        config.host = decodeURIComponent(hostname2);
+      } else if (hostname2 && /^%2f/i.test(hostname2)) {
+        result.pathname = hostname2 + result.pathname;
       }
       if (!config.port) {
         config.port = result.port;
@@ -40090,9 +40195,9 @@ var require_cluster = __commonJS({
           }
         });
       }
-      resolveSrv(hostname) {
+      resolveSrv(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.resolveSrv(hostname, (err, records) => {
+          this.options.resolveSrv(hostname2, (err, records) => {
             if (err) {
               return reject(err);
             }
@@ -40114,14 +40219,14 @@ var require_cluster = __commonJS({
           });
         });
       }
-      dnsLookup(hostname) {
+      dnsLookup(hostname2) {
         return new Promise((resolve3, reject) => {
-          this.options.dnsLookup(hostname, (err, address) => {
+          this.options.dnsLookup(hostname2, (err, address) => {
             if (err) {
-              debug2("failed to resolve hostname %s to IP: %s", hostname, err.message);
+              debug2("failed to resolve hostname %s to IP: %s", hostname2, err.message);
               reject(err);
             } else {
-              debug2("resolved hostname %s to IP %s", hostname, address);
+              debug2("resolved hostname %s to IP %s", hostname2, address);
               resolve3(address);
             }
           });
@@ -42446,85 +42551,27 @@ var init_audit2 = __esm({
 });
 
 // src/ui/flows/login.ts
-async function runLoginFlow(client) {
-  const answers = await he(
-    {
-      server: () => Re({
-        message: "Server URL",
-        placeholder: "http://localhost:8080",
-        defaultValue: "http://localhost:8080"
-      }),
-      email: () => Re({
-        message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
-      }),
-      password: () => Ce({
-        message: "Password",
-        validate: (v2) => v2 && v2.length >= 1 ? void 0 : "required"
-      })
-    },
-    {
-      onCancel: () => {
-        throw new UserCancelled();
-      }
-    }
-  );
-  const server = answers.server || "http://localhost:8080";
+async function runLoginFlow(client, options = {}) {
+  const server = options.server ?? DEFAULT_SERVER_URL;
   const s = ft();
-  s.start("Authenticating");
-  let res;
+  s.start("Opening browser for keynv login");
+  let creds;
   try {
-    res = await fetch(new URL("/v1/auth/login", server).toString(), {
-      method: "POST",
-      headers: { "content-type": "application/json", "x-keynv-agent": AGENT },
-      body: JSON.stringify({ email: answers.email, password: answers.password })
-    });
+    creds = await runBrowserAuth(server);
   } catch (err) {
-    s.error("Network error");
-    me(err instanceof Error ? err.message : "unreachable");
+    s.error("Browser login failed");
+    me(err instanceof Error ? err.message : "Unable to authenticate.");
     return false;
   }
-  if (!res.ok) {
-    let msg = `login failed (${res.status})`;
-    try {
-      const parsed = await res.json();
-      msg = parsed.error?.message ?? msg;
-    } catch {
-    }
-    s.error(msg);
-    return false;
-  }
-  const data = await res.json();
-  await saveCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  await client.setCredentials({
-    server_url: server,
-    user_id: data.user.id,
-    email: data.user.email,
-    org_id: data.user.org_id,
-    org_role: data.user.org_role,
-    access_token: data.access_token,
-    refresh_token: data.refresh_token,
-    access_expires_at: new Date(Date.now() + data.expires_in * 1e3).toISOString()
-  });
-  s.stop(`Logged in as ${data.user.email}`);
+  await client.setCredentials(creds);
+  s.stop(`Logged in as ${creds.email}`);
   return true;
 }
 var init_login = __esm({
   "src/ui/flows/login.ts"() {
     init_dist5();
-    init_http();
-    init_store();
-    init_version();
-    init_cancel();
+    init_browser_auth();
+    init_defaults();
   }
 });
 
@@ -42583,7 +42630,7 @@ async function addMemberInteractive(client, project) {
     {
       email: () => Re({
         message: "Email",
-        validate: (v2) => v2 && v2.includes("@") ? void 0 : "enter an email"
+        validate: (v2) => v2?.includes("@") ? void 0 : "enter an email"
       }),
       role: () => Ee({
         message: "Role",
@@ -42682,8 +42729,11 @@ function printDetail(detail) {
   const envLines = detail.environments.map(
     (e2) => `  ${e2.name}  (tier=${e2.tier}, approval=${e2.require_approval})`
   );
-  Se(`${detail.name}  (${detail.id})
-${envLines.join("\n") || "  (no environments)"}`, "Project");
+  Se(
+    `${detail.name}  (${detail.id})
+${envLines.join("\n") || "  (no environments)"}`,
+    "Project"
+  );
 }
 async function createProjectInteractive(client) {
   const answers = await he(
@@ -42742,6 +42792,7 @@ async function runMenu() {
   ge(`keynv ${VERSION}`);
   const client = new ApiClient();
   await client.ensureHydrated();
+  let didLogin = false;
   if (!client.isLoggedIn) {
     R2.info("Not logged in.");
     try {
@@ -42750,6 +42801,7 @@ async function runMenu() {
         ye("Login cancelled.");
         return 1;
       }
+      didLogin = true;
     } catch (err) {
       if (err instanceof UserCancelled) {
         me("Login cancelled.");
@@ -42761,6 +42813,16 @@ async function runMenu() {
     const u = client.currentUser;
     if (u) R2.message(`${u.email} (${u.org_role}) @ ${u.server_url}`);
   }
+  if (didLogin) {
+    const setup = await ue({
+      message: "Set up this project now?",
+      initialValue: true
+    });
+    if (!q(setup) && setup) {
+      const { runInitFlow: runInitFlow2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+      await runInitFlow2(client, { cwd: process.cwd(), dryRun: false, noScripts: false });
+    }
+  }
   while (true) {
     let choice;
     try {
@@ -42828,14 +42890,14 @@ var init_menu = __esm({
     init_dist5();
     init_http();
     init_store();
-    init_format();
-    init_cancel();
+    init_version();
     init_audit2();
     init_login();
     init_member();
     init_project();
     init_secret();
-    init_version();
+    init_format();
+    init_cancel();
   }
 });
 
@@ -43516,11 +43578,11 @@ var reducers = {
       return { ...state, options: [{ name: `-c`, value: String(command) }] };
     }
   },
-  setError: (state, segment, segmentIndex, errorMessage) => {
+  setError: (state, segment, segmentIndex, errorMessage2) => {
     if (segment === SpecialToken.EndOfInput || segment === SpecialToken.EndOfPartialInput) {
-      return { ...state, errorMessage: `${errorMessage}.` };
+      return { ...state, errorMessage: `${errorMessage2}.` };
     } else {
-      return { ...state, errorMessage: `${errorMessage} ("${segment}").` };
+      return { ...state, errorMessage: `${errorMessage2} ("${segment}").` };
     }
   },
   setOptionArityError: (state, segment) => {
@@ -45026,10 +45088,7 @@ to load a specific file, or set KEYNV_ENV_FILE in the environment.
 spelled \`--from\` to avoid the collision.)
 `,
     examples: [
-      [
-        "Auto-load .keynv.env from cwd or parents",
-        "$0 exec -- next dev"
-      ],
+      ["Auto-load .keynv.env from cwd or parents", "$0 exec -- next dev"],
       [
         "Run mysql with the alias substituted at fork-exec time",
         "$0 exec -- mysql -p@billing.dev.db_pass -h db.example.com"
@@ -45210,9 +45269,9 @@ function signalNumber(sig) {
 
 // src/commands/init.ts
 init_http();
-init_tty();
 init_init();
 init_cancel();
+init_tty();
 var InitCommand = class extends Command {
   static paths = [["init"]];
   static usage = Command.Usage({
@@ -45273,6 +45332,8 @@ commands directly.
 };
 
 // src/commands/login.ts
+init_browser_auth();
+init_defaults();
 init_http();
 init_store();
 init_format();
@@ -45333,18 +45394,40 @@ var LoginCommand = class extends Command {
   static usage = Command.Usage({
     description: "Authenticate against a keynv server.",
     examples: [
-      ["Interactive", "$0 login --server http://localhost:8080"],
+      ["Browser login", "$0 login"],
+      ["Self-hosted browser login", "$0 login --server http://localhost:8080"],
+      ["Headless token login", "$0 login --server http://... --token kt_..."],
       ["Non-interactive", "$0 login --server http://... --email a@b.com --password ..."]
     ]
   });
   server = options_exports.String("--server", { description: "Server base URL." });
+  token = options_exports.String("--token", { description: "CLI token for headless auth." });
   email = options_exports.String("--email", { description: "Email address." });
   password = options_exports.String("--password", {
     description: "Password (use stdin to avoid argv leak)."
   });
   async execute() {
-    const serverUrl = this.server ?? await promptLine("server URL [http://localhost:8080]: ") ?? "";
-    const finalServerUrl = serverUrl.length > 0 ? serverUrl : "http://localhost:8080";
+    const finalServerUrl = this.server ?? DEFAULT_SERVER_URL;
+    if (this.token) {
+      return this.loginWithToken(finalServerUrl, this.token);
+    }
+    if (!this.email && !this.password) {
+      this.context.stdout.write(`Opening browser for ${finalServerUrl} ...
+`);
+      try {
+        const creds = await runBrowserAuth(finalServerUrl);
+        await saveCredentials(creds);
+        this.context.stdout.write(`logged in as ${creds.email} (${creds.org_role})
+`);
+        return 0;
+      } catch (err) {
+        this.context.stderr.write(
+          `keynv: ${err instanceof Error ? err.message : "browser login failed"}
+`
+        );
+        return 1;
+      }
+    }
     const email2 = this.email ?? await promptLine("email: ");
     const password = this.password ?? await promptHidden("password: ");
     const res = await fetch(new URL("/v1/auth/login", finalServerUrl).toString(), {
@@ -45375,6 +45458,7 @@ var LoginCommand = class extends Command {
     const data = await res.json();
     try {
       await saveCredentials({
+        auth_kind: "session",
         server_url: finalServerUrl,
         user_id: data.user.id,
         email: data.user.email,
@@ -45392,6 +45476,54 @@ var LoginCommand = class extends Command {
       return 1;
     }
     this.context.stdout.write(`logged in as ${data.user.email} (${data.user.org_role})
+`);
+    return 0;
+  }
+  async loginWithToken(serverUrl, token) {
+    const res = await fetch(new URL("/v1/whoami", serverUrl).toString(), {
+      headers: { authorization: `Bearer ${token}`, "x-keynv-agent": AGENT }
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      let msg = `token login failed (${res.status})`;
+      try {
+        const parsed = JSON.parse(text);
+        msg = parsed.error?.message ?? msg;
+        this.context.stderr.write(
+          `${fmtError({
+            status: res.status,
+            ...parsed.error?.code ? { code: parsed.error.code } : {},
+            message: msg
+          })}
+`
+        );
+      } catch {
+        this.context.stderr.write(`keynv: ${msg}
+`);
+      }
+      return 1;
+    }
+    const data = await res.json();
+    try {
+      await saveCredentials({
+        auth_kind: "cli_token",
+        server_url: serverUrl,
+        user_id: data.id,
+        email: data.email,
+        org_id: data.org_id,
+        org_role: data.org_role,
+        access_token: token,
+        refresh_token: "",
+        access_expires_at: "9999-12-31T23:59:59.999Z"
+      });
+    } catch (err) {
+      this.context.stderr.write(
+        `keynv: failed to persist credentials: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return 1;
+    }
+    this.context.stdout.write(`logged in as ${data.email} (${data.org_role})
 `);
     return 0;
   }
@@ -45716,12 +45848,12 @@ streaming-mode limitation in @keynv/redactor).
 // src/commands/secret.ts
 init_dist();
 init_http();
+init_secret();
 init_format();
-init_tty();
 init_cancel();
 init_pickProject();
 init_pickSecret();
-init_secret();
+init_tty();
 async function findProjectIdByName2(client, name) {
   const data = await client.request("/v1/projects");
   const match = data.projects.find((p2) => p2.name === name);
@@ -46466,8 +46598,8 @@ the error message.
 };
 
 // src/commands/ui.ts
-init_menu();
 init_tty();
+init_menu();
 var UICommand = class extends Command {
   static paths = [["ui"]];
   static usage = Command.Usage({