@miniaxolotl/grove-opencode-plugin 0.5.0 → 1.2.2

package/dist/cli.js

@@ -6801,7 +6801,6 @@ var require_dist = __commonJS({
 
 // packages/mcp/src/cli.ts
 import { createServer } from "node:http";
-import { spawn as spawn2 } from "node:child_process";
 import { readFile as readFile3 } from "node:fs/promises";
 import { parseArgs } from "node:util";
 
@@ -21951,10 +21950,14 @@ var rememberSchema = external_exports.object({
   capture: external_exports.enum(["explicit", "automatic"]).default("explicit"),
   archived: external_exports.boolean().default(false),
   kind: kindSchema.default("fact"),
+  autoKind: external_exports.boolean().default(false),
   projectId: uuidSchema.nullable().default(null),
   taskId: external_exports.string().min(1).max(128).optional(),
+  retentionDays: external_exports.number().int().min(1).max(365).nullable().optional(),
   source: sourceSchema.default({ agent: "api" })
 }).strict().superRefine((input, ctx) => {
+  if (input.autoKind && input.kind === "handoff")
+    ctx.addIssue({ code: "custom", message: "Handoff kind is explicit" });
   if (Boolean(input.id) !== Boolean(input.expectedVersion)) {
     ctx.addIssue({
       code: "custom",
@@ -21976,6 +21979,11 @@ var rememberSchema = external_exports.object({
 var listSchema = external_exports.object({
   projectId: uuidSchema.nullable().optional(),
   kind: kindSchema.optional(),
+  tag: external_exports.string().trim().min(1).max(40).optional(),
+  sourceAgent: sourceSchema.shape.agent.removeDefault().optional(),
+  updatedAfter: external_exports.iso.datetime().optional(),
+  sort: external_exports.enum(["updated_desc", "updated_asc", "created_desc"]).optional(),
+  lifetime: external_exports.enum(["permanent", "ephemeral"]).optional(),
   status: external_exports.enum(["active", "archived", "expired", "all"]).default("active"),
   query: external_exports.string().trim().max(1e3).optional(),
   cursor: external_exports.string().max(2048).optional(),
@@ -22019,20 +22027,36 @@ var grantSchema = external_exports.object({
 var connectionSchema = grantSchema.extend({
   clientId: external_exports.string().min(1).max(500)
 });
+var agentSchema = external_exports.enum(["opencode", "claude", "codex"]);
+var agentNames = {
+  opencode: "OpenCode",
+  claude: "Claude Code",
+  codex: "Codex"
+};
+var connectSchema = external_exports.object({
+  agent: agentSchema,
+  project: projectSchema.nullable()
+}).strict();
+var approveConnectSchema = grantSchema.extend({
+  currentProject: external_exports.boolean().default(true)
+});
 var memorySchema = external_exports.object({
   id: uuidSchema,
   projectId: uuidSchema.nullable(),
   content: external_exports.string(),
   kind: kindSchema,
+  autoKind: external_exports.boolean().optional(),
   status: external_exports.enum(["active", "archived"]),
   version: external_exports.number().int(),
   source: sourceSchema,
   taskId: external_exports.string().nullable(),
+  retentionDays: external_exports.number().int().nullable().optional(),
   expiresAt: external_exports.string().nullable(),
   purgeAt: external_exports.string().nullable(),
   createdAt: external_exports.string(),
   updatedAt: external_exports.string(),
-  indexing: external_exports.enum(["pending", "ready", "failed"])
+  indexing: external_exports.enum(["disabled", "pending", "ready", "failed"]),
+  enrichment: external_exports.custom().optional()
 });
 var GroveError = class extends Error {
   constructor(code, message, status = 400) {
@@ -22247,8 +22271,8 @@ var updateConfig = (change) => withStoreLock(async () => {
     generation: (config2.generation ?? 0) + 1
   });
 });
-async function configuredOrigin(override) {
-  const origin = override ?? process.env.GROVE_API_URL ?? (await readConfig()).origin;
+async function configuredOrigin(override, agent, fallback) {
+  const origin = override ?? (process.env.GROVE_API_URL || void 0) ?? activeOrigin(await readConfig(), agent) ?? fallback;
   if (!origin)
     throw new GroveError(
       "not_configured",
@@ -22256,6 +22280,20 @@ async function configuredOrigin(override) {
     );
   return apiOrigin(origin);
 }
+function activeOrigin(config2, agent) {
+  return agent && config2.origins?.[agent] || config2.origin;
+}
+function pinOrigins(config2) {
+  config2.origins ??= {};
+  for (const agent of ["cli", "opencode", "claude", "codex"]) {
+    if (config2.origins[agent]) continue;
+    const origins = Object.keys(config2.accounts ?? {}).filter(
+      (origin) => config2.accounts?.[origin]?.[agent]
+    );
+    const selected = origins.includes(config2.origin ?? "") ? config2.origin : origins.length === 1 ? origins[0] : void 0;
+    if (selected) config2.origins[agent] = selected;
+  }
+}
 function credentialPath(origin, agent, accountId) {
   return join(
     configDirectory(),
@@ -22292,6 +22330,8 @@ async function saveCredentials(value) {
       value
     );
     const config2 = await readConfig();
+    pinOrigins(config2);
+    config2.origins[value.agent] = value.origin;
     config2.origin = value.origin;
     config2.accounts ??= {};
     config2.accounts[value.origin] = {
@@ -22302,6 +22342,26 @@ async function saveCredentials(value) {
     await writeConfig(config2);
   });
 }
+async function activateCredentials(origin, agent, accountId) {
+  await withStoreLock(async () => {
+    const credentials = await loadCredentials(origin, agent);
+    if (credentials.accountId !== accountId)
+      throw new GroveError(
+        "account_changed",
+        "Grove account changed; run connect again",
+        409
+      );
+    const config2 = await readConfig();
+    pinOrigins(config2);
+    if (config2.origin !== origin || config2.origins[agent] !== origin)
+      await writeConfig({
+        ...config2,
+        origins: { ...config2.origins, [agent]: origin },
+        origin,
+        generation: (config2.generation ?? 0) + 1
+      });
+  });
+}
 async function clearCredentials(origin, agent) {
   await withStoreLock(async () => {
     const config2 = await readConfig();
@@ -22419,7 +22479,7 @@ async function bearer(origin, agent, signal) {
   }, signal);
 }
 async function nodeClient(agent = "cli", origin, timeoutMs = 1e4) {
-  const endpoint = await configuredOrigin(origin);
+  const endpoint = await configuredOrigin(origin, agent);
   return new ApiClient(
     endpoint,
     (signal) => bearer(endpoint, agent, signal),
@@ -30592,7 +30652,7 @@ function createMemoryMcp(execute2) {
     {
       name: "remember",
       schema: rememberSchema,
-      description: "Save a concise durable memory, or correct one by id and expectedVersion. Reuse operationId when retrying. Handoffs require taskId and expire after 30 days (purged after 90)."
+      description: "Save a concise durable memory, or correct one by id and expectedVersion. Set autoKind=true to let the configured decision model select a durable kind; otherwise the supplied kind is preserved. Reuse operationId when retrying. Handoffs require taskId and expire after 30 days (purged after 90)."
     },
     {
       name: "recall",
@@ -30602,7 +30662,7 @@ function createMemoryMcp(execute2) {
     {
       name: "memories",
       schema: listSchema,
-      description: "Inspect memories with IDs, current versions, provenance, status filters and cursor pagination. Use the returned version for corrections/deletion."
+      description: "Inspect memories with IDs, current versions, provenance, generated titles/tags/relationships, status and tag filters, hybrid text/semantic search and cursor pagination. Use the returned version for corrections/deletion."
     },
     {
       name: "forget",
@@ -30660,8 +30720,8 @@ function createMemoryMcp(execute2) {
 
 // packages/mcp/src/bridge.ts
 async function startBridge(agent = "cli") {
-  const client = await nodeClient(agent);
   const server = createMemoryMcp(async (tool, raw, signal) => {
+    const client = await nodeClient(agent);
     const input = { ...raw };
     if (tool === "remember")
       input.source = { ...input.source, agent };
@@ -30685,7 +30745,8 @@ async function startBridge(agent = "cli") {
 import { homedir as homedir2 } from "node:os";
 import { join as join2 } from "node:path";
 import { readFile as readFile2, mkdir as mkdir2, writeFile as writeFile2, rename as rename2 } from "node:fs/promises";
-import { spawn } from "node:child_process";
+import { spawn, execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
 import { randomUUID as randomUUID2 } from "node:crypto";
 
 // node_modules/.pnpm/jsonc-parser@3.3.1/node_modules/jsonc-parser/lib/esm/impl/scanner.js
@@ -32060,9 +32121,117 @@ function applyEdits(text, edits) {
   return text;
 }
 
+// packages/grove-claude-plugin/package.json
+var package_default = {
+  name: "@miniaxolotl/grove-claude-plugin",
+  version: "1.2.2",
+  type: "module",
+  description: "Grove private memory tools and skills for Claude Code",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://github.com/miniaxolotl/grove.git"
+  },
+  files: [
+    ".claude-plugin",
+    ".mcp.json",
+    "hooks",
+    "skills",
+    "dist",
+    "README.md"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  engines: {
+    node: ">=22"
+  }
+};
+
+// packages/grove-codex-plugin/package.json
+var package_default2 = {
+  name: "@miniaxolotl/grove-codex-plugin",
+  version: "1.2.2",
+  type: "module",
+  description: "Grove private memory tools and skills for Codex",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "https://github.com/miniaxolotl/grove.git"
+  },
+  files: [
+    "plugin.json",
+    "mcp.json",
+    "hooks",
+    "skills",
+    "dist",
+    "README.md"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  engines: {
+    node: ">=22"
+  }
+};
+
 // packages/mcp/src/install.ts
+function activationInstructions(agent) {
+  if (agent === "opencode")
+    return {
+      restartRequired: false,
+      message: "OpenCode loads Grove automatically. Check its MCP tools; if Grove has not appeared, restart OpenCode."
+    };
+  if (agent === "claude")
+    return {
+      restartRequired: false,
+      message: "In Claude Code, run /reload-plugins to load Grove, or start a new session."
+    };
+  return {
+    restartRequired: true,
+    message: "Restart Codex to load Grove. Review its optional hooks in Codex to enable automatic recall."
+  };
+}
+async function nativeInstallation(agent) {
+  try {
+    const { stdout } = await promisify2(execFile2)(
+      agent,
+      ["plugin", "list", "--json"],
+      { timeout: 1e4, maxBuffer: 1024 * 1024 }
+    );
+    const value = JSON.parse(stdout);
+    const plugins = agent === "claude" ? value : value.installed;
+    const plugin = Array.isArray(plugins) ? plugins.find(
+      (plugin2) => (agent === "claude" ? plugin2.id : plugin2.pluginId) === "grove@grove" && (agent !== "claude" || plugin2.scope === "user")
+    ) : void 0;
+    if (!plugin) return "missing";
+    const expected = (agent === "claude" ? package_default : package_default2).version;
+    const actual = typeof plugin.version === "string" && /^\d+\.\d+\.\d+$/.test(plugin.version) ? plugin.version.split(".").map(Number) : [];
+    const target = expected.split(".").map(Number);
+    const difference = actual.length === 3 ? actual.map((part, index) => part - target[index]).find((part) => part !== 0) ?? 0 : -1;
+    return plugin.enabled === true && difference >= 0 ? "ready" : "update";
+  } catch {
+    return "missing";
+  }
+}
+async function requireClient(agent) {
+  try {
+    await promisify2(execFile2)(agent, ["--version"], {
+      timeout: 1e4,
+      maxBuffer: 64 * 1024
+    });
+  } catch {
+    throw new GroveError(
+      "client_missing",
+      `Install ${agent} and make sure its command is on PATH, then run grove connect ${agent} again.`
+    );
+  }
+}
 var run = (command, args) => new Promise((resolve, reject) => {
-  const child = spawn(command, args, { stdio: "inherit", shell: false });
+  const child = spawn(command, args, {
+    stdio: ["inherit", 2, 2],
+    shell: false
+  });
   child.once(
     "error",
     () => reject(new GroveError("client_missing", `${command} is not installed`))
@@ -32077,9 +32246,24 @@ var run = (command, args) => new Promise((resolve, reject) => {
 async function installIntegration(agent, remove = false) {
   if (agent === "cli")
     throw new GroveError("invalid_client", "Choose an agent client");
+  const native = !remove && agent !== "opencode" ? await nativeInstallation(agent) : "missing";
+  if (native === "ready") {
+    console.error("\u2713 Grove integration is already installed");
+    return;
+  }
   if (agent === "claude") {
     if (remove) return run("claude", ["plugin", "uninstall", "grove@grove"]);
     await run("claude", ["plugin", "marketplace", "add", "miniaxolotl/grove"]);
+    if (native === "update") {
+      await run("claude", ["plugin", "marketplace", "update", "grove"]);
+      await run("claude", [
+        "plugin",
+        "update",
+        "grove@grove",
+        "--scope",
+        "user"
+      ]);
+    }
     await run("claude", [
       "plugin",
       "install",
@@ -32090,10 +32274,9 @@ async function installIntegration(agent, remove = false) {
   } else if (agent === "codex") {
     if (remove) return run("codex", ["plugin", "remove", "grove@grove"]);
     await run("codex", ["plugin", "marketplace", "add", "miniaxolotl/grove"]);
+    if (native === "update")
+      await run("codex", ["plugin", "marketplace", "upgrade", "grove"]);
     await run("codex", ["plugin", "add", "grove@grove"]);
-    console.log(
-      "Grove installed. Review and trust its optional hooks in Codex before automatic recall runs."
-    );
   } else {
     const directory = join2(
       process.env.XDG_CONFIG_HOME ?? join2(homedir2(), ".config"),
@@ -32125,6 +32308,12 @@ async function installIntegration(agent, remove = false) {
     const existing = Array.isArray(config2.plugins) ? config2.plugins : [];
     const entries = existing.filter((entry) => !isGrove(entry));
     if (!remove) entries.push(existing.find(isGrove) ?? name);
+    if (!remove && existing.filter(isGrove).length === 1 || remove && !existing.some(isGrove)) {
+      console.error(
+        remove ? "Grove plugin entry is already removed" : "\u2713 Grove integration is already configured"
+      );
+      return;
+    }
     source = applyEdits(
       source,
       modify(source, ["plugins"], entries, {
@@ -32135,15 +32324,250 @@ async function installIntegration(agent, remove = false) {
     const temporary = `${path}.${randomUUID2()}.tmp`;
     await writeFile2(temporary, source, { flag: "wx", mode: 384 });
     await rename2(temporary, path);
+    console.error(
+      remove ? "Grove plugin entry removed" : "\u2713 Grove integration configured"
+    );
+  }
+  if (!remove && agent !== "opencode" && await nativeInstallation(agent) !== "ready")
+    throw new GroveError(
+      "install_incomplete",
+      `Grove was approved, but ${agent} has not enabled the required plugin version. Check its plugin settings, then run grove connect ${agent} again to finish.`
+    );
+}
+
+// packages/mcp/src/browser.ts
+import { spawn as spawn2 } from "node:child_process";
+function openBrowser(url2, noBrowser) {
+  console.error(`Continue in your browser: ${url2.href}`);
+  if (noBrowser) return;
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
+  const browser = spawn2(command, [url2.href], { stdio: "ignore" });
+  browser.on("error", () => {
+  });
+  browser.unref();
+}
+
+// packages/mcp/src/connect.ts
+import { setTimeout as delay2 } from "node:timers/promises";
+var cloudOrigin = "https://api.usegrove.cloud";
+async function waitForApproval(client, attempt, signal, interval = 2e3) {
+  let retryInterval = interval;
+  let recovering = false;
+  while (attempt.status === "pending") {
+    try {
+      await delay2(retryInterval, void 0, { signal });
+      attempt = await client.request(
+        `/v1/connect/${attempt.id}`,
+        { signal }
+      );
+      retryInterval = interval;
+      if (recovering) console.error("\u2713 Connection restored; continuing setup");
+      recovering = false;
+    } catch (error46) {
+      if (signal.aborted)
+        throw new GroveError(
+          "approval_timeout",
+          "Approval timed out. Run the same grove connect command to resume.",
+          408
+        );
+      if (error46 instanceof GroveError && (error46.status >= 500 || ["timeout", "unreachable"].includes(error46.code))) {
+        if (!recovering)
+          console.error(
+            "Grove is temporarily unavailable. Reconnecting automatically\u2026"
+          );
+        recovering = true;
+        retryInterval = Math.min(retryInterval * 2, 8e3);
+        continue;
+      }
+      if (error46 instanceof GroveError && error46.code === "connection_unavailable")
+        throw new GroveError(
+          error46.code,
+          "Connection access changed or this setup was replaced. Run the same grove connect command to resume with your current access.",
+          error46.status
+        );
+      throw error46;
+    }
+  }
+  if (attempt.status !== "approved")
+    throw new GroveError(
+      attempt.status === "cancelled" ? "connection_cancelled" : "connection_expired",
+      `Connection ${attempt.status}. Run grove connect when you are ready.`,
+      409
+    );
+  return attempt;
+}
+async function connectAgent(options, login2) {
+  const { agent, noBrowser } = options;
+  const origin = apiOrigin(options.origin);
+  const environmentKey = !!(process.env.GROVE_API_KEY && process.env.GROVE_API_URL && apiOrigin(process.env.GROVE_API_URL) === origin);
+  await requireClient(agent);
+  console.error(`\u2713 ${agentNames[agent]} found`);
+  const project = await projectIdentity(process.cwd());
+  const client = await nodeClient(agent, origin);
+  let attempt;
+  const start = async () => {
+    attempt = await client.request("/v1/connect", {
+      body: { agent, project }
+    });
+    const url2 = new URL(attempt.approvalUrl);
+    apiOrigin(url2.origin);
+    if (url2.username || url2.password || url2.pathname !== `/app/connect/${attempt.id}` || url2.search || url2.hash)
+      throw new GroveError(
+        "invalid_response",
+        "Grove returned an invalid connection link",
+        502
+      );
+    return attempt.status === "pending" ? url2.href : void 0;
+  };
+  let me;
+  try {
+    me = await client.request("/v1/me");
+  } catch (error46) {
+    if (!(error46 instanceof GroveError) || !["sign_in_required", "unauthorized", "connection_revoked"].includes(
+      error46.code
+    ) || environmentKey)
+      throw error46;
+    if ((await loadCredentials(origin, agent).catch(() => void 0))?.key)
+      throw new GroveError(
+        "sign_in_required",
+        "This API key is unavailable. Run grove login --key-stdin with a new key, then retry connect.",
+        401
+      );
+    me = await login2(origin, agent, false, noBrowser, {
+      freshClient: error46.code === "connection_revoked" || error46.code === "unauthorized",
+      afterLogin: start
+    });
+  }
+  console.error("\u2713 Signed in");
+  if (!attempt) {
+    const approvalUrl = await start();
+    if (approvalUrl) openBrowser(new URL(approvalUrl), noBrowser);
+  }
+  if (attempt.status === "pending") {
+    console.error(
+      `Approve ${agentNames[agent]} in your browser. Waiting for access\u2026`
+    );
+    console.error(attempt.approvalUrl);
+  }
+  const approved = await waitForApproval(
+    client,
+    attempt,
+    AbortSignal.timeout(10 * 6e4)
+  );
+  const verified = await client.request("/v1/me");
+  if (verified.accountId !== me.accountId || approved.connectionId !== me.connectionId || verified.connectionId !== approved.connectionId)
+    throw new GroveError(
+      "account_changed",
+      "The Grove account changed. Run grove connect again.",
+      409
+    );
+  if (!verified.capabilities.length || approved.projectId && !verified.grant?.allProjects && !verified.grant?.projectIds.includes(approved.projectId))
+    throw new GroveError(
+      "connection_scope",
+      "Connection access changed. Run grove connect again.",
+      403
+    );
+  const recallVerified = verified.capabilities.includes("memory:read");
+  if (recallVerified) {
+    await client.request("/v1/recall", {
+      body: {
+        projectId: approved.projectId ?? (verified.grant?.personal ? null : verified.grant?.projectIds[0] ?? null),
+        includePersonal: !!verified.grant?.personal,
+        limit: 1,
+        maxCharacters: 256
+      }
+    });
+  }
+  if (!environmentKey) await activateCredentials(origin, agent, me.accountId);
+  console.error(
+    recallVerified ? "\u2713 Memory access verified" : "\u2713 Grant verified (read access not selected)"
+  );
+  console.error(
+    approved.projectId ? `\u2713 Project linked: ${project?.name}` : verified.grant?.personal ? "\u2713 Personal memory access ready; no current project linked" : "\u2713 Selected scopes ready; current project access was not selected"
+  );
+  await installIntegration(agent);
+  if (environmentKey)
+    console.error(
+      "Launch your agent with the same GROVE_API_URL and GROVE_API_KEY environment."
+    );
+  const activation = activationInstructions(agent);
+  if (options.json)
     console.log(
-      remove ? "Grove plugin entry removed" : "Grove plugin configured. Restart OpenCode to load it."
+      JSON.stringify({
+        status: "connected",
+        origin,
+        agent,
+        accountId: me.accountId,
+        connectionId: approved.connectionId,
+        projectId: approved.projectId,
+        capabilities: verified.capabilities,
+        recallVerified,
+        restartRequired: activation.restartRequired,
+        hostVerified: false,
+        nextStep: activation.message
+      })
     );
+  else {
+    const prompt = verified.capabilities.includes("memory:write") ? verified.grant?.personal ? "Use Grove to remember that I prefer concise answers in my personal memories." : "Use Grove to save a confirmed decision in an allowed project." : "Recall my available memories from Grove.";
+    console.log(
+      `You're connected to Grove.
+${activation.message}
+Ask your agent: "${prompt}"`
+    );
+  }
+}
+
+// packages/mcp/src/select-agent.ts
+import { createInterface } from "node:readline/promises";
+async function selectAgent(interactive) {
+  const agents = ["opencode", "claude", "codex"];
+  const available = (await Promise.all(
+    agents.map(async (agent) => {
+      try {
+        await requireClient(agent);
+        return agent;
+      } catch {
+        return void 0;
+      }
+    })
+  )).filter((agent) => agent !== void 0);
+  if (!available.length)
+    throw new GroveError(
+      "client_missing",
+      "Install OpenCode, Claude Code or Codex, then run grove connect. Setup guide: https://usegrove.cloud/install"
+    );
+  if (available.length === 1) return available[0];
+  if (!interactive)
+    throw new GroveError(
+      "choose_client",
+      `Choose an agent: ${available.map((agent) => `grove connect ${agent}`).join(" or ")}`
+    );
+  console.error("Welcome to Grove. Which agent would you like to connect?");
+  available.forEach(
+    (agent, index) => console.error(`  ${index + 1}. ${agentNames[agent]}`)
+  );
+  const input = createInterface({
+    input: process.stdin,
+    output: process.stderr
+  });
+  try {
+    for (; ; ) {
+      const answer = (await input.question("Choose a number or name [1]: ")).trim().toLowerCase();
+      const selected = available[Number(answer || "1") - 1] ?? available.find(
+        (agent) => agent === answer || agentNames[agent].toLowerCase() === answer
+      );
+      if (selected) return selected;
+      console.error("Choose one of the installed agents above.");
+    }
+  } finally {
+    input.close();
   }
 }
 
 // packages/mcp/src/cli.ts
 var help = `Grove \u2014 private memory across your agents
 
+  grove connect [opencode|claude|codex] [--url <self-hosted origin>] [--no-browser]
   grove init --url <origin> --client opencode|claude|codex
   grove login --url <origin> --client <client> [--key-stdin | --no-browser]
   grove status [--client <client>] [--json]
@@ -32154,9 +32578,10 @@ var help = `Grove \u2014 private memory across your agents
   grove mcp --stdio [--client <client>]
   grove serve  (requires @miniaxolotl/grove-server or use Docker)
 
+Run grove connect to choose an installed agent, create an account or sign in, and finish setup.
 Credentials stay in your user configuration, never in project files.
 Use GROVE_API_URL + GROVE_API_KEY for headless clients. Logs use stderr in stdio mode.`;
-async function login(origin, agent, keyStdin, noBrowser) {
+async function login(origin, agent, keyStdin, noBrowser, options = {}) {
   if (keyStdin) {
     let key = "";
     for await (const chunk of process.stdin) {
@@ -32179,6 +32604,7 @@ async function login(origin, agent, keyStdin, noBrowser) {
     fail = reject;
   });
   const previous = await loadCredentials(origin, agent).catch(() => void 0);
+  let callbackResponse;
   const callbackPort = {
     cli: 34141,
     opencode: 34142,
@@ -32191,23 +32617,17 @@ async function login(origin, agent, keyStdin, noBrowser) {
       origin,
       agent,
       redirectUrl,
-      client: previous?.redirectUrl === redirectUrl ? previous.client : void 0
+      client: !options.freshClient && previous?.redirectUrl === redirectUrl ? previous.client : void 0
     },
     async (url2) => {
-      console.error(`Sign in: ${url2.href}`);
-      if (noBrowser) return;
-      const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
-      const browser = spawn2(command, [url2.href], { stdio: "ignore" });
-      browser.on("error", () => {
-      });
-      browser.unref();
+      openBrowser(url2, noBrowser);
     }
   );
   const server = createServer((request, response) => {
     const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
     response.setHeader("Content-Type", "text/plain");
     response.setHeader("Cache-Control", "no-store");
-    if (url2.pathname !== "/callback" || !provider.checkState(url2.searchParams.get("state"))) {
+    if (url2.pathname !== "/callback" || callbackResponse || !provider.checkState(url2.searchParams.get("state"))) {
       response.writeHead(400).end("Invalid authorization callback");
       return;
     }
@@ -32219,7 +32639,9 @@ async function login(origin, agent, keyStdin, noBrowser) {
       );
       return;
     }
-    response.end("Authorization received. Return to your terminal.");
+    callbackResponse = response;
+    if (!options.afterLogin)
+      response.end("Authorization received. Return to your terminal.");
     finish(result);
   });
   await new Promise((resolve, reject) => {
@@ -32236,17 +32658,25 @@ async function login(origin, agent, keyStdin, noBrowser) {
   });
   void code.catch(() => {
   });
+  console.error(
+    "Create your Grove account or sign in in the browser. Setup will continue here automatically."
+  );
   const timeout = setTimeout(
-    () => fail(new GroveError("login_timeout", "Sign-in timed out")),
-    18e4
+    () => fail(
+      new GroveError(
+        "login_timeout",
+        "Sign-in timed out. Run the same command to try again."
+      )
+    ),
+    10 * 6e4
   );
   try {
-    const options = {
+    const authOptions = {
       serverUrl: `${origin}/mcp`,
       fetchFn: (url2, init) => fetch(url2, { ...init, signal: AbortSignal.timeout(1e4) })
     };
-    if (await auth(provider, options) === "REDIRECT")
-      await auth(provider, { ...options, authorizationCode: await code });
+    if (await auth(provider, authOptions) === "REDIRECT")
+      await auth(provider, { ...authOptions, authorizationCode: await code });
     const token = provider.data.tokens?.access_token;
     if (!token)
       throw new GroveError("login_failed", "No access token was returned");
@@ -32258,8 +32688,23 @@ async function login(origin, agent, keyStdin, noBrowser) {
       ...provider.data,
       accountId: me.accountId
     });
+    const continuation = await options.afterLogin?.(me);
+    if (callbackResponse && !callbackResponse.writableEnded) {
+      if (continuation)
+        callbackResponse.writeHead(303, { Location: continuation });
+      await new Promise(
+        (done) => callbackResponse.end(
+          continuation ? "Continue to Grove to approve access." : "Access ready. Return to your terminal to finish setup.",
+          done
+        )
+      );
+    }
     return me;
   } finally {
+    if (callbackResponse && !callbackResponse.writableEnded)
+      callbackResponse.end(
+        "Connection could not be completed. Return to your terminal and run grove connect again."
+      );
     clearTimeout(timeout);
     server.closeAllConnections();
     server.close();
@@ -32287,11 +32732,35 @@ async function main() {
     );
     return;
   }
-  const command = positionals[0];
+  const command = positionals[0] ?? (process.stdin.isTTY && !values.json ? "connect" : void 0);
   if (!command || values.help) {
     console.log(help);
     return;
   }
+  if (command === "connect") {
+    const selected = positionals[1] ?? (values.client !== "cli" ? values.client : await selectAgent(!!process.stdin.isTTY && !values.json));
+    const parsed = agentSchema.safeParse(selected);
+    if (!parsed.success || positionals.length > 2 || positionals[1] && values.client !== "cli" && values.client !== positionals[1])
+      throw new GroveError(
+        "invalid_client",
+        "Use grove connect opencode, claude or codex"
+      );
+    if (values["key-stdin"] || values.stdio)
+      throw new GroveError(
+        "invalid_command",
+        "Use grove login --key-stdin for API keys, or grove mcp --stdio for the bridge"
+      );
+    await connectAgent(
+      {
+        agent: parsed.data,
+        origin: values.url ?? (process.env.GROVE_API_URL || cloudOrigin),
+        noBrowser: !!values["no-browser"],
+        json: !!values.json
+      },
+      login
+    );
+    return;
+  }
   const agent = values.client;
   if (!["cli", "opencode", "claude", "codex"].includes(agent))
     throw new GroveError(
@@ -32330,7 +32799,11 @@ async function main() {
     await installIntegration(agent, true);
     return;
   }
-  const origin = await configuredOrigin(values.url);
+  const origin = await configuredOrigin(
+    values.url,
+    agent,
+    command === "login" || command === "init" ? cloudOrigin : void 0
+  );
   if (command === "login" || command === "init") {
     const me = await login(
       origin,
@@ -32357,6 +32830,7 @@ async function main() {
           "Choose --client opencode, claude or codex to install"
         );
       await installIntegration(agent);
+      console.error(activationInstructions(agent).message);
       if (me.capabilities.includes("memory:read"))
         console.log(
           JSON.stringify({