@mnemonik/cli 7.107.3 → 7.108.1

package/dist/router.js

@@ -5271,7 +5271,8 @@ import {
   runProjectCommand
 } from "./project.js";
 import { evaluateRoot } from "./project/eligibility.js";
-import { grantTransport, grantHost } from "./auth/status.js";
+import { accountActions } from "./transport/server.js";
+import { grantTransport, grantHost, grantSummaryLines } from "./auth/status.js";
 import { createCliAuth } from "./auth/index.js";
 import { runEditorLogin } from "./auth/pkce.js";
 import { currentInstallSession, ensureInstallSession } from "./auth/installSession.js";
@@ -5307,6 +5308,51 @@ var removedFolderLine = (name2) => `  \u2713 ${name2} is no longer connected.`;
 var projectDeletionWarning = (name2) => `Deleting ${name2} removes its memories, code index and summaries for everyone. This cannot be undone.`;
 var projectDeletedLine = (name2) => `Deleted ${name2}.`;
 var NOTHING_DELETED_LINE = "Nothing was deleted.";
+var NOTHING_REMOVED_LINE = "Nothing was removed.";
+var SCANNER_UNINSTALL_PROMPT = "Uninstalling background indexing means your code on this machine is no longer\nindexed. Agents here lose code search and file context until you set it up\nagain with mnemonik scanner enable. This also withdraws your indexing consent\nfor this machine. Type yes to continue.";
+var SCANNER_REMOVED_LINE = "Background indexing removed from this machine.";
+async function revokeScannerCredential(deps, output, stateDir, saved) {
+  const state = saved ?? JSON.parse(await readFile3(`${stateDir}/scanner/state.json`, "utf8"));
+  const bearer = await ensureCliAuth(deps, output, false);
+  const response = await (deps.grantFetch ?? fetch)(
+    `${apiOrigin()}/api/v1/component-credentials/${encodeURIComponent(state.config.credentialFamilyId)}/revoke`,
+    { method: "POST", headers: { Authorization: `Bearer ${bearer}` } }
+  );
+  if (!response.ok) throw new Error(`revoke_failed_${response.status}`);
+}
+async function confirmScannerOptOut(parsed, deps, output) {
+  if (parsed.flags.has("confirm")) return void 0;
+  if (parsed.flags.has("json") || parsed.flags.has("non-interactive"))
+    return actionRequired2(output, parsed.flags.has("json"), "Rerun with --confirm", "--confirm");
+  output.line(SCANNER_UNINSTALL_PROMPT);
+  const readline = createInterface({ input: deps.input ?? process.stdin, terminal: false });
+  const answer = String((await readline[Symbol.asyncIterator]().next()).value ?? "").trim();
+  readline.close();
+  if (/^(?:y|yes)$/iu.test(answer)) return void 0;
+  output.line(NOTHING_REMOVED_LINE);
+  return 130;
+}
+async function uninstallScannerOptOut(deps, output, service, json) {
+  const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
+  const saved = await readFile3(`${stateDir}/scanner/state.json`, "utf8").then(
+    (text) => JSON.parse(text),
+    (error) => {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    }
+  );
+  if (saved)
+    try {
+      await revokeScannerCredential(deps, output, stateDir, saved);
+    } catch (error) {
+      output.error(humanReason(error.message));
+      return 3;
+    }
+  await service.uninstall();
+  if (json) output.json({ status: "uninstalled", consent: saved ? "withdrawn" : "none" });
+  else output.line(SCANNER_REMOVED_LINE);
+  return 0;
+}
 var dataDeletePrompt = (projectId) => `This deletes everything background indexing has sent for ${projectId} from your account. Type yes to continue.`;
 var stillWatchedLine = (root) => `The folder is still being indexed. Run mnemonik remove ${root} to stop that.`;
 var identityFileKeptLine = "This folder's .mnemonik.json still points at the deleted project. Connecting the folder again creates a new project.";
@@ -5364,6 +5410,9 @@ var values = /* @__PURE__ */ new Set([
 ]);
 var help = helpScreen([]) ?? "";
 function parse(args2) {
+  return { ...parseArguments(args2), json: args2.includes("--json") };
+}
+function parseArguments(args2) {
   const positionals = [];
   const flags2 = /* @__PURE__ */ new Map();
   const namedConfirm = args2[0] === "project" && args2[1] === "delete";
@@ -5404,6 +5453,42 @@ function parse(args2) {
   }
   return { positionals, flags: flags2 };
 }
+function commandPath(positionals) {
+  for (let length = positionals.length; length > 0; length--)
+    if (helpScreen(positionals.slice(0, length))) return positionals.slice(0, length);
+  return [];
+}
+function usageFailure(output, parsed, failure, human) {
+  if (parsed.json) {
+    const command = failure.reason === "unknown_command" ? parsed.positionals[0] ?? "" : (failure.path ?? commandPath(parsed.positionals)).join(" ");
+    output.json({
+      status: "usage_error",
+      reason: failure.reason,
+      command,
+      ...failure.detail ? { detail: failure.detail } : {},
+      action: failure.reason === "unknown_command" || !command ? "mnemonik --help" : `mnemonik ${command} --help`
+    });
+  } else if (typeof human === "string") output.error(human);
+  else human();
+  return 2;
+}
+function flagError(output, parsed, message) {
+  const [, kind, detail] = /^(Unknown flag|Missing value for flag)(?: combination)?: (\S+)/u.exec(
+    message
+  ) ?? [void 0, "Unknown flag"];
+  const reason = kind === "Unknown flag" ? "invalid_flag" : "invalid_value";
+  return usageFailure(output, parsed, { reason, detail }, message);
+}
+function usageReason(positionals, path) {
+  if (!path.length) return { reason: "unknown_command" };
+  for (let index = 1; index < path.length; index++)
+    if (positionals[index] !== path[index])
+      return positionals[index] === void 0 ? { reason: index === 1 ? "missing_subcommand" : "missing_argument" } : { reason: "unknown_subcommand", detail: positionals[index] };
+  const extra = positionals[path.length];
+  if (extra !== void 0)
+    return { reason: path.length === 1 ? "unknown_subcommand" : "invalid_value", detail: extra };
+  return { reason: path.length === 1 ? "missing_subcommand" : "missing_argument" };
+}
 function allowed(parsed, names) {
   const permitted = /* @__PURE__ */ new Set(["json", "non-interactive", "no-browser", "help", ...names]);
   for (const name2 of parsed.flags.keys())
@@ -5444,9 +5529,9 @@ function auth(deps, output, noBrowser) {
     print: (line) => output.line(line)
   });
 }
-async function ensureCliAuth(deps, output, noBrowser, showIdentity = true) {
+async function ensureCliAuth(deps, output, noBrowser, showIdentity = true, fresh = false) {
   const cliAuth = auth(deps, output, noBrowser);
-  let bearer = await cliAuth.getCliBearer().catch((error) => {
+  let bearer = fresh ? { status: "ACTION_REQUIRED", reason: "renew" } : await cliAuth.getCliBearer().catch((error) => {
     if (isCredentialSessionUnavailableError(error))
       return { status: "ACTION_REQUIRED", reason: error.reason };
     throw error;
@@ -5507,13 +5592,27 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
   const component = parsed.flags.get("component");
   const fullUninstall = command === "uninstall" && !host && !component;
   if (host && !hostOrder.includes(host) || component && !["hooks", "mcp"].includes(String(component)))
-    return output.error("Invalid host or component"), 2;
+    return usageFailure(
+      output,
+      parsed,
+      {
+        reason: "invalid_value",
+        detail: String(host && !hostOrder.includes(host) ? host : component)
+      },
+      "Invalid host or component"
+    );
   if (command === "uninstall") await abandonInterrupted(state);
   let selections;
   if (command === "install") {
     const names = String(parsed.flags.get("hosts") ?? hostOrder.join(",")).split(",");
-    if (names.some((name2) => !hostOrder.includes(name2)))
-      return output.error("Invalid hosts"), 2;
+    const unknownHost = names.find((name2) => !hostOrder.includes(name2));
+    if (unknownHost !== void 0)
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_value", detail: unknownHost },
+        "Invalid hosts"
+      );
     const components = String(parsed.flags.get("components") ?? "hooks,mcp").split(",");
     if (components.some((c) => !["hooks", "mcp"].includes(c)))
       return placeholder(output, json, "install scanner", "scanner setup");
@@ -5843,7 +5942,7 @@ async function installCommand(parsed, deps, output) {
     "no-browser",
     "dry-run"
   ]);
-  if (invalid) return output.error(invalid), 2;
+  if (invalid) return flagError(output, parsed, invalid);
   if (!deps.install && !parsed.flags.has("dry-run")) {
     const { joinedInstall } = await import("./install/journey.js");
     const state = deps.hostManagement?.stateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
@@ -5895,7 +5994,7 @@ function refusalStateDir(deps) {
 }
 async function doctorCommand(parsed, deps, output) {
   const invalid = allowed(parsed, []);
-  if (invalid) return output.error(invalid), 2;
+  if (invalid) return flagError(output, parsed, invalid);
   const result = await runPreflight({ cwd: deps.cwd, home: deps.home, ...deps.preflight });
   output.setContext({ home: deps.home ?? homedir3(), projectRoot: result.project.root });
   const document = await collectStatusDocument({
@@ -6000,9 +6099,11 @@ async function deleteProjectCommand(parsed, rest, deps, output) {
   const send = deps.grantFetch ?? fetch;
   const listed = await send(`${apiOrigin()}/api/v1/users/me/projects?days=0&limit=200`, {
     headers: { Authorization: `Bearer ${bearer}` }
-  });
-  if (!listed.ok) {
-    output.error("Mnemonik could not be reached from this machine.");
+  }).catch(() => void 0);
+  if (!listed?.ok) {
+    const reason = !listed ? "unreachable" : listed.status === 401 || listed.status === 403 ? "renew" : "server_error";
+    if (json) output.json({ status: "action_required", reason, action: accountActions[reason] });
+    else output.error(humanReason(reason));
     return 3;
   }
   const listing = await listed.json().catch(() => []);
@@ -6085,10 +6186,19 @@ async function runCli(args2, deps = {}) {
   const output = new Output(stdout, stderr, {
     home: deps.home ?? homedir3()
   });
-  const usageError = (positionals) => {
-    stderr.write(helpScreen(positionals) ?? help);
-    return 2;
-  };
+  const usageError = (positionals, failure = usageReason(
+    parsed.positionals,
+    positionals
+  )) => usageFailure(
+    output,
+    parsed,
+    { path: positionals, ...failure },
+    () => stderr.write(helpScreen(positionals) ?? help)
+  );
+  const argumentError = (screen, words, given, most) => usageError(
+    screen,
+    given.length > most ? { reason: "invalid_value", detail: given[most], path: words } : { reason: "missing_argument", path: words }
+  );
   if (helpIndex !== -1) {
     const positionals = args2.slice(0, helpIndex).filter((argument) => !argument.startsWith("--"));
     const screen = helpScreen(positionals);
@@ -6099,10 +6209,10 @@ async function runCli(args2, deps = {}) {
     stderr.write(
       "WARNING: MNEMONIK_DEV_RELEASE_DIR uses development artifacts; readiness remains LIMITED.\n"
     );
-  if (parsed.error) return output.error(parsed.error), 2;
+  if (parsed.error) return flagError(output, parsed, parsed.error);
   if (parsed.flags.has("version")) {
     if (parsed.positionals.length || parsed.flags.size !== 1)
-      return output.error("Unknown flag combination: --version"), 2;
+      return flagError(output, parsed, "Unknown flag combination: --version");
     output.line(await packageVersion());
     return 0;
   }
@@ -6124,7 +6234,12 @@ async function runCli(args2, deps = {}) {
       ...action === "list" ? [] : ["accept-indexing", "apply"]
     ]);
     if (invalid || !["add", "remove", "list"].includes(action ?? "") || actionArguments.length !== (action === "list" ? 0 : 1))
-      return invalid ? (output.error(invalid), 2) : usageError([command]);
+      return invalid ? flagError(output, parsed, invalid) : !["add", "remove", "list"].includes(action ?? "") ? usageError([command]) : argumentError(
+        [command],
+        command === "roots" ? [command, action ?? ""] : [command],
+        actionArguments.map(String),
+        action === "list" ? 0 : 1
+      );
     const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
     const saved = JSON.parse(
       await readFile3(`${stateDir}/scanner/state.json`, "utf8").catch(() => "null")
@@ -6208,16 +6323,13 @@ async function runCli(args2, deps = {}) {
   if (command === "auth" && subcommand === "logout" && parsed.flags.get("component") === "scanner") {
     const invalid = allowed(parsed, ["component"]);
     if (invalid || rest.length)
-      return invalid ? (output.error(invalid), 2) : usageError(["auth", "logout"]);
+      return invalid ? flagError(output, parsed, invalid) : usageError(["auth", "logout"]);
     try {
-      const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
-      const saved = JSON.parse(await readFile3(`${stateDir}/scanner/state.json`, "utf8"));
-      const bearer = await ensureCliAuth(deps, output, false);
-      const response = await (deps.grantFetch ?? fetch)(
-        `${apiOrigin()}/api/v1/component-credentials/${encodeURIComponent(saved.config.credentialFamilyId)}/revoke`,
-        { method: "POST", headers: { Authorization: `Bearer ${bearer}` } }
+      await revokeScannerCredential(
+        deps,
+        output,
+        deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
       );
-      if (!response.ok) throw new Error(`revoke_failed_${response.status}`);
       const result = {
         status: "revoked",
         verbs: ["revoke access"],
@@ -6239,7 +6351,7 @@ async function runCli(args2, deps = {}) {
     const invalid = allowed(parsed, ["project", "confirm"]);
     const project = parsed.flags.get("project");
     if (invalid || subcommand !== "delete" || rest.length || typeof project !== "string")
-      return invalid ? (output.error(invalid), 2) : usageError(["data", "delete"]);
+      return invalid ? flagError(output, parsed, invalid) : usageError(["data", "delete"]);
     if (!parsed.flags.has("confirm")) {
       if (parsed.flags.has("non-interactive") || parsed.flags.has("json"))
         return actionRequired2(
@@ -6273,7 +6385,12 @@ async function runCli(args2, deps = {}) {
   }
   if ((command === "update" || command === "uninstall") && parsed.flags.get("component") === "scanner") {
     const invalid = allowed(parsed, ["component", ...command === "uninstall" ? ["confirm"] : []]);
-    if (invalid || subcommand) return invalid ? (output.error(invalid), 2) : usageError([command]);
+    if (invalid || subcommand)
+      return invalid ? flagError(output, parsed, invalid) : usageError([command]);
+    if (command === "uninstall") {
+      const declined = await confirmScannerOptOut(parsed, deps, output);
+      if (declined !== void 0) return declined;
+    }
     try {
       const options = {
         stateDir: deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
@@ -6304,19 +6421,13 @@ async function runCli(args2, deps = {}) {
           output.line(
             result.status === "updated" ? "Mnemonik updated." : "Mnemonik is up to date."
           );
-      } else {
-        await scannerService(options).uninstall();
-        const result = {
-          status: "uninstalled",
-          verbs: ["stop collection", "remove local software"],
-          retained: ["credentials", "cloud data", "consent"]
-        };
-        if (parsed.flags.has("json")) output.json(result);
-        else
-          output.line(
-            "Stopped collection; removed local software. Credentials, cloud data and consent retained."
-          );
-      }
+      } else
+        return await uninstallScannerOptOut(
+          deps,
+          output,
+          scannerService(options),
+          parsed.flags.has("json")
+        );
       return 0;
     } catch (error) {
       const failure = scannerFailure(error);
@@ -6350,7 +6461,8 @@ async function runCli(args2, deps = {}) {
       parsed,
       command === "repair" ? ["host", "component", "apply"] : command === "update" ? ["host", "automatic"] : ["host", "component", "confirm"]
     );
-    if (invalid || subcommand) return invalid ? (output.error(invalid), 2) : usageError([command]);
+    if (invalid || subcommand)
+      return invalid ? flagError(output, parsed, invalid) : usageError([command]);
     if (command === "uninstall" && parsed.flags.has("non-interactive")) {
       const missing = requireConsent(parsed, output, ["confirm"]);
       if (missing !== void 0) return missing;
@@ -6360,7 +6472,8 @@ async function runCli(args2, deps = {}) {
   }
   if (command === "update") {
     const invalid = allowed(parsed, ["automatic"]);
-    if (invalid || subcommand) return invalid ? (output.error(invalid), 2) : usageError(["update"]);
+    if (invalid || subcommand)
+      return invalid ? flagError(output, parsed, invalid) : usageError(["update"]);
     const runtimeUpdate = deps.runtimeUpdate;
     if (!runtimeUpdate)
       return placeholder(
@@ -6393,7 +6506,12 @@ async function runCli(args2, deps = {}) {
     const invalid = allowed(parsed, subcommand === "preview" ? ["out"] : []);
     const bundleId = rest[0];
     if (invalid || !["preview", "send"].includes(subcommand ?? "") || subcommand === "preview" && rest.length || subcommand === "send" && (rest.length !== 1 || !bundleId))
-      return invalid ? (output.error(invalid), 2) : usageError(["diagnostics"]);
+      return invalid ? flagError(output, parsed, invalid) : subcommand === "preview" || subcommand === "send" ? argumentError(
+        ["diagnostics"],
+        ["diagnostics", subcommand],
+        rest,
+        subcommand === "send" ? 1 : 0
+      ) : usageError(["diagnostics"]);
     try {
       const result = subcommand === "preview" ? await previewDiagnostics(
         parsed.flags.get("out"),
@@ -6434,7 +6552,8 @@ Preview: ${preview.path}
   }
   if (command === "status") {
     const invalid = allowed(parsed, []);
-    if (invalid || subcommand) return invalid ? (output.error(invalid), 2) : usageError(["status"]);
+    if (invalid || subcommand)
+      return invalid ? flagError(output, parsed, invalid) : usageError(["status"]);
     const document = await collectCurrentInstallation(deps, output);
     const version = await packageVersion();
     const store = new RuntimeStore(
@@ -6453,9 +6572,9 @@ Preview: ${preview.path}
   }
   if (command === "connect") {
     const invalid = allowed(parsed, []);
-    if (invalid) return output.error(invalid), 2;
+    if (invalid) return flagError(output, parsed, invalid);
     if (!subcommand || rest.length || !hostOrder.includes(subcommand))
-      return usageError(["connect"]);
+      return subcommand && !hostOrder.includes(subcommand) ? usageError(["connect"], { reason: "invalid_value", detail: subcommand }) : argumentError(["connect"], ["connect"], [subcommand ?? "", ...rest].filter(Boolean), 1);
     const host = subcommand;
     const editor = (await localEditorStatus(deps.home ?? homedir3())).find(
       (candidate) => candidate.host === host
@@ -6493,21 +6612,28 @@ Preview: ${preview.path}
     if (subcommand === "delete") {
       const unknown = allowed(parsed, ["confirm"]);
       if (unknown || rest.length > 1)
-        return unknown ? (output.error(unknown), 2) : usageError(["project", "delete"]);
+        return unknown ? flagError(output, parsed, unknown) : argumentError(["project", "delete"], ["project", "delete"], rest, 1);
       return deleteProjectCommand(parsed, rest, deps, output);
     }
     const invalid = allowed(
       parsed,
       subcommand === "ensure" ? ["agent"] : subcommand === "status" ? [] : subcommand === "link" ? ["apply", "non-git", "confirm-mismatch", "replace"] : ["apply", "non-git", "owner"]
     );
-    if (invalid) return output.error(invalid), 2;
+    if (invalid) return flagError(output, parsed, invalid);
     if (subcommand === "ensure") {
       if (rest.length) return usageError(["project", "ensure"]);
       return ensureProjectForAgent({
         output,
         cwd: deps.cwd ?? process.cwd(),
         executor: deps.projectExecutor,
-        input: deps.input ?? process.stdin
+        input: deps.input ?? process.stdin,
+        handoff: parsed.flags.has("agent"),
+        // The same sign-in reader status and every other command use.
+        runtime: {
+          stateDir: deps.projectStateDir ?? deps.installStateDir,
+          fetch: deps.grantFetch,
+          getCliBearer: auth(deps, output, true).getCliBearer
+        }
       });
     }
     if (subcommand !== "status" && subcommand !== "setup" && parsed.flags.has("non-interactive")) {
@@ -6515,7 +6641,12 @@ Preview: ${preview.path}
       if (missing !== void 0) return missing;
     }
     if (subcommand === "link" && (rest.length < 1 || rest.length > 2) || subcommand !== "link" && rest.length > 1)
-      return usageError(["project", subcommand]);
+      return argumentError(
+        ["project", subcommand],
+        ["project", subcommand],
+        rest,
+        subcommand === "link" ? 2 : 1
+      );
     return runProjectCommand(
       {
         command: subcommand,
@@ -6543,17 +6674,25 @@ Preview: ${preview.path}
   if (command === "identity") {
     if (subcommand !== "migrate") return usageError(["identity", "migrate"]);
     const invalid = allowed(parsed, ["report", "backup", "apply", "verify", "rollback"]);
-    if (invalid) return output.error(invalid), 2;
+    if (invalid) return flagError(output, parsed, invalid);
     const selected = ["report", "backup", "apply", "verify", "rollback"].filter(
       (flag) => parsed.flags.has(flag)
     );
     if (selected.length > 1)
-      return output.error(
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_flag", detail: `--${selected[1]}` },
         "Choose one migration phase: --report, --backup, --apply, --verify, or --rollback"
-      ), 2;
+      );
     const mode = selected[0] ?? "report";
     if (rest.length && mode !== "report" && mode !== "backup")
-      return output.error("Paths are only accepted by --report and --backup"), 2;
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_value", detail: rest[0] },
+        "Paths are only accepted by --report and --backup"
+      );
     let result;
     try {
       result = await runIdentityMigration({
@@ -6597,10 +6736,14 @@ Preview: ${preview.path}
       );
     const invalid = allowed(
       parsed,
-      subcommand === "enable" ? ["accept-indexing", "apply", "scan-roots", "exclusions", "no-browser"] : subcommand === "export-preview" ? ["out"] : []
+      subcommand === "enable" ? ["accept-indexing", "apply", "scan-roots", "exclusions", "no-browser"] : subcommand === "export-preview" ? ["out"] : subcommand === "uninstall" ? ["confirm"] : []
     );
-    if (invalid) return output.error(invalid), 2;
+    if (invalid) return flagError(output, parsed, invalid);
     if (subcommand === "enable") return enableCommand(parsed, deps, output);
+    if (subcommand === "uninstall") {
+      const declined = await confirmScannerOptOut(parsed, deps, output);
+      if (declined !== void 0) return declined;
+    }
     if (subcommand === "status" && deps.scannerStatus) {
       const status = await deps.scannerStatus();
       const omitted = status.repositories.filter((repository) => !repository.selected).map((repository) => ({
@@ -6691,10 +6834,12 @@ Preview: ${preview.path}
         }
         await service.start();
       } else if (subcommand === "stop") {
+        await controlScanner("stop", options).catch(() => void 0);
         await service.stop();
         if ((deps.scannerService?.platform ?? process.platform) === "darwin")
           output.line("Background indexing will start again when this Mac restarts.");
-      } else if (subcommand === "uninstall") await service.uninstall();
+      } else if (subcommand === "uninstall")
+        return await uninstallScannerOptOut(deps, output, service, json);
       const includesStatus = ["status", "pause", "resume"].includes(subcommand);
       const supervisor = includesStatus ? await service.status() : void 0;
       const receipt = includesStatus ? await scannerReceipt(options.stateDir) : void 0;
@@ -6737,16 +6882,29 @@ Preview: ${preview.path}
       "reopen-install",
       ...subcommand === "logout" ? ["confirm"] : []
     ]);
-    if (invalid || rest.length || !["login", "status", "logout"].includes(subcommand ?? "") || parsed.flags.has("reopen-install") && subcommand !== "login")
-      return invalid ? (output.error(invalid), 2) : usageError(
-        subcommand && helpScreen(["auth", subcommand]) ? ["auth", subcommand] : ["auth"]
+    if (invalid || rest.length || !["login", "renew", "status", "logout"].includes(subcommand ?? "") || parsed.flags.has("reopen-install") && subcommand !== "login" && subcommand !== "renew")
+      return invalid ? flagError(output, parsed, invalid) : usageError(
+        subcommand && helpScreen(["auth", subcommand]) ? ["auth", subcommand] : ["auth"],
+        !rest.length && ["login", "renew", "status", "logout"].includes(subcommand ?? "") ? { reason: "invalid_flag", detail: "--reopen-install" } : void 0
       );
     const host = parsed.flags.get("host");
-    if (host && !hostOrder.includes(host)) return output.error("Invalid host"), 2;
-    if (subcommand === "login") {
-      if (host) return output.error("Use mnemonik connect <host> for a host login"), 2;
+    if (host && !hostOrder.includes(host))
+      return usageFailure(
+        output,
+        parsed,
+        { reason: "invalid_value", detail: String(host) },
+        "Invalid host"
+      );
+    if (subcommand === "login" || subcommand === "renew") {
+      if (host)
+        return usageFailure(
+          output,
+          parsed,
+          { reason: "invalid_flag", detail: "--host" },
+          "Use mnemonik connect <host> for a host login"
+        );
       const noBrowser = parsed.flags.has("no-browser");
-      const bearer = await ensureCliAuth(deps, output, noBrowser);
+      const bearer = await ensureCliAuth(deps, output, noBrowser, true, subcommand === "renew");
       if (parsed.flags.has("reopen-install")) {
         const current = await currentInstallSession(bearer, deps.grantFetch);
         if (current) {
@@ -6806,11 +6964,17 @@ Preview: ${preview.path}
         return (!grantHostName || hostOrder.includes(grantHostName)) && (!host || grantHostName === host);
       }).map((g) => ({ ...g, host: grantHost(g) ?? g.clientName ?? g.clientId }));
       if (parsed.flags.has("json")) output.json({ account: status.account, grants });
-      else
-        for (const g of grants)
-          output.line(
-            `${g.host}: ${g.id}; created ${g.createdAt}; last used ${g.lastUsedAt ?? "never"}; scopes ${g.scopes.join(", ")}`
-          );
+      else if (!grants.length)
+        output.line(
+          host ? `${launchHostLabels[host]} is not signed in.` : humanReason("not_signed_in")
+        );
+      else {
+        output.signedInAs(status.email);
+        for (const line of grantSummaryLines(grants, launchHostLabels)) output.line(line);
+        output.line(
+          "Older sign-ins stay valid until `mnemonik auth logout`. `mnemonik auth status --json` lists every one."
+        );
+      }
       return 0;
     }
     const confirmed = parsed.flags.has("confirm") || await managed.offerRevoke?.(host) || !parsed.flags.has("json") && !parsed.flags.has("non-interactive") && (await chooseHostProfile(deps.input ?? process.stdin, output, [
@@ -6836,7 +7000,7 @@ Preview: ${preview.path}
   if (command === "logout") {
     if (subcommand) return usageError(["logout"]);
     const invalid = allowed(parsed, []);
-    if (invalid) return output.error(invalid), 2;
+    if (invalid) return flagError(output, parsed, invalid);
     await auth(deps, output, false).logout();
     if (parsed.flags.has("json")) output.json({ status: "logged_out" });
     else output.line("Logged out.");
@@ -6849,6 +7013,9 @@ export {
   CODEX_SIGNED_IN_MESSAGE,
   CONNECT_NOT_APPROVED_MESSAGE,
   NOTHING_DELETED_LINE,
+  NOTHING_REMOVED_LINE,
+  SCANNER_REMOVED_LINE,
+  SCANNER_UNINSTALL_PROMPT,
   alreadyConnectedFolderLine,
   connectFolderPrompt,
   connectedFolderLine,