@mnemonik/cli 7.131.1 → 7.132.0

package/dist/scanner-release.json

@@ -1,15 +1,15 @@
 {
-  "version": "7.131.1",
-  "digestsSha256": "fddaf939143a69caeb71d682739c9bd1036cc1149fda878c9358ff3bae996770",
+  "version": "7.132.0",
+  "digestsSha256": "843daf7483f1c9697b3bb176f25bd5c7eb86c16f9cd408eee3414addbc426eb7",
   "platforms": {
     "darwin-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.131.1",
+      "version": "7.132.0",
       "entry": "scanner-darwin-arm64",
       "files": {
         "scanner-darwin-arm64": {
-          "sha256": "16c5ccfc823be45fa11bce9860915cfeb7bd11fd1d360bd4d4ac1e390a3b3252",
+          "sha256": "cb5afa5922c38a27f75e48972a854b9493a7db55ae064771aad4d332df323ba5",
           "size": 154586464,
           "executable": true
         }
@@ -17,7 +17,7 @@
       "totalSize": 154586464,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.131.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.132.0/"
       },
       "signer": {
         "platform": "darwin",
@@ -29,16 +29,16 @@
     "linux-arm64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.131.1",
+      "version": "7.132.0",
       "entry": "scanner-linux-arm64",
       "files": {
         "scanner-linux-arm64": {
-          "sha256": "af5fdd9a6b330ad77e6ad0f1fc15afcdecd5d045c4cdea604300bd3e55c8d25b",
+          "sha256": "d58df75fb113b8073de04447701e43d875b6d637f5fde12fa8696d8f4e5d31c3",
           "size": 156961920,
           "executable": true
         },
         "scanner-linux-arm64.minisig": {
-          "sha256": "acf46407e6e724247d4938b47fe535705b451af5048460abe8df1578fdfd5747",
+          "sha256": "365c96b9bca1136e03c052e679401ad55ad8908d715e0cf6ab474f12eb12c9df",
           "size": 314,
           "executable": false
         }
@@ -46,7 +46,7 @@
       "totalSize": 156962234,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.131.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.132.0/"
       },
       "signer": {
         "platform": "linux",
@@ -59,16 +59,16 @@
     "linux-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.131.1",
+      "version": "7.132.0",
       "entry": "scanner-linux-x64",
       "files": {
         "scanner-linux-x64": {
-          "sha256": "b9072be9d861a5483a8b52b802ce9444d15d446cffe3dfdcfc3add7b7930a6b7",
+          "sha256": "da4b839814ab7bb5fdc3a01d19233552b13e78ec35c7a4c28a05c92eaa70967a",
           "size": 155192512,
           "executable": true
         },
         "scanner-linux-x64.minisig": {
-          "sha256": "acf74fda903cab6659a9de60629f3a6e80f07c603ec0ea641f273fc51f9c7d93",
+          "sha256": "b7edc0866d2567ed9a470bb493ebfaa5a46b07c9cb44ea24c7e7e6c029e86969",
           "size": 312,
           "executable": false
         }
@@ -76,7 +76,7 @@
       "totalSize": 155192824,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.131.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.132.0/"
       },
       "signer": {
         "platform": "linux",
@@ -89,19 +89,19 @@
     "win-x64": {
       "schemaVersion": 1,
       "artifact": "scanner",
-      "version": "7.131.1",
+      "version": "7.132.0",
       "entry": "scanner-win-x64.exe",
       "files": {
         "scanner-win-x64.exe": {
-          "sha256": "961338b19f6db635a4d96d236f46005b5cf4538006e4950fcfd680e0931c8d42",
-          "size": 127677952,
+          "sha256": "090592373a694c44e24cfaafb1ee592b684ca0638055c504f52174024cf1dd7d",
+          "size": 127678464,
           "executable": true
         }
       },
-      "totalSize": 127677952,
+      "totalSize": 127678464,
       "source": {
         "kind": "release",
-        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.131.1/"
+        "url": "https://github.com/JayDeeCo-Limited/mnemonik-cli/releases/download/scanner-v7.132.0/"
       },
       "signingStatus": "unsigned",
       "disclosureVersion": "2026.09.1"

package/dist/status.d.ts

@@ -1,7 +1,7 @@
 export { CODEX_TRUST_MESSAGE } from './humanReason.js';
 import { cliCredentialStatus } from './auth/credentials.js';
-import type { CodingToolSignInResult, CodingToolSignInState } from './auth/status.js';
-import type { StoredSignIn } from './auth/claudeCodeSignIn.js';
+import { type McpAuthorization, type McpState } from './auth/status.js';
+import { type CliSignIn, type HooksState, type ScannerAuthorizationState } from './authorizationWords.js';
 import { type ScannerReceipt } from './scanner/control.js';
 import { type ScannerServiceOptions } from './scanner/service.js';
 import type { Readable } from 'node:stream';
@@ -17,6 +17,7 @@ export declare function localEditorStatus(home: string): Promise<{
     name: "Claude Code" | "Codex" | "Cursor";
     marked: boolean;
     hooks: boolean;
+    credentialFamily?: string | undefined;
     mcp: string;
 }[]>;
 /** What a person can really do to switch a declared connection back on. */
@@ -78,13 +79,12 @@ export declare function buildStatusDocument(input: StatusDocumentInput): Readine
     conditions: ReadinessCondition[];
 };
 /**
- * `status` could not tell the console about this machine because this
- * computer's sign-in is unusable (L-166). Wording decided 2026-09-25; the fix
- * is the approved renew step.
+ * `status` could not tell the console about this machine because the CLI's own
+ * sign-in could not be used (L-166): expired, revoked, or locked in the macOS
+ * Keychain over SSH. The CLI line of the authorization block gives the step.
  */
 export declare const REPORT_NOT_SENT: {
     sentence: string;
-    nextStep: string;
 };
 export declare function renderStatusSummaries(document: ReadinessDocument & {
     cliCredential?: Awaited<ReturnType<typeof cliCredentialStatus>>;
@@ -125,60 +125,92 @@ export declare function collectStatusDocument(input: CollectStatusInput): Promis
 export interface CodingToolStatus {
     host: string;
     name: string;
-    /** From this machine's own files and the tool's own trust records. */
-    hooks: 'installed' | 'missing' | 'approval_pending';
-    /**
-     * From the server, by the console's rule. `unknown` when it could not be
-     * read (Mnemonik unreachable, or this computer's own sign-in unusable).
-     */
-    signIn: CodingToolSignInState | 'unknown';
-    /** When the tool last renewed its sign-in; dates use, never decides it. */
-    lastUsedAt: string | null;
-    /**
-     * What the coding tool itself stores for Mnemonik on this machine, when it
-     * was read (Claude Code only). Token values are never read out.
-     */
-    stored?: StoredSignIn;
+    /** Its MCP connection's authorization; the evidence is in `authorizations`. */
+    mcp: McpState;
+    /** Its hooks' own authorization, from this machine's files and the tool's own trust records. */
+    hooks: HooksState;
     /** Commands the agent runs to fix what is wrong with this tool, in order; empty when none. */
     actions: string[];
     /**
      * Steps only the person can take, inside the coding tool, in plain words
-     * (Claude Code and Cursor sign in only there); empty when none.
+     * (Claude Code and Cursor authorize MCP only there); empty when none.
      */
     personSteps: string[];
 }
+/** One line of the authorization block, with the evidence behind it. */
+export type AuthorizationEntry = ({
+    component: 'mcp';
+    host: string;
+    line: string;
+} & McpAuthorization) | {
+    component: 'hooks';
+    host: string;
+    state: HooksState;
+    line: string;
+} | {
+    component: 'scanner';
+    state: ScannerAuthorizationState;
+    line: string;
+} | ({
+    component: 'cli';
+    line: string;
+} & CliSignIn);
 /** The coding tools installed on this machine: chosen at install or marked in their own settings. */
 export declare function installedCodingTools(home: string, stateDir: string): Promise<{
     host: "claude-code" | "codex" | "cursor";
     name: "Claude Code" | "Codex" | "Cursor";
     marked: boolean;
     hooks: boolean;
+    credentialFamily?: string | undefined;
     mcp: string;
 }[]>;
+/** The hooks' own authorization, as hookAuthorizations reads it. */
+export type HookCredentialState = 'authorized' | 'not_authorized' | 'unchecked';
+/**
+ * Each tool's hooks' own authorization: the credential the installer recorded
+ * for them (or their command names), stored here and inside its refresh
+ * window. Hooks that name none sign in some other way, which is not read here.
+ */
+export declare function hookAuthorizations(stateDir: string, editors: ReadonlyArray<{
+    host: string;
+    credentialFamily?: string;
+}>, now?: number): Promise<Map<string, HookCredentialState>>;
 export declare function codingToolStatuses(editors: ReadonlyArray<{
     host: string;
     name: string;
     hooks: boolean;
-}>, conditions: readonly ReadinessCondition[], signIns: ReadonlyMap<string, CodingToolSignInResult> | undefined): CodingToolStatus[];
+}>, conditions: readonly ReadinessCondition[], mcp: ReadonlyMap<string, McpAuthorization>, hookCredentials?: ReadonlyMap<string, HookCredentialState>): CodingToolStatus[];
 /**
- * The status document with each tool's sign-in added. A tool signed out on
- * this machine is a condition of the installation: status never says the
- * machine is working while one is. A tool never signed in here is not (it may
- * simply be unused); its line says how to sign in.
+ * The status document with each tool's state added. A tool whose MCP
+ * authorization here was revoked, expired, or is no longer held by the tool,
+ * hooks or a scanner whose own authorization is missing, expired or refused,
+ * is a condition of the installation: status never says the machine is
+ * working while one is. A tool never authorized here is not (it may simply be
+ * unused); its line says how to authorize it.
  */
 export declare function withCodingTools<T extends ReadinessDocument & {
     conditions?: readonly ReadinessCondition[];
-}>(document: T, tools: readonly CodingToolStatus[]): T & {
+}>(document: T, tools: readonly CodingToolStatus[], mcp: ReadonlyMap<string, McpAuthorization>, 
+/** The scanner's own authorization; one that is gone is a condition too, said once. */
+scanner?: ScannerAuthorizationState): T & {
     codingTools: CodingToolStatus[];
 };
-/** A stored sign-in whose access has expired and that the tool renews by itself. */
-export declare const renewsMessage: (tool: string) => string;
 /**
- * One line per tool, for a person, at a glance: signed in or not, and the one
- * short command when there is something to do. Hooks, last use and the rest
- * are in `--json`. A signed-out tool is already the installation's attention
- * line, with its command, so it is not said twice; a tool whose sign-in could
- * not be read gets no line.
+ * Background indexing's own authorization on this computer: set up, its
+ * credential stored here and inside its refresh window, and no refusal
+ * reported by the running scanner. The server's record of it is not asked.
+ */
+export declare function scannerAuthorization(stateDir: string, now?: number): Promise<ScannerAuthorizationState>;
+/**
+ * The authorization block of `status`: each tool's MCP connection and hooks,
+ * then the scanner and the CLI, one line each, never dropped. A state the
+ * installation's attention lines already give a step for says only what is wrong.
  */
-export declare function codingToolLines(tools: readonly CodingToolStatus[]): string[];
+export declare function authorizationEntries(input: {
+    tools: readonly CodingToolStatus[];
+    mcp: ReadonlyMap<string, McpAuthorization>;
+    conditions: readonly ReadinessCondition[];
+    scanner: ScannerAuthorizationState;
+    cli: CliSignIn;
+}): AuthorizationEntry[];
 //# sourceMappingURL=status.d.ts.map

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAE5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AACpD,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAkB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAE1F,QAAA,MAAM,WAAW,sBACd,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,aACrE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,aAC3D,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,EAAE,kBAAkB,EACrD,CAAC;AA+BX,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM;;;;;;KAkDnD;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAI3E,CAAC;AAEF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,WAAW,GAAG,aAAa,CAAC;IAC1C,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,sBAAsB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACpF,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,eAAe,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAC1D,+FAA+F;IAC/F,cAAc,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACzD,6GAA6G;IAC7G,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnD,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2ED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,GACzB,iBAAiB,GAAG;IAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoF1D;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,iBAAiB,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC5C,EACD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAC5B,kFAAkF;AAClF,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,IAAI,CA8DN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,EACrF,SAAS,UAAQ,GAChB,MAAM,EAAE,CAYV;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,GAC1D,MAAM,CAWR;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,iFAAiF;AACjF,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,UAAQ,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAIlE;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAmBD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAC7E,iBAAiB,GAAG;IAClB,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAC/D,QAAQ,EAAE,cAAc,CAAC;CAC1B,CACF,CAmRA;AAID,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,KAAK,EAAE,WAAW,GAAG,SAAS,GAAG,kBAAkB,CAAC;IACpD;;;OAGG;IACH,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC1C,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAcD,qGAAqG;AACrG,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;KAKxE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,EACtE,UAAU,EAAE,SAAS,kBAAkB,EAAE,EACzC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,SAAS,GAC/D,gBAAgB,EAAE,CA+BpB;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,iBAAiB,GAAG;IAAE,UAAU,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,EAC5E,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,CAAC,GAAG;IAAE,WAAW,EAAE,gBAAgB,EAAE,CAAA;CAAE,CA0B1F;AAED,oFAAoF;AACpF,eAAO,MAAM,aAAa,SAAU,MAAM,WAC0B,CAAC;AAErE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAc5E"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAoB,KAAK,gBAAgB,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAOL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAgB9B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAE5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAiB,MAAM,aAAa,CAAC;AACpD,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGtD,OAAO,EAAkB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAE1F,QAAA,MAAM,WAAW,sBACd,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,cAAc,aACrE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,aAC3D,QAAQ,EAAE,QAAQ,EAAE,oBAAoB,EAAE,kBAAkB,EACrD,CAAC;AA+BX,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM;;;;;;;KAuDnD;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAI3E,CAAC;AAEF,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,eAAe,CAAC,EAAE,eAAe,GAChC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,WAAW,GAAG,aAAa,CAAC;IAC1C,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,sBAAsB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACpF,gBAAgB,CAAC,EAAE;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,CAAC;IAChB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAChE,eAAe,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IAC1D,+FAA+F;IAC/F,cAAc,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC;IACzD,6GAA6G;IAC7G,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnD,qBAAqB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACtD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2ED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,GACzB,iBAAiB,GAAG;IAAE,UAAU,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAoF1D;AA2DD;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B,QAAQ;CAET,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,iBAAiB,GAAG;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC5C,EACD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;AAC5B,kFAAkF;AAClF,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,IAAI,CA8DN;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,aAAa,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,EACrF,SAAS,UAAQ,GAChB,MAAM,EAAE,CAYV;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,GAC1D,MAAM,CAWR;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,iFAAiF;AACjF,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,SAAS,UAAQ,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAIlE;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAe9B;AAmBD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAC7E,iBAAiB,GAAG;IAClB,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC;IAC/D,QAAQ,EAAE,cAAc,CAAC;CAC1B,CACF,CAmRA;AAID,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,GAAG,EAAE,QAAQ,CAAC;IACd,gGAAgG;IAChG,KAAK,EAAE,UAAU,CAAC;IAClB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,MAAM,kBAAkB,GAC1B,CAAC;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAAC,GACrE;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACxE,CAAC;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAAC;AAerD,qGAAqG;AACrG,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;;;;;;;KAKxE;AASD,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAEhF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACnE,GAAG,SAAa,GACf,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAkB3C;AA+BD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,EACtE,UAAU,EAAE,SAAS,kBAAkB,EAAE,EACzC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC1C,eAAe,GAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAa,GACpE,gBAAgB,EAAE,CA2BpB;AASD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,CAAC,SAAS,iBAAiB,GAAG;IAAE,UAAU,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;CAAE,EAE5E,QAAQ,EAAE,CAAC,EACX,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAClC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC1C,uFAAuF;AACvF,OAAO,CAAC,EAAE,yBAAyB,GAClC,CAAC,GAAG;IAAE,WAAW,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAuDzC;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,GACf,OAAO,CAAC,yBAAyB,CAAC,CAcpC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACnC,GAAG,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,OAAO,EAAE,yBAAyB,CAAC;IACnC,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,kBAAkB,EAAE,CA4BvB"}

package/dist/status.js

@@ -2707,6 +2707,16 @@ import {
 } from "./humanReason.js";
 import { CODEX_TRUST_MESSAGE } from "./humanReason.js";
 import { cliCredentialStatus } from "./auth/credentials.js";
+import { createCliCredentials } from "./auth/credentials.js";
+import { mcpAuthorization } from "./auth/status.js";
+import {
+  cliLine,
+  hooksLine,
+  mcpLine,
+  hooksNotAuthorizedReason,
+  mcpNotAuthorizedReason,
+  scannerLine
+} from "./authorizationWords.js";
 import { readOwnership } from "./install/ownership.js";
 import {
   pausedForConsent,
@@ -8196,6 +8206,7 @@ async function localEditorStatus(home) {
         declaration = object(config.mcp_servers) ? config.mcp_servers.mnemonik : object(config.mcpServers) ? config.mcpServers.mnemonik : void 0;
       } catch {
       }
+      const credentialFamily = commands.map((command) => /--credential-family (\S+)/u.exec(command)?.[1]).find((id) => !!id);
       return {
         host,
         name: name2,
@@ -8203,6 +8214,7 @@ async function localEditorStatus(home) {
         // presence of ~/.codex or a project-local .cursor is not a choice.
         marked: commands.length > 0 || object(declaration),
         hooks,
+        ...credentialFamily ? { credentialFamily } : {},
         mcp: !object(declaration) ? "missing" : declaration.enabled === false || declaration.disabled === true ? "disabled" : "ready"
       };
     })
@@ -8407,8 +8419,7 @@ ${message.nextStep}`;
   return lines;
 }
 var REPORT_NOT_SENT = {
-  sentence: "The console has not heard from this machine because its sign-in no longer works.",
-  nextStep: humanMessageFor("renew").nextStep
+  sentence: "The console has not heard from this computer because the CLI sign-in could not be used."
 };
 function renderStatusSummaries(document, output, options = {}) {
   if (options.diagnostics && document.cliCredential)
@@ -8477,7 +8488,7 @@ function refusalLines(batches, withPaths = false) {
 function scannerFailureCause(failure) {
   switch (failure.kind) {
     case "credential_refused":
-      return "The server refused this computer's indexing sign-in. Run mnemonik repair.";
+      return "Mnemonik no longer accepts the scanner authorization on this computer. Run mnemonik repair.";
     case "push_rejected":
       return `The server rejected an upload from this computer.${failure.reason ? ` The server said: ${failure.reason}.` : ""}`;
     case "watcher_error":
@@ -8722,30 +8733,70 @@ async function installedCodingTools(home, stateDir) {
     (editor) => editor.marked || owned.includes(editor.host)
   );
 }
-function codingToolStatuses(editors, conditions, signIns) {
+var hookConditionKinds = /* @__PURE__ */ new Set([
+  "hooks_missing",
+  "hook_not_verified",
+  "host_trust_pending",
+  "selected_component_failed"
+]);
+async function hookAuthorizations(stateDir, editors, now = Date.now()) {
+  const owned = (await readOwnership(stateDir)).targets;
+  const credentials = createCliCredentials({ stateDir });
+  return new Map(
+    await Promise.all(
+      editors.map(async (editor) => {
+        const id = owned.find((target) => target.host === editor.host && target.component === "hooks")?.credentialFamily || editor.credentialFamily;
+        if (!id) return [editor.host, "unchecked"];
+        const family = await credentials.readFamily(id).catch(() => null);
+        return [
+          editor.host,
+          family && Date.parse(family.refreshExpiresAt) > now ? "authorized" : "not_authorized"
+        ];
+      })
+    )
+  );
+}
+function hooksState(host, installed, credential, conditions) {
+  const mine = conditions.filter(
+    (condition) => condition.component === host && hookConditionKinds.has(condition.kind)
+  );
+  if (mine.some((condition) => condition.kind === "host_trust_pending")) return "trust_pending";
+  const missing = mine.find(
+    (condition) => condition.kind === "hooks_missing" || condition.kind === "selected_component_failed" && /hooks/u.test(condition.reason)
+  );
+  if (missing && !/sign-in/u.test(missing.reason)) return "not_installed";
+  if (!installed) return "not_installed";
+  if (missing || credential === "not_authorized") return "not_authorized";
+  const unverified = mine.find((condition) => condition.kind === "hook_not_verified");
+  if (unverified) return /not installed/u.test(unverified.reason) ? "not_installed" : "unchecked";
+  return credential === "unchecked" ? "unchecked" : "authorized";
+}
+var ended = (mcp) => mcp?.state === "not_authorized" && (mcp.reason === "revoked_or_expired" || mcp.reason === "not_held");
+function codingToolStatuses(editors, conditions, mcp, hookCredentials = /* @__PURE__ */ new Map()) {
   return editors.map((editor) => {
+    const hooks = hooksState(
+      editor.host,
+      editor.hooks,
+      hookCredentials.get(editor.host),
+      conditions
+    );
     const trust = conditions.find(
       (condition) => condition.kind === "host_trust_pending" && condition.component === editor.host
     );
-    const hooks = trust ? "approval_pending" : editor.hooks && !conditions.some(
-      (condition) => condition.kind === "hooks_missing" && condition.component === editor.host
-    ) ? "installed" : "missing";
-    const signIn = signIns?.get(editor.host);
-    const signInNeeded = signIn?.state === "signed_out" || signIn?.state === "not_set_up";
+    const authorization = mcp.get(editor.host);
+    const authorizeNeeded = authorization?.state === "not_authorized";
     const fix = signInFix(editor.host);
     return {
       host: editor.host,
       name: editor.name,
+      mcp: authorization?.state ?? "unchecked",
       hooks,
-      signIn: signIn?.state ?? "unknown",
-      lastUsedAt: signIn?.lastUsedAt ?? null,
-      ...signIn?.stored ? { stored: signIn.stored } : {},
       actions: [
-        ...hooks === "missing" ? ["mnemonik repair"] : [],
-        ...hooks === "approval_pending" && trust?.action ? [trust.action] : [],
-        ...signInNeeded && "command" in fix ? [fix.command] : []
+        ...hooks === "not_installed" || hooks === "not_authorized" ? ["mnemonik repair"] : [],
+        ...hooks === "trust_pending" && trust?.action ? [trust.action] : [],
+        ...authorizeNeeded && "command" in fix ? [fix.command] : []
       ],
-      personSteps: signInNeeded && "step" in fix ? [fix.step] : []
+      personSteps: authorizeNeeded && "step" in fix ? [fix.step] : []
     };
   });
 }
@@ -8755,16 +8806,39 @@ var stateRank = {
   ACTION_REQUIRED: 2,
   FAILED: 3
 };
-function withCodingTools(document, tools) {
-  const signedOut = tools.filter((tool) => tool.signIn === "signed_out").map((tool) => {
-    const fix = signInFix(tool.host);
-    return {
-      kind: "login_pending",
+function withCodingTools(document, tools, mcp, scanner) {
+  const scannerSaid = (document.conditions ?? []).some(
+    (condition) => condition.component === "scanner" && condition.kind === "login_pending"
+  );
+  const signedOut = [
+    ...(scanner === "not_authorized" || scanner === "refused") && !scannerSaid ? [
+      {
+        kind: "login_pending",
+        component: "scanner",
+        reason: "scanner_signed_out",
+        action: "mnemonik repair"
+      }
+    ] : [],
+    ...tools.filter((tool) => ended(mcp.get(tool.host))).map((tool) => {
+      const fix = signInFix(tool.host);
+      return {
+        kind: "login_pending",
+        component: tool.host,
+        reason: mcpNotAuthorizedReason(tool.name),
+        action: "step" in fix ? fix.step : fix.command
+      };
+    }),
+    ...tools.filter(
+      (tool) => tool.hooks === "not_authorized" && !(document.conditions ?? []).some(
+        (condition) => condition.component === tool.host && condition.kind === "hooks_missing"
+      )
+    ).map((tool) => ({
+      kind: "hooks_missing",
       component: tool.host,
-      reason: `${tool.name} is signed out of Mnemonik.`,
-      action: "step" in fix ? fix.step : fix.command
-    };
-  });
+      reason: hooksNotAuthorizedReason(tool.name),
+      action: "mnemonik repair"
+    }))
+  ];
   if (!signedOut.length) return { ...document, codingTools: [...tools] };
   const added = reduceReadiness(signedOut);
   const installation = document.installation;
@@ -8779,27 +8853,54 @@ function withCodingTools(document, tools) {
     codingTools: [...tools]
   };
 }
-var renewsMessage = (tool) => `The sign-in renews automatically the next time ${tool} connects.`;
-function codingToolLines(tools) {
-  return tools.flatMap((tool) => {
-    if (tool.signIn === "signed_in")
-      return [
-        tool.stored?.state === "refreshable" ? `${tool.name}: signed in. ${renewsMessage(tool.name)}` : `${tool.name}: signed in.`
-      ];
-    if (tool.signIn === "signed_in_elsewhere")
-      return [`${tool.name}: signed in on another of your machines.`];
-    if (tool.signIn !== "not_set_up") return [];
-    const fix = signInFix(tool.host);
-    return [`${tool.name}: not signed in. ${"step" in fix ? fix.step : `Run ${fix.command}.`}`];
+async function scannerAuthorization(stateDir, now = Date.now()) {
+  const state = JSON.parse(
+    await readFile2(join6(stateDir, "scanner/state.json"), "utf8").catch(() => "null")
+  );
+  if (!state) return "not_set_up";
+  const receipt = await scannerReceipt(stateDir).catch(() => null);
+  if (receipt?.snapshot?.lifecycle?.reason === "credential_revoked") return "refused";
+  const id = state.config?.credentialFamilyId;
+  if (typeof id !== "string") return "unchecked";
+  const family = await createCliCredentials({ stateDir }).readFamily(id).catch(() => null);
+  return family && Date.parse(family.refreshExpiresAt) > now ? "authorized" : "not_authorized";
+}
+function authorizationEntries(input) {
+  const stepped = (component, kinds) => input.conditions.some(
+    (condition) => condition.component === component && kinds.has(condition.kind)
+  );
+  const entries = [];
+  for (const tool of input.tools) {
+    const mcp = input.mcp.get(tool.host) ?? mcpAuthorization(void 0, void 0);
+    entries.push({
+      component: "mcp",
+      host: tool.host,
+      ...mcp,
+      line: mcpLine(tool.name, tool.host, mcp)
+    });
+    entries.push({
+      component: "hooks",
+      host: tool.host,
+      state: tool.hooks,
+      line: hooksLine(tool.name, tool.hooks, stepped(tool.host, hookConditionKinds))
+    });
+  }
+  entries.push({
+    component: "scanner",
+    state: input.scanner,
+    line: scannerLine(input.scanner, stepped("scanner", /* @__PURE__ */ new Set(["login_pending"])))
   });
+  entries.push({ component: "cli", ...input.cli, line: cliLine(input.cli) });
+  return entries;
 }
 export {
   CODEX_TRUST_MESSAGE,
   REPORT_NOT_SENT,
+  authorizationEntries,
   buildStatusDocument,
-  codingToolLines,
   codingToolStatuses,
   collectStatusDocument,
+  hookAuthorizations,
   installedCodingTools,
   localEditorStatus,
   localInstallationConditions,
@@ -8809,7 +8910,7 @@ export {
   renderRefusals,
   renderScannerFailure,
   renderStatusSummaries,
-  renewsMessage,
+  scannerAuthorization,
   scannerFailureCause,
   statusExitCode,
   withCodingTools