@nathapp/nax 0.83.7 → 0.84.0

package/dist/nax.js

@@ -2198,6 +2198,266 @@ function killProcessGroup(pid, signal) {
   }
 }
 
+// ../nax-agent/src/terminal-auth/open-url.ts
+import { spawn } from "child_process";
+function spawnDetached(command) {
+  const [file, ...args] = command;
+  const child = spawn(file ?? "", args, { stdio: "ignore", detached: true, windowsHide: true });
+  child.on("error", () => {});
+  child.unref();
+  return child;
+}
+function openerFor(platform, url) {
+  if (platform === "darwin")
+    return ["open", url];
+  if (platform === "win32")
+    return ["cmd", "/c", "start", "", url];
+  return ["xdg-open", url];
+}
+function openUrl(url) {
+  try {
+    _openUrlDeps.spawn(openerFor(_openUrlDeps.platform(), url));
+  } catch {}
+}
+var _openUrlDeps;
+var init_open_url = __esm(() => {
+  _openUrlDeps = {
+    spawn: (command) => {
+      spawnDetached(command);
+    },
+    platform: () => process.platform
+  };
+});
+
+// ../nax-agent/src/terminal-auth/prompt.ts
+function stdinOf() {
+  return _terminalPromptDeps.stdin ?? process.stdin;
+}
+function keyAction(char, bufferEmpty, hasEmptyHook) {
+  if (char === ETX || char === EOT)
+    return { kind: "cancel" };
+  if (char === CR || char === LF) {
+    return bufferEmpty && hasEmptyHook ? { kind: "empty-submit" } : { kind: "submit" };
+  }
+  if (char === BACKSPACE)
+    return { kind: "erase" };
+  return { kind: "append" };
+}
+function applyEdit(action, char, buffer, echo, onEmptySubmit) {
+  if (action.kind === "empty-submit") {
+    onEmptySubmit?.();
+    return buffer;
+  }
+  if (action.kind === "erase") {
+    if (echo)
+      _terminalPromptDeps.write("\b \b");
+    return buffer.slice(0, -1);
+  }
+  if (echo)
+    _terminalPromptDeps.write(char);
+  return buffer + char;
+}
+function read(message, echo, onEmptySubmit, style) {
+  const stdin = stdinOf();
+  if (stdin.isTTY !== true)
+    return Promise.reject(new PromptCancelledError);
+  _terminalPromptDeps.write(`${style.accent("?")} ${message} `);
+  return new Promise((resolve3, reject) => {
+    let buffer = "";
+    let settled = false;
+    const cleanup = () => {
+      if (settled)
+        return;
+      settled = true;
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("error", onEnd);
+      stdin.setRawMode(false);
+      stdin.pause();
+      _terminalPromptDeps.write(`
+`);
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(new PromptCancelledError);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk) {
+        const action = keyAction(char, buffer.length === 0, onEmptySubmit !== undefined);
+        if (action.kind === "cancel") {
+          onEnd();
+          return;
+        }
+        if (action.kind === "submit") {
+          cleanup();
+          resolve3(buffer);
+          return;
+        }
+        buffer = applyEdit(action, char, buffer, echo, onEmptySubmit);
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdin.once("end", onEnd);
+    stdin.once("error", onEnd);
+  });
+}
+function promptForSecret(message, style = PLAIN_STYLE) {
+  return read(message, false, undefined, style);
+}
+function promptForLine(message, onEmptySubmit, style = PLAIN_STYLE) {
+  return read(message, true, onEmptySubmit, style);
+}
+function promptForSelect(message, choices, style = PLAIN_STYLE) {
+  const stdin = stdinOf();
+  if (stdin.isTTY !== true)
+    return Promise.reject(new PromptCancelledError);
+  if (choices.length === 0)
+    return Promise.reject(new PromptCancelledError);
+  _terminalPromptDeps.write(`${style.accent("?")} ${message}
+`);
+  return new Promise((resolve3, reject) => {
+    let index = 0;
+    let settled = false;
+    let drawn = false;
+    const render = () => {
+      if (drawn)
+        _terminalPromptDeps.write(`\x1B[${choices.length}A`);
+      drawn = true;
+      for (const [i, choice] of choices.entries()) {
+        const active = i === index;
+        const marker = active ? style.accent(">") : " ";
+        const label = active ? style.accent(choice.label) : choice.label;
+        _terminalPromptDeps.write(`\r\x1B[2K${marker} ${label}
+`);
+      }
+    };
+    const cleanup = () => {
+      if (settled)
+        return;
+      settled = true;
+      stdin.removeListener("data", onData);
+      stdin.removeListener("end", onEnd);
+      stdin.removeListener("error", onEnd);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+    const onEnd = () => {
+      cleanup();
+      reject(new PromptCancelledError);
+    };
+    const onData = (chunk) => {
+      if (chunk.includes(ETX) || chunk.includes(EOT)) {
+        onEnd();
+        return;
+      }
+      if (chunk.includes(ARROW_UP)) {
+        index = (index - 1 + choices.length) % choices.length;
+        render();
+        return;
+      }
+      if (chunk.includes(ARROW_DOWN)) {
+        index = (index + 1) % choices.length;
+        render();
+        return;
+      }
+      if (chunk.includes(CR) || chunk.includes(LF)) {
+        const chosen = choices[index];
+        cleanup();
+        resolve3(chosen.id);
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stdin.on("data", onData);
+    stdin.once("end", onEnd);
+    stdin.once("error", onEnd);
+    render();
+  });
+}
+var ETX = "\x03", EOT = "\x04", CR = "\r", LF = `
+`, BACKSPACE = "\x7F", ARROW_UP = "\x1B[A", ARROW_DOWN = "\x1B[B", identity = (text) => text, PLAIN_STYLE, PromptCancelledError, _terminalPromptDeps;
+var init_prompt = __esm(() => {
+  PLAIN_STYLE = { accent: identity, dim: identity, bold: identity };
+  PromptCancelledError = class PromptCancelledError extends Error {
+    constructor() {
+      super("Prompt cancelled");
+      this.name = "PromptCancelledError";
+    }
+  };
+  _terminalPromptDeps = {
+    stdin: undefined,
+    write: (text) => process.stdout.write(text)
+  };
+});
+
+// ../nax-agent/src/terminal-auth/interaction.ts
+function createTerminalAuthInteraction(options) {
+  const style = options.style ?? PLAIN_STYLE;
+  const open = options.openUrl ?? openUrl;
+  let pendingUrl;
+  const manualCode = (message) => {
+    const url = pendingUrl;
+    if (url === undefined)
+      return promptForLine(message, undefined, style);
+    pendingUrl = undefined;
+    options.log(style.dim("Press Enter to open it in your browser."));
+    return promptForLine(message, () => {
+      options.log(style.dim("Opening your browser..."));
+      open(url);
+    }, style);
+  };
+  return {
+    prompt: async (prompt) => {
+      if (prompt.type === "manual-code")
+        return manualCode(prompt.message);
+      if (prompt.type === "text")
+        return promptForLine(prompt.message, undefined, style);
+      if (prompt.type === "select") {
+        return promptForSelect(prompt.message, prompt.options.map((option) => ({ id: option.id, label: option.label })), style);
+      }
+      return promptForSecret(prompt.message, style);
+    },
+    notify: (event) => {
+      switch (event.type) {
+        case "auth-url":
+          options.log(`
+${style.bold("Open this URL to continue:")}
+  ${event.url}`);
+          pendingUrl = event.url;
+          return;
+        case "device-code":
+          options.log(`
+Go to ${event.verificationUri} and enter code ${style.bold(event.userCode)}`);
+          return;
+        case "info":
+          options.log(event.message);
+          for (const link of event.links ?? [])
+            options.log(`  ${link.label ?? "Link"}: ${link.url}`);
+          return;
+        case "progress":
+          options.log(style.dim(event.message));
+          return;
+        default:
+      }
+    }
+  };
+}
+var init_interaction = __esm(() => {
+  init_open_url();
+  init_prompt();
+});
+
+// ../nax-agent/src/terminal-auth/index.ts
+var init_terminal_auth = __esm(() => {
+  init_interaction();
+  init_open_url();
+  init_prompt();
+});
+
 // ../nax-agent/src/native/credentials/chained-store.ts
 function createChainedCredentialStore(options) {
   const served = new Map;
@@ -2348,37 +2608,37 @@ function classify2(previous, next) {
     return "renewed";
   return "changed";
 }
-function identityData(providerId, identity) {
+function identityData(providerId, identity2) {
   return {
     providerId,
-    kind: identity.kind,
-    source: identity.source,
-    fingerprint: identity.fingerprint,
-    ...identity.account !== undefined ? { account: identity.account } : {}
+    kind: identity2.kind,
+    source: identity2.source,
+    fingerprint: identity2.fingerprint,
+    ...identity2.account !== undefined ? { account: identity2.account } : {}
   };
 }
-function replacementData(providerId, identity, previous) {
+function replacementData(providerId, identity2, previous) {
   return {
-    ...identityData(providerId, identity),
+    ...identityData(providerId, identity2),
     previousFingerprint: previous.fingerprint,
     ...previous.account !== undefined ? { previousAccount: previous.account } : {}
   };
 }
-function toStamp(identity) {
+function toStamp(identity2) {
   return {
-    fingerprint: identity.fingerprint,
-    source: identity.source,
-    ...identity.account !== undefined ? { account: identity.account } : {}
+    fingerprint: identity2.fingerprint,
+    source: identity2.source,
+    ...identity2.account !== undefined ? { account: identity2.account } : {}
   };
 }
 function createChangeGuard(inner, options) {
   const identities = new Map;
-  async function read(providerId) {
+  async function read2(providerId) {
     const credential = await inner.read(providerId);
     if (credential === undefined)
       return;
     const described = options.describe(providerId);
-    const identity = {
+    const identity2 = {
       kind: credential.kind,
       fingerprint: await fingerprintCredential(credential, options.salt),
       source: described?.source ?? "file",
@@ -2386,39 +2646,39 @@ function createChangeGuard(inner, options) {
     };
     const previous = identities.get(providerId);
     if (previous === undefined) {
-      getSafeLogger()?.info("credentials", "credential.resolved", identityData(providerId, identity));
-      identities.set(providerId, identity);
+      getSafeLogger()?.info("credentials", "credential.resolved", identityData(providerId, identity2));
+      identities.set(providerId, identity2);
       return credential;
     }
-    const verdict = classify2(previous, identity);
+    const verdict = classify2(previous, identity2);
     if (verdict === "renewed") {
-      getSafeLogger()?.info("credentials", "credential.renewed", replacementData(providerId, identity, previous));
+      getSafeLogger()?.info("credentials", "credential.renewed", replacementData(providerId, identity2, previous));
     } else if (verdict === "changed") {
       getSafeLogger()?.warn("credentials", "credential.changed", {
-        ...replacementData(providerId, identity, previous),
+        ...replacementData(providerId, identity2, previous),
         onChange: options.onChange
       });
       if (options.onChange === "refuse") {
-        throw new NaxError(`[credentials] Credential for ${providerId} changed from ${previous.fingerprint} to ${identity.fingerprint}`, "CREDENTIAL_CHANGED", {
+        throw new NaxError(`[credentials] Credential for ${providerId} changed from ${previous.fingerprint} to ${identity2.fingerprint}`, "CREDENTIAL_CHANGED", {
           stage: "credentials",
           providerId,
-          kind: identity.kind,
-          source: identity.source,
-          fingerprint: identity.fingerprint,
+          kind: identity2.kind,
+          source: identity2.source,
+          fingerprint: identity2.fingerprint,
           previousFingerprint: previous.fingerprint
         });
       }
     }
-    identities.set(providerId, identity);
+    identities.set(providerId, identity2);
     return credential;
   }
   return {
-    read,
+    read: read2,
     modify: (providerId, fn) => inner.modify(providerId, fn),
     delete: (providerId) => inner.delete(providerId),
     servedAuth: (providerId) => {
-      const identity = identities.get(providerId);
-      return identity === undefined ? undefined : toStamp(identity);
+      const identity2 = identities.get(providerId);
+      return identity2 === undefined ? undefined : toStamp(identity2);
     }
   };
 }
@@ -2980,7 +3240,7 @@ function createExecCredentialSource(options) {
   async function callHelper(providerId) {
     return applyOutcome(providerId, outcomeOf(await runHelper(options.command, providerId, timeoutMs)));
   }
-  async function read(providerId) {
+  async function read2(providerId) {
     if (declined.has(providerId))
       return;
     const lease = leases.get(providerId);
@@ -3002,7 +3262,7 @@ function createExecCredentialSource(options) {
     return new NaxError(`[credentials] Cannot ${operation} the credential for ${providerId}: the exec helper owns it.`, "CREDENTIAL_MANAGED_BY_HELPER", { stage: "credentials", providerId, operation });
   }
   return {
-    read,
+    read: read2,
     modify(providerId) {
       throw managedByHelper(providerId, "modify");
     },
@@ -3232,6 +3492,9 @@ async function importPiCredentials(options) {
 async function listStoredProviders() {
   return readStoredEntries();
 }
+async function loginProviderIds() {
+  return _authDeps.providerIds();
+}
 async function removeStoredProvider(providerId) {
   await naxCredentialStore().delete(providerId);
 }
@@ -3704,8 +3967,8 @@ function createMemoryTranscriptStore() {
 function transcriptModelIdentity(rawModel) {
   return rawModel === undefined ? undefined : parseModelSpec(rawModel).model;
 }
-function isForeignTranscript(doc, identity, sessionName) {
-  const { owner, model } = identity;
+function isForeignTranscript(doc, identity2, sessionName) {
+  const { owner, model } = identity2;
   if (owner !== undefined && doc.owner !== owner) {
     getLogger().debug("native-session", "Ignoring a transcript owned by another invocation", {
       sessionName,
@@ -3714,7 +3977,7 @@ function isForeignTranscript(doc, identity, sessionName) {
     });
     return true;
   }
-  if (model !== undefined && doc.model !== undefined && doc.model !== model) {
+  if (identity2.carryAcrossModels !== true && model !== undefined && doc.model !== undefined && doc.model !== model) {
     getLogger().debug("native-session", "Ignoring a transcript written by another model", {
       sessionName,
       storedModel: doc.model,
@@ -3724,7 +3987,7 @@ function isForeignTranscript(doc, identity, sessionName) {
   }
   return false;
 }
-function historyFromTranscript(doc, identity, sessionName) {
+function historyFromTranscript(doc, identity2, sessionName) {
   if (doc === null)
     return [];
   const version = doc.schemaVersion;
@@ -3734,14 +3997,14 @@ function historyFromTranscript(doc, identity, sessionName) {
   if (!Array.isArray(doc.messages)) {
     throw new NaxError(`transcript for session "${sessionName}" is unreadable: messages is not an array`, "TRANSCRIPT_CORRUPT", { stage: "native-session" });
   }
-  if (isForeignTranscript(doc, identity, sessionName))
+  if (isForeignTranscript(doc, identity2, sessionName))
     return [];
   return doc.messages;
 }
-function transcriptDocFor(messages, identity) {
+function transcriptDocFor(messages, identity2) {
   return {
-    ...identity.owner !== undefined ? { owner: identity.owner } : {},
-    ...identity.model !== undefined ? { model: identity.model } : {},
+    ...identity2.owner !== undefined ? { owner: identity2.owner } : {},
+    ...identity2.model !== undefined ? { model: identity2.model } : {},
     savedAt: new Date().toISOString(),
     messages: [...messages]
   };
@@ -3818,11 +4081,11 @@ function createFileTranscriptStore(dir) {
     }
   };
 }
-async function loadTranscript(dir, sessionName, identity = {}) {
-  return [...historyFromTranscript(await readTranscriptDoc(dir, sessionName), identity, sessionName)];
+async function loadTranscript(dir, sessionName, identity2 = {}) {
+  return [...historyFromTranscript(await readTranscriptDoc(dir, sessionName), identity2, sessionName)];
 }
-async function saveTranscript(dir, sessionName, messages, identity = {}) {
-  await writeTranscriptDoc(dir, sessionName, transcriptDocFor(messages, identity));
+async function saveTranscript(dir, sessionName, messages, identity2 = {}) {
+  await writeTranscriptDoc(dir, sessionName, transcriptDocFor(messages, identity2));
 }
 async function retainTranscript(dir, sessionName) {
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
@@ -4543,7 +4806,7 @@ async function openRepositoryInstructions(name, opts, store) {
   if (doc === null || doc.schemaVersion !== undefined && doc.schemaVersion !== 1 || !Array.isArray(doc.messages))
     return instructions;
   const ownerMatches = opts.transcriptOwner === undefined || doc?.owner === opts.transcriptOwner;
-  const modelMatches = doc?.model === undefined || doc.model === transcriptModelIdentity(opts.modelDef?.model);
+  const modelMatches = opts.carryHistoryAcrossModels === true || doc?.model === undefined || doc.model === transcriptModelIdentity(opts.modelDef?.model);
   if (ownerMatches && modelMatches) {
     const directories = doc?.instructionDirectories;
     if (Array.isArray(directories)) {
@@ -4596,6 +4859,7 @@ function createNativeSessionState() {
     streamHooks: new Map,
     failed: new Set,
     transcriptOwners: new Map,
+    carryHistoryAcrossModels: new Set,
     compaction: new Map,
     transportRetry: new Map,
     spinBreakers: new Map,
@@ -4666,6 +4930,10 @@ async function openNativeSession(state, name, opts) {
     state.transcriptOwners.set(name, opts.transcriptOwner);
   else
     state.transcriptOwners.delete(name);
+  if (opts.carryHistoryAcrossModels === true)
+    state.carryHistoryAcrossModels.add(name);
+  else
+    state.carryHistoryAcrossModels.delete(name);
   recordSystemPrompt(state, name, opts.systemPrompt);
   const instructions = await openRepositoryInstructions(name, opts, store);
   state.repositoryInstructions.set(name, instructions);
@@ -4702,6 +4970,7 @@ function clearNativeSessionState(state, sessionName) {
   state.timeouts.delete(sessionName);
   state.scratchpadRoots.delete(sessionName);
   state.transcriptOwners.delete(sessionName);
+  state.carryHistoryAcrossModels.delete(sessionName);
   state.streamHooks.delete(sessionName);
   state.failed.delete(sessionName);
   state.compaction.delete(sessionName);
@@ -5005,7 +5274,8 @@ function rewriteToolCallInput(messages, callId, input) {
       role: "assistant",
       content: lastAssistant.content,
       toolCalls,
-      ...lastAssistant.thinking !== undefined ? { thinking: lastAssistant.thinking } : {}
+      ...lastAssistant.thinking !== undefined ? { thinking: lastAssistant.thinking } : {},
+      ...lastAssistant.origin !== undefined ? { origin: lastAssistant.origin } : {}
     },
     ...messages.slice(lastAssistantIndex + 1)
   ];
@@ -24846,7 +25116,7 @@ function usageEvent(round, usage, costUsd) {
     costUsd
   };
 }
-function cappedInput(input) {
+function displayToolInput(input) {
   const redacted = redactSecrets(capStrings(input, REDACTION_SCAN_BYTES));
   let json2;
   try {
@@ -24858,7 +25128,7 @@ function cappedInput(input) {
     return redacted;
   return { truncated: true, preview: cutToByteCap(json2, TOOL_CALL_INPUT_BYTES) };
 }
-function previewOf(content) {
+function toolResultPreview(content) {
   return cutToByteCap(redactSecrets(cutToByteCap(content, REDACTION_SCAN_BYTES)), TOOL_RESULT_PREVIEW_BYTES);
 }
 function createTurnEventEmitter(sink) {
@@ -24890,7 +25160,7 @@ function createTurnEventEmitter(sink) {
     emit,
     deltaSink: (round) => (delta) => emit({ ...delta, round }),
     toolCall(call, recordedInput) {
-      const input = cappedInput(recordedInput ?? call.input);
+      const input = displayToolInput(recordedInput ?? call.input);
       outstanding.set(call.id, (outstanding.get(call.id) ?? 0) + 1);
       emit({ type: "tool_call", callId: call.id, name: call.name, input });
     },
@@ -24906,7 +25176,7 @@ function createTurnEventEmitter(sink) {
         type: "tool_result",
         callId: result.toolCallId,
         isError: result.isError === true,
-        preview: previewOf(result.content)
+        preview: toolResultPreview(result.content)
       });
     },
     flushUnanswered() {
@@ -25535,6 +25805,15 @@ async function maybeCompact(state, params) {
   }
   return { summarizeFailed: step.summarizeFailed };
 }
+function originOf(raw) {
+  if (raw === undefined)
+    return;
+  const spec = parseModelSpec(raw).model;
+  const slash = spec.indexOf("/");
+  if (slash <= 0 || slash === spec.length - 1)
+    return;
+  return { provider: spec.slice(0, slash), model: spec.slice(slash + 1) };
+}
 async function runModelRoundTrip(state, params, summarizeFailed) {
   const { handle, opts, deps, tools, loopEvents } = params;
   const step = await completeWithRecovery({
@@ -25590,11 +25869,13 @@ async function runModelRoundTrip(state, params, summarizeFailed) {
   state.output = assistantText;
   const assistantToolCalls = afterResponse.toolCalls ?? res.toolCalls;
   const assistantThinking = afterResponse.thinking ?? res.thinking;
+  const origin = originOf(handle.modelDef?.model);
   state.messages.push({
     role: "assistant",
     content: assistantText,
     ...assistantToolCalls !== undefined ? { toolCalls: assistantToolCalls } : {},
-    ...assistantThinking !== undefined ? { thinking: assistantThinking } : {}
+    ...assistantThinking !== undefined ? { thinking: assistantThinking } : {},
+    ...origin !== undefined ? { origin } : {}
   });
   if (assistantToolCalls === undefined || assistantToolCalls.length === 0) {
     state.completedNormally = true;
@@ -25683,6 +25964,7 @@ var MAX_FOLLOW_UPS_PER_TURN = 3;
 var init_turn_loop_round_trip = __esm(() => {
   init_core();
   init_infra();
+  init_models();
   init_turn_accumulator();
   init_turn_compaction_step();
   init_turn_complete_step();
@@ -25772,7 +26054,8 @@ async function runNativeTurn(handle, prompt, opts, deps) {
   const { store } = transcript;
   const transcriptIdentity = {
     owner: deps.sessionState.transcriptOwners.get(handle.id),
-    model: transcriptModelIdentity(handle.modelDef?.model)
+    model: transcriptModelIdentity(handle.modelDef?.model),
+    ...deps.sessionState.carryHistoryAcrossModels.has(handle.id) ? { carryAcrossModels: true } : {}
   };
   let messages = [
     ...historyFromTranscript(await store.load(handle.id), transcriptIdentity, handle.id)
@@ -26409,7 +26692,8 @@ var init_native_backend_options = __esm(() => {
       commandInterceptor: exports_external.custom(hasMethods2(["intercept"]), "must implement intercept").optional()
     }).optional(),
     bashApproval: exports_external.enum(["raw", "gated", "escalate"]).optional(),
-    allowUnsandboxed: exports_external.boolean().optional()
+    allowUnsandboxed: exports_external.boolean().optional(),
+    carryHistoryAcrossModels: exports_external.boolean().optional()
   });
 });
 
@@ -26754,6 +27038,7 @@ var init_src = __esm(() => {
   init_stderr_tail();
   init_redact();
   init_nax_error();
+  init_terminal_auth();
   init_native();
   init_turn_event_emitter();
   init_permissions();
@@ -29379,7 +29664,9 @@ __export(exports_internal, {
   NATIVE_AGENT_NAME: () => NATIVE_AGENT_NAME,
   NativeSessionUnsupportedError: () => NativeSessionUnsupportedError,
   NaxError: () => NaxError,
+  PLAIN_STYLE: () => PLAIN_STYLE,
   PROVIDER_ID_RE: () => PROVIDER_ID_RE,
+  PromptCancelledError: () => PromptCancelledError,
   READ_CEILING: () => READ_CEILING,
   RESERVED_TOOL_NAMES: () => RESERVED_TOOL_NAMES,
   SANDBOX_GLOB_CHARS: () => SANDBOX_GLOB_CHARS,
@@ -29411,6 +29698,7 @@ __export(exports_internal, {
   _grepDeps: () => _grepDeps,
   _instructionAccessDeps: () => _instructionAccessDeps,
   _launcherDeps: () => _launcherDeps,
+  _openUrlDeps: () => _openUrlDeps,
   _policyInputDeps: () => _policyInputDeps,
   _probeDeps: () => _probeDeps,
   _repositoryInstructionDeps: () => _repositoryInstructionDeps,
@@ -29428,6 +29716,7 @@ __export(exports_internal, {
   _spillDeps: () => _spillDeps,
   _srtBackendDeps: () => _srtBackendDeps,
   _systemOneClientDeps: () => _systemOneClientDeps,
+  _terminalPromptDeps: () => _terminalPromptDeps,
   abortableSleep: () => abortableSleep,
   adaptProviderTool: () => adaptProviderTool,
   advertisedSchemaBytes: () => advertisedSchemaBytes,
@@ -29488,6 +29777,7 @@ __export(exports_internal, {
   createRunCommandTool: () => createRunCommandTool,
   createSpinBreaker: () => createSpinBreaker,
   createSrtBackend: () => createSrtBackend,
+  createTerminalAuthInteraction: () => createTerminalAuthInteraction,
   createToolAuditSink: () => createToolAuditSink,
   createTurnAccumulator: () => createTurnAccumulator,
   credentialFaultCode: () => credentialFaultCode,
@@ -29553,6 +29843,7 @@ __export(exports_internal, {
   listNaxEntries: () => listNaxEntries,
   listStoredProviders: () => listStoredProviders,
   loadTranscript: () => loadTranscript,
+  loginProviderIds: () => loginProviderIds,
   markNativeTurnOutcome: () => markNativeTurnOutcome,
   maskForPrompt: () => maskForPrompt,
   mcpRuleAdmits: () => mcpRuleAdmits,
@@ -29566,6 +29857,7 @@ __export(exports_internal, {
   normalizeExec: () => normalizeExec,
   normalizeManagerBinary: () => normalizeManagerBinary,
   openNativeSession: () => openNativeSession,
+  openUrl: () => openUrl,
   parseGitlinks: () => parseGitlinks,
   parseModelSpec: () => parseModelSpec,
   parseNativeModel: () => parseNativeModel,
@@ -29578,6 +29870,9 @@ __export(exports_internal, {
   prepareCompaction: () => prepareCompaction,
   probeSandbox: () => probeSandbox,
   probeSandboxOnce: () => probeSandboxOnce,
+  promptForLine: () => promptForLine,
+  promptForSecret: () => promptForSecret,
+  promptForSelect: () => promptForSelect,
   providerAttachesTo: () => providerAttachesTo,
   providersWithoutCredentials: () => providersWithoutCredentials,
   pruneRetainedTranscripts: () => pruneRetainedTranscripts,
@@ -29643,6 +29938,7 @@ __export(exports_internal, {
   setAgentLogger: () => setAgentLogger,
   shellQuoteArg: () => shellQuoteArg,
   shouldCompact: () => shouldCompact,
+  spawnDetached: () => spawnDetached,
   spillRelativePath: () => spillRelativePath,
   spinTerminalNotice: () => spinTerminalNotice,
   strayCommonDirTripwire: () => strayCommonDirTripwire,
@@ -29741,6 +30037,7 @@ var init_internal = __esm(() => {
   init_permissions();
   init_sandbox();
   init_agent_session_deps();
+  init_terminal_auth();
   init_credential_read_deny();
   init_git();
   init_git_commit();
@@ -30395,9 +30692,9 @@ ${c.gray(JSON.stringify(filtered, null, 2))}`;
 }
 function buildDefaultMeta(data, mode, level) {
   const meta3 = [];
-  const identity = [data.agentName, data.model].filter((v) => typeof v === "string" && v.length > 0);
-  if (identity.length > 0)
-    meta3.push(`${EMOJI.agent} ${identity.join("\xB7")}`);
+  const identity2 = [data.agentName, data.model].filter((v) => typeof v === "string" && v.length > 0);
+  if (identity2.length > 0)
+    meta3.push(`${EMOJI.agent} ${identity2.join("\xB7")}`);
   if (typeof data.phaseIndex === "number" && typeof data.totalPhases === "number") {
     meta3.push(`${data.phaseIndex}/${data.totalPhases}`);
   }
@@ -36315,9 +36612,9 @@ function extractSpecStructure(specContent) {
   const stories = [];
   const warnings = [];
   for (const declarations of collectStoryDeclarations(specContent)) {
-    const read = readDeclarations(declarations);
-    stories.push(read.story);
-    warnings.push(...read.warnings);
+    const read2 = readDeclarations(declarations);
+    stories.push(read2.story);
+    warnings.push(...read2.warnings);
   }
   return { stories, warnings };
 }
@@ -38554,7 +38851,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.83.7",
+    version: "0.84.0",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -38566,7 +38863,7 @@ var init_package = __esm(() => {
       typecheck: "bun x tsc --noEmit && bun x tsc --noEmit -p tsconfig.test.json",
       lint: "bun run lint:biome && bun run lint:checks",
       "lint:biome": "bun scripts/quiet-run.ts bun x biome check --error-on-warnings --diagnostic-level=warn src/ bin/ test/ scripts/",
-      "lint:checks": "bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:import-cycles && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:complexity && bun run check:no-control-bytes && bun run check:review-prompts && bun run check:nax-ai-imports && bun run check:sandbox-imports && bun run check:git-spawn-env && bun run check:bundle-externals && bun run check:op-tool-capability && bun run check:nax-artifacts-untracked && bun run check:story-workdir-access && bun run check:package-frame-derivation && bun run check:config-profile-threading && bun run check:dispatch-field-forwarding && bun run check:bash-dispatch-ask && bun run check:test-satellites && bun run check:nax-ai-pin && bun run check:package-boundaries && bun run check:usage-vocabulary",
+      "lint:checks": "bun run check:no-real-global-nax && bun run check:feature-dir-ssot && bun run check:alias-internals && bun run check:import-cycles && bun run check:nax-error && bun run check:logger-storyid && bun run check:log-format-layering && bun run check:file-sizes && bun run check:complexity && bun run check:no-control-bytes && bun run check:review-prompts && bun run check:nax-ai-imports && bun run check:sandbox-imports && bun run check:git-spawn-env && bun run check:bundle-externals && bun run check:op-tool-capability && bun run check:nax-artifacts-untracked && bun run check:story-workdir-access && bun run check:package-frame-derivation && bun run check:config-profile-threading && bun run check:dispatch-field-forwarding && bun run check:bash-dispatch-ask && bun run check:test-satellites && bun run check:lockstep && bun run check:package-boundaries && bun run check:usage-vocabulary",
       "lint:json": "bun x biome check --error-on-warnings src/ bin/ test/ scripts/ --reporter json && bun run check:nax-error 1>&2 && bun run check:logger-storyid 1>&2",
       "lint:fix": "bun x biome check --write src/ bin/ test/ scripts/",
       "check:no-real-global-nax": "bun run ../repo-tooling/scripts/check-no-real-global-nax.ts",
@@ -38588,7 +38885,7 @@ var init_package = __esm(() => {
       "check:no-control-bytes": "bun run ../repo-tooling/scripts/check-no-control-bytes.ts",
       "check:review-prompts": "bun run scripts/check-review-prompts-generated.ts",
       "check:nax-ai-imports": "bun run ../repo-tooling/scripts/check-nax-ai-imports.ts",
-      "check:nax-ai-pin": "bun run scripts/check-nax-ai-pin.ts",
+      "check:lockstep": "bun run ../repo-tooling/scripts/check-lockstep.ts",
       "check:sandbox-imports": "bun run ../repo-tooling/scripts/check-sandbox-imports.ts",
       "check:git-spawn-env": "bun run ../repo-tooling/scripts/check-git-spawn-env.ts",
       "check:bundle-externals": "bun run scripts/check-bundle-externals.ts",
@@ -38602,7 +38899,6 @@ var init_package = __esm(() => {
       "check:bash-dispatch-ask": "bun run scripts/check-bash-dispatch-ask.ts",
       "check:rules-drift": "bun scripts/quiet-run.ts bun run scripts/check-rules-drift.ts",
       "gen:review-prompts": "bun run scripts/generate-review-prompts.ts",
-      release: "bun scripts/release.ts",
       test: "AGENT=1 bun run scripts/run-tests.ts",
       "test:verbose": "bun run scripts/run-tests.ts",
       "test:bail": "AGENT=1 bun run scripts/run-tests.ts --bail",
@@ -38642,7 +38938,7 @@ var init_package = __esm(() => {
       "@agentclientprotocol/sdk": "~1.7.0",
       "@anthropic-ai/sandbox-runtime": "0.0.77",
       "@modelcontextprotocol/sdk": "^1.30.0",
-      "@nathapp/nax-ai": "0.1.16",
+      "@nathapp/nax-ai": "0.84.0",
       chalk: "^5.6.2",
       commander: "^13.1.0",
       ink: "^6.7.0",
@@ -38872,9 +39168,9 @@ function cancellableDelay(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
-var spawn;
+var spawn2;
 var init_bun_deps = __esm(() => {
-  spawn = Bun.spawn;
+  spawn2 = Bun.spawn;
 });
 
 // src/agents/retry/failure-policy.ts
@@ -42479,7 +42775,7 @@ var init_nax_owned_paths = __esm(() => {
 });
 
 // src/review/diff-utils.ts
-var {spawn: spawn2 } = globalThis.Bun;
+var {spawn: spawn3 } = globalThis.Bun;
 async function resolveNaxIgnorePathspecExcludes(workdir, options) {
   if (options?.naxIgnoreIndex)
     return options.naxIgnoreIndex.toPathspecExcludes(options.packageDir);
@@ -42632,7 +42928,7 @@ var init_diff_utils = __esm(() => {
   init_path_filters();
   ALWAYS_EXCLUDED = [...NAX_OWNED_REVIEW_EXCLUDE_PATHSPECS];
   _diffUtilsDeps = {
-    spawn: spawn2,
+    spawn: spawn3,
     isGitRefValid,
     getMergeBase,
     timeoutMs: GIT_TIMEOUT_MS
@@ -56645,7 +56941,7 @@ function stripCarriageReturn(line) {
   return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
 var CONSEQUENCE = "? nax will run this project's plugins, hooks, MCP servers and test commands.", _trustPromptDeps;
-var init_prompt = __esm(() => {
+var init_prompt2 = __esm(() => {
   _trustPromptDeps = {
     ask: async (question) => {
       process.stderr.write(question);
@@ -56750,11 +57046,11 @@ async function removeFromStore(storePath, normalized) {
   return { outcome: "removed", entry };
 }
 async function readFoldersForWrite(storePath) {
-  const read = await readTrustStore();
-  if (read.state === "unparseable") {
-    throw trustStoreUnreadableError(storePath, read.reason);
+  const read2 = await readTrustStore();
+  if (read2.state === "unparseable") {
+    throw trustStoreUnreadableError(storePath, read2.reason);
   }
-  return read.state === "ok" ? read.file.folders : [];
+  return read2.state === "ok" ? read2.file.folders : [];
 }
 async function writeTrustStore(storePath, file2) {
   const tempPath = `${storePath}.${process.pid}.${randomUUID13()}.tmp`;
@@ -56833,7 +57129,7 @@ var _trustGateDeps;
 var init_gate = __esm(() => {
   init_errors4();
   init_match();
-  init_prompt();
+  init_prompt2();
   init_registry4();
   init_store2();
   _trustGateDeps = {
@@ -56846,7 +57142,7 @@ var init_gate = __esm(() => {
 var init_trust = __esm(() => {
   init_gate();
   init_match();
-  init_prompt();
+  init_prompt2();
   init_registry4();
   init_store2();
 });
@@ -57057,8 +57353,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("cfab34e07"))
-        return "cfab34e07";
+      if (/^[0-9a-f]{6,10}$/.test("eeb09eb"))
+        return "eeb09eb";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -58265,9 +58561,9 @@ async function readProjectIdentity(projectKey) {
     return null;
   }
 }
-async function writeProjectIdentity(projectKey, identity) {
+async function writeProjectIdentity(projectKey, identity2) {
   const p = identityPath(projectKey);
-  await Bun.write(p, JSON.stringify(identity, null, 2));
+  await Bun.write(p, JSON.stringify(identity2, null, 2));
 }
 async function claimProjectIdentity(projectKey, workdir, remoteUrl) {
   const existing2 = await readProjectIdentity(projectKey);
@@ -68835,7 +69131,7 @@ var require_cross_spawn = __commonJS(function(exports, module) {
   var cp = __require("child_process");
   var parse6 = require_parse();
   var enoent = require_enoent();
-  function spawn3(command, args, options) {
+  function spawn4(command, args, options) {
     const parsed = parse6(command, args, options);
     const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
     enoent.hookChildProcess(spawned, parsed);
@@ -68847,8 +69143,8 @@ var require_cross_spawn = __commonJS(function(exports, module) {
     result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
     return result;
   }
-  module.exports = spawn3;
-  module.exports.spawn = spawn3;
+  module.exports = spawn4;
+  module.exports.spawn = spawn4;
   module.exports.sync = spawnSync;
   module.exports._parse = parse6;
   module.exports._enoent = enoent;
@@ -69349,9 +69645,9 @@ function createMcpProviders(args) {
     return [];
   for (const [id] of servers)
     validateProviderId(id);
-  const read = args.readLock ?? readMcpLock;
+  const read2 = args.readLock ?? readMcpLock;
   let lockPromise;
-  const lock = () => lockPromise ??= read(args.projectRoot);
+  const lock = () => lockPromise ??= read2(args.projectRoot);
   return servers.map(([serverId, server]) => {
     return {
       id: serverId,
@@ -69597,7 +69893,7 @@ var init_executor = __esm(() => {
   init_bun_deps();
   init_trust();
   init_internal();
-  _executorDeps = { spawn };
+  _executorDeps = { spawn: spawn2 };
   DRAIN_TIMEOUT3 = Symbol("drain-timeout");
   DEFAULT_STRIP_ENV_VARS = [];
 });
@@ -70663,7 +70959,7 @@ ${r.output}`).join(""),
 }
 
 // src/quality/runner.ts
-var {spawn: spawn4 } = globalThis.Bun;
+var {spawn: spawn5 } = globalThis.Bun;
 function createDrainDeadline(deadlineMs) {
   let timeoutId;
   const promise3 = new Promise((resolve31) => {
@@ -70837,7 +71133,7 @@ var init_runner = __esm(() => {
   init_trust();
   init_executor();
   _qualityRunnerDeps = {
-    spawn: spawn4
+    spawn: spawn5
   };
 });
 
@@ -77645,7 +77941,7 @@ ${detail}`,
 `);
 }
 var CLASSIFIER;
-var init_prompt2 = __esm(() => {
+var init_prompt3 = __esm(() => {
   CLASSIFIER = [
     "Mark a finding for human judgment \u2014 and only such a finding \u2014 by adding a",
     "`Judgment: yes \u2014 <why>` line to its block. Use it when the finding is a spec",
@@ -77660,7 +77956,7 @@ var init_prompt2 = __esm(() => {
 var init_review = __esm(() => {
   init_audit_gaps();
   init_parse6();
-  init_prompt2();
+  init_prompt3();
 });
 
 // src/operations/finish-fix.ts
@@ -78351,7 +78647,7 @@ var init_new_package_setup = __esm(() => {
   init_trust();
   init_command_argv();
   registry4 = new WeakMap;
-  _newPackageSetupDeps = { spawn };
+  _newPackageSetupDeps = { spawn: spawn2 };
 });
 
 // src/operations/gate-cwd.ts
@@ -78792,7 +79088,7 @@ var init_isolation2 = __esm(() => {
   init_errors4();
   init_logger2();
   init_test_runners();
-  _isolationDeps = { spawn, timeoutMs: GIT_TIMEOUT_MS3 };
+  _isolationDeps = { spawn: spawn2, timeoutMs: GIT_TIMEOUT_MS3 };
   SRC_PATTERNS = [/^src\//, /^lib\//, /^packages\//];
 });
 
@@ -88013,7 +88309,7 @@ function contentText(content) {
   return content.map(contentPart).filter((part) => part !== "").join(`
 `);
 }
-function previewOf2(call2, secrets) {
+function previewOf(call2, secrets) {
   const fromContent = contentText(call2.content);
   let raw = fromContent;
   if (raw === "" && typeof call2.rawOutput === "string")
@@ -88088,7 +88384,7 @@ function createToolEvents(emit, secrets, now = Date.now) {
         running.add(state.id);
       const shown2 = announce(state);
       if (status !== "in_progress")
-        resolve35(shown2, status === "failed", previewOf2(shown2, secrets), resultBytesOf(shown2));
+        resolve35(shown2, status === "failed", previewOf(shown2, secrets), resultBytesOf(shown2));
     },
     announce(toolCall) {
       const state = merge2(toolCall);
@@ -88503,7 +88799,7 @@ function race(promise3, opts) {
 }
 
 // ../nax-agent-acp/src/client/launch.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 import { accessSync as accessSync3, constants as constants3, statSync as statSync8 } from "fs";
 import { delimiter as delimiter2, isAbsolute as isAbsolute25, join as join73 } from "path";
 import { Readable as Readable2, Writable } from "stream";
@@ -88548,7 +88844,7 @@ function failedLaunch(stderr, error48) {
 }
 function trySpawn(request) {
   try {
-    return spawn5(request.command, [...request.args], {
+    return spawn6(request.command, [...request.args], {
       cwd: request.cwd,
       env: { ...request.env },
       stdio: "pipe",
@@ -92413,7 +92709,7 @@ var init_turn_interactions = __esm(() => {
 });
 
 // src/agents/interaction/index.ts
-var init_interaction = __esm(() => {
+var init_interaction2 = __esm(() => {
   init_output_parsing();
   init_turn_interactions();
 });
@@ -92470,7 +92766,7 @@ function createAskPort(slot, beatMs = AWAITING_HUMAN_BEAT_MS, audit) {
 var STAGE = "acp", AWAITING_HUMAN_BEAT_MS = 30000;
 var init_ask_port = __esm(() => {
   init_logger2();
-  init_interaction();
+  init_interaction2();
 });
 
 // src/agents/acp/profile-map.ts
@@ -93208,7 +93504,7 @@ var init_turn_loop2 = __esm(() => {
   init_src();
   init_errors4();
   init_logger2();
-  init_interaction();
+  init_interaction2();
   init_turn();
   init_failure_map();
   init_pricing();
@@ -94359,17 +94655,17 @@ function formatEntryBlock(entry2) {
   const commandLines = lines2.map((line, index) => index === 0 ? `${ENTRY_INDENT}$ ${line}` : `${COMMAND_CONTINUATION_INDENT}${line}`);
   return [header, rootLine, ...commandLines];
 }
-function toListJson(path10, read) {
-  const taint = read.file.taint === undefined ? null : read.file.taint;
-  const entries = read.file.entries.map((entry2) => ({
+function toListJson(path10, read2) {
+  const taint = read2.file.taint === undefined ? null : read2.file.taint;
+  const entries = read2.file.entries.map((entry2) => ({
     ...entry2,
     id: approvalId(entry2)
   }));
   return {
     path: path10,
-    state: read.state,
+    state: read2.state,
     taint,
-    droppedMalformed: read.droppedMalformed,
+    droppedMalformed: read2.droppedMalformed,
     entries
   };
 }
@@ -94413,12 +94709,12 @@ async function promptForConfirmation(question) {
       resolve36(answer);
     };
     const onData = (char) => {
-      if (char === ETX) {
+      if (char === ETX2) {
         finish(false);
         _confirmDeps.exit(SIGINT_EXIT_CODE);
         return;
       }
-      if (char === EOT) {
+      if (char === EOT2) {
         finish(false);
         return;
       }
@@ -94430,7 +94726,7 @@ async function promptForConfirmation(question) {
     stdin.once("error", onClosed);
   });
 }
-var ETX = "\x03", EOT = "\x04", SIGINT_EXIT_CODE = 130, _confirmDeps;
+var ETX2 = "\x03", EOT2 = "\x04", SIGINT_EXIT_CODE = 130, _confirmDeps;
 var init_confirm = __esm(() => {
   init_source();
   _confirmDeps = {
@@ -94451,26 +94747,26 @@ async function resolveApprovalsFile(workdir) {
 async function approvalsListCommand(opts, deps = _approvalsCliDeps) {
   try {
     const path10 = await resolveApprovalsFile(opts.workdir);
-    const read = await deps.readApprovalsFileDetailed(path10);
+    const read2 = await deps.readApprovalsFileDetailed(path10);
     if (opts.json) {
-      deps.log(JSON.stringify(toListJson(path10, read)));
-      if (read.state === "unparseable")
+      deps.log(JSON.stringify(toListJson(path10, read2)));
+      if (read2.state === "unparseable")
         deps.logErr(PARSE_WARNING);
       return 0;
     }
-    if (read.state === "missing") {
+    if (read2.state === "missing") {
       deps.log(missingNotice(path10));
       return 0;
     }
-    if (read.state === "unparseable") {
+    if (read2.state === "unparseable") {
       deps.logErr(PARSE_WARNING);
       deps.log(missingNotice(path10));
       return 0;
     }
-    const entries = read.file.entries;
-    const taint = read.file.taint;
-    if (read.droppedMalformed > 0)
-      deps.logErr(malformedEntriesWarning(read.droppedMalformed));
+    const entries = read2.file.entries;
+    const taint = read2.file.taint;
+    if (read2.droppedMalformed > 0)
+      deps.logErr(malformedEntriesWarning(read2.droppedMalformed));
     deps.log(`Approvals store: ${path10}`);
     deps.log(formatTrustLine(taint, deps.isProcessAlive));
     deps.log(`${entries.length} remembered approvals`);
@@ -94492,12 +94788,12 @@ async function runPrecheck(opts, deps) {
   try {
     const path10 = await resolveApprovalsFile(opts.workdir);
     if (opts.all) {
-      const read = await deps.readApprovalsFileDetailed(path10);
-      if (read.state === "missing" || read.state === "ok" && read.file.entries.length === 0) {
+      const read2 = await deps.readApprovalsFileDetailed(path10);
+      if (read2.state === "missing" || read2.state === "ok" && read2.file.entries.length === 0) {
         deps.log(missingNotice(path10));
         return { kind: "empty", path: path10 };
       }
-      if (read.state === "unparseable") {
+      if (read2.state === "unparseable") {
         deps.logErr("approvals.json could not be parsed; not rewriting it");
         return { kind: "unparseable", path: path10 };
       }
@@ -94792,227 +95088,9 @@ var init_auth_list = __esm(() => {
   init_config();
 });
 
-// src/cli/auth-prompt.ts
-function read(message, echo, onEmptySubmit) {
-  const { stdin } = _authPromptDeps;
-  if (stdin.isTTY !== true)
-    return Promise.reject(new PromptCancelledError);
-  _authPromptDeps.write(`${source_default.cyan("?")} ${message} `);
-  return new Promise((resolve36, reject) => {
-    let buffer = "";
-    let settled2 = false;
-    const cleanup = () => {
-      if (settled2)
-        return;
-      settled2 = true;
-      stdin.removeListener("data", onData);
-      stdin.removeListener("end", onEnd);
-      stdin.removeListener("error", onEnd);
-      stdin.setRawMode(false);
-      stdin.pause();
-      _authPromptDeps.write(`
-`);
-    };
-    const onEnd = () => {
-      cleanup();
-      reject(new PromptCancelledError);
-    };
-    const onData = (chunk) => {
-      for (const char of chunk) {
-        if (char === ETX2 || char === EOT2) {
-          cleanup();
-          reject(new PromptCancelledError);
-          return;
-        }
-        if (char === CR || char === LF) {
-          if (buffer.length === 0 && onEmptySubmit !== undefined) {
-            onEmptySubmit();
-            continue;
-          }
-          cleanup();
-          resolve36(buffer);
-          return;
-        }
-        if (char === BACKSPACE) {
-          buffer = buffer.slice(0, -1);
-          if (echo)
-            _authPromptDeps.write("\b \b");
-          continue;
-        }
-        buffer += char;
-        if (echo)
-          _authPromptDeps.write(char);
-      }
-    };
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding("utf8");
-    stdin.on("data", onData);
-    stdin.once("end", onEnd);
-    stdin.once("error", onEnd);
-  });
-}
-function promptForSecret(message) {
-  return read(message, false);
-}
-function promptForLine(message, onEmptySubmit) {
-  return read(message, true, onEmptySubmit);
-}
-function promptForSelect(message, choices) {
-  const { stdin } = _authPromptDeps;
-  if (stdin.isTTY !== true)
-    return Promise.reject(new PromptCancelledError);
-  if (choices.length === 0)
-    return Promise.reject(new PromptCancelledError);
-  _authPromptDeps.write(`${source_default.cyan("?")} ${message}
-`);
-  return new Promise((resolve36, reject) => {
-    let index = 0;
-    let settled2 = false;
-    let drawn = false;
-    const render3 = () => {
-      if (drawn)
-        _authPromptDeps.write(`\x1B[${choices.length}A`);
-      drawn = true;
-      for (const [i, choice] of choices.entries()) {
-        const active = i === index;
-        const marker = active ? source_default.cyan(">") : " ";
-        const label2 = active ? source_default.cyan(choice.label) : choice.label;
-        _authPromptDeps.write(`\r\x1B[2K${marker} ${label2}
-`);
-      }
-    };
-    const cleanup = () => {
-      if (settled2)
-        return;
-      settled2 = true;
-      stdin.removeListener("data", onData);
-      stdin.removeListener("end", onEnd);
-      stdin.removeListener("error", onEnd);
-      stdin.setRawMode(false);
-      stdin.pause();
-    };
-    const onEnd = () => {
-      cleanup();
-      reject(new PromptCancelledError);
-    };
-    const onData = (chunk) => {
-      if (chunk.includes(ETX2) || chunk.includes(EOT2)) {
-        cleanup();
-        reject(new PromptCancelledError);
-        return;
-      }
-      if (chunk.includes(ARROW_UP)) {
-        index = (index - 1 + choices.length) % choices.length;
-        render3();
-        return;
-      }
-      if (chunk.includes(ARROW_DOWN)) {
-        index = (index + 1) % choices.length;
-        render3();
-        return;
-      }
-      if (chunk.includes(CR) || chunk.includes(LF)) {
-        const chosen = choices[index];
-        cleanup();
-        resolve36(chosen.id);
-      }
-    };
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding("utf8");
-    stdin.on("data", onData);
-    stdin.once("end", onEnd);
-    stdin.once("error", onEnd);
-    render3();
-  });
-}
-var ETX2 = "\x03", EOT2 = "\x04", CR = "\r", LF = `
-`, BACKSPACE = "\x7F", ARROW_UP = "\x1B[A", ARROW_DOWN = "\x1B[B", PromptCancelledError, _authPromptDeps;
-var init_auth_prompt = __esm(() => {
-  init_source();
-  PromptCancelledError = class PromptCancelledError extends Error {
-    constructor() {
-      super("Prompt cancelled");
-      this.name = "PromptCancelledError";
-    }
-  };
-  _authPromptDeps = {
-    stdin: process.stdin,
-    write: (text) => process.stdout.write(text)
-  };
-});
-
-// src/cli/open-url.ts
-function openerFor(platform, url2) {
-  if (platform === "darwin")
-    return ["open", url2];
-  if (platform === "win32")
-    return ["cmd", "/c", "start", "", url2];
-  return ["xdg-open", url2];
-}
-function openUrl(url2) {
-  try {
-    _openUrlDeps.spawn(openerFor(_openUrlDeps.platform(), url2));
-  } catch {}
-}
-var _openUrlDeps;
-var init_open_url = __esm(() => {
-  _openUrlDeps = {
-    spawn: (command2) => {
-      Bun.spawn([...command2], { stdin: "ignore", stdout: "ignore", stderr: "ignore" });
-    },
-    platform: () => process.platform
-  };
-});
-
 // src/cli/auth.ts
 function terminalInteraction() {
-  let pendingUrl;
-  return {
-    prompt: async (prompt) => {
-      if (prompt.type === "manual-code") {
-        const url2 = pendingUrl;
-        if (url2 === undefined)
-          return promptForLine(prompt.message);
-        pendingUrl = undefined;
-        _cliAuthDeps.log(source_default.dim("Press Enter to open it in your browser."));
-        return promptForLine(prompt.message, () => {
-          _cliAuthDeps.log(source_default.dim("Opening your browser..."));
-          openUrl(url2);
-        });
-      }
-      if (prompt.type === "text")
-        return promptForLine(prompt.message);
-      if (prompt.type === "select") {
-        return promptForSelect(prompt.message, prompt.options.map((option) => ({ id: option.id, label: option.label })));
-      }
-      return promptForSecret(prompt.message);
-    },
-    notify: (event) => {
-      switch (event.type) {
-        case "auth-url":
-          _cliAuthDeps.log(`
-${source_default.bold("Open this URL to continue:")}
-  ${event.url}`);
-          pendingUrl = event.url;
-          return;
-        case "device-code":
-          _cliAuthDeps.log(`
-Go to ${event.verificationUri} and enter code ${source_default.bold(event.userCode)}`);
-          return;
-        case "info":
-          _cliAuthDeps.log(event.message);
-          for (const link2 of event.links ?? [])
-            _cliAuthDeps.log(`  ${link2.label ?? "Link"}: ${link2.url}`);
-          return;
-        case "progress":
-          _cliAuthDeps.log(source_default.dim(event.message));
-          return;
-        default:
-      }
-    }
-  };
+  return createTerminalAuthInteraction({ log: (text) => _cliAuthDeps.log(text), style: CHALK_STYLE });
 }
 async function authLoginCommand(providerId, method) {
   if (!_cliAuthDeps.isTTY()) {
@@ -95109,19 +95187,18 @@ async function authRmCommand(providerId) {
     return 1;
   }
 }
-var _cliAuthDeps;
+var _cliAuthDeps, CHALK_STYLE;
 var init_auth3 = __esm(() => {
   init_src();
   init_source();
   init_config();
   init_auth_list();
-  init_auth_prompt();
-  init_open_url();
   _cliAuthDeps = {
     log: (text) => console.log(text),
     isTTY: () => process.stdin.isTTY === true,
     collectAuthList
   };
+  CHALK_STYLE = { accent: source_default.cyan, dim: source_default.dim, bold: source_default.bold };
 });
 
 // src/cli/config-diff.ts
@@ -98041,7 +98118,7 @@ var init_triggers = __esm(() => {
 });
 
 // src/interaction/index.ts
-var init_interaction2 = __esm(() => {
+var init_interaction3 = __esm(() => {
   init_ask_link();
   init_bridge_builder();
   init_chain();
@@ -98117,7 +98194,7 @@ var _configJsonDeps;
 var init_config_json = __esm(() => {
   init_internal();
   init_config();
-  init_interaction2();
+  init_interaction3();
   init_config_display();
   init_config_profile();
   init_config_requirements();
@@ -100905,19 +100982,19 @@ function validateProjectName(name) {
   return { valid: true };
 }
 async function checkInitCollision(name, currentWorkdir, currentRemote) {
-  const identity = await readProjectIdentity(name);
-  if (!identity)
+  const identity2 = await readProjectIdentity(name);
+  if (!identity2)
     return { collision: false };
-  const sameRemote = isSameProject(currentRemote, identity.remoteUrl);
-  const sameWorkdir = !currentRemote && !identity.remoteUrl && currentWorkdir === identity.workdir;
+  const sameRemote = isSameProject(currentRemote, identity2.remoteUrl);
+  const sameWorkdir = !currentRemote && !identity2.remoteUrl && currentWorkdir === identity2.workdir;
   if (sameRemote || sameWorkdir)
     return { collision: false };
   return {
     collision: true,
     existing: {
-      workdir: identity.workdir,
-      remoteUrl: identity.remoteUrl,
-      lastSeen: identity.lastSeen
+      workdir: identity2.workdir,
+      remoteUrl: identity2.remoteUrl,
+      lastSeen: identity2.lastSeen
     }
   };
 }
@@ -101432,7 +101509,7 @@ var init_checks_cli = __esm(() => {
   init_bun_deps();
   init_agents();
   _checkCliDeps = {
-    spawn
+    spawn: spawn2
   };
 });
 
@@ -103111,7 +103188,7 @@ var init_cleanup = __esm(() => {
   init_bun_deps();
   init_logger2();
   _cleanupDeps = {
-    spawn,
+    spawn: spawn2,
     sleep,
     kill: process.kill.bind(process),
     killProcessGroupFn: (pid, signal) => killProcessGroup(pid, signal)
@@ -108886,7 +108963,7 @@ var init_completion = __esm(() => {
   init_engine();
   init_fragments();
   init_execution2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_metrics();
   init_prd();
@@ -109497,12 +109574,12 @@ var init_execution = __esm(() => {
   init_engine();
   init_errors4();
   init_execution2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_git2();
   init_path_frame();
   init_scope_files();
-  init_interaction2();
+  init_interaction3();
   init_execution_helpers();
   init_execution_helpers();
   RUNTIME_CRASH_CODES = new Set(["CALL_OP_NO_OUTPUT", "CALL_OP_MAX_RETRIES"]);
@@ -109699,7 +109776,7 @@ var init_optimizer2 = __esm(() => {
 
 // src/pipeline/stages/prompt.ts
 var _promptStageDeps, promptStage;
-var init_prompt3 = __esm(() => {
+var init_prompt4 = __esm(() => {
   init_acceptance2();
   init_engine();
   init_logger2();
@@ -110057,7 +110134,7 @@ var init_stages = __esm(() => {
   init_context3();
   init_execution();
   init_optimizer2();
-  init_prompt3();
+  init_prompt4();
   init_queue_check();
   init_routing2();
   init_acceptance3();
@@ -110067,7 +110144,7 @@ var init_stages = __esm(() => {
   init_context3();
   init_execution();
   init_optimizer2();
-  init_prompt3();
+  init_prompt4();
   init_queue_check();
   init_routing2();
   defaultPipeline = new Proxy([], {
@@ -110694,7 +110771,7 @@ var init_pipeline_result_handler = __esm(() => {
   init_escalation();
   init_progress();
   _resultHandlerDeps = {
-    spawn,
+    spawn: spawn2,
     existsSync: existsSync25,
     worktreeManager: new WorktreeManager,
     mergeEngine: new MergeEngine(new WorktreeManager),
@@ -111445,7 +111522,7 @@ async function openAcceptanceFixScope(ctx, runtime2, storyId, packageDir) {
 }
 var _acceptanceFixScopeDeps;
 var init_acceptance_fix_scope = __esm(() => {
-  init_interaction2();
+  init_interaction3();
   init_path_frame();
   _acceptanceFixScopeDeps = {
     buildRunDispatchAskWiring
@@ -113192,7 +113269,7 @@ async function runDeferredRegression(options) {
 var _regressionDeps;
 var init_run_regression = __esm(() => {
   init_findings();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_operations();
   init_event_bus();
@@ -114487,15 +114564,15 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
     send: makeSendLogsBatch(resource)
   });
   const buildOrphanState = (startMs) => {
-    const identity = rootSpanIdentity();
+    const identity2 = rootSpanIdentity();
     const orphanAttrs = buildResourceAttributes({ serviceName: cfg.serviceName, runId: "orphan" });
     return {
-      ...identity,
+      ...identity2,
       startMs,
       feature: "",
       project: "",
       events: [],
-      spanTree: createSpanTree(identity.traceId, identity.spanId),
+      spanTree: createSpanTree(identity2.traceId, identity2.spanId),
       spanQueue: makeSpanQueue(orphanAttrs),
       metrics: createPhaseMetricsAggregator(),
       storyBounds: new Map,
@@ -114573,7 +114650,7 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
   const reporter = {
     name: STAGE8,
     async onRunStart(event) {
-      const identity = rootSpanIdentity();
+      const identity2 = rootSpanIdentity();
       const runId = event.runId;
       let gitBranch;
       let gitSha;
@@ -114601,14 +114678,14 @@ function createOtelReporterPlugin(cfg, deps, workdir) {
         git: { branch: gitBranch, sha: gitSha }
       });
       const state = {
-        ...identity,
+        ...identity2,
         startMs: Date.parse(event.startTime),
         feature: event.feature,
         project: event.project ?? "",
         gitBranch,
         gitSha,
         events: [],
-        spanTree: createSpanTree(identity.traceId, identity.spanId),
+        spanTree: createSpanTree(identity2.traceId, identity2.spanId),
         spanQueue: makeSpanQueue(resourceAttrs),
         metrics: createPhaseMetricsAggregator(),
         storyBounds: new Map,
@@ -118016,7 +118093,7 @@ var init_run_initialization = __esm(() => {
     },
     hasCommitsForStory: (workdir, storyId) => hasCommitsForStory(workdir, storyId),
     runReview: (reviewConfig, workdir, executionConfig) => runReview({ config: reviewConfig, workdir, executionConfig }),
-    spawn
+    spawn: spawn2
   };
 });
 
@@ -118285,9 +118362,9 @@ async function resolveProjectAsync(options = {}) {
     const identityFile = Bun.file(registryIdentityPath);
     if (await identityFile.exists()) {
       try {
-        const identity = await identityFile.json();
-        if (typeof identity.workdir === "string") {
-          return resolveProject({ ...options, dir: identity.workdir });
+        const identity2 = await identityFile.json();
+        if (typeof identity2.workdir === "string") {
+          return resolveProject({ ...options, dir: identity2.workdir });
         }
       } catch {}
     }
@@ -120853,7 +120930,7 @@ var init_run_setup = __esm(() => {
   init_internal();
   init_errors4();
   init_rtk();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_event_bus();
   init_prd();
@@ -121296,7 +121373,7 @@ async function cleanupSessionOnFailure(ctx, failAndClose2) {
 }
 
 // src/execution/deferred-review.ts
-var {spawn: spawn6 } = globalThis.Bun;
+var {spawn: spawn7 } = globalThis.Bun;
 async function spawnGitWithDeadline(args, workdir) {
   const proc = _deferredReviewDeps.spawn({
     cmd: hardenedGitArgv(["git", ...args]),
@@ -121376,7 +121453,7 @@ var init_deferred_review = __esm(() => {
   init_internal();
   init_git2();
   init_path_filters();
-  _deferredReviewDeps = { spawn: spawn6 };
+  _deferredReviewDeps = { spawn: spawn7 };
 });
 
 // src/execution/lifecycle/test-baseline-capture.ts
@@ -124665,7 +124742,7 @@ var _finishPhaseDeps;
 var init_phase = __esm(() => {
   init_internal();
   init_forge();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_pipeline2();
   init_runtime3();
@@ -125254,8 +125331,8 @@ function wireInteraction(bus, interactionChain, config2) {
       u();
   };
 }
-var init_interaction3 = __esm(() => {
-  init_interaction2();
+var init_interaction4 = __esm(() => {
+  init_interaction3();
   init_logger2();
 });
 
@@ -126556,7 +126633,7 @@ var init_unified_executor = __esm(() => {
   init_runner2();
   init_events_writer();
   init_hooks2();
-  init_interaction3();
+  init_interaction4();
   init_registry8();
   init_reporters();
   init_prd();
@@ -128861,7 +128938,7 @@ var init_plan_runtime = __esm(() => {
   init_analyze();
   init_config();
   init_generator2();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_runtime3();
   init_plan_helpers();
@@ -129017,7 +129094,7 @@ var init_context_builder = __esm(() => {
   init_plan_runtime();
   init_config();
   init_errors4();
-  init_interaction2();
+  init_interaction3();
   init_logger2();
   init_feature_name();
   init_spec_lint_gate();
@@ -132034,9 +132111,7 @@ __export(exports_cli, {
   MAX_CANONICAL_RULE_GLOB_FILES: () => MAX_CANONICAL_RULE_GLOB_FILES,
   MAX_DEAD_GLOB_SCAN_FILES: () => MAX_DEAD_GLOB_SCAN_FILES,
   MAX_DEAD_GLOB_SCAN_TOTAL_ENTRIES: () => MAX_DEAD_GLOB_SCAN_TOTAL_ENTRIES,
-  PromptCancelledError: () => PromptCancelledError,
   _approvalsCliDeps: () => _approvalsCliDeps,
-  _authPromptDeps: () => _authPromptDeps,
   _cliAuthDeps: () => _cliAuthDeps,
   _cliTrustDeps: () => _cliTrustDeps,
   _confirmDeps: () => _confirmDeps,
@@ -132096,8 +132171,6 @@ __export(exports_cli, {
   planMigration: () => planMigration,
   pluginsListCommand: () => pluginsListCommand,
   promptForConfirmation: () => promptForConfirmation,
-  promptForLine: () => promptForLine,
-  promptForSecret: () => promptForSecret,
   promptsCommand: () => promptsCommand,
   promptsInitCommand: () => promptsInitCommand,
   registerApprovalsCommand: () => registerApprovalsCommand,
@@ -132137,7 +132210,6 @@ var init_cli2 = __esm(() => {
   init_approvals();
   init_approvals_format();
   init_auth3();
-  init_auth_prompt();
   init_config2();
   init_config_descriptions();
   init_confirm();