@oh-hai/cli 0.4.4 → 0.4.6

package/dist/auth/token-store.d.ts

@@ -29,6 +29,23 @@ export declare function parseKey(key: string): {
     origin: string;
     agentId: string;
 };
+/** The id prefix marking a stored identity as the account OWNER's human session rather than an
+ *  agent bearer (issue #874). The store is keyed `(origin, id)` and has never cared what the id
+ *  MEANS, so a human simply takes an id shape an agent id cannot collide with — no second field,
+ *  no migration, and `--account`, `oh-hai use` and the env override all keep working unchanged. */
+export declare const HUMAN_ID_PREFIX = "human:";
+/** Whether a stored id is a HUMAN identity.
+ *
+ *  A PREFIX test, deliberately never a substring one: an agent legitimately named
+ *  `not-human-agent` contains the word and MUST still classify as an agent. Misclassifying it
+ *  would hand the human-inbox surface an agent bearer — which `GET /v1/messages` answers with that
+ *  agent's OWN submitted messages rather than an error, i.e. a plausible, well-formed, wrong
+ *  inbox. The classification is the only thing standing between those two outcomes, so it is a
+ *  test on the id's SHAPE and nothing else. */
+export declare function isHumanId(id: string): boolean;
+/** The `<userId>` half of a `human:<userId>` id. Returns undefined for an agent id, so a caller
+ *  cannot accidentally treat an agent id as a user id by slicing blindly. */
+export declare function humanUserId(id: string): string | undefined;
 /** The keys-only index file the keychain backend uses for enumeration — a sibling of the
  *  credentials file (`~/.config/oh-hai/keys.json`), honoring the same XDG resolution. */
 export declare function keychainIndexPath(env?: NodeJS.ProcessEnv): string;

package/dist/auth/token-store.js

@@ -24,6 +24,27 @@ export function parseKey(key) {
     const idx = key.indexOf("|");
     return idx < 0 ? { origin: "", agentId: key } : { origin: key.slice(0, idx), agentId: key.slice(idx + 1) };
 }
+/** The id prefix marking a stored identity as the account OWNER's human session rather than an
+ *  agent bearer (issue #874). The store is keyed `(origin, id)` and has never cared what the id
+ *  MEANS, so a human simply takes an id shape an agent id cannot collide with — no second field,
+ *  no migration, and `--account`, `oh-hai use` and the env override all keep working unchanged. */
+export const HUMAN_ID_PREFIX = "human:";
+/** Whether a stored id is a HUMAN identity.
+ *
+ *  A PREFIX test, deliberately never a substring one: an agent legitimately named
+ *  `not-human-agent` contains the word and MUST still classify as an agent. Misclassifying it
+ *  would hand the human-inbox surface an agent bearer — which `GET /v1/messages` answers with that
+ *  agent's OWN submitted messages rather than an error, i.e. a plausible, well-formed, wrong
+ *  inbox. The classification is the only thing standing between those two outcomes, so it is a
+ *  test on the id's SHAPE and nothing else. */
+export function isHumanId(id) {
+    return id.startsWith(HUMAN_ID_PREFIX);
+}
+/** The `<userId>` half of a `human:<userId>` id. Returns undefined for an agent id, so a caller
+ *  cannot accidentally treat an agent id as a user id by slicing blindly. */
+export function humanUserId(id) {
+    return isHumanId(id) ? id.slice(HUMAN_ID_PREFIX.length) : undefined;
+}
 /** The keys-only index file the keychain backend uses for enumeration — a sibling of the
  *  credentials file (`~/.config/oh-hai/keys.json`), honoring the same XDG resolution. */
 export function keychainIndexPath(env = process.env) {

package/dist/auth/token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,yFAAyF;AACzF,4FAA4F;AAC5F,wDAAwD;AACxD,EAAE;AACF,+FAA+F;AAC/F,2FAA2F;AAC3F,6FAA6F;AAC7F,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAC;AAuB3F;8EAC8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAChC,0FAA0F;IAC1F,2FAA2F,CAAC;AAE9F,2EAA2E;AAC3E,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,OAAe;IACnD,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAC1B,qFAAqF;IAC5E,WAAW,CAAsB;IACzB,QAAQ,CAAkB;IAC1B,OAAO,CAAgB;IACvB,QAAQ,CAAU;IAClB,IAAI,CAAwB;IACrC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAwC,EAAE,UAAwB,EAAE;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,2FAA2F;IACnF,SAAS;QACf,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAAe;QACvC,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;IAC5D,CAAC;IAED;mFAC+E;IAC/E,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,OAAe;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,sFAAsF;QACtF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;0EAEsE;IACtE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAe;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAmB,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,KAAK,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;6CACyC;IACzC,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED;wFACoF;IACpF,KAAK,CAAC,QAAQ;QACZ,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,UAAmB,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,KAAK,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,KAAK,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;iGAGiG;AACjG,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;6CAE6C;AAC7C,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,QAAW;IAClE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAQ,EAAQ,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAExD,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,WAAW,CACjC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACrC,OAAO,CAAC,cAAc,IAAI,yBAAyB,EACnD,KAAK,CACN,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/auth/token-store.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,yFAAyF;AACzF,4FAA4F;AAC5F,wDAAwD;AACxD,EAAE;AACF,+FAA+F;AAC/F,2FAA2F;AAC3F,6FAA6F;AAC7F,oCAAoC;AAEpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAC;AAuB3F;8EAC8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAChC,0FAA0F;IAC1F,2FAA2F,CAAC;AAE9F,2EAA2E;AAC3E,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,OAAe;IACnD,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;mGACmG;AACnG,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;mGAGmG;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AAExC;;;;;;;+CAO+C;AAC/C,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACxC,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAC1D,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAC1B,qFAAqF;IAC5E,WAAW,CAAsB;IACzB,QAAQ,CAAkB;IAC1B,OAAO,CAAgB;IACvB,QAAQ,CAAU;IAClB,IAAI,CAAwB;IACrC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAAwC,EAAE,UAAwB,EAAE;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,2FAA2F;IACnF,SAAS;QACf,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAAe;QACvC,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;IAC5D,CAAC;IAED;mFAC+E;IAC/E,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,OAAe;QACjD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,sFAAsF;QACtF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;0EAEsE;IACtE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,OAAe;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,UAAmB,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;oBAAE,OAAO,GAAG,IAAI,CAAC;YAChD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,KAAK,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;6CACyC;IACzC,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED;wFACoF;IACpF,KAAK,CAAC,QAAQ;QACZ,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,UAAmB,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,KAAK,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;YACpC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,KAAK,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,UAAU,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;iGAGiG;AACjG,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;6CAE6C;AAC7C,SAAS,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,QAAW;IAClE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAQ,EAAQ,EAAE;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAExD,0FAA0F;IAC1F,wFAAwF;IACxF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,WAAW,CACjC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EACrC,OAAO,CAAC,cAAc,IAAI,yBAAyB,EACnD,KAAK,CACN,CAAC;IACF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC"}

package/dist/commands/handlers.js

@@ -11,6 +11,7 @@ import { fleetCommand } from "./fleet.js";
 import { inboxCommand } from "./inbox.js";
 import { loginCommand } from "./login.js";
 import { logoutCommand } from "./logout.js";
+import { mailCommand } from "./mail.js";
 import { messagesCommand } from "./messages.js";
 import { notifyCommand } from "./notify.js";
 import { sessionCommand } from "./session.js";
@@ -34,6 +35,7 @@ export const COMMAND_HANDLERS = {
     bridge: bridgeCommand,
     session: sessionCommand,
     fleet: fleetCommand,
+    mail: mailCommand,
     messages: messagesCommand,
     doctor: doctorCommand,
     teach: teachCommand,

package/dist/commands/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/commands/handlers.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,4FAA4F;AAC5F,2FAA2F;AAC3F,uFAAuF;AACvF,2FAA2F;AAE3F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAmC;IAC9D,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,aAAa;IACrB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,cAAc;CACxB,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/commands/handlers.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,4FAA4F;AAC5F,2FAA2F;AAC3F,uFAAuF;AACvF,2FAA2F;AAE3F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,gBAAgB,GAAmC;IAC9D,KAAK,EAAE,YAAY;IACnB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,aAAa;IACrB,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,eAAe;IACzB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,cAAc;CACxB,CAAC"}

package/dist/commands/login.d.ts

@@ -12,4 +12,4 @@ export declare function loginCommand(ctx: CommandContext): Promise<void>;
  * Returns the AGENT ID the approved bearer was stored under (the one the human bound in the browser),
  * so the onboarding caller can reconcile it against the resolver's precedence and give honest next steps.
  */
-export declare function runDeviceCodeFlow(ctx: CommandContext, command?: string): Promise<string>;
+export declare function runDeviceCodeFlow(ctx: CommandContext, command?: string, subject?: "agent" | "human"): Promise<string>;

package/dist/commands/login.js

@@ -12,6 +12,8 @@ import { sanitizeForTerminal } from "../terminal.js";
 import { isHttpUrl } from "../url.js";
 import { flagOn, parseCommandArgs } from "./flags.js";
 import { throwTransportError } from "./http.js";
+import { classifyProbeStatus, probeGet, readActor, readJsonBody } from "./whoami.js";
+import { isHumanId } from "../auth/token-store.js";
 /** Per-request bound for each device-grant POST when no `--timeout`/`MA2H_TIMEOUT_MS` is set. It
  *  bounds a SINGLE request, never the whole flow — the human's approval window (minutes) is bounded
  *  separately by the poll budget below, so a snappy per-request timeout can't abort a slow human. */
@@ -32,14 +34,73 @@ const DEFAULT_EXPIRES_IN_SECONDS = 900;
 const MIN_EXPIRES_IN_SECONDS = 1;
 const MAX_EXPIRES_IN_SECONDS = 3600;
 export async function loginCommand(ctx) {
-    const { values } = parseCommandArgs(ctx.argv, { "token-stdin": { type: "boolean" } });
-    if (flagOn(values["token-stdin"])) {
+    const { values } = parseCommandArgs(ctx.argv, { "token-stdin": { type: "boolean" }, human: { type: "boolean" } });
+    if (flagOn(values.human)) {
+        // `--human --token-stdin` keeps the paste path for CI/headless, exactly as the agent side has
+        // one. Bare `--human` now runs the device-code flow: the browser opens, the human approves, and
+        // NO TOKEN IS EVER SHOWN, TYPED OR PASTED (#884) — the same "platinum" onboarding the agent
+        // login has had since #271, which the account owner was previously the only person denied.
+        if (flagOn(values["token-stdin"])) {
+            await humanLogin(ctx);
+        }
+        else {
+            await runDeviceCodeFlow(ctx, "login", "human");
+        }
+    }
+    else if (flagOn(values["token-stdin"])) {
         await tokenStdinLogin(ctx);
     }
     else {
         await runDeviceCodeFlow(ctx);
     }
 }
+/**
+ * `--human` (§4.3, issue #874): store the ACCOUNT OWNER's session token so `oh-hai mail` can read
+ * their own inbox. Stdin only, and the id is taken from the SERVER.
+ *
+ * WHY STDIN RATHER THAN THE DEVICE-CODE FLOW. That flow mints an AGENT bearer — the human picks an
+ * agent to bind at approval time — so there is no human-principal variant of it without a server
+ * change, which #874 excludes. The repo already has the right shape for this: `--token-stdin` takes
+ * a piped credential and stores it without ever printing it. A proper human device-code flow is the
+ * better end state and is filed as follow-up.
+ *
+ * WHY THE ID COMES FROM `/auth/whoami` AND NEVER FROM `--account`. The stored key decides which
+ * commands will accept this credential, so letting the caller name it would let a mistyped or
+ * malicious id file an AGENT token under a `human:` key — which is precisely the confusion
+ * `mail/identity.ts` exists to prevent, arriving through the front door. The Hub attests the actor;
+ * a non-human one is refused and NOTHING is stored.
+ */
+async function humanLogin(ctx) {
+    const raw = await ctx.runtime.readStdin();
+    const token = raw.trim();
+    if (token === "") {
+        throw new CliError("usage", 'no token on stdin — pipe your session token, e.g. `printf %s "$TOKEN" | oh-hai login --human`.');
+    }
+    // Ask the Hub who this credential IS. Every failure arm below stores nothing.
+    const res = await probeGet(ctx, "/auth/whoami", token);
+    if (res.status !== 200)
+        classifyProbeStatus(res.status);
+    const actor = readActor(await readJsonBody(res));
+    if (actor === undefined) {
+        throw new CliError("error", "unexpected Hub response (200 without an identity); could not confirm the token (check --base-url).");
+    }
+    // A REFLECTED CREDENTIAL MUST NEVER REACH stdout. A buggy or hostile Hub can answer with an actor
+    // that EMBEDS the token it was just given (`human:<the-token>`); `readActor` would accept it and
+    // `storeAndReport` prints the actor as `agent_id` on both output paths — so the session bearer
+    // would land on stdout, breaking the never-print contract at the one moment the token is in hand.
+    if (actor.includes(token)) {
+        throw new CliError("server", "the Hub echoed the presented credential back inside its identity response; refusing rather than storing or printing it.");
+    }
+    if (!isHumanId(actor)) {
+        // The common mistake: piping an AGENT token here. Refuse rather than storing it under a human
+        // key — a stored agent token wearing a `human:` id would defeat the mail gate entirely.
+        throw new CliError("usage", `that token authenticates as "${sanitizeForTerminal(actor)}", which is an AGENT, not a human — nothing was stored. ` +
+            "Pipe your own session token, or use `oh-hai login` to store an agent bearer.");
+    }
+    // The actor IS the storage id: the Hub returns `human:<userId>`, which is exactly the shape the
+    // store and `mail/identity.ts` key on. Nothing is derived by string surgery here.
+    await storeAndReport(ctx, actor, token);
+}
 /** `--token-stdin` (§4.3): read a bearer from stdin (local bootstrap / paste) and store it the same
  *  way the device-code path does. Behavior is frozen — #195 only adds the device-code flow. */
 async function tokenStdinLogin(ctx) {
@@ -47,6 +108,17 @@ async function tokenStdinLogin(ctx) {
     if (account === undefined) {
         throw new CliError("usage", "an agent id is required — pass --account/--agent or set MA2H_AGENT_ID.");
     }
+    // THE `human:` PREFIX IS RESERVED ON THIS PATH (#874). This arm stores whatever `--account` names
+    // WITHOUT attesting the token, which is fine for an agent id — the Hub 403s a mismatched bearer at
+    // use time — but not for a human one: `mail`'s gate keys on the stored ID, so
+    // `login --token-stdin --account human:<id>` with an agent bearer would file an agent token under
+    // a human key, pass that gate, and return the agent's own self-list as if it were the account
+    // inbox. Same shape as the env-token hole this branch already closes: the id must IMPLY the
+    // credential, and only `--human` establishes that, by taking the id from `/auth/whoami`.
+    if (isHumanId(account)) {
+        throw new CliError("usage", `"${sanitizeForTerminal(account)}" is a reserved human identity id, and this path does not verify the token behind it. ` +
+            "Use `oh-hai login --human` instead — it takes the id from the Hub, so the credential and the id cannot disagree.");
+    }
     const raw = await ctx.runtime.readStdin();
     const token = raw.trim();
     if (token === "") {
@@ -66,8 +138,8 @@ async function tokenStdinLogin(ctx) {
  * Returns the AGENT ID the approved bearer was stored under (the one the human bound in the browser),
  * so the onboarding caller can reconcile it against the resolver's precedence and give honest next steps.
  */
-export async function runDeviceCodeFlow(ctx, command = "login") {
-    const code = await requestDeviceCode(ctx);
+export async function runDeviceCodeFlow(ctx, command = "login", subject = "agent") {
+    const code = await requestDeviceCode(ctx, subject);
     // Try to open the browser for the human first (#271 "platinum" onboarding — no copy-paste). The
     // capability is optional and best-effort: `openBrowser` resolves false when it can't launch one
     // (headless box, no opener), and every hermetic test omits it → the printed fallback below. `openUrl`
@@ -99,7 +171,7 @@ export async function runDeviceCodeFlow(ctx, command = "login") {
         nextDelayMs = intervalMs; // resume the advertised interval unless this round overrides it below
         const res = await hubPost(ctx, "/auth/device/token", { device_code: code.deviceCode });
         if (res.status === 200) {
-            const token = await readAccessToken(res);
+            const token = await readAccessToken(res, subject);
             await storeAndReport(ctx, token.agentId, token.accessToken, command);
             return token.agentId;
         }
@@ -138,16 +210,50 @@ export async function runDeviceCodeFlow(ctx, command = "login") {
     // The loop exhausted its budget without a terminal response — treat as a timeout (§7).
     throw new CliError("timeout", "device authorization did not complete before the code expired; run `oh-hai login` again.");
 }
+/** Strip the controls `JSON.stringify` does NOT escape — C1 (U+0080–U+009F) and DEL — from a value
+ *  that is about to be serialized into an envelope. Narrower than `sanitizeForTerminal`, which also
+ *  strips C0 and would mangle legitimate content; C0 needs no help here because JSON escapes it. */
+function stripJsonControls(value) {
+    let out = "";
+    for (const ch of value) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (code !== 0x7f && !(code >= 0x80 && code <= 0x9f))
+            out += ch;
+    }
+    return out;
+}
 /** Store the bearer Hub-scoped (§5.1) and report success. The token is NEVER in the output (§5.4);
  *  an existing token for this identity is overwritten silently (§4.3). Shared by both login paths and
  *  the onboarding entrypoints — `command` labels the §8 success envelope ("login" / "setup"). */
 async function storeAndReport(ctx, agentId, token, command = "login") {
+    // NEVER STORE OR PRINT AN ID THAT CONTAINS THE CREDENTIAL — and the check lives HERE, in the one
+    // function every login path passes through, rather than once per path.
+    //
+    // This function prints `agentId` on BOTH output modes, so a Hub answering
+    // `human:<the-token-it-just-issued>` would put the bearer on stdout at the exact moment the CLI is
+    // holding it, breaking the §5.4 never-print contract via the response that delivers the secret.
+    //
+    // IT WAS ALREADY THE SAME RULE IN TWO OTHER PLACES — `humanLogin` refuses a reflected actor from
+    // /auth/whoami, and `mail/identity.ts` refuses one from its attestation probe — and the device path,
+    // added later, did not inherit it. Rather than write it a third time, it goes at the choke point:
+    // all three callers (`humanLogin`, `tokenStdinLogin`, `runDeviceCodeFlow`) are covered by
+    // construction, both device subjects are covered rather than just the human one, and a fourth
+    // caller added later inherits it instead of reopening the hole. The two earlier guards stay: they
+    // fire sooner, on a different input, and say something more specific about it.
+    if (agentId.includes(token)) {
+        throw new CliError("server", "the identity to store contains the credential itself; refusing rather than storing or printing it.");
+    }
     const store = await ctx.runtime.openStore();
     await store.set(originOf(ctx.config.baseUrl), agentId, token);
     if (ctx.json) {
         // No token field, ever (§5.4). `storage` reports which backend actually holds it. The agent id
         // is emitted raw — JSON.stringify escapes any control character, so it can't reach the terminal.
-        ctx.io.log(serializeEnvelope(buildOk(command, { agent_id: agentId, base_url: ctx.config.baseUrl, storage: store.backendName })));
+        ctx.io.log(serializeEnvelope(
+        // `JSON.stringify` escapes C0 but passes C1 (U+0080–U+009F) and DEL through RAW, so a
+        // Hub-chosen id carrying one would reach a terminal live inside the envelope. The human
+        // line below already sanitizes for this reason; the JSON path did not. The RAW id is still
+        // what was stored above — this sanitizes only what is DISPLAYED.
+        buildOk(command, { agent_id: stripJsonControls(agentId), base_url: ctx.config.baseUrl, storage: store.backendName })));
     }
     else {
         // Sanitize the DISPLAYED agent id — on the device-code path it's server-supplied, so a hostile
@@ -158,8 +264,8 @@ async function storeAndReport(ctx, agentId, token, command = "login") {
 }
 /** POST /auth/device/code, validate the fields the prompt + poll need, and normalize the poll
  *  interval / expiry to sane bounded values. */
-async function requestDeviceCode(ctx) {
-    const res = await hubPost(ctx, "/auth/device/code", {});
+async function requestDeviceCode(ctx, subject = "agent") {
+    const res = await hubPost(ctx, "/auth/device/code", subject === "human" ? { subject } : {});
     if (res.status !== 200) {
         const { message } = await readErrorEnvelope(res);
         throw mapHubError(res.status, message);
@@ -185,15 +291,30 @@ async function requestDeviceCode(ctx) {
         expiresInSeconds: boundedInt(body.expires_in, DEFAULT_EXPIRES_IN_SECONDS, MIN_EXPIRES_IN_SECONDS, MAX_EXPIRES_IN_SECONDS),
     };
 }
-/** Read + validate the 200 token response (`{ access_token, agent_id }`). */
-async function readAccessToken(res) {
+/** Read + validate the 200 token response: `{ access_token, agent_id }` for an agent grant,
+ *  `{ access_token, actor }` for a human one. Returns the id to STORE the bearer under. */
+async function readAccessToken(res, subject) {
     const body = await readJson(res);
     const accessToken = str(body.access_token);
-    const agentId = str(body.agent_id);
-    if (accessToken === undefined || agentId === undefined) {
+    // WHICH FIELD NAMES THE STORAGE KEY IS DECIDED BY THE LOGIN WE RAN, NOT BY WHAT CAME BACK.
+    // Reading `agent_id ?? actor` would let the HUB choose which kind of key its answer lands under:
+    // an `oh-hai login` (agent) whose response carried only `actor: "human:usr_x"` would file an AGENT
+    // bearer under a HUMAN key — the very thing `login --token-stdin --account human:…` is refused for,
+    // reached through the device path instead. The subject we asked for is the one that decides.
+    const id = subject === "human" ? str(body.actor) : str(body.agent_id);
+    if (accessToken === undefined || id === undefined) {
         throw new CliError("server", "the Hub returned a malformed token response.");
     }
-    return { accessToken, agentId };
+    // AND THE ID'S KIND MUST MATCH IT. `human:` is a reserved prefix on this side — `mail`'s gate keys
+    // on it — so an agent login must never store a human-shaped id, and a human login must never store
+    // an agent-shaped one. This is a SHAPE check on a value we then trust as a storage key; it is not
+    // an attestation, and nothing here proves the token is what the Hub says. It does not need to: the
+    // credential arrived from this same Hub in direct answer to our own poll, and `oh-hai mail`
+    // re-attests the stored credential against /auth/whoami before it touches the inbox.
+    if (isHumanId(id) !== (subject === "human")) {
+        throw new CliError("server", `the Hub returned a ${subject === "human" ? "non-human" : "human"}-shaped identity for a ${subject} login; refusing to store it.`);
+    }
+    return { accessToken, agentId: id };
 }
 /** POST a JSON body to `path` on the Hub, mapping transport failures to §7 exit codes. The
  *  per-request timeout bounds THIS request only; the poll budget bounds the whole flow. */

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,gGAAgG;AAChG,kGAAkG;AAClG,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;qGAEqG;AACrG,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,mGAAmG;AACnG,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,oGAAoG;AACpG,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;+FAC+F;AAC/F,KAAK,UAAU,eAAe,CAAC,GAAmB;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAmB,EAAE,OAAO,GAAG,OAAO;IAC5E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE1C,gGAAgG;IAChG,gGAAgG;IAChG,sGAAsG;IACtG,uGAAuG;IACvG,mFAAmF;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3G,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACnG,iGAAiG;QACjG,2BAA2B;QAC3B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qDAAqD,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0CAA0C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE5C,kGAAkG;IAClG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7E,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,2BAA2B;IAC3B,IAAI,UAAU,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,IAAI,WAAW,GAAG,UAAU,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,WAAW,GAAG,UAAU,CAAC,CAAC,sEAAsE;QAChG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACvE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,YAAY,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,uBAAuB;gBAC1B,SAAS,CAAC,mEAAmE;YAC/E,KAAK,WAAW;gBACd,UAAU,IAAI,sBAAsB,CAAC,CAAC,8CAA8C;gBACpF,WAAW,GAAG,UAAU,CAAC;gBACzB,SAAS;YACX,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YACjE,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,2EAA2E,CAC5E,CAAC;YACJ;gBACE,+EAA+E;gBAC/E,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED;;iGAEiG;AACjG,KAAK,UAAU,cAAc,CAAC,GAAmB,EAAE,OAAe,EAAE,KAAa,EAAE,OAAO,GAAG,OAAO;IAClG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,+FAA+F;QAC/F,iGAAiG;QACjG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iBAAiB,CACf,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAClG,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,+FAA+F;QAC/F,6FAA6F;QAC7F,yDAAyD;QACzD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,mBAAmB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAWD;gDACgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,4FAA4F;IAC5F,yGAAyG;IACzG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QACnF,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QAChH,gBAAgB,EAAE,UAAU,CAC1B,IAAI,CAAC,UAAU,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,CACvB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,GAAiB;IAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IACrE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,0BAA0B,CAAC;KAChF,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;sCAEsC;AACtC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,iBAAiB,CAC9B,GAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;oGAEoG;AACpG,SAAS,WAAW,CAAC,MAAc,EAAE,OAA2B;IAC9D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC;IAChG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;2FAC2F;AAC3F,SAAS,gBAAgB,CAAC,WAAsC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,GAAG,IAAI,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED;;;sGAGsG;AACtG,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC5E,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,gGAAgG;AAChG,kGAAkG;AAClG,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD;;qGAEqG;AACrG,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,mGAAmG;AACnG,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,oGAAoG;AACpG,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAClH,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,8FAA8F;QAC9F,gGAAgG;QAChG,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,UAAU,CAAC,GAAmB;IAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oGAAoG,CAAC,CAAC;IACpI,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,yHAAyH,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,8FAA8F;QAC9F,wFAAwF;QACxF,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,gCAAgC,mBAAmB,CAAC,KAAK,CAAC,0DAA0D;YAClH,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,kFAAkF;IAClF,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;+FAC+F;AAC/F,KAAK,UAAU,eAAe,CAAC,GAAmB;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,kGAAkG;IAClG,mGAAmG;IACnG,8EAA8E;IAC9E,kGAAkG;IAClG,8FAA8F;IAC9F,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,IAAI,mBAAmB,CAAC,OAAO,CAAC,wFAAwF;YACtH,kHAAkH,CACrH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB,EACnB,OAAO,GAAG,OAAO,EACjB,UAA6B,OAAO;IAEpC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEnD,gGAAgG;IAChG,gGAAgG;IAChG,sGAAsG;IACtG,uGAAuG;IACvG,mFAAmF;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3G,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACnG,iGAAiG;QACjG,2BAA2B;QAC3B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qDAAqD,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0CAA0C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE5C,kGAAkG;IAClG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7E,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,2BAA2B;IAC3B,IAAI,UAAU,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,IAAI,WAAW,GAAG,UAAU,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,WAAW,GAAG,UAAU,CAAC,CAAC,sEAAsE;QAChG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACvE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,YAAY,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,uBAAuB;gBAC1B,SAAS,CAAC,mEAAmE;YAC/E,KAAK,WAAW;gBACd,UAAU,IAAI,sBAAsB,CAAC,CAAC,8CAA8C;gBACpF,WAAW,GAAG,UAAU,CAAC;gBACzB,SAAS;YACX,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YACjE,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,2EAA2E,CAC5E,CAAC;YACJ;gBACE,+EAA+E;gBAC/E,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAGD;;oGAEoG;AACpG,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;YAAE,GAAG,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;iGAEiG;AACjG,KAAK,UAAU,cAAc,CAAC,GAAmB,EAAE,OAAe,EAAE,KAAa,EAAE,OAAO,GAAG,OAAO;IAClG,iGAAiG;IACjG,uEAAuE;IACvE,EAAE;IACF,0EAA0E;IAC1E,mGAAmG;IACnG,gGAAgG;IAChG,EAAE;IACF,iGAAiG;IACjG,qGAAqG;IACrG,kGAAkG;IAClG,0FAA0F;IAC1F,8FAA8F;IAC9F,kGAAkG;IAClG,+EAA+E;IAC/E,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,QAAQ,EACR,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,+FAA+F;QAC/F,iGAAiG;QACjG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iBAAiB;QACf,sFAAsF;QACtF,wFAAwF;QACxF,2FAA2F;QAC3F,iEAAiE;QACjE,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CACrH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,+FAA+F;QAC/F,6FAA6F;QAC7F,yDAAyD;QACzD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,mBAAmB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAWD;gDACgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,GAAmB,EAAE,UAA6B,OAAO;IACxF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,4FAA4F;IAC5F,yGAAyG;IACzG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QACnF,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QAChH,gBAAgB,EAAE,UAAU,CAC1B,IAAI,CAAC,UAAU,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,CACvB;KACF,CAAC;AACJ,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,eAAe,CAC5B,GAAiB,EACjB,OAA0B;IAE1B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE3C,2FAA2F;IAC3F,iGAAiG;IACjG,mGAAmG;IACnG,oGAAoG;IACpG,6FAA6F;IAC7F,MAAM,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAC/E,CAAC;IAED,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,4FAA4F;IAC5F,qFAAqF;IACrF,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,QAAQ,CAChB,QAAQ,EACR,sBAAsB,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,0BAA0B,OAAO,+BAA+B,CAClI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACtC,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IACrE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,0BAA0B,CAAC;KAChF,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;sCAEsC;AACtC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,iBAAiB,CAC9B,GAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;oGAEoG;AACpG,SAAS,WAAW,CAAC,MAAc,EAAE,OAA2B;IAC9D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC;IAChG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;2FAC2F;AAC3F,SAAS,gBAAgB,CAAC,WAAsC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,GAAG,IAAI,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED;;;sGAGsG;AACtG,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC5E,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/commands/mail/http.d.ts

@@ -0,0 +1,47 @@
+import type { CommandContext } from "../context.js";
+/** The triage views `GET /v1/messages` exposes to a human. `active` is the default feed and is
+ *  expressed by sending NO view param — the Hub treats `archived` and `snoozed` as mutually
+ *  exclusive opt-ins, so a caller must never send both. */
+export type MailView = "active" | "archived";
+/** The fields of an inbox row this client actually keys on — NOT a claim about what the Hub sends.
+ *
+ *  IMPORTANT, AND THE OPPOSITE OF THE AGENT PATH. `GET /v1/messages` answers a HUMAN bearer with
+ *  `toGetMessageBody(m, true)` — the FULL message, envelope and all, including `body`, `context`,
+ *  and the resolver-only `archived_at` / `snoozed_until`. Only the AGENT self-list is projected to
+ *  an index (`toAgentListItem`), which is what `messages.ts` documents and what an earlier revision
+ *  of this comment wrongly copied.
+ *
+ *  Two consequences worth stating rather than rediscovering:
+ *   - the human TABLE narrows to these fields by choice, not because the Hub sent only these;
+ *   - under `--json` the caller receives the full bodies, which is the point of the surface — so
+ *     nothing here may assume a field is absent. This interface is a floor, never an exhaustive
+ *     shape, and `isMailRow` validates only the three fields the renderer dereferences. */
+export interface MailRow {
+    id: string;
+    type: string;
+    status: string;
+    title?: string;
+    created_at?: string;
+    priority?: string;
+    agent?: {
+        id?: string;
+    };
+}
+/** List the account inbox — full message bodies, not an index (see MailRow). `view` selects the
+ *  triage feed; `archived` is an explicit opt-in. */
+export declare function listInbox(ctx: CommandContext, token: string, opts: {
+    limit?: number;
+    offset?: number;
+    view?: MailView;
+}): Promise<MailRow[]>;
+/** Pull one message by id.
+ *
+ *  VALIDATED LIKE THE LIST PATH, and for the same reason. `readJson` collapses a malformed 2xx —
+ *  non-JSON, an array, `{}` — to an empty object, so an unvalidated detail read would exit 0 and
+ *  print `{ message: {} }` (or a row of em dashes), presenting a Hub/proxy contract failure as a
+ *  successful read of an empty message. The list path already refuses that; leaving the detail path
+ *  permissive made the two disagree about what a valid response is. */
+export declare function readMessage(ctx: CommandContext, token: string, id: string): Promise<MailRow & Record<string, unknown>>;
+/** Apply one triage verb to one message. Returns nothing — the Hub answers 2xx with no body worth
+ *  rendering, and inventing one would imply state this command did not read back. */
+export declare function triage(ctx: CommandContext, token: string, id: string, verb: "archive" | "unarchive"): Promise<void>;

package/dist/commands/mail/http.js

@@ -0,0 +1,106 @@
+// Hub calls for the `oh-hai mail` surface — the account owner's own inbox (issue #874).
+//
+// Every function here takes a HUMAN session bearer. Nothing in this module decides whether the
+// caller is entitled to use it: that is `identity.ts`'s pre-flight gate, which runs before any of
+// these are reached. Re-checking here would invite the response-inspection shape the gate exists to
+// avoid — see that module's header.
+//
+// Status mapping, transport errors, and the error envelope are REUSED from the messaging layer
+// rather than reimplemented: a second copy of the status table drifts, and a drifted copy maps a
+// 404 or a 409 to the wrong exit code, which is exactly the machine contract callers branch on.
+import { throwTransportError } from "../http.js";
+import { readErrorEnvelope, readJson, redactToken, requestTimeoutMs, statusToCliError } from "../messaging/http.js";
+import { redactDeep } from "../messaging/sessions-http.js";
+import { CliError } from "../../envelope.js";
+function isMailRow(v) {
+    const r = v;
+    return typeof r === "object" && r !== null && typeof r.id === "string" && typeof r.type === "string" && typeof r.status === "string";
+}
+async function get(ctx, token, path) {
+    const url = `${ctx.config.baseUrl}${path}`;
+    let res;
+    try {
+        res = await ctx.runtime.fetchImpl(url, {
+            method: "GET",
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(requestTimeoutMs(ctx)),
+        });
+    }
+    catch (error) {
+        throwTransportError(error, ctx.config.baseUrl);
+    }
+    if (res.status < 200 || res.status >= 300) {
+        const { code, message } = await readErrorEnvelope(res);
+        throw statusToCliError(res.status, redactToken(message, token), code);
+    }
+    // REDACT THE BEARER FROM THE SUCCESS BODY TOO — not just from error messages (§5.4).
+    // A buggy or hostile Hub can echo the Authorization value into any field, and this surface
+    // serializes rows VERBATIM under `--json` (deliberately, so a multi-line body survives) — so an
+    // echoed bearer would land on stdout intact. The sibling `listMessages` already round-trips its
+    // rows through the same redactor; the human inbox path must not be the one that skips it.
+    // Fails CLOSED: a re-parse failure raises a server error rather than returning un-redacted data.
+    return redactDeep(await readJson(res), token, "message");
+}
+/** List the account inbox — full message bodies, not an index (see MailRow). `view` selects the
+ *  triage feed; `archived` is an explicit opt-in. */
+export async function listInbox(ctx, token, opts) {
+    const query = new URLSearchParams();
+    if (opts.limit !== undefined)
+        query.set("limit", String(opts.limit));
+    if (opts.offset !== undefined)
+        query.set("offset", String(opts.offset));
+    // Only the archived view carries a param; `active` is the absence of one.
+    if (opts.view === "archived")
+        query.set("archived", "true");
+    const suffix = query.toString();
+    const body = await get(ctx, token, `/v1/messages${suffix ? `?${suffix}` : ""}`);
+    const messages = body.messages;
+    if (!Array.isArray(messages) || !messages.every(isMailRow)) {
+        // A malformed body is a SERVER error, never a silently empty inbox — an empty table would read
+        // as "nothing to triage" and hide a Hub or proxy regression behind good news.
+        throw new CliError("server", "the Hub returned a malformed message list (expected { messages: [{ id, type, status }] }).");
+    }
+    return messages;
+}
+/** Pull one message by id.
+ *
+ *  VALIDATED LIKE THE LIST PATH, and for the same reason. `readJson` collapses a malformed 2xx —
+ *  non-JSON, an array, `{}` — to an empty object, so an unvalidated detail read would exit 0 and
+ *  print `{ message: {} }` (or a row of em dashes), presenting a Hub/proxy contract failure as a
+ *  successful read of an empty message. The list path already refuses that; leaving the detail path
+ *  permissive made the two disagree about what a valid response is. */
+export async function readMessage(ctx, token, id) {
+    const body = await get(ctx, token, `/v1/messages/${encodeURIComponent(id)}`);
+    if (!isMailRow(body)) {
+        throw new CliError("server", "the Hub returned a malformed message (expected { id, type, status }).");
+    }
+    // AND IT MUST BE THE MESSAGE THAT WAS ASKED FOR. A well-shaped body for a DIFFERENT id passes the
+    // shape check and would exit 0 having shown the wrong message — the caller then archives, quotes
+    // or acts on something they never requested. The agent-side `pollMessage` validates this echo for
+    // the same reason; a shape check alone is not an identity check.
+    if (body.id !== id) {
+        throw new CliError("server", "the Hub returned a different message than the one requested.");
+    }
+    return body;
+}
+/** Apply one triage verb to one message. Returns nothing — the Hub answers 2xx with no body worth
+ *  rendering, and inventing one would imply state this command did not read back. */
+export async function triage(ctx, token, id, verb) {
+    const url = `${ctx.config.baseUrl}/v1/messages/${encodeURIComponent(id)}/${verb}`;
+    let res;
+    try {
+        res = await ctx.runtime.fetchImpl(url, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${token}` },
+            signal: AbortSignal.timeout(requestTimeoutMs(ctx)),
+        });
+    }
+    catch (error) {
+        throwTransportError(error, ctx.config.baseUrl);
+    }
+    if (res.status < 200 || res.status >= 300) {
+        const { code, message } = await readErrorEnvelope(res);
+        throw statusToCliError(res.status, redactToken(message, token), code);
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/commands/mail/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/commands/mail/http.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,oGAAoG;AACpG,oCAAoC;AACpC,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,gGAAgG;AAEhG,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AA+B7C,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,CAAC,GAAG,CAAmB,CAAC;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AACvI,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,GAAmB,EAAE,KAAa,EAAE,IAAY;IACjE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,qFAAqF;IACrF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,0FAA0F;IAC1F,iGAAiG;IACjG,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAmB,EACnB,KAAa,EACb,IAA0D;IAE1D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,0EAA0E;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,4FAA4F,CAAC,CAAC;IAC7H,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;uEAMuE;AACvE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAmB,EAAE,KAAa,EAAE,EAAU;IAC9E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,uEAAuE,CAAC,CAAC;IACxG,CAAC;IACD,kGAAkG;IAClG,iGAAiG;IACjG,kGAAkG;IAClG,iEAAiE;IACjE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,IAAyC,CAAC;AACnD,CAAC;AAED;qFACqF;AACrF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAmB,EAAE,KAAa,EAAE,EAAU,EAAE,IAA6B;IACxG,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;IAClF,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/commands/mail/identity.d.ts

@@ -0,0 +1,15 @@
+import type { CommandContext } from "../context.js";
+/** The human identity a `mail` command runs as. */
+export interface MailIdentity {
+    /** The account owner's session bearer. */
+    token: string;
+    /** The `<userId>` half of the stored `human:<userId>` id — never the raw stored key. */
+    userId: string;
+}
+/**
+ * Resolve the human identity for a `mail` command, or refuse.
+ *
+ * Called before any request is composed. Throws rather than returning a discriminated result: a
+ * caller cannot then forget to branch, which is the failure this whole module exists to prevent.
+ */
+export declare function resolveMailIdentity(ctx: CommandContext): Promise<MailIdentity>;