@opendatalabs/connect 0.10.0 → 0.10.1-canary.5944de8

package/dist/cli/index.js

@@ -26,14 +26,15 @@ const vanaPromptTheme = {
         },
     },
 };
-import { createConnectRenderer, createHumanRenderer, formatDisplayPath, formatRelativeTime, } from "./render/index.js";
+import { createConnectRenderer, createHumanRenderer, createLoginRenderer, formatDisplayPath, formatRelativeTime, } from "./render/index.js";
 import { CliOutcomeStatus, migrateLegacyDataHome, getBrowserProfilesDir, getConnectorCacheDir, getLogsDir, getSessionsDir, getSourceResultPath, readCliState, readCliConfig, updateCliConfig, updateSourceState, } from "../core/index.js";
 import { fetchConnectorToCache, listAvailableSources, readCachedConnectorMetadata, } from "../connectors/registry.js";
-import { detectPersonalServerTarget, ingestResult, } from "../personal-server/index.js";
+import { detectPersonalServerTarget, ingestResult, resolvePersonalServerAuthConfig, } from "../personal-server/index.js";
 import { findDataConnectorsDir, ManagedPlaywrightRuntime, } from "../runtime/index.js";
 import { listAvailableSkills, installSkill, readInstalledSkills, } from "../skills/index.js";
 import { queryStatus, querySources, queryDataList, queryDataShow, queryDoctor, } from "./queries.js";
 import { checkForUpdate, readUpdateCheck, isNewerVersion, } from "./update-check.js";
+import { loadCredentials, saveCredentials, clearCredentials, isExpired, formatAddress, formatExpiresIn, getAuthTarget, resolvePersonalServerUrl, runDeviceCodeFlow, runSelfHostedLoginFlow, } from "./auth.js";
 function cleanDescription(desc) {
     return desc
         .replace(/ using Playwright browser automation\.?/i, ".")
@@ -73,6 +74,7 @@ export async function runCli(argv = process.argv) {
         .showSuggestionAfterError(true)
         .addHelpText("after", `
 Quick start:
+  vana login             Log in to your Vana account
   vana connect           Connect a source and collect data
   vana sources           Browse available sources
   vana status            Check system health
@@ -330,6 +332,19 @@ Examples:
         .action(async (scope) => {
         process.exitCode = await runServerData(scope, parsedOptions);
     });
+    program
+        .command("login")
+        .description("Log in to your Vana account or a self-hosted Personal Server")
+        .option("-s, --server <url>", "Self-hosted Personal Server URL")
+        .action(async (loginOptions) => {
+        process.exitCode = await runLogin(parsedOptions, loginOptions.server);
+    });
+    program
+        .command("logout")
+        .description("Log out and remove saved credentials")
+        .action(async () => {
+        process.exitCode = await runLogout(parsedOptions);
+    });
     program
         .command("mcp")
         .description("Start MCP server for agent integration")
@@ -834,6 +849,8 @@ async function runConnect(rawSource, options) {
                 const ingestCompleted = ingestEvents.some((ingestEvent) => ingestEvent.type === "ingest-complete");
                 const ingestPartial = ingestEvents.some((ingestEvent) => ingestEvent.type === "ingest-partial");
                 const ingestFailedEvent = ingestEvents.find((ingestEvent) => ingestEvent.type === "ingest-failed");
+                const ingestSkippedUnavailable = ingestEvents.some((ingestEvent) => ingestEvent.type === "ingest-skipped" &&
+                    ingestEvent.reason === "personal_server_unavailable");
                 if (ingestCompleted) {
                     finalStatus = CliOutcomeStatus.CONNECTED_AND_INGESTED;
                     finalDataState = "ingested_personal_server";
@@ -848,6 +865,10 @@ async function runConnect(rawSource, options) {
                     ingestFailureMessage =
                         ingestFailedEvent.message ?? "Personal Server sync failed.";
                 }
+                else if (ingestSkippedUnavailable) {
+                    finalStatus = CliOutcomeStatus.CONNECTED_LOCAL_ONLY;
+                    finalDataState = "ingest_unavailable";
+                }
                 else {
                     finalStatus = CliOutcomeStatus.CONNECTED_LOCAL_ONLY;
                     finalDataState = "collected_local";
@@ -920,6 +941,9 @@ async function runConnect(rawSource, options) {
         else if (finalStatus === CliOutcomeStatus.CONNECTED_AND_INGESTED) {
             successSummary = `Collected your ${displayName} data and synced it to your Personal Server.`;
         }
+        else if (finalDataState === "ingest_unavailable") {
+            successSummary = `Collected your ${displayName} data. Personal Server sync is pending.`;
+        }
         else {
             successSummary = `Collected your ${displayName} data and saved it locally.`;
         }
@@ -932,6 +956,10 @@ async function runConnect(rawSource, options) {
         if (failedCount > 0 && storedCount > 0) {
             renderer?.detail(`Retry: vana server sync`);
         }
+        else if (finalDataState === "ingest_unavailable") {
+            renderer?.detail(`Pending sync will retry during scheduled collection.`);
+            renderer?.detail(`Retry now: vana server sync`);
+        }
         // Journey-aware next step
         const state = await readCliState();
         const connectedSourceCount = Object.values(state.sources ?? {}).filter((s) => hasCollectedData(s?.dataState)).length;
@@ -1151,10 +1179,19 @@ async function runStatus(options) {
         }
     }
     if (options.json) {
+        const jsonAuthCreds = loadCredentials();
         const compactJson = {
             runtime: status.runtime,
             personalServer: status.personalServer,
             personalServerUrl: status.personalServerUrl,
+            pendingSyncCount: status.pendingSyncCount ?? 0,
+            auth: jsonAuthCreds
+                ? {
+                    authenticated: !isExpired(jsonAuthCreds),
+                    address: jsonAuthCreds.account.address,
+                    expires_at: jsonAuthCreds.account.expires_at,
+                }
+                : { authenticated: false },
             sources: {
                 connected: status.summary?.connectedCount ?? 0,
                 needsAttention: status.summary?.needsAttentionCount ?? 0,
@@ -1177,60 +1214,55 @@ async function runStatus(options) {
     else {
         emit.keyValue("Personal Server", "not connected", "warning");
     }
-    const connectedCount = status.summary?.connectedCount ?? 0;
-    const attentionCount = status.summary?.needsAttentionCount ?? 0;
+    // Auth state
+    const authCreds = loadCredentials();
+    if (authCreds && !isExpired(authCreds)) {
+        emit.keyValue("Account", formatAddress(authCreds.account.address), "success");
+        emit.keyValue("Auth", `Authenticated (expires in ${formatExpiresIn(authCreds.account.expires_at)})`, "success");
+    }
+    else {
+        emit.keyValue("Account", "Not logged in", "muted");
+        emit.keyValue("Auth", "Run `vana login` to authenticate", "muted");
+    }
+    const trackedSources = status.sources.filter(shouldDisplaySourceInStatus);
+    const attentionSources = trackedSources
+        .filter(isSourceAttention)
+        .sort(compareAttentionPriority);
+    const healthySources = trackedSources
+        .filter((source) => !isSourceAttention(source))
+        .sort(compareSourceStatusOrder);
     const sourceParts = [
-        connectedCount > 0 ? `${connectedCount} connected` : "none connected",
-        ...(connectedCount > 0 && attentionCount > 0
-            ? [`${attentionCount} need${attentionCount === 1 ? "s" : ""} attention`]
+        healthySources.length > 0
+            ? `${healthySources.length} healthy`
+            : trackedSources.length > 0
+                ? "none healthy"
+                : "none connected",
+        ...(attentionSources.length > 0
+            ? [
+                `${attentionSources.length} need${attentionSources.length === 1 ? "s" : ""} attention`,
+            ]
             : []),
     ];
-    emit.keyValue("Sources", sourceParts.join(", "), attentionCount > 0 && connectedCount > 0
+    emit.keyValue("Sources", sourceParts.join(", "), attentionSources.length > 0 && healthySources.length > 0
         ? "warning"
-        : connectedCount > 0
+        : healthySources.length > 0
             ? "success"
             : "muted");
-    // Show per-source health when sources are connected
-    const connectedSources = Object.entries(state.sources).filter(([, stored]) => stored?.connectorInstalled &&
-        (stored.dataState === "collected_local" ||
-            stored.dataState === "ingested_personal_server" ||
-            stored.dataState === "ingest_failed" ||
-            stored.connectionHealth));
-    if (connectedSources.length > 0) {
+    if ((status.pendingSyncCount ?? 0) > 0) {
+        emit.keyValue("Pending sync", `${status.pendingSyncCount} dataset(s)`, "warning");
+    }
+    if (attentionSources.length > 0) {
         emit.blank();
-        let needsReauthSource = null;
-        for (const [sourceId, stored] of connectedSources) {
-            const health = stored?.connectionHealth ?? "healthy";
-            const displayName = displaySource(sourceId, sourceLabels);
-            const sourceStatus = status.sources.find((s) => s.source === sourceId);
-            const sourceOverdue = sourceStatus?.isOverdue ?? false;
-            const healthTone = sourceOverdue ? "warning" : toneForHealth(health);
-            const healthLabel = health === "needs_reauth" ? "needs login" : health;
-            const staleTag = sourceOverdue
-                ? ` ${emit.badge("stale", "warning")}`
-                : "";
-            const collectedAgo = stored?.lastCollectedAt
-                ? `collected ${formatRelativeTime(stored.lastCollectedAt)}`
-                : "";
-            emit.keyValue(`  ${displayName}`, `${healthLabel}${staleTag}     ${collectedAgo}`, healthTone);
-            if ((health === "needs_reauth" || health === "error") &&
-                stored?.connectionHealthReason) {
-                const msg = formatHealthMessage(stored.connectionHealthReason);
-                const ago = stored.connectionHealthChangedAt
-                    ? ` (${formatRelativeTime(stored.connectionHealthChangedAt)})`
-                    : "";
-                if (msg) {
-                    emit.detail(`  \u21b3 ${msg}${ago} Run \`vana connect ${sourceId}\``);
-                }
-            }
-            if (health === "needs_reauth" && !needsReauthSource) {
-                needsReauthSource = sourceId;
-            }
+        emit.section(formatCountLabel("Needs attention", attentionSources.length));
+        for (const source of attentionSources) {
+            emitHumanStatusSource(emit, source, sourceLabels);
         }
-        if (needsReauthSource) {
-            emit.blank();
-            emit.next(`vana connect ${needsReauthSource}`);
-            return 0;
+    }
+    if (healthySources.length > 0) {
+        emit.blank();
+        emit.section(formatCountLabel("Healthy", healthySources.length));
+        for (const source of healthySources) {
+            emitHumanStatusSource(emit, source, sourceLabels);
         }
     }
     if (nextSteps.length > 0) {
@@ -1245,6 +1277,88 @@ async function runStatus(options) {
     }
     return 0;
 }
+function shouldDisplaySourceInStatus(source) {
+    return (source.installed ||
+        Boolean(source.lastRunOutcome) ||
+        source.dataState !== "none" ||
+        Boolean(source.connectionHealth));
+}
+function emitHumanStatusSource(emit, source, sourceLabels) {
+    const displayName = displaySource(source.source, sourceLabels);
+    const presentation = getHumanStatusPresentation(source);
+    const staleTag = source.isOverdue ? ` ${emit.badge("stale", "warning")}` : "";
+    const collectedAgo = source.lastCollectedAt
+        ? `collected ${formatRelativeTime(source.lastCollectedAt)}`
+        : "";
+    emit.keyValue(`  ${displayName}`, `${presentation.label}${staleTag}${collectedAgo ? `     ${collectedAgo}` : ""}`, presentation.tone);
+    const detail = formatHumanStatusDetail(source);
+    if (detail) {
+        emit.detail(`  \u21b3 ${detail}`);
+    }
+}
+function getHumanStatusPresentation(source) {
+    if (source.dataState === "ingest_failed") {
+        return { label: "sync failed", tone: "warning" };
+    }
+    if (source.dataState === "ingest_unavailable") {
+        return { label: "pending sync", tone: "warning" };
+    }
+    if (source.connectionHealth === "needs_reauth") {
+        return { label: "needs login", tone: "warning" };
+    }
+    if (source.connectionHealth === "error") {
+        return { label: "error", tone: "error" };
+    }
+    const presentation = getSourceStatusPresentation(source);
+    if (presentation.label === "needs input") {
+        return { label: "needs login", tone: presentation.tone };
+    }
+    return presentation;
+}
+function formatHumanStatusDetail(source) {
+    if (source.dataState === "ingest_failed") {
+        return formatSyncFailureSummary(source);
+    }
+    if (source.dataState === "ingest_unavailable") {
+        return "Personal Server unavailable. Pending sync will retry during scheduled collection. Run `vana server sync`.";
+    }
+    if (source.connectionHealth === "needs_reauth" ||
+        source.lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT) {
+        return `Authentication required. Run \`vana connect ${source.source}\`.`;
+    }
+    if (source.lastRunOutcome === CliOutcomeStatus.LEGACY_AUTH) {
+        return `Manual auth step required. Run \`vana connect ${source.source}\`.`;
+    }
+    if (source.connectionHealth === "error") {
+        const message = formatHealthMessage(source.connectionHealthReason);
+        return `${message ?? "Collection failed."} Run \`vana connect ${source.source}\`.`;
+    }
+    if (source.lastRunOutcome === CliOutcomeStatus.RUNTIME_ERROR) {
+        return `${humanizeIssue(source.lastError ?? "Collection failed")}. Run \`vana connect ${source.source}\`.`;
+    }
+    if (source.lastRunOutcome === CliOutcomeStatus.CONNECTOR_UNAVAILABLE) {
+        return "No connector available. Run `vana sources`.";
+    }
+    return null;
+}
+function formatSyncFailureSummary(source) {
+    const failedScopes = source.ingestScopes?.filter((scope) => scope.status === "failed") ?? [];
+    if (failedScopes.length === 0) {
+        return `Personal Server sync failed. Run \`vana connect ${source.source}\`.`;
+    }
+    const groupedFailures = new Map();
+    for (const failedScope of failedScopes) {
+        const summary = humanizeIssue(failedScope.error ?? "Sync failed");
+        groupedFailures.set(summary, (groupedFailures.get(summary) ?? 0) + 1);
+    }
+    const entries = Array.from(groupedFailures.entries());
+    if (entries.length === 1) {
+        const [summary, count] = entries[0];
+        return `${summary}${count > 1 ? ` for ${count} scopes` : ""}. Run \`vana connect ${source.source}\`.`;
+    }
+    const summaryParts = entries.map(([summary, count]) => count > 1 ? `${summary} (${count})` : summary);
+    return `${failedScopes.length} scopes failed to sync: ${summaryParts.join("; ")}. Run \`vana connect ${source.source}\`.`;
+}
 async function runDoctor(options) {
     const payload = await queryDoctor();
     if (options.json) {
@@ -1353,9 +1467,11 @@ async function runServerStatus(options) {
             ? "(auto-detected)"
             : target.source === "config"
                 ? "(saved)"
-                : target.source === "env"
-                    ? "(from VANA_PERSONAL_SERVER_URL)"
-                    : `(${target.source ?? "unknown"})`;
+                : target.source === "auth"
+                    ? "(from vana login)"
+                    : target.source === "env"
+                        ? "(from VANA_PERSONAL_SERVER_URL)"
+                        : `(${target.source ?? "unknown"})`;
         emit.keyValue("URL", `${target.url} ${urlSuffix}`, "muted");
     }
     const stateLabel = target.state === "available" ? "healthy" : "Not connected";
@@ -1937,6 +2053,105 @@ async function runCollect(source, options) {
     }
     return runConnect(source, options);
 }
+function isPendingSyncDataState(dataState) {
+    return dataState === "collected_local" || dataState === "ingest_unavailable";
+}
+function shouldRetryPendingSource(stored, mode) {
+    if (!stored?.lastResultPath) {
+        return false;
+    }
+    if (isPendingSyncDataState(stored.dataState)) {
+        return true;
+    }
+    if (mode === "manual") {
+        return (stored.dataState === "ingest_failed" ||
+            stored.ingestScopes?.some((scope) => scope.status === "failed") === true);
+    }
+    return false;
+}
+function buildRetryOptions(stored, mode) {
+    if (!stored) {
+        return undefined;
+    }
+    if (mode !== "manual") {
+        return undefined;
+    }
+    const failedScopes = stored.ingestScopes
+        ?.filter((scope) => scope.status === "failed")
+        .map((scope) => scope.scope) ?? [];
+    return failedScopes.length > 0 ? { scopes: failedScopes } : undefined;
+}
+function mergeIngestScopes(previous, current) {
+    if (!previous && !current) {
+        return undefined;
+    }
+    const merged = new Map();
+    for (const scope of previous ?? []) {
+        merged.set(scope.scope, { ...scope });
+    }
+    const now = new Date().toISOString();
+    for (const scope of current ?? []) {
+        merged.set(scope.scope, {
+            scope: scope.scope,
+            status: scope.status === "stored" ? "stored" : "failed",
+            syncedAt: scope.status === "stored" ? now : merged.get(scope.scope)?.syncedAt,
+            error: scope.status === "failed" ? scope.error : undefined,
+        });
+    }
+    return Array.from(merged.values()).sort((left, right) => left.scope.localeCompare(right.scope));
+}
+function deriveSyncedDataState(scopes, fallback) {
+    if (!scopes || scopes.length === 0) {
+        return fallback ?? "ingest_unavailable";
+    }
+    const storedCount = scopes.filter((scope) => scope.status === "stored").length;
+    const failedCount = scopes.filter((scope) => scope.status === "failed").length;
+    if (storedCount === 0 && failedCount > 0) {
+        return "ingest_failed";
+    }
+    return "ingested_personal_server";
+}
+function summarizeSyncError(scopes) {
+    const failedScopes = scopes?.filter((scope) => scope.status === "failed") ?? [];
+    if (failedScopes.length === 0) {
+        return null;
+    }
+    return failedScopes
+        .map((scope) => `${scope.scope}: ${scope.error ?? "sync failed"}`)
+        .join("; ");
+}
+async function syncPendingSources(target, mode) {
+    const state = await readCliState();
+    const pendingSources = Object.entries(state.sources).filter(([, stored]) => shouldRetryPendingSource(stored, mode));
+    if (pendingSources.length === 0) {
+        return { syncedCount: 0, sourceResults: [] };
+    }
+    let syncedCount = 0;
+    const sourceResults = [];
+    for (const [source, stored] of pendingSources) {
+        if (!stored?.lastResultPath) {
+            continue;
+        }
+        const ingestOptions = buildRetryOptions(stored, mode);
+        const ingestEvents = await ingestResult(source, stored.lastResultPath, target, ingestOptions);
+        const resultEvent = ingestEvents.find((event) => event.type === "ingest-complete" ||
+            event.type === "ingest-partial" ||
+            event.type === "ingest-failed");
+        const mergedScopes = mergeIngestScopes(stored.ingestScopes, resultEvent?.scopeResults);
+        const ingestCompleted = ingestEvents.some((event) => event.type === "ingest-complete");
+        const ingestPartial = ingestEvents.some((event) => event.type === "ingest-partial");
+        if (ingestCompleted || ingestPartial) {
+            syncedCount++;
+            await updateSourceState(source, {
+                dataState: deriveSyncedDataState(mergedScopes, stored.dataState),
+                ingestScopes: mergedScopes,
+                lastError: summarizeSyncError(mergedScopes),
+            });
+        }
+        sourceResults.push({ source, scopeResults: resultEvent?.scopeResults });
+    }
+    return { syncedCount, sourceResults };
+}
 async function runCollectAll(options) {
     const emit = createEmitter(options);
     const state = await readCliState();
@@ -1944,22 +2159,37 @@ async function runCollectAll(options) {
         .filter(([, stored]) => stored?.connectorInstalled &&
         isCollectionDue(stored.exportFrequency, stored.lastCollectedAt))
         .map(([id]) => id);
+    let exitCode = 0;
+    for (const source of dueSources) {
+        const result = await runConnect(source, options);
+        if (result !== 0) {
+            exitCode = result;
+        }
+    }
+    let syncedPendingCount = 0;
+    const target = await detectPersonalServerTarget();
+    if (target.state === "available") {
+        syncedPendingCount = (await syncPendingSources(target, "automatic"))
+            .syncedCount;
+    }
     if (dueSources.length === 0) {
+        if (syncedPendingCount > 0) {
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify({ message: `Synced ${syncedPendingCount} pending dataset(s).`, count: 0, syncedPendingCount })}\n`);
+            }
+            else {
+                emit.info(`Synced ${syncedPendingCount} pending dataset(s).`);
+            }
+            return 0;
+        }
         if (options.json) {
-            process.stdout.write(`${JSON.stringify({ message: "No sources are due for collection.", count: 0 })}\n`);
+            process.stdout.write(`${JSON.stringify({ message: "No sources are due for collection.", count: 0, syncedPendingCount: 0 })}\n`);
         }
         else {
             emit.info("No sources are due for collection.");
         }
         return 0;
     }
-    let exitCode = 0;
-    for (const source of dueSources) {
-        const result = await runConnect(source, options);
-        if (result !== 0) {
-            exitCode = result;
-        }
-    }
     return exitCode;
 }
 async function runServerSync(options) {
@@ -1977,13 +2207,8 @@ async function runServerSync(options) {
         }
         return 1;
     }
-    const state = await readCliState();
-    // Find sources that are local-only OR have failed ingest scopes
-    const pendingSources = Object.entries(state.sources).filter(([, stored]) => stored?.lastResultPath &&
-        (stored.dataState === "collected_local" ||
-            stored.dataState === "ingest_failed" ||
-            stored?.ingestScopes?.some((s) => s.status === "failed")));
-    if (pendingSources.length === 0) {
+    const syncResult = await syncPendingSources(target, "manual");
+    if (syncResult.sourceResults.length === 0) {
         if (options.json) {
             process.stdout.write(`${JSON.stringify({ message: "No pending datasets to sync.", syncedCount: 0 })}\n`);
         }
@@ -1992,46 +2217,13 @@ async function runServerSync(options) {
         }
         return 0;
     }
-    let syncedCount = 0;
-    const allScopeResults = [];
-    for (const [source, stored] of pendingSources) {
-        if (!stored?.lastResultPath) {
-            continue;
-        }
-        const ingestEvents = await ingestResult(source, stored.lastResultPath, target);
-        const resultEvent = ingestEvents.find((e) => e.type === "ingest-complete" ||
-            e.type === "ingest-partial" ||
-            e.type === "ingest-failed");
-        const scopeResults = resultEvent?.scopeResults;
-        const ingestCompleted = ingestEvents.some((e) => e.type === "ingest-complete");
-        const ingestPartial = ingestEvents.some((e) => e.type === "ingest-partial");
-        if (ingestCompleted || ingestPartial) {
-            syncedCount++;
-            const dataState = ingestCompleted || ingestPartial
-                ? "ingested_personal_server"
-                : stored.dataState;
-            await updateSourceState(source, {
-                dataState,
-                ingestScopes: scopeResults?.map((r) => ({
-                    scope: r.scope,
-                    status: r.status,
-                    syncedAt: r.status === "stored" ? new Date().toISOString() : undefined,
-                    error: r.error,
-                })),
-            });
-        }
-        allScopeResults.push({ source, scopeResults });
-        for (const event of ingestEvents) {
-            emit.event(event);
-        }
-    }
     if (options.json) {
-        process.stdout.write(`${JSON.stringify({ message: `Synced ${syncedCount} dataset(s).`, syncedCount })}\n`);
+        process.stdout.write(`${JSON.stringify({ message: `Synced ${syncResult.syncedCount} dataset(s).`, syncedCount: syncResult.syncedCount })}\n`);
     }
     else {
         // Show per-scope results with scope manifest style
         const renderer = createHumanRenderer();
-        for (const entry of allScopeResults) {
+        for (const entry of syncResult.sourceResults) {
             if (entry.scopeResults && entry.scopeResults.length > 0) {
                 emit.info(`${entry.source}:`);
                 for (const sr of entry.scopeResults) {
@@ -2046,9 +2238,9 @@ async function runServerSync(options) {
             }
         }
         emit.blank();
-        const allStored = allScopeResults.every((entry) => !entry.scopeResults ||
+        const allStored = syncResult.sourceResults.every((entry) => !entry.scopeResults ||
             entry.scopeResults.every((sr) => sr.status === "stored"));
-        emit.success(`Synced ${syncedCount} dataset(s).`);
+        emit.success(`Synced ${syncResult.syncedCount} dataset(s).`);
         emit.blank();
         if (allStored) {
             emit.next("vana data list");
@@ -2074,12 +2266,20 @@ async function runServerData(scope, options) {
     }
     // If PS is available, try to list remote scopes via client
     let remoteScopes = [];
+    let didQueryRemoteScopes = false;
     let remoteScopeFallbackReason;
     if (target.state === "available" && target.url) {
+        const auth = resolvePersonalServerAuthConfig(target.url);
         try {
-            const { createPersonalServerClient: createClient } = await import("../personal-server/client.js");
-            const client = createClient({ url: target.url });
-            remoteScopes = await client.listScopes(scope);
+            if (auth?.type === "bearerToken") {
+                const { createPersonalServerClient: createClient } = await import("../personal-server/client.js");
+                const client = createClient({
+                    url: target.url,
+                    auth,
+                });
+                didQueryRemoteScopes = true;
+                remoteScopes = await client.listScopes(scope);
+            }
         }
         catch (err) {
             remoteScopeFallbackReason =
@@ -2087,7 +2287,7 @@ async function runServerData(scope, options) {
         }
     }
     // Use remote scopes if available, otherwise fall back to local
-    const scopeList = remoteScopes.length > 0
+    const scopeList = didQueryRemoteScopes
         ? remoteScopes.map((s) => ({
             scope: s.scope,
             detail: `${s.count} version${s.count !== 1 ? "s" : ""}`,
@@ -2100,13 +2300,15 @@ async function runServerData(scope, options) {
         process.stdout.write(`${JSON.stringify({
             count: scopeList.length,
             scopes: scopeList,
-            source: remoteScopes.length > 0 ? "remote" : "local",
+            source: didQueryRemoteScopes ? "remote" : "local",
             ...(remoteScopeFallbackReason ? { remoteScopeFallbackReason } : {}),
         })}\n`);
         return 0;
     }
     if (scopeList.length === 0) {
-        emit.info("No scopes found.");
+        emit.info(didQueryRemoteScopes
+            ? "No data on your Personal Server."
+            : "No scopes found.");
         if (target.state !== "available") {
             emit.detail("Personal Server is not available. Showing locally-known scopes only.");
         }
@@ -2115,7 +2317,7 @@ async function runServerData(scope, options) {
     for (const entry of scopeList) {
         emit.keyValue(entry.scope, entry.detail, "muted");
     }
-    if (remoteScopes.length === 0 && localScopes.length > 0) {
+    if (!didQueryRemoteScopes && localScopes.length > 0) {
         emit.blank();
         emit.detail("Showing locally-known scopes. Connect your Personal Server for live data.");
     }
@@ -2303,6 +2505,62 @@ export function humanizeIssue(message) {
     if (/checksum|mismatch/i.test(message)) {
         return "Connector is out of date. Will auto-update on next connect.";
     }
+    const transportSummary = summarizeTransportError(message);
+    if (transportSummary) {
+        return transportSummary;
+    }
+    return message;
+}
+function summarizeTransportError(message) {
+    const httpMatch = message.match(/^HTTP\s+\d+:\s*(.+)$/s);
+    if (!httpMatch) {
+        return null;
+    }
+    const payload = httpMatch[1].trim();
+    const parsed = parseTransportErrorPayload(payload);
+    if (parsed) {
+        return parsed.message;
+    }
+    const messageMatch = payload.match(/"message"\s*:\s*"([^"]+)"/);
+    if (messageMatch) {
+        return messageMatch[1];
+    }
+    return "Request failed";
+}
+function parseTransportErrorPayload(payload) {
+    try {
+        const parsed = JSON.parse(payload);
+        const rawError = typeof parsed.error === "string"
+            ? parsed.error
+            : parsed.error && typeof parsed.error === "object"
+                ? (parsed.error.errorCode ??
+                    parsed.error.code)
+                : undefined;
+        const rawMessage = typeof parsed.message === "string"
+            ? parsed.message
+            : parsed.error && typeof parsed.error === "object"
+                ? parsed.error.message
+                : undefined;
+        const code = typeof rawError === "string" || typeof rawError === "number"
+            ? String(rawError)
+            : undefined;
+        const message = typeof rawMessage === "string" ? rawMessage : "Request failed";
+        return { code, message: summarizeTransportCode(code, message) };
+    }
+    catch {
+        return null;
+    }
+}
+function summarizeTransportCode(code, message) {
+    if (code === "MISSING_AUTH" || /missing authentication/i.test(message)) {
+        return "Authentication required";
+    }
+    if (code === "NO_SCHEMA" || /no schema registered/i.test(message)) {
+        return "No schema registered";
+    }
+    if (code === "INVALID_SCOPE" || /scope must be/i.test(message)) {
+        return "Unsupported scope";
+    }
     return message;
 }
 function formatHumanSourceMessage(message, source, displayName) {
@@ -2336,11 +2594,13 @@ export async function gatherSourceStatuses(storedSources, metadata = {}) {
         const details = metadata[source];
         const dataState = stored.dataState === "ingested_personal_server"
             ? "ingested_personal_server"
-            : stored.dataState === "ingest_failed"
-                ? "ingest_failed"
-                : stored.dataState === "collected_local"
-                    ? "collected_local"
-                    : "none";
+            : stored.dataState === "ingest_unavailable"
+                ? "ingest_unavailable"
+                : stored.dataState === "ingest_failed"
+                    ? "ingest_failed"
+                    : stored.dataState === "collected_local"
+                        ? "collected_local"
+                        : "none";
         const ingestScopes = stored.ingestScopes;
         const syncedScopeCount = ingestScopes?.filter((s) => s.status === "stored").length ?? 0;
         const failedScopeCount = ingestScopes?.filter((s) => s.status === "failed").length ?? 0;
@@ -2499,6 +2759,14 @@ function formatSourceStatusDetails(source) {
             tone: "success",
         });
     }
+    else if (source.dataState === "ingest_unavailable") {
+        details.push({
+            kind: "row",
+            label: "State",
+            value: "Pending sync to Personal Server",
+            tone: "warning",
+        });
+    }
     else if (source.dataState === "ingest_failed") {
         details.push({
             kind: "row",
@@ -2554,11 +2822,15 @@ function formatSourceStatusDetails(source) {
 }
 export function buildStatusNextSteps(sources, sourceLabels = {}, runtime = "unhealthy", availableSources = []) {
     const nextSteps = [];
-    const highestPriority = [...sources].sort(compareSourceStatusOrder)[0];
+    const attentionSources = [...sources]
+        .filter(isSourceAttention)
+        .sort(compareAttentionPriority);
+    const highestPriority = attentionSources[0] ?? [...sources].sort(compareSourceStatusOrder)[0];
     const connectedSources = sources.filter((source) => source.dataState === "collected_local" ||
         source.dataState === "ingested_personal_server" ||
-        source.dataState === "ingest_failed");
-    const needsAttention = sources.some((source) => rankSourceStatus(source) <= 4);
+        source.dataState === "ingest_failed" ||
+        source.dataState === "ingest_unavailable");
+    const needsAttention = attentionSources.length > 0;
     const highestPriorityLabel = highestPriority
         ? displaySource(highestPriority.source, sourceLabels)
         : null;
@@ -2581,8 +2853,22 @@ export function buildStatusNextSteps(sources, sourceLabels = {}, runtime = "unhe
             nextSteps.push("Inspect install health with `vana doctor`.");
         }
     }
-    else if (highestPriority.lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT) {
-        nextSteps.push(`Continue ${highestPriorityLabel} with \`vana connect ${highestPriority.source}\`.`);
+    else if (highestPriority.dataState === "ingest_failed") {
+        nextSteps.push(`Reconnect ${highestPriorityLabel} with \`vana connect ${highestPriority.source}\`.`);
+    }
+    else if (highestPriority.dataState === "ingest_unavailable") {
+        nextSteps.push("Retry pending Personal Server sync with `vana server sync`.");
+    }
+    else if (highestPriority.connectionHealth === "needs_reauth" ||
+        highestPriority.lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT) {
+        nextSteps.push(`Reconnect ${highestPriorityLabel} with \`vana connect ${highestPriority.source}\`.`);
+        if (highestPriority.lastLogPath) {
+            nextSteps.push(`Inspect the latest run log with \`vana logs ${highestPriority.source}\`.`);
+        }
+    }
+    else if (highestPriority.connectionHealth === "error" ||
+        highestPriority.lastRunOutcome === CliOutcomeStatus.RUNTIME_ERROR) {
+        nextSteps.push(`Retry ${highestPriorityLabel} with \`vana connect ${highestPriority.source}\`.`);
         if (highestPriority.lastLogPath) {
             nextSteps.push(`Inspect the latest run log with \`vana logs ${highestPriority.source}\`.`);
         }
@@ -2600,8 +2886,7 @@ export function buildStatusNextSteps(sources, sourceLabels = {}, runtime = "unhe
         }
     }
     else if (highestPriority.dataState === "collected_local" ||
-        highestPriority.dataState === "ingested_personal_server" ||
-        highestPriority.dataState === "ingest_failed") {
+        highestPriority.dataState === "ingested_personal_server") {
         if (connectedSources.length > 1) {
             nextSteps.push("Review your collected data with `vana data list`.");
         }
@@ -2872,6 +3157,11 @@ export function getSourceStatusPresentation(source) {
     if (!source.installed && !source.lastRunOutcome) {
         return { label: "not connected", tone: "muted" };
     }
+    // Check dataState before early-returning on missing lastRunOutcome —
+    // ingest can fail even when lastRunOutcome is unset
+    if (source.dataState === "ingest_failed") {
+        return { label: "sync failed", tone: "error" };
+    }
     if (!source.lastRunOutcome) {
         return { label: "installed", tone: "success" };
     }
@@ -2901,12 +3191,12 @@ export function getSourceStatusPresentation(source) {
         }
         return { label: "synced", tone: "success" };
     }
+    if (source.dataState === "ingest_unavailable") {
+        return { label: "pending sync", tone: "warning" };
+    }
     if (source.dataState === "collected_local") {
         return { label: "local", tone: "muted" };
     }
-    if (source.dataState === "ingest_failed") {
-        return { label: "sync failed", tone: "error" };
-    }
     return { label: "connected", tone: "success" };
 }
 export function toneForRuntime(runtime) {
@@ -2993,6 +3283,48 @@ export function compareSourceStatusOrder(left, right) {
             authMode: right.authMode,
         }));
 }
+export function isSourceAttention(source) {
+    if (source.dataState === "ingest_failed" ||
+        source.dataState === "ingest_unavailable") {
+        return true;
+    }
+    if (source.connectionHealth === "needs_reauth" ||
+        source.connectionHealth === "error" ||
+        source.connectionHealth === "stale") {
+        return true;
+    }
+    return rankSourceStatus(source) <= 4;
+}
+function compareAttentionPriority(left, right) {
+    const rank = (source) => {
+        if (source.dataState === "ingest_failed") {
+            return 0;
+        }
+        if (source.dataState === "ingest_unavailable") {
+            return 1;
+        }
+        if (source.connectionHealth === "needs_reauth") {
+            return 2;
+        }
+        if (source.connectionHealth === "error") {
+            return 3;
+        }
+        if (source.lastRunOutcome === CliOutcomeStatus.RUNTIME_ERROR) {
+            return 4;
+        }
+        if (source.lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT) {
+            return 5;
+        }
+        if (source.lastRunOutcome === CliOutcomeStatus.LEGACY_AUTH) {
+            return 6;
+        }
+        if (source.lastRunOutcome === CliOutcomeStatus.CONNECTOR_UNAVAILABLE) {
+            return 7;
+        }
+        return 8;
+    };
+    return rank(left) - rank(right) || compareSourceStatusOrder(left, right);
+}
 export function rankSourceStatus(source) {
     if (source.lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT) {
         return 0;
@@ -3009,6 +3341,9 @@ export function rankSourceStatus(source) {
     if (source.lastRunOutcome === CliOutcomeStatus.CONNECTOR_UNAVAILABLE) {
         return 4;
     }
+    if (source.dataState === "ingest_failed") {
+        return 2;
+    }
     if (source.dataState === "ingested_personal_server") {
         return 5;
     }
@@ -3129,6 +3464,7 @@ function compareLogRecordOrder(left, right) {
 }
 export function hasCollectedData(dataState) {
     return (dataState === "collected_local" ||
+        dataState === "ingest_unavailable" ||
         dataState === "ingested_personal_server" ||
         dataState === "ingest_failed");
 }
@@ -3148,6 +3484,9 @@ function formatLogOutcomeLabel(lastRunOutcome, dataState) {
     if (dataState === "ingested_personal_server") {
         return "synced";
     }
+    if (dataState === "ingest_unavailable") {
+        return "pending sync";
+    }
     if (dataState === "ingest_failed") {
         return "sync failed";
     }
@@ -3169,7 +3508,8 @@ function toneForLogOutcome(lastRunOutcome, dataState) {
     if (lastRunOutcome === CliOutcomeStatus.CONNECTOR_UNAVAILABLE ||
         lastRunOutcome === CliOutcomeStatus.LEGACY_AUTH ||
         lastRunOutcome === CliOutcomeStatus.NEEDS_INPUT ||
-        dataState === "ingest_failed") {
+        dataState === "ingest_failed" ||
+        dataState === "ingest_unavailable") {
         return "warning";
     }
     if (dataState === "ingested_personal_server") {
@@ -3180,20 +3520,6 @@ function toneForLogOutcome(lastRunOutcome, dataState) {
     }
     return "muted";
 }
-function toneForHealth(health) {
-    switch (health) {
-        case "healthy":
-            return "accent";
-        case "needs_reauth":
-            return "warning";
-        case "error":
-            return "error";
-        case "stale":
-            return "muted";
-        default:
-            return "muted";
-    }
-}
 // ---------------------------------------------------------------------------
 // Detach (background process)
 // ---------------------------------------------------------------------------
@@ -3899,4 +4225,195 @@ async function runSkillShow(name, options) {
         return 1;
     }
 }
+// ── Login / Logout ─────────────────────────────────────────────────────
+async function runLogin(options, serverUrl) {
+    // Determine auth target: cloud (account.vana.org) or self-hosted (PS directly)
+    const psUrl = serverUrl ?? resolvePersonalServerUrl() ?? null;
+    const authTarget = getAuthTarget(psUrl);
+    // If self-hosted, use /auth/device flow against the PS
+    if (authTarget === "self-hosted" && psUrl) {
+        const renderer = !options.json && !options.quiet ? createLoginRenderer() : null;
+        renderer?.title(psUrl);
+        try {
+            const result = await runSelfHostedLoginFlow(psUrl, (url) => {
+                renderer?.note("Open this URL in your browser:");
+                renderer?.note(url);
+                renderer?.scopeActive("Waiting for authorization");
+                // Try to open browser — use spawn with args array to prevent shell injection
+                // (a malicious self-hosted PS could return a URL with shell metacharacters)
+                try {
+                    const { spawn } = require("node:child_process");
+                    const opener = process.platform === "darwin"
+                        ? "open"
+                        : process.platform === "win32"
+                            ? "start"
+                            : "xdg-open";
+                    spawn(opener, [url], { detached: true, stdio: "ignore" }).unref();
+                }
+                catch {
+                    // Browser open failed — user will open manually
+                }
+            });
+            await saveCredentials({
+                account: {
+                    address: result.address,
+                    session_token: "",
+                    expires_at: result.expires_at,
+                },
+                personal_server: {
+                    url: psUrl,
+                    session_token: result.session_token,
+                    expires_at: result.expires_at,
+                },
+            });
+            await updateCliConfig({ personalServerUrl: psUrl });
+            renderer?.success(`Logged in to ${psUrl}`);
+            renderer?.detail("Credentials saved to ~/.vana/auth.json");
+            return 0;
+        }
+        catch (err) {
+            renderer?.fail("Login failed");
+            renderer?.detail(err instanceof Error ? err.message : String(err));
+            renderer?.next(`vana login --server ${psUrl}`);
+            return 1;
+        }
+        finally {
+            renderer?.cleanup();
+        }
+    }
+    // Cloud flow (account.vana.org)
+    // Check env var shortcut
+    const envToken = process.env.VANA_SESSION_TOKEN;
+    if (envToken) {
+        const creds = loadCredentials();
+        if (creds) {
+            if (options.json) {
+                process.stdout.write(`${JSON.stringify({ status: "authenticated", source: "env", address: creds.account.address })}\n`);
+            }
+            else {
+                const emit = createEmitter(options);
+                emit.success(`Already authenticated via VANA_SESSION_TOKEN env var`);
+            }
+            return 0;
+        }
+    }
+    // Check if already logged in
+    const existing = loadCredentials();
+    if (existing && !isExpired(existing)) {
+        if (options.json) {
+            process.stdout.write(`${JSON.stringify({
+                status: "authenticated",
+                address: existing.account.address,
+                personal_server: existing.personal_server?.url ?? null,
+                expires_at: existing.account.expires_at,
+            })}\n`);
+        }
+        else {
+            const emit = createEmitter(options);
+            emit.success(`Already logged in as ${formatAddress(existing.account.address)}`);
+            if (existing.personal_server) {
+                emit.keyValue("Personal Server", existing.personal_server.url, "success");
+            }
+            emit.info(`  Auth expires in ${formatExpiresIn(existing.account.expires_at)}`);
+            emit.blank();
+            emit.info("  Run `vana logout` first to re-authenticate.");
+        }
+        return 0;
+    }
+    if (options.json) {
+        // JSON mode: run flow and output result
+        const creds = await runDeviceCodeFlow({
+            onCode: (code, uri) => {
+                process.stderr.write(JSON.stringify({ event: "device_code", code, uri }) + "\n");
+            },
+            onWaiting: () => { },
+            onAuthorized: () => { },
+            onExpired: () => {
+                process.stdout.write(JSON.stringify({ status: "expired", error: "Device code expired" }) +
+                    "\n");
+            },
+            onError: (err) => {
+                process.stdout.write(JSON.stringify({ status: "error", error: err.message }) + "\n");
+            },
+        });
+        if (creds) {
+            await saveCredentials(creds);
+            if (creds.personal_server?.url) {
+                await updateCliConfig({ personalServerUrl: creds.personal_server.url });
+            }
+            process.stdout.write(`${JSON.stringify({
+                status: "authenticated",
+                address: creds.account.address,
+                personal_server: creds.personal_server?.url ?? null,
+                expires_at: creds.account.expires_at,
+            })}\n`);
+            return 0;
+        }
+        return 1;
+    }
+    // Interactive mode
+    const renderer = createLoginRenderer();
+    renderer.title("Vana");
+    const creds = await runDeviceCodeFlow({
+        onCode: (code, uri) => {
+            renderer.note("Open this URL in your browser:");
+            renderer.note(uri);
+            renderer.note(`Enter this code: ${code}`);
+        },
+        onWaiting: () => {
+            renderer.scopeActive("Waiting for authorization");
+        },
+        onAuthorized: async (authedCreds) => {
+            await saveCredentials(authedCreds);
+            if (authedCreds.personal_server?.url) {
+                await updateCliConfig({
+                    personalServerUrl: authedCreds.personal_server.url,
+                });
+            }
+            renderer.success(`Logged in as ${formatAddress(authedCreds.account.address)}`);
+            if (authedCreds.personal_server) {
+                renderer.detail(`Personal Server: ${authedCreds.personal_server.url}`);
+            }
+            renderer.detail("Credentials saved to ~/.vana/auth.json");
+        },
+        onExpired: () => {
+            renderer.fail("Authorization expired");
+            renderer.next("vana login");
+        },
+        onError: (err) => {
+            renderer.fail("Login failed");
+            renderer.detail(err.message);
+            renderer.next("vana login");
+        },
+    });
+    renderer.cleanup();
+    return creds ? 0 : 1;
+}
+async function runLogout(options) {
+    // Revoke the token server-side before clearing local credentials
+    const creds = loadCredentials();
+    if (creds?.personal_server?.url && creds.personal_server.session_token) {
+        try {
+            await fetch(`${creds.personal_server.url.replace(/\/$/, "")}/auth/device/token`, {
+                method: "DELETE",
+                headers: {
+                    Authorization: `Bearer ${creds.personal_server.session_token}`,
+                },
+                signal: AbortSignal.timeout(5000),
+            });
+        }
+        catch {
+            // Best-effort — server may be down, but we still clear local creds
+        }
+    }
+    await clearCredentials();
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify({ status: "logged_out" })}\n`);
+    }
+    else {
+        const emit = createEmitter(options);
+        emit.success("Logged out. Credentials removed.");
+    }
+    return 0;
+}
 //# sourceMappingURL=index.js.map