@productbrain/cli 0.1.0-beta.14 → 0.1.0-beta.14010

package/dist/commands/connect-redeem-failure.test.js

@@ -0,0 +1,133 @@
+/**
+ * pb never leaves a live key behind, and never kills a key the person owns (WP-810, TASK-648,
+ * DEC-1961, TEN-4516):
+ * - a git-tracked folder pin is refused BEFORE the redeem, so the one-time token stays unspent;
+ * - on a throw after the redeem the profile file is read back: a key no profile holds is revoked,
+ *   and pb says whether the revoke worked;
+ * - a key a profile holds is kept (the person owns it) and the profile is named, so a rotated
+ *   profile, or a profile whose activation marker failed, never ends up holding a dead key.
+ * The decline path's revoke lives in connect-decline.test.ts.
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+vi.mock('fs', () => ({ mkdirSync: vi.fn(), writeFileSync: vi.fn(), existsSync: vi.fn(() => false), readFileSync: vi.fn() }));
+vi.mock('../lib/spinner.js', () => ({ withSpinner: vi.fn(async (_m, fn) => fn()) }));
+vi.mock('../lib/prompts.js', () => ({ confirm: vi.fn(async () => true), isInteractive: vi.fn(() => true) }));
+vi.mock('@clack/prompts', () => ({ isCancel: vi.fn(() => false), text: vi.fn(async () => '') }));
+vi.mock('../lib/profiles.js', () => ({
+    createProfile: vi.fn(),
+    autoMigrate: vi.fn(),
+    profileFileExists: vi.fn(() => false),
+    profilePath: vi.fn((name) => `/home/u/.config/productbrain/profiles/${name}.env`),
+    resolveNamedProfileConfig: vi.fn(),
+    validateProfileName: vi.fn(),
+}));
+vi.mock('../lib/connectProfileName.js', async (importOriginal) => ({ ...(await importOriginal()), connectFolderName: vi.fn(() => 'my-repo') }));
+vi.mock('../lib/config.js', () => ({ setLocalProfilePin: vi.fn(), readLocalProjectConfig: vi.fn(() => null) }));
+vi.mock('../lib/projectConfig.js', async (importOriginal) => ({ ...(await importOriginal()), refuseTrackedPin: vi.fn() }));
+vi.mock('../lib/session.js', () => ({ discardAllSessions: vi.fn() }));
+vi.mock('../lib/productbrain-files.js', () => ({ sealConnectWrites: vi.fn(() => ({ added: [], stillExposed: [] })) }));
+vi.mock('./connect-screens.js', () => ({ runConnectScreens: vi.fn(async () => { }), runConnectHeadless: vi.fn(async () => { }) }));
+import { runConnect } from './connect.js';
+import { readLocalProjectConfig, setLocalProfilePin } from '../lib/config.js';
+import { createProfile, profileFileExists, resolveNamedProfileConfig } from '../lib/profiles.js';
+import { composeProfileName } from '../lib/connectProfileName.js';
+import { refuseTrackedPin } from '../lib/projectConfig.js';
+const TOKEN = 'pb_ct_' + 'a'.repeat(40);
+const KEY = 'pb_sk_' + 'f'.repeat(48);
+const GATEWAY = 'https://example.convex.site';
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+function redeemOk() {
+    mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ apiKey: KEY, workspaceId: 'ws1', workspaceName: 'Acme', workspaceSlug: 'acme' }),
+    });
+}
+const trackedPin = () => new CLIError('/repo/.productbrain/config.local.json is tracked by git, so it is committed and every clone shares it. Refusing to use it.', {
+    code: ErrorCode.CONFIG_INVALID,
+    category: 'config',
+    guidance: 'Untrack it with `git rm --cached .productbrain/config.local.json`, then run `pb files --fix` so git ignores it.',
+});
+describe('pb connect never leaves a live key behind (TASK-648)', () => {
+    let stderr;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockFetch.mockReset();
+        vi.mocked(readLocalProjectConfig).mockReset().mockReturnValue(null);
+        vi.mocked(setLocalProfilePin).mockReset();
+        // A fake profiles dir: createProfile stores the key, and the read-back sees what is stored.
+        const disk = new Map();
+        vi.mocked(createProfile).mockReset().mockImplementation((name, apiKey) => { disk.set(name, apiKey); });
+        vi.mocked(resolveNamedProfileConfig).mockReset().mockImplementation((name) => (disk.has(name) ? { apiKey: disk.get(name) } : null));
+        vi.mocked(profileFileExists).mockReset().mockReturnValue(false);
+        vi.mocked(refuseTrackedPin).mockReset();
+        stderr = '';
+        vi.spyOn(process.stderr, 'write').mockImplementation((chunk) => { stderr += String(chunk); return true; });
+    });
+    it('refuses a git-tracked pin before the redeem: no network call, so the token is unspent', async () => {
+        vi.mocked(readLocalProjectConfig).mockImplementation(() => { throw trackedPin(); });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY })).rejects.toThrow(/tracked by git/);
+        expect(mockFetch).not.toHaveBeenCalled();
+        expect(createProfile).not.toHaveBeenCalled();
+    });
+    it('refuses a tracked pin in the folder the connect writes, before the redeem, and pins exactly that folder', async () => {
+        vi.mocked(refuseTrackedPin).mockImplementationOnce(() => { throw trackedPin(); });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY })).rejects.toThrow(/tracked by git/);
+        expect(mockFetch).not.toHaveBeenCalled();
+        // One decider: the folder checked before the redeem is the folder the pin is written to.
+        redeemOk();
+        await runConnect(TOKEN, { gateway: GATEWAY });
+        const checked = vi.mocked(refuseTrackedPin).mock.calls.at(-1)?.[0];
+        expect(checked).toBe(process.cwd());
+        expect(vi.mocked(setLocalProfilePin).mock.calls[0][0]).toBe(checked);
+    });
+    it('revokes the redeemed key when the profile save throws, before the key is stored anywhere, and rethrows', async () => {
+        redeemOk();
+        mockFetch.mockResolvedValueOnce({ ok: true, json: async () => ({ ok: true, data: { revoked: true } }) });
+        vi.mocked(createProfile).mockImplementation(() => { throw new Error('EACCES: permission denied'); });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY })).rejects.toThrow('EACCES');
+        expect(mockFetch).toHaveBeenCalledTimes(2);
+        const [url, init] = mockFetch.mock.calls[1];
+        expect(url).toBe(`${GATEWAY}/api/aki`);
+        expect(init.headers.Authorization).toBe(`Bearer ${KEY}`);
+        expect(JSON.parse(String(init.body))).toEqual({ fn: 'apiKeys.revokeCallingKey', args: {} });
+        expect(stderr).toContain('The key this token created was revoked.');
+    });
+    it('names the key and its Settings page when that revoke fails, and never prints the key', async () => {
+        redeemOk();
+        mockFetch.mockRejectedValueOnce(new Error('fetch failed'));
+        vi.mocked(createProfile).mockImplementation(() => { throw new Error('disk full'); });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY, name: 'Laptop CLI' })).rejects.toThrow('disk full');
+        expect(stderr).toContain('could not be revoked. Revoke "Laptop CLI" in Settings → API keys:');
+        expect(stderr).toContain('/w/acme/settings/api-keys');
+        expect(stderr).not.toContain(KEY);
+    });
+    it('keeps the key when the profile file was written before createProfile threw (activation marker failed)', async () => {
+        redeemOk();
+        vi.mocked(createProfile).mockImplementation((name, apiKey) => {
+            vi.mocked(resolveNamedProfileConfig).mockImplementation((n) => (n === name ? { apiKey } : null));
+            throw new Error('ENOSPC: no space left on device, open active-profile');
+        });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY })).rejects.toThrow('ENOSPC');
+        expect(mockFetch).toHaveBeenCalledTimes(1); // the redeem only: no revoke
+        expect(stderr).toContain('pb connect stopped after saving the key.');
+        expect(stderr).not.toContain('revoked');
+    });
+    it('keeps the key once the profile holds it: a rotated profile whose pin write fails still holds a live key', async () => {
+        // The folder is already pinned to its own profile, so this connect rotates that profile's key.
+        const own = composeProfileName('Acme', 'my-repo', 1);
+        vi.mocked(readLocalProjectConfig).mockReturnValue({ profile: own });
+        vi.mocked(profileFileExists).mockImplementation((name) => name === own);
+        redeemOk();
+        vi.mocked(setLocalProfilePin).mockImplementation(() => { throw new Error('EACCES: permission denied'); });
+        await expect(runConnect(TOKEN, { gateway: GATEWAY })).rejects.toThrow('EACCES');
+        expect(createProfile).toHaveBeenCalledWith(own, KEY, GATEWAY, { overwrite: true });
+        expect(mockFetch).toHaveBeenCalledTimes(1); // the redeem only: no revoke
+        expect(stderr).toContain(`is in profile "${own}" (/home/u/.config/productbrain/profiles/${own}.env)`);
+        expect(stderr).toContain(`pb profile use --local ${own}`);
+        expect(stderr).not.toContain('revoked');
+        expect(stderr).not.toContain(KEY);
+    });
+});
+//# sourceMappingURL=connect-redeem-failure.test.js.map

package/dist/commands/connect-redeem-failure.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-redeem-failure.test.js","sourceRoot":"","sources":["../../src/commands/connect-redeem-failure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7H,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAA0B,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACrH,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7G,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACjG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACrC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,yCAAyC,IAAI,MAAM,CAAC;IACzF,yBAAyB,EAAE,EAAE,CAAC,EAAE,EAAE;IAClC,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC7B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,cAAc,EAAU,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AACxJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAChH,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,cAAc,EAAU,CAAC,EAAE,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACnI,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACtE,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvH,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjI,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,KAAK,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxC,MAAM,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACtC,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,SAAS,QAAQ;IACf,SAAS,CAAC,qBAAqB,CAAC;QAC9B,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;KAC1F,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,IAAI,QAAQ,CAAC,4HAA4H,EAAE;IACzI,IAAI,EAAE,SAAS,CAAC,cAAc;IAC9B,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,iHAAiH;CAC5H,CAAC,CAAC;AAEL,QAAQ,CAAC,sDAAsD,EAAE,GAAG,EAAE;IACpE,IAAI,MAAc,CAAC;IACnB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,SAAS,CAAC,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1C,4FAA4F;QAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvH,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7I,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,SAAS,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAChE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,EAAE,CAAC;QACZ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAA0B,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAExF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACxF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAEzC,yFAAyF;QACzF,QAAQ,EAAE,CAAC;QACX,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,QAAQ,EAAE,CAAC;QACX,SAAS,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAc,CAAC,CAAC;QACrH,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAErG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEhF,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA0B,CAAC;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,UAAU,CAAC,CAAC;QACvC,MAAM,CAAE,IAAI,CAAC,OAAkC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,QAAQ,EAAE,CAAC;QACX,SAAS,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3D,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC9F,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,QAAQ,EAAE,CAAC;QACX,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAY,EAAE,MAAc,EAAE,EAAE;YAC3E,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEhF,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,+FAA+F;QAC/F,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAChF,QAAQ,EAAE,CAAC;QACX,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1G,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEhF,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;QACzE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,GAAG,4CAA4C,GAAG,OAAO,CAAC,CAAC;QACtG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/connect-screens.d.ts

@@ -0,0 +1,17 @@
+/**
+ * What `pb connect` prints once the folder is connected: the workspace, the profile and one next
+ * step, pb init (TASK-562, WP-861). The hooks pb init writes open the session in the agent, so
+ * connect prints no chat sentence; the handoff that printed one is deleted.
+ *
+ * TASK-959 (DEC-1926, DEC-1921): pb connect writes no context files; pb init installs the hooks.
+ */
+/** RULE-662: the one next step, two short sentences, true for what pb init writes (Claude Code, Codex, Cursor). */
+export declare const CONNECT_NEXT_STEP = "Next: run pb init here. It adds session hooks for Claude Code, Codex and Cursor.";
+/** Interactive terminal: the same three lines, coloured. `workspaceName` is pre-sanitized (stripControlChars). */
+export declare function runConnectScreens(workspaceName: string, profileName: string): Promise<void>;
+/**
+ * Headless summary for `pb connect --yes` without a TTY (e.g. CI, TEN-2561 / WP-2): plain text, no
+ * colour codes. `workspaceName` is pre-sanitized by the caller (stripControlChars).
+ */
+export declare function runConnectHeadless(workspaceName: string, profileName: string): Promise<void>;
+//# sourceMappingURL=connect-screens.d.ts.map

package/dist/commands/connect-screens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-screens.d.ts","sourceRoot":"","sources":["../../src/commands/connect-screens.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,mHAAmH;AACnH,eAAO,MAAM,iBAAiB,qFAAiG,CAAC;AAQhI,kHAAkH;AAClH,wBAAsB,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElG"}

package/dist/commands/connect-screens.js

@@ -0,0 +1,28 @@
+/**
+ * What `pb connect` prints once the folder is connected: the workspace, the profile and one next
+ * step, pb init (TASK-562, WP-861). The hooks pb init writes open the session in the agent, so
+ * connect prints no chat sentence; the handoff that printed one is deleted.
+ *
+ * TASK-959 (DEC-1926, DEC-1921): pb connect writes no context files; pb init installs the hooks.
+ */
+import { CLI_INIT_COMMAND } from '../lib/cliFirstRun.js';
+import { bold, green } from '../lib/style.js';
+/** RULE-662: the one next step, two short sentences, true for what pb init writes (Claude Code, Codex, Cursor). */
+export const CONNECT_NEXT_STEP = `Next: run ${CLI_INIT_COMMAND} here. It adds session hooks for Claude Code, Codex and Cursor.`;
+function connectedLines(workspaceName, profileName, styled) {
+    const name = styled ? bold(green(workspaceName)) : workspaceName;
+    const profile = styled ? bold(profileName) : profileName;
+    return `${styled ? green('✓') : '✓'} Connected to ${name}\nYour API key is saved as profile ${profile}.\n${CONNECT_NEXT_STEP}\n`;
+}
+/** Interactive terminal: the same three lines, coloured. `workspaceName` is pre-sanitized (stripControlChars). */
+export async function runConnectScreens(workspaceName, profileName) {
+    process.stdout.write(`\n${connectedLines(workspaceName, profileName, true)}\n`);
+}
+/**
+ * Headless summary for `pb connect --yes` without a TTY (e.g. CI, TEN-2561 / WP-2): plain text, no
+ * colour codes. `workspaceName` is pre-sanitized by the caller (stripControlChars).
+ */
+export async function runConnectHeadless(workspaceName, profileName) {
+    process.stdout.write(connectedLines(workspaceName, profileName, false));
+}
+//# sourceMappingURL=connect-screens.js.map

package/dist/commands/connect-screens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-screens.js","sourceRoot":"","sources":["../../src/commands/connect-screens.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAE9C,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,gBAAgB,iEAAiE,CAAC;AAEhI,SAAS,cAAc,CAAC,aAAqB,EAAE,WAAmB,EAAE,MAAe;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACzD,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,sCAAsC,OAAO,MAAM,iBAAiB,IAAI,CAAC;AACnI,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,WAAmB;IAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,WAAmB;IACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC"}

package/dist/commands/connect-screens.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connect-screens.test.d.ts.map

package/dist/commands/connect-screens.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-screens.test.d.ts","sourceRoot":"","sources":["../../src/commands/connect-screens.test.ts"],"names":[],"mappings":""}

package/dist/commands/connect-screens.test.js

@@ -0,0 +1,19 @@
+/**
+ * TASK-562 (DEC-1926): pb connect names one next step, pb init, and prints no chat sentence,
+ * no handshake and no second set of hints.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { runConnectHeadless, CONNECT_NEXT_STEP } from './connect-screens.js';
+describe('runConnectHeadless', () => {
+    afterEach(() => vi.restoreAllMocks());
+    it('prints the workspace, the profile and the one pb init next step', async () => {
+        let out = '';
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => { out += String(chunk); return true; });
+        await runConnectHeadless('Acme', 'acme-my-repo');
+        expect(out).toBe(`✓ Connected to Acme\nYour API key is saved as profile acme-my-repo.\n${CONNECT_NEXT_STEP}\n`);
+        // S2 PR 2: pb init writes the Codex and Cursor hooks too, so the next step names all three.
+        expect(CONNECT_NEXT_STEP).toBe('Next: run pb init here. It adds session hooks for Claude Code, Codex and Cursor.');
+        expect(out).not.toMatch(/handshake|context files|Start Product Brain|pb connect <token>|pb use/i);
+    });
+});
+//# sourceMappingURL=connect-screens.test.js.map

package/dist/commands/connect-screens.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-screens.test.js","sourceRoot":"","sources":["../../src/commands/connect-screens.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;IAEtC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAExG,MAAM,kBAAkB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wEAAwE,iBAAiB,IAAI,CAAC,CAAC;QAChH,4FAA4F;QAC5F,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACnH,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/connect-seal.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connect-seal.test.d.ts.map

package/dist/commands/connect-seal.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-seal.test.d.ts","sourceRoot":"","sources":["../../src/commands/connect-seal.test.ts"],"names":[],"mappings":""}

package/dist/commands/connect-seal.test.js

@@ -0,0 +1,54 @@
+/**
+ * pb connect seals the folder's pin AFTER it is written and after stale sessions are dropped, and
+ * a .gitignore problem only warns: the connect still completes (TASK-641, TEN-2598, PR #1530 review).
+ * The real-git behaviour of sealConnectWrites lives in lib/productbrain-files.test.ts.
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+vi.mock('fs', () => ({ mkdirSync: vi.fn(), writeFileSync: vi.fn(), existsSync: vi.fn(() => false), readFileSync: vi.fn() }));
+vi.mock('../lib/spinner.js', () => ({ withSpinner: vi.fn(async (_m, fn) => fn()) }));
+vi.mock('../lib/prompts.js', () => ({ confirm: vi.fn(async () => true), isInteractive: vi.fn(() => true) }));
+vi.mock('@clack/prompts', () => ({ isCancel: vi.fn(() => false), text: vi.fn(async () => '') }));
+vi.mock('../lib/profiles.js', () => ({ createProfile: vi.fn(), autoMigrate: vi.fn(), profileFileExists: vi.fn(() => false), validateProfileName: vi.fn() }));
+vi.mock('../lib/connectProfileName.js', async (importOriginal) => ({ ...(await importOriginal()), connectFolderName: vi.fn(() => 'my-repo') }));
+// A prior pin for another workspace: the redirect path drops every session marker.
+vi.mock('../lib/config.js', () => ({ setLocalProfilePin: vi.fn(), readLocalProjectConfig: vi.fn(() => ({ profile: 'other-ws-my-repo' })) }));
+vi.mock('../lib/session.js', () => ({ discardAllSessions: vi.fn() }));
+vi.mock('../lib/productbrain-files.js', () => ({ sealConnectWrites: vi.fn() }));
+vi.mock('./connect-screens.js', () => ({ runConnectScreens: vi.fn(async () => { }), runConnectHeadless: vi.fn(async () => { }) }));
+import { runConnect } from './connect.js';
+import { sealConnectWrites } from '../lib/productbrain-files.js';
+import { setLocalProfilePin } from '../lib/config.js';
+import { discardAllSessions } from '../lib/session.js';
+import { runConnectScreens } from './connect-screens.js';
+const TOKEN = 'pb_ct_' + 'a'.repeat(40);
+const mockFetch = vi.fn();
+global.fetch = mockFetch;
+describe('pb connect — sealing the pin (TASK-641)', () => {
+    let stderr;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        stderr = '';
+        vi.spyOn(process.stderr, 'write').mockImplementation((chunk) => { stderr += String(chunk); return true; });
+        mockFetch.mockResolvedValueOnce({ ok: true, json: async () => ({ apiKey: 'pb_sk_x', workspaceId: 'ws1', workspaceName: 'Acme' }) });
+    });
+    it('seals once, with the cwd, after the pin is written and after the session discard', async () => {
+        vi.mocked(sealConnectWrites).mockReturnValue({ git: true, added: ['.productbrain/config.local.json'], stillExposed: [] });
+        await runConnect(TOKEN, { gateway: 'https://example.convex.site' });
+        expect(sealConnectWrites).toHaveBeenCalledTimes(1);
+        expect(sealConnectWrites).toHaveBeenCalledWith(process.cwd());
+        const sealAt = vi.mocked(sealConnectWrites).mock.invocationCallOrder[0];
+        expect(vi.mocked(setLocalProfilePin).mock.invocationCallOrder[0]).toBeLessThan(sealAt);
+        expect(vi.mocked(discardAllSessions).mock.invocationCallOrder[0]).toBeLessThan(sealAt);
+        expect(stderr).toContain('Added to .gitignore: .productbrain/config.local.json');
+    });
+    it('a .gitignore that cannot be written only warns: sessions are discarded and the connect completes', async () => {
+        vi.mocked(sealConnectWrites).mockReturnValue({
+            git: true, added: [], stillExposed: ['.productbrain/config.local.json'], writeError: 'could not write /repo/.gitignore: EACCES',
+        });
+        await expect(runConnect(TOKEN, { gateway: 'https://example.convex.site' })).resolves.toBeUndefined();
+        expect(discardAllSessions).toHaveBeenCalled();
+        expect(runConnectScreens).toHaveBeenCalledWith('Acme', 'acme-my-repo');
+        expect(stderr).toContain('Not git-ignored (could not write /repo/.gitignore: EACCES): .productbrain/config.local.json — run `pb files`');
+    });
+});
+//# sourceMappingURL=connect-seal.test.js.map

package/dist/commands/connect-seal.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-seal.test.js","sourceRoot":"","sources":["../../src/commands/connect-seal.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7H,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,EAA0B,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACrH,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7G,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACjG,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7J,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,cAAc,EAAU,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;AACxJ,mFAAmF;AACnF,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7I,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACtE,EAAE,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACjI,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,KAAK,GAAG,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;AAEzB,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,IAAI,MAAc,CAAC;IACnB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,GAAG,EAAE,CAAC;QACZ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,KAA0B,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,SAAS,CAAC,qBAAqB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAc,CAAC,CAAC;IAClJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,iCAAiC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAE1H,MAAM,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAEpE,MAAM,CAAC,iBAAiB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACvF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,eAAe,CAAC;YAC3C,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,iCAAiC,CAAC,EAAE,UAAU,EAAE,0CAA0C;SAChI,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAErG,MAAM,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9C,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8GAA8G,CAAC,CAAC;IAC3I,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/connect.d.ts

@@ -0,0 +1,38 @@
+/**
+ * pb connect — redeem a short-lived connect token to save an API key locally.
+ *
+ * Part of FEAT-958 Path C: Onboarding flow. Redeems a connect token, saves the API key locally and
+ * names one next step, pb init (TASK-562). It refuses the home folder before the token is spent.
+ */
+/**
+ * Pin `pinFolder` (runConnect's one decider, TASK-648) to the profile. Returns the prior pin so the
+ * caller can detect a redirect.
+ * - config.json (committed): its PRESENCE declares a Product Brain project
+ *   (projectConfig.ts findProjectRoot / projectConfigExists). Created empty when absent; its
+ *   content is never read, so connect never rewrites it (TASK-638: the siteUrl writer had no
+ *   reader since TEN-4500).
+ * - config.local.json (gitignored): the profile pin, via the shared setLocalProfilePin().
+ * Does NOT include the API key anywhere — that stays in profiles, never committed.
+ */
+export declare function saveProjectConfig(pinFolder: string, profileName: string): {
+    previousProfile: string | null;
+};
+export interface ConnectOptions {
+    /** Override redeem gateway (`pb connect --gateway`). */
+    gateway?: string;
+    /** Optional API key label for workspace settings (non-TTY: use instead of prompt). */
+    name?: string;
+    /**
+     * Skip the interactive workspace-confirm gate (`pb connect --yes`). Required to
+     * connect in a non-interactive shell (e.g. CI), where the gate otherwise fails
+     * closed. Pairs with `--name` for scripted connects.
+     */
+    assumeYes?: boolean;
+}
+/**
+ * Main entrypoint for `pb connect <token>`.
+ * Validates token format, redeems it via /auth/redeem-connect-token,
+ * saves the key, and runs the wizard (S3).
+ */
+export declare function runConnect(token: string, options?: ConnectOptions): Promise<void>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/commands/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmOH;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG;IAAE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAc5G;AAED,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA8GD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwG3F"}