@sealant/mend 0.9.0 → 0.10.0

package/dist/login.js

@@ -0,0 +1,240 @@
+import { spawn } from "node:child_process";
+import * as os from "node:os";
+import { groupCode } from "./pair.js";
+/**
+ * The opened request as the server's JSON, checked field by field before the
+ * CLI acts on it — a captive portal or a non-Mend server answering 200 must
+ * read as "not a Mend server", never as a crash. Null follows the CLI's
+ * absence idiom (chooseUrl, minutesUntil); the one caller turns it into the
+ * exit message.
+ */
+const parseCliAuthStart = (json) => {
+    if (typeof json !== "object" || json === null)
+        return null;
+    if (!("deviceCode" in json &&
+        "code" in json &&
+        "verifyPath" in json &&
+        "expiresAt" in json &&
+        "intervalSeconds" in json)) {
+        return null;
+    }
+    const { deviceCode, code, verifyPath, expiresAt, intervalSeconds } = json;
+    if (typeof deviceCode !== "string" ||
+        typeof code !== "string" ||
+        typeof verifyPath !== "string" ||
+        typeof expiresAt !== "string" ||
+        typeof intervalSeconds !== "number") {
+        return null;
+    }
+    return { deviceCode, code, verifyPath, expiresAt, intervalSeconds };
+};
+/** A poll answer's JSON, checked the same way; anything off-shape answers null. */
+const parseCliAuthPoll = (json) => {
+    if (typeof json !== "object" || json === null || !("status" in json))
+        return null;
+    if (json.status === "pending")
+        return { status: "pending" };
+    if (json.status !== "approved")
+        return null;
+    if (!("token" in json && "user" in json && "device" in json))
+        return null;
+    const { token, user, device } = json;
+    if (typeof token !== "string")
+        return null;
+    if (typeof user !== "object" || user === null)
+        return null;
+    if (!("id" in user && "name" in user && "email" in user))
+        return null;
+    if (typeof user.id !== "string" ||
+        typeof user.name !== "string" ||
+        typeof user.email !== "string") {
+        return null;
+    }
+    if (typeof device !== "object" || device === null)
+        return null;
+    if (!("id" in device && "name" in device))
+        return null;
+    if (typeof device.id !== "string" || typeof device.name !== "string")
+        return null;
+    return {
+        status: "approved",
+        token,
+        user: { id: user.id, name: user.name, email: user.email },
+        device: { id: device.id, name: device.name },
+    };
+};
+const paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}` : text;
+const dim = paint("2");
+const green = paint("32");
+const cobalt = paint("34");
+const say = (line) => process.stdout.write(`${line}\n`);
+const fail = (message) => {
+    process.stderr.write(`mend: ${message}\n`);
+    process.exit(1);
+};
+const takeFlagValue = (args, flag) => {
+    const at = args.indexOf(flag);
+    return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
+};
+/**
+ * The server URL as a human types it: a bare `host:port` gets http://, a
+ * trailing slash goes, anything the URL parser rejects answers null so the
+ * caller can say so. The path is kept — an instance can live under one.
+ */
+export const normalizeServerUrl = (input) => {
+    const trimmed = input.trim();
+    if (trimmed === "")
+        return null;
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) ? trimmed : `http://${trimmed}`;
+    let url;
+    try {
+        url = new URL(withScheme);
+    }
+    catch {
+        return null;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return null;
+    return `${url.origin}${url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "")}`;
+};
+/** The page a human approves on — the verify path resolved against the URL the CLI dialed. */
+export const authorizeUrl = (base, verifyPath) => `${base}${verifyPath}`;
+/** How the browser opens on this platform; null means print the URL and let the human click. */
+export const browserCommand = (platform) => {
+    if (platform === "darwin")
+        return { command: "open", args: [] };
+    if (platform === "linux")
+        return { command: "xdg-open", args: [] };
+    return null;
+};
+/** Polling cadence: what the server asked for, held to a sane band. */
+export const pollDelayMs = (intervalSeconds) => Math.min(Math.max(Math.round(intervalSeconds), 1), 10) * 1000;
+/** When to stop polling: the request's own expiry, or ten minutes for an unreadable date. */
+export const pollDeadline = (expiresAt, now = Date.now()) => {
+    const at = Date.parse(expiresAt);
+    return Number.isNaN(at) ? now + 10 * 60_000 : at;
+};
+/** Fire-and-forget: a browser that fails to open must never take the login down. */
+const openBrowser = (url) => {
+    const opener = browserCommand(process.platform);
+    if (opener === null || process.stdout.isTTY !== true)
+        return;
+    try {
+        const child = spawn(opener.command, [...opener.args, url], {
+            stdio: "ignore",
+            detached: true,
+        });
+        child.on("error", () => undefined);
+        child.unref();
+    }
+    catch {
+        // The URL is already printed; clicking it is the fallback.
+    }
+};
+/** One unauthenticated POST to the authorize surface; anything but 2xx surfaces as a status. */
+const post = async (url, body) => {
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch {
+        return fail(`cannot reach the Mend server at ${new URL(url).origin} — is it running?`);
+    }
+    const text = await response.text();
+    let json = null;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        // A non-JSON body only matters for the happy path, which always is JSON.
+    }
+    return { status: response.status, json };
+};
+const retryAfterSecondsOf = (json) => {
+    if (typeof json === "object" && json !== null && "retryAfterSeconds" in json) {
+        const seconds = Number(json.retryAfterSeconds);
+        if (Number.isFinite(seconds) && seconds > 0)
+            return seconds;
+    }
+    return 5;
+};
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Where this login points: `--url` wins, then whatever is already configured
+ * (MEND_URL or the config file) — a set URL is never asked about again;
+ * `--url` is how you point somewhere else. Only a fresh machine prompts, and
+ * only on a terminal; a piped stdin takes the default silently.
+ */
+const resolveServerUrl = async (args, deps) => {
+    const given = takeFlagValue(args, "--url") ?? deps.configuredUrl;
+    if (given !== null) {
+        return normalizeServerUrl(given) ?? fail(`"${given}" is not a URL the CLI can dial`);
+    }
+    if (process.stdin.isTTY !== true) {
+        return (normalizeServerUrl(deps.defaultUrl) ??
+            fail(`"${deps.defaultUrl}" is not a URL the CLI can dial`));
+    }
+    const readline = await import("node:readline/promises");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const typed = (await rl.question(`mend server url ${dim(`[${deps.defaultUrl}]`)}: `)).trim();
+    rl.close();
+    const chosen = typed === "" ? deps.defaultUrl : typed;
+    return normalizeServerUrl(chosen) ?? fail(`"${chosen}" is not a URL the CLI can dial`);
+};
+/**
+ * `mend login [--url <server>]` — open, show, wait, save. The token lands in
+ * the CLI config (0600) together with the device id, so `mend logout` can
+ * revoke the token server-side instead of merely forgetting it.
+ */
+export const loginCommand = async (args, deps) => {
+    const base = await resolveServerUrl(args, deps);
+    const started = await post(`${base}/api/cli/auth`, { name: os.hostname() });
+    if (started.status === 429) {
+        return fail(`the server asked for a pause — try again in ${retryAfterSecondsOf(started.json)}s`);
+    }
+    if (started.status < 200 || started.status >= 300) {
+        return fail(`the server at ${base} refused to open an authorize request (${started.status})`);
+    }
+    const opened = parseCliAuthStart(started.json) ??
+        fail(`the server at ${base} did not answer like a Mend server — is that the right URL?`);
+    const url = authorizeUrl(base, opened.verifyPath);
+    say(`${green("✓")} authorize request open at ${base}`);
+    say(`  ${dim("code")}    ${groupCode(opened.code)} ${dim("· approve only if the browser shows the same code")}`);
+    say(`  ${dim("browser")} ${cobalt(url)}`);
+    say("");
+    say(dim("  waiting for approval… Ctrl-C stops; nothing is granted until someone approves"));
+    openBrowser(url);
+    const deadline = pollDeadline(opened.expiresAt);
+    const delay = pollDelayMs(opened.intervalSeconds);
+    while (Date.now() < deadline) {
+        await sleep(delay);
+        const poll = await post(`${base}/api/cli/auth/token`, { deviceCode: opened.deviceCode });
+        if (poll.status === 429) {
+            await sleep(retryAfterSecondsOf(poll.json) * 1000);
+            continue;
+        }
+        if (poll.status === 403)
+            return fail("denied in the browser; nothing was granted");
+        if (poll.status === 404 || poll.status === 410) {
+            return fail("the authorize request is no longer open — run mend login again");
+        }
+        if (poll.status < 200 || poll.status >= 300) {
+            return fail(`the server answered ${poll.status} while waiting — run mend login again`);
+        }
+        const result = parseCliAuthPoll(poll.json);
+        if (result === null) {
+            return fail("the server's answer stopped making sense while waiting — run mend login again");
+        }
+        if (result.status === "pending")
+            continue;
+        deps.save({ url: base, token: result.token, deviceId: result.device.id });
+        say(`${green("✓")} signed in as ${result.user.email}`);
+        say(`  ${dim("this terminal is the device")} ${result.device.name} ${dim("· revoke it any time under Settings → Devices")}`);
+        return;
+    }
+    return fail("the authorize request expired before anyone approved — run mend login again");
+};

package/dist/main.js

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import { doctorCommand } from "./doctor.js";
 import { readSyncFiles, scanDotfileCandidates } from "./dotfiles.js";
 import { formatLoadReport } from "./env.js";
+import { loginCommand } from "./login.js";
 import { pairCommand, qrCommand } from "./pair.js";
 import { isComposeFile, proposeFromCompose, proposeFromPackageJson, proposeFromWorkspacePackage, renderMendToml, workspaceGlobs, } from "./service-init.js";
 import { agentIsLive, agentOutcome, cwdFacts, gitTopLevel, HARNESS_COMMANDS, LIVE_STATUSES, matchProjectByCwd, normalizeProjectName, parseLaunchArgs, } from "./shared.js";
@@ -30,9 +31,12 @@ const loadConfig = () => {
             fail(`could not parse ${CONFIG_PATH}`);
         }
     }
+    const configuredUrl = process.env["MEND_URL"] ?? fileConfig.url ?? null;
     return {
-        url: process.env["MEND_URL"] ?? fileConfig.url ?? "http://localhost:3105",
+        url: configuredUrl ?? "http://localhost:3105",
+        configuredUrl,
         token: process.env["MEND_TOKEN"] ?? fileConfig.token ?? null,
+        deviceId: fileConfig.deviceId ?? null,
     };
 };
 const fail = (message) => {
@@ -547,7 +551,7 @@ const serviceUrl = (service) => service.browserUrl ??
  * authority is our own address; on a remote one it is an address on the
  * server's network — the honest client path is the authenticated tunnel.
  */
-const printServiceAccess = (config, service) => {
+const printServiceAccess = (config, service, tunneling = false) => {
     const gate = "no Mend sign-in on this port — network reach is the only gate";
     if (serverIsLocal(config)) {
         if (service.authority !== null)
@@ -561,8 +565,11 @@ const printServiceAccess = (config, service) => {
         }
         return;
     }
-    const local = service.hostPort ?? service.workspacePort;
-    say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    if (!tunneling) {
+        // Suggest the tunnel only when this command is not about to open it.
+        const local = service.hostPort ?? service.workspacePort;
+        say(`  ${cobalt(`mend service connect ${service.label}`)} ${dim(`→ 127.0.0.1:${local} on this machine, authenticated as you`)}`);
+    }
     if (service.authority !== null) {
         say(`  ${dim(`server-side listener ${service.authority} · ${gate}`)}`);
     }
@@ -573,8 +580,8 @@ const printWorkspaceTtlFailure = (service) => {
     say(amber(`  workspace TTL renewal failed · ${service.workspaceTtlRenewalError}`));
     say(dim(`  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} · known expiry ${service.workspaceExpiresAt ?? "unknown"} · failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`));
 };
-const printServiceEndpoint = (config, service) => {
-    printServiceAccess(config, service);
+const printServiceEndpoint = (config, service, tunneling = false) => {
+    printServiceAccess(config, service, tunneling);
     printWorkspaceTtlFailure(service);
 };
 const printService = (config, service) => {
@@ -670,10 +677,22 @@ const findLiveService = async (config, needle) => {
  * declared port to answer, then exposes it like any Service. The command
  * never occupies the agent's terminal or a tool call.
  */
+/**
+ * The point of starting a Service is reaching it. On a local server the
+ * bound authority already answers on this machine, so start-and-return is
+ * complete. On a remote server nothing local answers — stay attached and
+ * tunnel the port here, exactly what `mend service connect` would do next.
+ * Ctrl-C closes the tunnel, never the Service.
+ */
+const willAutoConnect = (config, service, optOut) => !optOut && !serverIsLocal(config) && service.protocol !== "udp";
+const autoConnect = async (config, service) => {
+    say(dim("  remote server — tunneling the port here · Ctrl-C stops the tunnel, not the Service"));
+    await tunnelServices(config, [service], null);
+};
 const serviceRun = async (config, args) => {
     const dashdash = args.indexOf("--");
-    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] [--http|--https] -- <command...>\n" +
-        "       mend service run [session] <name>          (a declared recipe)";
+    const usage = "usage: mend service run [session] --port <port> [--name <n>] [--udp] [--http|--https] [--no-connect] -- <command...>\n" +
+        "       mend service run [session] <name> [--no-connect]          (a declared recipe)";
     // No explicit command = a DECLARED Service: resolve the name against the
     // session worktree's mend.toml and start (or adopt) its recipe.
     if (dashdash === -1) {
@@ -698,9 +717,12 @@ const serviceRun = async (config, args) => {
                 : `starting ${recipe.name} — waiting for :${recipe.port} to answer…`, mutateService(config, "POST", `/sessions/${session.id}/services/recipe`, {
             name: recipe.name,
         }));
+        const tunneling = willAutoConnect(config, service, args.includes("--no-connect"));
         say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-        printServiceEndpoint(config, service);
+        printServiceEndpoint(config, service, tunneling);
         say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+        if (tunneling)
+            await autoConnect(config, service);
         return;
     }
     const argv = args.slice(dashdash + 1);
@@ -732,9 +754,12 @@ const serviceRun = async (config, args) => {
         protocol,
         browserScheme,
     }));
+    const tunneling = willAutoConnect(config, service, head.includes("--no-connect"));
     say(`${green("✓")} Service ${service.label ?? ""} · ${service.status}`);
-    printServiceEndpoint(config, service);
+    printServiceEndpoint(config, service, tunneling);
     say(dim(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+    if (tunneling)
+        await autoConnect(config, service);
 };
 /** Read sequence-addressed PTY output without attaching an input-capable terminal. */
 const serviceLogs = async (config, args) => {
@@ -881,34 +906,14 @@ const serviceInit = async (args) => {
     say(`${green("✓")} wrote ${target} — commit it, then: mend service run ${proposals[0]?.name}`);
 };
 /**
- * `mend service connect [name…] [--port <n>]`: the location-independent data
- * plane for Services. The server's own listener binds the SERVER's
- * interfaces (`MEND_SERVICE_HOSTS`) — exactly right when the server is this
- * machine, unreachable when it is a Pod or a VPS. This binds each Service's
- * port on THIS machine's loopback instead and pumps every accepted
- * connection over one authenticated WebSocket to the server, which dials the
- * same workspace forward the listener uses. No ports are opened anywhere but
- * here, and every connection carries the caller's Mend auth.
+ * The location-independent data plane for Services: bind each Service's port
+ * on THIS machine's loopback and pump every accepted connection over one
+ * authenticated WebSocket to the server, which dials the same workspace
+ * forward the server-side listener uses. No ports are opened anywhere but
+ * here, and every connection carries the caller's Mend auth. Blocks until
+ * interrupted — the listeners keep the process alive.
  */
-const serviceConnect = async (config, args) => {
-    const portFlag = args.indexOf("--port");
-    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
-    if (portOverride !== null && !Number.isInteger(portOverride)) {
-        return fail("--port takes a port number");
-    }
-    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
-    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
-    const picked = names.length === 0
-        ? live
-        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
-    if (picked.length === 0) {
-        return fail(names.length === 0
-            ? "no live TCP services — mend service run starts one"
-            : `no live TCP service matches "${names.join('", "')}"`);
-    }
-    if (portOverride !== null && picked.length !== 1) {
-        return fail("--port applies to exactly one service — name it");
-    }
+const tunnelServices = async (config, services, portOverride) => {
     const tunnelUrl = (serviceId) => {
         const url = parseMendUrl(`${config.url}/api/service-tunnel`);
         url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
@@ -917,7 +922,7 @@ const serviceConnect = async (config, args) => {
             url.searchParams.set("token", config.token);
         return url;
     };
-    for (const service of picked) {
+    for (const service of services) {
         const port = portOverride ?? service.hostPort ?? service.workspacePort;
         const server = net.createServer((socket) => {
             // Hold local bytes until the tunnel is open; loopback buffers are tiny.
@@ -950,12 +955,39 @@ const serviceConnect = async (config, args) => {
             });
             server.listen(port, "127.0.0.1", () => resolve());
         }).catch((error) => fail(error.message));
-        say(`${green("●")} ${service.label} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
+        say(`${green("●")} ${service.label ?? service.id.slice(0, 8)} → 127.0.0.1:${port} ${dim(`(tunnel to ${config.url})`)}`);
     }
     say(dim("  connections are authenticated as you · Ctrl-C stops"));
     // The listeners keep the process alive until the user stops it.
     await new Promise(() => { });
 };
+/**
+ * `mend service connect [name…] [--port <n>]`: the standalone entry to the
+ * tunnel. The server's own listener binds the SERVER's interfaces
+ * (`MEND_SERVICE_HOSTS`) — exactly right when the server is this machine,
+ * unreachable when it is a Pod or a VPS; this brings the port here instead.
+ */
+const serviceConnect = async (config, args) => {
+    const portFlag = args.indexOf("--port");
+    const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
+    if (portOverride !== null && !Number.isInteger(portOverride)) {
+        return fail("--port takes a port number");
+    }
+    const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
+    const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
+    const picked = names.length === 0
+        ? live
+        : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
+    if (picked.length === 0) {
+        return fail(names.length === 0
+            ? "no live TCP services — mend service run starts one"
+            : `no live TCP service matches "${names.join('", "')}"`);
+    }
+    if (portOverride !== null && picked.length !== 1) {
+        return fail("--port applies to exactly one service — name it");
+    }
+    await tunnelServices(config, picked, portOverride);
+};
 const serviceCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
@@ -1069,106 +1101,48 @@ const connectCommand = async (config, args) => {
     const account = await withSpinner(`connecting ${provider}`, api(config, "POST", "/me/sealant/accounts", { provider, secret }));
     process.stdout.write(`${accountLine(account)}\n`);
 };
-// ─── login: obtain and save the bearer token ────────────────────────────────
+// ─── login: authorize this terminal through the browser (login.ts) ──────────
 const takeFlagValue = (args, flag) => {
     const at = args.indexOf(flag);
     return at !== -1 && args[at + 1] !== undefined ? String(args[at + 1]) : null;
 };
-/**
- * Read a password: raw-mode without echo on a TTY; on a pipe, one line through the SAME readline
- * that read the email (a second reader would find the buffered pipe already drained).
- */
-const readSecretLine = async (prompt, rl) => {
-    if (process.stdin.isTTY !== true) {
-        return (await rl.question(prompt)).trim();
-    }
-    process.stdout.write(prompt);
-    return new Promise((resolve) => {
-        const stdin = process.stdin;
-        stdin.setRawMode(true);
-        stdin.resume();
-        stdin.setEncoding("utf8");
-        let buffer = "";
-        const onData = (chunk) => {
-            for (const char of chunk) {
-                if (char === "\r" || char === "\n") {
-                    stdin.setRawMode(false);
-                    stdin.pause();
-                    stdin.off("data", onData);
-                    process.stdout.write("\n");
-                    resolve(buffer);
-                    return;
-                }
-                if (char === "\u0003") {
-                    stdin.setRawMode(false);
-                    process.stdout.write("\n");
-                    process.exit(130);
-                }
-                if (char === "\u007f" || char === "\b") {
-                    buffer = buffer.slice(0, -1);
-                    continue;
-                }
-                buffer += char;
-            }
-        };
-        stdin.on("data", onData);
-    });
-};
+// Only these three fields persist; `configuredUrl` is derived on every load.
 const saveCliConfig = (next) => {
     fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token }, null, 2)}\n`, { mode: 0o600 });
+    fs.writeFileSync(CONFIG_PATH, `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}\n`, { mode: 0o600 });
     fs.chmodSync(CONFIG_PATH, 0o600);
 };
-/**
- * `mend login [--url <server>] [--email <address>]`: sign in with email + password against the
- * server's auth endpoint (the bearer plugin answers with a `set-auth-token` header) and save the
- * token 0600 in the CLI config. Nothing else asks for a password again.
- */
+/** `mend login [--url <server>]` — the browser authorize walk; login.ts owns the flow. */
 const login = async (config, args) => {
-    const url = takeFlagValue(args, "--url") ?? process.env["MEND_URL"] ?? config.url;
-    const emailFlag = takeFlagValue(args, "--email");
-    const readline = await import("node:readline/promises");
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const email = emailFlag ?? (await rl.question(`email for ${url}: `)).trim();
-    if (email === "") {
-        rl.close();
-        return fail("an email is required");
-    }
-    const password = await readSecretLine("password: ", rl);
-    rl.close();
-    if (password === "")
-        return fail("a password is required");
-    let response;
-    try {
-        response = await fetch(`${url}/api/auth/sign-in/email`, {
-            method: "POST",
-            // better-auth's CSRF check rejects the `Origin: null` a non-browser fetch sends; the
-            // server's own URL is always a trusted origin, so present that.
-            headers: { "content-type": "application/json", origin: url },
-            body: JSON.stringify({ email, password }),
-        });
-    }
-    catch {
-        return fail(`cannot reach the Mend server at ${url} — is it running?`);
-    }
-    if (response.status === 401 || response.status === 403 || response.status === 400) {
-        return fail(`sign-in refused for ${email} at ${url}`);
-    }
-    if (!response.ok)
-        return fail(`sign-in failed: ${url} responded ${response.status}`);
-    const token = response.headers.get("set-auth-token");
-    if (token === null || token === "") {
-        return fail("the server signed you in but returned no bearer token (bearer plugin missing?)");
-    }
-    saveCliConfig({ ...config, url, token });
-    say(`${green("✓")} signed in as ${email} · ${dim(`token saved to ${CONFIG_PATH}`)}`);
+    await loginCommand(args, {
+        configuredUrl: config.configuredUrl,
+        defaultUrl: config.url,
+        save: (next) => {
+            saveCliConfig({ url: next.url, token: next.token, deviceId: next.deviceId });
+            say(dim(`  token saved to ${CONFIG_PATH} (0600)`));
+        },
+    });
 };
-const logout = (config) => {
-    if (!fs.existsSync(CONFIG_PATH)) {
+/**
+ * Signing out revokes the device server-side when it can — merely forgetting
+ * a live token would leave it valid until someone found it in Settings →
+ * Devices. A server that cannot be reached still loses the local copy.
+ */
+const logout = async (config) => {
+    if (!fs.existsSync(CONFIG_PATH) && config.token === null) {
         say(dim("nothing saved — already signed out"));
         return;
     }
-    saveCliConfig({ ...config, token: null });
+    if (config.token !== null && config.deviceId !== null) {
+        try {
+            await request(config, "DELETE", `/me/devices/${config.deviceId}`);
+            say(`${green("✓")} device revoked on ${config.url}`);
+        }
+        catch {
+            say(dim("  could not revoke on the server — end it under Settings → Devices"));
+        }
+    }
+    saveCliConfig({ ...config, token: null, deviceId: null });
     say(`${green("✓")} signed out · ${dim(`token removed from ${CONFIG_PATH}`)}`);
 };
 // ─── keys: the machine's Mend deploy key (docs/GIT-ACCESS.md) ───────────────
@@ -2044,7 +2018,10 @@ const dashboard = async (config) => {
 const HELP = `mend — the agent workbench
 
 start
-  mend login [--url <server>]           sign in with email + password; saves the token (0600)
+  mend login [--url <server>]           sign this terminal in through the browser: opens
+                                        <server>/authorize, you press Authorize there, and the
+                                        CLI saves a revocable device token (0600); no password
+                                        is ever typed here
   mend connect <provider> [--from-stdin] [--remove]
                                         send THIS machine's claude/codex/github credential to the
                                         platform under your own user (reads the file the provider's
@@ -2065,7 +2042,7 @@ start
 
 everything else
   mend                                  the dashboard: every project and session, live
-  mend logout                           forget the saved token
+  mend logout                           revoke this terminal's device token and forget it
   mend keys init                        generate the machine's Mend deploy key (ed25519)
   mend keys show                        print the public key — add it as a deploy key on your git host
   mend env load [file] [--secret [A,B]] load a .env into the project: ordinary names → configuration,
@@ -2105,7 +2082,7 @@ everything else
 
   server: MEND_URL (default http://localhost:3105) · auth: MEND_TOKEN
   detach key: Ctrl+] (set MEND_DETACH_KEY=none when an outer multiplexer owns detaching)
-  config file: ~/.config/mend/cli.json { "url": ..., "token": ... }
+  config file: ~/.config/mend/cli.json { "url": ..., "token": ..., "deviceId": ... }
 `;
 const main = async () => {
     const [command, ...rest] = process.argv.slice(2);