@thegitai/cli 1.0.0-preview.25 → 1.0.0-preview.27

package/README.md

@@ -17,9 +17,9 @@ Requires Node.js 24 or newer.
 ## Usage
 
 ```text
-ai                  start an interactive session in the current repo
+ai                  sign in if needed, then start a session in the current repo
 ai "<request>"      start a session with <request> as the first message
-ai login            sign in via your browser (--no-browser for SSH/headless)
+ai login            the same as `ai`; kept for muscle memory
 ai whoami           show the signed-in account
 ai --usage          show account usage and reset times
 ai logout           sign out
@@ -34,9 +34,14 @@ always be viewed or resumed from that computer. Continuing it through the
 service requires the TheGitAI account used for that session. Local sessions can
 also be listed while signed out or offline.
 
+Signing in opens your browser. The same screen also prints a URL you can open on
+any other device and a box for an authorization code, so SSH and headless
+machines need no separate command: open the URL wherever you have a browser,
+choose "Not on this machine?" on that page, and paste the code it shows.
+
 CLI login tokens use a rolling 48-hour inactivity timeout. If one expires during
-any server request, the CLI saves the local session, removes the expired
-credential, and asks you to run `ai login` before resuming.
+any server request, the CLI removes the expired credential and signs you in
+again on the next run.
 
 ## Structured questions
 

package/dist/bin/ai.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import chalk from '../src/colors.js';
-import { stdin as input, stdout as output } from 'node:process';
-import readline from 'node:readline/promises';
 import { ServerApi } from '../src/api/index.js';
-import { loginViaBrowser } from '../src/api/browser-login.js';
+import { DEFAULT_THEGITAI_HOST } from '../src/api/default-host.js';
+import { isSignInCancelled } from '../src/api/browser-login.js';
+import { runSignIn } from '../src/signin.js';
 import { STARTUP_RETRY_BUDGET, authenticationErrorMessage, isAuthenticationError, isTransientNetworkError, } from '../src/api/http.js';
 import { formatCliHelpText } from '../src/help-text.js';
 import { createIndex } from '../src/project-index.js';
@@ -15,7 +15,6 @@ import { formatSessionExitNotice } from '../src/session-exit.js';
 import { formatUsageText } from '../src/usage.js';
 import { formatVersionLine } from '../src/version.js';
 import { parseArgs } from '../src/cli-args.js';
-const DEFAULT_SERVER_URL = 'https://thegit.ai';
 const { auth, chat, models, sessions } = ServerApi;
 function printUsage() {
     console.log(formatCliHelpText({ color: process.stdout.isTTY === true }));
@@ -34,49 +33,17 @@ function unreachableReason(error) {
         return 'connection reset';
     return err?.message ? String(err.message) : 'network error';
 }
-async function promptText(question, fallback = null) {
-    const rl = readline.createInterface({ input, output });
-    try {
-        const suffix = fallback ? ` (${fallback})` : '';
-        const answer = await rl.question(`${question}${suffix}: `);
-        return answer.trim() || fallback || '';
-    }
-    finally {
-        rl.close();
-    }
-}
 function appendPromptHistory(prompt, env = process.env) {
     appendPromptToFile(prompt, env);
 }
-async function runAuthCommand(command, args) {
-    if (command === 'login') {
-        const serverUrl = DEFAULT_SERVER_URL;
-        const noBrowser = args.includes('--no-browser');
-        console.log(chalk.dim(noBrowser
-            ? 'Sign in on the website, then paste the authorization code here.'
-            : 'Opening your browser to sign in…'));
-        const result = await loginViaBrowser({
-            serverUrl,
-            noBrowser,
-            onUrl: (url) => {
-                console.log(chalk.dim(noBrowser ? 'Open this URL to sign in:' : 'If your browser did not open, visit:'));
-                console.log(`  ${url}`);
-            },
-            onWaiting: () => console.log(chalk.dim('Waiting for you to finish signing in…')),
-            promptCode: noBrowser
-                ? () => promptText('Paste the authorization code')
-                : undefined,
-            deviceName: process.env.THEGITAI_DEVICE_NAME?.trim() || undefined,
-        });
-        auth.writeCliAuthConfig(result);
-        console.log(chalk.green(`✓ Logged in as ${result.customer.email}`));
-        console.log(chalk.dim(`Server: ${result.serverUrl}`));
-        console.log(chalk.dim('You can close the browser tab. Run `ai` in a repo to start.'));
-        return;
-    }
+async function runAuthCommand(command) {
     const config = auth.readCliAuthConfig();
     if (!config) {
-        throw new Error('Not logged in. Run `ai login` first.');
+        if (command === 'logout') {
+            console.log(chalk.green('Already signed out.'));
+            return;
+        }
+        throw new Error('Not signed in. Run `ai` to sign in.');
     }
     if (command === 'whoami') {
         const customer = await auth.fetchWhoami({ config });
@@ -84,19 +51,25 @@ async function runAuthCommand(command, args) {
         return;
     }
     if (command === 'logout') {
-        await auth.logoutFromServer({ config });
+        try {
+            await auth.logoutFromServer({ config });
+        }
+        catch {
+        }
         auth.clearCliAuthConfig();
         console.log(chalk.green('Logged out.'));
         return;
     }
     throw new Error(`Unknown auth command: ${command}`);
 }
-function requireCliAuthConfig() {
+async function ensureCliAuthConfig() {
     const config = auth.readCliAuthConfig();
-    if (!config) {
-        throw new Error('Not logged in. Run `ai login` first.');
+    if (config)
+        return config;
+    if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+        throw new Error('Not signed in. Run `ai login` on a terminal to sign in.');
     }
-    return config;
+    return await runSignIn();
 }
 function formatSessionName(name) {
     return name ? `"${name}"` : '(unnamed)';
@@ -154,7 +127,7 @@ function requireInteractiveTerminal() {
     return true;
 }
 export async function main() {
-    const { autoYes, help, version, usage, command, commandArgs, session: sessionIdentifier, listSessions, unknownOption, prompt, } = parseArgs(process.argv);
+    const { autoYes, help, version, usage, command, session: sessionIdentifier, listSessions, unknownOption, prompt, } = parseArgs(process.argv);
     if (version) {
         console.log(formatVersionLine());
         return;
@@ -169,18 +142,18 @@ export async function main() {
         process.exitCode = 2;
         return;
     }
-    if (command) {
-        await runAuthCommand(command, commandArgs);
+    if (command && command !== 'login') {
+        await runAuthCommand(command);
         return;
     }
     if (usage) {
-        const authConfig = requireCliAuthConfig();
+        const authConfig = await ensureCliAuthConfig();
         console.log(formatUsageText(await auth.fetchWhoamiResponse({ config: authConfig })));
         return;
     }
     const rootDir = process.cwd();
     if (listSessions) {
-        const activeServerUrl = auth.readCliAuthConfig()?.serverUrl ?? DEFAULT_SERVER_URL;
+        const activeServerUrl = auth.readCliAuthConfig()?.serverUrl ?? DEFAULT_THEGITAI_HOST;
         printSessionList(rootDir, listSessionMetadata(rootDir), models.selectCacheForServer(models.readCachedServerModels(), activeServerUrl));
         return;
     }
@@ -195,7 +168,7 @@ export async function main() {
     if (!requireInteractiveTerminal()) {
         return;
     }
-    const authConfig = requireCliAuthConfig();
+    const authConfig = await ensureCliAuthConfig();
     const serverSessionClient = sessions.createServerSessionClient({ config: authConfig });
     const cachedModels = models.selectCacheForServer(models.readCachedServerModels(), authConfig.serverUrl);
     const [modelsOutcome, whoamiOutcome] = await Promise.allSettled([
@@ -279,7 +252,7 @@ export async function main() {
         },
     });
     const initialPrompt = prompt || undefined;
-    await runClientInteractive({
+    const outcome = await runClientInteractive({
         appendPromptHistory: (value) => appendPromptHistory(value, session.env),
         authConfig,
         debugUi: whoami.debugUi,
@@ -290,10 +263,21 @@ export async function main() {
         initialPrompt,
         usageText: async () => formatUsageText(await auth.fetchWhoamiResponse({ config: authConfig })),
     });
+    if (outcome.signedOut) {
+        if (sessionHasUserMessage(session)) {
+            saveSessionState(session);
+        }
+        console.log(chalk.green('\n✓ Logged out.\n'));
+        return;
+    }
     await saveSessionBoth({ session, serverSessionClient });
     printSessionExit(session);
 }
 main().catch((error) => {
+    if (isSignInCancelled(error)) {
+        console.error(chalk.dim('\nSign-in cancelled. Nothing was saved.\n'));
+        process.exit(130);
+    }
     if (isAuthenticationError(error)) {
         auth.clearCliAuthConfig();
         console.error(chalk.red(`\n✖ Error: ${authenticationErrorMessage(error)}\n`));

package/dist/src/api/browser-login.js

@@ -5,15 +5,27 @@ import http from 'node:http';
 import os from 'node:os';
 import { openUrl } from '../core/open-url.js';
 import { ServerApiError, createTraceContext, failureCode, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
-const DEFAULT_WEBSITE_URL = 'https://thegit.ai';
-const DEFAULT_SERVER_URL = 'https://thegit.ai';
-const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+import { DEFAULT_THEGITAI_HOST } from './default-host.js';
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
 function shutDownServer(server) {
     server.closeAllConnections?.();
     server.close();
 }
+export class SignInCancelledError extends Error {
+    constructor() {
+        super('Sign-in cancelled.');
+        this.name = 'SignInCancelledError';
+    }
+}
+export function isSignInCancelled(error) {
+    return error instanceof SignInCancelledError;
+}
+function isAbortError(error) {
+    const err = error;
+    return err?.name === 'AbortError' || err?.code === 'ABORT_ERR';
+}
 export function resolveWebsiteUrl() {
-    return DEFAULT_WEBSITE_URL.replace(/\/+$/, '');
+    return DEFAULT_THEGITAI_HOST.replace(/\/+$/, '');
 }
 function defaultDeviceName() {
     try {
@@ -102,12 +114,8 @@ function buildAuthUrl(websiteUrl, params) {
     const url = new URL(`${websiteUrl}/cli-auth`);
     url.searchParams.set('code_challenge', params.codeChallenge);
     url.searchParams.set('device_name', params.deviceName);
-    if (params.redirectUri)
-        url.searchParams.set('redirect_uri', params.redirectUri);
-    if (params.state)
-        url.searchParams.set('state', params.state);
-    if (params.paste)
-        url.searchParams.set('mode', 'paste');
+    url.searchParams.set('redirect_uri', params.redirectUri);
+    url.searchParams.set('state', params.state);
     return url.toString();
 }
 const RESULT_PAGE = (heading, detail) => `<!doctype html><html><head><meta charset="utf-8"><title>TheGitAI CLI</title>` +
@@ -140,36 +148,38 @@ async function exchangeCodeForToken({ serverUrl, code, codeVerifier, fetchImpl,
         customer,
     };
 }
+async function readPastedResult({ promptCode, signal, serverUrl, codeVerifier, fetchImpl, onPasteRejected, }) {
+    while (!signal.aborted) {
+        const code = (await promptCode(signal)).trim();
+        if (code) {
+            try {
+                return await exchangeCodeForToken({ serverUrl, code, codeVerifier, fetchImpl });
+            }
+            catch (error) {
+                if (signal.aborted)
+                    break;
+                onPasteRejected?.(error.message);
+            }
+        }
+        await new Promise((resolve) => setImmediate(resolve));
+    }
+    return await new Promise(() => { });
+}
 export async function loginViaBrowser(options) {
-    const serverUrl = normalizeServerUrl(options.serverUrl ?? DEFAULT_SERVER_URL);
+    const serverUrl = normalizeServerUrl(options.serverUrl ?? DEFAULT_THEGITAI_HOST);
     const websiteUrl = resolveWebsiteUrl();
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     const openBrowser = options.openBrowser ?? openUrl;
     const onUrl = options.onUrl ?? (() => { });
     const deviceName = withOperatingSystemInfo(options.deviceName ?? defaultDeviceName());
     const { verifier, challenge } = generatePkce();
-    if (options.noBrowser) {
-        const authUrl = buildAuthUrl(websiteUrl, {
-            codeChallenge: challenge,
-            deviceName,
-            paste: true,
-        });
-        onUrl(authUrl);
-        if (!options.promptCode) {
-            throw new Error('No way to read the authorization code in this context.');
-        }
-        const code = (await options.promptCode()).trim();
-        if (!code) {
-            throw new Error('No authorization code was entered.');
-        }
-        return exchangeCodeForToken({ serverUrl, code, codeVerifier: verifier, fetchImpl });
-    }
     const state = crypto.randomBytes(16).toString('base64url');
     const server = http.createServer();
+    let timer;
     const codePromise = new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
+        timer = setTimeout(() => {
             shutDownServer(server);
-            reject(new Error('Timed out waiting for the browser login to complete.'));
+            reject(new Error('Timed out waiting for the login to complete.'));
         }, options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
         server.on('request', (req, res) => {
             const requestUrl = new URL(req.url ?? '/', 'http://127.0.0.1');
@@ -182,7 +192,7 @@ export async function loginViaBrowser(options) {
             const returnedState = requestUrl.searchParams.get('state') ?? '';
             if (!code || returnedState !== state) {
                 res.writeHead(400, { 'content-type': 'text/html', connection: 'close' });
-                res.end(RESULT_PAGE('Login failed', 'The request could not be verified. Please run ai login again.'));
+                res.end(RESULT_PAGE('Login failed', 'The request could not be verified. Please run `ai` again.'));
                 clearTimeout(timer);
                 shutDownServer(server);
                 reject(new Error('The login callback could not be verified.'));
@@ -212,8 +222,44 @@ export async function loginViaBrowser(options) {
         state,
     });
     onUrl(authUrl);
-    await openBrowser(authUrl).catch(() => false);
-    options.onWaiting?.();
-    const code = await codePromise;
-    return exchangeCodeForToken({ serverUrl, code, codeVerifier: verifier, fetchImpl });
+    const opened = await openBrowser(authUrl).catch(() => false);
+    options.onBrowserOpen?.(opened);
+    let raceSettled = false;
+    const untilSettled = (promise) => promise.catch((error) => {
+        if (raceSettled)
+            return new Promise(() => { });
+        throw error;
+    });
+    const pasteAbort = new AbortController();
+    const routes = [
+        untilSettled(codePromise.then((code) => exchangeCodeForToken({ serverUrl, code, codeVerifier: verifier, fetchImpl }))),
+    ];
+    if (options.promptCode) {
+        const pasted = readPastedResult({
+            promptCode: options.promptCode,
+            signal: pasteAbort.signal,
+            serverUrl,
+            codeVerifier: verifier,
+            fetchImpl,
+            onPasteRejected: options.onPasteRejected,
+        }).catch((error) => {
+            if (!raceSettled && isAbortError(error))
+                throw new SignInCancelledError();
+            if (!raceSettled) {
+                return new Promise(() => { });
+            }
+            throw error;
+        });
+        routes.push(untilSettled(pasted));
+    }
+    try {
+        return await Promise.race(routes);
+    }
+    finally {
+        raceSettled = true;
+        pasteAbort.abort();
+        if (timer)
+            clearTimeout(timer);
+        shutDownServer(server);
+    }
 }

package/dist/src/api/chat.js

@@ -2,6 +2,7 @@ import { drainBackgroundJobNotifications } from '../background-jobs.js';
 import { createPromptCheckpoint, sanitizeSessionSafetyForServer, } from '../session-safety.js';
 import { applySessionSnapshot, saveSessionState, snapshotFromSession, } from '../session-store.js';
 import { executeLocalToolCall } from '../tool-executor.js';
+import { saveGeneratedImage } from '../tools/save-generated-image.js';
 import { isUserInputQuestionArray } from './contracts.js';
 import { createTraceContext, gatewayFailureCategory, normalizeServerUrl, readErrorResponse, } from './http.js';
 import { collectClientEnvironment } from '../client-environment.js';
@@ -165,6 +166,9 @@ function publicStatusMessage(data) {
     if (event.phase === 'analyzing_image') {
         return (event.imageCount ?? 1) > 1 ? 'Analyzing images...' : 'Analyzing image...';
     }
+    if (event.phase === 'generating_image') {
+        return 'Generating image...';
+    }
     if (event.phase === 'running_tool')
         return `Running ${toolName}...`;
     if (event.phase === 'waiting_for_tool')
@@ -312,7 +316,14 @@ async function executeAndPostToolResult({ config, projectIndex, session, event,
     }
     try {
         const call = normalizeShellJobToolCall(event.call);
-        const rawResult = await executeLocalToolCall({ projectIndex }, session, call);
+        const rawResult = event.generatedImage
+            ? saveGeneratedImage({
+                base64Data: event.generatedImage.base64Data,
+                mimeType: event.generatedImage.mimeType,
+                suggestedFilename: event.generatedImage.suggestedFilename ||
+                    String(call.args?.filename ?? call.args?.file_name ?? ''),
+            })
+            : await executeLocalToolCall({ projectIndex }, session, call);
         preserveCancelledTurnToolResult(session, input, { ...event, call }, rawResult);
         if (signal?.aborted) {
             throw new TurnCancelledError();
@@ -383,9 +394,15 @@ async function consumeTurnStream({ response, config, projectIndex, session, inpu
             const data = event.data;
             if (data?.phase === 'analyzing_image') {
                 session.onImageAnalysis?.(Math.max(1, Number(data.imageCount ?? 1) || 1));
+                session.onImageGeneration?.(false);
+            }
+            else if (data?.phase === 'generating_image') {
+                session.onImageGeneration?.(true);
+                session.onImageAnalysis?.(0);
             }
             else if (data?.phase) {
                 session.onImageAnalysis?.(0);
+                session.onImageGeneration?.(false);
             }
             const message = publicStatusMessage(event.data);
             if (message)

package/dist/src/api/default-host.js

@@ -0,0 +1 @@
+export const DEFAULT_THEGITAI_HOST = 'https://thegit.ai';

package/dist/src/api/http.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-const DEFAULT_SERVER_URL = 'https://thegit.ai';
+import { DEFAULT_THEGITAI_HOST } from './default-host.js';
 export const TRACE_ID_HEADER = 'x-thegitai-trace-id';
 export const CLIENT_HEADER = 'x-thegitai-client';
 export const CLIENT_PLATFORM_HEADER = 'x-thegitai-client-platform';
@@ -88,7 +88,7 @@ export async function retryTransient(run, { retries = 2, baseDelayMs = 400, dead
     }
 }
 export function normalizeServerUrl(serverUrl) {
-    const normalized = String(serverUrl || DEFAULT_SERVER_URL)
+    const normalized = String(serverUrl || DEFAULT_THEGITAI_HOST)
         .trim()
         .replace(/\/+$/, '');
     if (!/^https?:\/\//i.test(normalized)) {

package/dist/src/cli-args.js

@@ -1,9 +1,24 @@
 export const AUTH_COMMANDS = new Set(['login', 'whoami', 'logout']);
+function hasPromptWordsAfter(args) {
+    for (let i = 1; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--session' || arg === '--resume') {
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('-'))
+            continue;
+        return true;
+    }
+    return false;
+}
 export function parseArgs(argv) {
     const args = argv.slice(2);
     const firstArg = args[0];
-    const command = firstArg && AUTH_COMMANDS.has(firstArg) ? firstArg : null;
-    const commandArgs = command ? args.slice(1) : [];
+    const command = firstArg && AUTH_COMMANDS.has(firstArg) &&
+        (firstArg !== 'login' || !hasPromptWordsAfter(args))
+        ? firstArg
+        : null;
     let autoYes = false;
     let help = false;
     let version = false;
@@ -12,7 +27,7 @@ export function parseArgs(argv) {
     let listSessions = false;
     let unknownOption = null;
     const promptParts = [];
-    for (let i = 0; i < args.length; i++) {
+    for (let i = command ? 1 : 0; i < args.length; i++) {
         const arg = args[i];
         if (arg === '--yes' || arg === '-y') {
             autoYes = true;
@@ -39,7 +54,7 @@ export function parseArgs(argv) {
             usage = true;
             continue;
         }
-        if (command === null && unknownOption === null && /^-/.test(arg)) {
+        if (unknownOption === null && /^-/.test(arg)) {
             unknownOption = arg;
             continue;
         }
@@ -47,7 +62,6 @@ export function parseArgs(argv) {
     }
     return {
         command,
-        commandArgs,
         autoYes,
         help,
         version,

package/dist/src/help-text.js

@@ -26,8 +26,12 @@ const HELP_MARKDOWN = [
     '',
     '## Auth',
     '',
-    '- `ai login` — sign in to TheGitAI (opens your browser to the website)',
-    '- `ai login --no-browser` — print a URL and paste the code (for SSH/headless)',
+    '- `ai` — signs you in if you are not already, then starts a session',
+    '- `ai login` — the same thing; kept for muscle memory',
+    '- Signing in opens your browser. When it cannot open one — over SSH, in a',
+    '  container, or when the browser you want is on another device — the same',
+    '  screen prints a URL you can open anywhere and takes the code that page',
+    '  gives you back. There is no mode to pick and no flag to remember.',
     '- `ai whoami` — show the signed-in account',
     '- `ai --usage` — show account usage percentage and reset times',
     '- `ai logout` — sign out',
@@ -89,6 +93,7 @@ const HELP_MARKDOWN = [
     '- `/jobs output <id>` — print one job\'s full captured output',
     '- `/jobs kill <id>` — stop one background job',
     '- `/new` — start a new conversation; this session remains saved',
+    '- `/logout` — sign out and quit',
     '- `/exit` — quit the session',
     '',
     '## Safety & approvals',
@@ -131,12 +136,14 @@ const HELP_MARKDOWN = [
     '',
     '## Troubleshooting',
     '',
-    '- "Not logged in" → run `ai login`.',
     '- Auth or permission errors → run `ai whoami` to confirm the signed-in',
     '  account.',
     '- Usage or quota errors → run `ai --usage`.',
-    '- Signed in with the wrong credentials → `ai logout`, then `ai login` with',
-    '  the account you intended to use.',
+    '- Signed in with the wrong account → `/logout` (or `ai logout`), then run',
+    '  `ai` and sign in as the account you intended to use.',
+    '- The browser did not open, or opened on the wrong machine → open the URL',
+    "  printed on the sign-in screen anywhere you like, choose \"Not on this",
+    '  machine?" on that page, and paste the code back into the terminal.',
     '- A local session was used with a different sign-in → sign in with the',
     '  account you used for that session or start a new session.',
     '- For anything else, re-run the command and report the printed error',

package/dist/src/session-store.js

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, w
 import path from 'node:path';
 import { getClientStateDir } from './client-state.js';
 import { findStoredImageByContent, pruneSessionImages, readSessionImage, sweepOrphanSessionImages, } from './core/session-image-store.js';
+import { sweepGeneratedImages } from './tools/save-generated-image.js';
 import { normalizeAssistantEditJournal } from './edit-journal.js';
 import { createSessionGrants } from './permissions.js';
 import { cloneSessionSafetyState, createSessionSafetyState, mergeLocalSessionSafetyState, normalizeSessionSafetyState, } from './session-safety.js';
@@ -224,6 +225,7 @@ export function pruneSavedSessions(rootDir, env = process.env) {
         activeSessionIds: listAllSessionIds(env),
         env,
     });
+    sweepGeneratedImages({ env });
 }
 export function readGitBranch(rootDir) {
     try {

package/dist/src/signin.js

@@ -0,0 +1,56 @@
+import { stdin as input, stdout as output } from 'node:process';
+import readline from 'node:readline/promises';
+import chalk from './colors.js';
+import { auth } from './api/index.js';
+import { DEFAULT_THEGITAI_HOST } from './api/default-host.js';
+import { loginViaBrowser } from './api/browser-login.js';
+function hyperlink(url, label) {
+    if (process.stdout.isTTY !== true)
+        return label;
+    return `\x1b]8;;${url}\x07${label}\x1b]8;;\x07`;
+}
+export function formatSignInScreen({ url }) {
+    return [
+        '',
+        `  ${chalk.bold.cyan('TheGitAI')}`,
+        '',
+        `  ${chalk.bold('Sign in to continue.')}`,
+        '  Your browser should open automatically. If not, copy this URL:',
+        '',
+        `  ${chalk.cyan(url)}`,
+        '',
+        `  ${hyperlink(url, chalk.cyan('→ Click here to authenticate'))}`,
+        '',
+        chalk.dim("  Signing in on a different machine? Choose \"Not on this machine?\""),
+        chalk.dim('  on that page, authorize, and paste the code it gives you below.'),
+        '',
+    ].join('\n');
+}
+async function promptForCode(signal) {
+    const rl = readline.createInterface({ input, output });
+    try {
+        return await rl.question(`  ${chalk.bold('Authorization code:')} `, { signal });
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function runSignIn({ env = process.env, login = loginViaBrowser, write = auth.writeCliAuthConfig, log = (line) => console.log(line), } = {}) {
+    const result = await login({
+        serverUrl: DEFAULT_THEGITAI_HOST,
+        deviceName: env.THEGITAI_DEVICE_NAME?.trim() || undefined,
+        onUrl: (url) => log(formatSignInScreen({ url })),
+        onBrowserOpen: (opened) => {
+            if (!opened) {
+                log(chalk.dim('  (no browser opened — use the URL or the code box above)'));
+            }
+        },
+        promptCode: promptForCode,
+        onPasteRejected: (message) => log(chalk.red(`  ✖ ${message}`) + chalk.dim('  Try pasting it again.')),
+    });
+    write(result, env);
+    log('');
+    log(chalk.green(`  ✓ Signed in as ${result.customer.email}`));
+    log('');
+    return result;
+}

package/dist/src/tools/index.js

@@ -23,6 +23,7 @@ import { strReplace } from './str-replace.js';
 import { undoEdit } from './undo-edit.js';
 import { updateTodos } from './update-todos.js';
 import { readImageFile } from './read-image-file.js';
+import { saveGeneratedImage } from './save-generated-image.js';
 import { writeFile } from './write-file.js';
 export const TOOL_MAP = {
     search_code: (context, args) => searchCode(context.projectIndex, args),
@@ -52,6 +53,16 @@ export const TOOL_MAP = {
     shell_job_kill: shellJobKill,
     update_todos: updateTodos,
     analyze_image: (context, args) => readImageFile(context, args),
+    generate_image: (_context, args) => {
+        if (!String(args.base64Data ?? '').trim()) {
+            return {
+                ok: false,
+                error: 'This CLI build cannot generate images without server-supplied image bytes. Update TheGitAI CLI.',
+                failureCategory: 'tool_exception',
+            };
+        }
+        return saveGeneratedImage(args);
+    },
 };
 function invalidToolCall(error) {
     return {

package/dist/src/tools/save-generated-image.js

@@ -0,0 +1,120 @@
+import { existsSync, mkdirSync, readdirSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { getClientStateDir } from '../client-state.js';
+import { MAX_IMAGE_SIZE_BYTES, sniffImageMimeType, } from '../core/image-limits.js';
+const IMAGE_FILE_MODE = 0o600;
+const IMAGE_DIR_MODE = 0o700;
+export const GENERATED_IMAGES_SUBDIR = 'generated_images';
+export const GENERATED_IMAGE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+export function getGeneratedImagesDir(env = process.env) {
+    return path.join(getClientStateDir(env), GENERATED_IMAGES_SUBDIR);
+}
+export function sanitizeGeneratedImageBasename(raw) {
+    const trimmed = String(raw ?? '').trim();
+    const base = trimmed
+        .replace(/\\/g, '/')
+        .split('/')
+        .pop()
+        ?.replace(/^\.+/, '')
+        .replace(/[^\w.\-]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .replace(/-\.|\.-/g, '.')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 80);
+    if (!base || base === '.' || base === '..') {
+        return `generated-${Date.now()}.png`;
+    }
+    if (/\.png$/i.test(base)) {
+        return base.replace(/\.png$/i, '.png');
+    }
+    const withoutExt = base.replace(/\.[^.]+$/, '').replace(/-+$/g, '');
+    return `${withoutExt || 'generated'}.png`;
+}
+function uniquePath(dir, basename) {
+    const candidate = path.join(dir, basename);
+    if (!existsSync(candidate)) {
+        return candidate;
+    }
+    const ext = path.extname(basename) || '.png';
+    const stem = path.basename(basename, ext);
+    for (let i = 2; i < 10_000; i += 1) {
+        const next = path.join(dir, `${stem}-${i}${ext}`);
+        if (!existsSync(next)) {
+            return next;
+        }
+    }
+    return path.join(dir, `${stem}-${Date.now()}${ext}`);
+}
+export function sweepGeneratedImages({ maxAgeMs = GENERATED_IMAGE_MAX_AGE_MS, env = process.env, now = Date.now(), } = {}) {
+    const dir = getGeneratedImagesDir(env);
+    if (!existsSync(dir))
+        return 0;
+    let removed = 0;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    for (const entry of entries) {
+        const filePath = path.join(dir, entry);
+        try {
+            if (now - statSync(filePath).mtimeMs < maxAgeMs)
+                continue;
+            rmSync(filePath, { force: true });
+            removed += 1;
+        }
+        catch {
+        }
+    }
+    return removed;
+}
+export function saveGeneratedImage(args) {
+    const base64Data = String(args.base64Data ?? '').trim();
+    if (!base64Data) {
+        return {
+            ok: false,
+            error: 'This CLI build cannot generate images without server-supplied image bytes. Update TheGitAI CLI.',
+            failureCategory: 'tool_exception',
+        };
+    }
+    let bytes;
+    try {
+        bytes = Buffer.from(base64Data, 'base64');
+    }
+    catch {
+        return {
+            ok: false,
+            error: 'Generated image bytes are invalid.',
+            failureCategory: 'invalid_argument',
+        };
+    }
+    if (bytes.length === 0 || bytes.length > MAX_IMAGE_SIZE_BYTES) {
+        return {
+            ok: false,
+            error: 'Generated image exceeded the allowed size limit.',
+            failureCategory: 'invalid_argument',
+        };
+    }
+    const sniffed = sniffImageMimeType(bytes);
+    if (sniffed !== 'image/png') {
+        return {
+            ok: false,
+            error: 'Generated image must be a PNG.',
+            failureCategory: 'invalid_argument',
+        };
+    }
+    const env = args.env ?? process.env;
+    const dir = getGeneratedImagesDir(env);
+    mkdirSync(dir, { recursive: true, mode: IMAGE_DIR_MODE });
+    const basename = sanitizeGeneratedImageBasename(args.suggestedFilename ?? args.filename);
+    const target = uniquePath(dir, basename);
+    writeFileSync(target, bytes, { mode: IMAGE_FILE_MODE });
+    return {
+        ok: true,
+        path: target,
+        message: `Image saved to ${target}`,
+    };
+}

package/dist/src/ui/repl.js

@@ -13,7 +13,7 @@ import { setScratchSession } from '../scratch-dir.js';
 import { setImageStoreSession } from '../core/session-image-store.js';
 import { cancelActiveCommand } from '../executor.js';
 import { isTurnFailureMarker } from '../turn-failure-marker.js';
-import { clearCliAuthConfig } from '../api/auth.js';
+import { clearCliAuthConfig, logoutFromServer, } from '../api/auth.js';
 import { authenticationErrorMessage, isAuthenticationError, } from '../api/http.js';
 import { createUserInputPromptState, formatUserInputTranscript, } from './tui/user-input.js';
 import { setCommandOutputHook, withTuiMode } from '../runtime-mode.js';
@@ -105,6 +105,10 @@ export const SLASH_COMMANDS = [
         command: '/new',
         description: 'start a new conversation; this session remains saved',
     },
+    {
+        command: '/logout',
+        description: 'Sign out and quit',
+    },
     {
         command: '/exit',
         description: 'Quit the current session',
@@ -982,6 +986,7 @@ function createInitialShellState(session, serverModels, debugUi) {
         activeTurnInputPreformatted: false,
         agentMode: session.agentMode,
         analyzingImages: 0,
+        generatingImage: false,
         approvalCursor: 0,
         approvalPrompt: null,
         approvalScrollOffset: 0,
@@ -1347,6 +1352,7 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
         throw new Error('stdout is not a terminal');
     }
     let fatalError = null;
+    let signedOut = false;
     await withTuiMode(async () => {
         setBackgroundJobSession(session.sessionId);
         setScratchSession(session.sessionId);
@@ -2404,6 +2410,22 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
                 requestExit();
                 return;
             }
+            if (input === '/logout') {
+                store.update((current) => ({
+                    ...current,
+                    busy: true,
+                    status: 'Signing out...',
+                }));
+                try {
+                    await logoutFromServer({ config: authConfig });
+                }
+                catch {
+                }
+                clearCliAuthConfig(session.env);
+                signedOut = true;
+                requestExit();
+                return;
+            }
             if (input === '/help') {
                 appendStaticEntry({
                     body: formatInteractiveHelpText(),
@@ -2623,6 +2645,7 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
                 activeTurnInput: input,
                 activeTurnInputPreformatted: preformatted,
                 analyzingImages: 0,
+                generatingImage: false,
                 busy: true,
                 busyPausedAt: null,
                 busySince: turnStartedAt,
@@ -2777,6 +2800,14 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
             store.update((current) => ({
                 ...current,
                 analyzingImages: Math.max(0, activeImageCount),
+                generatingImage: activeImageCount > 0 ? false : current.generatingImage,
+            }));
+        };
+        session.onImageGeneration = (active) => {
+            store.update((current) => ({
+                ...current,
+                generatingImage: Boolean(active),
+                analyzingImages: active ? 0 : current.analyzingImages,
             }));
         };
         session.onStatus = (message) => {
@@ -2993,4 +3024,5 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
     });
     if (fatalError)
         throw fatalError;
+    return { signedOut };
 }

package/dist/src/ui/tui/build-frame.js

@@ -181,6 +181,7 @@ const CLIENT_SLASH_COMMANDS = [
     { command: '/resume', description: 'Open the session picker to resume a previous session' },
     { command: '/jobs', description: 'Background jobs: pick to view output or kill' },
     { command: '/new', description: 'start a new conversation; this session remains saved' },
+    { command: '/logout', description: 'Sign out and quit' },
     { command: '/exit', description: 'Quit the current session' },
 ];
 function buildModelPickerOptions(currentModelId, serverModels) {
@@ -953,11 +954,13 @@ export function buildWorkingClockLine(state, elapsedSeconds) {
     if (state.busyPausedAt != null) {
         return `${WORKING_CLOCK_ICON} Paused · ${elapsed} · waiting for your response`;
     }
-    const label = state.analyzingImages > 0
-        ? state.analyzingImages > 1
-            ? 'Analyzing images'
-            : 'Analyzing image'
-        : 'Working';
+    const label = state.generatingImage
+        ? 'Generating image'
+        : state.analyzingImages > 0
+            ? state.analyzingImages > 1
+                ? 'Analyzing images'
+                : 'Analyzing image'
+            : 'Working';
     return `${WORKING_CLOCK_ICON} ${label} · ${elapsed}`;
 }
 export function approvalPanelInnerWidth(width) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thegitai/cli",
-  "version": "1.0.0-preview.25",
+  "version": "1.0.0-preview.27",
   "description": "TheGitAI is an AI coding agent for your terminal. It indexes your repository, writes and edits files, runs commands, and builds features with you.",
   "keywords": [
     "ai",
@@ -37,10 +37,10 @@
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
-    "@thegitai/tui-darwin-arm64": "1.0.0-preview.25",
-    "@thegitai/tui-darwin-x64": "1.0.0-preview.25",
-    "@thegitai/tui-linux-x64": "1.0.0-preview.25",
-    "@thegitai/tui-win32-x64": "1.0.0-preview.25",
+    "@thegitai/tui-darwin-arm64": "1.0.0-preview.27",
+    "@thegitai/tui-darwin-x64": "1.0.0-preview.27",
+    "@thegitai/tui-linux-x64": "1.0.0-preview.27",
+    "@thegitai/tui-win32-x64": "1.0.0-preview.27",
     "@vscode/ripgrep": "1.18.0"
   },
   "publishConfig": {