@tryarcanist/cli 0.1.204 → 0.1.206

package/dist/index.js

@@ -4,6 +4,13 @@
 import { createRequire as createRequire2 } from "module";
 import { Command } from "commander";
 
+// src/commands/agent-subscription.ts
+import { execFileSync, spawn } from "child_process";
+import { existsSync as existsSync2, rmSync } from "fs";
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+
 // src/api.ts
 import { createRequire } from "module";
 
@@ -604,6 +611,259 @@ function isControlCharacter(char) {
   return code < ASCII_FIRST_PRINTABLE || code === ASCII_DELETE;
 }
 
+// src/commands/agent-subscription.ts
+var GROK_SUBSCRIPTION_CLI_CONFIG = {
+  harness: "grok",
+  displayName: "Grok",
+  defaultBin: "grok",
+  binEnvVar: "ARCANIST_GROK_BIN",
+  binOption: "grok-path",
+  // RFC 8628 device flow: prints a verification URL + code, usable from a
+  // terminal without a local browser.
+  loginArgs: ["login", "--device-auth"],
+  loginEnv: () => ({}),
+  authJsonCandidates: [join2(".grok", "auth.json")],
+  // Grok Build's auth.json is issuer-keyed (observed 2026-07-15 against the
+  // installed CLI's embedded docs): {"https://accounts.x.ai/sign-in": {"key":
+  // "…"}} — so the credential fields live one level down and the token field
+  // is named `key`. Token detection scans nested objects.
+  tokenFields: ["access_token", "refresh_token", "key"],
+  installHint: "Install the Grok CLI (https://x.ai/cli), or point at it with --grok-path <path> or ARCANIST_GROK_BIN."
+};
+var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
+  harness: "cursor",
+  displayName: "Cursor",
+  defaultBin: "cursor-agent",
+  binEnvVar: "ARCANIST_CURSOR_AGENT_BIN",
+  binOption: "cursor-path",
+  loginArgs: ["login"],
+  // Cursor's CLI stores login state under its config dir; the location is not
+  // formally documented, so pin every documented override at the throwaway
+  // HOME and search the known spots afterwards.
+  loginEnv: (tempHome) => ({
+    CURSOR_CONFIG_DIR: join2(tempHome, ".cursor"),
+    XDG_CONFIG_HOME: join2(tempHome, ".config")
+  }),
+  authJsonCandidates: [
+    join2(".cursor", "auth.json"),
+    join2(".cursor", "cli-config.json"),
+    join2(".config", "cursor", "auth.json"),
+    join2(".config", "cursor", "cli-config.json")
+  ],
+  tokenFields: ["accessToken", "access_token", "refreshToken", "refresh_token", "token"],
+  installHint: "Install the Cursor CLI (https://cursor.com/docs/cli/installation), or point at it with --cursor-path <path> or ARCANIST_CURSOR_AGENT_BIN. If login-token capture keeps failing, use a Cursor API key in Settings instead.",
+  // Entry names observed 2026-07-15 after `cursor-agent login` on macOS
+  // (login keychain, account "cursor-user").
+  darwinKeychain: {
+    entries: [
+      { service: "cursor-access-token", field: "accessToken", required: true },
+      { service: "cursor-refresh-token", field: "refreshToken", required: false }
+    ]
+  }
+};
+function subscriptionBasePath(harness) {
+  return `/api/settings/agent-subscriptions/${harness}`;
+}
+function resolveVendorBin(config, optionPath) {
+  return optionPath?.trim() || process.env[config.binEnvVar]?.trim() || config.defaultBin;
+}
+function runVendorLogin(config, binPath, tempHome) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(binPath, config.loginArgs, {
+      stdio: "inherit",
+      env: tempHome ? { ...process.env, HOME: tempHome, ...config.loginEnv(tempHome) } : process.env
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(new CliError("user", `Could not find the \`${binPath}\` executable.`, { hint: config.installHint }));
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${binPath} ${config.loginArgs.join(" ")}\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${binPath} ${config.loginArgs.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
+          hint: `Complete the ${config.displayName} login, then re-run \`arcanist ${config.harness} login\`.`
+        })
+      );
+    });
+  });
+}
+function hasTokenField(value, tokenFields, depth = 0) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || depth > 2) return false;
+  const record = value;
+  if (tokenFields.some((field) => typeof record[field] === "string" && record[field].trim().length > 0)) {
+    return true;
+  }
+  return Object.values(record).some((nested) => hasTokenField(nested, tokenFields, depth + 1));
+}
+function readDarwinKeychainAuthJson(config) {
+  const record = {};
+  for (const entry of config.darwinKeychain?.entries ?? []) {
+    let value = "";
+    try {
+      value = execFileSync("security", ["find-generic-password", "-s", entry.service, "-w"], {
+        encoding: "utf8"
+      }).trim();
+    } catch {
+    }
+    if (value) {
+      record[entry.field] = value;
+    } else if (entry.required) {
+      throw new CliError(
+        "user",
+        `${config.displayName} login completed but the '${entry.service}' Keychain item could not be read.`,
+        {
+          hint: `Approve the macOS Keychain access prompt if one appeared, then re-run \`arcanist ${config.harness} login\`.`
+        }
+      );
+    }
+  }
+  return JSON.stringify(record);
+}
+async function readLoginAuthJson(config, tempHome) {
+  for (const candidate of config.authJsonCandidates) {
+    const path = join2(tempHome, candidate);
+    if (!existsSync2(path)) continue;
+    let raw;
+    try {
+      raw = await readFile(path, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      if (hasTokenField(JSON.parse(raw), config.tokenFields)) return raw;
+    } catch {
+    }
+  }
+  throw new CliError("user", `${config.displayName} login completed but no auth credential file was found.`, {
+    hint: `Verify \`${config.defaultBin} ${config.loginArgs.join(" ")}\` succeeds on its own, then re-run \`arcanist ${config.harness} login\`.`
+  });
+}
+async function setSubscriptionEnabled(apiConfig, harness, enabled) {
+  return apiFetch(apiConfig, `${subscriptionBasePath(harness)}/enabled`, {
+    method: "PUT",
+    body: JSON.stringify({ enabled })
+  });
+}
+async function agentSubscriptionLoginCommand(config, options, command) {
+  const { config: apiConfig } = resolveBusinessContext(command, options);
+  const binPath = resolveVendorBin(config, options.binPath);
+  let tempHome;
+  const handleSigint = () => {
+    if (tempHome) {
+      try {
+        rmSync(tempHome, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    process.exit(EXIT_CODE_INTERRUPTED);
+  };
+  process.on("SIGINT", handleSigint);
+  try {
+    const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
+    let authJson;
+    if (captureViaKeychain) {
+      await runVendorLogin(config, binPath, null);
+      authJson = readDarwinKeychainAuthJson(config);
+    } else {
+      tempHome = await mkdtemp(join2(tmpdir(), `arcanist-${config.harness}-`));
+      await runVendorLogin(config, binPath, tempHome);
+      authJson = await readLoginAuthJson(config, tempHome);
+    }
+    const state = await apiFetch(
+      apiConfig,
+      `${subscriptionBasePath(config.harness)}/auth-json`,
+      {
+        method: "PUT",
+        body: JSON.stringify({ authJson })
+      }
+    );
+    let activated = false;
+    let activationError;
+    try {
+      await setSubscriptionEnabled(apiConfig, config.harness, true);
+      activated = true;
+    } catch (err) {
+      activationError = err instanceof Error ? err.message : String(err);
+    }
+    emit(command, options, { ...state, enabled: activated }, (payload) => {
+      console.log(
+        activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
+      );
+      if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
+      if (!activated) {
+        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+        console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
+      }
+      console.log(
+        `Note: ${config.displayName} BYOS session execution is not live yet; the credential is stored for when it ships.`
+      );
+      if (captureViaKeychain) {
+        console.log(
+          `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
+        );
+      }
+    });
+  } finally {
+    try {
+      if (tempHome) {
+        await rm(tempHome, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    } finally {
+      process.off("SIGINT", handleSigint);
+    }
+  }
+}
+async function agentSubscriptionUseCommand(config, state, options, command) {
+  const normalized = state.trim().toLowerCase();
+  if (normalized !== "on" && normalized !== "off") {
+    throw new CliError("user", `Usage: arcanist ${config.harness} use <on|off>`);
+  }
+  const enabled = normalized === "on";
+  const { config: apiConfig } = resolveBusinessContext(command, options);
+  const result = await setSubscriptionEnabled(apiConfig, config.harness, enabled);
+  emit(
+    command,
+    options,
+    result,
+    () => console.log(
+      result.enabled ? `${config.displayName} subscription auth is now selected for ${config.displayName} sessions.` : `${config.displayName} subscription auth is no longer selected.`
+    )
+  );
+}
+async function agentSubscriptionStatusCommand(config, options, command) {
+  const { config: apiConfig } = resolveBusinessContext(command, options);
+  const payload = await apiFetch(apiConfig, subscriptionBasePath(config.harness));
+  emit(command, options, payload, (state) => {
+    console.log(`Eligible: ${state.eligible ? "yes" : "no"}`);
+    console.log(`Auth saved: ${state.credential.isSet ? "yes" : "no"}`);
+    console.log(`Selected: ${state.enabled ? "yes" : "no"}`);
+    if (state.credential.lastValidationStatus) console.log(`Status: ${state.credential.lastValidationStatus}`);
+  });
+}
+async function agentSubscriptionLogoutCommand(config, options, command) {
+  const { config: apiConfig } = resolveBusinessContext(command, options);
+  await setSubscriptionEnabled(apiConfig, config.harness, false).catch(() => {
+  });
+  const payload = await apiFetch(
+    apiConfig,
+    `${subscriptionBasePath(config.harness)}/auth-json`,
+    { method: "DELETE" }
+  );
+  emit(
+    command,
+    options,
+    payload,
+    () => console.log(`${config.displayName} subscription auth deactivated and cleared.`)
+  );
+}
+
 // src/commands/auth.ts
 async function whoamiCommand(options, command) {
   const { config } = resolveBusinessContext(command, options);
@@ -618,16 +878,19 @@ async function whoamiCommand(options, command) {
 var CODEX_AGENT_RUNTIME_BACKEND = "codex";
 var CLAUDE_CODE_AGENT_RUNTIME_BACKEND = "claude_code";
 var OPENCODE_AGENT_RUNTIME_BACKEND = "opencode";
+var CURSOR_AGENT_RUNTIME_BACKEND = "cursor";
 var AGENT_RUNTIME_BACKENDS = [
   CODEX_AGENT_RUNTIME_BACKEND,
   CLAUDE_CODE_AGENT_RUNTIME_BACKEND,
-  OPENCODE_AGENT_RUNTIME_BACKEND
+  OPENCODE_AGENT_RUNTIME_BACKEND,
+  CURSOR_AGENT_RUNTIME_BACKEND
 ];
 var AGENT_RUNTIME_BACKEND_NAMES = {
   [CODEX_AGENT_RUNTIME_BACKEND]: "Codex",
   [CLAUDE_CODE_AGENT_RUNTIME_BACKEND]: "Claude Code",
   // "opencode" is intentionally lowercase to match the project's brand name.
-  [OPENCODE_AGENT_RUNTIME_BACKEND]: "opencode"
+  [OPENCODE_AGENT_RUNTIME_BACKEND]: "opencode",
+  [CURSOR_AGENT_RUNTIME_BACKEND]: "Cursor"
 };
 function isAgentRuntimeBackend(value) {
   return AGENT_RUNTIME_BACKENDS.includes(value);
@@ -669,10 +932,18 @@ var AnthropicModel = {
 var BasetenModel = {
   KimiK27Code: "kimi-k2.7-code"
 };
+var XaiModel = {
+  Grok45: "grok-4.5"
+};
+var CursorModel = {
+  Composer25: "composer-2.5"
+};
 var MODEL_PROVIDERS_SET = /* @__PURE__ */ new Set([
   "openai",
   "anthropic",
-  "baseten"
+  "baseten",
+  "xai",
+  "cursor"
 ]);
 var BACKEND_DESKTOP_IMAGE_FEEDBACK_CONFIGS = {
   [CODEX_AGENT_RUNTIME_BACKEND]: {
@@ -986,12 +1257,47 @@ var MODEL_REGISTRY = [
     },
     pricing: { inputPerMillion: 0.95, outputPerMillion: 4, cacheReadPerMillion: 0.16 },
     sessionStart: { eligible: true, isDefault: true }
+  },
+  {
+    id: XaiModel.Grok45,
+    name: "Grok 4.5",
+    provider: "xai",
+    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
+    contextWindow: 5e5,
+    // No reasoning config on purpose: xAI's chat-completions reference
+    // (verified 2026-07-14, https://docs.x.ai/docs/api-reference) documents
+    // `reasoning_effort` as supported only by grok-4.3, so grok-4.5 is
+    // classified no-reasoning per the registry rule. Pricing/context verified
+    // 2026-07-14 against https://docs.x.ai/docs/pricing ($2/M in, $6/M out,
+    // 500k context); no cached-input rate is documented, so none is recorded.
+    pricing: { inputPerMillion: 2, outputPerMillion: 6 },
+    sessionStart: { eligible: true }
+  },
+  {
+    id: CursorModel.Composer25,
+    name: "Composer 2.5",
+    provider: "cursor",
+    backends: [CURSOR_AGENT_RUNTIME_BACKEND],
+    // Cursor bills Composer usage through the user's Cursor account (API key
+    // or subscription); Arcanist does not meter it, so no registry pricing is
+    // recorded (costTracked: false requires pricing to stay undefined). No
+    // reasoning config: Cursor encodes effort in distinct model ids
+    // (`--list-models`), not a per-request parameter. Context window is not
+    // published for Composer 2.5 (checked cursor.com/docs/models 2026-07-15),
+    // so none is recorded.
+    costTracked: false,
+    sessionStart: { eligible: true, isDefault: true },
+    // Internal probe: hidden from the public model picker; selectable via
+    // CLI/API only while the cursor backend is gated.
+    visibility: "internal_probe"
   }
 ];
 var MODEL_PROVIDER_NAMES = {
   openai: "OpenAI",
   anthropic: "Anthropic",
-  baseten: "Baseten"
+  baseten: "Baseten",
+  xai: "xAI",
+  cursor: "Cursor"
 };
 function buildSessionStartModelIdsByBackend() {
   const byBackend = Object.fromEntries(AGENT_RUNTIME_BACKENDS.map((backend) => [backend, []]));
@@ -1030,7 +1336,8 @@ var VALID_SESSION_START_MODEL_IDS_BY_BACKEND = {
   [CLAUDE_CODE_AGENT_RUNTIME_BACKEND]: new Set(
     SESSION_START_MODEL_IDS_BY_BACKEND[CLAUDE_CODE_AGENT_RUNTIME_BACKEND]
   ),
-  [OPENCODE_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[OPENCODE_AGENT_RUNTIME_BACKEND])
+  [OPENCODE_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[OPENCODE_AGENT_RUNTIME_BACKEND]),
+  [CURSOR_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[CURSOR_AGENT_RUNTIME_BACKEND])
 };
 var MODEL_CONTEXT_WINDOWS = {
   ...Object.fromEntries(
@@ -1231,7 +1538,7 @@ async function listAutomationsCommand(options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
   const items = [];
-  let cursor = options.cursor;
+  let cursor2 = options.cursor;
   let nextCursor = null;
   let pageCount = 0;
   do {
@@ -1241,14 +1548,14 @@ async function listAutomationsCommand(options, command) {
     }
     const query = new URLSearchParams();
     if (options.limit) query.set("limit", options.limit);
-    if (cursor) query.set("cursor", cursor);
+    if (cursor2) query.set("cursor", cursor2);
     const payload = await automationApiFetch(
       config,
       `/api/automation/schedules${query.size ? `?${query.toString()}` : ""}`
     );
     items.push(...payload.data.items);
     nextCursor = payload.data.nextCursor;
-    cursor = nextCursor ?? void 0;
+    cursor2 = nextCursor ?? void 0;
   } while (options.all === true && nextCursor);
   const output = { items, nextCursor: options.all === true ? null : nextCursor };
   if (isJson(command, options)) {
@@ -1341,11 +1648,11 @@ function formatTime(value) {
 }
 
 // src/commands/codex.ts
-import { spawn } from "child_process";
-import { rmSync } from "fs";
-import { mkdtemp, readFile, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { spawn as spawn2 } from "child_process";
+import { rmSync as rmSync2 } from "fs";
+import { mkdtemp as mkdtemp2, readFile as readFile2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join3 } from "path";
 var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
 var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
 var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
@@ -1354,7 +1661,7 @@ function resolveCodexPath(optionPath) {
 }
 function runCodexDeviceLogin(codexPath, codexHome) {
   return new Promise((resolve2, reject) => {
-    const child = spawn(codexPath, ["login", "--device-auth"], {
+    const child = spawn2(codexPath, ["login", "--device-auth"], {
       stdio: "inherit",
       env: { ...process.env, CODEX_HOME: codexHome }
     });
@@ -1395,7 +1702,7 @@ async function codexLoginCommand(options, command) {
   const handleSigint = () => {
     if (codexHome) {
       try {
-        rmSync(codexHome, { recursive: true, force: true });
+        rmSync2(codexHome, { recursive: true, force: true });
       } catch {
       }
     }
@@ -1403,11 +1710,11 @@ async function codexLoginCommand(options, command) {
   };
   process.on("SIGINT", handleSigint);
   try {
-    codexHome = await mkdtemp(join2(tmpdir(), "arcanist-codex-"));
+    codexHome = await mkdtemp2(join3(tmpdir2(), "arcanist-codex-"));
     await runCodexDeviceLogin(codexPath, codexHome);
     let authJson;
     try {
-      authJson = await readFile(join2(codexHome, "auth.json"), "utf8");
+      authJson = await readFile2(join3(codexHome, "auth.json"), "utf8");
     } catch {
       throw new CliError("user", "Codex login completed but no auth.json was written.", {
         hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
@@ -1441,7 +1748,7 @@ async function codexLoginCommand(options, command) {
   } finally {
     try {
       if (codexHome) {
-        await rm(codexHome, { recursive: true, force: true }).catch(() => {
+        await rm2(codexHome, { recursive: true, force: true }).catch(() => {
         });
       }
     } finally {
@@ -1536,7 +1843,7 @@ function isWatchTerminal(phase) {
 }
 
 // src/uploads.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { basename, extname } from "path";
 
 // ../../shared/constants/uploads.ts
@@ -1639,7 +1946,7 @@ async function resolveUploadedFileOptions(files) {
     paths.map(async (path) => {
       const name = basename(path);
       try {
-        return { name, content: await readFile2(path, "utf8") };
+        return { name, content: await readFile3(path, "utf8") };
       } catch (err) {
         const message = stringifyError(err);
         throw new CliError("user", `Failed to read uploaded file ${path}: ${message}`);
@@ -2095,6 +2402,7 @@ function createFlattenState() {
     toolCallIndexById: /* @__PURE__ */ new Map(),
     agentProgressIndexByKey: /* @__PURE__ */ new Map(),
     questionIndexById: /* @__PURE__ */ new Map(),
+    narrationIndex: null,
     malformedSearchBlockedPromptIds: /* @__PURE__ */ new Set(),
     malformedSearchBlockedWithoutPrompt: false
   };
@@ -2426,6 +2734,23 @@ function applyTodoUpdate(data, state) {
     }
   }
 }
+function projectNarration(data, state) {
+  const text = typeof data?.text === "string" ? data.text.trim() : "";
+  if (!text) return;
+  const promptId = resolvePromptId(data);
+  const event = {
+    type: "narration",
+    id: "narration",
+    text,
+    ...promptId ? { promptId } : {}
+  };
+  if (state.narrationIndex === null) {
+    state.narrationIndex = state.merged.length;
+    state.merged.push(event);
+  } else {
+    state.merged[state.narrationIndex] = event;
+  }
+}
 function flattenSessionEvents(raw) {
   const state = createFlattenState();
   const normalizedEvents = normalizeRawSessionEvents(raw);
@@ -2499,6 +2824,9 @@ function flattenSessionEvents(raw) {
       case "question":
         projectQuestion(data, state);
         break;
+      case "narration":
+        projectNarration(data, state);
+        break;
     }
   }
   return suppressMalformedSearchSegments(state);
@@ -2828,6 +3156,9 @@ ${event.answer ? `**Answer:** ${event.answer}
       return "";
     case "agent_progress":
       return `*[${event.label}]*
+`;
+    case "narration":
+      return `*[Currently: ${event.text}]*
 `;
     case "raw_agent_runtime":
       return "";
@@ -3126,6 +3457,10 @@ function resolveModelAndBackend(options) {
       );
     }
     agentRuntimeBackend = options.backend;
+  } else if (options.model !== void 0) {
+    const normalizedModel = extractModelId(options.model);
+    const derived = normalizedModel ? getAgentRuntimeBackendForModel(normalizedModel) : void 0;
+    if (derived) agentRuntimeBackend = derived;
   }
   if (options.model !== void 0) {
     const normalizedModel = extractModelId(options.model);
@@ -3936,10 +4271,10 @@ async function qaCommand(prUrl, options, command) {
 }
 
 // src/git.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 function git(args) {
   try {
-    return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     throw new CliError("user", `git ${args.join(" ")} failed: ${stringifyError(err)}`);
   }
@@ -4046,7 +4381,7 @@ function parseRespondConflict(err) {
 }
 
 // src/commands/sandbox.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
@@ -4593,7 +4928,7 @@ function assertCleanAndPushed() {
     throw new CliError("user", "Current commit is not pushed; push before building the sandbox layer.");
 }
 function assertManifestExists(path) {
-  if (!existsSync2(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
+  if (!existsSync3(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
 }
 function parseRepoArg3(value, fallback) {
   if (!value) return fallback();
@@ -4824,9 +5159,9 @@ function sourceBody(sourceRepo, manifestPath) {
 }
 async function sandboxInitCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
-  if (existsSync2(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
+  if (existsSync3(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
   const layerPath = ".arcanist/sandbox.layer.Dockerfile";
-  if (existsSync2(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
+  if (existsSync3(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
   mkdirSync2(dirname2(DEFAULT_MANIFEST_PATH), { recursive: true });
   writeFileSync2(
     DEFAULT_MANIFEST_PATH,
@@ -5124,7 +5459,7 @@ async function listSessionsCommand(options, command) {
   const runtime = getRuntimeOptions(command, options);
   const config = requireConfig(runtime);
   const sessions2 = [];
-  let cursor = options.cursor;
+  let cursor2 = options.cursor;
   let nextCursor = null;
   let pageCount = 0;
   do {
@@ -5138,14 +5473,14 @@ async function listSessionsCommand(options, command) {
     if (options.search) query.set("q", options.search);
     if (options.repo) query.set("repo", options.repo);
     if (options.limit) query.set("limit", options.limit);
-    if (cursor) query.set("cursor", cursor);
+    if (cursor2) query.set("cursor", cursor2);
     const payload2 = await apiFetch(
       config,
       `/api/sessions${query.size ? `?${query.toString()}` : ""}`
     );
     sessions2.push(...payload2.sessions);
     nextCursor = payload2.nextCursor;
-    cursor = nextCursor ?? void 0;
+    cursor2 = nextCursor ?? void 0;
   } while (options.all === true && nextCursor);
   const payload = { sessions: sessions2, nextCursor: options.all === true ? null : nextCursor };
   if (isJson(command, options)) {
@@ -5377,7 +5712,7 @@ var MAX_ALL_PAGES3 = 1e3;
 async function listTokensCommand(options, command) {
   const { config } = resolveBusinessContext(command, options);
   const data = [];
-  let cursor = options.cursor;
+  let cursor2 = options.cursor;
   let nextCursor = null;
   let pageCount = 0;
   do {
@@ -5387,14 +5722,14 @@ async function listTokensCommand(options, command) {
     }
     const query = new URLSearchParams();
     if (options.limit) query.set("limit", options.limit);
-    if (cursor) query.set("cursor", cursor);
+    if (cursor2) query.set("cursor", cursor2);
     const payload2 = await apiFetch(
       config,
       `/api/cli-tokens${query.size ? `?${query.toString()}` : ""}`
     );
     data.push(...payload2.data);
     nextCursor = payload2.nextCursor;
-    cursor = nextCursor ?? void 0;
+    cursor2 = nextCursor ?? void 0;
   } while (options.all === true && nextCursor);
   const payload = { data, nextCursor: options.all === true ? null : nextCursor };
   emit(command, options, payload, (listPayload) => {
@@ -5628,6 +5963,52 @@ Examples:
 codex.command("use <state>").description("Turn using your saved Codex subscription auth for OpenAI sessions on or off (state: on|off)").action((state, options, command) => codexUseCommand(state, options, command));
 codex.command("status").description("Show whether your workspace is eligible and whether a Codex subscription auth is saved").action((options, command) => codexStatusCommand(options, command));
 codex.command("logout").description("Deactivate the selector and remove the stored Codex subscription auth for your user").action((options, command) => codexLogoutCommand(options, command));
+var grok = program.command("grok").description("Grok (xAI) subscription (bring-your-own-subscription) commands");
+grok.command("login").description("Authenticate a Grok (xAI) subscription and store it for future Grok BYOS sessions").option("--grok-path <path>", "Path to the grok executable (default: grok on PATH, or ARCANIST_GROK_BIN)").addHelpText(
+  "after",
+  `
+Runs the Grok CLI device-authorization login locally under a temporary HOME, then uploads the
+resulting auth.json to Arcanist (encrypted, per user) and activates the selector. Your workspace
+must have Grok subscription auth enabled. The credential is never written to your default ~/.grok.
+Grok BYOS session execution is not live yet; the credential is stored for when it ships.
+
+Examples:
+  arcanist grok login
+  arcanist grok login --grok-path /usr/local/bin/grok
+`
+).action(
+  (options, command) => agentSubscriptionLoginCommand(GROK_SUBSCRIPTION_CLI_CONFIG, { ...options, binPath: options.grokPath }, command)
+);
+grok.command("use <state>").description("Turn using your saved Grok subscription auth on or off (state: on|off)").action(
+  (state, options, command) => agentSubscriptionUseCommand(GROK_SUBSCRIPTION_CLI_CONFIG, state, options, command)
+);
+grok.command("status").description("Show whether your workspace is eligible and whether a Grok subscription auth is saved").action((options, command) => agentSubscriptionStatusCommand(GROK_SUBSCRIPTION_CLI_CONFIG, options, command));
+grok.command("logout").description("Deactivate the selector and remove the stored Grok subscription auth for your user").action((options, command) => agentSubscriptionLogoutCommand(GROK_SUBSCRIPTION_CLI_CONFIG, options, command));
+var cursor = program.command("cursor").description("Cursor subscription (bring-your-own-subscription) commands");
+cursor.command("login").description("Authenticate a Cursor subscription and store it for future Cursor BYOS sessions").option(
+  "--cursor-path <path>",
+  "Path to the cursor-agent executable (default: cursor-agent on PATH, or ARCANIST_CURSOR_AGENT_BIN)"
+).addHelpText(
+  "after",
+  `
+Runs the Cursor CLI login locally under a temporary HOME/CURSOR_CONFIG_DIR, then uploads the
+captured auth credential to Arcanist (encrypted, per user) and activates the selector. Your
+workspace must have Cursor subscription auth enabled. Cursor's login-token location is not
+formally documented; if capture fails, use a Cursor API key in Settings instead. Cursor BYOS
+session execution is not live yet; the credential is stored for when it ships.
+
+Examples:
+  arcanist cursor login
+  arcanist cursor login --cursor-path /usr/local/bin/cursor-agent
+`
+).action(
+  (options, command) => agentSubscriptionLoginCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, { ...options, binPath: options.cursorPath }, command)
+);
+cursor.command("use <state>").description("Turn using your saved Cursor subscription auth on or off (state: on|off)").action(
+  (state, options, command) => agentSubscriptionUseCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, state, options, command)
+);
+cursor.command("status").description("Show whether your workspace is eligible and whether a Cursor subscription auth is saved").action((options, command) => agentSubscriptionStatusCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
+cursor.command("logout").description("Deactivate the selector and remove the stored Cursor subscription auth for your user").action((options, command) => agentSubscriptionLogoutCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
 var sessions = program.command("sessions").description("Session commands");
 addCreateOptions(sessions.command("create").description("Create a session and send a prompt")).action(
   (repoUrl, prompt, options, command) => createCommand(repoUrl, prompt, options, command)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.204",
+  "version": "0.1.206",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {