@tryarcanist/cli 0.1.222 → 0.1.224

package/dist/index.js

@@ -5,11 +5,11 @@ import { createRequire as createRequire2 } from "module";
 import { Command } from "commander";
 
 // src/commands/agent-subscription.ts
-import { execFileSync, spawn } from "child_process";
-import { existsSync as existsSync2, rmSync } from "fs";
-import { mkdtemp, readFile, rm } from "fs/promises";
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join2 } from "path";
+import { execFileSync, spawn as spawn2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { readFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 
 // src/api.ts
@@ -640,6 +640,71 @@ function isControlCharacter(char) {
   return code < ASCII_FIRST_PRINTABLE || code === ASCII_DELETE;
 }
 
+// src/vendor-login.ts
+import { spawn } from "child_process";
+import { rmSync } from "fs";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var VendorBinaryMissingError = class extends CliError {
+  constructor(binPath, hint) {
+    super("user", `Could not find the \`${binPath}\` executable.`, { hint });
+    this.name = "VendorBinaryMissingError";
+  }
+};
+function runVendorLoginProcess(spec) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(spec.binPath, spec.args, {
+      stdio: "inherit",
+      env: { ...process.env, ...spec.env }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(new VendorBinaryMissingError(spec.binPath, spec.missingBinaryHint));
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${spec.binPath} ${spec.args.join(" ")}\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${spec.binPath} ${spec.args.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
+          hint: `Complete the ${spec.displayName} login, then re-run \`${spec.retryCommand}\`.`
+        })
+      );
+    });
+  });
+}
+async function withIsolatedLoginDir(prefix, fn) {
+  let tempDir;
+  const handleSigint = () => {
+    if (tempDir) {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    process.exit(EXIT_CODE_INTERRUPTED);
+  };
+  process.on("SIGINT", handleSigint);
+  try {
+    tempDir = await mkdtemp(join2(tmpdir(), prefix));
+    return await fn(tempDir);
+  } finally {
+    try {
+      if (tempDir) {
+        await rm(tempDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    } finally {
+      process.off("SIGINT", handleSigint);
+    }
+  }
+}
+
 // src/commands/agent-subscription.ts
 var GROK_SUBSCRIPTION_CLI_CONFIG = {
   harness: "grok",
@@ -650,7 +715,7 @@ var GROK_SUBSCRIPTION_CLI_CONFIG = {
   // terminal without a local browser.
   loginArgs: ["login", "--device-auth"],
   loginEnv: () => ({}),
-  authJsonCandidates: [join2(".grok", "auth.json")],
+  authJsonCandidates: [join3(".grok", "auth.json")],
   // Grok Build's auth.json is issuer-keyed (observed 2026-07-15 against the
   // installed CLI's embedded docs): {"https://accounts.x.ai/sign-in": {"key":
   // "…"}} — so the credential fields live one level down and the token field
@@ -663,8 +728,8 @@ var GROK_SUBSCRIPTION_CLI_CONFIG = {
   installer: {
     command: "curl -fsSL https://x.ai/cli/install.sh | bash",
     binCandidates: (home) => [
-      join2(home, ".grok", "bin", "grok"),
-      join2(home, ".local", "bin", "grok"),
+      join3(home, ".grok", "bin", "grok"),
+      join3(home, ".local", "bin", "grok"),
       "/usr/local/bin/grok"
     ],
     postInstallNote: "Grok CLI installed. Restart your shell if `grok` is not found on PATH later."
@@ -680,14 +745,14 @@ var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
   // formally documented, so pin every documented override at the throwaway
   // HOME and search the known spots afterwards.
   loginEnv: (tempHome) => ({
-    CURSOR_CONFIG_DIR: join2(tempHome, ".cursor"),
-    XDG_CONFIG_HOME: join2(tempHome, ".config")
+    CURSOR_CONFIG_DIR: join3(tempHome, ".cursor"),
+    XDG_CONFIG_HOME: join3(tempHome, ".config")
   }),
   authJsonCandidates: [
-    join2(".cursor", "auth.json"),
-    join2(".cursor", "cli-config.json"),
-    join2(".config", "cursor", "auth.json"),
-    join2(".config", "cursor", "cli-config.json")
+    join3(".cursor", "auth.json"),
+    join3(".cursor", "cli-config.json"),
+    join3(".config", "cursor", "auth.json"),
+    join3(".config", "cursor", "cli-config.json")
   ],
   tokenFields: ["accessToken", "access_token", "refreshToken", "refresh_token", "token"],
   installHint: "Install the Cursor CLI (https://cursor.com/docs/cli/installation), or point at it with --cursor-path <path> or ARCANIST_CURSOR_AGENT_BIN. If login-token capture keeps failing, use a Cursor API key in Settings instead.",
@@ -705,7 +770,7 @@ var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
   // name first, since `agent` is also Grok's alias.
   installer: {
     command: "curl https://cursor.com/install -fsS | bash",
-    binCandidates: (home) => [join2(home, ".local", "bin", "cursor-agent"), join2(home, ".local", "bin", "agent")],
+    binCandidates: (home) => [join3(home, ".local", "bin", "cursor-agent"), join3(home, ".local", "bin", "agent")],
     postInstallNote: 'Cursor CLI installed to ~/.local/bin. Add it to your PATH for future shells: export PATH="$HOME/.local/bin:$PATH"'
   }
 };
@@ -715,15 +780,9 @@ function subscriptionBasePath(harness) {
 function resolveVendorBin(config, optionPath) {
   return optionPath?.trim() || process.env[config.binEnvVar]?.trim() || config.defaultBin;
 }
-var VendorBinaryMissingError = class extends CliError {
-  constructor(config, binPath) {
-    super("user", `Could not find the \`${binPath}\` executable.`, { hint: config.installHint });
-    this.name = "VendorBinaryMissingError";
-  }
-};
 function runVendorInstall(config, command) {
   return new Promise((resolve2, reject) => {
-    const child = spawn("bash", ["-c", command], { stdio: ["inherit", 2, "inherit"] });
+    const child = spawn2("bash", ["-c", command], { stdio: ["inherit", 2, "inherit"] });
     child.on("error", (err) => {
       reject(
         new CliError("user", `Failed to run the ${config.displayName} CLI installer: ${err.message}`, {
@@ -779,29 +838,13 @@ async function runVendorLoginWithInstallOffer(config, binPath, tempHome, explici
   }
 }
 function runVendorLogin(config, binPath, tempHome) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn(binPath, config.loginArgs, {
-      stdio: "inherit",
-      env: tempHome ? { ...process.env, HOME: tempHome, ...config.loginEnv(tempHome) } : process.env
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        reject(new VendorBinaryMissingError(config, binPath));
-        return;
-      }
-      reject(new CliError("user", `Failed to launch \`${binPath} ${config.loginArgs.join(" ")}\`: ${err.message}`));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve2();
-        return;
-      }
-      reject(
-        new CliError("user", `\`${binPath} ${config.loginArgs.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
-          hint: `Complete the ${config.displayName} login, then re-run \`arcanist ${config.harness} login\`.`
-        })
-      );
-    });
+  return runVendorLoginProcess({
+    displayName: config.displayName,
+    binPath,
+    args: config.loginArgs,
+    env: tempHome ? { HOME: tempHome, ...config.loginEnv(tempHome) } : {},
+    missingBinaryHint: config.installHint,
+    retryCommand: `arcanist ${config.harness} login`
   });
 }
 function hasTokenField(value, tokenFields, depth = 0) {
@@ -838,7 +881,7 @@ function readDarwinKeychainAuthJson(config) {
 }
 async function readLoginAuthJson(config, tempHome) {
   for (const candidate of config.authJsonCandidates) {
-    const path = join2(tempHome, candidate);
+    const path = join3(tempHome, candidate);
     if (!existsSync2(path)) continue;
     let raw;
     try {
@@ -865,72 +908,51 @@ async function agentSubscriptionLoginCommand(config, options, command) {
   const { config: apiConfig } = resolveBusinessContext(command, options);
   const binPath = resolveVendorBin(config, options.binPath);
   const explicitBinPath = Boolean(options.binPath?.trim() || process.env[config.binEnvVar]?.trim());
-  let tempHome;
-  const handleSigint = () => {
-    if (tempHome) {
-      try {
-        rmSync(tempHome, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    process.exit(EXIT_CODE_INTERRUPTED);
-  };
-  process.on("SIGINT", handleSigint);
-  try {
-    const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
-    let authJson;
-    if (captureViaKeychain) {
-      await runVendorLoginWithInstallOffer(config, binPath, null, explicitBinPath);
-      authJson = readDarwinKeychainAuthJson(config);
-    } else {
-      tempHome = await mkdtemp(join2(tmpdir(), `arcanist-${config.harness}-`));
+  const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
+  let authJson;
+  if (captureViaKeychain) {
+    await runVendorLoginWithInstallOffer(config, binPath, null, explicitBinPath);
+    authJson = readDarwinKeychainAuthJson(config);
+  } else {
+    authJson = await withIsolatedLoginDir(`arcanist-${config.harness}-`, async (tempHome) => {
       await runVendorLoginWithInstallOffer(config, binPath, tempHome, explicitBinPath);
-      authJson = await readLoginAuthJson(config, tempHome);
+      return readLoginAuthJson(config, tempHome);
+    });
+  }
+  const state = await apiFetch(
+    apiConfig,
+    `${subscriptionBasePath(config.harness)}/auth-json`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ authJson })
     }
-    const state = await apiFetch(
-      apiConfig,
-      `${subscriptionBasePath(config.harness)}/auth-json`,
-      {
-        method: "PUT",
-        body: JSON.stringify({ authJson })
-      }
+  );
+  let activated = false;
+  let activationError;
+  try {
+    await setSubscriptionEnabled(apiConfig, config.harness, true);
+    activated = true;
+  } catch (err) {
+    activationError = err instanceof Error ? err.message : String(err);
+  }
+  emit(command, options, { ...state, enabled: activated }, (payload) => {
+    console.log(
+      activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
     );
-    let activated = false;
-    let activationError;
-    try {
-      await setSubscriptionEnabled(apiConfig, config.harness, true);
-      activated = true;
-    } catch (err) {
-      activationError = err instanceof Error ? err.message : String(err);
+    if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
+    if (!activated) {
+      console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+      console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
     }
-    emit(command, options, { ...state, enabled: activated }, (payload) => {
-      console.log(
-        activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
-      );
-      if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
-      if (!activated) {
-        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
-        console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
-      }
+    console.log(
+      `${config.displayName} sessions will use your subscription auth while the selector is on; run \`arcanist ${config.harness} use off\` to switch back.`
+    );
+    if (captureViaKeychain) {
       console.log(
-        `${config.displayName} sessions will use your subscription auth while the selector is on; run \`arcanist ${config.harness} use off\` to switch back.`
+        `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
       );
-      if (captureViaKeychain) {
-        console.log(
-          `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
-        );
-      }
-    });
-  } finally {
-    try {
-      if (tempHome) {
-        await rm(tempHome, { recursive: true, force: true }).catch(() => {
-        });
-      }
-    } finally {
-      process.off("SIGINT", handleSigint);
     }
-  }
+  });
 }
 async function agentSubscriptionUseCommand(config, state, options, command) {
   const normalized = state.trim().toLowerCase();
@@ -976,58 +998,97 @@ async function agentSubscriptionLogoutCommand(config, options, command) {
   );
 }
 
-// src/commands/review.ts
-var PR_REVIEW_POLL_INTERVAL_MS = 1e4;
-var PR_REVIEW_WAIT_TIMEOUT_MS = 30 * 60 * 1e3;
-async function reviewCommand(prUrl, options = {}, command) {
-  assertArcanistSessionMutationAllowed("review");
-  const { config } = resolveBusinessContext(command, options);
-  const trigger = await apiFetch(config, "/api/pr-reviews", {
-    method: "POST",
-    body: JSON.stringify({
-      prUrl,
-      ...options.focus ? { focus: options.focus } : {},
-      // Send an explicitly passed model even when empty (e.g. --model "$VAR" with an
-      // unset VAR) so the server rejects it as invalid instead of silently routing.
-      ...options.model !== void 0 ? { model: options.model } : {}
-    })
-  });
-  if (!options.wait || trigger.cached) {
-    emit(command, options, trigger, (payload) => {
-      if (payload.cached) console.log(`Zeus review already completed: ${payload.verdict ?? "unknown"}.`);
-      else console.log(`Started Zeus review${payload.sessionId ? ` (${payload.sessionId})` : ""}.`);
-    });
-    return;
+// ../../shared/utils/timing.ts
+function sleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+
+// src/status-poll.ts
+async function pollUntilSettled(opts) {
+  const deadline = Date.now() + opts.timeoutMs;
+  while (Date.now() < deadline) {
+    const settled = await opts.fetchStatus();
+    if (settled !== null) return settled;
+    await sleep(opts.pollIntervalMs);
   }
-  const result = await waitForReview(config, prUrl, trigger.sessionId ?? null);
-  emit(command, options, result, (payload) => {
-    console.log(`Zeus review: ${sanitizeTerminalText(payload.verdict)}. ${payload.findings.length} finding(s).`);
-    for (const finding of payload.findings) {
-      console.log(
-        `${sanitizeTerminalText(finding.severity)} ${sanitizeTerminalText(finding.file)}:${finding.line} - ${sanitizeTerminalText(finding.title)}`
-      );
-    }
-  });
+  throw new CliError("server", opts.timeoutMessage);
 }
-function sanitizeTerminalText(value) {
-  return value.replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, "").replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f]/g, "");
+function assertSameAttempt(triggeredSessionId, settledSessionId, label) {
+  if (triggeredSessionId && settledSessionId !== triggeredSessionId) {
+    throw new CliError("conflict", `${label} completed for a different attempt; retry the command.`);
+  }
 }
-async function waitForReview(config, prUrl, sessionId) {
-  const deadline = Date.now() + PR_REVIEW_WAIT_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    const status = await apiFetch(
-      config,
-      `/api/pr-reviews/status?prUrl=${encodeURIComponent(prUrl)}`
-    );
-    if (status.status === "completed") {
-      if (sessionId && status.sessionId !== sessionId) {
-        throw new CliError("conflict", "PR review completed for a different attempt; retry the command.");
-      }
-      return { ...status, sessionId: status.sessionId ?? sessionId };
-    }
-    await new Promise((resolve2) => setTimeout(resolve2, PR_REVIEW_POLL_INTERVAL_MS));
+
+// ../../shared/session/phase.ts
+var PHASES = [
+  "idle",
+  "running",
+  "waiting_for_input",
+  "finalizing",
+  "review_listening",
+  "completed",
+  "superseded",
+  "needs_you",
+  "blocked",
+  "failed",
+  "stopped",
+  "archived"
+];
+var TERMINAL_PHASES_ARRAY = [
+  "completed",
+  "superseded",
+  "needs_you",
+  "blocked",
+  "failed",
+  "stopped",
+  "archived"
+];
+var TERMINAL_PHASES = new Set(TERMINAL_PHASES_ARRAY);
+var TERMINAL_FOR_FALLBACK_POLLING_PHASES = new Set(
+  TERMINAL_PHASES_ARRAY.filter((phase) => phase !== "completed")
+);
+var CHILD_SLOT_RELEASE_PHASES = new Set(
+  TERMINAL_PHASES_ARRAY.filter((phase) => phase !== "stopped")
+);
+var ARCHIVABLE_STALE_TERMINAL_PHASES_ARRAY = TERMINAL_PHASES_ARRAY.filter(
+  (phase) => phase !== "archived" && phase !== "needs_you" && phase !== "blocked" && phase !== "stopped"
+);
+function isTerminalPhase(phase, _sessionKind) {
+  return TERMINAL_PHASES.has(phase);
+}
+
+// src/constants/watch.ts
+var MIN_WATCH_POLL_INTERVAL_MS = 250;
+var DEFAULT_WATCH_POLL_INTERVAL_MS = 1e3;
+var MAX_WATCH_POLL_INTERVAL_MS = 6e4;
+var WATCH_REPLAY_PAGE_SIZE = 200;
+function isWatchTerminal(phase) {
+  return isTerminalPhase(phase);
+}
+
+// src/utils/poll-interval.ts
+function clampPollInterval(ms, minimum) {
+  return Math.max(ms, minimum);
+}
+function parsePollInterval(raw, opts = {}) {
+  const defaultMs = opts.defaultMs ?? DEFAULT_WATCH_POLL_INTERVAL_MS;
+  const minMs = opts.minMs ?? MIN_WATCH_POLL_INTERVAL_MS;
+  const maxMs = opts.maxMs === void 0 ? MAX_WATCH_POLL_INTERVAL_MS : opts.maxMs;
+  if (!raw) return defaultMs;
+  if (!/^\d+$/.test(raw)) {
+    throw new CliError("user", "Polling interval must be a non-negative integer.");
+  }
+  const value = Number(raw);
+  if (value < minMs || maxMs !== null && value > maxMs) {
+    const range = maxMs === null ? `at least ${minMs}` : `between ${minMs} and ${maxMs}`;
+    throw new CliError("user", `Polling interval must be ${range} milliseconds.`);
   }
-  throw new CliError("server", "Timed out waiting for Zeus review results.");
+  return value;
+}
+
+// src/utils/terminal-text.ts
+function sanitizeTerminalText(value) {
+  return value.replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, "").replace(/\u001b\[[0-?]*[ -\/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f]/g, "");
 }
 
 // src/commands/anubis.ts
@@ -1035,6 +1096,7 @@ var ANUBIS_POLL_INTERVAL_MS = 15e3;
 var ANUBIS_WAIT_TIMEOUT_MS = 45 * 60 * 1e3;
 async function anubisCommand(prUrl, options = {}, command) {
   assertArcanistSessionMutationAllowed("anubis");
+  const pollIntervalMs = options.wait ? parsePollInterval(options.pollInterval, { defaultMs: ANUBIS_POLL_INTERVAL_MS, maxMs: null }) : null;
   const { config } = resolveBusinessContext(command, options);
   const trigger = await apiFetch(config, "/api/anubis-runs", {
     method: "POST",
@@ -1046,29 +1108,25 @@ async function anubisCommand(prUrl, options = {}, command) {
     });
     return;
   }
-  const result = await waitForAnubis(config, prUrl, trigger.sessionId);
+  const result = await pollUntilSettled({
+    pollIntervalMs: pollIntervalMs ?? ANUBIS_POLL_INTERVAL_MS,
+    timeoutMs: ANUBIS_WAIT_TIMEOUT_MS,
+    timeoutMessage: "Timed out waiting for Anubis results.",
+    fetchStatus: async () => {
+      const status = await apiFetch(
+        config,
+        `/api/anubis-runs/status?prUrl=${encodeURIComponent(prUrl)}`
+      );
+      if (status.sessionStatus === "active") return null;
+      assertSameAttempt(trigger.sessionId, status.sessionId, "Anubis");
+      return status;
+    }
+  });
   emit(command, options, result, (payload) => {
     console.log(`Anubis: ${sanitizeTerminalText(payload.verdict ?? "could-not-verify")}.`);
     if (payload.summary) console.log(sanitizeTerminalText(payload.summary));
   });
 }
-async function waitForAnubis(config, prUrl, sessionId) {
-  const deadline = Date.now() + ANUBIS_WAIT_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    const status = await apiFetch(
-      config,
-      `/api/anubis-runs/status?prUrl=${encodeURIComponent(prUrl)}`
-    );
-    if (status.sessionStatus !== "active") {
-      if (status.sessionId !== sessionId) {
-        throw new CliError("conflict", "Anubis completed for a different attempt; retry the command.");
-      }
-      return status;
-    }
-    await new Promise((resolve2) => setTimeout(resolve2, ANUBIS_POLL_INTERVAL_MS));
-  }
-  throw new CliError("server", "Timed out waiting for Anubis results.");
-}
 
 // src/commands/auth.ts
 async function whoamiCommand(options, command) {
@@ -2072,11 +2130,8 @@ function formatTime(value) {
 }
 
 // src/commands/codex.ts
-import { spawn as spawn2 } from "child_process";
-import { rmSync as rmSync2 } from "fs";
-import { mkdtemp as mkdtemp2, readFile as readFile2, rm as rm2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join3 } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join4 } from "path";
 var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
 var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
 var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
@@ -2092,33 +2147,13 @@ function resolveCodexPath(optionPath) {
   return optionPath?.trim() || process.env.ARCANIST_CODEX_BIN?.trim() || "codex";
 }
 function runCodexDeviceLogin(codexPath, codexHome) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn2(codexPath, ["login", "--device-auth"], {
-      stdio: "inherit",
-      env: { ...process.env, CODEX_HOME: codexHome }
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        reject(
-          new CliError("user", `Could not find the \`${codexPath}\` executable.`, {
-            hint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN."
-          })
-        );
-        return;
-      }
-      reject(new CliError("user", `Failed to launch \`${codexPath} login --device-auth\`: ${err.message}`));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve2();
-        return;
-      }
-      reject(
-        new CliError("user", `\`${codexPath} login --device-auth\` exited with code ${code ?? "unknown"}.`, {
-          hint: "Complete the device approval in your browser, then re-run `arcanist codex login`."
-        })
-      );
-    });
+  return runVendorLoginProcess({
+    displayName: "Codex",
+    binPath: codexPath,
+    args: ["login", "--device-auth"],
+    env: { CODEX_HOME: codexHome },
+    missingBinaryHint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN.",
+    retryCommand: "arcanist codex login"
   });
 }
 async function setCodexSubscriptionEnabled(config, enabled) {
@@ -2130,64 +2165,44 @@ async function setCodexSubscriptionEnabled(config, enabled) {
 async function codexLoginCommand(options, command) {
   const { config } = resolveBusinessContext(command, options);
   const codexPath = resolveCodexPath(options.codexPath);
-  let codexHome;
-  const handleSigint = () => {
-    if (codexHome) {
-      try {
-        rmSync2(codexHome, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    process.exit(EXIT_CODE_INTERRUPTED);
-  };
-  process.on("SIGINT", handleSigint);
-  try {
-    codexHome = await mkdtemp2(join3(tmpdir2(), "arcanist-codex-"));
+  const authJson = await withIsolatedLoginDir("arcanist-codex-", async (codexHome) => {
     await runCodexDeviceLogin(codexPath, codexHome);
-    let authJson;
+    let raw;
     try {
-      authJson = await readFile2(join3(codexHome, "auth.json"), "utf8");
+      raw = await readFile2(join4(codexHome, "auth.json"), "utf8");
     } catch {
       throw new CliError("user", "Codex login completed but no auth.json was written.", {
         hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
       });
     }
-    if (!authJson.trim()) {
+    if (!raw.trim()) {
       throw new CliError("user", "Codex login produced an empty auth.json.");
     }
-    const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
-      method: "PUT",
-      body: JSON.stringify({ authJson })
-    });
-    let activated = false;
-    let activationError;
-    try {
-      await setCodexSubscriptionEnabled(config, true);
-      activated = true;
-    } catch (err) {
-      activationError = err instanceof Error ? err.message : String(err);
-    }
-    emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
-      console.log(
-        activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
-      );
-      const status = describeCredentialStatus(payload);
-      if (status) console.log(`Status: ${status}`);
-      if (!activated) {
-        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
-        console.log("Run `arcanist codex use on` to start using it.");
-      }
-    });
-  } finally {
-    try {
-      if (codexHome) {
-        await rm2(codexHome, { recursive: true, force: true }).catch(() => {
-        });
-      }
-    } finally {
-      process.off("SIGINT", handleSigint);
-    }
+    return raw;
+  });
+  const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+    method: "PUT",
+    body: JSON.stringify({ authJson })
+  });
+  let activated = false;
+  let activationError;
+  try {
+    await setCodexSubscriptionEnabled(config, true);
+    activated = true;
+  } catch (err) {
+    activationError = err instanceof Error ? err.message : String(err);
   }
+  emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
+    console.log(
+      activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
+    );
+    const status = describeCredentialStatus(payload);
+    if (status) console.log(`Status: ${status}`);
+    if (!activated) {
+      console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+      console.log("Run `arcanist codex use on` to start using it.");
+    }
+  });
 }
 async function codexUseCommand(state, options, command) {
   const normalized = state.trim().toLowerCase();
@@ -2226,58 +2241,6 @@ async function codexLogoutCommand(options, command) {
   emit(command, options, payload, () => console.log("Codex subscription auth deactivated and cleared."));
 }
 
-// ../../shared/utils/timing.ts
-function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
-}
-
-// ../../shared/session/phase.ts
-var PHASES = [
-  "idle",
-  "running",
-  "waiting_for_input",
-  "finalizing",
-  "review_listening",
-  "completed",
-  "superseded",
-  "needs_you",
-  "blocked",
-  "failed",
-  "stopped",
-  "archived"
-];
-var TERMINAL_PHASES_ARRAY = [
-  "completed",
-  "superseded",
-  "needs_you",
-  "blocked",
-  "failed",
-  "stopped",
-  "archived"
-];
-var TERMINAL_PHASES = new Set(TERMINAL_PHASES_ARRAY);
-var TERMINAL_FOR_FALLBACK_POLLING_PHASES = new Set(
-  TERMINAL_PHASES_ARRAY.filter((phase) => phase !== "completed")
-);
-var CHILD_SLOT_RELEASE_PHASES = new Set(
-  TERMINAL_PHASES_ARRAY.filter((phase) => phase !== "stopped")
-);
-var ARCHIVABLE_STALE_TERMINAL_PHASES_ARRAY = TERMINAL_PHASES_ARRAY.filter(
-  (phase) => phase !== "archived" && phase !== "needs_you" && phase !== "blocked" && phase !== "stopped"
-);
-function isTerminalPhase(phase, _sessionKind) {
-  return TERMINAL_PHASES.has(phase);
-}
-
-// src/constants/watch.ts
-var MIN_WATCH_POLL_INTERVAL_MS = 250;
-var DEFAULT_WATCH_POLL_INTERVAL_MS = 1e3;
-var MAX_WATCH_POLL_INTERVAL_MS = 6e4;
-var WATCH_REPLAY_PAGE_SIZE = 200;
-function isWatchTerminal(phase) {
-  return isTerminalPhase(phase);
-}
-
 // src/uploads.ts
 import { readFile as readFile3 } from "fs/promises";
 import { basename, extname } from "path";
@@ -2423,26 +2386,6 @@ function normalizeUploadedFileOptions(files) {
   return Array.isArray(files) ? files : [files];
 }
 
-// src/utils/poll-interval.ts
-function clampPollInterval(ms, minimum) {
-  return Math.max(ms, minimum);
-}
-function parsePollInterval(raw, opts = {}) {
-  const defaultMs = opts.defaultMs ?? DEFAULT_WATCH_POLL_INTERVAL_MS;
-  const minMs = opts.minMs ?? MIN_WATCH_POLL_INTERVAL_MS;
-  const maxMs = opts.maxMs === void 0 ? MAX_WATCH_POLL_INTERVAL_MS : opts.maxMs;
-  if (!raw) return defaultMs;
-  if (!/^\d+$/.test(raw)) {
-    throw new CliError("user", "Polling interval must be a non-negative integer.");
-  }
-  const value = Number(raw);
-  if (value < minMs || maxMs !== null && value > maxMs) {
-    const range = maxMs === null ? `at least ${minMs}` : `between ${minMs} and ${maxMs}`;
-    throw new CliError("user", `Polling interval must be ${range} milliseconds.`);
-  }
-  return value;
-}
-
 // ../../shared/session/no-change-outcome.ts
 function isNoChangesPromptResult(result) {
   return typeof result === "object" && result !== null && "noChanges" in result && result.noChanges === true;
@@ -4783,6 +4726,55 @@ function parseRespondConflict(err) {
   };
 }
 
+// src/commands/review.ts
+var PR_REVIEW_POLL_INTERVAL_MS = 1e4;
+var PR_REVIEW_WAIT_TIMEOUT_MS = 30 * 60 * 1e3;
+async function reviewCommand(prUrl, options = {}, command) {
+  assertArcanistSessionMutationAllowed("review");
+  const pollIntervalMs = options.wait ? parsePollInterval(options.pollInterval, { defaultMs: PR_REVIEW_POLL_INTERVAL_MS, maxMs: null }) : null;
+  const { config } = resolveBusinessContext(command, options);
+  const trigger = await apiFetch(config, "/api/pr-reviews", {
+    method: "POST",
+    body: JSON.stringify({
+      prUrl,
+      ...options.focus ? { focus: options.focus } : {},
+      // Send an explicitly passed model even when empty (e.g. --model "$VAR" with an
+      // unset VAR) so the server rejects it as invalid instead of silently routing.
+      ...options.model !== void 0 ? { model: options.model } : {}
+    })
+  });
+  if (!options.wait || trigger.cached) {
+    emit(command, options, trigger, (payload) => {
+      if (payload.cached) console.log(`Zeus review already completed: ${payload.verdict ?? "unknown"}.`);
+      else console.log(`Started Zeus review${payload.sessionId ? ` (${payload.sessionId})` : ""}.`);
+    });
+    return;
+  }
+  const triggeredSessionId = trigger.sessionId ?? null;
+  const result = await pollUntilSettled({
+    pollIntervalMs: pollIntervalMs ?? PR_REVIEW_POLL_INTERVAL_MS,
+    timeoutMs: PR_REVIEW_WAIT_TIMEOUT_MS,
+    timeoutMessage: "Timed out waiting for Zeus review results.",
+    fetchStatus: async () => {
+      const status = await apiFetch(
+        config,
+        `/api/pr-reviews/status?prUrl=${encodeURIComponent(prUrl)}`
+      );
+      if (status.status !== "completed") return null;
+      assertSameAttempt(triggeredSessionId, status.sessionId, "PR review");
+      return { ...status, sessionId: status.sessionId ?? triggeredSessionId };
+    }
+  });
+  emit(command, options, result, (payload) => {
+    console.log(`Zeus review: ${sanitizeTerminalText(payload.verdict)}. ${payload.findings.length} finding(s).`);
+    for (const finding of payload.findings) {
+      console.log(
+        `${sanitizeTerminalText(finding.severity)} ${sanitizeTerminalText(finding.file)}:${finding.line} - ${sanitizeTerminalText(finding.title)}`
+      );
+    }
+  });
+}
+
 // src/commands/sandbox.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname2 } from "path";
@@ -6391,7 +6383,7 @@ cursor.command("use <state>").description("Turn using your saved Cursor subscrip
 cursor.command("status").description("Show whether your workspace is eligible and whether a Cursor subscription auth is saved").action((options, command) => agentSubscriptionStatusCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
 cursor.command("logout").description("Deactivate the selector and remove the stored Cursor subscription auth for your user").action((options, command) => agentSubscriptionLogoutCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
 var sessions = program.command("sessions").description("Session commands");
-program.command("review <pr-url>").description("Run a Zeus review for a GitHub pull request").option("--focus <text>", "Focus the review on a specific concern").option("--model <model>", "Pin the reviewer model (Arcanist members only); defaults to automatic routing").option("--wait", "Wait for the review and print its verdict and findings").addHelpText(
+program.command("review <pr-url>").description("Run a Zeus review for a GitHub pull request").option("--focus <text>", "Focus the review on a specific concern").option("--model <model>", "Pin the reviewer model (Arcanist members only); defaults to automatic routing").option("--wait", "Wait for the review and print its verdict and findings").option("--poll-interval <ms>", "Polling interval in milliseconds while waiting (default 10000)").addHelpText(
   "after",
   `
 Examples:
@@ -6405,7 +6397,7 @@ a specific reviewer model instead (members only).
 Zeus review is currently available to Arcanist members only.
 `
 ).action((prUrl, options, command) => reviewCommand(prUrl, options, command));
-program.command("anubis <pr-url>").description("Run an Anubis QA verification for a GitHub pull request").option("--wait", "Wait for the verdict").addHelpText(
+program.command("anubis <pr-url>").description("Run an Anubis QA verification for a GitHub pull request").option("--wait", "Wait for the verdict").option("--poll-interval <ms>", "Polling interval in milliseconds while waiting (default 15000)").addHelpText(
   "after",
   `
 Examples:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.222",
+  "version": "0.1.224",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {