@tryarcanist/cli 0.1.223 → 0.1.224

package/dist/index.js

@@ -5,11 +5,11 @@ import { createRequire as createRequire2 } from "module";
 import { Command } from "commander";
 
 // src/commands/agent-subscription.ts
-import { execFileSync, spawn } from "child_process";
-import { existsSync as existsSync2, rmSync } from "fs";
-import { mkdtemp, readFile, rm } from "fs/promises";
-import { homedir as homedir2, tmpdir } from "os";
-import { join as join2 } from "path";
+import { execFileSync, spawn as spawn2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { readFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 
 // src/api.ts
@@ -640,6 +640,71 @@ function isControlCharacter(char) {
   return code < ASCII_FIRST_PRINTABLE || code === ASCII_DELETE;
 }
 
+// src/vendor-login.ts
+import { spawn } from "child_process";
+import { rmSync } from "fs";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+var VendorBinaryMissingError = class extends CliError {
+  constructor(binPath, hint) {
+    super("user", `Could not find the \`${binPath}\` executable.`, { hint });
+    this.name = "VendorBinaryMissingError";
+  }
+};
+function runVendorLoginProcess(spec) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(spec.binPath, spec.args, {
+      stdio: "inherit",
+      env: { ...process.env, ...spec.env }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(new VendorBinaryMissingError(spec.binPath, spec.missingBinaryHint));
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${spec.binPath} ${spec.args.join(" ")}\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve2();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${spec.binPath} ${spec.args.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
+          hint: `Complete the ${spec.displayName} login, then re-run \`${spec.retryCommand}\`.`
+        })
+      );
+    });
+  });
+}
+async function withIsolatedLoginDir(prefix, fn) {
+  let tempDir;
+  const handleSigint = () => {
+    if (tempDir) {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    process.exit(EXIT_CODE_INTERRUPTED);
+  };
+  process.on("SIGINT", handleSigint);
+  try {
+    tempDir = await mkdtemp(join2(tmpdir(), prefix));
+    return await fn(tempDir);
+  } finally {
+    try {
+      if (tempDir) {
+        await rm(tempDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    } finally {
+      process.off("SIGINT", handleSigint);
+    }
+  }
+}
+
 // src/commands/agent-subscription.ts
 var GROK_SUBSCRIPTION_CLI_CONFIG = {
   harness: "grok",
@@ -650,7 +715,7 @@ var GROK_SUBSCRIPTION_CLI_CONFIG = {
   // terminal without a local browser.
   loginArgs: ["login", "--device-auth"],
   loginEnv: () => ({}),
-  authJsonCandidates: [join2(".grok", "auth.json")],
+  authJsonCandidates: [join3(".grok", "auth.json")],
   // Grok Build's auth.json is issuer-keyed (observed 2026-07-15 against the
   // installed CLI's embedded docs): {"https://accounts.x.ai/sign-in": {"key":
   // "…"}} — so the credential fields live one level down and the token field
@@ -663,8 +728,8 @@ var GROK_SUBSCRIPTION_CLI_CONFIG = {
   installer: {
     command: "curl -fsSL https://x.ai/cli/install.sh | bash",
     binCandidates: (home) => [
-      join2(home, ".grok", "bin", "grok"),
-      join2(home, ".local", "bin", "grok"),
+      join3(home, ".grok", "bin", "grok"),
+      join3(home, ".local", "bin", "grok"),
       "/usr/local/bin/grok"
     ],
     postInstallNote: "Grok CLI installed. Restart your shell if `grok` is not found on PATH later."
@@ -680,14 +745,14 @@ var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
   // formally documented, so pin every documented override at the throwaway
   // HOME and search the known spots afterwards.
   loginEnv: (tempHome) => ({
-    CURSOR_CONFIG_DIR: join2(tempHome, ".cursor"),
-    XDG_CONFIG_HOME: join2(tempHome, ".config")
+    CURSOR_CONFIG_DIR: join3(tempHome, ".cursor"),
+    XDG_CONFIG_HOME: join3(tempHome, ".config")
   }),
   authJsonCandidates: [
-    join2(".cursor", "auth.json"),
-    join2(".cursor", "cli-config.json"),
-    join2(".config", "cursor", "auth.json"),
-    join2(".config", "cursor", "cli-config.json")
+    join3(".cursor", "auth.json"),
+    join3(".cursor", "cli-config.json"),
+    join3(".config", "cursor", "auth.json"),
+    join3(".config", "cursor", "cli-config.json")
   ],
   tokenFields: ["accessToken", "access_token", "refreshToken", "refresh_token", "token"],
   installHint: "Install the Cursor CLI (https://cursor.com/docs/cli/installation), or point at it with --cursor-path <path> or ARCANIST_CURSOR_AGENT_BIN. If login-token capture keeps failing, use a Cursor API key in Settings instead.",
@@ -705,7 +770,7 @@ var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
   // name first, since `agent` is also Grok's alias.
   installer: {
     command: "curl https://cursor.com/install -fsS | bash",
-    binCandidates: (home) => [join2(home, ".local", "bin", "cursor-agent"), join2(home, ".local", "bin", "agent")],
+    binCandidates: (home) => [join3(home, ".local", "bin", "cursor-agent"), join3(home, ".local", "bin", "agent")],
     postInstallNote: 'Cursor CLI installed to ~/.local/bin. Add it to your PATH for future shells: export PATH="$HOME/.local/bin:$PATH"'
   }
 };
@@ -715,15 +780,9 @@ function subscriptionBasePath(harness) {
 function resolveVendorBin(config, optionPath) {
   return optionPath?.trim() || process.env[config.binEnvVar]?.trim() || config.defaultBin;
 }
-var VendorBinaryMissingError = class extends CliError {
-  constructor(config, binPath) {
-    super("user", `Could not find the \`${binPath}\` executable.`, { hint: config.installHint });
-    this.name = "VendorBinaryMissingError";
-  }
-};
 function runVendorInstall(config, command) {
   return new Promise((resolve2, reject) => {
-    const child = spawn("bash", ["-c", command], { stdio: ["inherit", 2, "inherit"] });
+    const child = spawn2("bash", ["-c", command], { stdio: ["inherit", 2, "inherit"] });
     child.on("error", (err) => {
       reject(
         new CliError("user", `Failed to run the ${config.displayName} CLI installer: ${err.message}`, {
@@ -779,29 +838,13 @@ async function runVendorLoginWithInstallOffer(config, binPath, tempHome, explici
   }
 }
 function runVendorLogin(config, binPath, tempHome) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn(binPath, config.loginArgs, {
-      stdio: "inherit",
-      env: tempHome ? { ...process.env, HOME: tempHome, ...config.loginEnv(tempHome) } : process.env
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        reject(new VendorBinaryMissingError(config, binPath));
-        return;
-      }
-      reject(new CliError("user", `Failed to launch \`${binPath} ${config.loginArgs.join(" ")}\`: ${err.message}`));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve2();
-        return;
-      }
-      reject(
-        new CliError("user", `\`${binPath} ${config.loginArgs.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
-          hint: `Complete the ${config.displayName} login, then re-run \`arcanist ${config.harness} login\`.`
-        })
-      );
-    });
+  return runVendorLoginProcess({
+    displayName: config.displayName,
+    binPath,
+    args: config.loginArgs,
+    env: tempHome ? { HOME: tempHome, ...config.loginEnv(tempHome) } : {},
+    missingBinaryHint: config.installHint,
+    retryCommand: `arcanist ${config.harness} login`
   });
 }
 function hasTokenField(value, tokenFields, depth = 0) {
@@ -838,7 +881,7 @@ function readDarwinKeychainAuthJson(config) {
 }
 async function readLoginAuthJson(config, tempHome) {
   for (const candidate of config.authJsonCandidates) {
-    const path = join2(tempHome, candidate);
+    const path = join3(tempHome, candidate);
     if (!existsSync2(path)) continue;
     let raw;
     try {
@@ -865,72 +908,51 @@ async function agentSubscriptionLoginCommand(config, options, command) {
   const { config: apiConfig } = resolveBusinessContext(command, options);
   const binPath = resolveVendorBin(config, options.binPath);
   const explicitBinPath = Boolean(options.binPath?.trim() || process.env[config.binEnvVar]?.trim());
-  let tempHome;
-  const handleSigint = () => {
-    if (tempHome) {
-      try {
-        rmSync(tempHome, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    process.exit(EXIT_CODE_INTERRUPTED);
-  };
-  process.on("SIGINT", handleSigint);
-  try {
-    const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
-    let authJson;
-    if (captureViaKeychain) {
-      await runVendorLoginWithInstallOffer(config, binPath, null, explicitBinPath);
-      authJson = readDarwinKeychainAuthJson(config);
-    } else {
-      tempHome = await mkdtemp(join2(tmpdir(), `arcanist-${config.harness}-`));
+  const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
+  let authJson;
+  if (captureViaKeychain) {
+    await runVendorLoginWithInstallOffer(config, binPath, null, explicitBinPath);
+    authJson = readDarwinKeychainAuthJson(config);
+  } else {
+    authJson = await withIsolatedLoginDir(`arcanist-${config.harness}-`, async (tempHome) => {
       await runVendorLoginWithInstallOffer(config, binPath, tempHome, explicitBinPath);
-      authJson = await readLoginAuthJson(config, tempHome);
+      return readLoginAuthJson(config, tempHome);
+    });
+  }
+  const state = await apiFetch(
+    apiConfig,
+    `${subscriptionBasePath(config.harness)}/auth-json`,
+    {
+      method: "PUT",
+      body: JSON.stringify({ authJson })
     }
-    const state = await apiFetch(
-      apiConfig,
-      `${subscriptionBasePath(config.harness)}/auth-json`,
-      {
-        method: "PUT",
-        body: JSON.stringify({ authJson })
-      }
+  );
+  let activated = false;
+  let activationError;
+  try {
+    await setSubscriptionEnabled(apiConfig, config.harness, true);
+    activated = true;
+  } catch (err) {
+    activationError = err instanceof Error ? err.message : String(err);
+  }
+  emit(command, options, { ...state, enabled: activated }, (payload) => {
+    console.log(
+      activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
     );
-    let activated = false;
-    let activationError;
-    try {
-      await setSubscriptionEnabled(apiConfig, config.harness, true);
-      activated = true;
-    } catch (err) {
-      activationError = err instanceof Error ? err.message : String(err);
+    if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
+    if (!activated) {
+      console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+      console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
     }
-    emit(command, options, { ...state, enabled: activated }, (payload) => {
-      console.log(
-        activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
-      );
-      if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
-      if (!activated) {
-        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
-        console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
-      }
+    console.log(
+      `${config.displayName} sessions will use your subscription auth while the selector is on; run \`arcanist ${config.harness} use off\` to switch back.`
+    );
+    if (captureViaKeychain) {
       console.log(
-        `${config.displayName} sessions will use your subscription auth while the selector is on; run \`arcanist ${config.harness} use off\` to switch back.`
+        `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
       );
-      if (captureViaKeychain) {
-        console.log(
-          `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
-        );
-      }
-    });
-  } finally {
-    try {
-      if (tempHome) {
-        await rm(tempHome, { recursive: true, force: true }).catch(() => {
-        });
-      }
-    } finally {
-      process.off("SIGINT", handleSigint);
     }
-  }
+  });
 }
 async function agentSubscriptionUseCommand(config, state, options, command) {
   const normalized = state.trim().toLowerCase();
@@ -2108,11 +2130,8 @@ function formatTime(value) {
 }
 
 // src/commands/codex.ts
-import { spawn as spawn2 } from "child_process";
-import { rmSync as rmSync2 } from "fs";
-import { mkdtemp as mkdtemp2, readFile as readFile2, rm as rm2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join3 } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join4 } from "path";
 var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
 var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
 var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
@@ -2128,33 +2147,13 @@ function resolveCodexPath(optionPath) {
   return optionPath?.trim() || process.env.ARCANIST_CODEX_BIN?.trim() || "codex";
 }
 function runCodexDeviceLogin(codexPath, codexHome) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn2(codexPath, ["login", "--device-auth"], {
-      stdio: "inherit",
-      env: { ...process.env, CODEX_HOME: codexHome }
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        reject(
-          new CliError("user", `Could not find the \`${codexPath}\` executable.`, {
-            hint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN."
-          })
-        );
-        return;
-      }
-      reject(new CliError("user", `Failed to launch \`${codexPath} login --device-auth\`: ${err.message}`));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve2();
-        return;
-      }
-      reject(
-        new CliError("user", `\`${codexPath} login --device-auth\` exited with code ${code ?? "unknown"}.`, {
-          hint: "Complete the device approval in your browser, then re-run `arcanist codex login`."
-        })
-      );
-    });
+  return runVendorLoginProcess({
+    displayName: "Codex",
+    binPath: codexPath,
+    args: ["login", "--device-auth"],
+    env: { CODEX_HOME: codexHome },
+    missingBinaryHint: "Install the Codex CLI, or point at it with --codex-path <path> or ARCANIST_CODEX_BIN.",
+    retryCommand: "arcanist codex login"
   });
 }
 async function setCodexSubscriptionEnabled(config, enabled) {
@@ -2166,64 +2165,44 @@ async function setCodexSubscriptionEnabled(config, enabled) {
 async function codexLoginCommand(options, command) {
   const { config } = resolveBusinessContext(command, options);
   const codexPath = resolveCodexPath(options.codexPath);
-  let codexHome;
-  const handleSigint = () => {
-    if (codexHome) {
-      try {
-        rmSync2(codexHome, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    process.exit(EXIT_CODE_INTERRUPTED);
-  };
-  process.on("SIGINT", handleSigint);
-  try {
-    codexHome = await mkdtemp2(join3(tmpdir2(), "arcanist-codex-"));
+  const authJson = await withIsolatedLoginDir("arcanist-codex-", async (codexHome) => {
     await runCodexDeviceLogin(codexPath, codexHome);
-    let authJson;
+    let raw;
     try {
-      authJson = await readFile2(join3(codexHome, "auth.json"), "utf8");
+      raw = await readFile2(join4(codexHome, "auth.json"), "utf8");
     } catch {
       throw new CliError("user", "Codex login completed but no auth.json was written.", {
         hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
       });
     }
-    if (!authJson.trim()) {
+    if (!raw.trim()) {
       throw new CliError("user", "Codex login produced an empty auth.json.");
     }
-    const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
-      method: "PUT",
-      body: JSON.stringify({ authJson })
-    });
-    let activated = false;
-    let activationError;
-    try {
-      await setCodexSubscriptionEnabled(config, true);
-      activated = true;
-    } catch (err) {
-      activationError = err instanceof Error ? err.message : String(err);
-    }
-    emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
-      console.log(
-        activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
-      );
-      const status = describeCredentialStatus(payload);
-      if (status) console.log(`Status: ${status}`);
-      if (!activated) {
-        console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
-        console.log("Run `arcanist codex use on` to start using it.");
-      }
-    });
-  } finally {
-    try {
-      if (codexHome) {
-        await rm2(codexHome, { recursive: true, force: true }).catch(() => {
-        });
-      }
-    } finally {
-      process.off("SIGINT", handleSigint);
-    }
+    return raw;
+  });
+  const state = await apiFetch(config, CODEX_SUBSCRIPTION_AUTH_JSON_PATH, {
+    method: "PUT",
+    body: JSON.stringify({ authJson })
+  });
+  let activated = false;
+  let activationError;
+  try {
+    await setCodexSubscriptionEnabled(config, true);
+    activated = true;
+  } catch (err) {
+    activationError = err instanceof Error ? err.message : String(err);
   }
+  emit(command, options, { ...state, useCodexSubscription: activated }, (payload) => {
+    console.log(
+      activated ? "Codex subscription auth saved and activated for OpenAI sessions." : "Codex subscription auth saved."
+    );
+    const status = describeCredentialStatus(payload);
+    if (status) console.log(`Status: ${status}`);
+    if (!activated) {
+      console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
+      console.log("Run `arcanist codex use on` to start using it.");
+    }
+  });
 }
 async function codexUseCommand(state, options, command) {
   const normalized = state.trim().toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.223",
+  "version": "0.1.224",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {