@tryarcanist/cli 0.1.230 → 0.1.232

package/README.md

@@ -197,7 +197,7 @@ arcanist sessions create your-org/your-repo "review the trace" --uploaded-file t
 arcanist sessions create your-org/your-repo "retry-safe create" --idempotency-key 1f0e6f1a-...
 ```
 
-`--backend` picks the agent runtime backend: `codex` (default), `claude_code`, `opencode`, `cursor`, or `grok`. `--model` must be valid for the chosen backend and the CLI rejects a mismatch before any network call; run `arcanist models list` for the selectable models per backend. When `--model` is omitted the backend default is used. Non-codex backends require the matching provider credential configured in Settings.
+`--backend` picks the agent runtime backend: `codex` (default) or `claude_code`. `--model` must be valid for the chosen backend and the CLI rejects a mismatch before any network call; run `arcanist models list` for the selectable models per backend. When `--model` is omitted the backend default is used. Non-codex backends require the matching provider credential configured in Settings.
 
 `--wait` blocks until the created prompt finishes, prints the resulting PR/branch line in human-readable mode when it is already available, and exits non-zero if the prompt finishes with `status: failed`, making it suitable for cron or other schedulers that alert on command failure. JSON mode waits quietly and prints the create payload after the prompt completes successfully. `--poll-interval <ms>` tunes the completion check frequency.
 
@@ -242,7 +242,7 @@ The PR URL must be `https://github.com/<owner>/<repo>/pull/<number>`.
 The CLI derives the repo from that URL, creates a QA session with `qa: true` and `targetPrUrl`, then enqueues the verifier prompt (skipped when the server signals `promptAlreadyEnqueued`).
 Inspect progress with the session URL or the session events stream.
 
-`--backend` picks the agent runtime backend: `codex` (default), `claude_code`, `opencode`, `cursor`, or `grok`.
+`--backend` picks the agent runtime backend: `codex` (default) or `claude_code`.
 `--model` must be valid for the chosen backend, and the CLI rejects mismatches before any network call.
 When `--model` is omitted, the backend default is used.
 
@@ -435,7 +435,7 @@ printf "summarize new regressions" | arcanist automations create your-org/your-r
 arcanist automations create https://github.com/your-org/your-repo - --cron "0 14 * * 1-5" --name "Weekday summary"
 ```
 
-Use `--model <model>` to pin the model for sessions started by the automation. Backend is derived from the model; non-codex backends such as Claude or opencode are limited to Arcanist team businesses. When `--model` is omitted the codex backend default is used.
+Use `--model <model>` to pin the model for sessions started by the automation. Backend is derived from the model; non-codex backends such as Claude are limited to Arcanist team businesses. When `--model` is omitted the codex backend default is used.
 
 Use `--slack-team-id <team-id>` together with `--slack-channel-id <channel-id>` to deliver each completed automation digest into a Slack channel. Both flags are required together; the target workspace must already be connected to Arcanist and the bot must already be in the channel.
 

package/dist/index.js

@@ -7,36 +7,18 @@ import { Command } from "commander";
 // ../../shared/agent/agent-runtime-backend.ts
 var CODEX_AGENT_RUNTIME_BACKEND = "codex";
 var CLAUDE_CODE_AGENT_RUNTIME_BACKEND = "claude_code";
-var OPENCODE_AGENT_RUNTIME_BACKEND = "opencode";
-var CURSOR_AGENT_RUNTIME_BACKEND = "cursor";
-var GROK_AGENT_RUNTIME_BACKEND = "grok";
 var AGENT_RUNTIME_BACKENDS = [
   CODEX_AGENT_RUNTIME_BACKEND,
-  CLAUDE_CODE_AGENT_RUNTIME_BACKEND,
-  OPENCODE_AGENT_RUNTIME_BACKEND,
-  CURSOR_AGENT_RUNTIME_BACKEND,
-  GROK_AGENT_RUNTIME_BACKEND
+  CLAUDE_CODE_AGENT_RUNTIME_BACKEND
 ];
 var AGENT_RUNTIME_BACKEND_NAMES = {
   [CODEX_AGENT_RUNTIME_BACKEND]: "Codex",
-  [CLAUDE_CODE_AGENT_RUNTIME_BACKEND]: "Claude Code",
-  // "opencode" is intentionally lowercase to match the project's brand name.
-  [OPENCODE_AGENT_RUNTIME_BACKEND]: "opencode",
-  [CURSOR_AGENT_RUNTIME_BACKEND]: "Cursor",
-  [GROK_AGENT_RUNTIME_BACKEND]: "Grok Build"
+  [CLAUDE_CODE_AGENT_RUNTIME_BACKEND]: "Claude Code"
 };
 function isAgentRuntimeBackend(value) {
   return AGENT_RUNTIME_BACKENDS.includes(value);
 }
 
-// src/commands/agent-subscription.ts
-import { execFileSync, spawn as spawn2 } from "child_process";
-import { existsSync as existsSync2 } from "fs";
-import { readFile } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
-import { createInterface as createInterface2 } from "readline/promises";
-
 // src/api.ts
 import { createRequire } from "module";
 
@@ -668,364 +650,6 @@ function isControlCharacter(char) {
   return code < ASCII_FIRST_PRINTABLE || code === ASCII_DELETE;
 }
 
-// src/vendor-login.ts
-import { spawn } from "child_process";
-import { rmSync } from "fs";
-import { mkdtemp, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join2 } from "path";
-var VendorBinaryMissingError = class extends CliError {
-  constructor(binPath, hint) {
-    super("user", `Could not find the \`${binPath}\` executable.`, { hint });
-    this.name = "VendorBinaryMissingError";
-  }
-};
-function runVendorLoginProcess(spec) {
-  return new Promise((resolve3, reject) => {
-    const child = spawn(spec.binPath, spec.args, {
-      stdio: "inherit",
-      env: { ...process.env, ...spec.env }
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") {
-        reject(new VendorBinaryMissingError(spec.binPath, spec.missingBinaryHint));
-        return;
-      }
-      reject(new CliError("user", `Failed to launch \`${spec.binPath} ${spec.args.join(" ")}\`: ${err.message}`));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve3();
-        return;
-      }
-      reject(
-        new CliError("user", `\`${spec.binPath} ${spec.args.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
-          hint: `Complete the ${spec.displayName} login, then re-run \`${spec.retryCommand}\`.`
-        })
-      );
-    });
-  });
-}
-async function withIsolatedLoginDir(prefix, fn) {
-  let tempDir;
-  const handleSigint = () => {
-    if (tempDir) {
-      try {
-        rmSync(tempDir, { recursive: true, force: true });
-      } catch {
-      }
-    }
-    process.exit(EXIT_CODE_INTERRUPTED);
-  };
-  process.on("SIGINT", handleSigint);
-  try {
-    tempDir = await mkdtemp(join2(tmpdir(), prefix));
-    return await fn(tempDir);
-  } finally {
-    try {
-      if (tempDir) {
-        await rm(tempDir, { recursive: true, force: true }).catch(() => {
-        });
-      }
-    } finally {
-      process.off("SIGINT", handleSigint);
-    }
-  }
-}
-
-// src/commands/agent-subscription.ts
-var GROK_SUBSCRIPTION_CLI_CONFIG = {
-  harness: "grok",
-  displayName: "Grok",
-  defaultBin: "grok",
-  binEnvVar: "ARCANIST_GROK_BIN",
-  // RFC 8628 device flow: prints a verification URL + code, usable from a
-  // terminal without a local browser.
-  loginArgs: ["login", "--device-auth"],
-  loginEnv: () => ({}),
-  authJsonCandidates: [join3(".grok", "auth.json")],
-  // Grok Build's auth.json is issuer-keyed (observed 2026-07-15 against the
-  // installed CLI's embedded docs): {"https://accounts.x.ai/sign-in": {"key":
-  // "…"}} — so the credential fields live one level down and the token field
-  // is named `key`. Token detection scans nested objects.
-  tokenFields: ["access_token", "refresh_token", "key"],
-  installHint: "Install the Grok CLI (https://x.ai/cli), or point at it with --grok-path <path> or ARCANIST_GROK_BIN.",
-  // Official Grok Build installer: installs `grok` (plus an `agent` alias)
-  // under ~/.grok/bin, symlinks into ~/.local/bin or /usr/local/bin when
-  // writable, and appends PATH exports to shell rc files itself.
-  installer: {
-    command: "curl -fsSL https://x.ai/cli/install.sh | bash",
-    binCandidates: (home) => [
-      join3(home, ".grok", "bin", "grok"),
-      join3(home, ".local", "bin", "grok"),
-      "/usr/local/bin/grok"
-    ],
-    postInstallNote: "Grok CLI installed. Restart your shell if `grok` is not found on PATH later."
-  }
-};
-var CURSOR_SUBSCRIPTION_CLI_CONFIG = {
-  harness: "cursor",
-  displayName: "Cursor",
-  defaultBin: "cursor-agent",
-  binEnvVar: "ARCANIST_CURSOR_AGENT_BIN",
-  loginArgs: ["login"],
-  // Cursor's CLI stores login state under its config dir; the location is not
-  // formally documented, so pin every documented override at the throwaway
-  // HOME and search the known spots afterwards.
-  loginEnv: (tempHome) => ({
-    CURSOR_CONFIG_DIR: join3(tempHome, ".cursor"),
-    XDG_CONFIG_HOME: join3(tempHome, ".config")
-  }),
-  authJsonCandidates: [
-    join3(".cursor", "auth.json"),
-    join3(".cursor", "cli-config.json"),
-    join3(".config", "cursor", "auth.json"),
-    join3(".config", "cursor", "cli-config.json")
-  ],
-  tokenFields: ["accessToken", "access_token", "refreshToken", "refresh_token", "token"],
-  installHint: "Install the Cursor CLI (https://cursor.com/docs/cli/installation), or point at it with --cursor-path <path> or ARCANIST_CURSOR_AGENT_BIN. If login-token capture keeps failing, use a Cursor API key in Settings instead.",
-  // Entry names observed 2026-07-15 after `cursor-agent login` on macOS
-  // (login keychain, account "cursor-user").
-  darwinKeychain: {
-    entries: [
-      { service: "cursor-access-token", field: "accessToken", required: true },
-      { service: "cursor-refresh-token", field: "refreshToken", required: false }
-    ]
-  },
-  // Official Cursor CLI installer: installs to ~/.local/bin. Installers have
-  // shipped the binary as both `cursor-agent` and `agent` (the 2026-07
-  // installer's success message says `agent`), so probe both — unambiguous
-  // name first, since `agent` is also Grok's alias.
-  installer: {
-    command: "curl https://cursor.com/install -fsS | bash",
-    binCandidates: (home) => [join3(home, ".local", "bin", "cursor-agent"), join3(home, ".local", "bin", "agent")],
-    postInstallNote: 'Cursor CLI installed to ~/.local/bin. Add it to your PATH for future shells: export PATH="$HOME/.local/bin:$PATH"'
-  }
-};
-function subscriptionBasePath(harness) {
-  return `/api/settings/agent-subscriptions/${harness}`;
-}
-function resolveVendorBin(config, optionPath) {
-  return optionPath?.trim() || process.env[config.binEnvVar]?.trim() || config.defaultBin;
-}
-function runVendorInstall(config, command) {
-  return new Promise((resolve3, reject) => {
-    const child = spawn2("bash", ["-c", command], { stdio: ["inherit", 2, "inherit"] });
-    child.on("error", (err) => {
-      reject(
-        new CliError("user", `Failed to run the ${config.displayName} CLI installer: ${err.message}`, {
-          hint: config.installHint
-        })
-      );
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve3();
-        return;
-      }
-      reject(
-        new CliError("user", `The ${config.displayName} CLI installer exited with code ${code ?? "unknown"}.`, {
-          hint: config.installHint
-        })
-      );
-    });
-  });
-}
-async function offerVendorInstall(config, explicitBinPath) {
-  const installer = config.installer;
-  if (!installer || explicitBinPath) return null;
-  if (process.platform !== "linux" && process.platform !== "darwin") return null;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
-  console.error(`Could not find the \`${config.defaultBin}\` executable.`);
-  console.error(`Install it now by running: ${installer.command}`);
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  let answer;
-  try {
-    answer = (await rl.question("Proceed? [y/N] ")).trim().toLowerCase();
-  } finally {
-    rl.close();
-  }
-  if (answer !== "y" && answer !== "yes") return null;
-  await runVendorInstall(config, installer.command);
-  for (const candidate of installer.binCandidates(homedir2())) {
-    if (existsSync2(candidate)) {
-      if (installer.postInstallNote) console.error(installer.postInstallNote);
-      return candidate;
-    }
-  }
-  return config.defaultBin;
-}
-async function runVendorLoginWithInstallOffer(config, binPath, tempHome, explicitBinPath) {
-  try {
-    await runVendorLogin(config, binPath, tempHome);
-  } catch (err) {
-    if (!(err instanceof VendorBinaryMissingError)) throw err;
-    const installedBin = await offerVendorInstall(config, explicitBinPath);
-    if (!installedBin) throw err;
-    await runVendorLogin(config, installedBin, tempHome);
-  }
-}
-function runVendorLogin(config, binPath, tempHome) {
-  return runVendorLoginProcess({
-    displayName: config.displayName,
-    binPath,
-    args: config.loginArgs,
-    env: tempHome ? { HOME: tempHome, ...config.loginEnv(tempHome) } : {},
-    missingBinaryHint: config.installHint,
-    retryCommand: `arcanist ${config.harness} login`
-  });
-}
-function hasTokenField(value, tokenFields, depth = 0) {
-  if (!value || typeof value !== "object" || Array.isArray(value) || depth > 2) return false;
-  const record = value;
-  if (tokenFields.some((field) => typeof record[field] === "string" && record[field].trim().length > 0)) {
-    return true;
-  }
-  return Object.values(record).some((nested) => hasTokenField(nested, tokenFields, depth + 1));
-}
-function readDarwinKeychainAuthJson(config) {
-  const record = {};
-  for (const entry of config.darwinKeychain?.entries ?? []) {
-    let value = "";
-    try {
-      value = execFileSync("security", ["find-generic-password", "-s", entry.service, "-w"], {
-        encoding: "utf8"
-      }).trim();
-    } catch {
-    }
-    if (value) {
-      record[entry.field] = value;
-    } else if (entry.required) {
-      throw new CliError(
-        "user",
-        `${config.displayName} login completed but the '${entry.service}' Keychain item could not be read.`,
-        {
-          hint: `Approve the macOS Keychain access prompt if one appeared, then re-run \`arcanist ${config.harness} login\`.`
-        }
-      );
-    }
-  }
-  return JSON.stringify(record);
-}
-async function readLoginAuthJson(config, tempHome) {
-  for (const candidate of config.authJsonCandidates) {
-    const path = join3(tempHome, candidate);
-    if (!existsSync2(path)) continue;
-    let raw;
-    try {
-      raw = await readFile(path, "utf8");
-    } catch {
-      continue;
-    }
-    try {
-      if (hasTokenField(JSON.parse(raw), config.tokenFields)) return raw;
-    } catch {
-    }
-  }
-  throw new CliError("user", `${config.displayName} login completed but no auth credential file was found.`, {
-    hint: `Verify \`${config.defaultBin} ${config.loginArgs.join(" ")}\` succeeds on its own, then re-run \`arcanist ${config.harness} login\`.`
-  });
-}
-async function setSubscriptionEnabled(apiConfig, harness, enabled) {
-  return apiFetch(apiConfig, `${subscriptionBasePath(harness)}/enabled`, {
-    method: "PUT",
-    body: JSON.stringify({ enabled })
-  });
-}
-async function agentSubscriptionLoginCommand(config, options, command) {
-  const { config: apiConfig } = resolveBusinessContext(command, options);
-  const binPath = resolveVendorBin(config, options.binPath);
-  const explicitBinPath = Boolean(options.binPath?.trim() || process.env[config.binEnvVar]?.trim());
-  const captureViaKeychain = process.platform === "darwin" && config.darwinKeychain !== void 0;
-  let authJson;
-  if (captureViaKeychain) {
-    await runVendorLoginWithInstallOffer(config, binPath, null, explicitBinPath);
-    authJson = readDarwinKeychainAuthJson(config);
-  } else {
-    authJson = await withIsolatedLoginDir(`arcanist-${config.harness}-`, async (tempHome) => {
-      await runVendorLoginWithInstallOffer(config, binPath, tempHome, explicitBinPath);
-      return readLoginAuthJson(config, tempHome);
-    });
-  }
-  const state = await apiFetch(
-    apiConfig,
-    `${subscriptionBasePath(config.harness)}/auth-json`,
-    {
-      method: "PUT",
-      body: JSON.stringify({ authJson })
-    }
-  );
-  let activated = false;
-  let activationError;
-  try {
-    await setSubscriptionEnabled(apiConfig, config.harness, true);
-    activated = true;
-  } catch (err) {
-    activationError = err instanceof Error ? err.message : String(err);
-  }
-  emit(command, options, { ...state, enabled: activated }, (payload) => {
-    console.log(
-      activated ? `${config.displayName} subscription auth saved and activated.` : `${config.displayName} subscription auth saved.`
-    );
-    if (payload.lastValidationStatus) console.log(`Status: ${payload.lastValidationStatus}`);
-    if (!activated) {
-      console.log(`Could not activate it automatically${activationError ? ` (${activationError})` : ""}.`);
-      console.log(`Run \`arcanist ${config.harness} use on\` to start using it.`);
-    }
-    console.log(
-      `${config.displayName} sessions will use your subscription auth while the selector is on; run \`arcanist ${config.harness} use off\` to switch back.`
-    );
-    if (captureViaKeychain) {
-      console.log(
-        `Your local ${config.defaultBin} login also remains active (Keychain-backed); run \`${config.defaultBin} logout\` to remove it.`
-      );
-    }
-  });
-}
-async function agentSubscriptionUseCommand(config, state, options, command) {
-  const normalized = state.trim().toLowerCase();
-  if (normalized !== "on" && normalized !== "off") {
-    throw new CliError("user", `Usage: arcanist ${config.harness} use <on|off>`);
-  }
-  const enabled = normalized === "on";
-  const { config: apiConfig } = resolveBusinessContext(command, options);
-  const result = await setSubscriptionEnabled(apiConfig, config.harness, enabled);
-  emit(
-    command,
-    options,
-    result,
-    () => console.log(
-      result.enabled ? `${config.displayName} subscription auth is now selected for ${config.displayName} sessions.` : `${config.displayName} subscription auth is no longer selected.`
-    )
-  );
-}
-async function agentSubscriptionStatusCommand(config, options, command) {
-  const { config: apiConfig } = resolveBusinessContext(command, options);
-  const payload = await apiFetch(apiConfig, subscriptionBasePath(config.harness));
-  emit(command, options, payload, (state) => {
-    console.log(`Eligible: ${state.eligible ? "yes" : "no"}`);
-    console.log(`Auth saved: ${state.credential.isSet ? "yes" : "no"}`);
-    console.log(`Selected: ${state.enabled ? "yes" : "no"}`);
-    if (state.credential.lastValidationStatus) console.log(`Status: ${state.credential.lastValidationStatus}`);
-  });
-}
-async function agentSubscriptionLogoutCommand(config, options, command) {
-  const { config: apiConfig } = resolveBusinessContext(command, options);
-  await setSubscriptionEnabled(apiConfig, config.harness, false).catch(() => {
-  });
-  const payload = await apiFetch(
-    apiConfig,
-    `${subscriptionBasePath(config.harness)}/auth-json`,
-    { method: "DELETE" }
-  );
-  emit(
-    command,
-    options,
-    payload,
-    () => console.log(`${config.displayName} subscription auth deactivated and cleared.`)
-  );
-}
-
 // ../../shared/utils/timing.ts
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -1157,8 +781,8 @@ async function anubisCommand(prUrl, options = {}, command) {
 }
 
 // src/commands/artifacts.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { basename, join as join2, resolve as resolve2 } from "path";
 async function fetchArtifacts(config, sessionId) {
   const payload = await apiFetch(
     config,
@@ -1173,14 +797,14 @@ function artifactFilename(artifact) {
 }
 async function downloadArtifact(config, sessionId, artifact, outputDir, usedNames) {
   const filename = artifactFilename(artifact);
-  const taken = usedNames.has(filename) || existsSync3(join4(outputDir, filename));
+  const taken = usedNames.has(filename) || existsSync2(join2(outputDir, filename));
   const targetName = taken ? `${artifact.artifactId}-${filename}` : filename;
   usedNames.add(targetName);
   const bytes = await apiFetchBytes(
     config,
     `/api/sessions/${encodeURIComponent(sessionId)}/artifacts/${encodeURIComponent(artifact.artifactId)}/view?filename=${encodeURIComponent(filename)}`
   );
-  const targetPath = join4(outputDir, targetName);
+  const targetPath = join2(outputDir, targetName);
   writeFileSync2(targetPath, bytes);
   return targetPath;
 }
@@ -1266,7 +890,7 @@ async function whoamiCommand(options, command) {
 var MAX_ALL_PAGES = 1e3;
 async function fetchPages(label, all, initialCursor, fetchPage) {
   const items = [];
-  let cursor2 = initialCursor;
+  let cursor = initialCursor;
   let nextCursor = null;
   let pageCount = 0;
   do {
@@ -1274,10 +898,10 @@ async function fetchPages(label, all, initialCursor, fetchPage) {
     if (all && pageCount > MAX_ALL_PAGES) {
       throw new CliError("user", `${label} exceeded ${MAX_ALL_PAGES} pages without reaching the end.`);
     }
-    const page = await fetchPage(cursor2);
+    const page = await fetchPage(cursor);
     items.push(...page.items);
     nextCursor = page.nextCursor;
-    cursor2 = nextCursor ?? void 0;
+    cursor = nextCursor ?? void 0;
   } while (all && nextCursor);
   return { items, nextCursor: all ? null : nextCursor };
 }
@@ -1294,10 +918,10 @@ function parseGithubRepoFullName(value) {
 }
 
 // src/git.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync } from "child_process";
 function git(args) {
   try {
-    return execFileSync2("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     throw new CliError("user", `git ${args.join(" ")} failed: ${stringifyError(err)}`);
   }
@@ -1353,32 +977,7 @@ var AnthropicModel = {
   Sonnet5: "claude-sonnet-5",
   Fable5: "claude-fable-5"
 };
-var BasetenModel = {
-  KimiK27Code: "kimi-k2.7-code"
-};
-var XaiModel = {
-  Grok45: "grok-4.5",
-  Grok43: "grok-4.3",
-  Grok420Reasoning: "grok-4.20-0309-reasoning",
-  Grok420NonReasoning: "grok-4.20-0309-non-reasoning",
-  Grok420MultiAgent: "grok-4.20-multi-agent-0309",
-  GrokBuild01: "grok-build-0.1"
-};
-var CursorModel = {
-  Composer25: "composer-2.5"
-};
-var GrokBuildModel = {
-  Grok45Byos: "grok-4.5-byos",
-  GrokComposer25Fast: "grok-composer-2.5-fast"
-};
-var MODEL_PROVIDERS_SET = /* @__PURE__ */ new Set([
-  "openai",
-  "anthropic",
-  "baseten",
-  "xai",
-  "cursor",
-  "grok"
-]);
+var MODEL_PROVIDERS_SET = /* @__PURE__ */ new Set(["openai", "anthropic"]);
 var BACKEND_DESKTOP_IMAGE_FEEDBACK_CONFIGS = {
   [CODEX_AGENT_RUNTIME_BACKEND]: {
     backend: CODEX_AGENT_RUNTIME_BACKEND,
@@ -1623,7 +1222,7 @@ var MODEL_REGISTRY = [
     // billing. `anthropic/cost.ts` ANTHROPIC_MESSAGES_MODEL_PRICING owns that
     // and is intentionally ~3x divergent until Phase 5.
     pricing: { inputPerMillion: 5, outputPerMillion: 25, cacheReadPerMillion: 0.5, cacheWritePerMillion: 6.25 },
-    sessionStart: { eligible: true, isDefault: true }
+    sessionStart: { eligible: true }
   },
   {
     id: AnthropicModel.Opus5,
@@ -1631,11 +1230,15 @@ var MODEL_REGISTRY = [
     provider: "anthropic",
     backends: [CLAUDE_CODE_AGENT_RUNTIME_BACKEND],
     contextWindow: 1e6,
+    // Verified 2026-07-26 against @anthropic-ai/claude-agent-sdk 0.3.219
+    // EffortLevel: Opus 5 supports low/medium/high/xhigh/max. "none" maps to
+    // omitting SDK Options.effort so Claude keeps its adaptive default.
     reasoning: { efforts: ["none", "low", "medium", "high", "xhigh", "max"], default: "high" },
     // Bridge cost estimate; authoritative Anthropic Messages pricing lives in
-    // apps/control-plane-worker/src/anthropic/cost.ts.
+    // apps/control-plane-worker/src/anthropic/cost.ts, where Opus 5 carries the
+    // same rates as Opus 4.8, so this default move has no modeled cost delta.
     pricing: { inputPerMillion: 5, outputPerMillion: 25, cacheReadPerMillion: 0.5, cacheWritePerMillion: 6.25 },
-    sessionStart: { eligible: true }
+    sessionStart: { eligible: true, isDefault: true }
   },
   {
     id: AnthropicModel.Sonnet46,
@@ -1683,212 +1286,11 @@ var MODEL_REGISTRY = [
     // verified Messages API table.
     pricing: { inputPerMillion: 10, outputPerMillion: 50, cacheReadPerMillion: 1, cacheWritePerMillion: 12.5 },
     sessionStart: { eligible: true }
-  },
-  {
-    id: BasetenModel.KimiK27Code,
-    name: "Kimi K2.7 Code",
-    provider: "baseten",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 262e3,
-    // Verified 2026-07-04 against Baseten Model APIs docs, model library, and
-    // changelog: wire id `moonshotai/Kimi-K2.7-Code`, 262k served
-    // context/output, OpenAI SDK compatible, MIT license, tool calling
-    // supported for all Model APIs.
-    providerModelId: "moonshotai/Kimi-K2.7-Code",
-    desktopImageFeedback: {
-      backend: OPENCODE_AGENT_RUNTIME_BACKEND,
-      fixture: "known_image_fixture",
-      deliveryPath: "native_mcp_tool_result_image",
-      verifiedAt: "2026-07-07"
-    },
-    pricing: { inputPerMillion: 0.95, outputPerMillion: 4, cacheReadPerMillion: 0.16 },
-    sessionStart: { eligible: true, isDefault: true }
-  },
-  // xAI models (all text/chat models from https://docs.x.ai/docs/models,
-  // verified 2026-07-15). All run on the opencode backend through the
-  // OpenAI-compatible Chat Completions API at api.x.ai. No reasoning config
-  // for any of them: xAI documents `reasoning_effort` for grok-4.3 only
-  // (https://docs.x.ai/docs/api-reference), AND the opencode backend
-  // intentionally passes no reasoning parameters to OSS providers
-  // (variantReasoning: intentional in backend-capabilities.ts) — grok-4.3's
-  // server-side default (`low`) applies. Pricing records both tiers: xAI
-  // bills the whole request at long-context rates once the prompt crosses
-  // 200k tokens, expressed via `longContext` (bridge cost estimates only).
-  {
-    id: XaiModel.Grok45,
-    name: "Grok 4.5",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 5e5,
-    // Verified 2026-07-15 against https://docs.x.ai/docs/pricing: $2/M in,
-    // $6/M out, $0.50/M cached input below 200k prompt tokens; $4/$12/$1.00
-    // at or above it. 500k context.
-    pricing: {
-      inputPerMillion: 2,
-      outputPerMillion: 6,
-      cacheReadPerMillion: 0.5,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 4, outputPerMillion: 12, cacheReadPerMillion: 1 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: XaiModel.Grok43,
-    name: "Grok 4.3",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 1e6,
-    // Verified 2026-07-15 against https://docs.x.ai/docs/pricing: $1.25/M in,
-    // $2.50/M out, $0.20/M cached input below 200k prompt tokens;
-    // $2.50/$5.00/$0.40 at or above it. 1M context.
-    pricing: {
-      inputPerMillion: 1.25,
-      outputPerMillion: 2.5,
-      cacheReadPerMillion: 0.2,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 2.5, outputPerMillion: 5, cacheReadPerMillion: 0.4 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: XaiModel.Grok420Reasoning,
-    name: "Grok 4.20 Reasoning",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 1e6,
-    // xAI encodes reasoning in distinct model ids for the 4.20 line (like
-    // Cursor), not a per-request parameter. Verified 2026-07-15 against
-    // https://docs.x.ai/docs/pricing: $1.25/M in, $2.50/M out, $0.20/M cached
-    // input below 200k prompt tokens; $2.50/$5.00/$0.40 at or above it. 1M context.
-    pricing: {
-      inputPerMillion: 1.25,
-      outputPerMillion: 2.5,
-      cacheReadPerMillion: 0.2,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 2.5, outputPerMillion: 5, cacheReadPerMillion: 0.4 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: XaiModel.Grok420NonReasoning,
-    name: "Grok 4.20 Non-Reasoning",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 1e6,
-    // Verified 2026-07-15 against https://docs.x.ai/docs/pricing: $1.25/M in,
-    // $2.50/M out, $0.20/M cached input below 200k prompt tokens;
-    // $2.50/$5.00/$0.40 at or above it. 1M context.
-    pricing: {
-      inputPerMillion: 1.25,
-      outputPerMillion: 2.5,
-      cacheReadPerMillion: 0.2,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 2.5, outputPerMillion: 5, cacheReadPerMillion: 0.4 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: XaiModel.Grok420MultiAgent,
-    name: "Grok 4.20 Multi-Agent",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 1e6,
-    // Verified 2026-07-15 against https://docs.x.ai/docs/pricing: $1.25/M in,
-    // $2.50/M out, $0.20/M cached input below 200k prompt tokens;
-    // $2.50/$5.00/$0.40 at or above it. 1M context.
-    pricing: {
-      inputPerMillion: 1.25,
-      outputPerMillion: 2.5,
-      cacheReadPerMillion: 0.2,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 2.5, outputPerMillion: 5, cacheReadPerMillion: 0.4 }
-    },
-    sessionStart: { eligible: true },
-    // Cannot run a coding-agent session on a standard xAI key (verified
-    // 2026-07-15 against api.x.ai with our production key): chat completions
-    // rejects the model outright ("Multi Agent requests are not allowed on
-    // chat completions") and the Responses API 400s any request carrying
-    // client-side tools ("Client-side tools for multi-agent models require
-    // beta access") — and the harness always sends tools. Hidden from the
-    // picker until xAI grants beta access; CLI/API selection stays open for
-    // retesting.
-    visibility: "internal_probe"
-  },
-  {
-    id: XaiModel.GrokBuild01,
-    name: "Grok Build 0.1",
-    provider: "xai",
-    backends: [OPENCODE_AGENT_RUNTIME_BACKEND],
-    contextWindow: 256e3,
-    // Verified 2026-07-15 against https://docs.x.ai/docs/pricing: $1/M in,
-    // $2/M out, $0.20/M cached input below 200k prompt tokens; $2/$4/$0.40 at
-    // or above it. 256k context.
-    pricing: {
-      inputPerMillion: 1,
-      outputPerMillion: 2,
-      cacheReadPerMillion: 0.2,
-      longContext: { thresholdTokens: 2e5, inputPerMillion: 2, outputPerMillion: 4, cacheReadPerMillion: 0.4 }
-    },
-    sessionStart: { eligible: true }
-  },
-  {
-    id: CursorModel.Composer25,
-    name: "Composer 2.5",
-    provider: "cursor",
-    backends: [CURSOR_AGENT_RUNTIME_BACKEND],
-    // Cursor bills Composer usage through the user's Cursor account (API key
-    // or subscription); Arcanist does not meter it, so no registry pricing is
-    // recorded (costTracked: false requires pricing to stay undefined). No
-    // reasoning config: Cursor encodes effort in distinct model ids
-    // (`--list-models`), not a per-request parameter. Context window is not
-    // published for Composer 2.5 (checked cursor.com/docs/models 2026-07-15),
-    // so none is recorded.
-    costTracked: false,
-    sessionStart: { eligible: true, isDefault: true }
-  },
-  {
-    id: GrokBuildModel.Grok45Byos,
-    name: "Grok 4.5 (Subscription)",
-    provider: "grok",
-    backends: [GROK_AGENT_RUNTIME_BACKEND],
-    // Wire id `grok-4.5` (the CLI's subscription default) collides with the
-    // xai/opencode registry id, so the Arcanist id is suffixed and the wire id
-    // rides providerModelId. Billed through the user's Grok subscription via
-    // the Grok Build CLI (cli-chat-proxy.grok.com); Arcanist does not meter it
-    // (costTracked: false requires pricing to stay undefined). Context window
-    // verified 2026-07-15 against https://docs.x.ai/docs/models (grok-4.5,
-    // 500k). No reasoning config: the CLI's --reasoning-effort is documented
-    // for reasoning models only and grok-4.5 is classified no-reasoning per
-    // the xai registry entries above.
-    providerModelId: "grok-4.5",
-    contextWindow: 5e5,
-    costTracked: false,
-    sessionStart: { eligible: true, isDefault: true },
-    // Internal probe (ARC-1704): hidden from the public model picker except
-    // for users with an active Grok subscription (Codex Spark precedent);
-    // CLI/API-selectable and session-startable by internal Arcanist
-    // businesses only.
-    visibility: "internal_probe",
-    requiresGrokSubscriptionAuth: true
-  },
-  {
-    id: GrokBuildModel.GrokComposer25Fast,
-    name: "Grok Composer 2.5 Fast",
-    provider: "grok",
-    backends: [GROK_AGENT_RUNTIME_BACKEND],
-    // Cursor's Composer 2.5 Fast served through Grok Build (verified in
-    // `grok models` 0.2.101 under a live subscription, 2026-07-15). Wire id
-    // matches the registry id, so no providerModelId. Context window is not
-    // published for Composer variants (cursor.com/docs/models), so none is
-    // recorded. Subscription-billed, not metered by Arcanist.
-    costTracked: false,
-    sessionStart: { eligible: true },
-    visibility: "internal_probe",
-    requiresGrokSubscriptionAuth: true
   }
 ];
 var MODEL_PROVIDER_NAMES = {
   openai: "OpenAI",
-  anthropic: "Anthropic",
-  baseten: "Baseten",
-  xai: "xAI",
-  cursor: "Cursor",
-  grok: "Grok Build"
+  anthropic: "Anthropic"
 };
 function buildSessionStartModelIdsByBackend() {
   const byBackend = Object.fromEntries(AGENT_RUNTIME_BACKENDS.map((backend) => [backend, []]));
@@ -1926,10 +1328,7 @@ var VALID_SESSION_START_MODEL_IDS_BY_BACKEND = {
   [CODEX_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[CODEX_AGENT_RUNTIME_BACKEND]),
   [CLAUDE_CODE_AGENT_RUNTIME_BACKEND]: new Set(
     SESSION_START_MODEL_IDS_BY_BACKEND[CLAUDE_CODE_AGENT_RUNTIME_BACKEND]
-  ),
-  [OPENCODE_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[OPENCODE_AGENT_RUNTIME_BACKEND]),
-  [CURSOR_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[CURSOR_AGENT_RUNTIME_BACKEND]),
-  [GROK_AGENT_RUNTIME_BACKEND]: new Set(SESSION_START_MODEL_IDS_BY_BACKEND[GROK_AGENT_RUNTIME_BACKEND])
+  )
 };
 var MODEL_CONTEXT_WINDOWS = {
   ...Object.fromEntries(
@@ -2036,6 +1435,12 @@ function buildModelProviderGroups(models2) {
       reasoning: model.reasoning
     });
   }
+  const defaultModelIds = new Set(
+    models2.filter((model) => model.sessionStart?.isDefault === true).map((model) => model.id)
+  );
+  for (const group of groups.values()) {
+    group.models.sort((a, b) => Number(defaultModelIds.has(b.id)) - Number(defaultModelIds.has(a.id)));
+  }
   return [...groups.values()];
 }
 var SESSION_START_MODEL_ID_SET_ANY_BACKEND = new Set(
@@ -2051,27 +1456,11 @@ var CODEX_SUBSCRIPTION_SESSION_START_MODEL_PROVIDER_GROUPS = buildModelProviderG
     (model) => SESSION_START_MODEL_ID_SET_ANY_BACKEND.has(model.id) && (model.visibility !== "internal_probe" || model.requiresCodexSubscriptionAuth === true)
   )
 );
-function buildSubscriptionAwareGroups(include) {
-  return buildModelProviderGroups(
-    MODEL_REGISTRY.filter(
-      (model) => SESSION_START_MODEL_ID_SET_ANY_BACKEND.has(model.id) && (model.visibility !== "internal_probe" || include.codexSubscription && model.requiresCodexSubscriptionAuth === true || include.grokSubscription && model.requiresGrokSubscriptionAuth === true)
-    )
-  );
-}
-var SESSION_START_MODEL_PROVIDER_GROUPS_BY_SUBSCRIPTIONS = {
-  "false:false": PUBLIC_SESSION_START_MODEL_PROVIDER_GROUPS,
-  "false:true": buildSubscriptionAwareGroups({ codexSubscription: false, grokSubscription: true }),
-  "true:false": CODEX_SUBSCRIPTION_SESSION_START_MODEL_PROVIDER_GROUPS,
-  "true:true": buildSubscriptionAwareGroups({ codexSubscription: true, grokSubscription: true })
-};
 
 // src/commands/model-options.ts
 function backendForProviderPrefix(rawModel) {
   const provider = rawModel.match(/^([a-z]+)[/:]/i)?.[1]?.toLowerCase();
   if (provider === "anthropic") return CLAUDE_CODE_AGENT_RUNTIME_BACKEND;
-  if (provider === "baseten" || provider === "xai") return OPENCODE_AGENT_RUNTIME_BACKEND;
-  if (provider === "cursor") return CURSOR_AGENT_RUNTIME_BACKEND;
-  if (provider === "grok") return GROK_AGENT_RUNTIME_BACKEND;
   return void 0;
 }
 function resolveModelAndBackend(options) {
@@ -2113,7 +1502,7 @@ var AUTOMATION_ERROR_HINTS = {
   slack_channel_unavailable: "Check the Slack channel ID and confirm the bot can see the channel.",
   slack_bot_not_in_channel: "Invite the Arcanist bot to the channel, then retry.",
   rule_cap_reached: "Delete or disable an existing automation before creating another one. The cap is 20 enabled rules.",
-  model_not_available: "That model's backend (Claude/opencode) is limited to Arcanist team businesses; use the codex default or a codex model.",
+  model_not_available: "That model's backend (Claude) is limited to Arcanist team businesses; use the codex default or a codex model.",
   repo_skills_unavailable: "Arcanist could not verify the repo's skills right now. Retry once GitHub skill discovery is healthy.",
   unknown_skill: "That leading slash skill does not exist in the selected repository."
 };
@@ -2161,10 +1550,10 @@ async function listAutomationsCommand(options, command) {
     "automations list --all",
     options.all === true,
     options.cursor,
-    async (cursor2) => {
+    async (cursor) => {
       const query = new URLSearchParams();
       if (options.limit) query.set("limit", options.limit);
-      if (cursor2) query.set("cursor", cursor2);
+      if (cursor) query.set("cursor", cursor);
       const payload = await automationApiFetch(
         config,
         `/api/automation/schedules${query.size ? `?${query.toString()}` : ""}`
@@ -2245,8 +1634,73 @@ function formatTime(value) {
 }
 
 // src/commands/codex.ts
-import { readFile as readFile2 } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile } from "fs/promises";
+import { join as join4 } from "path";
+
+// src/vendor-login.ts
+import { spawn } from "child_process";
+import { rmSync } from "fs";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join3 } from "path";
+function runVendorLoginProcess(spec) {
+  return new Promise((resolve3, reject) => {
+    const child = spawn(spec.binPath, spec.args, {
+      stdio: "inherit",
+      env: { ...process.env, ...spec.env }
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") {
+        reject(
+          new CliError("user", `Could not find the \`${spec.binPath}\` executable.`, {
+            hint: spec.missingBinaryHint
+          })
+        );
+        return;
+      }
+      reject(new CliError("user", `Failed to launch \`${spec.binPath} ${spec.args.join(" ")}\`: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve3();
+        return;
+      }
+      reject(
+        new CliError("user", `\`${spec.binPath} ${spec.args.join(" ")}\` exited with code ${code ?? "unknown"}.`, {
+          hint: `Complete the ${spec.displayName} login, then re-run \`${spec.retryCommand}\`.`
+        })
+      );
+    });
+  });
+}
+async function withIsolatedLoginDir(prefix, fn) {
+  let tempDir;
+  const handleSigint = () => {
+    if (tempDir) {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    process.exit(EXIT_CODE_INTERRUPTED);
+  };
+  process.on("SIGINT", handleSigint);
+  try {
+    tempDir = await mkdtemp(join3(tmpdir(), prefix));
+    return await fn(tempDir);
+  } finally {
+    try {
+      if (tempDir) {
+        await rm(tempDir, { recursive: true, force: true }).catch(() => {
+        });
+      }
+    } finally {
+      process.off("SIGINT", handleSigint);
+    }
+  }
+}
+
+// src/commands/codex.ts
 var CODEX_SUBSCRIPTION_PATH = "/api/settings/codex-subscription";
 var CODEX_SUBSCRIPTION_AUTH_JSON_PATH = "/api/settings/codex-subscription/auth-json";
 var CODEX_SUBSCRIPTION_ENABLED_PATH = "/api/settings/codex-subscription/enabled";
@@ -2284,7 +1738,7 @@ async function codexLoginCommand(options, command) {
     await runCodexDeviceLogin(codexPath, codexHome);
     let raw;
     try {
-      raw = await readFile2(join5(codexHome, "auth.json"), "utf8");
+      raw = await readFile(join4(codexHome, "auth.json"), "utf8");
     } catch {
       throw new CliError("user", "Codex login completed but no auth.json was written.", {
         hint: "Verify `codex login --device-auth` succeeds on its own, then re-run `arcanist codex login`."
@@ -2357,7 +1811,7 @@ async function codexLogoutCommand(options, command) {
 }
 
 // src/uploads.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 import { basename as basename2, extname } from "path";
 
 // ../../shared/constants/uploads.ts
@@ -2460,7 +1914,7 @@ async function resolveUploadedFileOptions(files) {
     paths.map(async (path) => {
       const name = basename2(path);
       try {
-        return { name, content: await readFile3(path, "utf8") };
+        return { name, content: await readFile2(path, "utf8") };
       } catch (err) {
         const message = stringifyError(err);
         throw new CliError("user", `Failed to read uploaded file ${path}: ${message}`);
@@ -4863,7 +4317,7 @@ async function reviewCommand(prUrl, options = {}, command) {
 }
 
 // src/commands/sandbox.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname2 } from "path";
 
 // ../../shared/sandbox-layer/parser.ts
@@ -5410,7 +4864,7 @@ function assertCleanAndPushed() {
     throw new CliError("user", "Current commit is not pushed; push before building the sandbox layer.");
 }
 function assertManifestExists(path) {
-  if (!existsSync4(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
+  if (!existsSync3(path)) throw new CliError("user", `Missing sandbox manifest: ${path}`);
 }
 function repoPath(repo) {
   return `${repo.owner}/${repo.repo}`;
@@ -5627,9 +5081,9 @@ function sourceBody(sourceRepo, manifestPath) {
 }
 async function sandboxInitCommand(options = {}, command) {
   const runtime = getRuntimeOptions(command, options);
-  if (existsSync4(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
+  if (existsSync3(DEFAULT_MANIFEST_PATH)) throw new CliError("conflict", `${DEFAULT_MANIFEST_PATH} already exists`);
   const layerPath = ".arcanist/sandbox.layer.Dockerfile";
-  if (existsSync4(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
+  if (existsSync3(layerPath)) throw new CliError("conflict", `${layerPath} already exists`);
   mkdirSync3(dirname2(DEFAULT_MANIFEST_PATH), { recursive: true });
   writeFileSync3(
     DEFAULT_MANIFEST_PATH,
@@ -5939,14 +5393,14 @@ async function listSessionsCommand(options, command) {
     "sessions list --all",
     options.all === true,
     options.cursor,
-    async (cursor2) => {
+    async (cursor) => {
       const query = new URLSearchParams();
       if (options.status) query.set("status", options.status);
       if (options.scope) query.set("scope", options.scope);
       if (options.search) query.set("q", options.search);
       if (options.repo) query.set("repo", options.repo);
       if (options.limit) query.set("limit", options.limit);
-      if (cursor2) query.set("cursor", cursor2);
+      if (cursor) query.set("cursor", cursor);
       const payload2 = await apiFetch(
         config,
         `/api/sessions${query.size ? `?${query.toString()}` : ""}`
@@ -6173,10 +5627,10 @@ async function listTokensCommand(options, command) {
     "tokens list --all",
     options.all === true,
     options.cursor,
-    async (cursor2) => {
+    async (cursor) => {
       const query = new URLSearchParams();
       if (options.limit) query.set("limit", options.limit);
-      if (cursor2) query.set("cursor", cursor2);
+      if (cursor) query.set("cursor", cursor);
       const payload2 = await apiFetch(
         config,
         `/api/cli-tokens${query.size ? `?${query.toString()}` : ""}`
@@ -6416,56 +5870,6 @@ Examples:
 codex.command("use <state>").description("Turn using your saved Codex subscription auth for OpenAI sessions on or off (state: on|off)").action((state, options, command) => codexUseCommand(state, options, command));
 codex.command("status").description("Show Codex subscription availability and whether auth is saved").action((options, command) => codexStatusCommand(options, command));
 codex.command("logout").description("Deactivate the selector and remove the stored Codex subscription auth for your user").action((options, command) => codexLogoutCommand(options, command));
-var grok = program.command("grok").description("Grok (xAI) subscription (bring-your-own-subscription) commands");
-grok.command("login").description("Authenticate a Grok (xAI) subscription and store it for future Grok BYOS sessions").option("--grok-path <path>", "Path to the grok executable (default: grok on PATH, or ARCANIST_GROK_BIN)").addHelpText(
-  "after",
-  `
-Runs the Grok CLI device-authorization login locally under a temporary HOME, then uploads the
-resulting auth.json to Arcanist (encrypted, per user) and activates the selector. Your workspace
-must have Grok subscription auth enabled. The credential is never written to your default ~/.grok.
-While the selector is on, Grok Build sessions run on your subscription auth.
-If the grok CLI is not installed, you will be offered its official install script ([y/N] prompt,
-interactive terminals only).
-
-Examples:
-  arcanist grok login
-  arcanist grok login --grok-path /usr/local/bin/grok
-`
-).action(
-  (options, command) => agentSubscriptionLoginCommand(GROK_SUBSCRIPTION_CLI_CONFIG, { ...options, binPath: options.grokPath }, command)
-);
-grok.command("use <state>").description("Turn using your saved Grok subscription auth on or off (state: on|off)").action(
-  (state, options, command) => agentSubscriptionUseCommand(GROK_SUBSCRIPTION_CLI_CONFIG, state, options, command)
-);
-grok.command("status").description("Show whether your workspace is eligible and whether a Grok subscription auth is saved").action((options, command) => agentSubscriptionStatusCommand(GROK_SUBSCRIPTION_CLI_CONFIG, options, command));
-grok.command("logout").description("Deactivate the selector and remove the stored Grok subscription auth for your user").action((options, command) => agentSubscriptionLogoutCommand(GROK_SUBSCRIPTION_CLI_CONFIG, options, command));
-var cursor = program.command("cursor").description("Cursor subscription (bring-your-own-subscription) commands");
-cursor.command("login").description("Authenticate a Cursor subscription and store it for future Cursor BYOS sessions").option(
-  "--cursor-path <path>",
-  "Path to the cursor-agent executable (default: cursor-agent on PATH, or ARCANIST_CURSOR_AGENT_BIN)"
-).addHelpText(
-  "after",
-  `
-Runs the Cursor CLI login locally under a temporary HOME/CURSOR_CONFIG_DIR, then uploads the
-captured auth credential to Arcanist (encrypted, per user) and activates the selector. Your
-workspace must have Cursor subscription auth enabled. Cursor's login-token location is not
-formally documented; if capture fails, use a Cursor API key in Settings instead. While the
-selector is on, Cursor sessions run on your subscription auth instead of a Cursor API key.
-If the cursor-agent CLI is not installed, you will be offered its official install script
-([y/N] prompt, interactive terminals only).
-
-Examples:
-  arcanist cursor login
-  arcanist cursor login --cursor-path /usr/local/bin/cursor-agent
-`
-).action(
-  (options, command) => agentSubscriptionLoginCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, { ...options, binPath: options.cursorPath }, command)
-);
-cursor.command("use <state>").description("Turn using your saved Cursor subscription auth on or off (state: on|off)").action(
-  (state, options, command) => agentSubscriptionUseCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, state, options, command)
-);
-cursor.command("status").description("Show whether your workspace is eligible and whether a Cursor subscription auth is saved").action((options, command) => agentSubscriptionStatusCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
-cursor.command("logout").description("Deactivate the selector and remove the stored Cursor subscription auth for your user").action((options, command) => agentSubscriptionLogoutCommand(CURSOR_SUBSCRIPTION_CLI_CONFIG, options, command));
 var sessions = program.command("sessions").description("Session commands");
 program.command("review <pr-url>").description("Run a Zeus review for a GitHub pull request").option("--focus <text>", "Focus the review on a specific concern").option("--model <model>", "Pin the reviewer model (Arcanist members only); defaults to automatic routing").option("--wait", "Wait for the review and print its verdict and findings").option("--poll-interval <ms>", "Polling interval in milliseconds while waiting (default 10000)").addHelpText(
   "after",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.230",
+  "version": "0.1.232",
   "description": "CLI for Arcanist — create and manage coding agent sessions",
   "type": "module",
   "bin": {