@tryarcanist/cli 0.1.361 → 0.1.363

package/README.md

@@ -150,6 +150,28 @@ arcanist environments retry owner/repo --wait --json
 arcanist environments retry owner/repo --wait --poll-interval 5000 --json
 ```
 
+### `arcanist environments login`
+
+Log into your app once in a throwaway local browser and save that login on the environment so Zeus sessions start signed in. Alias: `arcanist env login`. A write-scoped token is required. Pass an environment id or `owner/repo` outside a checkout; the environment must have an app runtime configured.
+
+```bash
+arcanist environments login owner/repo
+arcanist environments login owner/repo --validate-path /dashboard --yes
+arcanist environments login owner/repo --url http://localhost:3000/login --no-network-policy
+arcanist environments login owner/repo --clear
+```
+
+The command opens a fresh Chrome window that shares nothing with your own browser profile. Log into your app and every provider it redirects through (Auth0, Google, and so on) using dedicated test accounts, keep the window open, then press Enter in the terminal. Closing the window or pressing Ctrl-C cancels without uploading anything.
+
+What gets captured is the Playwright storage state for that window: cookies and localStorage. Cookies and storage on `localhost`, `127.0.0.1`, or `[::1]` are rewritten to `localhost` on the app runtime port, which is where the sandbox serves the app. The state is encrypted at rest and only ever handed to a live sandbox for the environment. Output is counts only (cookie domains, storage origins, byte size); cookie and storage values never reach the terminal.
+
+- `--url <url>` opens this page first instead of the app runtime URL, for example a login page on another local port.
+- `--validate-path <path>` saves a signed-in-only page (for example `/dashboard`) as the environment's `auth.validatePath`; every session opens it to verify the login still works. Without the flag the command prompts for one when the environment has none. Saving it changes the app runtime profile, so an environment rebuild is scheduled.
+- `--yes` adds the provider hosts the login redirected through to the environment's trusted domains without asking, so the sandbox can follow the same redirect. `--no-network-policy` leaves the trusted domains alone; verification then reports the login as unavailable until those hosts are trusted.
+- `--clear` removes the saved login and skips the browser entirely.
+
+The capture needs an interactive terminal: stdin and stderr must be a TTY. Instructions and prompts go to stderr, so `--json --yes --validate-path /dashboard > result.json` works. JSON output is `{environmentId, version, counts: {cookieDomainCount, storageOriginCount}, providerHosts, networkPolicy: {added, rejected, skipped}, validatePath}`, or `{environmentId, deleted}` with `--clear`. `arcanist environments status --json` reports the saved login under `browserState`, including whether a re-login is needed.
+
 ### `arcanist setup`
 
 Connect Arcanist and prepare one or more repository environments. The command starts browser authentication when needed, lists only repositories where GitHub reports write access, and queues at most 20 builds.

package/dist/index.js

@@ -7409,7 +7409,7 @@ function isTerminalPhase(phase, _sessionKind) {
 // package.json
 var package_default = {
   name: "@tryarcanist/cli",
-  version: "0.1.361",
+  version: "0.1.363",
   description: "Command-line interface for Arcanist: inspect sessions, prepare Zeus environments, and trigger reviews",
   type: "module",
   bin: {
@@ -7438,7 +7438,8 @@ var package_default = {
   homepage: "https://www.tryarcanist.com",
   license: "MIT",
   dependencies: {
-    commander: "^12.1.0"
+    commander: "^12.1.0",
+    "playwright-core": "^1.61.1"
   },
   devDependencies: {
     tsup: "^8.0.0",
@@ -27450,6 +27451,494 @@ async function egressValidateCommand(path = EGRESS_ALLOWLIST_SOURCE_PATH, option
   });
 }
 
+// ../../shared/utils/type-guards.ts
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function asNonEmptyString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+
+// ../../shared/browser-state/storage-state.ts
+var MAX_BROWSER_STATE_BYTES = 1024 * 1024;
+var BrowserStateValidationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "BrowserStateValidationError";
+  }
+  code;
+};
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var SAME_SITE_VALUES = /* @__PURE__ */ new Set(["Strict", "Lax", "None"]);
+function invalidShape(message) {
+  return new BrowserStateValidationError("invalid_shape", message);
+}
+function isBrowserCookie(value) {
+  if (!isRecord(value)) return false;
+  if (typeof value.name !== "string" || typeof value.value !== "string" || typeof value.domain !== "string" || typeof value.path !== "string") {
+    return false;
+  }
+  if (value.expires !== void 0 && !(typeof value.expires === "number" && Number.isFinite(value.expires))) {
+    return false;
+  }
+  if (value.httpOnly !== void 0 && typeof value.httpOnly !== "boolean") return false;
+  if (value.secure !== void 0 && typeof value.secure !== "boolean") return false;
+  if (value.sameSite !== void 0 && !SAME_SITE_VALUES.has(value.sameSite)) {
+    return false;
+  }
+  return true;
+}
+function isOriginString(value) {
+  if (typeof value !== "string") return false;
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return false;
+  }
+  return url2.origin !== "null" && url2.origin === value;
+}
+function isLocalStorageItem(value) {
+  return isRecord(value) && typeof value.name === "string" && typeof value.value === "string";
+}
+function parseStorageState(raw) {
+  const bytes = new TextEncoder().encode(raw).byteLength;
+  if (bytes > MAX_BROWSER_STATE_BYTES) {
+    throw new BrowserStateValidationError("too_large", `Browser state is ${bytes} bytes; the limit is 1 MiB.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new BrowserStateValidationError("invalid_json", "Browser state is not valid JSON.");
+  }
+  if (!isRecord(parsed) || !Array.isArray(parsed.cookies) || !Array.isArray(parsed.origins)) {
+    throw invalidShape("Browser state must be a Playwright storage state with cookies[] and origins[].");
+  }
+  const cookies = [];
+  parsed.cookies.forEach((cookie, index) => {
+    if (!isBrowserCookie(cookie)) {
+      throw invalidShape(
+        `Browser state cookies[${index}] is not a Playwright cookie: name, value, domain, and path must be strings; expires a finite number; httpOnly and secure booleans; sameSite one of Strict, Lax, None.`
+      );
+    }
+    cookies.push(cookie);
+  });
+  const origins = [];
+  parsed.origins.forEach((entry, index) => {
+    if (!isRecord(entry) || !Array.isArray(entry.localStorage)) {
+      throw invalidShape(`Browser state origins[${index}] must carry an origin string and a localStorage[] array.`);
+    }
+    if (!isOriginString(entry.origin)) {
+      throw invalidShape(
+        `Browser state origins[${index}].origin must be a URL origin such as https://app.example.com with no path, query, or fragment.`
+      );
+    }
+    const localStorage = [];
+    entry.localStorage.forEach((item, itemIndex) => {
+      if (!isLocalStorageItem(item)) {
+        throw invalidShape(
+          `Browser state origins[${index}].localStorage[${itemIndex}] must be a record with string name and value.`
+        );
+      }
+      localStorage.push({ name: item.name, value: item.value });
+    });
+    origins.push({ origin: entry.origin, localStorage });
+  });
+  if (cookies.length === 0 && origins.every((o) => o.localStorage.length === 0)) {
+    throw new BrowserStateValidationError("empty", "Browser state is empty; nothing was captured. Did you log in?");
+  }
+  return { state: { cookies, origins }, bytes };
+}
+function summarizeStorageState(state) {
+  return {
+    cookieDomainCount: new Set(state.cookies.map((c) => c.domain.replace(/^\./, "").toLowerCase())).size,
+    storageOriginCount: state.origins.filter((o) => o.localStorage.length > 0).length
+  };
+}
+function isLocalHost(host) {
+  return LOCAL_HOSTS.has(host.replace(/^\./, "").toLowerCase());
+}
+function sandboxAppOrigin(hostPort) {
+  return `http://localhost:${hostPort}`;
+}
+function normalizeLocalOrigins(state, sandboxOrigin2) {
+  const sandbox2 = new URL(sandboxOrigin2);
+  const merged = /* @__PURE__ */ new Map();
+  for (const entry of state.origins) {
+    let host;
+    try {
+      host = new URL(entry.origin).hostname;
+    } catch {
+      host = "";
+    }
+    const origin = isLocalHost(host) ? sandbox2.origin : entry.origin;
+    let items = merged.get(origin);
+    if (!items) {
+      items = /* @__PURE__ */ new Map();
+      merged.set(origin, items);
+    }
+    for (const item of entry.localStorage) {
+      items.delete(item.name);
+      items.set(item.name, item.value);
+    }
+  }
+  return {
+    cookies: state.cookies.map(
+      (cookie) => isLocalHost(cookie.domain) ? { ...cookie, domain: sandbox2.hostname, secure: false } : cookie
+    ),
+    origins: [...merged].map(([origin, items]) => ({
+      origin,
+      localStorage: [...items].map(([name, value]) => ({ name, value }))
+    }))
+  };
+}
+function providerHostsFromNavigations(urls) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const value of urls) {
+    let url2;
+    try {
+      url2 = new URL(value);
+    } catch {
+      continue;
+    }
+    if (url2.protocol !== "http:" && url2.protocol !== "https:") continue;
+    if (isLocalHost(url2.hostname)) continue;
+    hosts.add(url2.hostname.toLowerCase());
+  }
+  return [...hosts].sort();
+}
+
+// src/browser-capture.ts
+import { mkdtempSync, rmSync as rmSync2 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join5 } from "path";
+var WINDOW_CLOSED_MESSAGE = "The browser window was closed before Enter was pressed. Run the command again, log in, then press Enter here before closing the window.";
+function describeStartUrl(startUrl) {
+  try {
+    const { origin } = new URL(startUrl);
+    if (origin && origin !== "null") return sanitizeTerminalText(origin);
+  } catch {
+  }
+  return "the start page";
+}
+async function launch(userDataDir) {
+  const { chromium } = await import("playwright-core");
+  const common = {
+    headless: false,
+    viewport: null,
+    handleSIGINT: false,
+    args: ["--no-first-run", "--no-default-browser-check"]
+  };
+  try {
+    return await chromium.launchPersistentContext(userDataDir, { ...common, channel: "chrome" });
+  } catch {
+    try {
+      return await chromium.launchPersistentContext(userDataDir, common);
+    } catch {
+      throw new CliError("user", "No browser found for the login window.", {
+        hint: "Install Google Chrome, or run `npx playwright install chromium` and try again."
+      });
+    }
+  }
+}
+async function captureBrowserLogin(opts) {
+  let userDataDir;
+  let context;
+  const navigations = [];
+  const done = new AbortController();
+  const cleanup = async () => {
+    const open2 = context;
+    context = void 0;
+    await open2?.close().catch(() => {
+    });
+    if (userDataDir) {
+      rmSync2(userDataDir, { recursive: true, force: true });
+      userDataDir = void 0;
+    }
+  };
+  const onInterrupt = () => {
+    void cleanup().finally(() => process.exit(EXIT_CODE_INTERRUPTED));
+  };
+  process.once("SIGINT", onInterrupt);
+  try {
+    userDataDir = mkdtempSync(join5(tmpdir2(), "arcanist-login-"));
+    const open2 = await launch(userDataDir);
+    context = open2;
+    const track = (page2) => {
+      page2.on("framenavigated", (frame) => {
+        if (frame === page2.mainFrame()) navigations.push(frame.url());
+      });
+    };
+    for (const page2 of open2.pages()) track(page2);
+    open2.on("page", track);
+    const page = open2.pages()[0] ?? await open2.newPage();
+    let closed = false;
+    const closedEarly = new Promise((_, reject) => {
+      open2.once("close", () => {
+        closed = true;
+        reject(new CliError("user", WINDOW_CLOSED_MESSAGE));
+      });
+    });
+    closedEarly.catch(() => {
+    });
+    const opened = await Promise.race([
+      closedEarly,
+      page.goto(opts.startUrl).then(
+        () => true,
+        () => false
+      )
+    ]);
+    if (closed) await closedEarly;
+    if (!opened) {
+      opts.onStatus?.(
+        `Could not open ${describeStartUrl(opts.startUrl)}; the window is open, navigate to your app yourself.`
+      );
+    }
+    await Promise.race([closedEarly, opts.waitForDone(done.signal)]);
+    const state = await open2.storageState();
+    return { rawState: JSON.stringify(state), navigations };
+  } finally {
+    done.abort();
+    process.off("SIGINT", onInterrupt);
+    await cleanup();
+  }
+}
+
+// src/utils/prompt-line.ts
+import { createInterface as createInterface2 } from "readline/promises";
+async function promptLine(question, options = {}) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY) {
+    throw new CliError(
+      "user",
+      "An interactive terminal is required here. Re-run with the matching flag in non-interactive environments."
+    );
+  }
+  const { signal } = options;
+  if (signal?.aborted) throw new CliError("user", "Cancelled.");
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const onAbort = () => rl.close();
+  signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await new Promise((resolve3, reject) => {
+      rl.once("SIGINT", () => reject(new CliError("user", "Cancelled.", { exitCode: EXIT_CODE_INTERRUPTED })));
+      rl.once("close", () => reject(new CliError("user", "Cancelled.")));
+      rl.question(question).then((answer) => resolve3(answer.trim()), reject);
+    });
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    rl.close();
+  }
+}
+
+// src/commands/environment-login.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function resolveEnvironment(config2, target) {
+  const response = await apiFetch(
+    config2,
+    "/api/environments"
+  );
+  const environments2 = response.data.environments;
+  if (target && UUID.test(target)) {
+    const byId = environments2.find((e) => e.id === target);
+    if (!byId) throw new CliError("user", `No environment with id ${target}.`);
+    return byId;
+  }
+  const repo = parseRepoArgOrCurrent(target, "environment");
+  const match = environments2.find(
+    (e) => e.scope === "team" && e.repoOwner.toLowerCase() === repo.owner.toLowerCase() && e.repoName.toLowerCase() === repo.repo.toLowerCase()
+  );
+  if (!match) {
+    throw new CliError("user", `No team environment for ${repo.owner}/${repo.repo}.`, {
+      hint: "Run `arcanist environments status` first."
+    });
+  }
+  return match;
+}
+function sandboxOrigin(environment) {
+  const appRuntime = environment.provisioningConfig?.sandbox?.appRuntime;
+  const hostPort = appRuntime?.url?.hostPort;
+  if (!appRuntime || !hostPort) {
+    throw new CliError(
+      "user",
+      `Environment "${sanitizeTerminalText(environment.name)}" has no app runtime, so there is nothing to log into.`,
+      {
+        hint: "Configure the app runtime on the Environment page first."
+      }
+    );
+  }
+  const origin = sandboxAppOrigin(hostPort);
+  const path = appRuntime.url?.path ?? "/";
+  return { origin, startUrl: `${origin}${path.startsWith("/") ? path : `/${path}`}`, appRuntime };
+}
+function normalizeCapture(rawState, origin) {
+  let parsed;
+  try {
+    parsed = parseStorageState(rawState);
+  } catch (error61) {
+    if (error61 instanceof BrowserStateValidationError) {
+      const hint = error61.code === "empty" ? "Log into your app in the browser window before pressing Enter." : error61.code === "too_large" ? "Log out of sites you do not need for this app and try again." : void 0;
+      throw new CliError("user", error61.message, hint ? { hint } : {});
+    }
+    throw error61;
+  }
+  const normalized = normalizeLocalOrigins(parsed.state, origin);
+  return { normalized, counts: summarizeStorageState(normalized), bytes: parsed.bytes };
+}
+function requireInteractiveTerminal() {
+  if (process.stdin.isTTY && process.stderr.isTTY) return;
+  throw new CliError("user", "environments login needs an interactive terminal to wait for you to finish logging in.", {
+    hint: "Run it from a terminal (add --yes --validate-path <path> to skip the other prompts), or use --clear to remove a saved login."
+  });
+}
+function requireAppRelativePath(validatePath) {
+  if (validatePath.startsWith("/") && !validatePath.startsWith("//")) return;
+  throw new CliError("user", "validatePath must be an app-relative path like /dashboard.", {
+    hint: "Pass a path on your own app, not a full URL."
+  });
+}
+function say(line) {
+  console.error(line);
+}
+async function confirmHosts(hosts, options) {
+  if (hosts.length === 0 || options.networkPolicy === false) return [];
+  say(
+    "These provider hosts will be added to the environment's trusted domains so the sandbox can follow the login redirect:"
+  );
+  for (const host of hosts) say(`  ${host}`);
+  if (options.yes) return hosts;
+  const answer = (await promptLine("Add them? [Y/n] ")).toLowerCase();
+  return answer === "" || answer === "y" || answer === "yes" ? hosts : [];
+}
+async function saveValidatePath(config2, environmentId, validatePath) {
+  const fresh = await apiFetch(
+    config2,
+    `/api/environments/${encodeURIComponent(environmentId)}`
+  );
+  const environment = fresh.data;
+  const appRuntime = environment.provisioningConfig?.sandbox?.appRuntime ?? {};
+  if (appRuntime.auth?.validatePath === validatePath) return false;
+  const provisioningConfig = {
+    ...environment.provisioningConfig,
+    sandbox: {
+      ...environment.provisioningConfig?.sandbox,
+      appRuntime: { ...appRuntime, auth: { ...appRuntime.auth, validatePath } }
+    }
+  };
+  await apiFetch(config2, `/api/environments/${encodeURIComponent(environment.id)}`, {
+    method: "PUT",
+    body: JSON.stringify({
+      name: environment.name,
+      description: environment.description,
+      provisioningKind: environment.provisioningKind,
+      provisioningConfig,
+      cache: environment.cache,
+      repos: environment.repos,
+      networkPolicy: environment.networkPolicy,
+      ...environment.reviewConfig !== void 0 ? { reviewConfig: environment.reviewConfig } : {}
+    })
+  });
+  return true;
+}
+async function environmentLoginCommand(target, options = {}, command) {
+  const { config: config2 } = resolveBusinessContext(command, options);
+  if (!options.clear) {
+    requireInteractiveTerminal();
+    if (options.validatePath) requireAppRelativePath(options.validatePath);
+  }
+  const environment = await resolveEnvironment(config2, target);
+  const name = sanitizeTerminalText(environment.name);
+  const statePath = `/api/environments/${encodeURIComponent(environment.id)}/browser-state`;
+  if (options.clear) {
+    const result = await apiFetch(config2, statePath, { method: "DELETE" });
+    emit(
+      command,
+      options,
+      { environmentId: environment.id, deleted: result.data.deleted },
+      ({ deleted }) => console.log(deleted ? `Browser login removed from "${name}".` : `"${name}" had no browser login.`)
+    );
+    return;
+  }
+  const { origin, startUrl, appRuntime } = sandboxOrigin(environment);
+  say(`Environment: ${name} (${sanitizeTerminalText(environment.id)})`);
+  say(`Sandbox app origin: ${origin}`);
+  say("");
+  say("Opening a fresh Chrome window. Log into your app and every provider it uses (Auth0, Google, ...)");
+  say("using dedicated TEST accounts only. Do not use personal, admin, or billing accounts.");
+  say(`If your app is running locally, open it at ${origin} so the saved login matches the sandbox.`);
+  say("Press Enter here when you are done. Keep the window open until you press Enter.");
+  const capture = await captureBrowserLogin({
+    startUrl: options.url ?? startUrl,
+    waitForDone: async (signal) => {
+      await promptLine("", { signal });
+    },
+    onStatus: say
+  });
+  const { normalized, counts, bytes } = normalizeCapture(capture.rawState, origin);
+  const hosts = providerHostsFromNavigations(capture.navigations);
+  say("");
+  say(
+    `Captured browser state: ${counts.cookieDomainCount} cookie domains, ${counts.storageOriginCount} storage origins, ${Math.round(bytes / 1024)} KB`
+  );
+  const providerHosts = await confirmHosts(hosts, options);
+  const upload = await apiFetch(config2, statePath, {
+    method: "PUT",
+    body: JSON.stringify({ state: JSON.stringify(normalized), providerHosts })
+  });
+  let validatePath = options.validatePath ?? appRuntime.auth?.validatePath;
+  if (!validatePath) {
+    say("");
+    say(
+      "This environment has no auth.validatePath. Enter a page only a signed-in user can see, so Arcanist can verify the login on every session:"
+    );
+    validatePath = await promptLine("> ") || void 0;
+  }
+  if (validatePath && validatePath !== appRuntime.auth?.validatePath) {
+    requireAppRelativePath(validatePath);
+    if (await saveValidatePath(config2, environment.id, validatePath)) {
+      say("Environment rebuild scheduled (the app runtime profile changed).");
+    }
+  }
+  const { networkPolicy } = upload.data;
+  emit(
+    command,
+    options,
+    {
+      environmentId: environment.id,
+      version: upload.data.browserState.version,
+      counts,
+      providerHosts,
+      networkPolicy,
+      validatePath: validatePath ?? null
+    },
+    () => {
+      console.log(`Saved. Environment "${name}" now has browser login v${upload.data.browserState.version}.`);
+      if (networkPolicy.added.length > 0) {
+        console.log(`Trusted domains added: ${networkPolicy.added.map(sanitizeTerminalText).join(", ")}`);
+      }
+      if (networkPolicy.rejected.length > 0) {
+        console.log(
+          `Not added (fix on the Environment page): ${networkPolicy.rejected.map(sanitizeTerminalText).join(", ")}`
+        );
+      }
+      if (networkPolicy.skipped) console.log("Network policy is full access; nothing to add.");
+      if (hosts.length > 0 && providerHosts.length === 0) {
+        console.log(
+          "Provider hosts were not added; verification reports unavailable until they are on the trusted domains."
+        );
+      }
+      if (!validatePath) {
+        console.log(
+          "No validatePath saved; Arcanist cannot verify this login until one is set on the Environment page or with --validate-path."
+        );
+      }
+    }
+  );
+}
+
 // ../../shared/utils/timing.ts
 function sleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -27551,6 +28040,42 @@ function nextAction(state) {
   }
   return "wait";
 }
+function environmentCoversRepo(environment, repo) {
+  const covered = environment.repos?.length ? environment.repos : [{ repoOwner: environment.repoOwner, repoName: environment.repoName }];
+  return covered.some(
+    (entry) => entry.repoOwner.toLowerCase() === repo.owner.toLowerCase() && entry.repoName.toLowerCase() === repo.repo.toLowerCase()
+  );
+}
+async function fetchBrowserLoginStatus(config2, repo) {
+  let environments2;
+  try {
+    const response = await apiFetch(
+      config2,
+      "/api/environments"
+    );
+    environments2 = response.data.environments;
+  } catch {
+    return null;
+  }
+  const environment = environments2.find((item) => item.scope === "team" && environmentCoversRepo(item, repo));
+  if (!environment) return null;
+  const command = `arcanist environments login ${environment.repoOwner}/${environment.repoName}`;
+  const summary = environment.browserState;
+  if (!summary) return { state: "none", capturedAt: null, command };
+  if (summary.reloginNeeded) return { state: "expired", capturedAt: summary.capturedAt, command };
+  if (!summary.lastVerifiedAt) return { state: "unverified", capturedAt: summary.capturedAt, command: null };
+  return { state: "ready", capturedAt: summary.capturedAt, command: null };
+}
+function printBrowserLogin(status) {
+  if (!status) return;
+  const label = {
+    none: "not captured",
+    ready: "ready",
+    expired: "expired",
+    unverified: "captured, not verified yet"
+  }[status.state];
+  console.log(`browser login: ${label}${status.command ? ` (run: ${sanitizeTerminalText(status.command)})` : ""}`);
+}
 function printState(state) {
   const detail = state.failureReason ?? state.stage ?? state.buildStatus ?? state.nextAction;
   console.log(
@@ -27584,7 +28109,11 @@ async function environmentStatusCommand(repoArg, options = {}, command) {
   const { config: config2 } = resolveBusinessContext(command, options);
   await apiFetch(config2, "/api/repos");
   const state = options.wait ? await waitForSetup(config2, repo.fullName, pollIntervalMs ?? SETUP_POLL_INTERVAL_MS) : await fetchSetupState(config2, repo.fullName);
-  emit(command, options, { repository: state }, ({ repository }) => printState(repository));
+  const browserLogin = await fetchBrowserLoginStatus(config2, repo);
+  emit(command, options, { repository: state, browserLogin }, ({ repository, browserLogin: login }) => {
+    printState(repository);
+    printBrowserLogin(login);
+  });
 }
 async function environmentPrepareCommand(repoArg, options = {}, command) {
   const pollIntervalMs = options.wait ? parsePollInterval(options.pollInterval, { defaultMs: SETUP_POLL_INTERVAL_MS, maxMs: null }) : null;
@@ -27715,16 +28244,6 @@ Code: ${action.userCode}
 var CODEX_AGENT_RUNTIME_BACKEND = "codex";
 var AGENT_RUNTIME_BACKENDS = [CODEX_AGENT_RUNTIME_BACKEND];
 
-// ../../shared/utils/type-guards.ts
-function isRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function asNonEmptyString(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-
 // ../../shared/constants/models.ts
 var OpenAIModel = {
   GPT56: "gpt-5.6",
@@ -32083,7 +32602,7 @@ JSON:
 JSON mode returns {branches}
 `
 ).action((repo, options, command) => repoBranchesCommand(repo, options, command));
-var environments = program.command("environments").description("Zeus environment setup commands");
+var environments = program.command("environments").alias("env").description("Zeus environment setup commands");
 environments.command("prepare").description("Prepare a repository for Zeus reviews").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--wait", "Wait until setup is ready or needs attention").option("--poll-interval <ms>", "Polling interval while waiting (default 5000)").addHelpText(
   "after",
   `
@@ -32096,12 +32615,27 @@ environments.command("status").description("Show repository environment setup st
   "after",
   `
 JSON:
-Returns {repository: {fullName, status, stage, nextAction, command, buildStatus?, failureReason?, secretRequest?, question?}}.
+Returns {repository: {fullName, status, stage, nextAction, command, buildStatus?, failureReason?, secretRequest?, question?}, browserLogin}.
+browserLogin is {state, capturedAt, command} for the repository's team environment, or null when there is none.
+The stable browserLogin state values are none, ready, expired, and unverified.
 command is the CLI argv to run, or null when the next step is the web UI or Arcanist.
 The stable status values are not_started, pending, running, escalated, succeeded, failed, and ready.
 `
 ).action((repo, options, command) => environmentStatusCommand(repo, options, command));
 environments.command("retry").description("Retry a failed repository environment setup").argument("[repo]", "Repository owner/name; defaults to current git remote").option("--wait", "Wait until setup is ready or needs attention").option("--poll-interval <ms>", "Polling interval while waiting (default 5000)").action((repo, options, command) => environmentRetryCommand(repo, options, command));
+environments.command("login").description("Log into your app once in a local browser and save the login for Zeus sessions").argument("[environment]", "Environment id or repository owner/name; defaults to current git remote").option("--url <url>", "Page to open first instead of the app runtime URL").option("--validate-path <path>", "Signed-in-only page Arcanist opens to verify the login, e.g. /dashboard").option("--yes", "Add captured provider hosts to trusted domains without asking").option("--no-network-policy", "Do not touch the environment's trusted domains").option("--clear", "Remove the saved browser login").addHelpText(
+  "after",
+  `
+Examples:
+  arcanist env login owner/repo
+  arcanist env login owner/repo --validate-path /dashboard --yes
+  arcanist env login owner/repo --clear
+
+JSON:
+JSON mode returns {environmentId, version, counts: {cookieDomainCount, storageOriginCount}, providerHosts, networkPolicy: {added, rejected, skipped}, validatePath}.
+With --clear it returns {environmentId, deleted}. Instructions and prompts go to stderr; the capture path needs an interactive terminal (pass --yes --validate-path to skip the other prompts).
+`
+).action((environment, options, command) => environmentLoginCommand(environment, options, command));
 var models = program.command("models").description("Model discovery commands");
 models.command("list").description("List session-start models").addHelpText(
   "after",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryarcanist/cli",
-  "version": "0.1.361",
+  "version": "0.1.363",
   "description": "Command-line interface for Arcanist: inspect sessions, prepare Zeus environments, and trigger reviews",
   "type": "module",
   "bin": {
@@ -29,7 +29,8 @@
   "homepage": "https://www.tryarcanist.com",
   "license": "MIT",
   "dependencies": {
-    "commander": "^12.1.0"
+    "commander": "^12.1.0",
+    "playwright-core": "^1.61.1"
   },
   "devDependencies": {
     "tsup": "^8.0.0",