@vibe-commit/capture 0.2.2 → 0.3.0

package/dist/commands/auth.js

@@ -36,29 +36,38 @@
  * that discipline theatre. It is refused loudly rather than quietly ignored,
  * because a user who typed it needs to be told it is now in their history.
  *
- * ## What this verb is NOT
+ * ## ⚠ Browser FIRST since `CR-226`; the paste is the fallback, not gone
  *
- * It is not sign-in, and it does not mint. `mintIngestCredential` exists in
- * `vibecommit-mcp` with no route in front of it, so on this side of the wire the
- * plaintext still comes from the web app's `POST /api/ingest-credentials`, shown
- * once, and the human carries it here. Putting a route in front of the minter is
- * the PKCE work `connect.ts` defers; this verb makes the paste path first-class,
- * it does not remove the paste.
+ * This note used to say the verb "is not sign-in, and it does not mint", because
+ * `mintIngestCredential` in `vibecommit-mcp` had no route in front of it and the
+ * only plaintext producer was the web app's `POST /api/ingest-credentials`. The
+ * route now exists (`POST /oauth/ingest-credential`), so on a terminal this verb
+ * signs in through the browser and mints the credential there
+ * (`browser_credential.ts`). The paste below is unchanged and still reached:
  *
- * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — no route mints one, re-verified
- * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the only producer, verified
+ *   - `--stdin`, or no TTY — the CI shape. Never a browser, exactly as before.
+ *   - `--paste` — a human who already holds a credential from the dashboard.
+ *   - any browser step failing — its reason is printed, then the prompt runs.
+ *
+ * ⚠ So there is no path on which `CR-226` makes the pre-existing flow worse:
+ * every failure lands on the prompt that was the whole verb before it.
+ *
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential is the mint route, verified
+ * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the dashboard producer the paste path still serves, verified
  */
 import { AUTH, URLS } from "../copy/index.js";
 import { writeLines } from "./context.js";
 import { EXIT } from "../exit.js";
 import { INGEST_TOKEN_PREFIX, IngestCredential, saveCredential } from "../credential.js";
 import { credentialsPath } from "../paths.js";
-import { renderErrorBlock, tildePath } from "../term.js";
+import { paint, renderErrorBlock, tildePath, wrap } from "../term.js";
 /**
  * `--stdin` forces the pipe even on a terminal — the CI shape, where a job may
  * well have a TTY attached and must not start prompting because of it.
  */
 const STDIN_FLAG = "--stdin";
+/** `CR-226`. Skip the browser and go straight to the prompt. */
+const PASTE_FLAG = "--paste";
 export async function auth(ctx, argv, deps = {}) {
     // ⛔ THE ARGV REFUSAL COMES FIRST, before stdin is read, resumed or opened.
     // Anything else would mean the secret in `argv` had already been accepted by
@@ -75,6 +84,21 @@ export async function auth(ctx, argv, deps = {}) {
         return EXIT.usage;
     }
     const piped = argv.includes(STDIN_FLAG) || !ctx.stdinIsTty;
+    // ── `CR-226`: the browser, first, on a terminal only. ──────────────────────
+    if (!piped && !argv.includes(PASTE_FLAG) && deps.browser !== undefined) {
+        const minted = await deps.browser(ctx, "auth");
+        if (minted.kind === "saved")
+            return saved(ctx);
+        // The reason is already on stderr. The documented fallback is the paste
+        // this verb has always had, with the page that mints one named first.
+        writeLines(ctx.stdout, [
+            "",
+            ...wrap(AUTH.pasteInsteadLabel, 2),
+            // `accent` on a URL — §13.1's one exception, one colour on the line.
+            `  ${paint(ctx.colour, "accent", URLS.settings)}`,
+            "",
+        ]);
+    }
     const raw = piped
         ? await (deps.readStdin ?? (() => Promise.resolve("")))()
         : await (deps.readSecret ?? (() => Promise.resolve("")))(AUTH.prompt);
@@ -107,6 +131,10 @@ export async function auth(ctx, argv, deps = {}) {
         return EXIT.failure;
     }
     saveCredential(ctx.home, new IngestCredential(secret, "file"));
+    return saved(ctx);
+}
+/** The one confirmation, whichever path wrote the file. */
+function saved(ctx) {
     writeLines(ctx.stdout, renderErrorBlock({
         kind: "ok",
         what: AUTH.savedWhat,

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkBzD;;;GAGG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAmB,EACnB,IAAuB,EACvB,OAAiB,EAAE;IAEnB,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;SAC/C,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IAC3D,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExE,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,0CAA0C;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,cAAc;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/D,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KAC1B,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAyBtE;;;GAGG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,gEAAgE;AAChE,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAmB,EACnB,IAAuB,EACvB,OAAiB,EAAE;IAEnB,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;SAC/C,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IAE3D,8EAA8E;IAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAClC,qEAAqE;YACrE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACjD,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExE,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,0CAA0C;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,cAAc;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,2DAA2D;AAC3D,SAAS,KAAK,CAAC,GAAmB;IAChC,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KAC1B,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/commands/browser_credential.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The browser beats — sign in, then buy this machine's ingest credential with
+ * that sign-in. `CR-084d` wrote the first; `CR-226` adds the second.
+ *
+ * ## Why these live together, and outside `connect`
+ *
+ * Sign-in used to be `connect`'s private beat, reachable only behind
+ * `--sign-in`, for a reason its own note gave: *"sign-in cannot mint the
+ * credential the rest of `connect` is about."* `CR-226` put a route in front of
+ * the minter, so that sentence stopped being true — and two verbs now need the
+ * pair. `auth` runs it first and falls back to the paste it has always had;
+ * `connect` runs it when a fresh machine reaches the credential beat with a
+ * human at the terminal. One copy of the sequence, two callers.
+ *
+ * ## ⚠ Browser FIRST, never browser ONLY (FOUNDER_OAUTH_PROPOSAL decision 2)
+ *
+ * Every failure here returns `failed` and leaves the machine exactly as it was:
+ * no half-written file, no deleted session. The caller then offers the paste
+ * path, which is the path that worked before this module existed. There is no
+ * outcome of this function that makes the pre-`CR-226` state worse, and that is
+ * the property that made it safe to wire a mechanism that had never run.
+ *
+ * ## ⚠ And never for a machine that already has a credential
+ *
+ * `VIBECOMMIT_TOKEN` is read before the file (D56) and still is; this module
+ * does not read either. It is the CALLER's job to reach it only when there is
+ * nothing to use — `connect` gates on `absent`, and `auth` is the verb a user
+ * types precisely to replace what is there.
+ */
+import { type IngestCredential } from "../credential.js";
+import { type CommandContext } from "./context.js";
+/**
+ * The network and the browser, injectable. Defaults are the real ones; a test
+ * supplies a `fetch` aimed at a stand-in server and an `openBrowser` that follows
+ * the authorize redirect itself.
+ */
+export interface BrowserDeps {
+    readonly fetch?: typeof fetch;
+    readonly openBrowser?: (url: string) => boolean;
+    /** The machine's name, for the credential's label. */
+    readonly hostname?: () => string;
+}
+/**
+ * Which verb a failed step tells the user to run again.
+ *
+ * ⚠ A NAME, NOT THE COMMAND STRING, and that is for `test/copy-width.test.ts`.
+ * Its fix-line width gate DERIVES every string that can reach a `fixes:` array
+ * by reading the array literals; a `fixes: [retry]` holding a runtime string is
+ * invisible to it, which would quietly drop `COMMANDS.signIn` out of the set it
+ * checks. The conditional in `signInError` names all three copy paths inline,
+ * where the gate can see them.
+ */
+export type Retry = "auth" | "connect" | "sign-in";
+export interface SignInBeatOptions extends BrowserDeps {
+    /** The verb a failed sign-in's fix line tells the user to run again. */
+    readonly retry: Retry;
+    /**
+     * Sign in even though a session file loads. Only for a session the server has
+     * already REFUSED to renew — see `browserCredential` — never to second-guess a
+     * working one.
+     */
+    readonly replace?: boolean;
+}
+/**
+ * The browser sign-in beat — `CR-084d`.
+ *
+ * Opt-in inside `connect` (`--sign-in`) for the read lane, and the first half of
+ * `browserCredential` below. When a session already exists it is a no-op that
+ * says so; it never replaces a working session.
+ */
+export declare function signInBeat(ctx: CommandContext, options: SignInBeatOptions): Promise<number>;
+export type BrowserCredential = 
+/** Minted AND written to `credentials.json`. The caller confirms it on screen. */
+{
+    readonly kind: "saved";
+    readonly credential: IngestCredential;
+}
+/** Nothing was written. The reason is already on stderr; the caller offers the paste. */
+ | {
+    readonly kind: "failed";
+};
+/**
+ * Sign in if needed, mint this machine's credential, save it — `CR-226`.
+ *
+ * Prints its own progress and its own failure; prints NOTHING on success,
+ * because what comes next differs by caller (`auth` ends, `connect` goes on to
+ * capture) and a confirmation here would be a second one.
+ */
+export declare function browserCredential(ctx: CommandContext, retry: Retry, deps?: BrowserDeps): Promise<BrowserCredential>;

package/dist/commands/browser_credential.js

@@ -0,0 +1,181 @@
+/**
+ * The browser beats — sign in, then buy this machine's ingest credential with
+ * that sign-in. `CR-084d` wrote the first; `CR-226` adds the second.
+ *
+ * ## Why these live together, and outside `connect`
+ *
+ * Sign-in used to be `connect`'s private beat, reachable only behind
+ * `--sign-in`, for a reason its own note gave: *"sign-in cannot mint the
+ * credential the rest of `connect` is about."* `CR-226` put a route in front of
+ * the minter, so that sentence stopped being true — and two verbs now need the
+ * pair. `auth` runs it first and falls back to the paste it has always had;
+ * `connect` runs it when a fresh machine reaches the credential beat with a
+ * human at the terminal. One copy of the sequence, two callers.
+ *
+ * ## ⚠ Browser FIRST, never browser ONLY (FOUNDER_OAUTH_PROPOSAL decision 2)
+ *
+ * Every failure here returns `failed` and leaves the machine exactly as it was:
+ * no half-written file, no deleted session. The caller then offers the paste
+ * path, which is the path that worked before this module existed. There is no
+ * outcome of this function that makes the pre-`CR-226` state worse, and that is
+ * the property that made it safe to wire a mechanism that had never run.
+ *
+ * ## ⚠ And never for a machine that already has a credential
+ *
+ * `VIBECOMMIT_TOKEN` is read before the file (D56) and still is; this module
+ * does not read either. It is the CALLER's job to reach it only when there is
+ * nothing to use — `connect` gates on `absent`, and `auth` is the verb a user
+ * types precisely to replace what is there.
+ */
+import { hostname as osHostname } from "node:os";
+import { AUTH, COMMANDS, SIGNIN } from "../copy/index.js";
+import { saveCredential } from "../credential.js";
+import { EXIT } from "../exit.js";
+import { mcpUrl } from "../oauth/discovery.js";
+import { machineLabel } from "../oauth/mint.js";
+import { loadSession } from "../oauth/session.js";
+import { HTTP_TIMEOUT_MS, mintWithSession, openBrowser as platformOpenBrowser, signIn, } from "../oauth/signin.js";
+import { paint, renderErrorBlock, wrap } from "../term.js";
+import { writeLines } from "./context.js";
+/**
+ * The browser sign-in beat — `CR-084d`.
+ *
+ * Opt-in inside `connect` (`--sign-in`) for the read lane, and the first half of
+ * `browserCredential` below. When a session already exists it is a no-op that
+ * says so; it never replaces a working session.
+ */
+export async function signInBeat(ctx, options) {
+    if (options.replace !== true && loadSession(ctx.home).kind === "ok") {
+        writeLines(ctx.stdout, wrap(SIGNIN.alreadySignedIn, 2));
+        return EXIT.ok;
+    }
+    const endpoint = mcpUrl(ctx.env);
+    if (endpoint === null) {
+        writeLines(ctx.stderr, signInError(ctx, options.retry, SIGNIN.noServerWhat, SIGNIN.noServerRefusedWhy));
+        return EXIT.failure;
+    }
+    const outcome = await signIn({
+        home: ctx.home,
+        mcpEndpoint: endpoint,
+        fetch: options.fetch ?? fetch,
+        nowMs: () => ctx.now().getTime(),
+        openBrowser: options.openBrowser ?? platformOpenBrowser,
+        onAuthorizeUrl: (url, opened) => {
+            writeLines(ctx.stdout, [
+                "",
+                ...wrap(opened ? SIGNIN.opening : SIGNIN.manualLabel, 2),
+                // `accent` on a URL is §13.1's one exception, and the line carries no
+                // second colour. Printed on BOTH paths: a user who wants to open it in a
+                // different browser than the default should not have to guess it.
+                `  ${paint(ctx.colour, "accent", url)}`,
+                ...(opened ? wrap(SIGNIN.waiting, 2) : []),
+            ]);
+        },
+        page: { done: SIGNIN.browserDone, refused: SIGNIN.browserRefused },
+    });
+    if (outcome.kind === "ok") {
+        writeLines(ctx.stdout, ["", ...wrap(SIGNIN.done, 2)]);
+        return EXIT.ok;
+    }
+    writeLines(ctx.stderr, ["", ...signInFailure(ctx, options.retry, outcome)]);
+    return EXIT.failure;
+}
+/** §13.6's shape for a sign-in failure. One renderer, six outcomes. */
+function signInFailure(ctx, retry, outcome) {
+    switch (outcome.kind) {
+        case "no-server":
+            return signInError(ctx, retry, SIGNIN.noServerWhat, outcome.detail === "unreachable"
+                ? SIGNIN.noServerUnreachableWhy
+                : SIGNIN.noServerMalformedWhy, SIGNIN.noServerFix);
+        case "denied":
+            return signInError(ctx, retry, SIGNIN.deniedWhat, SIGNIN.deniedWhy, SIGNIN.deniedFix);
+        case "timeout":
+            return signInError(ctx, retry, SIGNIN.timeoutWhat, SIGNIN.timeoutWhy, SIGNIN.timeoutFix);
+        case "rejected":
+            return signInError(ctx, retry, SIGNIN.rejectedWhat, SIGNIN.rejectedWhy, SIGNIN.rejectedFix);
+        case "unreachable":
+            return signInError(ctx, retry, SIGNIN.unreachableWhat, SIGNIN.unreachableWhy, SIGNIN.unreachableFix);
+        case "malformed":
+            return signInError(ctx, retry, SIGNIN.malformedWhat, SIGNIN.malformedWhy, SIGNIN.malformedFix);
+    }
+}
+function signInError(ctx, retry, what, why, fixLabel = SIGNIN.noServerFix) {
+    return renderErrorBlock({
+        kind: "bad",
+        what,
+        why: [why],
+        fixLabel,
+        fixes: [
+            retry === "auth" ? COMMANDS.auth : retry === "connect" ? COMMANDS.connect : COMMANDS.signIn,
+        ],
+    }, ctx.colour);
+}
+/**
+ * Sign in if needed, mint this machine's credential, save it — `CR-226`.
+ *
+ * Prints its own progress and its own failure; prints NOTHING on success,
+ * because what comes next differs by caller (`auth` ends, `connect` goes on to
+ * capture) and a confirmation here would be a second one.
+ */
+export async function browserCredential(ctx, retry, deps = {}) {
+    // Resolved ONCE and handed to both halves, so the session and the credential
+    // cannot come from two different servers.
+    const endpoint = mcpUrl(ctx.env);
+    if (endpoint === null) {
+        writeLines(ctx.stderr, signInError(ctx, retry, SIGNIN.noServerWhat, SIGNIN.noServerRefusedWhy));
+        return { kind: "failed" };
+    }
+    if ((await signInBeat(ctx, { ...deps, retry })) !== EXIT.ok)
+        return { kind: "failed" };
+    const label = machineLabel((deps.hostname ?? osHostname)());
+    writeLines(ctx.stdout, ["", ...wrap(AUTH.minting(label), 2)]);
+    const fetchImpl = deps.fetch ?? fetch;
+    const mint = () => mintWithSession(endpoint, label, {
+        home: ctx.home,
+        fetch: fetchImpl,
+        nowMs: () => ctx.now().getTime(),
+        mint: { fetch: fetchImpl, timeoutMs: HTTP_TIMEOUT_MS },
+    });
+    let outcome = await mint();
+    // ⚠ A SESSION THE SERVER WILL NOT RENEW IS OVER, and a stored file that loads
+    // is not the same as a session that works. `signInBeat` above declines to
+    // replace any session that LOADS — correct for the read lane, and a dead end
+    // here: the user would be told to sign in by a verb that then says "already
+    // signed in". So an `expired` (the refresh grant was refused) gets exactly one
+    // fresh sign-in and one more mint. Nothing else does: a `busy` lock or an
+    // unreachable server is not fixed by a browser.
+    if (outcome.kind === "not-authorized" && outcome.authorized.kind === "expired") {
+        if ((await signInBeat(ctx, { ...deps, retry, replace: true })) !== EXIT.ok) {
+            return { kind: "failed" };
+        }
+        outcome = await mint();
+    }
+    if (outcome.kind === "ok") {
+        // Through the CR-216 writer, so the 0700/0600 double-chmod and the
+        // wrong-class refusal apply exactly as they do to a pasted credential.
+        saveCredential(ctx.home, outcome.credential);
+        return { kind: "saved", credential: outcome.credential };
+    }
+    writeLines(ctx.stderr, ["", ...renderErrorBlock({ kind: "bad", what: AUTH.mintFailedWhat, why: [mintWhy(outcome)] }, ctx.colour)]);
+    return { kind: "failed" };
+}
+/** One `why` per way the mint can fail. No status codes on screen (§13.6). */
+function mintWhy(outcome) {
+    switch (outcome.kind) {
+        case "not-authorized":
+        case "unauthorized":
+        case "wrong-client":
+            return AUTH.mintSessionWhy;
+        case "refused":
+            if (outcome.error === "not_a_member")
+                return AUTH.mintNotMemberWhy;
+            if (outcome.error === "rate_limited")
+                return AUTH.mintRateLimitedWhy;
+            return AUTH.mintRefusedWhy;
+        case "unreachable":
+            return AUTH.mintUnreachableWhy;
+        case "malformed":
+            return AUTH.mintMalformedWhy;
+    }
+}
+//# sourceMappingURL=browser_credential.js.map

package/dist/commands/browser_credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser_credential.js","sourceRoot":"","sources":["../../src/commands/browser_credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,IAAI,mBAAmB,EAClC,MAAM,GAGP,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAqC/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,OAA0B;IAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,mBAAmB;QACvD,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,EAAE;gBACF,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxD,sEAAsE;gBACtE,yEAAyE;gBACzE,kEAAkE;gBAClE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE;KACnE,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,GAAmB,EACnB,KAAY,EACZ,OAAwC;IAExC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAChB,GAAG,EACH,KAAK,EACL,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,MAAM,KAAK,aAAa;gBAC9B,CAAC,CAAC,MAAM,CAAC,sBAAsB;gBAC/B,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAC/B,MAAM,CAAC,WAAW,CACnB,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxF,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3F,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9F,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACvG,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAmB,EACnB,KAAY,EACZ,IAAY,EACZ,GAAW,EACX,WAAmB,MAAM,CAAC,WAAW;IAErC,OAAO,gBAAgB,CACrB;QACE,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,GAAG,EAAE,CAAC,GAAG,CAAC;QACV,QAAQ;QACR,KAAK,EAAE;YACL,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;SAC5F;KACF,EACD,GAAG,CAAC,MAAM,CACX,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB,EACnB,KAAY,EACZ,OAAoB,EAAE;IAEtB,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEvF,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE;KACvD,CAAC,CAAC;IAEL,IAAI,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/E,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,mEAAmE;QACnE,uEAAuE;QACvE,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,UAAU,CACR,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,OAAsC;IACrD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,gBAAgB,CAAC;QACtB,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,SAAS;YACZ,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;YACnE,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/commands/connect.d.ts

@@ -12,17 +12,22 @@
  *   - `CR-025` owns the ending: capture the current session and print the live
  *     `/app/commits/<sha>` URL. The seam is marked below.
  *
- * `CR-084d` lands the browser sign-in beat (PKCE loopback → a user-principal
- * token for the READ lane) behind `--sign-in`. It is opt-in and not part of the
- * default install for one reason: **sign-in does not produce an ingest
- * credential**, so it cannot replace the beat below. No route in
- * `vibecommit-mcp` mints a `vcik_` — `mintIngestCredential` exists and has no
- * call site outside that repo's own tests — so `VIBECOMMIT_TOKEN` remains the
- * supported path for capture, exactly as before.
+ * `CR-084d` landed the browser sign-in beat (PKCE loopback → a user-principal
+ * token for the READ lane) behind `--sign-in`, opt-in because sign-in did not
+ * produce an ingest credential.
  *
- * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — no route mints one, verified
+ * ⚠ `CR-226` CHANGED THAT, AND THIS NOTE USED TO SAY THE OPPOSITE. The server
+ * now has a route in front of `mintIngestCredential`, so a fresh machine that
+ * reaches the credential beat with a human at the terminal signs in through the
+ * browser and mints its own credential there (`browser_credential.ts`) — browser
+ * FIRST, with the old warning pointing at `vibecommit auth` as the fallback when
+ * any step fails. `--sign-in` keeps its meaning (sign in for the read lane even
+ * when a credential exists), and `VIBECOMMIT_TOKEN` still wins over everything.
+ *
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential now mints one, verified
  */
 import { type CommandContext } from "./context.js";
+import { type BrowserCredential, type Retry } from "./browser_credential.js";
 /**
  * What `connect` was asked to do beyond the default.
  *
@@ -33,4 +38,16 @@ export interface ConnectOptions {
     /** `--sign-in`. Off by default — see the module note for why. */
     readonly signIn?: boolean;
 }
-export declare function connect(ctx: CommandContext, options?: ConnectOptions): Promise<number>;
+/**
+ * The browser beat, INJECTED — `CR-226`. `src/index.ts` passes the real
+ * `browserCredential`; left out, the credential beat behaves exactly as it did
+ * before the route existed and never opens a browser. That default is the same
+ * one `auth` takes for its readers, and for the same reason: a suite that
+ * forgot to stub it must not reach a real server or launch a real browser.
+ * `test/cli-wiring.test.ts` asserts the boot path supplies it, so "forgot" is
+ * caught where it matters.
+ */
+export interface ConnectDeps {
+    readonly browser?: (ctx: CommandContext, retry: Retry) => Promise<BrowserCredential>;
+}
+export declare function connect(ctx: CommandContext, options?: ConnectOptions, deps?: ConnectDeps): Promise<number>;

package/dist/commands/connect.js

@@ -12,17 +12,21 @@
  *   - `CR-025` owns the ending: capture the current session and print the live
  *     `/app/commits/<sha>` URL. The seam is marked below.
  *
- * `CR-084d` lands the browser sign-in beat (PKCE loopback → a user-principal
- * token for the READ lane) behind `--sign-in`. It is opt-in and not part of the
- * default install for one reason: **sign-in does not produce an ingest
- * credential**, so it cannot replace the beat below. No route in
- * `vibecommit-mcp` mints a `vcik_` — `mintIngestCredential` exists and has no
- * call site outside that repo's own tests — so `VIBECOMMIT_TOKEN` remains the
- * supported path for capture, exactly as before.
+ * `CR-084d` landed the browser sign-in beat (PKCE loopback → a user-principal
+ * token for the READ lane) behind `--sign-in`, opt-in because sign-in did not
+ * produce an ingest credential.
  *
- * @provenance vibecommit-mcp src/oauth/ingest_credential.ts — no route mints one, verified
+ * ⚠ `CR-226` CHANGED THAT, AND THIS NOTE USED TO SAY THE OPPOSITE. The server
+ * now has a route in front of `mintIngestCredential`, so a fresh machine that
+ * reaches the credential beat with a human at the terminal signs in through the
+ * browser and mints its own credential there (`browser_credential.ts`) — browser
+ * FIRST, with the old warning pointing at `vibecommit auth` as the fallback when
+ * any step fails. `--sign-in` keeps its meaning (sign in for the read lane even
+ * when a credential exists), and `VIBECOMMIT_TOKEN` still wins over everything.
+ *
+ * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential now mints one, verified
  */
-import { CONNECT, COMMANDS, AGENT_HOOKS, COMMIT_HOOK, ERRORS, HELP, PATH_CLASH, RUNTIME, SIGNIN, URLS, } from "../copy/index.js";
+import { AUTH, CONNECT, COMMANDS, AGENT_HOOKS, COMMIT_HOOK, ERRORS, HELP, PATH_CLASH, RUNTIME, URLS, } from "../copy/index.js";
 import { dialectFor } from "../agents/registry.js";
 import { grantProject, isAffirmative, isProjectAllowed } from "../consent.js";
 import { loadCredential } from "../credential.js";
@@ -31,15 +35,14 @@ import { resolveRepoSlug } from "../git.js";
 import { confinementRoots, readSpan, DEFAULT_HOOK_BUDGET_MS } from "../hooks/entry.js";
 import { installAgentHooks } from "../agent_install.js";
 import { classifyInstall, installPostCommitHook } from "../install.js";
-import { mcpUrl } from "../oauth/discovery.js";
-import { loadSession } from "../oauth/session.js";
-import { openBrowser, signIn } from "../oauth/signin.js";
 import { CAPTURE_NOT_APPROVED, deliver, ingestUrl, } from "../post.js";
 import { resolveProjectKeys } from "../project.js";
 import { meetsNodeFloor, NODE_FLOOR_TEXT } from "../runtime.js";
-import { paint, renderErrorBlock, truncatePath, wrap } from "../term.js";
+import { credentialsPath } from "../paths.js";
+import { paint, renderErrorBlock, tildePath, truncatePath, wrap } from "../term.js";
 import { writeLines } from "./context.js";
-export async function connect(ctx, options = {}) {
+import { signInBeat } from "./browser_credential.js";
+export async function connect(ctx, options = {}, deps = {}) {
     // (1) The runtime floor refuses LOUDLY here, unlike in the hook: the user is
     // watching and can act, and D57 §DX11 asks for exactly that asymmetry.
     if (!meetsNodeFloor(ctx.nodeVersion)) {
@@ -72,7 +75,7 @@ export async function connect(ctx, options = {}) {
     }
     if (isProjectAllowed(ctx.home, keys.consent)) {
         writeLines(ctx.stdout, wrap(CONNECT.alreadyConnected, 2));
-        return await afterConsent(ctx, keys, options);
+        return await afterConsent(ctx, keys, options, deps);
     }
     // (3) The disclosure, then the gate.
     writeLines(ctx.stdout, disclosure(ctx));
@@ -97,7 +100,7 @@ export async function connect(ctx, options = {}) {
         return EXIT.ok;
     }
     grantProject(ctx.home, keys.consent, ctx.now());
-    return await afterConsent(ctx, keys, options);
+    return await afterConsent(ctx, keys, options, deps);
 }
 /**
  * Consent is settled. Sign in if asked, then do the credential beat.
@@ -108,81 +111,13 @@ export async function connect(ctx, options = {}) {
  * A failure in one says nothing about the other — which is why a failed sign-in
  * returns here rather than falling through to report the install as fine.
  */
-async function afterConsent(ctx, keys, options) {
+async function afterConsent(ctx, keys, options, deps) {
     if (options.signIn === true) {
-        const code = await signInBeat(ctx);
+        const code = await signInBeat(ctx, { retry: "sign-in" });
         if (code !== EXIT.ok)
             return code;
     }
-    return await credentialBeat(ctx, keys);
-}
-/**
- * The browser sign-in beat — `CR-084d`.
- *
- * Reachable only behind `--sign-in`. That is deliberate and not timidity: an
- * unconditional beat here would open a browser during every `connect`, including
- * the ones run by a wrapper, and sign-in cannot mint the credential the rest of
- * `connect` is about. When a read verb lands (`why` — `CR-086`; `report` —
- * `CR-108`) it calls `readWithSession`, which drives the same session and needs
- * no beat here at all.
- */
-async function signInBeat(ctx) {
-    if (loadSession(ctx.home).kind === "ok") {
-        writeLines(ctx.stdout, wrap(SIGNIN.alreadySignedIn, 2));
-        return EXIT.ok;
-    }
-    const endpoint = mcpUrl(ctx.env);
-    if (endpoint === null) {
-        writeLines(ctx.stderr, signInError(ctx, SIGNIN.noServerWhat, SIGNIN.noServerRefusedWhy));
-        return EXIT.failure;
-    }
-    const outcome = await signIn({
-        home: ctx.home,
-        mcpEndpoint: endpoint,
-        fetch,
-        nowMs: () => ctx.now().getTime(),
-        openBrowser,
-        onAuthorizeUrl: (url, opened) => {
-            writeLines(ctx.stdout, [
-                "",
-                ...wrap(opened ? SIGNIN.opening : SIGNIN.manualLabel, 2),
-                // `accent` on a URL is §13.1's one exception, and the line carries no
-                // second colour. Printed on BOTH paths: a user who wants to open it in a
-                // different browser than the default should not have to guess it.
-                `  ${paint(ctx.colour, "accent", url)}`,
-                ...(opened ? wrap(SIGNIN.waiting, 2) : []),
-            ]);
-        },
-        page: { done: SIGNIN.browserDone, refused: SIGNIN.browserRefused },
-    });
-    if (outcome.kind === "ok") {
-        writeLines(ctx.stdout, ["", ...wrap(SIGNIN.done, 2)]);
-        return EXIT.ok;
-    }
-    writeLines(ctx.stderr, ["", ...signInFailure(ctx, outcome)]);
-    return EXIT.failure;
-}
-/** §13.6's shape for a sign-in failure. One renderer, six outcomes. */
-function signInFailure(ctx, outcome) {
-    switch (outcome.kind) {
-        case "no-server":
-            return signInError(ctx, SIGNIN.noServerWhat, outcome.detail === "unreachable"
-                ? SIGNIN.noServerUnreachableWhy
-                : SIGNIN.noServerMalformedWhy, SIGNIN.noServerFix);
-        case "denied":
-            return signInError(ctx, SIGNIN.deniedWhat, SIGNIN.deniedWhy, SIGNIN.deniedFix);
-        case "timeout":
-            return signInError(ctx, SIGNIN.timeoutWhat, SIGNIN.timeoutWhy, SIGNIN.timeoutFix);
-        case "rejected":
-            return signInError(ctx, SIGNIN.rejectedWhat, SIGNIN.rejectedWhy, SIGNIN.rejectedFix);
-        case "unreachable":
-            return signInError(ctx, SIGNIN.unreachableWhat, SIGNIN.unreachableWhy, SIGNIN.unreachableFix);
-        case "malformed":
-            return signInError(ctx, SIGNIN.malformedWhat, SIGNIN.malformedWhy, SIGNIN.malformedFix);
-    }
-}
-function signInError(ctx, what, why, fixLabel = SIGNIN.noServerFix) {
-    return renderErrorBlock({ kind: "bad", what, why: [why], fixLabel, fixes: [COMMANDS.signIn] }, ctx.colour);
+    return await credentialBeat(ctx, keys, deps);
 }
 /**
  * The disclosure block — `CR-111d`, style guide §10.2 transcribed.
@@ -242,11 +177,33 @@ function disclosure(ctx) {
  * name, and on npm >= 7 the clash surfaces as EEXIST during the first install of
  * exactly the population that installs commit tooling.
  */
-async function credentialBeat(ctx, keys) {
+async function credentialBeat(ctx, keys, deps) {
     const load = loadCredential({ env: ctx.env, home: ctx.home });
     if (load.kind === "ok") {
         return await captureBeat(ctx, keys, load.credential);
     }
+    // ⛔ ONLY FOR `absent`, AND ONLY WITH A HUMAN AT THE TERMINAL (`CR-226`).
+    //   - `absent`: a credential that is present but wrong-class, unreadable or
+    //     insecure is a FAULT, and a fault's fix is `vibecommit auth` (D206 §5,
+    //     `credential-fix-copy.test.ts`). Minting over it would hide the fault.
+    //   - `stdinIsTty`: a wrapper or a CI job runs `connect` too, and a browser
+    //     opened there waits five minutes for nobody. The old warning is the
+    //     right answer for them, and it is what they still get.
+    if (load.kind === "absent" && ctx.stdinIsTty && deps.browser !== undefined) {
+        const minted = await deps.browser(ctx, "connect");
+        if (minted.kind === "saved") {
+            writeLines(ctx.stdout, [
+                "",
+                ...renderErrorBlock({
+                    kind: "ok",
+                    what: AUTH.savedWhat,
+                    why: [AUTH.savedWhy(tildePath(credentialsPath(ctx.home), ctx.home))],
+                }, ctx.colour),
+            ]);
+            return await captureBeat(ctx, keys, minted.credential);
+        }
+        // Failed: the reason is already on stderr. Fall through to the paste path.
+    }
     writeLines(ctx.stderr, renderErrorBlock({
         kind: "warn",
         what: CONNECT.credentialNeededWhat,
@@ -267,8 +224,10 @@ async function credentialBeat(ctx, keys) {
  *     the client may render but may not analyze (D60 §D6). It is not obtainable
  *     from the server either: `send()` returns a status and discards the body,
  *     so no id, sha or count exists on this side of the wire.
- *   - **`Opening your browser to sign in...`.** That beat is the oauth lane's.
- *     Until PKCE lands, `VIBECOMMIT_TOKEN` is the supported path.
+ *   - **`Opening your browser to sign in...`.** That beat runs BEFORE this one
+ *     now (`credentialBeat` → `browser_credential.ts`, `CR-226`), and only when
+ *     there was no credential to start with — by the time this function runs,
+ *     the credential exists however it arrived.
  */
 async function captureBeat(ctx, keys, credential) {
     // ⚠ EVERY USE BELOW BUT ONE IS THE TOPLEVEL ROLE — locating the transcript,