@vibe-commit/capture 0.4.5 → 0.6.0

package/README.md

@@ -25,13 +25,33 @@ the approved direction points at `Vibe-Commit/claude-plugin`, which vendors the
 
 | Command | What it does |
 |---|---|
-| `vibecommit connect` | Connect this repo and capture the current session. |
+| `vibecommit connect` | Connect this repo and capture the current session. On a machine with no credential it signs you in through the browser first. |
+| `vibecommit auth` | Replace this machine's credential: sign in through the browser, or `--paste` one you made in Settings. Run it again whenever `status` or a hook says the credential is no longer accepted. Inside a git repo it then goes on to `connect` that repo; outside one it only saves the credential. |
 | `vibecommit status` | Show whether capture is on for this repo and when it last succeeded. |
 | `vibecommit off` | Stop capturing for this repo. |
 | `vibecommit why <file>:<line>` | Show the conversation turns recorded against the commit that last changed this line. |
 | `vibecommit report --since <when>` | Summarise capture coverage over a time window. |
 | `vibecommit finalize --session <id>` \| `--latest` | Close a finished session's last turn so commits made in it can be recorded. |
 
+### Keeping a machine connected
+
+`vibecommit connect` asks the server whether this machine's credential is still accepted **before** it sends
+anything. If it is not, `connect` says so, prints the command that fixes it last, and exits `3`; it does not print
+"Connected". Turns held while the credential was rejected upload once you reconnect. If the server cannot be
+reached, `connect` finishes as it always did and adds one line saying it could not confirm the credential.
+
+The fix is `vibecommit auth` (for the Claude Code plugin, which puts nothing on your `PATH`, the line names
+`node <path> auth`). Running it again on a machine that already has a credential **retires the credential it replaces**,
+so Settings shows one row per machine, but only when both are in the same workspace. If the browser lands you in a
+different workspace, `auth` shows the account and workspace and asks first, defaulting to no; answering no changes
+nothing on this machine. A credential set through `VIBECOMMIT_TOKEN` is never replaced or retired by `auth`.
+
+`vibecommit status` shows when a credential is being rejected (`status --json` carries it as `credential_stopped`,
+which is `null` when nothing is stopped).
+
+After a successful `status`, `connect` or `auth`, on a terminal, a final line tells you when a newer version is on
+npm. It never appears in a hook, under `--json`, or after an error. Set `VIBECOMMIT_NO_UPDATE_CHECK=1` to turn it off.
+
 ### One-shot runs: `vibecommit finalize`
 
 A turn is recorded only once a following prompt opens the next one, so the **last turn of a
@@ -114,6 +134,42 @@ accepts a third `match_kind`,
 witnessing it directly — rendered with its own basis sentence, never folded into the unqualified `exact`
 copy.
 
+0.5.0 makes connecting a machine something you can check and undo. `vibecommit connect` and `vibecommit auth` ask
+the server who a stored credential belongs to before sending anything: a credential the server no longer accepts
+is named as the fault and nothing is sent, and an unreachable server keeps today's behaviour with one muted line.
+Signing in again over a credential on this machine asks a question when the workspace would change — or when the
+new credential cannot be confirmed while the old one could — showing the new workspace beside the one it
+replaces; answering *no* revokes the credential it just created, and says so if it could not. Signing in again
+as the same workspace saves without asking. Saving a replacement also retires the credential it replaces, but
+only for a credential stored in a file, only within the same workspace, and best effort: what was and was not
+retired is printed. `vibecommit status` (and `status --json`, as `credential_stopped`) say when the server no
+longer accepts a machine's credential and capture has stopped sending for it.
+`vibecommit connect --device` (also `auth --device`) signs a machine in without a browser on it. It is chosen
+automatically over SSH, on Linux with no display, or when the browser cannot be opened. It prints a code and
+`https://www.vibecommit.ai/device`; you approve there on any device that has a browser; the machine then shows
+the account and workspace that approved and asks `[y/N]`, and nothing is saved until you answer `y`. Approving
+with a code needs the account setting *Allow approving machines with a code*, which is per account and off by
+default; with it off, the approval page says so and the code simply stays valid for its five minutes. The server
+sets a credential's end date and moves it forward while the machine keeps capturing; a credential idle for 90
+days ends. The hook records the end date in the credential's metadata file (never in `credentials.json`);
+within 14 days of it the hook says so once a day, naming the command that renews it, and `vibecommit status` turns
+to a warning. On a terminal, a successful `connect` also mentions on its last line when a newer version exists.
+It needs a server that has the matching routes (the workspace question and the device sign-in), which the
+production server has.
+
+0.6.0 makes `auth` and `connect` one motion, and changes four contracts you may be scripting around.
+`vibecommit auth` inside a git repository now continues into `connect` after it saves the credential, so it may
+ask `connect`'s consent question; outside a repository, with `--stdin`, or with no terminal, it only saves the
+credential, exactly as before, and a refused replacement (`declined`) still exits 1 without connecting. The chained
+`connect` never opens a second sign-in. `vibecommit connect` in a repository where Claude Code has not run yet now
+installs the git and agent hooks and exits 0 (it used to exit 1 and install neither); its "no Claude Code session"
+warning is on stdout, and a `vibecommit` command on PATH that is not this one still exits 1. An organisation that
+has not approved capture yet now gets its hooks installed too: the "capture is armed" screen was previously
+printed without them. The ending reports hook setup first, then prints "Connected." and, when the server's reply
+names the recorded session, a link to that session's page (`/app/conversations/<id>`), falling back to the
+captures list; the PATH check and the unconfirmed-credential note follow it. Only `connect` reads that part of the
+server's reply; the hooks never read a successful response body.
+
 ## Status
 
 **Implemented**, not a scaffold. All six commands above have real bodies — OAuth sign-in

package/dist/atomic_write.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Write a file so that no reader ever sees half of it — temp file in the SAME
+ * directory, then `rename`.
+ *
+ * `rename(2)` within one filesystem replaces the destination in one step, so a
+ * hook that reads `credentials.json` while `auth` is saving gets the old file or
+ * the new one and never a torn one (`FC5`). The temp file is created `wx` at the
+ * final mode, so the bytes are never readable by group or other even briefly,
+ * and the `chmod` after is the same belt `saveCredential` has always worn
+ * (`writeFileSync`'s `mode` is masked by the umask).
+ *
+ * A failure removes the temp file and rethrows: the destination is untouched.
+ */
+export declare function writeFileAtomic(path: string, data: string, mode: number): void;

package/dist/atomic_write.js

@@ -0,0 +1,33 @@
+/**
+ * Write a file so that no reader ever sees half of it — temp file in the SAME
+ * directory, then `rename`.
+ *
+ * `rename(2)` within one filesystem replaces the destination in one step, so a
+ * hook that reads `credentials.json` while `auth` is saving gets the old file or
+ * the new one and never a torn one (`FC5`). The temp file is created `wx` at the
+ * final mode, so the bytes are never readable by group or other even briefly,
+ * and the `chmod` after is the same belt `saveCredential` has always worn
+ * (`writeFileSync`'s `mode` is masked by the umask).
+ *
+ * A failure removes the temp file and rethrows: the destination is untouched.
+ */
+import { randomBytes } from "node:crypto";
+import { chmodSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+export function writeFileAtomic(path, data, mode) {
+    const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+    try {
+        writeFileSync(tmp, data, { mode, flag: "wx" });
+        chmodSync(tmp, mode);
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* nothing to clean up */
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=atomic_write.js.map

package/dist/atomic_write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic_write.js","sourceRoot":"","sources":["../src/atomic_write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3E,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3E,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/commands/auth.d.ts

@@ -52,11 +52,29 @@
  * ⚠ So there is no path on which `CR-226` makes the pre-existing flow worse:
  * every failure lands on the prompt that was the whole verb before it.
  *
+ * ## ⭐ Inside a git work tree, a save CONTINUES INTO `connect` (0.6.0, `CR-236`)
+ *
+ * `/install` and this verb's own ending used to make a new user run two commands back to back — `auth`,
+ * then `connect` — for what is one intent. So on a TERMINAL, inside any git work tree
+ * (`resolveProjectKeys(cwd) !== null`, the precondition `connect` checks for itself), a SAVED credential
+ * goes straight on into `connect`, which asks its own consent question first, and `auth` returns
+ * `connect`'s exit code. The gate (`shouldConnect`) is checked on BOTH save paths — the browser's `saved`
+ * result and the TTY paste.
+ *
+ * ⛔ Never on `--stdin` or a non-TTY: CI must keep exit 0 and never meet a consent refusal. Never on
+ * `declined`, an empty paste or a wrong-class paste: nothing was saved. Outside a repo the output and
+ * the exit are byte-identical to before — that is the escape hatch for a renewal that should not touch
+ * the repo you are standing in.
+ *
+ * ⛔ **NEVER A SECOND SIGN-IN.** `src/index.ts` hands the chained `connect` NO `browser`, so an `absent`
+ * credential falls to its warning and never to a mint; this verb just saved one, so it is not absent.
+ * `test/auth-connect-chain.test.ts` brace-matches the inner call to keep it so.
+ *
  * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential is the mint route, verified
  * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the dashboard producer the paste path still serves, verified
  */
 import type { CommandContext } from "./context.js";
-import type { BrowserCredential, Retry } from "./browser_credential.js";
+import type { BrowserCredential, BrowserOptions, Retry } from "./browser_credential.js";
 export interface AuthDeps {
     /**
      * Read the secret from a terminal WITHOUT ECHOING IT. Injected for the same
@@ -76,6 +94,12 @@ export interface AuthDeps {
      * so a test that forgot to stub it cannot reach a server or open a browser.
      * `src/index.ts` passes the real one.
      */
-    readonly browser?: (ctx: CommandContext, retry: Retry) => Promise<BrowserCredential>;
+    readonly browser?: (ctx: CommandContext, retry: Retry, options?: BrowserOptions) => Promise<BrowserCredential>;
+    /**
+     * The chain into `connect` — `CR-236`. Injected like `browser`, for the same reason: left out, this verb
+     * behaves exactly as it did before the chain, so a suite that forgot to stub it cannot reach a network.
+     * `src/index.ts` passes one that carries NO `browser` (never a second sign-in).
+     */
+    readonly connect?: (ctx: CommandContext) => Promise<number>;
 }
 export declare function auth(ctx: CommandContext, argv: readonly string[], deps?: AuthDeps): Promise<number>;

package/dist/commands/auth.js

@@ -52,14 +52,34 @@
  * ⚠ So there is no path on which `CR-226` makes the pre-existing flow worse:
  * every failure lands on the prompt that was the whole verb before it.
  *
+ * ## ⭐ Inside a git work tree, a save CONTINUES INTO `connect` (0.6.0, `CR-236`)
+ *
+ * `/install` and this verb's own ending used to make a new user run two commands back to back — `auth`,
+ * then `connect` — for what is one intent. So on a TERMINAL, inside any git work tree
+ * (`resolveProjectKeys(cwd) !== null`, the precondition `connect` checks for itself), a SAVED credential
+ * goes straight on into `connect`, which asks its own consent question first, and `auth` returns
+ * `connect`'s exit code. The gate (`shouldConnect`) is checked on BOTH save paths — the browser's `saved`
+ * result and the TTY paste.
+ *
+ * ⛔ Never on `--stdin` or a non-TTY: CI must keep exit 0 and never meet a consent refusal. Never on
+ * `declined`, an empty paste or a wrong-class paste: nothing was saved. Outside a repo the output and
+ * the exit are byte-identical to before — that is the escape hatch for a renewal that should not touch
+ * the repo you are standing in.
+ *
+ * ⛔ **NEVER A SECOND SIGN-IN.** `src/index.ts` hands the chained `connect` NO `browser`, so an `absent`
+ * credential falls to its warning and never to a mint; this verb just saved one, so it is not absent.
+ * `test/auth-connect-chain.test.ts` brace-matches the inner call to keep it so.
+ *
  * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential is the mint route, verified
  * @provenance vibecommit-web app/api/ingest-credentials/route.ts — the dashboard producer the paste path still serves, verified
  */
-import { AUTH, HELP, URLS } from "../copy/index.js";
+import { AUTH, COMMANDS, DEVICE, HELP, URLS } from "../copy/index.js";
+import { authCommandFor } from "../install.js";
 import { writeLines } from "./context.js";
 import { EXIT } from "../exit.js";
 import { INGEST_TOKEN_PREFIX, IngestCredential, saveCredential } from "../credential.js";
 import { credentialsPath } from "../paths.js";
+import { resolveProjectKeys } from "../project.js";
 import { paint, renderErrorBlock, tildePath, wrap } from "../term.js";
 /**
  * `--stdin` forces the pipe even on a terminal — the CI shape, where a job may
@@ -68,6 +88,8 @@ import { paint, renderErrorBlock, tildePath, wrap } from "../term.js";
 const STDIN_FLAG = "--stdin";
 /** `CR-226`. Skip the browser and go straight to the prompt. */
 const PASTE_FLAG = "--paste";
+/** `CR-234d`. Sign in by CODE, approved on another device — TTY only. */
+const DEVICE_FLAG = "--device";
 export async function auth(ctx, argv, deps = {}) {
     // ⛔ THE ARGV REFUSAL COMES FIRST, before stdin is read, resumed or opened.
     // Anything else would mean the secret in `argv` had already been accepted by
@@ -92,11 +114,33 @@ export async function auth(ctx, argv, deps = {}) {
         return EXIT.ok;
     }
     const piped = argv.includes(STDIN_FLAG) || !ctx.stdinIsTty;
+    // `CR-234d`: `--device` is TTY only (the approval is a person's) and is the opposite of `--paste`.
+    if (argv.includes(DEVICE_FLAG) && (piped || argv.includes(PASTE_FLAG))) {
+        writeLines(ctx.stderr, renderErrorBlock(piped
+            ? {
+                kind: "bad",
+                what: DEVICE.needsTerminalWhat,
+                why: [DEVICE.needsTerminalWhy],
+                fixLabel: DEVICE.needsTerminalFix,
+                fixes: [DEVICE.needsTerminalCommand(authCommandFor(ctx.env, ctx.selfPath))],
+            }
+            : {
+                kind: "bad",
+                what: DEVICE.conflictWhat,
+                why: [DEVICE.conflictWhy],
+                fixLabel: DEVICE.conflictFix,
+                fixes: [COMMANDS.auth, `${COMMANDS.auth} ${PASTE_FLAG}`],
+            }, ctx.colour));
+        return EXIT.usage;
+    }
     // ── `CR-226`: the browser, first, on a terminal only. ──────────────────────
     if (!piped && !argv.includes(PASTE_FLAG) && deps.browser !== undefined) {
-        const minted = await deps.browser(ctx, "auth");
+        const minted = await deps.browser(ctx, "auth", { device: argv.includes(DEVICE_FLAG) });
         if (minted.kind === "saved")
-            return saved(ctx);
+            return await saved(ctx, deps, piped, minted.notes);
+        // The user said NO at the replace confirmation: not a failure of the browser, so no paste prompt.
+        if (minted.kind === "declined")
+            return EXIT.failure;
         // The reason is already on stderr. The documented fallback is the paste
         // this verb has always had, with the page that mints one named first.
         writeLines(ctx.stdout, [
@@ -139,17 +183,28 @@ export async function auth(ctx, argv, deps = {}) {
         return EXIT.failure;
     }
     saveCredential(ctx.home, new IngestCredential(secret, "file"));
-    return saved(ctx);
+    return await saved(ctx, deps, piped);
 }
-/** The one confirmation, whichever path wrote the file. */
-function saved(ctx) {
-    writeLines(ctx.stdout, renderErrorBlock({
-        kind: "ok",
-        what: AUTH.savedWhat,
-        why: [AUTH.savedWhy(tildePath(credentialsPath(ctx.home), ctx.home))],
-        fixLabel: AUTH.nextLabel,
-        fixes: [AUTH.nextCommand],
-    }, ctx.colour));
+/**
+ * The one confirmation, whichever path wrote the file — and the chain's single gate.
+ *
+ * `shouldConnect` is read here, AFTER a save and nowhere else, so `declined`, empty and wrong-class input
+ * (which return before this) can never chain. When it holds, the "Next, connect a repository" fix line is
+ * dropped — `connect`'s own output follows — and `connect`'s exit code is returned. When it does not, the
+ * block and the exit are exactly what they were.
+ */
+async function saved(ctx, deps, piped, notes = []) {
+    const shouldConnect = !piped && deps.connect !== undefined && resolveProjectKeys(ctx.cwd) !== null;
+    writeLines(ctx.stdout, [
+        ...renderErrorBlock({
+            kind: "ok",
+            what: AUTH.savedWhat,
+            why: [AUTH.savedWhy(tildePath(credentialsPath(ctx.home), ctx.home)), ...notes],
+            ...(shouldConnect ? {} : { fixLabel: AUTH.nextLabel, fixes: [AUTH.nextCommand] }),
+        }, ctx.colour),
+    ]);
+    if (shouldConnect && deps.connect !== undefined)
+        return await deps.connect(ctx);
     return EXIT.ok;
 }
 //# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAyBtE;;;GAGG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,gEAAgE;AAChE,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAmB,EACnB,IAAuB,EACvB,OAAiB,EAAE;IAEnB,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;SAC/C,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IAE3D,8EAA8E;IAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAClC,qEAAqE;YACrE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACjD,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExE,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,0CAA0C;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,cAAc;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,2DAA2D;AAC3D,SAAS,KAAK,CAAC,GAAmB;IAChC,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;KAC1B,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;IACF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AA+BtE;;;GAGG;AACH,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,gEAAgE;AAChE,MAAM,UAAU,GAAG,SAAS,CAAC;AAE7B,yEAAyE;AACzE,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,GAAmB,EACnB,IAAuB,EACvB,OAAiB,EAAE;IAEnB,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC;SAC/C,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,kGAAkG;IAClG,oGAAoG;IACpG,qGAAqG;IACrG,kGAAkG;IAClG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;IAE3D,mGAAmG;IACnG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd,KAAK;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,MAAM,CAAC,iBAAiB;gBAC9B,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,gBAAgB;gBACjC,KAAK,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;aAC5E;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,MAAM,CAAC,YAAY;gBACzB,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;gBACzB,QAAQ,EAAE,MAAM,CAAC,WAAW;gBAC5B,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;aACzD,EACL,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChF,kGAAkG;QAClG,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACpD,wEAAwE;QACxE,sEAAsE;QACtE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,EAAE;YACF,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAClC,qEAAqE;YACrE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YACjD,EAAE;SACH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAG,KAAK;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAExE,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAE1B,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yEAAyE;IACzE,+EAA+E;IAC/E,+EAA+E;IAC/E,0CAA0C;IAC1C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC5C,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CACd;YACE,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,IAAI,CAAC,cAAc;YACzB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SACvB,EACD,GAAG,CAAC,MAAM,CACX,CACF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,KAAK,CAClB,GAAmB,EACnB,IAAc,EACd,KAAc,EACd,QAA2B,EAAE;IAE7B,MAAM,aAAa,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;IACnG,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;QACrB,GAAG,gBAAgB,CACjB;YACE,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC;YAC9E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;SAClF,EACD,GAAG,CAAC,MAAM,CACX;KACF,CAAC,CAAC;IACH,IAAI,aAAa,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/commands/browser_credential.d.ts

@@ -27,8 +27,9 @@
  * nothing to use — `connect` gates on `absent`, and `auth` is the verb a user
  * types precisely to replace what is there.
  */
-import { type IngestCredential } from "../credential.js";
 import { type CommandContext } from "./context.js";
+import { type BrowserCredential } from "./finish_mint.js";
+export { finishMint, type BrowserCredential, type FinishMintInput, type Prior } from "./finish_mint.js";
 /**
  * The network and the browser, injectable. Defaults are the real ones; a test
  * supplies a `fetch` aimed at a stand-in server and an `openBrowser` that follows
@@ -39,6 +40,27 @@ export interface BrowserDeps {
     readonly openBrowser?: (url: string) => boolean;
     /** The machine's name, for the credential's label. */
     readonly hostname?: () => string;
+    /** How long the browser round trip may take. Tests only: the real default is `SIGNIN_DEADLINE_MS`. */
+    readonly deadlineMs?: number;
+    /** `process.platform`, for the headless check. Tests only. */
+    readonly platform?: NodeJS.Platform;
+    /** The device flow's wait between polls. Tests only: the real one is a timer. */
+    readonly sleep?: (ms: number) => Promise<void>;
+    /** The device flow's Ctrl+C. Tests only: the real one listens for SIGINT. */
+    readonly interrupt?: () => {
+        readonly promise: Promise<void>;
+        readonly dispose: () => void;
+    };
+}
+/**
+ * What the caller asked of the browser beat beyond the default (`CR-234d`).
+ *
+ * `device: true` is `--device`: sign in by CODE even where a browser would open. Absent, the beat still
+ * chooses the device flow by itself on an SSH session or a Linux box with no display (`headlessReason`),
+ * and falls back to it when the browser cannot be opened.
+ */
+export interface BrowserOptions {
+    readonly device?: boolean;
 }
 /**
  * Which verb a failed step tells the user to run again.
@@ -60,7 +82,22 @@ export interface SignInBeatOptions extends BrowserDeps {
      * working one.
      */
     readonly replace?: boolean;
+    /**
+     * `G8a`. A session file that LOADS is not a session that WORKS: before saying "already signed in",
+     * ask the server to renew it. Only a refused refresh (`expired`) falls through to a fresh sign-in;
+     * a busy lock, an unreachable server or a malformed answer proves nothing, and says "already".
+     */
+    readonly verify?: boolean;
+    /** Ask the authorize page to bind this org (re-auth, plan item 2(a), brief A1). */
+    readonly orgId?: string;
+    /**
+     * `CR-234d`. If the browser cannot be opened, return `NO_BROWSER` instead of printing the URL and waiting
+     * for a callback nobody can make. Only `browserCredential` sets this, and only it handles the result.
+     */
+    readonly fallbackToDevice?: boolean;
 }
+/** `signInBeat`'s sentinel for "no browser, go to the device flow". Never an exit code a verb returns. */
+export declare const NO_BROWSER = -1;
 /**
  * The browser sign-in beat — `CR-084d`.
  *
@@ -69,16 +106,6 @@ export interface SignInBeatOptions extends BrowserDeps {
  * says so; it never replaces a working session.
  */
 export declare function signInBeat(ctx: CommandContext, options: SignInBeatOptions): Promise<number>;
-export type BrowserCredential = 
-/** Minted AND written to `credentials.json`. The caller confirms it on screen. */
-{
-    readonly kind: "saved";
-    readonly credential: IngestCredential;
-}
-/** Nothing was written. The reason is already on stderr; the caller offers the paste. */
- | {
-    readonly kind: "failed";
-};
 /**
  * Sign in if needed, mint this machine's credential, save it — `CR-226`.
  *
@@ -86,4 +113,4 @@ export type BrowserCredential =
  * because what comes next differs by caller (`auth` ends, `connect` goes on to
  * capture) and a confirmation here would be a second one.
  */
-export declare function browserCredential(ctx: CommandContext, retry: Retry, deps?: BrowserDeps): Promise<BrowserCredential>;
+export declare function browserCredential(ctx: CommandContext, retry: Retry, deps?: BrowserDeps, options?: BrowserOptions): Promise<BrowserCredential>;

package/dist/commands/browser_credential.js

@@ -28,15 +28,25 @@
  * types precisely to replace what is there.
  */
 import { hostname as osHostname } from "node:os";
+import { headlessReason } from "../device_mode.js";
+import { resolveOnPath } from "../install.js";
 import { AUTH, COMMANDS, SIGNIN } from "../copy/index.js";
-import { saveCredential } from "../credential.js";
+import { loadCredential } from "../credential.js";
 import { EXIT } from "../exit.js";
 import { mcpUrl } from "../oauth/discovery.js";
 import { machineLabel } from "../oauth/mint.js";
 import { loadSession } from "../oauth/session.js";
-import { HTTP_TIMEOUT_MS, mintWithSession, openBrowser as platformOpenBrowser, signIn, } from "../oauth/signin.js";
+import { authorizedAccessToken, HTTP_TIMEOUT_MS, mintWithSession, openBrowser as platformOpenBrowser, signIn, } from "../oauth/signin.js";
 import { paint, renderErrorBlock, wrap } from "../term.js";
 import { writeLines } from "./context.js";
+import { deviceCredential } from "./device_credential.js";
+import { finishMint } from "./finish_mint.js";
+import { probeCredential } from "./probe.js";
+// `finishMint` and its types moved to `finish_mint.ts` (`CR-234d`) so the device flow can share them without
+// a cycle. Re-exported here because this is where every caller and test has always found them.
+export { finishMint } from "./finish_mint.js";
+/** `signInBeat`'s sentinel for "no browser, go to the device flow". Never an exit code a verb returns. */
+export const NO_BROWSER = -1;
 /**
  * The browser sign-in beat — `CR-084d`.
  *
@@ -46,8 +56,18 @@ import { writeLines } from "./context.js";
  */
 export async function signInBeat(ctx, options) {
     if (options.replace !== true && loadSession(ctx.home).kind === "ok") {
-        writeLines(ctx.stdout, wrap(SIGNIN.alreadySignedIn, 2));
-        return EXIT.ok;
+        const live = options.verify === true
+            ? await authorizedAccessToken({
+                home: ctx.home,
+                fetch: options.fetch ?? fetch,
+                nowMs: () => ctx.now().getTime(),
+            })
+            : null;
+        if (live === null || live.kind !== "expired") {
+            writeLines(ctx.stdout, wrap(SIGNIN.alreadySignedIn, 2));
+            return EXIT.ok;
+        }
+        // The refresh grant was refused: the session is over. Sign in again below.
     }
     const endpoint = mcpUrl(ctx.env);
     if (endpoint === null) {
@@ -60,6 +80,9 @@ export async function signInBeat(ctx, options) {
         fetch: options.fetch ?? fetch,
         nowMs: () => ctx.now().getTime(),
         openBrowser: options.openBrowser ?? platformOpenBrowser,
+        ...(options.orgId === undefined ? {} : { orgId: options.orgId }),
+        ...(options.deadlineMs === undefined ? {} : { deadlineMs: options.deadlineMs }),
+        ...(options.fallbackToDevice === true ? { fallbackOnNoBrowser: true } : {}),
         onAuthorizeUrl: (url, opened) => {
             writeLines(ctx.stdout, [
                 "",
@@ -77,6 +100,8 @@ export async function signInBeat(ctx, options) {
         writeLines(ctx.stdout, ["", ...wrap(SIGNIN.done, 2)]);
         return EXIT.ok;
     }
+    if (outcome.kind === "no-browser")
+        return NO_BROWSER;
     writeLines(ctx.stderr, ["", ...signInFailure(ctx, options.retry, outcome)]);
     return EXIT.failure;
 }
@@ -117,7 +142,7 @@ function signInError(ctx, retry, what, why, fixLabel = SIGNIN.noServerFix) {
  * because what comes next differs by caller (`auth` ends, `connect` goes on to
  * capture) and a confirmation here would be a second one.
  */
-export async function browserCredential(ctx, retry, deps = {}) {
+export async function browserCredential(ctx, retry, deps = {}, options = {}) {
     // Resolved ONCE and handed to both halves, so the session and the credential
     // cannot come from two different servers.
     const endpoint = mcpUrl(ctx.env);
@@ -125,11 +150,45 @@ export async function browserCredential(ctx, retry, deps = {}) {
         writeLines(ctx.stderr, signInError(ctx, retry, SIGNIN.noServerWhat, SIGNIN.noServerRefusedWhy));
         return { kind: "failed" };
     }
-    if ((await signInBeat(ctx, { ...deps, retry })) !== EXIT.ok)
+    const fetchImpl = deps.fetch ?? fetch;
+    // ⛔ THE CREDENTIAL THIS RE-AUTH REPLACES, and only from the FILE (plan item 2). `VIBECOMMIT_TOKEN`
+    // wins `loadCredential`, so an exported variable makes `source` "env" and `prior` null: an
+    // environment credential is the CI path (D56) and is never probed, bound or retired from here.
+    const loaded = loadCredential({ env: ctx.env, home: ctx.home });
+    const prior = loaded.kind === "ok" && loaded.credential.source === "file"
+        ? {
+            credential: loaded.credential,
+            // Not recorded: it is about to be replaced, and its facts must not outlive it.
+            who: await probeCredential(ctx, loaded.credential, fetchImpl, { record: false }),
+        }
+        : null;
+    // ⛔ DEVICE MODE (`CR-234d`, plan item 7). By request (`--device`), or because this machine has no browser
+    // of its own: an SSH session, or a Linux box with no display. The loopback sign-in would open a browser
+    // nobody can see and wait out its deadline, so the machine asks for a code instead. The prefilled link is
+    // opened only where a browser plausibly exists — `--device` on a desktop — never on a headless box.
+    const headless = headlessReason(ctx.env, deps.platform ?? process.platform);
+    if (options.device === true || headless !== null) {
+        return await deviceCredential(ctx, { endpoint, prior, openLink: headless === null }, deps);
+    }
+    const signedIn = await signInBeat(ctx, {
+        ...deps,
+        retry,
+        // 2(a): ask the authorize page to bind the org the old credential belongs to. Only on a 200 —
+        // an org the server would not vouch for is not worth asking for.
+        ...(prior?.who.kind === "ok" ? { orgId: prior.who.orgId } : {}),
+        // A browser that cannot be opened is a headless machine the check above did not recognise: go to
+        // the device flow rather than print a URL and wait for a callback nobody can make.
+        fallbackToDevice: true,
+        openBrowser: deps.openBrowser ?? ((url) => canOpenBrowser(ctx.env, deps.platform ?? process.platform) && platformOpenBrowser(url)),
+    });
+    if (signedIn === NO_BROWSER) {
+        return await deviceCredential(ctx, { endpoint, prior, openLink: false }, deps);
+    }
+    if (signedIn !== EXIT.ok) {
         return { kind: "failed" };
+    }
     const label = machineLabel((deps.hostname ?? osHostname)());
     writeLines(ctx.stdout, ["", ...wrap(AUTH.minting(label), 2)]);
-    const fetchImpl = deps.fetch ?? fetch;
     const mint = () => mintWithSession(endpoint, label, {
         home: ctx.home,
         fetch: fetchImpl,
@@ -151,14 +210,28 @@ export async function browserCredential(ctx, retry, deps = {}) {
         outcome = await mint();
     }
     if (outcome.kind === "ok") {
-        // Through the CR-216 writer, so the 0700/0600 double-chmod and the
-        // wrong-class refusal apply exactly as they do to a pasted credential.
-        saveCredential(ctx.home, outcome.credential);
-        return { kind: "saved", credential: outcome.credential };
+        return await finishMint(ctx, {
+            minted: outcome.credential,
+            facts: outcome.facts,
+            prior,
+            endpoint,
+            fetch: fetchImpl,
+            // The block guards a re-auth that lands in a DIFFERENT workspace. The device flow passes
+            // "always" — there the approver is not the person at this terminal.
+            confirm: "on-replace",
+        });
     }
     writeLines(ctx.stderr, ["", ...renderErrorBlock({ kind: "bad", what: AUTH.mintFailedWhat, why: [mintWhy(outcome)] }, ctx.colour)]);
     return { kind: "failed" };
 }
+/**
+ * Is there anything on this machine that could open a URL? `openBrowser` reports `true` once `spawn` returns,
+ * and a missing `xdg-open` only surfaces later as an asynchronous error — so on Linux the answer is checked
+ * up front. macOS and Windows ship `open` and `start`.
+ */
+function canOpenBrowser(env, platform) {
+    return platform !== "linux" || resolveOnPath(env, "xdg-open") !== null;
+}
 /** One `why` per way the mint can fail. No status codes on screen (§13.6). */
 function mintWhy(outcome) {
     switch (outcome.kind) {

package/dist/commands/browser_credential.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser_credential.js","sourceRoot":"","sources":["../../src/commands/browser_credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAyB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,eAAe,EACf,WAAW,IAAI,mBAAmB,EAClC,MAAM,GAGP,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAqC/D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,OAA0B;IAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,mBAAmB;QACvD,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,EAAE;gBACF,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxD,sEAAsE;gBACtE,yEAAyE;gBACzE,kEAAkE;gBAClE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE;KACnE,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,GAAmB,EACnB,KAAY,EACZ,OAAwC;IAExC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAChB,GAAG,EACH,KAAK,EACL,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,MAAM,KAAK,aAAa;gBAC9B,CAAC,CAAC,MAAM,CAAC,sBAAsB;gBAC/B,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAC/B,MAAM,CAAC,WAAW,CACnB,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxF,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3F,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9F,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACvG,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAmB,EACnB,KAAY,EACZ,IAAY,EACZ,GAAW,EACX,WAAmB,MAAM,CAAC,WAAW;IAErC,OAAO,gBAAgB,CACrB;QACE,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,GAAG,EAAE,CAAC,GAAG,CAAC;QACV,QAAQ;QACR,KAAK,EAAE;YACL,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;SAC5F;KACF,EACD,GAAG,CAAC,MAAM,CACX,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB,EACnB,KAAY,EACZ,OAAoB,EAAE;IAEtB,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEvF,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE;KACvD,CAAC,CAAC;IAEL,IAAI,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/E,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,mEAAmE;QACnE,uEAAuE;QACvE,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;IAC3D,CAAC;IAED,UAAU,CACR,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,OAAsC;IACrD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,gBAAgB,CAAC;QACtB,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,SAAS;YACZ,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;YACnE,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACjC,CAAC;AACH,CAAC"}
+{"version":3,"file":"browser_credential.js","sourceRoot":"","sources":["../../src/commands/browser_credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,WAAW,IAAI,mBAAmB,EAClC,MAAM,GAGP,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAA0B,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,6GAA6G;AAC7G,+FAA+F;AAC/F,OAAO,EAAE,UAAU,EAA4D,MAAM,kBAAkB,CAAC;AAqExG,0GAA0G;AAC1G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,OAA0B;IAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,GACR,OAAO,CAAC,MAAM,KAAK,IAAI;YACrB,CAAC,CAAC,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;gBAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7C,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QACD,2EAA2E;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACxG,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,QAAQ;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,mBAAmB;QACvD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;gBACrB,EAAE;gBACF,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxD,sEAAsE;gBACtE,yEAAyE;gBACzE,kEAAkE;gBAClE,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE;gBACvC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE;KACnE,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IACrD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,GAAmB,EACnB,KAAY,EACZ,OAAiE;IAEjE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAChB,GAAG,EACH,KAAK,EACL,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,MAAM,KAAK,aAAa;gBAC9B,CAAC,CAAC,MAAM,CAAC,sBAAsB;gBAC/B,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAC/B,MAAM,CAAC,WAAW,CACnB,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACxF,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3F,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9F,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACvG,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAmB,EACnB,KAAY,EACZ,IAAY,EACZ,GAAW,EACX,WAAmB,MAAM,CAAC,WAAW;IAErC,OAAO,gBAAgB,CACrB;QACE,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,GAAG,EAAE,CAAC,GAAG,CAAC;QACV,QAAQ;QACR,KAAK,EAAE;YACL,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;SAC5F;KACF,EACD,GAAG,CAAC,MAAM,CACX,CAAC;AACJ,CAAC;AACD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB,EACnB,KAAY,EACZ,OAAoB,EAAE,EACtB,UAA0B,EAAE;IAE5B,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,mGAAmG;IACnG,2FAA2F;IAC3F,+FAA+F;IAC/F,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GACT,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM;QACzD,CAAC,CAAC;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,+EAA+E;YAC/E,GAAG,EAAE,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACjF;QACH,CAAC,CAAC,IAAI,CAAC;IAEX,0GAA0G;IAC1G,wGAAwG;IACxG,0GAA0G;IAC1G,oGAAoG;IACpG,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE;QACrC,GAAG,IAAI;QACP,KAAK;QACL,8FAA8F;QAC9F,iEAAiE;QACjE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,iGAAiG;QACjG,mFAAmF;QACnF,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;KACnI,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9D,MAAM,IAAI,GAAG,GAAkB,EAAE,CAC/B,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE;KACvD,CAAC,CAAC;IAEL,IAAI,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/E,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,UAAU,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,OAAO,CAAC,UAAU;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;YACL,QAAQ;YACR,KAAK,EAAE,SAAS;YAChB,yFAAyF;YACzF,oEAAoE;YACpE,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CACR,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAsB,EAAE,QAAyB;IACvE,OAAO,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO,CAAC,OAAsC;IACrD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,gBAAgB,CAAC;QACtB,KAAK,cAAc,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,SAAS;YACZ,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;YACnE,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACjC,KAAK,WAAW;YACd,OAAO,IAAI,CAAC,gBAAgB,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/commands/connect.d.ts

@@ -27,7 +27,7 @@
  * @provenance vibecommit-mcp src/transport/server.ts — POST /oauth/ingest-credential now mints one, verified
  */
 import { type CommandContext } from "./context.js";
-import { type BrowserCredential, type Retry } from "./browser_credential.js";
+import { type BrowserCredential, type BrowserOptions, type Retry } from "./browser_credential.js";
 /**
  * What `connect` was asked to do beyond the default.
  *
@@ -37,6 +37,8 @@ import { type BrowserCredential, type Retry } from "./browser_credential.js";
 export interface ConnectOptions {
     /** `--sign-in`. Off by default — see the module note for why. */
     readonly signIn?: boolean;
+    /** `CR-234d`: `--device`. Obtain a missing credential by CODE, approved on another device. TTY only. */
+    readonly device?: boolean;
     /** `TODOS[184]`: `--help`/`-h`. `connect` has no `argv` param, so this is computed at the call site. */
     readonly help?: boolean;
 }
@@ -50,6 +52,8 @@ export interface ConnectOptions {
  * caught where it matters.
  */
 export interface ConnectDeps {
-    readonly browser?: (ctx: CommandContext, retry: Retry) => Promise<BrowserCredential>;
+    readonly browser?: (ctx: CommandContext, retry: Retry, options?: BrowserOptions) => Promise<BrowserCredential>;
+    /** The network for the credential probe. Left out, the real `fetch` — the stand-in server is a URL. */
+    readonly fetch?: typeof fetch;
 }
 export declare function connect(ctx: CommandContext, options?: ConnectOptions, deps?: ConnectDeps): Promise<number>;