@vincentt-xr/cli 0.12.3 → 0.14.0

package/README.md

@@ -67,7 +67,8 @@ Project
                        [--force] [--no-install]
   link <project-id>  Link this directory to an existing project
   unlink             Detach this directory from its project
-  projects           List the workspace's projects and their ids
+  projects           List the workspace's projects, their ids, and where each
+                       one lives on this machine
                        [--json] [--org <s>]
 
 Dev loop
@@ -119,5 +120,23 @@ In a directory that is not linked to anything, `npx vincentt projects` lists the
 workspace's projects with their ids, which is what `vincentt link <project-id>`
 needs. `--json` prints the same rows for a program to read.
 
+It also reports **where each project lives on this machine**. Any command run in
+a linked folder records that folder against the project, so a project you have
+worked on here is listed with its directory on an indented line under its row:
+
+```
+  66f1c2a9e4b7   museum-ar-tour   Museum AR Tour   museum-ar-tour.vincentt.app
+      ↳ /Users/alice/code/museum-ar-tour
+```
+
+A project this machine has no folder for reads `no folder known on this machine`
+rather than leaving a gap, and a project checked out in several places lists
+every one without picking. The folder is checked when it is read — it is only
+reported if it still holds that project's binding — so a path that has moved or
+been unbound is never handed back. Under `--json` every project carries a
+`locations` array: empty when unknown, one member when located, several when the
+project is in more than one place. Nothing about this leaves the machine, and
+deleting `~/.vincentt/locations.ndjson` costs nothing but the shortcut.
+
 `vincentt` is a project devDependency in the scaffold, so invoke it as
 `npx vincentt <verb>` and it resolves to the local copy — no global install.

package/dist/cli/index.js

@@ -19,6 +19,7 @@ import { httpAuthBackend } from "../login/authBackend.js";
 import { loginCommand } from "../login/loginCommand.js";
 import { ensureLoggedIn } from "../login/ensure.js";
 import { clearMachineToken, loadMachineConfig, locateProjectBinding, resolveConfig, writeDxEnablement, MACHINE_CONFIG_PATH, } from "../shared/config.js";
+import { fileLocationStore } from "../shared/locationStore.js";
 import { getMe, listProjects, ProjectUnreachableError } from "../lib/backend.js";
 import { listProjectsCommand } from "../lib/listProjects.js";
 import { initCommand } from "../lib/initCommand.js";
@@ -41,6 +42,7 @@ import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";
 import * as feedbackCopy from "../lib/feedbackCopy.js";
 import { record as recordInvocation } from "../dx/journal.js";
 import { dxDisableCommand, dxEnableCommand, dxSendCommand, parseDxOptions, runDx, } from "../dx/command.js";
+import { httpConsentBackend, runConsentInBrowser } from "../dx/consent.js";
 import { DX_UNATTENDED_SUNSET, loadEnablement } from "../dx/enablement.js";
 import { journalEnabled, journalPath, readJournal } from "../dx/journal.js";
 import { postReport } from "../dx/send.js";
@@ -395,6 +397,7 @@ async function projects() {
             return resolveOrgForCommand(cfg, { flag: flag("--org") });
         },
         list: listProjects,
+        store: fileLocationStore,
     }, { json: has("--json") });
 }
 /**
@@ -946,6 +949,25 @@ async function version() {
         console.log(line);
 }
 // ---- dx ---------------------------------------------------------------------
+/**
+ * The API host + PAT for a dx call, or undefined when signed out.
+ *
+ * resolveConfig THROWS when there is no PAT, and its message is written for a verb that
+ * cannot proceed at all. Everything dx does is optional, so a signed-out creator gets
+ * one plain line from the command layer instead of a config-file stack trace. Shared by
+ * `enable`, `disable`, and `--send` so all three read the credential identically.
+ */
+async function dxAuth() {
+    try {
+        const cfg = await resolveConfig(projectDir(), {
+            allowCustomApi: has("--allow-custom-api"),
+        });
+        return cfg.pat ? { apiUrl: cfg.apiUrl, pat: cfg.pat } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function dx() {
     const options = parseDxOptions(argv);
     const now = Date.now();
@@ -954,18 +976,30 @@ async function dx() {
     // precisely the case where nobody reads what was disclosed.
     const interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
     if (options.enable || options.disable) {
+        const consent = httpConsentBackend();
         const deps = {
             print: (l) => console.log(l),
             now: () => now,
             interactive,
             confirm: (q) => stdinConfirm()(`  ${q} [y/N] `, false),
-            // `enable` does NOT require being signed in. --send refuses without a PAT
-            // regardless, so a config holding only enablement keys is inert; and
-            // ordering the two verbs ("you must log in before you may state a
-            // preference") would be a rule with no safety behind it.
+            // `enable` NOW REQUIRES being signed in, reversing f7's
+            // D-Enable-does-not-require-being-signed-in. The browser path records consent on
+            // the ACCOUNT, so there has to be an account to record it against and a credential
+            // to reach it with — the precondition is load-bearing now rather than ceremonial.
+            auth: dxAuth,
             save: async (next) => {
                 await writeDxEnablement(next);
             },
+            // The no-TTY consent round trip. Defaults are the real seams; the whole thing is
+            // injected as ONE function so dxEnableCommand needs no socket to test.
+            consentInBrowser: async () => {
+                const { consoleUrl } = await resolveAuthUrls();
+                return runConsentInBrowser({
+                    consoleUrl,
+                    onProgress: (l) => console.log(l),
+                });
+            },
+            revokeAccountConsent: (auth) => consent.revoke(auth.apiUrl, auth.pat),
         };
         process.exitCode = options.enable
             ? await dxEnableCommand(deps, DX_UNATTENDED_SUNSET)
@@ -988,25 +1022,15 @@ async function dx() {
         enabled: () => journalEnabled(),
         path: journalPath,
         cliVersion,
-        auth: async () => {
-            // resolveConfig THROWS when there is no PAT, and its message is written
-            // for a verb that cannot proceed at all. Sending a DX report is
-            // optional, so a signed-out creator gets one plain line from
-            // dxSendCommand instead of a config-file stack trace.
-            try {
-                const cfg = await resolveConfig(projectDir(), {
-                    allowCustomApi: has("--allow-custom-api"),
-                });
-                return cfg.pat ? { apiUrl: cfg.apiUrl, pat: cfg.pat } : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        },
+        auth: dxAuth,
         post: (apiUrl, pat, report) => postReport(apiUrl, pat, report),
         confirm: (q) => stdinConfirm()(`${q} [y/N] `, false),
         interactive,
         enablement: () => enablement,
+        // The third arm: the account-wide grant, read from /me. Consulted only when the
+        // first two have not already allowed the send, and allowed to throw — a /me that
+        // is unreachable falls back to the other two arms rather than blocking.
+        accountConsent: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now),
     }, options);
 }
 // ---- assets (f5) ------------------------------------------------------------

package/dist/cli/usage-text.js

@@ -30,7 +30,10 @@ export const USAGE_TEXT = `Vincentt CLI — local-first AR dev loop\n\n` +
     `                       [--org <s>] [--preview] [--force] [--no-install]\n` +
     `  link <project-id>  Link this folder to an existing project\n` +
     `  unlink             Disconnect this folder from its project\n` +
-    `  projects           List the workspace's projects and their ids  [--json]\n` +
+    `  projects           List the workspace's projects, their ids, and where each\n` +
+    `                       one lives on this machine  [--json]\n` +
+    `                       A project this machine has no folder for says\n` +
+    `                       "no folder known on this machine" rather than leaving a gap.\n` +
     `                       [--org <s>] to list a workspace other than the active one\n\n` +
     `Dev loop\n` +
     `  publish            Upload the built dist; go live at <slug>.vincentt.app\n` +

package/dist/dx/command.d.ts

@@ -1,3 +1,4 @@
+import type { ConsentDecision } from "./consent.js";
 import type { Enablement } from "./enablement.js";
 import type { JournalEntry } from "./journal.js";
 import type { WireReport } from "./send.js";
@@ -46,30 +47,83 @@ export interface DxEnableDeps {
     save: (next: {
         at: string;
     } | undefined) => Promise<void>;
+    /**
+     * Resolved API host + PAT, or undefined when signed out.
+     *
+     * `enable` now REQUIRES this, which REVERSES f7's
+     * D-Enable-does-not-require-being-signed-in. That decision reasoned that ordering the
+     * two verbs would be "a rule with no safety behind it" — true while the grant lived
+     * only in a local file. It no longer does: the browser path records consent against
+     * the ACCOUNT, so there has to be an account to record it against, and the CLI has to
+     * hold a credential to reach it. The precondition is now load-bearing rather than
+     * ceremonial, so the refusal names `vincentt login`.
+     */
+    auth?: () => Promise<{
+        apiUrl: string;
+        pat: string;
+    } | undefined>;
+    /**
+     * Run the console consent round trip: open the browser, wait for the loopback
+     * callback, and return the human's answer. Injected whole so the command layer needs
+     * no socket, no browser, and no clock to test.
+     */
+    consentInBrowser?: () => Promise<ConsentDecision>;
+    /**
+     * DELETE /me/dx-consent. Used only by `disable`, and allowed to throw — the caller
+     * treats a network failure as "local revoke still stands", never as a reason to leave
+     * the capability on.
+     */
+    revokeAccountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<void>;
 }
 /**
- * `vincentt dx enable` — grant this machine durable permission to send DX reports
- * without asking first.
+ * `vincentt dx enable` — grant durable permission to send DX reports without asking
+ * first.
+ *
+ * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
+ *
+ *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
+ *     can read the disclosure where they stand; sending them to a browser would be
+ *     ceremony.
+ *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
+ *     creator driving the CLI through a coding agent has no terminal, so the old code
+ *     refused and the flow dead-ended. It now opens the console, where a human can
+ *     actually give consent.
  *
- * The TTY requirement is a SPEED BUMP, NOT A BOUNDARY, and is written down as
- * such so a later reader does not build on a guarantee that is not there. It
- * stops the reflex — an agent that meets a prompt, infers there must be a way
- * past it, and tries the obvious thing. It does not stop a caller that allocates
- * a PTY or writes config.json directly.
+ * The no-TTY path is no longer a refusal, but that is NOT a relaxation of the gate. The
+ * old TTY check was explicitly a SPEED BUMP, NOT A BOUNDARY (it never stopped a caller
+ * that allocated a PTY or wrote config.json directly); what replaces it is stronger,
+ * because the browser path puts the decision in front of a human on a page the agent
+ * cannot see, click, or forge — the agent can start the flow but cannot finish it.
  *
- * The refusal path writes NOTHING. Not "writes the same bytes back" — nothing at
- * all: this file holds the PAT, and a refusal that round-trips the config through
- * a write can lose the credential if it dies mid-write.
+ * The refusal paths still write NOTHING. Not "write the same bytes back" — nothing at
+ * all: this file holds the PAT, and a refusal that round-trips the config through a
+ * write can lose the credential if it dies mid-write.
  */
 export declare function dxEnableCommand(deps: DxEnableDeps, sunset: number): Promise<number>;
 /**
  * `vincentt dx disable` — the obvious opposite command.
  *
- * Clears BOTH keys. Leaving the timestamp behind would make a later re-enable
- * report its age from the first grant, which is the kind of thing that ships
- * wrong and is never noticed. Needs no terminal and no confirmation: turning a
- * capability OFF is always safe to do, and requiring a TTY here would strand a
- * creator who wanted to revoke from a script.
+ * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
+ * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
+ * clearing only the local flag would leave the account grant standing, so the very next
+ * `--send` would be authorized by arm (c) and the command would appear not to have
+ * worked.
+ *
+ * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
+ * cannot fail and the one that stops THIS machine, which is the machine the creator is
+ * standing at.
+ *
+ * A NETWORK FAILURE MUST NEVER BLOCK A REVOKE. Turning a capability off is always safe,
+ * so the failure path still clears locally, still exits 0, and says plainly that the
+ * account grant may remain and where to clear it. The opposite design — fail the command
+ * so the creator "knows it did not work" — leaves them with the capability still on and
+ * a non-zero exit that suggests nothing happened at all.
+ *
+ * Needs no terminal and no confirmation: requiring a TTY here would strand a creator who
+ * wanted to revoke from a script, and this is the direction that is always safe.
  */
 export declare function dxDisableCommand(deps: DxEnableDeps): Promise<number>;
 export interface DxSendDeps extends DxDeps {
@@ -95,6 +149,16 @@ export interface DxSendDeps extends DxDeps {
     interactive: () => boolean;
     /** Durable unattended-send state, read strictly. Absent reads as not enabled. */
     enablement?: () => Enablement;
+    /**
+     * The ACCOUNT's consent, read from GET /me. The third arm of the gate.
+     *
+     * Allowed to throw, and its throw is not fatal — see the gate below. Absent (the dep
+     * not wired at all) reads as not consented, never as "unknown, so allow".
+     */
+    accountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<Enablement>;
 }
 /**
  * `vincentt dx --send`.

package/dist/dx/command.js

@@ -131,18 +131,28 @@ function sunsetDate(sunset) {
     return new Date(sunset).toISOString().slice(0, 10);
 }
 /**
- * `vincentt dx enable` — grant this machine durable permission to send DX reports
- * without asking first.
+ * `vincentt dx enable` — grant durable permission to send DX reports without asking
+ * first.
  *
- * The TTY requirement is a SPEED BUMP, NOT A BOUNDARY, and is written down as
- * such so a later reader does not build on a guarantee that is not there. It
- * stops the reflex — an agent that meets a prompt, infers there must be a way
- * past it, and tries the obvious thing. It does not stop a caller that allocates
- * a PTY or writes config.json directly.
+ * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
  *
- * The refusal path writes NOTHING. Not "writes the same bytes back" — nothing at
- * all: this file holds the PAT, and a refusal that round-trips the config through
- * a write can lose the credential if it dies mid-write.
+ *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
+ *     can read the disclosure where they stand; sending them to a browser would be
+ *     ceremony.
+ *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
+ *     creator driving the CLI through a coding agent has no terminal, so the old code
+ *     refused and the flow dead-ended. It now opens the console, where a human can
+ *     actually give consent.
+ *
+ * The no-TTY path is no longer a refusal, but that is NOT a relaxation of the gate. The
+ * old TTY check was explicitly a SPEED BUMP, NOT A BOUNDARY (it never stopped a caller
+ * that allocated a PTY or wrote config.json directly); what replaces it is stronger,
+ * because the browser path puts the decision in front of a human on a page the agent
+ * cannot see, click, or forge — the agent can start the flow but cannot finish it.
+ *
+ * The refusal paths still write NOTHING. Not "write the same bytes back" — nothing at
+ * all: this file holds the PAT, and a refusal that round-trips the config through a
+ * write can lose the credential if it dies mid-write.
  */
 export async function dxEnableCommand(deps, sunset) {
     if (deps.now() >= sunset) {
@@ -152,15 +162,26 @@ export async function dxEnableCommand(deps, sunset) {
         deps.print("");
         return 1;
     }
-    if (!deps.interactive()) {
+    // Being signed in is now a PRECONDITION, checked before either path and before any
+    // disclosure is printed. This REVERSES f7's D-Enable-does-not-require-being-signed-in
+    // — see the note on DxEnableDeps.auth for why that reversal is justified rather than
+    // merely convenient: the browser path records consent on the ACCOUNT, so there must be
+    // one, and reaching it needs a credential. Checked FIRST because a creator who is
+    // signed out cannot complete either path, and reading a consent disclosure before
+    // being told so is wasted attention.
+    const auth = await deps.auth?.();
+    if (auth === undefined) {
         deps.print("");
-        deps.print("  Enabling unattended sending needs a terminal to ask in, and this");
-        deps.print("  session has none. Nothing was changed.");
+        deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
+        deps.print("  this machine is not signed in. Nothing was changed.");
         deps.print("");
-        deps.print("  Run `vincentt dx enable` yourself, in your own terminal.");
+        deps.print("  Run `vincentt login` first.");
         deps.print("");
         return 1;
     }
+    if (!deps.interactive()) {
+        return enableViaBrowser(deps);
+    }
     // What is being granted, INCLUDING the note risk. The note is the part a
     // creator does not picture: enablement is what lets an agent compose prose they
     // have not read and put it on the wire.
@@ -187,17 +208,111 @@ export async function dxEnableCommand(deps, sunset) {
     deps.print("");
     return 0;
 }
+/**
+ * The no-TTY arm: hand the decision to a human in a browser.
+ *
+ * The disclosure itself is deliberately NOT printed here. It lives on the console page,
+ * where the person deciding will actually see it; printing it into an agent's transcript
+ * would put the warning everywhere except in front of the human it is written for. What
+ * is printed here is only what a reader of the transcript needs — that a browser is
+ * being opened, and the URL.
+ *
+ * Note the CLI's PAT is NOT passed into this round trip and never rides the console URL.
+ * The console holds its own session and POSTs /me/dx-consent itself, so the browser
+ * carries only a `state` and a decision. The PAT's role was to prove there is an account
+ * at all, which the caller has already checked.
+ */
+async function enableViaBrowser(deps) {
+    if (deps.consentInBrowser === undefined) {
+        // No browser seam wired: refuse rather than silently falling back to a path that
+        // asks nobody. Reachable only from a caller that built deps by hand.
+        deps.print("");
+        deps.print("  Enabling unattended sending needs either a terminal to ask in or a");
+        deps.print("  browser to open, and this session has neither. Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    let decision;
+    try {
+        decision = await deps.consentInBrowser();
+    }
+    catch (err) {
+        // A timeout, a cancelled window, an unreachable console. Nothing is written on any
+        // of them — an enable that could not be confirmed is not an enable.
+        deps.print("");
+        deps.print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+        deps.print("  Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    if (decision !== "granted") {
+        // Denied writes NOTHING and exits 0. Exit 0 because declining is a successful
+        // outcome of the command the caller ran, not a malfunction — an agent that reads a
+        // non-zero exit here would reasonably retry, which is how a refused consent prompt
+        // becomes a loop the human has to keep dismissing.
+        deps.print("");
+        deps.print("  Not enabled.");
+        deps.print("");
+        return 0;
+    }
+    // The grant is already recorded on the account by the console (the page POSTs
+    // /me/dx-consent before it redirects). The local flag is cached alongside it so this
+    // machine can decide without a network round trip — and so a later --send is not
+    // blocked by an API that happens to be unreachable.
+    await deps.save({ at: new Date(deps.now()).toISOString() });
+    deps.print("");
+    deps.print("  Enabled. Reports may now be sent without a prompt.");
+    deps.print("  Turn it off with `vincentt dx disable`, or in the console.");
+    deps.print("");
+    return 0;
+}
 /**
  * `vincentt dx disable` — the obvious opposite command.
  *
- * Clears BOTH keys. Leaving the timestamp behind would make a later re-enable
- * report its age from the first grant, which is the kind of thing that ships
- * wrong and is never noticed. Needs no terminal and no confirmation: turning a
- * capability OFF is always safe to do, and requiring a TTY here would strand a
- * creator who wanted to revoke from a script.
+ * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
+ * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
+ * clearing only the local flag would leave the account grant standing, so the very next
+ * `--send` would be authorized by arm (c) and the command would appear not to have
+ * worked.
+ *
+ * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
+ * cannot fail and the one that stops THIS machine, which is the machine the creator is
+ * standing at.
+ *
+ * A NETWORK FAILURE MUST NEVER BLOCK A REVOKE. Turning a capability off is always safe,
+ * so the failure path still clears locally, still exits 0, and says plainly that the
+ * account grant may remain and where to clear it. The opposite design — fail the command
+ * so the creator "knows it did not work" — leaves them with the capability still on and
+ * a non-zero exit that suggests nothing happened at all.
+ *
+ * Needs no terminal and no confirmation: requiring a TTY here would strand a creator who
+ * wanted to revoke from a script, and this is the direction that is always safe.
  */
 export async function dxDisableCommand(deps) {
     await deps.save(undefined);
+    // Signed out: there is no account grant this machine can reach, and nothing to say
+    // about one. `logout` already cleared the local flag on its way out.
+    const auth = await deps.auth?.();
+    if (auth !== undefined && deps.revokeAccountConsent !== undefined) {
+        try {
+            await deps.revokeAccountConsent(auth);
+        }
+        catch (err) {
+            deps.print("");
+            deps.print("  Unattended sending is off on this machine.");
+            deps.print("");
+            deps.print(`  ! Could not reach Vincentt to clear the account-wide grant:`);
+            deps.print(`    ${err instanceof Error ? err.message : String(err)}`);
+            deps.print("");
+            deps.print("  If you allowed reports in the console, that grant may still be");
+            deps.print("  active for your other machines. Clear it in the console settings.");
+            deps.print("");
+            // Exit 0: the revoke the creator asked for HAPPENED here, and the part that did
+            // not is named with the place to finish it. A non-zero exit would read as "the
+            // command failed", which would be false about the machine they are on.
+            return 0;
+        }
+    }
     deps.print("");
     deps.print("  Unattended sending is off. Reports need your confirmation again.");
     deps.print("");
@@ -245,8 +360,45 @@ export async function dxSendCommand(deps, options) {
     // The second arm is the SUPPORTED unattended path: a person, at a terminal,
     // ran `vincentt dx enable` on this machine. That is a prior deliberate act
     // rather than a per-send answer, which is what makes it consent at all.
-    const enablement = deps.enablement?.() ?? { enabled: false };
+    //
+    // The THIRD arm is the same kind of prior deliberate act, made in the console and
+    // recorded on the ACCOUNT rather than on this machine. It exists because the second
+    // arm cannot be reached at all by the creator this feature is for: driving the CLI
+    // through a coding agent, there is no terminal to run `dx enable` in.
+    const localEnablement = deps.enablement?.() ?? { enabled: false };
     const interactive = deps.interactive();
+    // Auth is resolved BEFORE the gate now, because arm (c) needs a credential to read
+    // /me. The signed-out refusal still comes AFTER the gate, so a caller with neither a
+    // terminal nor consent gets the refusal about consent — the thing they need to fix —
+    // rather than being sent to `login` first and only then told that logging in was not
+    // sufficient.
+    const auth = await deps.auth();
+    // Arm (c) is consulted ONLY when the first two have not already allowed the send.
+    // Skipping it otherwise is not just an optimization: it keeps `--send` from making a
+    // network call it does not need, so a creator at their own terminal is never blocked
+    // by an API being slow or down.
+    let accountEnablement = { enabled: false };
+    if (!interactive && !localEnablement.enabled && auth !== undefined) {
+        try {
+            accountEnablement = (await deps.accountConsent?.(auth)) ?? { enabled: false };
+        }
+        catch {
+            // A NETWORK FAILURE FALLS BACK TO THE OTHER TWO ARMS, and since we only get here
+            // when both have already said no, that means refusing. This is the fail-CLOSED
+            // direction: an unreachable API can never authorize a send.
+            //
+            // The swallow is deliberate and is the whole point of the arm's placement — a
+            // /me that is down must never BLOCK a send that (a) or (b) already allows, and it
+            // cannot, because those paths never reach this call at all.
+            accountEnablement = { enabled: false };
+        }
+    }
+    // The grant that authorizes this send, and the one whose age gets reported. The local
+    // flag wins when both exist: it is the more specific statement (this machine) and it
+    // is the one `dx disable` can always clear.
+    const enablement = localEnablement.enabled
+        ? localEnablement
+        : accountEnablement;
     if (!interactive && !enablement.enabled) {
         // This refusal NAMES the enabling command. A refusal is an answer to a
         // command the caller typed, which makes it SOLICITED output — the
@@ -260,14 +412,13 @@ export async function dxSendCommand(deps, options) {
         deps.print("machine, or run `vincentt dx --send` in your own terminal.");
         return 1;
     }
-    const auth = await deps.auth();
     if (auth === undefined) {
         deps.print("Not signed in. Run `vincentt login` to send a report.");
         return 1;
     }
     const report = buildReport(clusters, deps.cliVersion(), options.note);
     // Above the payload, on the unattended path only: name that this is enabled,
-    // how old the grant is, and that nothing is going to ask.
+    // how old the grant is, WHERE it was granted, and that nothing is going to ask.
     const unattended = !interactive && enablement.enabled;
     if (unattended) {
         const line = enablementLine(enablement, deps.now());

package/dist/dx/consent.d.ts

@@ -0,0 +1,77 @@
+import { type Enablement } from "./enablement.js";
+/**
+ * The account-consent seam.
+ *
+ * `read` returns the parsed Enablement rather than the raw envelope so the strict
+ * `=== true` interpretation happens in exactly one place and cannot be re-derived
+ * loosely by a second caller.
+ */
+export interface ConsentBackend {
+    /** GET /me → the account's dxReportsConsent fields, read strictly. */
+    read(apiUrl: string, pat: string, now: number): Promise<Enablement>;
+    /** POST /me/dx-consent — grant. Idempotent; a re-grant refreshes the timestamp. */
+    grant(apiUrl: string, pat: string, now: number): Promise<Enablement>;
+    /** DELETE /me/dx-consent — revoke. Never fails on already-revoked. */
+    revoke(apiUrl: string, pat: string): Promise<void>;
+}
+/** The real HTTP-backed ConsentBackend, pointed at a Vincentt API base URL. */
+export declare function httpConsentBackend(): ConsentBackend;
+/**
+ * The console URL the browser opens for the consent decision:
+ * `<console>/cli-dx-consent?redirect_uri=<loopback>&state=…`.
+ *
+ * Mirrors buildCliAuthUrl deliberately, including the param NAMES — the console's page
+ * reads exactly `redirect_uri` and `state`, and it validates that redirect_uri is a
+ * 127.0.0.1 loopback. No PKCE material rides here: unlike login, nothing is being
+ * redeemed. The callback carries only a decision, and `state` is what binds that
+ * decision to this CLI invocation.
+ */
+export declare function buildConsentUrl(consoleBase: string, redirectUri: string, state: string): string;
+export type ConsentDecision = "granted" | "denied";
+export type ConsentCallback = {
+    ok: true;
+    decision: ConsentDecision;
+} | {
+    ok: false;
+    reason: "state_mismatch" | "missing_result";
+    message: string;
+};
+/**
+ * Interpret the loopback callback (`?state=…&result=granted|denied`).
+ *
+ * State is verified constant-time FIRST, before `result` is even read, so a stray or
+ * forged callback can never grant consent — the same discipline as parseCallback, and
+ * for a higher-stakes decision: here the forged value would not be a code that still has
+ * to survive a PKCE exchange, it would be the answer itself.
+ *
+ * Anything that is not exactly "granted" reads as DENIED rather than as an error, so an
+ * unrecognized result can only ever fail closed.
+ */
+export declare function parseConsentCallback(params: URLSearchParams, expectedState: string, stateMatches: (expected: string, actual: string | null) => boolean): ConsentCallback;
+/** Thrown when the human never answers in the browser. */
+export declare class ConsentTimeoutError extends Error {
+    constructor();
+}
+export interface ConsentBrowserOptions {
+    /** Console origin that serves /cli-dx-consent. */
+    consoleUrl: string;
+    /** Abort if the browser round trip does not complete in time. Default 5 min. */
+    timeoutMs?: number;
+    pickPort?: () => Promise<number>;
+    openBrowser?: (url: string) => void;
+    /** Mint the anti-CSRF state. Injected only so a test can pin it. */
+    mintState?: () => string;
+    onProgress?: (line: string) => void;
+}
+/**
+ * Open the console's consent page and wait for the human's answer.
+ *
+ * The mechanics are the SHARED loopback helper, not a second copy of it: listener up
+ * before the browser, `state` verified constant-time on every callback, a stray callback
+ * answered but not accepted, and a bounded wait. The only thing that differs from login
+ * is what comes back — a decision instead of an auth code.
+ *
+ * Nothing is written here. This function reports what the human said; persisting it is
+ * the command layer's job, so the "denied writes nothing" rule lives in one place.
+ */
+export declare function runConsentInBrowser(opts: ConsentBrowserOptions): Promise<ConsentDecision>;