@vincentt-xr/cli 0.13.0 → 0.14.1

package/dist/cli/index.js

@@ -42,6 +42,7 @@ import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";
 import * as feedbackCopy from "../lib/feedbackCopy.js";
 import { record as recordInvocation } from "../dx/journal.js";
 import { dxDisableCommand, dxEnableCommand, dxSendCommand, parseDxOptions, runDx, } from "../dx/command.js";
+import { httpConsentBackend, runConsentInBrowser } from "../dx/consent.js";
 import { DX_UNATTENDED_SUNSET, loadEnablement } from "../dx/enablement.js";
 import { journalEnabled, journalPath, readJournal } from "../dx/journal.js";
 import { postReport } from "../dx/send.js";
@@ -948,6 +949,25 @@ async function version() {
         console.log(line);
 }
 // ---- dx ---------------------------------------------------------------------
+/**
+ * The API host + PAT for a dx call, or undefined when signed out.
+ *
+ * resolveConfig THROWS when there is no PAT, and its message is written for a verb that
+ * cannot proceed at all. Everything dx does is optional, so a signed-out creator gets
+ * one plain line from the command layer instead of a config-file stack trace. Shared by
+ * `enable`, `disable`, and `--send` so all three read the credential identically.
+ */
+async function dxAuth() {
+    try {
+        const cfg = await resolveConfig(projectDir(), {
+            allowCustomApi: has("--allow-custom-api"),
+        });
+        return cfg.pat ? { apiUrl: cfg.apiUrl, pat: cfg.pat } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function dx() {
     const options = parseDxOptions(argv);
     const now = Date.now();
@@ -956,18 +976,30 @@ async function dx() {
     // precisely the case where nobody reads what was disclosed.
     const interactive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY);
     if (options.enable || options.disable) {
+        const consent = httpConsentBackend();
         const deps = {
             print: (l) => console.log(l),
             now: () => now,
             interactive,
             confirm: (q) => stdinConfirm()(`  ${q} [y/N] `, false),
-            // `enable` does NOT require being signed in. --send refuses without a PAT
-            // regardless, so a config holding only enablement keys is inert; and
-            // ordering the two verbs ("you must log in before you may state a
-            // preference") would be a rule with no safety behind it.
+            // `enable` NOW REQUIRES being signed in, reversing f7's
+            // D-Enable-does-not-require-being-signed-in. The browser path records consent on
+            // the ACCOUNT, so there has to be an account to record it against and a credential
+            // to reach it with — the precondition is load-bearing now rather than ceremonial.
+            auth: dxAuth,
             save: async (next) => {
                 await writeDxEnablement(next);
             },
+            // The no-TTY consent round trip. Defaults are the real seams; the whole thing is
+            // injected as ONE function so dxEnableCommand needs no socket to test.
+            consentInBrowser: async () => {
+                const { consoleUrl } = await resolveAuthUrls();
+                return runConsentInBrowser({
+                    consoleUrl,
+                    onProgress: (l) => console.log(l),
+                });
+            },
+            revokeAccountConsent: (auth) => consent.revoke(auth.apiUrl, auth.pat),
         };
         process.exitCode = options.enable
             ? await dxEnableCommand(deps, DX_UNATTENDED_SUNSET)
@@ -990,25 +1022,15 @@ async function dx() {
         enabled: () => journalEnabled(),
         path: journalPath,
         cliVersion,
-        auth: async () => {
-            // resolveConfig THROWS when there is no PAT, and its message is written
-            // for a verb that cannot proceed at all. Sending a DX report is
-            // optional, so a signed-out creator gets one plain line from
-            // dxSendCommand instead of a config-file stack trace.
-            try {
-                const cfg = await resolveConfig(projectDir(), {
-                    allowCustomApi: has("--allow-custom-api"),
-                });
-                return cfg.pat ? { apiUrl: cfg.apiUrl, pat: cfg.pat } : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        },
+        auth: dxAuth,
         post: (apiUrl, pat, report) => postReport(apiUrl, pat, report),
         confirm: (q) => stdinConfirm()(`${q} [y/N] `, false),
         interactive,
         enablement: () => enablement,
+        // The third arm: the account-wide grant, read from /me. Consulted only when the
+        // first two have not already allowed the send, and allowed to throw — a /me that
+        // is unreachable falls back to the other two arms rather than blocking.
+        accountConsent: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now),
     }, options);
 }
 // ---- assets (f5) ------------------------------------------------------------

package/dist/dx/command.d.ts

@@ -1,3 +1,4 @@
+import type { ConsentDecision } from "./consent.js";
 import type { Enablement } from "./enablement.js";
 import type { JournalEntry } from "./journal.js";
 import type { WireReport } from "./send.js";
@@ -46,30 +47,83 @@ export interface DxEnableDeps {
     save: (next: {
         at: string;
     } | undefined) => Promise<void>;
+    /**
+     * Resolved API host + PAT, or undefined when signed out.
+     *
+     * `enable` now REQUIRES this, which REVERSES f7's
+     * D-Enable-does-not-require-being-signed-in. That decision reasoned that ordering the
+     * two verbs would be "a rule with no safety behind it" — true while the grant lived
+     * only in a local file. It no longer does: the browser path records consent against
+     * the ACCOUNT, so there has to be an account to record it against, and the CLI has to
+     * hold a credential to reach it. The precondition is now load-bearing rather than
+     * ceremonial, so the refusal names `vincentt login`.
+     */
+    auth?: () => Promise<{
+        apiUrl: string;
+        pat: string;
+    } | undefined>;
+    /**
+     * Run the console consent round trip: open the browser, wait for the loopback
+     * callback, and return the human's answer. Injected whole so the command layer needs
+     * no socket, no browser, and no clock to test.
+     */
+    consentInBrowser?: () => Promise<ConsentDecision>;
+    /**
+     * DELETE /me/dx-consent. Used only by `disable`, and allowed to throw — the caller
+     * treats a network failure as "local revoke still stands", never as a reason to leave
+     * the capability on.
+     */
+    revokeAccountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<void>;
 }
 /**
- * `vincentt dx enable` — grant this machine durable permission to send DX reports
- * without asking first.
+ * `vincentt dx enable` — grant durable permission to send DX reports without asking
+ * first.
+ *
+ * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
+ *
+ *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
+ *     can read the disclosure where they stand; sending them to a browser would be
+ *     ceremony.
+ *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
+ *     creator driving the CLI through a coding agent has no terminal, so the old code
+ *     refused and the flow dead-ended. It now opens the console, where a human can
+ *     actually give consent.
  *
- * The TTY requirement is a SPEED BUMP, NOT A BOUNDARY, and is written down as
- * such so a later reader does not build on a guarantee that is not there. It
- * stops the reflex — an agent that meets a prompt, infers there must be a way
- * past it, and tries the obvious thing. It does not stop a caller that allocates
- * a PTY or writes config.json directly.
+ * The no-TTY path is no longer a refusal, but that is NOT a relaxation of the gate. The
+ * old TTY check was explicitly a SPEED BUMP, NOT A BOUNDARY (it never stopped a caller
+ * that allocated a PTY or wrote config.json directly); what replaces it is stronger,
+ * because the browser path puts the decision in front of a human on a page the agent
+ * cannot see, click, or forge — the agent can start the flow but cannot finish it.
  *
- * The refusal path writes NOTHING. Not "writes the same bytes back" — nothing at
- * all: this file holds the PAT, and a refusal that round-trips the config through
- * a write can lose the credential if it dies mid-write.
+ * The refusal paths still write NOTHING. Not "write the same bytes back" — nothing at
+ * all: this file holds the PAT, and a refusal that round-trips the config through a
+ * write can lose the credential if it dies mid-write.
  */
 export declare function dxEnableCommand(deps: DxEnableDeps, sunset: number): Promise<number>;
 /**
  * `vincentt dx disable` — the obvious opposite command.
  *
- * Clears BOTH keys. Leaving the timestamp behind would make a later re-enable
- * report its age from the first grant, which is the kind of thing that ships
- * wrong and is never noticed. Needs no terminal and no confirmation: turning a
- * capability OFF is always safe to do, and requiring a TTY here would strand a
- * creator who wanted to revoke from a script.
+ * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
+ * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
+ * clearing only the local flag would leave the account grant standing, so the very next
+ * `--send` would be authorized by arm (c) and the command would appear not to have
+ * worked.
+ *
+ * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
+ * cannot fail and the one that stops THIS machine, which is the machine the creator is
+ * standing at.
+ *
+ * A NETWORK FAILURE MUST NEVER BLOCK A REVOKE. Turning a capability off is always safe,
+ * so the failure path still clears locally, still exits 0, and says plainly that the
+ * account grant may remain and where to clear it. The opposite design — fail the command
+ * so the creator "knows it did not work" — leaves them with the capability still on and
+ * a non-zero exit that suggests nothing happened at all.
+ *
+ * Needs no terminal and no confirmation: requiring a TTY here would strand a creator who
+ * wanted to revoke from a script, and this is the direction that is always safe.
  */
 export declare function dxDisableCommand(deps: DxEnableDeps): Promise<number>;
 export interface DxSendDeps extends DxDeps {
@@ -95,6 +149,16 @@ export interface DxSendDeps extends DxDeps {
     interactive: () => boolean;
     /** Durable unattended-send state, read strictly. Absent reads as not enabled. */
     enablement?: () => Enablement;
+    /**
+     * The ACCOUNT's consent, read from GET /me. The third arm of the gate.
+     *
+     * Allowed to throw, and its throw is not fatal — see the gate below. Absent (the dep
+     * not wired at all) reads as not consented, never as "unknown, so allow".
+     */
+    accountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<Enablement>;
 }
 /**
  * `vincentt dx --send`.

package/dist/dx/command.js

@@ -131,18 +131,28 @@ function sunsetDate(sunset) {
     return new Date(sunset).toISOString().slice(0, 10);
 }
 /**
- * `vincentt dx enable` — grant this machine durable permission to send DX reports
- * without asking first.
+ * `vincentt dx enable` — grant durable permission to send DX reports without asking
+ * first.
  *
- * The TTY requirement is a SPEED BUMP, NOT A BOUNDARY, and is written down as
- * such so a later reader does not build on a guarantee that is not there. It
- * stops the reflex — an agent that meets a prompt, infers there must be a way
- * past it, and tries the obvious thing. It does not stop a caller that allocates
- * a PTY or writes config.json directly.
+ * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
  *
- * The refusal path writes NOTHING. Not "writes the same bytes back" — nothing at
- * all: this file holds the PAT, and a refusal that round-trips the config through
- * a write can lose the credential if it dies mid-write.
+ *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
+ *     can read the disclosure where they stand; sending them to a browser would be
+ *     ceremony.
+ *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
+ *     creator driving the CLI through a coding agent has no terminal, so the old code
+ *     refused and the flow dead-ended. It now opens the console, where a human can
+ *     actually give consent.
+ *
+ * The no-TTY path is no longer a refusal, but that is NOT a relaxation of the gate. The
+ * old TTY check was explicitly a SPEED BUMP, NOT A BOUNDARY (it never stopped a caller
+ * that allocated a PTY or wrote config.json directly); what replaces it is stronger,
+ * because the browser path puts the decision in front of a human on a page the agent
+ * cannot see, click, or forge — the agent can start the flow but cannot finish it.
+ *
+ * The refusal paths still write NOTHING. Not "write the same bytes back" — nothing at
+ * all: this file holds the PAT, and a refusal that round-trips the config through a
+ * write can lose the credential if it dies mid-write.
  */
 export async function dxEnableCommand(deps, sunset) {
     if (deps.now() >= sunset) {
@@ -152,15 +162,26 @@ export async function dxEnableCommand(deps, sunset) {
         deps.print("");
         return 1;
     }
-    if (!deps.interactive()) {
+    // Being signed in is now a PRECONDITION, checked before either path and before any
+    // disclosure is printed. This REVERSES f7's D-Enable-does-not-require-being-signed-in
+    // — see the note on DxEnableDeps.auth for why that reversal is justified rather than
+    // merely convenient: the browser path records consent on the ACCOUNT, so there must be
+    // one, and reaching it needs a credential. Checked FIRST because a creator who is
+    // signed out cannot complete either path, and reading a consent disclosure before
+    // being told so is wasted attention.
+    const auth = await deps.auth?.();
+    if (auth === undefined) {
         deps.print("");
-        deps.print("  Enabling unattended sending needs a terminal to ask in, and this");
-        deps.print("  session has none. Nothing was changed.");
+        deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
+        deps.print("  this machine is not signed in. Nothing was changed.");
         deps.print("");
-        deps.print("  Run `vincentt dx enable` yourself, in your own terminal.");
+        deps.print("  Run `vincentt login` first.");
         deps.print("");
         return 1;
     }
+    if (!deps.interactive()) {
+        return enableViaBrowser(deps);
+    }
     // What is being granted, INCLUDING the note risk. The note is the part a
     // creator does not picture: enablement is what lets an agent compose prose they
     // have not read and put it on the wire.
@@ -187,17 +208,111 @@ export async function dxEnableCommand(deps, sunset) {
     deps.print("");
     return 0;
 }
+/**
+ * The no-TTY arm: hand the decision to a human in a browser.
+ *
+ * The disclosure itself is deliberately NOT printed here. It lives on the console page,
+ * where the person deciding will actually see it; printing it into an agent's transcript
+ * would put the warning everywhere except in front of the human it is written for. What
+ * is printed here is only what a reader of the transcript needs — that a browser is
+ * being opened, and the URL.
+ *
+ * Note the CLI's PAT is NOT passed into this round trip and never rides the console URL.
+ * The console holds its own session and POSTs /me/dx-consent itself, so the browser
+ * carries only a `state` and a decision. The PAT's role was to prove there is an account
+ * at all, which the caller has already checked.
+ */
+async function enableViaBrowser(deps) {
+    if (deps.consentInBrowser === undefined) {
+        // No browser seam wired: refuse rather than silently falling back to a path that
+        // asks nobody. Reachable only from a caller that built deps by hand.
+        deps.print("");
+        deps.print("  Enabling unattended sending needs either a terminal to ask in or a");
+        deps.print("  browser to open, and this session has neither. Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    let decision;
+    try {
+        decision = await deps.consentInBrowser();
+    }
+    catch (err) {
+        // A timeout, a cancelled window, an unreachable console. Nothing is written on any
+        // of them — an enable that could not be confirmed is not an enable.
+        deps.print("");
+        deps.print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+        deps.print("  Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    if (decision !== "granted") {
+        // Denied writes NOTHING and exits 0. Exit 0 because declining is a successful
+        // outcome of the command the caller ran, not a malfunction — an agent that reads a
+        // non-zero exit here would reasonably retry, which is how a refused consent prompt
+        // becomes a loop the human has to keep dismissing.
+        deps.print("");
+        deps.print("  Not enabled.");
+        deps.print("");
+        return 0;
+    }
+    // The grant is already recorded on the account by the console (the page POSTs
+    // /me/dx-consent before it redirects). The local flag is cached alongside it so this
+    // machine can decide without a network round trip — and so a later --send is not
+    // blocked by an API that happens to be unreachable.
+    await deps.save({ at: new Date(deps.now()).toISOString() });
+    deps.print("");
+    deps.print("  Enabled. Reports may now be sent without a prompt.");
+    deps.print("  Turn it off with `vincentt dx disable`, or in the console.");
+    deps.print("");
+    return 0;
+}
 /**
  * `vincentt dx disable` — the obvious opposite command.
  *
- * Clears BOTH keys. Leaving the timestamp behind would make a later re-enable
- * report its age from the first grant, which is the kind of thing that ships
- * wrong and is never noticed. Needs no terminal and no confirmation: turning a
- * capability OFF is always safe to do, and requiring a TTY here would strand a
- * creator who wanted to revoke from a script.
+ * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
+ * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
+ * clearing only the local flag would leave the account grant standing, so the very next
+ * `--send` would be authorized by arm (c) and the command would appear not to have
+ * worked.
+ *
+ * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
+ * cannot fail and the one that stops THIS machine, which is the machine the creator is
+ * standing at.
+ *
+ * A NETWORK FAILURE MUST NEVER BLOCK A REVOKE. Turning a capability off is always safe,
+ * so the failure path still clears locally, still exits 0, and says plainly that the
+ * account grant may remain and where to clear it. The opposite design — fail the command
+ * so the creator "knows it did not work" — leaves them with the capability still on and
+ * a non-zero exit that suggests nothing happened at all.
+ *
+ * Needs no terminal and no confirmation: requiring a TTY here would strand a creator who
+ * wanted to revoke from a script, and this is the direction that is always safe.
  */
 export async function dxDisableCommand(deps) {
     await deps.save(undefined);
+    // Signed out: there is no account grant this machine can reach, and nothing to say
+    // about one. `logout` already cleared the local flag on its way out.
+    const auth = await deps.auth?.();
+    if (auth !== undefined && deps.revokeAccountConsent !== undefined) {
+        try {
+            await deps.revokeAccountConsent(auth);
+        }
+        catch (err) {
+            deps.print("");
+            deps.print("  Unattended sending is off on this machine.");
+            deps.print("");
+            deps.print(`  ! Could not reach Vincentt to clear the account-wide grant:`);
+            deps.print(`    ${err instanceof Error ? err.message : String(err)}`);
+            deps.print("");
+            deps.print("  If you allowed reports in the console, that grant may still be");
+            deps.print("  active for your other machines. Clear it in the console settings.");
+            deps.print("");
+            // Exit 0: the revoke the creator asked for HAPPENED here, and the part that did
+            // not is named with the place to finish it. A non-zero exit would read as "the
+            // command failed", which would be false about the machine they are on.
+            return 0;
+        }
+    }
     deps.print("");
     deps.print("  Unattended sending is off. Reports need your confirmation again.");
     deps.print("");
@@ -245,8 +360,45 @@ export async function dxSendCommand(deps, options) {
     // The second arm is the SUPPORTED unattended path: a person, at a terminal,
     // ran `vincentt dx enable` on this machine. That is a prior deliberate act
     // rather than a per-send answer, which is what makes it consent at all.
-    const enablement = deps.enablement?.() ?? { enabled: false };
+    //
+    // The THIRD arm is the same kind of prior deliberate act, made in the console and
+    // recorded on the ACCOUNT rather than on this machine. It exists because the second
+    // arm cannot be reached at all by the creator this feature is for: driving the CLI
+    // through a coding agent, there is no terminal to run `dx enable` in.
+    const localEnablement = deps.enablement?.() ?? { enabled: false };
     const interactive = deps.interactive();
+    // Auth is resolved BEFORE the gate now, because arm (c) needs a credential to read
+    // /me. The signed-out refusal still comes AFTER the gate, so a caller with neither a
+    // terminal nor consent gets the refusal about consent — the thing they need to fix —
+    // rather than being sent to `login` first and only then told that logging in was not
+    // sufficient.
+    const auth = await deps.auth();
+    // Arm (c) is consulted ONLY when the first two have not already allowed the send.
+    // Skipping it otherwise is not just an optimization: it keeps `--send` from making a
+    // network call it does not need, so a creator at their own terminal is never blocked
+    // by an API being slow or down.
+    let accountEnablement = { enabled: false };
+    if (!interactive && !localEnablement.enabled && auth !== undefined) {
+        try {
+            accountEnablement = (await deps.accountConsent?.(auth)) ?? { enabled: false };
+        }
+        catch {
+            // A NETWORK FAILURE FALLS BACK TO THE OTHER TWO ARMS, and since we only get here
+            // when both have already said no, that means refusing. This is the fail-CLOSED
+            // direction: an unreachable API can never authorize a send.
+            //
+            // The swallow is deliberate and is the whole point of the arm's placement — a
+            // /me that is down must never BLOCK a send that (a) or (b) already allows, and it
+            // cannot, because those paths never reach this call at all.
+            accountEnablement = { enabled: false };
+        }
+    }
+    // The grant that authorizes this send, and the one whose age gets reported. The local
+    // flag wins when both exist: it is the more specific statement (this machine) and it
+    // is the one `dx disable` can always clear.
+    const enablement = localEnablement.enabled
+        ? localEnablement
+        : accountEnablement;
     if (!interactive && !enablement.enabled) {
         // This refusal NAMES the enabling command. A refusal is an answer to a
         // command the caller typed, which makes it SOLICITED output — the
@@ -255,19 +407,18 @@ export async function dxSendCommand(deps, options) {
         // nothing satisfies the letter of that rule and leaves a human at exit 1
         // with no path forward, for no security gain: guessability was never the
         // threat.
-        deps.print("Sending a report needs your confirmation, and this session has no terminal");
-        deps.print("to ask in. Run `vincentt dx enable` yourself to allow reports from this");
-        deps.print("machine, or run `vincentt dx --send` in your own terminal.");
+        deps.print("Sending a report needs consent that has not been given on this account.");
+        deps.print("`vincentt dx enable` opens the Vincentt console so you can allow it.");
+        deps.print("It takes one click, and it works from here.");
         return 1;
     }
-    const auth = await deps.auth();
     if (auth === undefined) {
         deps.print("Not signed in. Run `vincentt login` to send a report.");
         return 1;
     }
     const report = buildReport(clusters, deps.cliVersion(), options.note);
     // Above the payload, on the unattended path only: name that this is enabled,
-    // how old the grant is, and that nothing is going to ask.
+    // how old the grant is, WHERE it was granted, and that nothing is going to ask.
     const unattended = !interactive && enablement.enabled;
     if (unattended) {
         const line = enablementLine(enablement, deps.now());

package/dist/dx/consent.d.ts

@@ -0,0 +1,77 @@
+import { type Enablement } from "./enablement.js";
+/**
+ * The account-consent seam.
+ *
+ * `read` returns the parsed Enablement rather than the raw envelope so the strict
+ * `=== true` interpretation happens in exactly one place and cannot be re-derived
+ * loosely by a second caller.
+ */
+export interface ConsentBackend {
+    /** GET /me → the account's dxReportsConsent fields, read strictly. */
+    read(apiUrl: string, pat: string, now: number): Promise<Enablement>;
+    /** POST /me/dx-consent — grant. Idempotent; a re-grant refreshes the timestamp. */
+    grant(apiUrl: string, pat: string, now: number): Promise<Enablement>;
+    /** DELETE /me/dx-consent — revoke. Never fails on already-revoked. */
+    revoke(apiUrl: string, pat: string): Promise<void>;
+}
+/** The real HTTP-backed ConsentBackend, pointed at a Vincentt API base URL. */
+export declare function httpConsentBackend(): ConsentBackend;
+/**
+ * The console URL the browser opens for the consent decision:
+ * `<console>/cli-dx-consent?redirect_uri=<loopback>&state=…`.
+ *
+ * Mirrors buildCliAuthUrl deliberately, including the param NAMES — the console's page
+ * reads exactly `redirect_uri` and `state`, and it validates that redirect_uri is a
+ * 127.0.0.1 loopback. No PKCE material rides here: unlike login, nothing is being
+ * redeemed. The callback carries only a decision, and `state` is what binds that
+ * decision to this CLI invocation.
+ */
+export declare function buildConsentUrl(consoleBase: string, redirectUri: string, state: string): string;
+export type ConsentDecision = "granted" | "denied";
+export type ConsentCallback = {
+    ok: true;
+    decision: ConsentDecision;
+} | {
+    ok: false;
+    reason: "state_mismatch" | "missing_result";
+    message: string;
+};
+/**
+ * Interpret the loopback callback (`?state=…&result=granted|denied`).
+ *
+ * State is verified constant-time FIRST, before `result` is even read, so a stray or
+ * forged callback can never grant consent — the same discipline as parseCallback, and
+ * for a higher-stakes decision: here the forged value would not be a code that still has
+ * to survive a PKCE exchange, it would be the answer itself.
+ *
+ * Anything that is not exactly "granted" reads as DENIED rather than as an error, so an
+ * unrecognized result can only ever fail closed.
+ */
+export declare function parseConsentCallback(params: URLSearchParams, expectedState: string, stateMatches: (expected: string, actual: string | null) => boolean): ConsentCallback;
+/** Thrown when the human never answers in the browser. */
+export declare class ConsentTimeoutError extends Error {
+    constructor();
+}
+export interface ConsentBrowserOptions {
+    /** Console origin that serves /cli-dx-consent. */
+    consoleUrl: string;
+    /** Abort if the browser round trip does not complete in time. Default 5 min. */
+    timeoutMs?: number;
+    pickPort?: () => Promise<number>;
+    openBrowser?: (url: string) => void;
+    /** Mint the anti-CSRF state. Injected only so a test can pin it. */
+    mintState?: () => string;
+    onProgress?: (line: string) => void;
+}
+/**
+ * Open the console's consent page and wait for the human's answer.
+ *
+ * The mechanics are the SHARED loopback helper, not a second copy of it: listener up
+ * before the browser, `state` verified constant-time on every callback, a stray callback
+ * answered but not accepted, and a bounded wait. The only thing that differs from login
+ * is what comes back — a decision instead of an auth code.
+ *
+ * Nothing is written here. This function reports what the human said; persisting it is
+ * the command layer's job, so the "denied writes nothing" rule lives in one place.
+ */
+export declare function runConsentInBrowser(opts: ConsentBrowserOptions): Promise<ConsentDecision>;

package/dist/dx/consent.js

@@ -0,0 +1,197 @@
+/**
+ * The ACCOUNT half of unattended-send authorization.
+ *
+ * `vincentt dx enable` used to require a TTY, which dead-ends the flow this feature is
+ * actually for: a creator drives the CLI through a coding agent, the agent has no
+ * terminal, and the command refuses. Consent therefore moves to the console, where a
+ * human can actually read the disclosure and click — the CLI opens a browser and waits.
+ *
+ * The grant is PER-ACCOUNT, not per-machine: one decision covers every machine the
+ * creator signs in on. That is a wider blast radius than the local flag, which is why
+ * the console page carries the full disclosure (including that an agent may compose a
+ * note the user has not read) and why the visibility line names the console as the
+ * source — a creator who wants it off needs to know that clearing a local flag is not
+ * enough.
+ *
+ * Every call is isolated behind ConsentBackend so the command layer is unit-testable
+ * with no network.
+ */
+import { randomBytes } from "node:crypto";
+import { waitForLoopbackCallback } from "../login/loopback.js";
+import { browserPage } from "../login/pkceLogin.js";
+import { stateMatches } from "../login/pkce.js";
+import { getFreePort } from "../preview/net.js";
+import { authFailureMessage } from "../shared/authError.js";
+import { clientHeaders } from "../shared/clientHeader.js";
+import { readAccountConsent } from "./enablement.js";
+async function safeText(res) {
+    try {
+        return (await res.text()).slice(0, 300);
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * Unwrap the `meEnvelope` GET /me and both /me/dx-consent verbs return.
+ *
+ * The envelope is `{ me: {...}, csrfToken }`, but a bare user object is tolerated for the
+ * same reason normalizeMe tolerates it: a contract wording change should not silently
+ * turn a granted account into a refusal. Note the tolerance is on the SHAPE ONLY — the
+ * consent VALUE is still read `=== true`, so a resilient unwrap never becomes a lenient
+ * authorization read.
+ */
+function unwrapMe(raw) {
+    const envelope = (raw ?? {});
+    return envelope.me && typeof envelope.me === "object" ? envelope.me : envelope;
+}
+/** The real HTTP-backed ConsentBackend, pointed at a Vincentt API base URL. */
+export function httpConsentBackend() {
+    const strip = (u) => u.replace(/\/$/, "");
+    return {
+        async read(apiUrl, pat, now) {
+            const res = await fetch(`${strip(apiUrl)}/me`, {
+                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
+            });
+            if (!res.ok) {
+                throw new Error(authFailureMessage("Could not read your account", res.status, await safeText(res)));
+            }
+            return readAccountConsent(unwrapMe(await res.json()), now);
+        },
+        async grant(apiUrl, pat, now) {
+            const res = await fetch(`${strip(apiUrl)}/me/dx-consent`, {
+                method: "POST",
+                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
+            });
+            if (!res.ok) {
+                throw new Error(authFailureMessage("Could not record consent", res.status, await safeText(res)));
+            }
+            return readAccountConsent(unwrapMe(await res.json()), now);
+        },
+        async revoke(apiUrl, pat) {
+            const res = await fetch(`${strip(apiUrl)}/me/dx-consent`, {
+                method: "DELETE",
+                headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
+            });
+            if (!res.ok) {
+                throw new Error(authFailureMessage("Could not revoke consent", res.status, await safeText(res)));
+            }
+        },
+    };
+}
+/**
+ * The console URL the browser opens for the consent decision:
+ * `<console>/cli-dx-consent?redirect_uri=<loopback>&state=…`.
+ *
+ * Mirrors buildCliAuthUrl deliberately, including the param NAMES — the console's page
+ * reads exactly `redirect_uri` and `state`, and it validates that redirect_uri is a
+ * 127.0.0.1 loopback. No PKCE material rides here: unlike login, nothing is being
+ * redeemed. The callback carries only a decision, and `state` is what binds that
+ * decision to this CLI invocation.
+ */
+export function buildConsentUrl(consoleBase, redirectUri, state) {
+    const base = /^https?:\/\//i.test(consoleBase)
+        ? consoleBase
+        : `${/^(localhost|127\.0\.0\.1)(:|\/|$)/i.test(consoleBase) ? "http" : "https"}://${consoleBase}`;
+    const u = new URL("/cli-dx-consent", base);
+    u.searchParams.set("redirect_uri", redirectUri);
+    u.searchParams.set("state", state);
+    return u.toString();
+}
+/**
+ * Interpret the loopback callback (`?state=…&result=granted|denied`).
+ *
+ * State is verified constant-time FIRST, before `result` is even read, so a stray or
+ * forged callback can never grant consent — the same discipline as parseCallback, and
+ * for a higher-stakes decision: here the forged value would not be a code that still has
+ * to survive a PKCE exchange, it would be the answer itself.
+ *
+ * Anything that is not exactly "granted" reads as DENIED rather than as an error, so an
+ * unrecognized result can only ever fail closed.
+ */
+export function parseConsentCallback(params, expectedState, stateMatches) {
+    if (!stateMatches(expectedState, params.get("state"))) {
+        return {
+            ok: false,
+            reason: "state_mismatch",
+            message: "State mismatch — ignoring an unexpected callback.",
+        };
+    }
+    const result = params.get("result");
+    if (result === null) {
+        return {
+            ok: false,
+            reason: "missing_result",
+            message: "The browser returned no answer.",
+        };
+    }
+    return { ok: true, decision: result === "granted" ? "granted" : "denied" };
+}
+/** Thrown when the human never answers in the browser. */
+export class ConsentTimeoutError extends Error {
+    constructor() {
+        super("Timed out waiting for an answer in the browser (5 minutes).");
+        this.name = "ConsentTimeoutError";
+    }
+}
+/**
+ * Open the console's consent page and wait for the human's answer.
+ *
+ * The mechanics are the SHARED loopback helper, not a second copy of it: listener up
+ * before the browser, `state` verified constant-time on every callback, a stray callback
+ * answered but not accepted, and a bounded wait. The only thing that differs from login
+ * is what comes back — a decision instead of an auth code.
+ *
+ * Nothing is written here. This function reports what the human said; persisting it is
+ * the command layer's job, so the "denied writes nothing" rule lives in one place.
+ */
+export async function runConsentInBrowser(opts) {
+    // 24 bytes of CSPRNG, matching the login flow's state. This is the only thing binding
+    // the browser's answer to this invocation, so it is minted per call and never reused.
+    const state = (opts.mintState ?? defaultState)();
+    return waitForLoopbackCallback({
+        pickPort: opts.pickPort ?? getFreePort,
+        buildUrl: (redirectUri) => buildConsentUrl(opts.consoleUrl, redirectUri, state),
+        openBrowser: opts.openBrowser ?? defaultOpenBrowser,
+        timeoutMs: opts.timeoutMs ?? 5 * 60_000,
+        onTimeout: () => new ConsentTimeoutError(),
+        onProgress: opts.onProgress,
+        parse: (params) => {
+            const result = parseConsentCallback(params, state, stateMatches);
+            if (result.ok) {
+                const granted = result.decision === "granted";
+                return {
+                    ok: true,
+                    value: result.decision,
+                    page: {
+                        status: 200,
+                        html: browserPage(granted, granted ? "Reports allowed" : "Not enabled", "Return to your terminal — you can close this tab."),
+                    },
+                };
+            }
+            return {
+                ok: false,
+                // A state mismatch keeps waiting: it is a stray or forged callback, and letting
+                // it end the flow would let anyone who can reach the loopback port cancel a
+                // legitimate consent round trip.
+                retry: result.reason === "state_mismatch",
+                message: result.message,
+                page: {
+                    status: 400,
+                    html: browserPage(false, "Something went wrong", result.message),
+                },
+            };
+        },
+    });
+}
+function defaultState() {
+    return randomBytes(24)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function defaultOpenBrowser(url) {
+    // Lazy import keeps this module importable in tests that never open a browser.
+    void Promise.all([import("node:child_process"), import("../login/pkceLogin.js")]).then(([{ spawn }, { launchBrowser }]) => launchBrowser(url, spawn));
+}

package/dist/dx/enablement.d.ts

@@ -10,10 +10,22 @@
  * raise.
  */
 export declare const DX_UNATTENDED_SUNSET: number;
+/**
+ * WHERE the grant was made. Consent can now be given in the console (per-ACCOUNT, so it
+ * covers every machine the creator signs in on) or at this terminal (per-MACHINE).
+ *
+ * The source is carried rather than inferred because the two have different blast radii
+ * and different places to revoke. A creator reading `ENABLED` on a machine they never
+ * ran `dx enable` on has no way to act on it without being told the grant lives in their
+ * account — they would go looking for a local flag that is not there.
+ */
+export type EnablementSource = "console" | "machine";
 export interface Enablement {
     enabled: boolean;
     /** The raw ISO8601 grant time. Present only when `enabled` is true. */
     at?: string;
+    /** Where the grant came from. Present only when `enabled` is true. */
+    source?: EnablementSource;
 }
 /**
  * Decide enablement from an already-parsed config object. Pure, and STRICT:
@@ -26,6 +38,18 @@ export interface Enablement {
  * that reads a creator's "off" as "on" is inverted, not merely loose.
  */
 export declare function readEnablement(cfg: unknown, now: number): Enablement;
+/**
+ * Decide enablement from the ACCOUNT's `/me` fields, with the same strictness as the
+ * local read.
+ *
+ * `=== true` is not defensive noise here either: this value crosses the wire, so it
+ * arrives as whatever JSON the server (or anything between) actually sent. A truthiness
+ * read would treat the string "false" — the exact shape a serializer bug or a hand-rolled
+ * proxy produces — as consent. The sunset applies identically: past it, an account grant
+ * stops being honored too, or "forgetting the sunset turns the feature off" would only be
+ * true of the local half.
+ */
+export declare function readAccountConsent(raw: unknown, now: number): Enablement;
 /**
  * Read enablement from the real machine config.
  *
@@ -42,10 +66,20 @@ export declare function grantedOn(at: string): string;
 /**
  * The one visibility line, in the single pinned shape every human surface uses:
  *
- *   Unattended send: ENABLED since 2026-04-01 (145 days)
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted in the console
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted on this machine
  *
  * Returns undefined when not enabled. Nothing is printed in that case, on
  * purpose: a line that prints unconditionally is a line readers learn to skip,
  * which would cost exactly the attention the enabled line needs.
+ *
+ * The AGE stays exactly where it was — it remains the entire mitigation for having no
+ * expiry, and the source is appended AFTER it rather than woven in, so the number a
+ * reader is meant to notice is not pushed off the front of the line.
+ *
+ * The source clause answers the question the age raises: having seen "145 days", the
+ * creator's next move is to turn it off, and that is a different place depending on
+ * where it was granted. A line that says ENABLED without saying where sends someone
+ * looking for a local flag that may not exist.
  */
 export declare function enablementLine(e: Enablement, now: number): string | undefined;

package/dist/dx/enablement.js

@@ -1,11 +1,16 @@
 /**
  * Durable authorization for unattended `vincentt dx --send`.
  *
- * `--send` transmits only when the session is interactive OR this machine has
- * been explicitly enabled by a person, at a terminal, via `vincentt dx enable`.
- * The state is two fields in ~/.vincentt/config.json, set by `enable`, cleared by
- * `disable` and by `logout`, and it has NO expiry — it stays on until the creator
- * turns it off.
+ * `--send` transmits only when the session is interactive, OR this MACHINE has been
+ * enabled via `vincentt dx enable`, OR the creator's ACCOUNT carries the grant they
+ * gave in the console. `enable` collects that consent in the browser by default and
+ * at the terminal when there is one; either way a person answers, never the caller.
+ *
+ * The machine half is two fields in ~/.vincentt/config.json, set by `enable`, cleared
+ * by `disable` and by `logout`. The account half is read from `/me` and cleared by
+ * `disable` or in the console — NOT by `logout`, since signing out of one machine is
+ * not a decision about the account. Neither has an expiry: both stay on until the
+ * creator turns them off.
  *
  * Because there is no expiry, VISIBILITY is the entire mitigation, and the AGE is
  * the load-bearing half of it: `ENABLED` alone reads as configuration, while
@@ -50,7 +55,35 @@ export function readEnablement(cfg, now) {
         return DISABLED;
     if (now >= DX_UNATTENDED_SUNSET)
         return DISABLED;
-    return { enabled: true, at: dxSendEnabledAt };
+    // The local flag is by definition a grant made on THIS machine — `dx enable` is the
+    // only writer, whether it took the browser path or the terminal one. An account grant
+    // never lands in this file; it is read from /me and reported separately.
+    return { enabled: true, at: dxSendEnabledAt, source: "machine" };
+}
+/**
+ * Decide enablement from the ACCOUNT's `/me` fields, with the same strictness as the
+ * local read.
+ *
+ * `=== true` is not defensive noise here either: this value crosses the wire, so it
+ * arrives as whatever JSON the server (or anything between) actually sent. A truthiness
+ * read would treat the string "false" — the exact shape a serializer bug or a hand-rolled
+ * proxy produces — as consent. The sunset applies identically: past it, an account grant
+ * stops being honored too, or "forgetting the sunset turns the feature off" would only be
+ * true of the local half.
+ */
+export function readAccountConsent(raw, now) {
+    if (typeof raw !== "object" || raw === null)
+        return DISABLED;
+    const { dxReportsConsent, dxReportsConsentAt } = raw;
+    if (dxReportsConsent !== true)
+        return DISABLED;
+    if (typeof dxReportsConsentAt !== "string")
+        return DISABLED;
+    if (!Number.isFinite(Date.parse(dxReportsConsentAt)))
+        return DISABLED;
+    if (now >= DX_UNATTENDED_SUNSET)
+        return DISABLED;
+    return { enabled: true, at: dxReportsConsentAt, source: "console" };
 }
 /**
  * Read enablement from the real machine config.
@@ -83,15 +116,30 @@ export function grantedOn(at) {
 /**
  * The one visibility line, in the single pinned shape every human surface uses:
  *
- *   Unattended send: ENABLED since 2026-04-01 (145 days)
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted in the console
+ *   Unattended send: ENABLED since 2026-04-01 (145 days) · granted on this machine
  *
  * Returns undefined when not enabled. Nothing is printed in that case, on
  * purpose: a line that prints unconditionally is a line readers learn to skip,
  * which would cost exactly the attention the enabled line needs.
+ *
+ * The AGE stays exactly where it was — it remains the entire mitigation for having no
+ * expiry, and the source is appended AFTER it rather than woven in, so the number a
+ * reader is meant to notice is not pushed off the front of the line.
+ *
+ * The source clause answers the question the age raises: having seen "145 days", the
+ * creator's next move is to turn it off, and that is a different place depending on
+ * where it was granted. A line that says ENABLED without saying where sends someone
+ * looking for a local flag that may not exist.
  */
 export function enablementLine(e, now) {
     if (!e.enabled || e.at === undefined)
         return undefined;
     const days = ageInDays(e.at, now);
-    return `Unattended send: ENABLED since ${grantedOn(e.at)} (${days} ${days === 1 ? "day" : "days"})`;
+    const where = e.source === "console"
+        ? " · granted in the console"
+        : e.source === "machine"
+            ? " · granted on this machine"
+            : "";
+    return `Unattended send: ENABLED since ${grantedOn(e.at)} (${days} ${days === 1 ? "day" : "days"})${where}`;
 }

package/dist/login/loopback.d.ts

@@ -0,0 +1,72 @@
+/** Thrown when the wait elapses with no answer from the browser. */
+export declare class LoopbackTimeoutError extends Error {
+    constructor(message: string);
+}
+/** Thrown when the callback is a terminal failure (a cancel, a malformed answer). */
+export declare class LoopbackCallbackError extends Error {
+    constructor(message: string);
+}
+/**
+ * What the caller's parser decided about one callback.
+ *
+ * `retry` is the third state and the reason this is not a boolean: a state mismatch is
+ * a stray or forged callback, and the right response is to answer it and KEEP WAITING
+ * for the genuine one. Treating it as a failure would let anyone who can reach the
+ * loopback port cancel a legitimate consent flow.
+ */
+export type CallbackDecision<T> = {
+    ok: true;
+    value: T;
+    page: LoopbackPage;
+} | {
+    ok: false;
+    retry: boolean;
+    message: string;
+    page: LoopbackPage;
+};
+export interface LoopbackPage {
+    status: number;
+    html: string;
+}
+export interface LoopbackWaitOptions<T> {
+    /** Pick a free loopback port. Injected so tests never race a real ephemeral picker. */
+    pickPort: () => Promise<number>;
+    /** Build the console URL the browser opens, given the loopback redirect_uri. */
+    buildUrl: (redirectUri: string) => string;
+    /** Launch the browser. A no-op fake in tests; never fatal in production. */
+    openBrowser: (url: string) => void;
+    /** Interpret one callback's query params. Must verify `state` itself. */
+    parse: (params: URLSearchParams) => CallbackDecision<T>;
+    /** Abort if the round trip does not complete in time. */
+    timeoutMs: number;
+    /** Built when the wait times out, so each flow words its own transcript. */
+    onTimeout: () => Error;
+    /**
+     * Built when a callback is a TERMINAL failure. Injected for the same reason as
+     * onTimeout: each flow keeps its own error type, so callers can keep matching on
+     * theirs rather than on a shared one this extraction happened to introduce.
+     */
+    onCallbackError?: (message: string) => Error;
+    /** Narration (the "→ Opening…" / printed-URL / "Waiting…" lines). */
+    onProgress?: (line: string) => void;
+    /** The loopback path the console redirects to. Defaults to /callback. */
+    path?: string;
+}
+/**
+ * Run one loopback round trip and resolve with whatever `parse` extracted.
+ *
+ * Ordering is security-load-bearing and is the reason this function exists at all:
+ *   1. pick the port and START LISTENING,
+ *   2. only then open the browser + print the fallback URL,
+ *   3. verify `state` on every callback before reading anything else from it,
+ *   4. bound the wait.
+ */
+export declare function waitForLoopbackCallback<T>(opts: LoopbackWaitOptions<T>): Promise<T>;
+/**
+ * Verify `state` constant-time and hand back the remaining params.
+ *
+ * State is checked FIRST, always, before any other field is read, so a forged or stray
+ * callback can never drive a decision. Shared with pkce.parseCallback's discipline; kept
+ * here as a helper so a caller writing its own `parse` cannot forget it.
+ */
+export declare function verifiedState(params: URLSearchParams, expected: string): boolean;

package/dist/login/loopback.js

@@ -0,0 +1,119 @@
+// The browser round-trip primitive: start a loopback listener on 127.0.0.1, open the
+// browser at a console URL, and wait for the console to redirect back with a verified
+// `state`.
+//
+// EXTRACTED from pkceLogin.ts rather than copied. `vincentt login` (PKCE) and
+// `vincentt dx enable` (account consent) are two flows with the same security-critical
+// skeleton, and the skeleton is exactly the part that must not drift between them: the
+// listener comes up BEFORE the browser (a browser that redirects to a port nobody is
+// listening on loses the answer), `state` is verified constant-time on every callback,
+// a mismatch is answered but NOT accepted, and the wait is bounded. Two copies of that
+// would mean a fix applied to one and not the other — and the un-fixed one is a consent
+// gate.
+//
+// Every external boundary stays injected (port picker, listen, browser open, clock) so
+// callers are unit-testable with no real socket.
+import { createServer } from "node:http";
+import { stateMatches } from "./pkce.js";
+/** Thrown when the wait elapses with no answer from the browser. */
+export class LoopbackTimeoutError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "LoopbackTimeoutError";
+    }
+}
+/** Thrown when the callback is a terminal failure (a cancel, a malformed answer). */
+export class LoopbackCallbackError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "LoopbackCallbackError";
+    }
+}
+/**
+ * Run one loopback round trip and resolve with whatever `parse` extracted.
+ *
+ * Ordering is security-load-bearing and is the reason this function exists at all:
+ *   1. pick the port and START LISTENING,
+ *   2. only then open the browser + print the fallback URL,
+ *   3. verify `state` on every callback before reading anything else from it,
+ *   4. bound the wait.
+ */
+export function waitForLoopbackCallback(opts) {
+    const callbackPath = opts.path ?? "/callback";
+    return new Promise((resolve, reject) => {
+        void (async () => {
+            let port;
+            try {
+                port = await opts.pickPort();
+            }
+            catch (err) {
+                reject(err);
+                return;
+            }
+            const redirectUri = `http://127.0.0.1:${port}${callbackPath}`;
+            const url = opts.buildUrl(redirectUri);
+            const progress = opts.onProgress ?? (() => { });
+            const server = createServer((req, res) => {
+                // A received request always carries a url; the base makes it absolute for parsing.
+                const parsed = new URL(req.url, `http://127.0.0.1:${port}`);
+                if (parsed.pathname !== callbackPath) {
+                    res.writeHead(404, { "content-type": "text/plain" });
+                    res.end("Not found");
+                    return;
+                }
+                const decision = opts.parse(parsed.searchParams);
+                res.writeHead(decision.page.status, {
+                    "content-type": "text/html; charset=utf-8",
+                });
+                res.end(decision.page.html);
+                if (decision.ok) {
+                    server.close();
+                    resolve(decision.value);
+                }
+                else if (!decision.retry) {
+                    server.close();
+                    reject(opts.onCallbackError?.(decision.message) ??
+                        new LoopbackCallbackError(decision.message));
+                }
+                // retry === true: answered, still listening for the genuine callback.
+            });
+            server.on("error", reject);
+            server.listen(port, "127.0.0.1", () => {
+                for (const line of progressLines(url))
+                    progress(line);
+                opts.openBrowser(url);
+            });
+            const timer = setTimeout(() => {
+                server.close();
+                reject(opts.onTimeout());
+            }, opts.timeoutMs);
+            timer.unref();
+        })();
+    });
+}
+/**
+ * The narration, including the printed URL.
+ *
+ * The URL is printed on EVERY run, not only when the open fails, because the CLI cannot
+ * tell whether a browser actually appeared — `open`/`xdg-open` exits 0 on a headless box
+ * with nothing to show. On the agent-driven flow this whole feature exists for, the
+ * printed URL is frequently the only way the human ever reaches the page.
+ */
+function progressLines(url) {
+    return [
+        "→ Opening your browser…",
+        `  If it doesn't open, visit: ${url}`,
+        "",
+        "  Waiting for you to answer in the browser…",
+    ];
+}
+/**
+ * Verify `state` constant-time and hand back the remaining params.
+ *
+ * State is checked FIRST, always, before any other field is read, so a forged or stray
+ * callback can never drive a decision. Shared with pkce.parseCallback's discipline; kept
+ * here as a helper so a caller writing its own `parse` cannot forget it.
+ */
+export function verifiedState(params, expected) {
+    return stateMatches(expected, params.get("state"));
+}

package/dist/login/pkceLogin.d.ts

@@ -43,6 +43,7 @@ type SpawnLike = (cmd: string, args: string[], opts: {
 };
 /** Launch the browser via an injected spawn; a throw is swallowed (fallback = the printed URL). */
 export declare function launchBrowser(url: string, spawn: SpawnLike, platform?: string): void;
+export declare function browserPage(ok: boolean, heading: string, body: string): string;
 /**
  * Run the loopback + PKCE exchange, persist the PAT, and confirm identity via /me.
  * Resolves with the confirmed identity + the config path; rejects with LoginTimeoutError

package/dist/login/pkceLogin.js

@@ -11,11 +11,11 @@
 // Every external boundary is injected (getFreePort, listen, openBrowser, backend, clock/
 // timeout, config write) so the whole flow is unit-testable against a stub backend + fake
 // browser + temp config dir, with no real socket or network.
-import { createServer } from "node:http";
 import { getFreePort } from "../preview/net.js";
 import { writeMachineConfig } from "../shared/config.js";
 import { makePkceMaterial, buildCliAuthUrl, parseCallback, } from "./pkce.js";
 import { httpAuthBackend } from "./authBackend.js";
+import { waitForLoopbackCallback } from "./loopback.js";
 /** Thrown when the wait elapses with no approval; drives the L4 timeout transcript. */
 export class LoginTimeoutError extends Error {
     constructor() {
@@ -57,7 +57,10 @@ function defaultOpenBrowser(url) {
 // AuthLayout auth-card is mirrored here token-for-token: --color-sand page, white
 // --color-surface card (rounded-2xl, p-7), the terminal glyph on --color-primary-faint,
 // and the light/dark palette. A subtle green/red tints only the glyph on ok/failure.
-function browserPage(ok, heading, body) {
+//
+// Exported so `dx enable`'s consent round trip renders the SAME page rather than growing
+// a second, drifting copy of the console's card.
+export function browserPage(ok, heading, body) {
     // The terminal glyph the console uses on the Grant-CLI screen (icons.terminal).
     const glyph = '<svg width="22" height="22" viewBox="0 0 24 24" fill="none" stroke="currentColor" ' +
         'stroke-width="2" stroke-linecap="round" stroke-linejoin="round">' +
@@ -102,51 +105,44 @@ export async function runPkceLogin(opts) {
         ((apiUrl, pat) => writeMachineConfig({ apiUrl, pat, consoleUrl: opts.consoleUrl }));
     const progress = opts.onProgress ?? (() => { });
     const material = makePkceMaterial();
-    const port = await pickPort();
-    const redirectUri = `http://127.0.0.1:${port}/callback`;
-    const authUrl = buildCliAuthUrl(opts.consoleUrl, redirectUri, material);
-    // (4) await the loopback callback; verify state; hand back the auth_code.
-    const code = await new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
-            // A received request always carries a url; the base makes it absolute for parsing.
-            const url = new URL(req.url, `http://127.0.0.1:${port}`);
-            if (url.pathname !== "/callback") {
-                res.writeHead(404, { "content-type": "text/plain" });
-                res.end("Not found");
-                return;
-            }
-            const result = parseCallback(url.searchParams, material.state);
-            res.writeHead(result.ok ? 200 : 400, {
-                "content-type": "text/html; charset=utf-8",
-            });
-            res.end(result.ok
-                ? browserPage(true, "You're all set", "Return to your terminal — you can close this tab.")
-                : browserPage(false, "Sign-in failed", result.message));
+    // (1)–(4): listener up first, browser second, state verified on every callback,
+    // bounded wait. The mechanics live in waitForLoopbackCallback, shared with
+    // `dx enable` so the two flows cannot drift apart.
+    const code = await waitForLoopbackCallback({
+        pickPort,
+        buildUrl: (redirectUri) => buildCliAuthUrl(opts.consoleUrl, redirectUri, material),
+        openBrowser,
+        timeoutMs: opts.timeoutMs ?? 5 * 60_000,
+        onTimeout: () => new LoginTimeoutError(),
+        onCallbackError: (message) => new LoginCallbackError(message),
+        onProgress: (line) => {
+            // The login transcript says "sign in" where the generic narration says
+            // "answer" — same lines, this flow's words.
+            progress(line
+                .replace("→ Opening your browser…", "→ Opening your browser to sign in…")
+                .replace("  Waiting for you to answer in the browser…", "  Waiting for you to approve access in the browser…"));
+        },
+        parse: (params) => {
+            const result = parseCallback(params, material.state);
             if (result.ok) {
-                server.close();
-                resolve(result.code);
-            }
-            else if (result.reason !== "state_mismatch") {
-                // A cancel is a real, terminal failure. A state mismatch is a stray/forged
-                // callback — answer it but keep waiting for the genuine one (or the timeout).
-                server.close();
-                reject(new LoginCallbackError(result.message));
+                return {
+                    ok: true,
+                    value: result.code,
+                    page: {
+                        status: 200,
+                        html: browserPage(true, "You're all set", "Return to your terminal — you can close this tab."),
+                    },
+                };
             }
-        });
-        server.on("error", reject);
-        // (1) listener up FIRST; only then (3) open the browser + print the fallback.
-        server.listen(port, "127.0.0.1", () => {
-            progress("→ Opening your browser to sign in…");
-            progress(`  If it doesn't open, visit: ${authUrl}`);
-            progress("");
-            progress("  Waiting for you to approve access in the browser…");
-            openBrowser(authUrl);
-        });
-        const timer = setTimeout(() => {
-            server.close();
-            reject(new LoginTimeoutError());
-        }, opts.timeoutMs ?? 5 * 60_000);
-        timer.unref();
+            // A cancel is a real, terminal failure. A state mismatch is a stray/forged
+            // callback — answer it but keep waiting for the genuine one (or the timeout).
+            return {
+                ok: false,
+                retry: result.reason === "state_mismatch",
+                message: result.message,
+                page: { status: 400, html: browserPage(false, "Sign-in failed", result.message) },
+            };
+        },
     });
     // (5) redeem the code for the raw PAT; (6) persist then confirm identity.
     const pat = await backend.exchange(code, material.codeVerifier);

package/dist/shared/config.d.ts

@@ -56,6 +56,14 @@ export declare function writeDxEnablement(next: {
  * other field by design, which would leave a disconnected machine still armed to
  * transmit for whoever signs in next — a creator who disconnects a machine has
  * disconnected it.
+ *
+ * The ACCOUNT-WIDE grant is deliberately NOT revoked here, and that asymmetry is the
+ * point: the local flag is a statement about this machine, so disconnecting the machine
+ * retracts it, while the account grant is a separate deliberate decision that lives in
+ * the console and covers machines this one knows nothing about. Signing out of a laptop
+ * is not a statement about a desktop. `vincentt dx disable` is the verb that revokes the
+ * account grant; `logout` only ever clears local state, which also keeps it free of a
+ * network call that could fail and strand a sign-out.
  */
 export declare function clearMachineToken(): Promise<{
     path: string;

package/dist/shared/config.js

@@ -112,6 +112,14 @@ export async function writeDxEnablement(next) {
  * other field by design, which would leave a disconnected machine still armed to
  * transmit for whoever signs in next — a creator who disconnects a machine has
  * disconnected it.
+ *
+ * The ACCOUNT-WIDE grant is deliberately NOT revoked here, and that asymmetry is the
+ * point: the local flag is a statement about this machine, so disconnecting the machine
+ * retracts it, while the account grant is a separate deliberate decision that lives in
+ * the console and covers machines this one knows nothing about. Signing out of a laptop
+ * is not a statement about a desktop. `vincentt dx disable` is the verb that revokes the
+ * account grant; `logout` only ever clears local state, which also keeps it free of a
+ * network call that could fail and strand a sign-out.
  */
 export async function clearMachineToken() {
     const current = await loadMachineConfig();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincentt-xr/cli",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay)",
   "license": "UNLICENSED",
   "type": "module",