@xortex/xcode 3.0.1 → 3.0.3

package/buddy/useBuddyNotification.tsx

@@ -0,0 +1,98 @@
+import { c as _c } from "react/compiler-runtime";
+import { feature } from 'bun:bundle';
+import React, { useEffect } from 'react';
+import { useNotifications } from '../context/notifications.js';
+import { Text } from '../ink.js';
+import { getGlobalConfig } from '../utils/config.js';
+import { getRainbowColor } from '../utils/thinking.js';
+
+// Local date, not UTC — 24h rolling wave across timezones. Sustained Twitter
+// buzz instead of a single UTC-midnight spike, gentler on soul-gen load.
+// Teaser window: April 1-7, 2026 only. Command stays live forever after.
+export function isBuddyTeaserWindow(): boolean {
+  if ("external" === 'ant') return true;
+  const d = new Date();
+  return d.getFullYear() === 2026 && d.getMonth() === 3 && d.getDate() <= 7;
+}
+export function isBuddyLive(): boolean {
+  if ("external" === 'ant') return true;
+  const d = new Date();
+  return d.getFullYear() > 2026 || d.getFullYear() === 2026 && d.getMonth() >= 3;
+}
+function RainbowText(t0) {
+  const $ = _c(2);
+  const {
+    text
+  } = t0;
+  let t1;
+  if ($[0] !== text) {
+    t1 = <>{[...text].map(_temp)}</>;
+    $[0] = text;
+    $[1] = t1;
+  } else {
+    t1 = $[1];
+  }
+  return t1;
+}
+
+// Rainbow /buddy teaser shown on startup when no companion hatched yet.
+// Idle presence and reactions are handled by CompanionSprite directly.
+function _temp(ch, i) {
+  return <Text key={i} color={getRainbowColor(i)}>{ch}</Text>;
+}
+export function useBuddyNotification() {
+  const $ = _c(4);
+  const {
+    addNotification,
+    removeNotification
+  } = useNotifications();
+  let t0;
+  let t1;
+  if ($[0] !== addNotification || $[1] !== removeNotification) {
+    t0 = () => {
+      if (!feature("BUDDY")) {
+        return;
+      }
+      const config = getGlobalConfig();
+      if (config.companion || !isBuddyTeaserWindow()) {
+        return;
+      }
+      addNotification({
+        key: "buddy-teaser",
+        jsx: <RainbowText text="/buddy" />,
+        priority: "immediate",
+        timeoutMs: 15000
+      });
+      return () => removeNotification("buddy-teaser");
+    };
+    t1 = [addNotification, removeNotification];
+    $[0] = addNotification;
+    $[1] = removeNotification;
+    $[2] = t0;
+    $[3] = t1;
+  } else {
+    t0 = $[2];
+    t1 = $[3];
+  }
+  useEffect(t0, t1);
+}
+export function findBuddyTriggerPositions(text: string): Array<{
+  start: number;
+  end: number;
+}> {
+  if (!feature('BUDDY')) return [];
+  const triggers: Array<{
+    start: number;
+    end: number;
+  }> = [];
+  const re = /\/buddy\b/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    triggers.push({
+      start: m.index,
+      end: m.index + m[0].length
+    });
+  }
+  return triggers;
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJmZWF0dXJlIiwiUmVhY3QiLCJ1c2VFZmZlY3QiLCJ1c2VOb3RpZmljYXRpb25zIiwiVGV4dCIsImdldEdsb2JhbENvbmZpZyIsImdldFJhaW5ib3dDb2xvciIsImlzQnVkZHlUZWFzZXJXaW5kb3ciLCJkIiwiRGF0ZSIsImdldEZ1bGxZZWFyIiwiZ2V0TW9udGgiLCJnZXREYXRlIiwiaXNCdWRkeUxpdmUiLCJSYWluYm93VGV4dCIsInQwIiwiJCIsIl9jIiwidGV4dCIsInQxIiwibWFwIiwiX3RlbXAiLCJjaCIsImkiLCJ1c2VCdWRkeU5vdGlmaWNhdGlvbiIsImFkZE5vdGlmaWNhdGlvbiIsInJlbW92ZU5vdGlmaWNhdGlvbiIsImNvbmZpZyIsImNvbXBhbmlvbiIsImtleSIsImpzeCIsInByaW9yaXR5IiwidGltZW91dE1zIiwiZmluZEJ1ZGR5VHJpZ2dlclBvc2l0aW9ucyIsIkFycmF5Iiwic3RhcnQiLCJlbmQiLCJ0cmlnZ2VycyIsInJlIiwibSIsIlJlZ0V4cEV4ZWNBcnJheSIsImV4ZWMiLCJwdXNoIiwiaW5kZXgiLCJsZW5ndGgiXSwic291cmNlcyI6WyJ1c2VCdWRkeU5vdGlmaWNhdGlvbi50c3giXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgZmVhdHVyZSB9IGZyb20gJ2J1bjpidW5kbGUnXG5pbXBvcnQgUmVhY3QsIHsgdXNlRWZmZWN0IH0gZnJvbSAncmVhY3QnXG5pbXBvcnQgeyB1c2VOb3RpZmljYXRpb25zIH0gZnJvbSAnLi4vY29udGV4dC9ub3RpZmljYXRpb25zLmpzJ1xuaW1wb3J0IHsgVGV4dCB9IGZyb20gJy4uL2luay5qcydcbmltcG9ydCB7IGdldEdsb2JhbENvbmZpZyB9IGZyb20gJy4uL3V0aWxzL2NvbmZpZy5qcydcbmltcG9ydCB7IGdldFJhaW5ib3dDb2xvciB9IGZyb20gJy4uL3V0aWxzL3RoaW5raW5nLmpzJ1xuXG4vLyBMb2NhbCBkYXRlLCBub3QgVVRDIOKAlCAyNGggcm9sbGluZyB3YXZlIGFjcm9zcyB0aW1lem9uZXMuIFN1c3RhaW5lZCBUd2l0dGVyXG4vLyBidXp6IGluc3RlYWQgb2YgYSBzaW5nbGUgVVRDLW1pZG5pZ2h0IHNwaWtlLCBnZW50bGVyIG9uIHNvdWwtZ2VuIGxvYWQuXG4vLyBUZWFzZXIgd2luZG93OiBBcHJpbCAxLTcsIDIwMjYgb25seS4gQ29tbWFuZCBzdGF5cyBsaXZlIGZvcmV2ZXIgYWZ0ZXIuXG5leHBvcnQgZnVuY3Rpb24gaXNCdWRkeVRlYXNlcldpbmRvdygpOiBib29sZWFuIHtcbiAgaWYgKFwiZXh0ZXJuYWxcIiA9PT0gJ2FudCcpIHJldHVybiB0cnVlXG4gIGNvbnN0IGQgPSBuZXcgRGF0ZSgpXG4gIHJldHVybiBkLmdldEZ1bGxZZWFyKCkgPT09IDIwMjYgJiYgZC5nZXRNb250aCgpID09PSAzICYmIGQuZ2V0RGF0ZSgpIDw9IDdcbn1cblxuZXhwb3J0IGZ1bmN0aW9uIGlzQnVkZHlMaXZlKCk6IGJvb2xlYW4ge1xuICBpZiAoXCJleHRlcm5hbFwiID09PSAnYW50JykgcmV0dXJuIHRydWVcbiAgY29uc3QgZCA9IG5ldyBEYXRlKClcbiAgcmV0dXJuIChcbiAgICBkLmdldEZ1bGxZZWFyKCkgPiAyMDI2IHx8IChkLmdldEZ1bGxZZWFyKCkgPT09IDIwMjYgJiYgZC5nZXRNb250aCgpID49IDMpXG4gIClcbn1cblxuZnVuY3Rpb24gUmFpbmJvd1RleHQoeyB0ZXh0IH06IHsgdGV4dDogc3RyaW5nIH0pOiBSZWFjdC5SZWFjdE5vZGUge1xuICByZXR1cm4gKFxuICAgIDw+XG4gICAgICB7Wy4uLnRleHRdLm1hcCgoY2gsIGkpID0+IChcbiAgICAgICAgPFRleHQga2V5PXtpfSBjb2xvcj17Z2V0UmFpbmJvd0NvbG9yKGkpfT5cbiAgICAgICAgICB7Y2h9XG4gICAgICAgIDwvVGV4dD5cbiAgICAgICkpfVxuICAgIDwvPlxuICApXG59XG5cbi8vIFJhaW5ib3cgL2J1ZGR5IHRlYXNlciBzaG93biBvbiBzdGFydHVwIHdoZW4gbm8gY29tcGFuaW9uIGhhdGNoZWQgeWV0LlxuLy8gSWRsZSBwcmVzZW5jZSBhbmQgcmVhY3Rpb25zIGFyZSBoYW5kbGVkIGJ5IENvbXBhbmlvblNwcml0ZSBkaXJlY3RseS5cbmV4cG9ydCBmdW5jdGlvbiB1c2VCdWRkeU5vdGlmaWNhdGlvbigpOiB2b2lkIHtcbiAgY29uc3QgeyBhZGROb3RpZmljYXRpb24sIHJlbW92ZU5vdGlmaWNhdGlvbiB9ID0gdXNlTm90aWZpY2F0aW9ucygpXG5cbiAgdXNlRWZmZWN0KCgpID0+IHtcbiAgICBpZiAoIWZlYXR1cmUoJ0JVRERZJykpIHJldHVyblxuICAgIGNvbnN0IGNvbmZpZyA9IGdldEdsb2JhbENvbmZpZygpXG4gICAgaWYgKGNvbmZpZy5jb21wYW5pb24gfHwgIWlzQnVkZHlUZWFzZXJXaW5kb3coKSkgcmV0dXJuXG4gICAgYWRkTm90aWZpY2F0aW9uKHtcbiAgICAgIGtleTogJ2J1ZGR5LXRlYXNlcicsXG4gICAgICBqc3g6IDxSYWluYm93VGV4dCB0ZXh0PVwiL2J1ZGR5XCIgLz4sXG4gICAgICBwcmlvcml0eTogJ2ltbWVkaWF0ZScsXG4gICAgICB0aW1lb3V0TXM6IDE1XzAwMCxcbiAgICB9KVxuICAgIHJldHVybiAoKSA9PiByZW1vdmVOb3RpZmljYXRpb24oJ2J1ZGR5LXRlYXNlcicpXG4gIH0sIFthZGROb3RpZmljYXRpb24sIHJlbW92ZU5vdGlmaWNhdGlvbl0pXG59XG5cbmV4cG9ydCBmdW5jdGlvbiBmaW5kQnVkZHlUcmlnZ2VyUG9zaXRpb25zKFxuICB0ZXh0OiBzdHJpbmcsXG4pOiBBcnJheTx7IHN0YXJ0OiBudW1iZXI7IGVuZDogbnVtYmVyIH0+IHtcbiAgaWYgKCFmZWF0dXJlKCdCVUREWScpKSByZXR1cm4gW11cbiAgY29uc3QgdHJpZ2dlcnM6IEFycmF5PHsgc3RhcnQ6IG51bWJlcjsgZW5kOiBudW1iZXIgfT4gPSBbXVxuICBjb25zdCByZSA9IC9cXC9idWRkeVxcYi9nXG4gIGxldCBtOiBSZWdFeHBFeGVjQXJyYXkgfCBudWxsXG4gIHdoaWxlICgobSA9IHJlLmV4ZWModGV4dCkpICE9PSBudWxsKSB7XG4gICAgdHJpZ2dlcnMucHVzaCh7IHN0YXJ0OiBtLmluZGV4LCBlbmQ6IG0uaW5kZXggKyBtWzBdLmxlbmd0aCB9KVxuICB9XG4gIHJldHVybiB0cmlnZ2Vyc1xufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsU0FBU0EsT0FBTyxRQUFRLFlBQVk7QUFDcEMsT0FBT0MsS0FBSyxJQUFJQyxTQUFTLFFBQVEsT0FBTztBQUN4QyxTQUFTQyxnQkFBZ0IsUUFBUSw2QkFBNkI7QUFDOUQsU0FBU0MsSUFBSSxRQUFRLFdBQVc7QUFDaEMsU0FBU0MsZUFBZSxRQUFRLG9CQUFvQjtBQUNwRCxTQUFTQyxlQUFlLFFBQVEsc0JBQXNCOztBQUV0RDtBQUNBO0FBQ0E7QUFDQSxPQUFPLFNBQVNDLG1CQUFtQkEsQ0FBQSxDQUFFLEVBQUUsT0FBTyxDQUFDO0VBQzdDLElBQUksVUFBVSxLQUFLLEtBQUssRUFBRSxPQUFPLElBQUk7RUFDckMsTUFBTUMsQ0FBQyxHQUFHLElBQUlDLElBQUksQ0FBQyxDQUFDO0VBQ3BCLE9BQU9ELENBQUMsQ0FBQ0UsV0FBVyxDQUFDLENBQUMsS0FBSyxJQUFJLElBQUlGLENBQUMsQ0FBQ0csUUFBUSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUlILENBQUMsQ0FBQ0ksT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDO0FBQzNFO0FBRUEsT0FBTyxTQUFTQyxXQUFXQSxDQUFBLENBQUUsRUFBRSxPQUFPLENBQUM7RUFDckMsSUFBSSxVQUFVLEtBQUssS0FBSyxFQUFFLE9BQU8sSUFBSTtFQUNyQyxNQUFNTCxDQUFDLEdBQUcsSUFBSUMsSUFBSSxDQUFDLENBQUM7RUFDcEIsT0FDRUQsQ0FBQyxDQUFDRSxXQUFXLENBQUMsQ0FBQyxHQUFHLElBQUksSUFBS0YsQ0FBQyxDQUFDRSxXQUFXLENBQUMsQ0FBQyxLQUFLLElBQUksSUFBSUYsQ0FBQyxDQUFDRyxRQUFRLENBQUMsQ0FBQyxJQUFJLENBQUU7QUFFN0U7QUFFQSxTQUFBRyxZQUFBQyxFQUFBO0VBQUEsTUFBQUMsQ0FBQSxHQUFBQyxFQUFBO0VBQXFCO0lBQUFDO0VBQUEsSUFBQUgsRUFBMEI7RUFBQSxJQUFBSSxFQUFBO0VBQUEsSUFBQUgsQ0FBQSxRQUFBRSxJQUFBO0lBRTNDQyxFQUFBLEtBQ0csS0FBSUQsSUFBSSxDQUFDLENBQUFFLEdBQUksQ0FBQ0MsS0FJZCxFQUFDLEdBQ0Q7SUFBQUwsQ0FBQSxNQUFBRSxJQUFBO0lBQUFGLENBQUEsTUFBQUcsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQUgsQ0FBQTtFQUFBO0VBQUEsT0FOSEcsRUFNRztBQUFBOztBQUlQO0FBQ0E7QUFiQSxTQUFBRSxNQUFBQyxFQUFBLEVBQUFDLENBQUE7RUFBQSxPQUlRLENBQUMsSUFBSSxDQUFNQSxHQUFDLENBQURBLEVBQUEsQ0FBQyxDQUFTLEtBQWtCLENBQWxCLENBQUFqQixlQUFlLENBQUNpQixDQUFDLEVBQUMsQ0FDcENELEdBQUMsQ0FDSixFQUZDLElBQUksQ0FFRTtBQUFBO0FBUWYsT0FBTyxTQUFBRSxxQkFBQTtFQUFBLE1BQUFSLENBQUEsR0FBQUMsRUFBQTtFQUNMO0lBQUFRLGVBQUE7SUFBQUM7RUFBQSxJQUFnRHZCLGdCQUFnQixDQUFDLENBQUM7RUFBQSxJQUFBWSxFQUFBO0VBQUEsSUFBQUksRUFBQTtFQUFBLElBQUFILENBQUEsUUFBQVMsZUFBQSxJQUFBVCxDQUFBLFFBQUFVLGtCQUFBO0lBRXhEWCxFQUFBLEdBQUFBLENBQUE7TUFDUixJQUFJLENBQUNmLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFBQTtNQUFBO01BQ3JCLE1BQUEyQixNQUFBLEdBQWV0QixlQUFlLENBQUMsQ0FBQztNQUNoQyxJQUFJc0IsTUFBTSxDQUFBQyxTQUFvQyxJQUExQyxDQUFxQnJCLG1CQUFtQixDQUFDLENBQUM7UUFBQTtNQUFBO01BQzlDa0IsZUFBZSxDQUFDO1FBQUFJLEdBQUEsRUFDVCxjQUFjO1FBQUFDLEdBQUEsRUFDZCxDQUFDLFdBQVcsQ0FBTSxJQUFRLENBQVIsUUFBUSxHQUFHO1FBQUFDLFFBQUEsRUFDeEIsV0FBVztRQUFBQyxTQUFBLEVBQ1Y7TUFDYixDQUFDLENBQUM7TUFBQSxPQUNLLE1BQU1OLGtCQUFrQixDQUFDLGNBQWMsQ0FBQztJQUFBLENBQ2hEO0lBQUVQLEVBQUEsSUFBQ00sZUFBZSxFQUFFQyxrQkFBa0IsQ0FBQztJQUFBVixDQUFBLE1BQUFTLGVBQUE7SUFBQVQsQ0FBQSxNQUFBVSxrQkFBQTtJQUFBVixDQUFBLE1BQUFELEVBQUE7SUFBQUMsQ0FBQSxNQUFBRyxFQUFBO0VBQUE7SUFBQUosRUFBQSxHQUFBQyxDQUFBO0lBQUFHLEVBQUEsR0FBQUgsQ0FBQTtFQUFBO0VBWHhDZCxTQUFTLENBQUNhLEVBV1QsRUFBRUksRUFBcUMsQ0FBQztBQUFBO0FBRzNDLE9BQU8sU0FBU2MseUJBQXlCQSxDQUN2Q2YsSUFBSSxFQUFFLE1BQU0sQ0FDYixFQUFFZ0IsS0FBSyxDQUFDO0VBQUVDLEtBQUssRUFBRSxNQUFNO0VBQUVDLEdBQUcsRUFBRSxNQUFNO0FBQUMsQ0FBQyxDQUFDLENBQUM7RUFDdkMsSUFBSSxDQUFDcEMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRTtFQUNoQyxNQUFNcUMsUUFBUSxFQUFFSCxLQUFLLENBQUM7SUFBRUMsS0FBSyxFQUFFLE1BQU07SUFBRUMsR0FBRyxFQUFFLE1BQU07RUFBQyxDQUFDLENBQUMsR0FBRyxFQUFFO0VBQzFELE1BQU1FLEVBQUUsR0FBRyxZQUFZO0VBQ3ZCLElBQUlDLENBQUMsRUFBRUMsZUFBZSxHQUFHLElBQUk7RUFDN0IsT0FBTyxDQUFDRCxDQUFDLEdBQUdELEVBQUUsQ0FBQ0csSUFBSSxDQUFDdkIsSUFBSSxDQUFDLE1BQU0sSUFBSSxFQUFFO0lBQ25DbUIsUUFBUSxDQUFDSyxJQUFJLENBQUM7TUFBRVAsS0FBSyxFQUFFSSxDQUFDLENBQUNJLEtBQUs7TUFBRVAsR0FBRyxFQUFFRyxDQUFDLENBQUNJLEtBQUssR0FBR0osQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDSztJQUFPLENBQUMsQ0FBQztFQUMvRDtFQUNBLE9BQU9QLFFBQVE7QUFDakIiLCJpZ25vcmVMaXN0IjpbXX0=

package/cli/exit.ts

@@ -0,0 +1,31 @@
+/**
+ * CLI exit helpers for subcommand handlers.
+ *
+ * Consolidates the 4-5 line "print + lint-suppress + exit" block that was
+ * copy-pasted ~60 times across `claude mcp *` / `claude plugin *` handlers.
+ * The `: never` return type lets TypeScript narrow control flow at call sites
+ * without a trailing `return`.
+ */
+/* eslint-disable custom-rules/no-process-exit -- centralized CLI exit point */
+
+// `return undefined as never` (not a post-exit throw) — tests spy on
+// process.exit and let it return. Call sites write `return cliError(...)`
+// where subsequent code would dereference narrowed-away values under mock.
+// cliError uses console.error (tests spy on console.error); cliOk uses
+// process.stdout.write (tests spy on process.stdout.write — Bun's console.log
+// doesn't route through a spied process.stdout.write).
+
+/** Write an error message to stderr (if given) and exit with code 1. */
+export function cliError(msg?: string): never {
+  // biome-ignore lint/suspicious/noConsole: centralized CLI error output
+  if (msg) console.error(msg)
+  process.exit(1)
+  return undefined as never
+}
+
+/** Write a message to stdout (if given) and exit with code 0. */
+export function cliOk(msg?: string): never {
+  if (msg) process.stdout.write(msg + '\n')
+  process.exit(0)
+  return undefined as never
+}

package/cli/handlers/agents.ts

@@ -0,0 +1,70 @@
+/**
+ * Agents subcommand handler — prints the list of configured agents.
+ * Dynamically imported only when `claude agents` runs.
+ */
+
+import {
+  AGENT_SOURCE_GROUPS,
+  compareAgentsByName,
+  getOverrideSourceLabel,
+  type ResolvedAgent,
+  resolveAgentModelDisplay,
+  resolveAgentOverrides,
+} from '../../tools/AgentTool/agentDisplay.js'
+import {
+  getActiveAgentsFromList,
+  getAgentDefinitionsWithOverrides,
+} from '../../tools/AgentTool/loadAgentsDir.js'
+import { getCwd } from '../../utils/cwd.js'
+
+function formatAgent(agent: ResolvedAgent): string {
+  const model = resolveAgentModelDisplay(agent)
+  const parts = [agent.agentType]
+  if (model) {
+    parts.push(model)
+  }
+  if (agent.memory) {
+    parts.push(`${agent.memory} memory`)
+  }
+  return parts.join(' · ')
+}
+
+export async function agentsHandler(): Promise<void> {
+  const cwd = getCwd()
+  const { allAgents } = await getAgentDefinitionsWithOverrides(cwd)
+  const activeAgents = getActiveAgentsFromList(allAgents)
+  const resolvedAgents = resolveAgentOverrides(allAgents, activeAgents)
+
+  const lines: string[] = []
+  let totalActive = 0
+
+  for (const { label, source } of AGENT_SOURCE_GROUPS) {
+    const groupAgents = resolvedAgents
+      .filter(a => a.source === source)
+      .sort(compareAgentsByName)
+
+    if (groupAgents.length === 0) continue
+
+    lines.push(`${label}:`)
+    for (const agent of groupAgents) {
+      if (agent.overriddenBy) {
+        const winnerSource = getOverrideSourceLabel(agent.overriddenBy)
+        lines.push(`  (shadowed by ${winnerSource}) ${formatAgent(agent)}`)
+      } else {
+        lines.push(`  ${formatAgent(agent)}`)
+        totalActive++
+      }
+    }
+    lines.push('')
+  }
+
+  if (lines.length === 0) {
+    // biome-ignore lint/suspicious/noConsole:: intentional console output
+    console.log('No agents found.')
+  } else {
+    // biome-ignore lint/suspicious/noConsole:: intentional console output
+    console.log(`${totalActive} active agents\n`)
+    // biome-ignore lint/suspicious/noConsole:: intentional console output
+    console.log(lines.join('\n').trimEnd())
+  }
+}

package/cli/handlers/auth.ts

@@ -0,0 +1,330 @@
+/* eslint-disable custom-rules/no-process-exit -- CLI subcommand handler intentionally exits */
+
+import {
+  clearAuthRelatedCaches,
+  performLogout,
+} from '../../commands/logout/logout.js'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../services/analytics/index.js'
+import { getSSLErrorHint } from '../../services/api/errorUtils.js'
+import { fetchAndStoreClaudeCodeFirstTokenDate } from '../../services/api/firstTokenDate.js'
+import {
+  createAndStoreApiKey,
+  fetchAndStoreUserRoles,
+  refreshOAuthToken,
+  shouldUseClaudeAIAuth,
+  storeOAuthAccountInfo,
+} from '../../services/oauth/client.js'
+import { getOauthProfileFromOauthToken } from '../../services/oauth/getOauthProfile.js'
+import { OAuthService } from '../../services/oauth/index.js'
+import type { OAuthTokens } from '../../services/oauth/types.js'
+import {
+  clearOAuthTokenCache,
+  getAnthropicApiKeyWithSource,
+  getAuthTokenSource,
+  getOauthAccountInfo,
+  getSubscriptionType,
+  isUsing3PServices,
+  saveOAuthTokensIfNeeded,
+  validateForceLoginOrg,
+} from '../../utils/auth.js'
+import { saveGlobalConfig } from '../../utils/config.js'
+import { logForDebugging } from '../../utils/debug.js'
+import { isRunningOnHomespace } from '../../utils/envUtils.js'
+import { errorMessage } from '../../utils/errors.js'
+import { logError } from '../../utils/log.js'
+import { getAPIProvider } from '../../utils/model/providers.js'
+import { getInitialSettings } from '../../utils/settings/settings.js'
+import { jsonStringify } from '../../utils/slowOperations.js'
+import {
+  buildAccountProperties,
+  buildAPIProviderProperties,
+} from '../../utils/status.js'
+
+/**
+ * Shared post-token-acquisition logic. Saves tokens, fetches profile/roles,
+ * and sets up the local auth state.
+ */
+export async function installOAuthTokens(tokens: OAuthTokens): Promise<void> {
+  // Clear old state before saving new credentials
+  await performLogout({ clearOnboarding: false })
+
+  // Reuse pre-fetched profile if available, otherwise fetch fresh
+  const profile =
+    tokens.profile ?? (await getOauthProfileFromOauthToken(tokens.accessToken))
+  if (profile) {
+    storeOAuthAccountInfo({
+      accountUuid: profile.account.uuid,
+      emailAddress: profile.account.email,
+      organizationUuid: profile.organization.uuid,
+      displayName: profile.account.display_name || undefined,
+      hasExtraUsageEnabled:
+        profile.organization.has_extra_usage_enabled ?? undefined,
+      billingType: profile.organization.billing_type ?? undefined,
+      subscriptionCreatedAt:
+        profile.organization.subscription_created_at ?? undefined,
+      accountCreatedAt: profile.account.created_at,
+    })
+  } else if (tokens.tokenAccount) {
+    // Fallback to token exchange account data when profile endpoint fails
+    storeOAuthAccountInfo({
+      accountUuid: tokens.tokenAccount.uuid,
+      emailAddress: tokens.tokenAccount.emailAddress,
+      organizationUuid: tokens.tokenAccount.organizationUuid,
+    })
+  }
+
+  const storageResult = saveOAuthTokensIfNeeded(tokens)
+  clearOAuthTokenCache()
+
+  if (storageResult.warning) {
+    logEvent('tengu_oauth_storage_warning', {
+      warning:
+        storageResult.warning as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    })
+  }
+
+  // Roles and first-token-date may fail for limited-scope tokens (e.g.
+  // inference-only from setup-token). They're not required for core auth.
+  await fetchAndStoreUserRoles(tokens.accessToken).catch(err =>
+    logForDebugging(String(err), { level: 'error' }),
+  )
+
+  if (shouldUseClaudeAIAuth(tokens.scopes)) {
+    await fetchAndStoreClaudeCodeFirstTokenDate().catch(err =>
+      logForDebugging(String(err), { level: 'error' }),
+    )
+  } else {
+    // API key creation is critical for Console users — let it throw.
+    const apiKey = await createAndStoreApiKey(tokens.accessToken)
+    if (!apiKey) {
+      throw new Error(
+        'Unable to create API key. The server accepted the request but did not return a key.',
+      )
+    }
+  }
+
+  await clearAuthRelatedCaches()
+}
+
+export async function authLogin({
+  email,
+  sso,
+  console: useConsole,
+  claudeai,
+}: {
+  email?: string
+  sso?: boolean
+  console?: boolean
+  claudeai?: boolean
+}): Promise<void> {
+  if (useConsole && claudeai) {
+    process.stderr.write(
+      'Error: --console and --claudeai cannot be used together.\n',
+    )
+    process.exit(1)
+  }
+
+  const settings = getInitialSettings()
+  // forceLoginMethod is a hard constraint (enterprise setting) — matches ConsoleOAuthFlow behavior.
+  // Without it, --console selects Console; --claudeai (or no flag) selects claude.ai.
+  const loginWithClaudeAi = settings.forceLoginMethod
+    ? settings.forceLoginMethod === 'claudeai'
+    : !useConsole
+  const orgUUID = settings.forceLoginOrgUUID
+
+  // Fast path: if a refresh token is provided via env var, skip the browser
+  // OAuth flow and exchange it directly for tokens.
+  const envRefreshToken = process.env.CLAUDE_CODE_OAUTH_REFRESH_TOKEN
+  if (envRefreshToken) {
+    const envScopes = process.env.CLAUDE_CODE_OAUTH_SCOPES
+    if (!envScopes) {
+      process.stderr.write(
+        'CLAUDE_CODE_OAUTH_SCOPES is required when using CLAUDE_CODE_OAUTH_REFRESH_TOKEN.\n' +
+          'Set it to the space-separated scopes the refresh token was issued with\n' +
+          '(e.g. "user:inference" or "user:profile user:inference user:sessions:claude_code user:mcp_servers").\n',
+      )
+      process.exit(1)
+    }
+
+    const scopes = envScopes.split(/\s+/).filter(Boolean)
+
+    try {
+      logEvent('tengu_login_from_refresh_token', {})
+
+      const tokens = await refreshOAuthToken(envRefreshToken, { scopes })
+      await installOAuthTokens(tokens)
+
+      const orgResult = await validateForceLoginOrg()
+      if (!orgResult.valid) {
+        process.stderr.write(orgResult.message + '\n')
+        process.exit(1)
+      }
+
+      // Mark onboarding complete — interactive paths handle this via
+      // the Onboarding component, but the env var path skips it.
+      saveGlobalConfig(current => {
+        if (current.hasCompletedOnboarding) return current
+        return { ...current, hasCompletedOnboarding: true }
+      })
+
+      logEvent('tengu_oauth_success', {
+        loginWithClaudeAi: shouldUseClaudeAIAuth(tokens.scopes),
+      })
+      process.stdout.write('Login successful.\n')
+      process.exit(0)
+    } catch (err) {
+      logError(err)
+      const sslHint = getSSLErrorHint(err)
+      process.stderr.write(
+        `Login failed: ${errorMessage(err)}\n${sslHint ? sslHint + '\n' : ''}`,
+      )
+      process.exit(1)
+    }
+  }
+
+  const resolvedLoginMethod = sso ? 'sso' : undefined
+
+  const oauthService = new OAuthService()
+
+  try {
+    logEvent('tengu_oauth_flow_start', { loginWithClaudeAi })
+
+    const result = await oauthService.startOAuthFlow(
+      async url => {
+        process.stdout.write('Opening browser to sign in…\n')
+        process.stdout.write(`If the browser didn't open, visit: ${url}\n`)
+      },
+      {
+        loginWithClaudeAi,
+        loginHint: email,
+        loginMethod: resolvedLoginMethod,
+        orgUUID,
+      },
+    )
+
+    await installOAuthTokens(result)
+
+    const orgResult = await validateForceLoginOrg()
+    if (!orgResult.valid) {
+      process.stderr.write(orgResult.message + '\n')
+      process.exit(1)
+    }
+
+    logEvent('tengu_oauth_success', { loginWithClaudeAi })
+
+    process.stdout.write('Login successful.\n')
+    process.exit(0)
+  } catch (err) {
+    logError(err)
+    const sslHint = getSSLErrorHint(err)
+    process.stderr.write(
+      `Login failed: ${errorMessage(err)}\n${sslHint ? sslHint + '\n' : ''}`,
+    )
+    process.exit(1)
+  } finally {
+    oauthService.cleanup()
+  }
+}
+
+export async function authStatus(opts: {
+  json?: boolean
+  text?: boolean
+}): Promise<void> {
+  const { source: authTokenSource, hasToken } = getAuthTokenSource()
+  const { source: apiKeySource } = getAnthropicApiKeyWithSource()
+  const hasApiKeyEnvVar =
+    !!process.env.ANTHROPIC_API_KEY && !isRunningOnHomespace()
+  const oauthAccount = getOauthAccountInfo()
+  const subscriptionType = getSubscriptionType()
+  const using3P = isUsing3PServices()
+  const loggedIn =
+    hasToken || apiKeySource !== 'none' || hasApiKeyEnvVar || using3P
+
+  // Determine auth method
+  let authMethod: string = 'none'
+  if (using3P) {
+    authMethod = 'third_party'
+  } else if (authTokenSource === 'claude.ai') {
+    authMethod = 'claude.ai'
+  } else if (authTokenSource === 'apiKeyHelper') {
+    authMethod = 'api_key_helper'
+  } else if (authTokenSource !== 'none') {
+    authMethod = 'oauth_token'
+  } else if (apiKeySource === 'ANTHROPIC_API_KEY' || hasApiKeyEnvVar) {
+    authMethod = 'api_key'
+  } else if (apiKeySource === '/login managed key') {
+    authMethod = 'claude.ai'
+  }
+
+  if (opts.text) {
+    const properties = [
+      ...buildAccountProperties(),
+      ...buildAPIProviderProperties(),
+    ]
+    let hasAuthProperty = false
+    for (const prop of properties) {
+      const value =
+        typeof prop.value === 'string'
+          ? prop.value
+          : Array.isArray(prop.value)
+            ? prop.value.join(', ')
+            : null
+      if (value === null || value === 'none') {
+        continue
+      }
+      hasAuthProperty = true
+      if (prop.label) {
+        process.stdout.write(`${prop.label}: ${value}\n`)
+      } else {
+        process.stdout.write(`${value}\n`)
+      }
+    }
+    if (!hasAuthProperty && hasApiKeyEnvVar) {
+      process.stdout.write('API key: ANTHROPIC_API_KEY\n')
+    }
+    if (!loggedIn) {
+      process.stdout.write(
+        'Not logged in. Run claude auth login to authenticate.\n',
+      )
+    }
+  } else {
+    const apiProvider = getAPIProvider()
+    const resolvedApiKeySource =
+      apiKeySource !== 'none'
+        ? apiKeySource
+        : hasApiKeyEnvVar
+          ? 'ANTHROPIC_API_KEY'
+          : null
+    const output: Record<string, string | boolean | null> = {
+      loggedIn,
+      authMethod,
+      apiProvider,
+    }
+    if (resolvedApiKeySource) {
+      output.apiKeySource = resolvedApiKeySource
+    }
+    if (authMethod === 'claude.ai') {
+      output.email = oauthAccount?.emailAddress ?? null
+      output.orgId = oauthAccount?.organizationUuid ?? null
+      output.orgName = oauthAccount?.organizationName ?? null
+      output.subscriptionType = subscriptionType ?? null
+    }
+
+    process.stdout.write(jsonStringify(output, null, 2) + '\n')
+  }
+  process.exit(loggedIn ? 0 : 1)
+}
+
+export async function authLogout(): Promise<void> {
+  try {
+    await performLogout({ clearOnboarding: false })
+  } catch {
+    process.stderr.write('Failed to log out.\n')
+    process.exit(1)
+  }
+  process.stdout.write('Successfully logged out from your Anthropic account.\n')
+  process.exit(0)
+}