arcane-cli 1.11.3 → 1.11.5

package/dist/index.js

@@ -4,9 +4,9 @@ const require = __createRequire(import.meta.url);
 
 // src/index.ts
 import { Command } from "commander";
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname11, join as join20 } from "path";
+import { dirname as dirname12, join as join21 } from "path";
 
 // src/commands/init.ts
 import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
@@ -1214,15 +1214,15 @@ async function syncUserTierFanout(options) {
   const rendered = await renderUserFanout(options.storeRoot, options.spellIds, options.fallbackDir);
   const desired = [...rendered.files, ...options.extraFiles ?? []];
   const owned = options.ownedClients;
-  const ownsClient = (client) => owned === void 0 || client !== void 0 && owned.includes(client);
+  const ownsClient = (client2) => owned === void 0 || client2 !== void 0 && owned.includes(client2);
   const previous = options.previous ?? {};
   const dryRun = Boolean(options.dryRun);
   const record = {};
   const outcomes = [];
   const desiredPaths = new Set(desired.map((f) => f.relativePath));
   for (const id of rendered.missing) {
-    for (const client of SPELL_FANOUT_CLIENTS) {
-      const relativePath = USER_FANOUT_PATHS[client](id);
+    for (const client2 of SPELL_FANOUT_CLIENTS) {
+      const relativePath = USER_FANOUT_PATHS[client2](id);
       desiredPaths.add(relativePath);
       if (previous[relativePath] !== void 0) record[relativePath] = previous[relativePath];
       outcomes.push({ relativePath, status: "unrenderable" });
@@ -1311,15 +1311,15 @@ function describeFanoutOutcomes(outcomes, dryRun = false) {
     const n = { codex: 0, claude: 0, "copilot-agents": 0 };
     for (const o of outcomes) {
       if (o.status !== status) continue;
-      const client = clientOfFanoutPath(o.relativePath);
-      if (client !== void 0) n[client]++;
+      const client2 = clientOfFanoutPath(o.relativePath);
+      if (client2 !== void 0) n[client2]++;
     }
     return n;
   };
   const paths = (status) => outcomes.filter((o) => o.status === status).map((o) => `    ~/${o.relativePath}`).join("\n");
   if (counts.written > 0) {
     const n = byClient("written");
-    const breakdown = Object.keys(n).filter((client) => n[client] > 0).map((client) => `${n[client]} ${FANOUT_CLIENT_LABELS[client]}`).join(", ");
+    const breakdown = Object.keys(n).filter((client2) => n[client2] > 0).map((client2) => `${n[client2]} ${FANOUT_CLIENT_LABELS[client2]}`).join(", ");
     lines.push(
       `${prefix}${dryRun ? "write" : "Wrote"} ${counts.written} client file(s): ${breakdown}.`
     );
@@ -1365,8 +1365,8 @@ async function inspectUserTierFanout(homeDir, record) {
   };
   for (const [relativePath, recorded] of Object.entries(record ?? {})) {
     health.total++;
-    const client = clientOfFanoutPath(relativePath);
-    if (client !== void 0) health.byClient[client]++;
+    const client2 = clientOfFanoutPath(relativePath);
+    if (client2 !== void 0) health.byClient[client2]++;
     const target = join(homeDir, relativePath);
     const state = await classifyTarget(target);
     if (state === "absent") {
@@ -1830,12 +1830,12 @@ function requireEnum(value, allowed, path4, issues) {
 }
 function validateOptionalClient(clients, key, property, expected, issues) {
   if (clients[key] === void 0) return;
-  const client = requireRecord(clients[key], `clients.${key}`, issues);
-  if (!client) return;
+  const client2 = requireRecord(clients[key], `clients.${key}`, issues);
+  if (!client2) return;
   if (expected === "string") {
-    requireString(client[property], `clients.${key}.${property}`, issues);
+    requireString(client2[property], `clients.${key}.${property}`, issues);
   } else {
-    requireBoolean(client[property], `clients.${key}.${property}`, issues);
+    requireBoolean(client2[property], `clients.${key}.${property}`, issues);
   }
 }
 function validateAgentDefinition(value, source) {
@@ -2002,7 +2002,7 @@ function projectAgentsDir(targetDir, scope = "repo") {
 }
 
 // src/modules/agent-generator.ts
-import { writeFile as writeFile5, mkdir as mkdir3, readdir as readdir4 } from "fs/promises";
+import { writeFile as writeFile5, mkdir as mkdir3, readdir as readdir4, readFile as readFile6 } from "fs/promises";
 import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 
@@ -2208,6 +2208,25 @@ function renderSpellRoutingSection() {
 | Review code or a PR | \`spell-review\` |
 
 If a spell exists for the workflow you are about to perform, invoke it \u2014 do not improvise the workflow from general knowledge, even when the user doesn't name the spell.
+`;
+}
+async function loadBranchNamingFragment(assetsDir) {
+  try {
+    const fragment = await readFile6(
+      join3(assetsDir, ".arcane", "spells", "_fragments", "branch-naming.md"),
+      "utf8"
+    );
+    return fragment.trim();
+  } catch {
+    return null;
+  }
+}
+function renderBranchNamingSection(fragment) {
+  if (fragment === null) return "";
+  return `## Branch Naming
+
+${fragment}
+
 `;
 }
 function renderAgentRosterSection(entries) {
@@ -2233,6 +2252,7 @@ async function syncAgents(targetDir, assetsDir, roster, options = {}) {
   const synced = [];
   const skipped = [];
   let hasUnresolvedRoles = false;
+  const branchNaming = renderBranchNamingSection(await loadBranchNamingFragment(assetsDir));
   const userTier = options.scope === "user";
   const repoOptedOut = !userTier && options.spellScope === "user";
   const userAgentFiles = [];
@@ -2351,7 +2371,7 @@ async function syncAgents(targetDir, assetsDir, roster, options = {}) {
     }
     if (!userTier) {
       const copilotSection = `${renderSpellRoutingSection()}
-${renderAgentRosterSection(resolved)}`;
+${branchNaming}${renderAgentRosterSection(resolved)}`;
       const copilotMerged = await mergeIntoFile(
         targetDir,
         ".github/copilot-instructions.md",
@@ -2367,7 +2387,7 @@ ${renderAgentRosterSection(resolved)}`;
   }
   if (options.claude !== false) {
     const claudeSection = `${renderSpellRoutingSection()}
-${renderAgentRosterSection(resolved)}`;
+${branchNaming}${renderAgentRosterSection(resolved)}`;
     const claudeMerged = await mergeIntoFile(
       targetDir,
       "CLAUDE.md",
@@ -2378,7 +2398,7 @@ ${renderAgentRosterSection(resolved)}`;
   }
   if (options.codex !== false) {
     const codexSection = `${renderSpellRoutingSection()}
-${renderAgentRosterSection(resolved)}`;
+${branchNaming}${renderAgentRosterSection(resolved)}`;
     const codexMerged = await mergeIntoFile(
       targetDir,
       "AGENTS.md",
@@ -3314,7 +3334,7 @@ async function offerRegistryScaffold(targetDir, businessRoot) {
 }
 
 // src/modules/push-safety.ts
-import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile8, chmod, access as access3, rm as rm4, readdir as readdir6 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile8, chmod, access as access3, rm as rm4, readdir as readdir6 } from "fs/promises";
 import { constants } from "fs";
 import { join as join6, resolve as resolve2, dirname as dirname3, basename } from "path";
 var DISABLED_PUSH_URL = "arcane-push-blocked-run-spell-unblock-push://this-repository";
@@ -3492,7 +3512,7 @@ async function hookFileMatches(cwd, hookName, body) {
   const hookPath = await hookFilePath(cwd, hookName);
   if (!await fileExists(hookPath)) return false;
   try {
-    if (await readFile6(hookPath, "utf-8") !== body) return false;
+    if (await readFile7(hookPath, "utf-8") !== body) return false;
   } catch {
     return false;
   }
@@ -4353,8 +4373,8 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
       for (const file of component.files) printDryRun(`Would copy: ${file}`);
     }
     for (const id of spellIds) {
-      for (const client of ["codex", "claude"]) {
-        const relativePath = USER_FANOUT_PATHS[client](id);
+      for (const client2 of ["codex", "claude"]) {
+        const relativePath = USER_FANOUT_PATHS[client2](id);
         if (await fileExists(join7(homeDir, relativePath))) {
           printDryRun(`Would leave alone (exists, not written by Arcane): ~/${relativePath}`);
         } else {
@@ -4419,7 +4439,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
 }
 
 // src/modules/component-install.ts
-import { readFile as readFile7, stat, writeFile as writeFile9 } from "fs/promises";
+import { readFile as readFile8, stat, writeFile as writeFile9 } from "fs/promises";
 import { join as join8 } from "path";
 async function planComponentInstall(component, targetDir, assetsDir, opts = {}) {
   const files = [];
@@ -4454,7 +4474,7 @@ async function executeInstallPlan(plan, targetDir) {
   const written = [];
   try {
     for (const { file, src, state } of plan.toCopy) {
-      const previous = state === "missing" ? null : await readFile7(join8(targetDir, file));
+      const previous = state === "missing" ? null : await readFile8(join8(targetDir, file));
       fileHashes[file] = await copyFile(src, targetDir, file, { force: true });
       written.push({ file, previous });
       files.push(file);
@@ -4609,7 +4629,7 @@ async function runAdd(names, options, targetDir, assetsDir, packageVersion) {
 
 // src/commands/update.ts
 import { dirname as dirname5, join as join10 } from "path";
-import { readFile as readFile8, writeFile as writeFile10 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
 
 // src/modules/merge3.ts
 var CONFLICT_START = "<<<<<<< yours (edited)";
@@ -5436,8 +5456,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
             handled = true;
           } else {
             const [currentContent, newContent] = await Promise.all([
-              readFile8(join10(targetDir, file), "utf-8"),
-              readFile8(srcPath, "utf-8")
+              readFile9(join10(targetDir, file), "utf-8"),
+              readFile9(srcPath, "utf-8")
             ]);
             const result = merge3(oldVendorContent, currentContent, newContent);
             await writeFile10(join10(targetDir, file), result.content, "utf-8");
@@ -5625,7 +5645,7 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
 import { dirname as dirname7 } from "path";
 
 // src/modules/version-check.ts
-import { readFile as readFile9, writeFile as writeFile11, mkdir as mkdir6 } from "fs/promises";
+import { readFile as readFile10, writeFile as writeFile11, mkdir as mkdir6 } from "fs/promises";
 import { dirname as dirname6, join as join11 } from "path";
 import { homedir as homedir3 } from "os";
 import { createRequire } from "module";
@@ -5644,7 +5664,7 @@ var DEFAULT_CACHE_PATH = join11(homedir3(), ".arcane", "version-cache.json");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function readCache(cachePath) {
   try {
-    const content = await readFile9(cachePath, "utf-8");
+    const content = await readFile10(cachePath, "utf-8");
     const parsed = JSON.parse(content);
     if (typeof parsed.latest !== "string" || typeof parsed.checkedAt !== "string") {
       return null;
@@ -6028,7 +6048,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 }
 
 // src/commands/doctor.ts
-import { access as access4, readdir as readdir9, readFile as readFile12, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
+import { access as access4, readdir as readdir9, readFile as readFile13, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
 import { join as join15, dirname as dirname9 } from "path";
 
 // src/config/incidents.ts
@@ -6097,7 +6117,7 @@ function evaluateIncidentGate(records) {
 }
 
 // src/modules/denylist-scan.ts
-import { readFile as readFile10, readdir as readdir7 } from "fs/promises";
+import { readFile as readFile11, readdir as readdir7 } from "fs/promises";
 import { join as join13, relative } from "path";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -6115,7 +6135,7 @@ async function scanFile(absolutePath, displayPath, rules) {
   const findings = [];
   let content;
   try {
-    content = await readFile10(absolutePath, "utf8");
+    content = await readFile11(absolutePath, "utf8");
   } catch {
     return findings;
   }
@@ -6409,7 +6429,7 @@ function parseAdoRemote(url) {
 }
 
 // src/modules/placeholders.ts
-import { readdir as readdir8, readFile as readFile11 } from "fs/promises";
+import { readdir as readdir8, readFile as readFile12 } from "fs/promises";
 import { join as join14 } from "path";
 var PLACEHOLDER_STANDARD_FILE = "spell-authoring-standards.md";
 var RUNTIME_PLACEHOLDERS_START = "<!-- runtime-placeholders:start -->";
@@ -6505,7 +6525,7 @@ function parseRuntimePlaceholders(standardContent) {
 async function scanGovernancePlaceholders(governanceDir) {
   let standard;
   try {
-    standard = await readFile11(join14(governanceDir, PLACEHOLDER_STANDARD_FILE), "utf8");
+    standard = await readFile12(join14(governanceDir, PLACEHOLDER_STANDARD_FILE), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { status: "skipped", reason: `${PLACEHOLDER_STANDARD_FILE} is not installed` };
@@ -6524,7 +6544,7 @@ async function scanGovernancePlaceholders(governanceDir) {
   const templateDocs = [];
   const findings = [];
   for (const file of files) {
-    const content = await readFile11(join14(governanceDir, file), "utf8");
+    const content = await readFile12(join14(governanceDir, file), "utf8");
     const status = parseFrontmatterStatus(content);
     if (status === "template") templateDocs.push(file);
     if (status !== "active") continue;
@@ -6590,7 +6610,7 @@ async function checkArcaneManifest(targetDir) {
   } catch {
     const selfHostedManifestPath = join15(targetDir, "src", "assets", ".arcane.json");
     try {
-      const raw = await readFile12(selfHostedManifestPath, "utf8");
+      const raw = await readFile13(selfHostedManifestPath, "utf8");
       const manifest = JSON.parse(raw);
       if (isRecord3(manifest) && manifest["selfHosted"] === true && manifest["tracking_mode"] === "internal") {
         return {
@@ -6609,7 +6629,7 @@ async function checkArcaneManifest(targetDir) {
     };
   }
   try {
-    const raw = await readFile12(manifestPath2, "utf8");
+    const raw = await readFile13(manifestPath2, "utf8");
     const manifest = JSON.parse(raw);
     if (!isRecord3(manifest) || typeof manifest["version"] !== "string" || !manifest["version"] || !Array.isArray(manifest["components"])) {
       return {
@@ -6934,7 +6954,7 @@ async function checkMcpConfig(targetDir) {
   const filePath = join15(targetDir, ".mcp.json");
   let raw;
   try {
-    raw = await readFile12(filePath, "utf8");
+    raw = await readFile13(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no .mcp.json \u2014 nothing to check" };
   }
@@ -7017,7 +7037,7 @@ async function checkDelegations(targetDir) {
   const filePath = join15(targetDir, ".arcane", "delegations.json");
   let raw;
   try {
-    raw = await readFile12(filePath, "utf8");
+    raw = await readFile13(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no delegations recorded" };
   }
@@ -7237,16 +7257,16 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
 }
 
 // src/commands/ward.ts
-import { readFile as readFile14 } from "fs/promises";
+import { readFile as readFile15 } from "fs/promises";
 
 // src/modules/ward.ts
-import { readdir as readdir10, readFile as readFile13 } from "fs/promises";
+import { readdir as readdir10, readFile as readFile14 } from "fs/promises";
 import { join as join16, relative as relative2 } from "path";
 async function scanFileAllRules(absolutePath, displayPath, rules) {
   const findings = [];
   let content;
   try {
-    content = await readFile13(absolutePath, "utf8");
+    content = await readFile14(absolutePath, "utf8");
   } catch {
     return findings;
   }
@@ -7341,7 +7361,7 @@ async function runWard(repoRoot, options = {}) {
     const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
     if (findings2.length > 0) {
       try {
-        fileLines.set(displayPath, (await readFile13(absolutePath, "utf8")).split("\n"));
+        fileLines.set(displayPath, (await readFile14(absolutePath, "utf8")).split("\n"));
       } catch {
       }
     }
@@ -7369,7 +7389,7 @@ function parseTermsFileContent(raw) {
 }
 async function readTermsFile(filePath) {
   try {
-    return parseTermsFileContent(await readFile14(filePath, "utf8"));
+    return parseTermsFileContent(await readFile15(filePath, "utf8"));
   } catch (error) {
     console.warn(
       `\u26A0 arcane: could not read --terms-file "${filePath}": ${error.message}`
@@ -7579,17 +7599,732 @@ async function runBlockPush(targetDir) {
   }
 }
 
+// src/modules/credential-store.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+var CHUNK_SIZE = 1e3;
+var MAX_CHUNKS = 64;
+var INDEX_NAME = "session/index";
+var CHUNK_PREFIX = "session/";
+var INDEX_VERSION = 1;
+var KeychainUnavailableError = class extends Error {
+  constructor(operation, cause) {
+    super(`The OS keychain is not available (${operation} failed).`);
+    this.name = "KeychainUnavailableError";
+    this.cause = cause;
+  }
+};
+function sha256Hex(value) {
+  return createHash2("sha256").update(value, "utf8").digest("hex");
+}
+function chunkName(gen, n) {
+  return `${CHUNK_PREFIX}${gen}/${n}`;
+}
+function splitSecret(secret, size = CHUNK_SIZE) {
+  const chunks = [];
+  let start = 0;
+  while (start < secret.length) {
+    let end = Math.min(start + size, secret.length);
+    if (end < secret.length) {
+      const last = secret.charCodeAt(end - 1);
+      if (last >= 55296 && last <= 56319) end -= 1;
+    }
+    chunks.push(secret.slice(start, end));
+    start = end;
+  }
+  return chunks;
+}
+function parseIndex(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  if (o["v"] !== INDEX_VERSION || typeof o["gen"] !== "string" || !/^[0-9a-f]{16}$/.test(o["gen"]) || typeof o["count"] !== "number" || !Number.isInteger(o["count"]) || o["count"] < 1 || o["count"] > MAX_CHUNKS || typeof o["sha256"] !== "string" || !/^[0-9a-f]{64}$/.test(o["sha256"])) {
+    return null;
+  }
+  return { v: o["v"], gen: o["gen"], count: o["count"], sha256: o["sha256"] };
+}
+var ChunkedSecretStore = class {
+  constructor(backend) {
+    this.backend = backend;
+  }
+  backend;
+  guard(operation, fn) {
+    try {
+      return fn();
+    } catch (error) {
+      throw new KeychainUnavailableError(operation, error);
+    }
+  }
+  /** Reads the stored secret. Never throws for bad data; throws only when the keychain itself fails. */
+  load() {
+    const raw = this.guard("read", () => this.backend.get(INDEX_NAME));
+    if (raw === null) return { state: "signed-out" };
+    const index = parseIndex(raw);
+    if (index === null) return { state: "corrupt", reason: "the index entry is not valid" };
+    const parts = [];
+    for (let n = 0; n < index.count; n += 1) {
+      const part = this.guard("read", () => this.backend.get(chunkName(index.gen, n)));
+      if (part === null) return { state: "corrupt", reason: `chunk ${n} of ${index.count} is missing` };
+      parts.push(part);
+    }
+    const secret = parts.join("");
+    if (sha256Hex(secret) !== index.sha256) {
+      return { state: "corrupt", reason: "the stored pieces do not match their checksum" };
+    }
+    return { state: "ok", secret };
+  }
+  /**
+   * Replaces the stored secret. The previous session stays readable until the
+   * new index is written; a failure before that leaves it untouched.
+   */
+  save(secret) {
+    if (secret.length === 0) throw new Error("Refusing to store an empty secret.");
+    const gen = randomBytes(8).toString("hex");
+    const chunks = splitSecret(secret);
+    if (chunks.length > MAX_CHUNKS) {
+      throw new Error(`Refusing to store a secret longer than ${MAX_CHUNKS * CHUNK_SIZE} characters.`);
+    }
+    chunks.forEach((chunk, n) => {
+      this.guard("write", () => this.backend.set(chunkName(gen, n), chunk));
+    });
+    const index = { v: INDEX_VERSION, gen, count: chunks.length, sha256: sha256Hex(secret) };
+    this.guard("write", () => this.backend.set(INDEX_NAME, JSON.stringify(index)));
+    try {
+      this.sweep(gen);
+    } catch {
+    }
+  }
+  /** Deletes everything this store wrote, strays included. Succeeds when nothing is stored. */
+  clear() {
+    this.guard("delete", () => this.backend.delete(INDEX_NAME));
+    this.sweep(null);
+  }
+  /** Removes every chunk that does not belong to `keepGen` (all chunks when it is null). */
+  sweep(keepGen) {
+    const names = this.guard("list", () => this.backend.list());
+    for (const name of names) {
+      if (name === INDEX_NAME || !name.startsWith(CHUNK_PREFIX)) continue;
+      if (keepGen !== null && name.startsWith(`${CHUNK_PREFIX}${keepGen}/`)) continue;
+      this.guard("delete", () => this.backend.delete(name));
+    }
+  }
+};
+
+// src/modules/identity-config.ts
+function defineIdentityEnvironment(config) {
+  return {
+    ...config,
+    discoveryUrl: `https://${config.signInHost}/${config.tenantId}/v2.0/.well-known/openid-configuration`
+  };
+}
+var IDENTITY_ENVIRONMENTS = {
+  production: defineIdentityEnvironment({
+    environment: "production",
+    tenantId: "9f8edbfb-291c-4c4a-b9cc-8820a04f8973",
+    signInHost: "arcaneai.ciamlogin.com",
+    clientId: "7cd8f05d-9979-4458-8ca2-47c67748c41f"
+  }),
+  development: defineIdentityEnvironment({
+    environment: "development",
+    tenantId: "b365de0e-3026-4afe-bf5b-556fccb4ffcf",
+    signInHost: "arcaneaidev.ciamlogin.com",
+    clientId: "651be720-83cc-452b-8346-abf20713ad12"
+  })
+};
+var SIGN_IN_SCOPES = ["openid", "profile", "email", "offline_access"];
+var ENVIRONMENT_VARIABLE = "ARCANE_ENVIRONMENT";
+var UnknownEnvironmentError = class extends Error {
+  constructor(value) {
+    super(
+      `${ENVIRONMENT_VARIABLE}=${JSON.stringify(value)} is not an environment. Use "production" (the default) or "development".`
+    );
+    this.name = "UnknownEnvironmentError";
+  }
+};
+function resolveIdentityEnvironment(env = process.env) {
+  const raw = (env[ENVIRONMENT_VARIABLE] ?? "").trim().toLowerCase();
+  if (raw === "" || raw === "prod" || raw === "production") return IDENTITY_ENVIRONMENTS.production;
+  if (raw === "dev" || raw === "development") return IDENTITY_ENVIRONMENTS.development;
+  throw new UnknownEnvironmentError(env[ENVIRONMENT_VARIABLE] ?? "");
+}
+
+// src/modules/oidc.ts
+import { createServer } from "http";
+import { execFile as execFile3 } from "child_process";
+import * as client from "openid-client";
+var IdentityUnreachableError = class extends Error {
+  constructor(host, cause) {
+    super(`Could not reach the identity service at ${host}.`);
+    this.name = "IdentityUnreachableError";
+    this.cause = cause;
+  }
+};
+var LoginTimeoutError = class extends Error {
+  constructor() {
+    super("Timed out waiting for the sign-in to finish in the browser.");
+    this.name = "LoginTimeoutError";
+  }
+};
+var LoginDeniedError = class extends Error {
+  constructor(code) {
+    super(`The identity service refused the sign-in (${code}).`);
+    this.name = "LoginDeniedError";
+  }
+};
+async function loadIdentityConfiguration(environment, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  let metadata;
+  try {
+    const response = await fetchImpl(environment.discoveryUrl, { redirect: "manual" });
+    if (!response.ok) throw new Error(`discovery returned HTTP ${response.status}`);
+    metadata = await response.json();
+  } catch (error) {
+    throw new IdentityUnreachableError(environment.signInHost, error);
+  }
+  if (typeof metadata.issuer !== "string" || !metadata.token_endpoint || !metadata.authorization_endpoint) {
+    throw new IdentityUnreachableError(environment.signInHost, new Error("discovery document incomplete"));
+  }
+  const config = new client.Configuration(metadata, environment.clientId, void 0, client.None());
+  if (options.fetch) config[client.customFetch] = options.fetch;
+  if (options.allowInsecureHttp) client.allowInsecureRequests(config);
+  return config;
+}
+function toTokenResult(tokens, previousRefreshToken) {
+  const claims = tokens.claims();
+  if (!claims?.sub) throw new Error("The identity service returned no account identifier.");
+  const refreshToken = tokens.refresh_token ?? previousRefreshToken;
+  if (!refreshToken) {
+    throw new Error("The identity service returned no refresh token; nothing can be stored.");
+  }
+  const now = /* @__PURE__ */ new Date();
+  const seconds = tokens.expiresIn() ?? 0;
+  const email = typeof claims["email"] === "string" ? claims["email"] : typeof claims["preferred_username"] === "string" ? claims["preferred_username"] : null;
+  return {
+    refreshToken,
+    sub: claims.sub,
+    email,
+    obtainedAt: now,
+    expiresAt: new Date(now.getTime() + seconds * 1e3)
+  };
+}
+var CLOSE_PAGE = [
+  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
+  '<body style="font-family:system-ui;margin:3rem"><h1>Signed in to Arcane</h1>',
+  "<p>You can close this window and go back to the terminal.</p></body>"
+].join("");
+var FAILED_PAGE = [
+  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
+  '<body style="font-family:system-ui;margin:3rem"><h1>Sign-in not completed</h1>',
+  "<p>Go back to the terminal for what to do next.</p></body>"
+].join("");
+async function browserLogin(config, options) {
+  const codeVerifier = client.randomPKCECodeVerifier();
+  const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
+  const state = client.randomState();
+  const nonce = client.randomNonce();
+  const server = createServer();
+  await new Promise((resolve5, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve5());
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    server.close();
+    throw new Error("Could not open a loopback port for the sign-in.");
+  }
+  const redirectUri = new URL(`http://127.0.0.1:${address.port}`).href;
+  const authorizationUrl = client.buildAuthorizationUrl(config, {
+    redirect_uri: redirectUri,
+    scope: options.scopes.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state,
+    nonce
+  });
+  const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
+  let timer;
+  const close = () => {
+    if (timer) clearTimeout(timer);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  const tokens = new Promise((resolve5, reject) => {
+    server.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", redirectUri);
+      if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
+        res.writeHead(404).end();
+        return;
+      }
+      const errorCode = url.searchParams.get("error");
+      if (errorCode) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
+        reject(new LoginDeniedError(errorCode.replace(/[^a-z_]/gi, "")));
+        return;
+      }
+      client.authorizationCodeGrant(config, url, {
+        pkceCodeVerifier: codeVerifier,
+        expectedState: state,
+        expectedNonce: nonce,
+        idTokenExpected: true
+      }).then(async (response) => {
+        const result = toTokenResult(response);
+        await options.onValidated?.(result);
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(CLOSE_PAGE);
+        resolve5(result);
+      }).catch((error) => {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
+        reject(error);
+      });
+    });
+    timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
+  });
+  tokens.catch(() => {
+  });
+  try {
+    const opened = await options.openUrl(authorizationUrl.href);
+    if (!opened) options.onCannotOpen?.(authorizationUrl.href);
+    return await tokens;
+  } finally {
+    close();
+  }
+}
+async function deviceLogin(config, options) {
+  const handle = await client.initiateDeviceAuthorization(config, { scope: options.scopes.join(" ") });
+  options.prompt(handle.verification_uri, handle.user_code, handle.expires_in);
+  const response = await client.pollDeviceAuthorizationGrant(config, handle);
+  return toTokenResult(response);
+}
+async function refreshSession(config, refreshToken, scopes) {
+  const response = await client.refreshTokenGrant(config, refreshToken, { scope: scopes.join(" ") });
+  return toTokenResult(response, refreshToken);
+}
+function openInDefaultBrowser(url) {
+  const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+  return new Promise((resolve5) => {
+    try {
+      const child = execFile3(command, args, { windowsHide: true }, (error) => resolve5(!error));
+      child.on("error", () => resolve5(false));
+    } catch {
+      resolve5(false);
+    }
+  });
+}
+
+// src/modules/session-store.ts
+import { execFileSync } from "child_process";
+import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
+import { userInfo } from "os";
+import { dirname as dirname10, join as join17 } from "path";
+
+// src/modules/keychain-backend.ts
+import { createRequire as createRequire2 } from "module";
+var KEYCHAIN_SERVICE = "arcane-cli";
+function createKeychainBackend(service = KEYCHAIN_SERVICE) {
+  let loaded = null;
+  const keyring = () => {
+    loaded ??= createRequire2(import.meta.url)("@napi-rs/keyring");
+    return loaded;
+  };
+  const entry = (name) => new (keyring()).Entry(service, name);
+  return {
+    get: (name) => entry(name).getPassword() ?? null,
+    set: (name, value) => {
+      entry(name).setPassword(value);
+    },
+    delete: (name) => {
+      entry(name).deletePassword();
+    },
+    list: () => keyring().findCredentials(service).map((credential) => credential.account)
+  };
+}
+
+// src/modules/session-store.ts
+var INSECURE_SESSION_FILE_NAME = "session-insecure.json";
+var SessionClearError = class extends Error {
+  constructor(keychainError, removed) {
+    super(keychainError.message);
+    this.keychainError = keychainError;
+    this.removed = removed;
+    this.name = "SessionClearError";
+    this.cause = keychainError;
+  }
+  keychainError;
+  removed;
+};
+function isIsoDate(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value));
+}
+function parseSessionRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const o = parsed;
+  if (o["v"] !== 1 || o["environment"] !== "production" && o["environment"] !== "development" || typeof o["sub"] !== "string" || o["sub"] === "" || !(typeof o["email"] === "string" || o["email"] === null) || typeof o["refreshToken"] !== "string" || o["refreshToken"] === "" || !isIsoDate(o["obtainedAt"]) || !isIsoDate(o["expiresAt"])) {
+    return null;
+  }
+  return {
+    v: 1,
+    environment: o["environment"],
+    sub: o["sub"],
+    email: o["email"],
+    refreshToken: o["refreshToken"],
+    obtainedAt: o["obtainedAt"],
+    expiresAt: o["expiresAt"]
+  };
+}
+var FileSecretBackend = class {
+  constructor(filePath, restrict = restrictToCurrentUser) {
+    this.filePath = filePath;
+    this.restrict = restrict;
+  }
+  filePath;
+  restrict;
+  exists() {
+    return existsSync2(this.filePath);
+  }
+  read() {
+    if (!existsSync2(this.filePath)) return {};
+    const parsed = JSON.parse(readFileSync2(this.filePath, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error("the session file is not an object");
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  }
+  write(entries) {
+    if (Object.keys(entries).length === 0) {
+      rmSync(this.filePath, { force: true });
+      return;
+    }
+    mkdirSync(dirname10(this.filePath), { recursive: true });
+    const tmp = `${this.filePath}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(entries), { encoding: "utf8", mode: 384 });
+    try {
+      this.restrict(tmp);
+    } catch (error) {
+      rmSync(tmp, { force: true });
+      throw new Error(
+        "Could not restrict the session file to your account, so it was not written.",
+        { cause: error }
+      );
+    }
+    renameSync(tmp, this.filePath);
+  }
+  get(name) {
+    return this.read()[name] ?? null;
+  }
+  set(name, value) {
+    const entries = this.read();
+    entries[name] = value;
+    this.write(entries);
+  }
+  delete(name) {
+    const entries = this.read();
+    if (!(name in entries)) return;
+    delete entries[name];
+    this.write(entries);
+  }
+  list() {
+    return Object.keys(this.read());
+  }
+  /** Removes the file itself, strays and all. */
+  remove() {
+    rmSync(this.filePath, { force: true });
+  }
+};
+function restrictToCurrentUser(filePath) {
+  if (process.platform !== "win32") return;
+  const account = userInfo().username;
+  execFileSync("icacls", [filePath, "/inheritance:r", "/grant:r", `${account}:F`], {
+    stdio: "ignore",
+    windowsHide: true
+  });
+}
+function insecureSessionFilePath(homeDir) {
+  return join17(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
+}
+function createSessionStorage(options = {}) {
+  const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
+  const fileBackend = options.fileBackend ?? new FileSecretBackend(insecureSessionFilePath());
+  const file = new ChunkedSecretStore(fileBackend);
+  const interpret = (result, source) => {
+    if (result.state === "signed-out") return null;
+    if (result.state === "corrupt") return { state: "corrupt", source, reason: result.reason };
+    const record = parseSessionRecord(result.secret);
+    if (record === null) return { state: "corrupt", source, reason: "the stored session is not valid" };
+    return { state: "ok", source, record };
+  };
+  return {
+    load() {
+      let keychainError;
+      try {
+        const fromKeychain = interpret(keychain.load(), "keychain");
+        if (fromKeychain) return fromKeychain;
+      } catch (error) {
+        if (!(error instanceof KeychainUnavailableError)) throw error;
+        keychainError = error;
+      }
+      if (fileBackend.exists()) {
+        const fromFile = interpret(file.load(), "file");
+        if (fromFile) return fromFile;
+      }
+      return keychainError ? { state: "signed-out", keychainError } : { state: "signed-out" };
+    },
+    save(record, { insecure }) {
+      const serialized = JSON.stringify(record);
+      if (insecure) {
+        file.save(serialized);
+        try {
+          keychain.clear();
+        } catch {
+        }
+        return;
+      }
+      keychain.save(serialized);
+      fileBackend.remove();
+    },
+    clear() {
+      const removed = [];
+      let keychainError;
+      try {
+        const hadKeychainSession = keychain.load().state !== "signed-out";
+        keychain.clear();
+        if (hadKeychainSession) removed.push("keychain");
+      } catch (error) {
+        keychainError = error;
+      }
+      if (fileBackend.exists()) {
+        fileBackend.remove();
+        removed.push("file");
+      }
+      if (keychainError instanceof KeychainUnavailableError) {
+        throw new SessionClearError(keychainError, removed);
+      }
+      if (keychainError) throw keychainError;
+      return { removed };
+    }
+  };
+}
+
+// src/commands/login.ts
+function defaultLoginDeps() {
+  return {
+    storage: createSessionStorage(),
+    environment: () => resolveIdentityEnvironment(),
+    loadConfiguration: (environment) => loadIdentityConfiguration(environment),
+    browserLogin,
+    deviceLogin,
+    openUrl: openInDefaultBrowser,
+    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY)
+  };
+}
+var INSECURE_STORAGE_WARNING = "Insecure storage: the session is kept in a file protected only by your account's file permissions, not in the OS keychain. Run `spell logout` to remove it.";
+function safeErrorText(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.split("\n")[0].replace(/([?&](?:code|state|id_token|access_token|refresh_token)=)[^&\s]+/gi, "$1[redacted]");
+}
+function toSessionRecord(result, environment) {
+  return {
+    v: 1,
+    environment: environment.environment,
+    sub: result.sub,
+    email: result.email,
+    refreshToken: result.refreshToken,
+    obtainedAt: result.obtainedAt.toISOString(),
+    expiresAt: result.expiresAt.toISOString()
+  };
+}
+function describeAccount(record) {
+  const who = record.email ? `${record.email} (${record.sub})` : record.sub;
+  return record.environment === "development" ? `${who} [development]` : who;
+}
+async function runLogin(options, deps = defaultLoginDeps()) {
+  let environment;
+  try {
+    environment = deps.environment();
+  } catch (error) {
+    if (error instanceof UnknownEnvironmentError) {
+      console.error(error.message);
+      process.exit(1);
+      return;
+    }
+    throw error;
+  }
+  if (!options.deviceCode && !deps.isInteractive()) {
+    console.error(
+      "No interactive terminal, so a browser sign-in cannot be started here. Run `spell login --device-code` and finish the sign-in on another device."
+    );
+    process.exit(1);
+    return;
+  }
+  let config;
+  try {
+    config = await deps.loadConfiguration(environment);
+  } catch (error) {
+    console.error(
+      error instanceof IdentityUnreachableError ? `${error.message} Check your network connection and try again.` : `Could not prepare the sign-in: ${safeErrorText(error)}`
+    );
+    process.exit(1);
+    return;
+  }
+  let record;
+  const saveValidatedSession = (result) => {
+    const next = toSessionRecord(result, environment);
+    deps.storage.save(next, { insecure: Boolean(options.insecureStorage) });
+    record = next;
+  };
+  try {
+    if (options.deviceCode) {
+      const result = await deps.deviceLogin(config, {
+        scopes: SIGN_IN_SCOPES,
+        prompt: (uri, code, seconds) => {
+          printInfo(`Open ${uri} on any device and enter the code ${code}.`);
+          printInfo(`Waiting up to ${Math.round(seconds / 60)} minutes for you to finish signing in.`);
+        }
+      });
+      saveValidatedSession(result);
+    } else {
+      printInfo("Opening your browser to sign in to Arcane. Come back here when it says you are signed in.");
+      await deps.browserLogin(config, {
+        scopes: SIGN_IN_SCOPES,
+        openUrl: deps.openUrl,
+        onValidated: saveValidatedSession,
+        onCannotOpen: (url) => {
+          printWarning("No browser could be opened. Open this address yourself, or run `spell login --device-code`:");
+          printInfo(url);
+        }
+      });
+      if (!record) throw new Error("The browser sign-in ended without storing a session.");
+    }
+  } catch (error) {
+    if (error instanceof KeychainUnavailableError) {
+      console.error(
+        `${error.message} Nothing was stored. If this machine has no keychain, run \`spell login --insecure-storage\` to keep the session in a file instead (protected only by your account's file permissions).`
+      );
+    } else if (error instanceof LoginTimeoutError || error instanceof LoginDeniedError) {
+      console.error(`${error.message} Nothing was changed.`);
+    } else {
+      console.error(`The sign-in did not complete: ${safeErrorText(error)}. Nothing was changed.`);
+    }
+    process.exit(1);
+    return;
+  }
+  if (!record) throw new Error("The sign-in completed without a stored session.");
+  printSuccess(`Signed in as ${describeAccount(record)}.`);
+  if (options.insecureStorage) printWarning(INSECURE_STORAGE_WARNING);
+}
+
+// src/commands/logout.ts
+function runLogout(storage = createSessionStorage()) {
+  let removed;
+  try {
+    removed = storage.clear().removed;
+  } catch (error) {
+    if (error instanceof SessionClearError) {
+      const fileResult = error.removed.includes("file") ? "The insecure session file was removed. " : "";
+      console.error(
+        `${fileResult}${error.keychainError.message} Any session in the OS keychain could not be verified or removed.`
+      );
+      process.exit(1);
+      return;
+    }
+    if (error instanceof KeychainUnavailableError) {
+      console.error(`${error.message} The session could not be removed from it.`);
+      process.exit(1);
+      return;
+    }
+    throw error;
+  }
+  if (removed.length === 0) {
+    printSuccess("Nothing was stored; you were already signed out.");
+    return;
+  }
+  const where = removed.map((m) => m === "keychain" ? "the OS keychain" : "the insecure session file").join(" and ");
+  printSuccess(`Signed out: removed the session from ${where}.`);
+  printInfo("This signs out this machine only; the session at the identity service stays valid until it expires.");
+}
+
+// src/commands/whoami.ts
+function defaultWhoamiDeps() {
+  return {
+    storage: createSessionStorage(),
+    loadConfiguration: (environment) => loadIdentityConfiguration(environment),
+    refreshSession,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+async function runWhoami(options, deps = defaultWhoamiDeps()) {
+  let loaded;
+  try {
+    loaded = deps.storage.load();
+  } catch (error) {
+    if (error instanceof KeychainUnavailableError) {
+      console.error(`${error.message} Cannot tell whether you are signed in.`);
+      process.exit(1);
+      return;
+    }
+    throw error;
+  }
+  if (loaded.state === "signed-out") {
+    console.error("Not signed in. Run `spell login`.");
+    if (loaded.keychainError) console.error(loaded.keychainError.message);
+    process.exit(1);
+    return;
+  }
+  if (loaded.state === "corrupt") {
+    console.error(
+      `The stored session is damaged (${loaded.reason}), so you are treated as signed out. Run \`spell logout\` to clear it, then \`spell login\`.`
+    );
+    process.exit(1);
+    return;
+  }
+  const { record, source } = loaded;
+  printSuccess(`Signed in as ${describeAccount(record)}.`);
+  const expires = new Date(record.expiresAt);
+  const expired = expires.getTime() <= deps.now().getTime();
+  printInfo(`Signed in on ${new Date(record.obtainedAt).toLocaleString()}.`);
+  printInfo(
+    expired ? `The last token expired on ${expires.toLocaleString()}; the session refreshes on next use.` : `The current token is valid until ${expires.toLocaleString()}.`
+  );
+  printInfo(`Stored in ${source === "keychain" ? "the OS keychain" : "the insecure session file"}.`);
+  if (source === "file") printWarning(INSECURE_STORAGE_WARNING);
+  if (!options.verify) return;
+  const environment = IDENTITY_ENVIRONMENTS[record.environment];
+  try {
+    const config = await deps.loadConfiguration(environment);
+    const fresh = await deps.refreshSession(config, record.refreshToken, SIGN_IN_SCOPES);
+    deps.storage.save(toSessionRecord(fresh, environment), { insecure: source === "file" });
+    printSuccess(`Verified with the identity service at ${environment.signInHost}; the session is active.`);
+  } catch (error) {
+    console.error(
+      `The identity service did not accept the session (${safeErrorText(error)}). Run \`spell login\` again.`
+    );
+    process.exit(1);
+  }
+}
+
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir11, readFile as readFile16, writeFile as writeFile12 } from "fs/promises";
-import { basename as basename3, dirname as dirname10, isAbsolute, join as join18, relative as relative3, resolve as resolve4 } from "path";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
+import { basename as basename3, dirname as dirname11, isAbsolute, join as join19, relative as relative3, resolve as resolve4 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile15 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join18 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -7862,7 +8597,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path4) {
   try {
-    return await readFile15(path4, "utf8");
+    return await readFile16(path4, "utf8");
   } catch {
     return null;
   }
@@ -7958,13 +8693,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join17(options.rootDir, options.planRelPath);
-  const queueAbsPath = join17(options.rootDir, options.queueRelPath);
+  const planAbsPath = join18(options.rootDir, options.planRelPath);
+  const queueAbsPath = join18(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join17(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join17(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join18(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join18(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile15(planAbsPath, "utf8"),
+    readFile16(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -8160,7 +8895,7 @@ function toPosix(path4) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile16(join18(rootDir, planRelPath), "utf8");
+    planContent = await readFile17(join19(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -8172,13 +8907,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join18(dirname10(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join19(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join18(rootDir, "docs", "plans");
+  const plansDir = join19(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir11(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -8198,21 +8933,21 @@ async function discoverPrograms(rootDir) {
 async function programFromPlanPath(rootDir, planPath) {
   const planAbs = isAbsolute(planPath) ? planPath : resolve4(rootDir, planPath);
   const planRelPath = toPosix(relative3(rootDir, planAbs));
-  return programFromPlan(rootDir, basename3(dirname10(planAbs)), planRelPath);
+  return programFromPlan(rootDir, basename3(dirname11(planAbs)), planRelPath);
 }
 function normalizeLineEndings2(content) {
   return content.replace(/\r\n?/g, "\n");
 }
 async function readOptionalFile(path4) {
   try {
-    return await readFile16(path4, "utf8");
+    return await readFile17(path4, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile16(join18(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile17(join19(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -8232,7 +8967,7 @@ async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile16(options.templatePath, "utf8");
+  const templateHtml = await readFile17(options.templatePath, "utf8");
   const theme = options.theme ?? "auto";
   const drifted = [];
   const repaired = [];
@@ -8243,19 +8978,19 @@ async function runReportGeneration(options) {
     if (!generated.themeApplied) themeSkipped.push(program2.slug);
     const missing = JSON.parse(generated.json).sections.flatMap((section) => section.rows).filter((row) => row.descriptionState === "unwritten").map((row) => row.id);
     if (missing.length > 0) unwritten.push({ slug: program2.slug, ids: missing });
-    const outAbs = options.outDir ? isAbsolute(options.outDir) ? options.outDir : resolve4(options.rootDir, options.outDir) : resolve4(options.rootDir, dirname10(program2.planRelPath));
+    const outAbs = options.outDir ? isAbsolute(options.outDir) ? options.outDir : resolve4(options.rootDir, options.outDir) : resolve4(options.rootDir, dirname11(program2.planRelPath));
     const outRel = toPosix(relative3(options.rootDir, outAbs));
     const outputs = [
       [`${outRel}/show-report.json`, generated.json],
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join18(options.rootDir, relPath));
+      const actual = await readOptionalFile(join19(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile12(join18(options.rootDir, relPath), expected, "utf8");
+          await writeFile12(join19(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -8266,7 +9001,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join19(assetsDir, "report", "show-report.template.html");
+  const templatePath = join20(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -8341,9 +9076,9 @@ async function runReport(targetDir, options = {}, assetsDir) {
 
 // src/index.ts
 import { realpathSync } from "fs";
-var require3 = createRequire2(import.meta.url);
+var require3 = createRequire3(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join20(dirname11(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join21(dirname12(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -8466,6 +9201,18 @@ program.command("block-push").description("Enforce push_policy: blocked on this
 program.command("unblock-push").description("Lift this repository's push block (interactive terminal only)").action(async () => {
   await runUnblockPush(process.cwd());
 });
+program.command("login").description("Sign in to your Arcane account (browser by default; the session is kept in the OS keychain)").option("--device-code", "Sign in from another device by typing a code; for machines with no browser").option(
+  "--insecure-storage",
+  "Keep the session in a file under ~/.arcane instead of the OS keychain; protected only by your account's file permissions"
+).action(async (opts) => {
+  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage });
+});
+program.command("logout").description("Sign out on this machine: remove the stored session").action(() => {
+  runLogout();
+});
+program.command("whoami").description("Show who is signed in; exits 1 when signed out").option("--verify", "Also check the session with the identity service").action(async (opts) => {
+  await runWhoami({ verify: opts.verify });
+});
 program.command("doctor").description("Check your environment for Arcane prerequisites").option("--fix", "Automatically create missing session continuity files").option("--leaks", "Run only the on-demand secrets/credential scan (ARC-037), skipping the default checks").action(async (opts) => {
   await runDoctor(
     process.cwd(),