arcane-cli 1.11.4 → 1.12.0

package/dist/index.js

@@ -6,7 +6,7 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname12, join as join21 } from "path";
+import { dirname as dirname12, join as join22 } from "path";
 
 // src/commands/init.ts
 import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
@@ -7715,21 +7715,25 @@ var ChunkedSecretStore = class {
 };
 
 // src/modules/identity-config.ts
+function defineIdentityEnvironment(config) {
+  return {
+    ...config,
+    discoveryUrl: `https://${config.signInHost}/${config.tenantId}/v2.0/.well-known/openid-configuration`
+  };
+}
 var IDENTITY_ENVIRONMENTS = {
-  production: {
+  production: defineIdentityEnvironment({
     environment: "production",
     tenantId: "9f8edbfb-291c-4c4a-b9cc-8820a04f8973",
     signInHost: "arcaneai.ciamlogin.com",
-    clientId: "7cd8f05d-9979-4458-8ca2-47c67748c41f",
-    discoveryUrl: "https://arcaneai.ciamlogin.com/9f8edbfb-291c-4c4a-b9cc-8820a04f8973/v2.0/.well-known/openid-configuration"
-  },
-  development: {
+    clientId: "7cd8f05d-9979-4458-8ca2-47c67748c41f"
+  }),
+  development: defineIdentityEnvironment({
     environment: "development",
     tenantId: "b365de0e-3026-4afe-bf5b-556fccb4ffcf",
     signInHost: "arcaneaidev.ciamlogin.com",
-    clientId: "651be720-83cc-452b-8346-abf20713ad12",
-    discoveryUrl: "https://arcaneaidev.ciamlogin.com/b365de0e-3026-4afe-bf5b-556fccb4ffcf/v2.0/.well-known/openid-configuration"
-  }
+    clientId: "651be720-83cc-452b-8346-abf20713ad12"
+  })
 };
 var SIGN_IN_SCOPES = ["openid", "profile", "email", "offline_access"];
 var ENVIRONMENT_VARIABLE = "ARCANE_ENVIRONMENT";
@@ -7752,6 +7756,70 @@ function resolveIdentityEnvironment(env = process.env) {
 import { createServer } from "http";
 import { execFile as execFile3 } from "child_process";
 import * as client from "openid-client";
+
+// src/modules/result-pages.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join17 } from "path";
+var RESULT_KINDS = ["success", "denied", "failure"];
+function resultPagePath(kind) {
+  return join17("sign-in", `sign-in-callback-${kind}.html`);
+}
+function styleHashes(html) {
+  return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match) => {
+    const text = match[1].replace(/\r\n?/g, "\n");
+    return `'sha256-${createHash3("sha256").update(text, "utf8").digest("base64")}'`;
+  });
+}
+function resultPageHeaders(html) {
+  const hashes = [...new Set(styleHashes(html))];
+  return {
+    "cache-control": "no-store",
+    "content-security-policy": [
+      "default-src 'none'",
+      `style-src ${hashes.length > 0 ? hashes.join(" ") : "'none'"}`,
+      "img-src data:",
+      "font-src data:",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'"
+    ].join("; "),
+    "content-type": "text/html; charset=utf-8",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff"
+  };
+}
+function resultPage(html) {
+  return { html, headers: resultPageHeaders(html) };
+}
+function plainPage(heading, next) {
+  return resultPage(
+    [
+      '<!doctype html><html lang="en"><meta charset="utf-8">',
+      '<meta name="viewport" content="width=device-width, initial-scale=1">',
+      `<title>${heading} \u2014 Arcane</title>`,
+      "<style>:root{color-scheme:light dark}body{font-family:system-ui,sans-serif;margin:3rem;line-height:1.5}</style>",
+      `<body><h1>${heading}</h1><p>${next}</p></body></html>`
+    ].join("")
+  );
+}
+var PLAIN_RESULT_PAGES = {
+  success: plainPage("Signed in to Arcane", "Return to your terminal. Your browser can be closed now."),
+  denied: plainPage("Sign-in was not completed", "Return to your terminal to try again. No new session was stored."),
+  failure: plainPage("Could not finish sign-in", "Return to your terminal for details. No new session was stored.")
+};
+async function loadResultPages(assetsDir) {
+  try {
+    const [success, denied, failure] = await Promise.all(
+      RESULT_KINDS.map(async (kind) => resultPage(await readFile16(join17(assetsDir, resultPagePath(kind)), "utf8")))
+    );
+    return { success, denied, failure };
+  } catch {
+    return null;
+  }
+}
+
+// src/modules/oidc.ts
 var IdentityUnreachableError = class extends Error {
   constructor(host, cause) {
     super(`Could not reach the identity service at ${host}.`);
@@ -7765,6 +7833,12 @@ var LoginTimeoutError = class extends Error {
     this.name = "LoginTimeoutError";
   }
 };
+var LoginBrowserUnavailableError = class extends Error {
+  constructor() {
+    super("No browser could be opened. Run `spell login --device-code` and finish signing in on another device.");
+    this.name = "LoginBrowserUnavailableError";
+  }
+};
 var LoginDeniedError = class extends Error {
   constructor(code) {
     super(`The identity service refused the sign-in (${code}).`);
@@ -7807,16 +7881,8 @@ function toTokenResult(tokens, previousRefreshToken) {
     expiresAt: new Date(now.getTime() + seconds * 1e3)
   };
 }
-var CLOSE_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Signed in to Arcane</h1>',
-  "<p>You can close this window and go back to the terminal.</p></body>"
-].join("");
-var FAILED_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Sign-in not completed</h1>',
-  "<p>Go back to the terminal for what to do next.</p></body>"
-].join("");
+var resultPath = (kind) => `/result/${kind}`;
+var RESULT_PATHS = new Set(RESULT_KINDS.map(resultPath));
 async function browserLogin(config, options) {
   const codeVerifier = client.randomPKCECodeVerifier();
   const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
@@ -7841,8 +7907,11 @@ async function browserLogin(config, options) {
     state,
     nonce
   });
+  const pages = options.pages ?? PLAIN_RESULT_PAGES;
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let timer;
+  let callbackConsumed = false;
+  let browserResult;
   const close = () => {
     if (timer) clearTimeout(timer);
     server.closeAllConnections?.();
@@ -7851,14 +7920,53 @@ async function browserLogin(config, options) {
   const tokens = new Promise((resolve5, reject) => {
     server.on("request", (req, res) => {
       const url = new URL(req.url ?? "/", redirectUri);
+      if (RESULT_PATHS.has(url.pathname)) {
+        if (!browserResult || url.pathname !== resultPath(browserResult.kind) || url.search !== "") {
+          res.writeHead(404).end();
+          return;
+        }
+        const served = browserResult;
+        const page = pages[served.kind];
+        const settle = () => {
+          if (served.kind === "success") resolve5(served.result);
+          else reject(served.error);
+        };
+        res.once("finish", settle).once("close", settle);
+        res.writeHead(200, page.headers).end(page.html);
+        return;
+      }
       if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
         res.writeHead(404).end();
         return;
       }
+      if (callbackConsumed) {
+        res.writeHead(409, { "cache-control": "no-store" }).end();
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.writeHead(400, pages.failure.headers).end(pages.failure.html);
+        return;
+      }
+      callbackConsumed = true;
+      const redirectToResult = (result) => {
+        browserResult = result;
+        res.writeHead(303, {
+          "cache-control": "no-store",
+          location: resultPath(result.kind),
+          "referrer-policy": "no-referrer"
+        }).end();
+        if (result.kind === "success") {
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => resolve5(result.result), Math.min(timeoutMs, 5e3));
+        }
+      };
       const errorCode = url.searchParams.get("error");
       if (errorCode) {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(new LoginDeniedError(errorCode.replace(/[^a-z_]/gi, "")));
+        const code = errorCode.replace(/[^a-z_]/gi, "");
+        redirectToResult({
+          kind: code === "access_denied" ? "denied" : "failure",
+          error: new LoginDeniedError(code)
+        });
         return;
       }
       client.authorizationCodeGrant(config, url, {
@@ -7866,12 +7974,12 @@ async function browserLogin(config, options) {
         expectedState: state,
         expectedNonce: nonce,
         idTokenExpected: true
-      }).then((response) => {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(CLOSE_PAGE);
-        resolve5(toTokenResult(response));
+      }).then(async (response) => {
+        const result = toTokenResult(response);
+        await options.onValidated?.(result);
+        redirectToResult({ kind: "success", result });
       }).catch((error) => {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(error);
+        redirectToResult({ kind: "failure", error });
       });
     });
     timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
@@ -7880,7 +7988,10 @@ async function browserLogin(config, options) {
   });
   try {
     const opened = await options.openUrl(authorizationUrl.href);
-    if (!opened) options.onCannotOpen?.(authorizationUrl.href);
+    if (!opened) {
+      options.onCannotOpen?.();
+      throw new LoginBrowserUnavailableError();
+    }
     return await tokens;
   } finally {
     close();
@@ -7912,7 +8023,7 @@ function openInDefaultBrowser(url) {
 import { execFileSync } from "child_process";
 import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
 import { userInfo } from "os";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname10, join as join18 } from "path";
 
 // src/modules/keychain-backend.ts
 import { createRequire as createRequire2 } from "module";
@@ -7938,6 +8049,17 @@ function createKeychainBackend(service = KEYCHAIN_SERVICE) {
 
 // src/modules/session-store.ts
 var INSECURE_SESSION_FILE_NAME = "session-insecure.json";
+var SessionClearError = class extends Error {
+  constructor(keychainError, removed) {
+    super(keychainError.message);
+    this.keychainError = keychainError;
+    this.removed = removed;
+    this.name = "SessionClearError";
+    this.cause = keychainError;
+  }
+  keychainError;
+  removed;
+};
 function isIsoDate(value) {
   return typeof value === "string" && !Number.isNaN(Date.parse(value));
 }
@@ -8035,7 +8157,7 @@ function restrictToCurrentUser(filePath) {
   });
 }
 function insecureSessionFilePath(homeDir) {
-  return join17(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
+  return join18(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
 }
 function createSessionStorage(options = {}) {
   const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
@@ -8081,8 +8203,9 @@ function createSessionStorage(options = {}) {
       const removed = [];
       let keychainError;
       try {
-        if (keychain.load().state !== "signed-out") removed.push("keychain");
+        const hadKeychainSession = keychain.load().state !== "signed-out";
         keychain.clear();
+        if (hadKeychainSession) removed.push("keychain");
       } catch (error) {
         keychainError = error;
       }
@@ -8090,6 +8213,9 @@ function createSessionStorage(options = {}) {
         fileBackend.remove();
         removed.push("file");
       }
+      if (keychainError instanceof KeychainUnavailableError) {
+        throw new SessionClearError(keychainError, removed);
+      }
       if (keychainError) throw keychainError;
       return { removed };
     }
@@ -8097,7 +8223,7 @@ function createSessionStorage(options = {}) {
 }
 
 // src/commands/login.ts
-function defaultLoginDeps() {
+function defaultLoginDeps(assetsDir) {
   return {
     storage: createSessionStorage(),
     environment: () => resolveIdentityEnvironment(),
@@ -8105,10 +8231,12 @@ function defaultLoginDeps() {
     browserLogin,
     deviceLogin,
     openUrl: openInDefaultBrowser,
-    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    resultPages: () => loadResultPages(assetsDir)
   };
 }
 var INSECURE_STORAGE_WARNING = "Insecure storage: the session is kept in a file protected only by your account's file permissions, not in the OS keychain. Run `spell logout` to remove it.";
+var MISSING_RESULT_PAGES_WARNING = "This arcane-cli install is missing its sign-in result pages (assets/sign-in/), so the browser will show a plain page. Reinstall the package to restore them.";
 function safeErrorText(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.split("\n")[0].replace(/([?&](?:code|state|id_token|access_token|refresh_token)=)[^&\s]+/gi, "$1[redacted]");
@@ -8128,7 +8256,7 @@ function describeAccount(record) {
   const who = record.email ? `${record.email} (${record.sub})` : record.sub;
   return record.environment === "development" ? `${who} [development]` : who;
 }
-async function runLogin(options, deps = defaultLoginDeps()) {
+async function runLogin(options, deps) {
   let environment;
   try {
     environment = deps.environment();
@@ -8157,51 +8285,51 @@ async function runLogin(options, deps = defaultLoginDeps()) {
     process.exit(1);
     return;
   }
-  let result;
+  let record;
+  const saveValidatedSession = (result) => {
+    const next = toSessionRecord(result, environment);
+    deps.storage.save(next, { insecure: Boolean(options.insecureStorage) });
+    record = next;
+  };
   try {
     if (options.deviceCode) {
-      result = await deps.deviceLogin(config, {
+      const result = await deps.deviceLogin(config, {
         scopes: SIGN_IN_SCOPES,
         prompt: (uri, code, seconds) => {
           printInfo(`Open ${uri} on any device and enter the code ${code}.`);
           printInfo(`Waiting up to ${Math.round(seconds / 60)} minutes for you to finish signing in.`);
         }
       });
+      saveValidatedSession(result);
     } else {
+      const pages = await deps.resultPages();
+      if (!pages) printWarning(MISSING_RESULT_PAGES_WARNING);
       printInfo("Opening your browser to sign in to Arcane. Come back here when it says you are signed in.");
-      result = await deps.browserLogin(config, {
+      await deps.browserLogin(config, {
         scopes: SIGN_IN_SCOPES,
         openUrl: deps.openUrl,
-        onCannotOpen: (url) => {
-          printWarning("No browser could be opened. Open this address yourself, or run `spell login --device-code`:");
-          printInfo(url);
+        pages: pages ?? void 0,
+        onValidated: saveValidatedSession,
+        onCannotOpen: () => {
+          printWarning("No browser could be opened. Run `spell login --device-code` to sign in on another device.");
         }
       });
+      if (!record) throw new Error("The browser sign-in ended without storing a session.");
     }
-  } catch (error) {
-    if (error instanceof LoginTimeoutError || error instanceof LoginDeniedError) {
-      console.error(`${error.message} Nothing was changed.`);
-    } else {
-      console.error(`The sign-in did not complete: ${safeErrorText(error)}. Nothing was changed.`);
-    }
-    process.exit(1);
-    return;
-  }
-  const record = toSessionRecord(result, environment);
-  try {
-    deps.storage.save(record, { insecure: Boolean(options.insecureStorage) });
   } catch (error) {
     if (error instanceof KeychainUnavailableError) {
       console.error(
         `${error.message} Nothing was stored. If this machine has no keychain, run \`spell login --insecure-storage\` to keep the session in a file instead (protected only by your account's file permissions).`
       );
-      process.exit(1);
-      return;
+    } else if (error instanceof LoginTimeoutError || error instanceof LoginDeniedError) {
+      console.error(`${error.message} Nothing was changed.`);
+    } else {
+      console.error(`The sign-in did not complete: ${safeErrorText(error)}. Nothing was changed.`);
     }
-    console.error(`The session could not be stored: ${safeErrorText(error)}`);
     process.exit(1);
     return;
   }
+  if (!record) throw new Error("The sign-in completed without a stored session.");
   printSuccess(`Signed in as ${describeAccount(record)}.`);
   if (options.insecureStorage) printWarning(INSECURE_STORAGE_WARNING);
 }
@@ -8212,6 +8340,14 @@ function runLogout(storage = createSessionStorage()) {
   try {
     removed = storage.clear().removed;
   } catch (error) {
+    if (error instanceof SessionClearError) {
+      const fileResult = error.removed.includes("file") ? "The insecure session file was removed. " : "";
+      console.error(
+        `${fileResult}${error.keychainError.message} Any session in the OS keychain could not be verified or removed.`
+      );
+      process.exit(1);
+      return;
+    }
     if (error instanceof KeychainUnavailableError) {
       console.error(`${error.message} The session could not be removed from it.`);
       process.exit(1);
@@ -8289,15 +8425,15 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
 
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir11, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
-import { basename as basename3, dirname as dirname11, isAbsolute, join as join19, relative as relative3, resolve as resolve4 } from "path";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile18, writeFile as writeFile12 } from "fs/promises";
+import { basename as basename3, dirname as dirname11, isAbsolute, join as join20, relative as relative3, resolve as resolve4 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { join as join19 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -8570,7 +8706,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path4) {
   try {
-    return await readFile16(path4, "utf8");
+    return await readFile17(path4, "utf8");
   } catch {
     return null;
   }
@@ -8666,13 +8802,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join18(options.rootDir, options.planRelPath);
-  const queueAbsPath = join18(options.rootDir, options.queueRelPath);
+  const planAbsPath = join19(options.rootDir, options.planRelPath);
+  const queueAbsPath = join19(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join18(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join18(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join19(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join19(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile16(planAbsPath, "utf8"),
+    readFile17(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -8868,7 +9004,7 @@ function toPosix(path4) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile17(join19(rootDir, planRelPath), "utf8");
+    planContent = await readFile18(join20(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -8880,13 +9016,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join19(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join20(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join19(rootDir, "docs", "plans");
+  const plansDir = join20(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir11(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -8913,14 +9049,14 @@ function normalizeLineEndings2(content) {
 }
 async function readOptionalFile(path4) {
   try {
-    return await readFile17(path4, "utf8");
+    return await readFile18(path4, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile17(join19(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile18(join20(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -8940,7 +9076,7 @@ async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile17(options.templatePath, "utf8");
+  const templateHtml = await readFile18(options.templatePath, "utf8");
   const theme = options.theme ?? "auto";
   const drifted = [];
   const repaired = [];
@@ -8958,12 +9094,12 @@ async function runReportGeneration(options) {
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join19(options.rootDir, relPath));
+      const actual = await readOptionalFile(join20(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile12(join19(options.rootDir, relPath), expected, "utf8");
+          await writeFile12(join20(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -8974,7 +9110,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join20(assetsDir, "report", "show-report.template.html");
+  const templatePath = join21(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -9051,7 +9187,7 @@ async function runReport(targetDir, options = {}, assetsDir) {
 import { realpathSync } from "fs";
 var require3 = createRequire3(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join21(dirname12(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join22(dirname12(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -9178,7 +9314,7 @@ program.command("login").description("Sign in to your Arcane account (browser by
   "--insecure-storage",
   "Keep the session in a file under ~/.arcane instead of the OS keychain; protected only by your account's file permissions"
 ).action(async (opts) => {
-  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage });
+  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage }, defaultLoginDeps(ASSETS_DIR));
 });
 program.command("logout").description("Sign out on this machine: remove the stored session").action(() => {
   runLogout();