arcane-cli 1.11.5 → 1.12.1

package/dist/index.js

@@ -6,11 +6,11 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire3 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname12, join as join21 } from "path";
+import { dirname as dirname13, join as join23 } from "path";
 
 // src/commands/init.ts
 import { select as select3, confirm as confirm2, input as input3 } from "@inquirer/prompts";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname5, join as join8 } from "path";
 import chalk2 from "chalk";
 
 // src/modules/copier.ts
@@ -1417,7 +1417,7 @@ var WORDMARK = [
 var INDENT = "  ";
 var LOCKUP_WIDTH = INDENT.length + Math.max(...WORDMARK.map((l) => l.length));
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function isAnimatable() {
   return !!process.stdout.isTTY && process.env["TERM"] !== "dumb" && process.env["CI"] !== "true" && process.env["ARCANE_DISABLE_ANIMATION"] !== "true" && (process.stdout.columns ?? 80) >= LOCKUP_WIDTH;
@@ -2849,7 +2849,7 @@ function buildGitEnv() {
 function runGit(cwd, args, options = {}) {
   const commandClass = options.commandClass ?? classifyGitCommand(args);
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUTS_MS[commandClass] ?? DEFAULT_TIMEOUTS_MS.write;
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = execFile(
       "git",
       args,
@@ -2883,7 +2883,7 @@ function runGit(cwd, args, options = {}) {
           reject(error);
           return;
         }
-        resolve5({ stdout, stderr });
+        resolve6({ stdout, stderr });
       }
     );
     child.stdin?.end();
@@ -3336,7 +3336,27 @@ async function offerRegistryScaffold(targetDir, businessRoot) {
 // src/modules/push-safety.ts
 import { mkdir as mkdir5, readFile as readFile7, writeFile as writeFile8, chmod, access as access3, rm as rm4, readdir as readdir6 } from "fs/promises";
 import { constants } from "fs";
-import { join as join6, resolve as resolve2, dirname as dirname3, basename } from "path";
+import { join as join7, resolve as resolve3, dirname as dirname4, basename as basename2 } from "path";
+
+// src/modules/real-path.ts
+import { realpathSync } from "fs";
+import { basename, dirname as dirname3, join as join6, resolve as resolve2 } from "path";
+function resolveRealPath(path4) {
+  const missing = [];
+  let existing = path4;
+  for (; ; ) {
+    try {
+      return join6(realpathSync.native(existing), ...missing);
+    } catch {
+      const parent = dirname3(existing);
+      if (parent === existing) return resolve2(path4);
+      missing.unshift(basename(existing));
+      existing = parent;
+    }
+  }
+}
+
+// src/modules/push-safety.ts
 var DISABLED_PUSH_URL = "arcane-push-blocked-run-spell-unblock-push://this-repository";
 var NO_PUSH_URL_MARKER = (remote) => `remote.${remote}.arcaneHadNoPushUrl`;
 var ARCANE_HOOKS_DIR = ".arcane/hooks";
@@ -3365,10 +3385,12 @@ function isArcaneHooksPath(root, value) {
   const windows = process.platform === "win32";
   const normalize = (p) => {
     const separated = windows ? p.replace(/\\/g, "/") : p;
-    const absolute = resolve2(root, separated).replace(/\\/g, "/").replace(/\/+$/, "");
+    const resolved = resolve3(root, separated);
+    const absolute = (windows ? resolved.replace(/\\/g, "/") : resolved).replace(/\/+$/, "");
     return windows ? absolute.toLowerCase() : absolute;
   };
-  return normalize(value) === normalize(ARCANE_HOOKS_DIR);
+  if (normalize(value) === normalize(ARCANE_HOOKS_DIR)) return true;
+  return normalize(resolveRealPath(resolve3(root, value))) === normalize(join7(resolveRealPath(root), ARCANE_HOOKS_DIR));
 }
 var PRE_PUSH_HOOK_BODY = `#!/bin/sh
 # Installed by Arcane because this repository's .arcane.json sets
@@ -3413,8 +3435,8 @@ async function repositoryRoot(cwd) {
     ]);
     const commonDir = stdout.trim();
     if (commonDir !== "") {
-      const parent = dirname3(commonDir);
-      if (basename(commonDir) === ".git" && parent !== "") return parent;
+      const parent = dirname4(commonDir);
+      if (basename2(commonDir) === ".git" && parent !== "") return parent;
     }
   } catch {
   }
@@ -3427,10 +3449,11 @@ async function repositoryRoot(cwd) {
   return cwd;
 }
 async function hookFilePath(cwd, hookName = "pre-push") {
-  return join6(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, hookName);
+  return join7(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, hookName);
 }
 async function hooksPathValue(cwd) {
-  return join6(await repositoryRoot(cwd), ARCANE_HOOKS_DIR).replace(/\\/g, "/");
+  const value = join7(await repositoryRoot(cwd), ARCANE_HOOKS_DIR);
+  return process.platform === "win32" ? value.replace(/\\/g, "/") : value;
 }
 async function installHook(cwd, hookName, body) {
   const root = await repositoryRoot(cwd);
@@ -3449,11 +3472,11 @@ async function installHook(cwd, hookName, body) {
       return { status: "refused-default-hooks", hooks: displaced };
     }
   }
-  const hookPath = join6(root, ARCANE_HOOKS_DIR, hookName);
+  const hookPath = join7(root, ARCANE_HOOKS_DIR, hookName);
   if (existing !== void 0 && await hookFileMatches(cwd, hookName, body)) {
     return { status: "already-ours" };
   }
-  await mkdir5(join6(root, ARCANE_HOOKS_DIR), { recursive: true });
+  await mkdir5(join7(root, ARCANE_HOOKS_DIR), { recursive: true });
   await writeFile8(hookPath, body, "utf-8");
   await chmod(hookPath, 493);
   await runGit(cwd, ["config", "--local", "core.hooksPath", await hooksPathValue(cwd)]);
@@ -3498,7 +3521,7 @@ async function defaultHooks(cwd) {
   let hooksDir;
   try {
     const { stdout } = await runGit(cwd, ["rev-parse", "--git-common-dir"]);
-    hooksDir = join6(resolve2(cwd, stdout.trim()), "hooks");
+    hooksDir = join7(resolve3(cwd, stdout.trim()), "hooks");
   } catch {
     return [];
   }
@@ -3534,7 +3557,7 @@ async function removeHook(cwd, hookName) {
     await rm4(await hookFilePath(cwd, hookName), { force: true });
   } catch {
   }
-  const hooksDir = join6(root, ARCANE_HOOKS_DIR);
+  const hooksDir = join7(root, ARCANE_HOOKS_DIR);
   let remaining = [];
   try {
     remaining = await readdir6(hooksDir);
@@ -3937,7 +3960,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   }
   let flags = {};
   try {
-    flags = resolveManifestFlags(options.manifestFlags, {}, join7(targetDir, ".arcane.json"));
+    flags = resolveManifestFlags(options.manifestFlags, {}, join8(targetDir, ".arcane.json"));
   } catch (err) {
     if (!(err instanceof ManifestFlagError)) throw err;
     console.error(`
@@ -4072,7 +4095,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
     const installedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join7(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const srcPath = join8(assetsDir, component.sourceOverrides?.[file] ?? file);
       if (options.dryRun) {
         printDryRun(`Would copy: ${file}`);
       } else {
@@ -4089,7 +4112,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       fileCount++;
     }
     for (const dir of component.directories ?? []) {
-      const srcDirPath = join7(assetsDir, dir);
+      const srcDirPath = join8(assetsDir, dir);
       if (options.dryRun) {
         printDryRun(`Would copy directory: ${dir}/`);
       } else {
@@ -4118,7 +4141,7 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
   if (options.dryRun) {
     if (hasAgents) {
       const agentFiles = await import("fs").then(
-        (fsModule) => fsModule.promises.readdir(join7(assetsDir, "agents"))
+        (fsModule) => fsModule.promises.readdir(join8(assetsDir, "agents"))
       );
       const yamlFiles = agentFiles.filter((f) => f.endsWith(".yaml")).sort();
       printDryRun("Would run agent setup (interactive):");
@@ -4357,7 +4380,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
   console.log(chalk2.hex("#a855f7")(`
   \u2726 Arcane v${packageVersion}
 `));
-  const homeDir = dirname4(storeRoot);
+  const homeDir = dirname5(storeRoot);
   const components = USER_TIER_COMPONENTS.map(
     (name) => componentForScope(getComponent(name), "user")
   );
@@ -4375,7 +4398,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
     for (const id of spellIds) {
       for (const client2 of ["codex", "claude"]) {
         const relativePath = USER_FANOUT_PATHS[client2](id);
-        if (await fileExists(join7(homeDir, relativePath))) {
+        if (await fileExists(join8(homeDir, relativePath))) {
           printDryRun(`Would leave alone (exists, not written by Arcane): ~/${relativePath}`);
         } else {
           printDryRun(`Would write: ~/${relativePath}`);
@@ -4393,7 +4416,7 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
     const installedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join7(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const srcPath = join8(assetsDir, component.sourceOverrides?.[file] ?? file);
       fileHashes[file] = await copyFile(srcPath, storeRoot, file, { force: options.force });
       installedFiles.push(file);
       fileCount++;
@@ -4440,23 +4463,23 @@ async function runInitUser(options, storeRoot, assetsDir, packageVersion) {
 
 // src/modules/component-install.ts
 import { readFile as readFile8, stat, writeFile as writeFile9 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 async function planComponentInstall(component, targetDir, assetsDir, opts = {}) {
   const files = [];
   const stateOf = async (file, src) => {
-    const dest = join8(targetDir, file);
+    const dest = join9(targetDir, file);
     if (!await fileExists(dest)) return { file, src, state: "missing" };
     if ((await stat(dest)).isDirectory()) return { file, src, state: "directory" };
     const same = await hashFile(dest) === await hashFile(src);
     return { file, src, state: same ? "identical" : "differs" };
   };
   for (const file of component.files) {
-    files.push(await stateOf(file, join8(assetsDir, component.sourceOverrides?.[file] ?? file)));
+    files.push(await stateOf(file, join9(assetsDir, component.sourceOverrides?.[file] ?? file)));
   }
   for (const dir of component.directories ?? []) {
-    const srcDir = join8(assetsDir, dir);
+    const srcDir = join9(assetsDir, dir);
     for (const file of await listDirectoryFiles(srcDir, dir)) {
-      files.push(await stateOf(file, join8(assetsDir, file)));
+      files.push(await stateOf(file, join9(assetsDir, file)));
     }
   }
   const of = (...states) => files.filter((f) => states.includes(f.state));
@@ -4474,7 +4497,7 @@ async function executeInstallPlan(plan, targetDir) {
   const written = [];
   try {
     for (const { file, src, state } of plan.toCopy) {
-      const previous = state === "missing" ? null : await readFile8(join8(targetDir, file));
+      const previous = state === "missing" ? null : await readFile8(join9(targetDir, file));
       fileHashes[file] = await copyFile(src, targetDir, file, { force: true });
       written.push({ file, previous });
       files.push(file);
@@ -4492,7 +4515,7 @@ async function rollback(written, targetDir) {
         await removeWithin(targetDir, file);
         await removeEmptyAncestors(targetDir, file);
       } else {
-        await writeFile9(join8(targetDir, file), previous);
+        await writeFile9(join9(targetDir, file), previous);
       }
     } catch {
     }
@@ -4628,7 +4651,7 @@ async function runAdd(names, options, targetDir, assetsDir, packageVersion) {
 }
 
 // src/commands/update.ts
-import { dirname as dirname5, join as join10 } from "path";
+import { dirname as dirname6, join as join11 } from "path";
 import { readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
 
 // src/modules/merge3.ts
@@ -4760,7 +4783,7 @@ function merge3(base, ours, theirs) {
 }
 
 // src/modules/registry-changes.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function findMissingRequires(installed, profile) {
   const names = new Set(installed.flatMap((c) => LEGACY_COMPONENT_MIGRATIONS[c.name] ?? [c.name]));
   const promised = listProfiles().find((p) => p.id === profile)?.components;
@@ -4806,7 +4829,7 @@ async function findNewlyAvailable(targetDir, profile, installed, spellScope) {
     const alreadyPresent = [];
     if (component.skipExisting) {
       for (const file of component.files) {
-        if (await fileExists(join9(targetDir, file))) alreadyPresent.push(file);
+        if (await fileExists(join10(targetDir, file))) alreadyPresent.push(file);
       }
       if (component.files.length > 0 && alreadyPresent.length === component.files.length) continue;
     }
@@ -5065,7 +5088,7 @@ async function resolveOrphan(targetDir, file, recordedHash, prune) {
     console.log(`  ! Refused (path escapes the target directory): ${file}`);
     return "reported";
   }
-  const filePath = join10(targetDir, file);
+  const filePath = join11(targetDir, file);
   if (!await fileExists(filePath)) return "not-found";
   if (!prune) return "reported";
   if (recordedHash === void 0) {
@@ -5087,7 +5110,7 @@ async function isReleasableUserOwnedFile(targetDir, file, recordedHash) {
   } catch {
     return false;
   }
-  const filePath = join10(targetDir, file);
+  const filePath = join11(targetDir, file);
   if (!await fileExists(filePath)) return false;
   if (recordedHash === void 0) return true;
   return !await fileMatchesHash(filePath, recordedHash);
@@ -5098,7 +5121,7 @@ async function retainReportedOrphan(targetDir, file, recordedHash, into) {
   } catch {
     return;
   }
-  if (!await fileExists(join10(targetDir, file))) return;
+  if (!await fileExists(join11(targetDir, file))) return;
   if (!into.files.includes(file)) into.files.push(file);
   if (recordedHash !== void 0) {
     into.fileHashes ??= {};
@@ -5127,7 +5150,7 @@ async function findMissingTrackedFiles(targetDir, components, scope = "repo", sp
     const candidates = readopted.has(installed.name) ? component.files : installed.files;
     for (const file of candidates) {
       if (!component.files.includes(file)) continue;
-      if (!await fileExists(join10(targetDir, file))) missing.push(file);
+      if (!await fileExists(join11(targetDir, file))) missing.push(file);
     }
   }
   return missing;
@@ -5169,7 +5192,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   const movedFilesPresent = /* @__PURE__ */ new Set();
   for (const move of COMPONENT_FILE_MOVES) {
     for (const file of move.files) {
-      if (await fileExists(join10(targetDir, file))) movedFilesPresent.add(file);
+      if (await fileExists(join11(targetDir, file))) movedFilesPresent.add(file);
     }
   }
   manifest = {
@@ -5200,7 +5223,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       return;
     }
     try {
-      flagPatch = resolveManifestFlags(options.manifestFlags, manifest, join10(targetDir, ".arcane.json"));
+      flagPatch = resolveManifestFlags(options.manifestFlags, manifest, join11(targetDir, ".arcane.json"));
     } catch (err) {
       if (!(err instanceof ManifestFlagError)) throw err;
       console.error(`
@@ -5213,7 +5236,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
   const answered = { ...manifest, ...flagPatch };
   const spellScope = effectiveSpellScope(manifest);
   const readopted = findReadoptedSpellComponents(manifest.components, scope, spellScope);
-  const homeDir = dirname5(targetDir);
+  const homeDir = dirname6(targetDir);
   for (const line of await missingTierWarning(scope, spellScope)) console.log(line);
   if (scope === "repo") {
     console.warn(
@@ -5408,8 +5431,8 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
     const updatedFiles = [];
     const fileHashes = {};
     for (const file of component.files) {
-      const srcPath = join10(assetsDir, component.sourceOverrides?.[file] ?? file);
-      const targetExists = await fileExists(join10(targetDir, file));
+      const srcPath = join11(assetsDir, component.sourceOverrides?.[file] ?? file);
+      const targetExists = await fileExists(join11(targetDir, file));
       const preserveExisting = Boolean(component.skipExisting) && targetExists;
       const recordedHash = installed.fileHashes?.[file];
       if (component.initOnly && !targetExists) {
@@ -5429,7 +5452,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
           continue;
         }
       }
-      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join10(targetDir, file), recordedHash);
+      const editedByOperator = recordedHash !== void 0 && targetExists && !preserveExisting && !await fileMatchesHash(join11(targetDir, file), recordedHash);
       if (preserveExisting) {
         console.log(`  ${options.dryRun ? "[dry-run] Would preserve" : "Preserved"}: ${file}`);
       } else if (editedByOperator && isClientShimPath(file)) {
@@ -5456,11 +5479,11 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
             handled = true;
           } else {
             const [currentContent, newContent] = await Promise.all([
-              readFile9(join10(targetDir, file), "utf-8"),
+              readFile9(join11(targetDir, file), "utf-8"),
               readFile9(srcPath, "utf-8")
             ]);
             const result = merge3(oldVendorContent, currentContent, newContent);
-            await writeFile10(join10(targetDir, file), result.content, "utf-8");
+            await writeFile10(join11(targetDir, file), result.content, "utf-8");
             fileHashes[file] = await hashFile(srcPath);
             if (result.hasConflict) {
               conflictedFiles.push(file);
@@ -5482,7 +5505,7 @@ async function runUpdate(options, targetDir, assetsDir, packageVersion) {
       }
     }
     for (const dir of component.directories ?? []) {
-      const srcDirPath = join10(assetsDir, dir);
+      const srcDirPath = join11(assetsDir, dir);
       if (options.dryRun) {
         console.log(`  [dry-run] Would update directory: ${dir}/`);
       } else {
@@ -5642,11 +5665,11 @@ ${verb} ${orphansToReport.length} orphaned file(s) (tracked before this update,
 }
 
 // src/commands/status.ts
-import { dirname as dirname7 } from "path";
+import { dirname as dirname8 } from "path";
 
 // src/modules/version-check.ts
 import { readFile as readFile10, writeFile as writeFile11, mkdir as mkdir6 } from "fs/promises";
-import { dirname as dirname6, join as join11 } from "path";
+import { dirname as dirname7, join as join12 } from "path";
 import { homedir as homedir3 } from "os";
 import { createRequire } from "module";
 var require2 = createRequire(import.meta.url);
@@ -5660,7 +5683,7 @@ function getFeedUrl() {
   }
   return url;
 }
-var DEFAULT_CACHE_PATH = join11(homedir3(), ".arcane", "version-cache.json");
+var DEFAULT_CACHE_PATH = join12(homedir3(), ".arcane", "version-cache.json");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function readCache(cachePath) {
   try {
@@ -5675,7 +5698,7 @@ async function readCache(cachePath) {
   }
 }
 async function writeCache(cachePath, latest) {
-  await mkdir6(dirname6(cachePath), { recursive: true });
+  await mkdir6(dirname7(cachePath), { recursive: true });
   const entry = { latest, checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
   await writeFile11(cachePath, JSON.stringify(entry, null, 2), "utf-8");
 }
@@ -5816,7 +5839,7 @@ async function runStatus(targetDir, packageVersion, options = {}) {
   console.log("");
   if (scope === "user") {
     console.log(`  Scope: user \u2014 ${targetDir}`);
-    const health = await inspectUserTierFanout(dirname7(targetDir), manifest.fanout);
+    const health = await inspectUserTierFanout(dirname8(targetDir), manifest.fanout);
     console.log(
       `  Client files: ${health.total} (${health.byClient.codex} ${FANOUT_CLIENT_LABELS.codex}, ${health.byClient.claude} ${FANOUT_CLIENT_LABELS.claude})`
     );
@@ -5879,7 +5902,7 @@ async function runStatus(targetDir, packageVersion, options = {}) {
 
 // src/commands/uninstall.ts
 import { rm as rm5 } from "fs/promises";
-import { dirname as dirname8, join as join12 } from "path";
+import { dirname as dirname9, join as join13 } from "path";
 import { confirm as confirm3 } from "@inquirer/prompts";
 async function runUninstall(options, targetDir) {
   let manifest;
@@ -5962,16 +5985,16 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
       }
     }
   }
-  await rm5(join12(targetDir, ".arcane.json"), { force: true });
+  await rm5(join13(targetDir, ".arcane.json"), { force: true });
   const agentDirs = [
     ".github/agents",
     ".arcane/agents",
     ".arcane/generated"
   ];
   for (const dir of agentDirs) {
-    await rm5(join12(targetDir, dir), { recursive: true, force: true });
+    await rm5(join13(targetDir, dir), { recursive: true, force: true });
   }
-  await rm5(join12(targetDir, ".arcane/agents.yaml"), { force: true });
+  await rm5(join13(targetDir, ".arcane/agents.yaml"), { force: true });
   const markerFiles = [
     "CLAUDE.md",
     "AGENTS.md",
@@ -5988,7 +6011,7 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
 \u2713 Uninstalled \u2014 ${removed} files removed.`);
 }
 async function uninstallUserTier(options, storeRoot, manifest) {
-  const homeDir = dirname8(storeRoot);
+  const homeDir = dirname9(storeRoot);
   const storeFiles = manifest.components.flatMap((c) => c.files);
   const recordedCount = Object.keys(manifest.fanout ?? {}).length;
   if (options.dryRun) {
@@ -6033,10 +6056,10 @@ async function uninstallUserTier(options, storeRoot, manifest) {
       console.log(`  ! Skipped ${file}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  await rm5(join12(storeRoot, ".arcane.json"), { force: true });
-  await rm5(join12(storeRoot, "agents"), { recursive: true, force: true });
-  await rm5(join12(storeRoot, "agents.yaml"), { force: true });
-  await removeDirectoryIfEmpty(join12(storeRoot, USER_TIER_SPELLS_DIR));
+  await rm5(join13(storeRoot, ".arcane.json"), { force: true });
+  await rm5(join13(storeRoot, "agents"), { recursive: true, force: true });
+  await rm5(join13(storeRoot, "agents.yaml"), { force: true });
+  await removeDirectoryIfEmpty(join13(storeRoot, USER_TIER_SPELLS_DIR));
   await removeDirectoryIfEmpty(storeRoot);
   for (const line of describeFanoutOutcomes(fanout.outcomes)) console.log(`  ${line}`);
   const pruned = fanout.outcomes.filter((o) => o.status === "pruned").length;
@@ -6049,7 +6072,7 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 
 // src/commands/doctor.ts
 import { access as access4, readdir as readdir9, readFile as readFile13, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
-import { join as join15, dirname as dirname9 } from "path";
+import { join as join16, dirname as dirname10 } from "path";
 
 // src/config/incidents.ts
 var INCIDENT_QUEUE = [
@@ -6118,7 +6141,7 @@ function evaluateIncidentGate(records) {
 
 // src/modules/denylist-scan.ts
 import { readFile as readFile11, readdir as readdir7 } from "fs/promises";
-import { join as join13, relative } from "path";
+import { join as join14, relative } from "path";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -6169,7 +6192,7 @@ async function collectScannableFiles(root, repoRoot = root, extensions = DEFAULT
     return collected;
   }
   for (const entry of entries) {
-    const absolutePath = join13(root, entry.name);
+    const absolutePath = join14(root, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRECTORIES.has(entry.name)) continue;
       collected.push(...await collectScannableFiles(absolutePath, repoRoot, extensions));
@@ -6196,7 +6219,7 @@ import { existsSync, readFileSync } from "fs";
 import { win32 } from "path";
 var EXTERNAL_CLI_TIMEOUT_MS = 1e4;
 function execFileWithTimeout(file, args, timeoutMs, options = {}) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = execFile2(
       file,
       args,
@@ -6212,7 +6235,7 @@ function execFileWithTimeout(file, args, timeoutMs, options = {}) {
           reject(error);
           return;
         }
-        resolve5({ stdout, stderr });
+        resolve6({ stdout, stderr });
       }
     );
     child.stdin?.end();
@@ -6430,7 +6453,7 @@ function parseAdoRemote(url) {
 
 // src/modules/placeholders.ts
 import { readdir as readdir8, readFile as readFile12 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 var PLACEHOLDER_STANDARD_FILE = "spell-authoring-standards.md";
 var RUNTIME_PLACEHOLDERS_START = "<!-- runtime-placeholders:start -->";
 var RUNTIME_PLACEHOLDERS_END = "<!-- runtime-placeholders:end -->";
@@ -6525,7 +6548,7 @@ function parseRuntimePlaceholders(standardContent) {
 async function scanGovernancePlaceholders(governanceDir) {
   let standard;
   try {
-    standard = await readFile12(join14(governanceDir, PLACEHOLDER_STANDARD_FILE), "utf8");
+    standard = await readFile12(join15(governanceDir, PLACEHOLDER_STANDARD_FILE), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { status: "skipped", reason: `${PLACEHOLDER_STANDARD_FILE} is not installed` };
@@ -6544,7 +6567,7 @@ async function scanGovernancePlaceholders(governanceDir) {
   const templateDocs = [];
   const findings = [];
   for (const file of files) {
-    const content = await readFile12(join14(governanceDir, file), "utf8");
+    const content = await readFile12(join15(governanceDir, file), "utf8");
     const status = parseFrontmatterStatus(content);
     if (status === "template") templateDocs.push(file);
     if (status !== "active") continue;
@@ -6575,8 +6598,8 @@ async function checkNodeVersion() {
 async function checkVSCodeExtension(id, label2, homeDir = resolveHomeDir()) {
   const name = `VS Code extension: ${label2}`;
   const flavours = [
-    { dir: join15(homeDir, ".vscode", "extensions"), bin: "code" },
-    { dir: join15(homeDir, ".vscode-insiders", "extensions"), bin: "code-insiders" }
+    { dir: join16(homeDir, ".vscode", "extensions"), bin: "code" },
+    { dir: join16(homeDir, ".vscode-insiders", "extensions"), bin: "code-insiders" }
   ];
   let installBin = null;
   for (const flavour of flavours) {
@@ -6604,11 +6627,11 @@ async function checkVSCodeExtension(id, label2, homeDir = resolveHomeDir()) {
 }
 async function checkArcaneManifest(targetDir) {
   const name = "Arcane manifest (.arcane.json)";
-  const manifestPath2 = join15(targetDir, ".arcane.json");
+  const manifestPath2 = join16(targetDir, ".arcane.json");
   try {
     await access4(manifestPath2);
   } catch {
-    const selfHostedManifestPath = join15(targetDir, "src", "assets", ".arcane.json");
+    const selfHostedManifestPath = join16(targetDir, "src", "assets", ".arcane.json");
     try {
       const raw = await readFile13(selfHostedManifestPath, "utf8");
       const manifest = JSON.parse(raw);
@@ -6714,7 +6737,7 @@ async function checkSessionContinuity(targetDir) {
   const results = [];
   for (const file of SESSION_CONTINUITY_FILES) {
     const name = `Session file: ${file}`;
-    const filePath = join15(targetDir, file);
+    const filePath = join16(targetDir, file);
     try {
       await access4(filePath);
       results.push({ name, passed: true, message: "present" });
@@ -6732,12 +6755,12 @@ async function checkSessionContinuity(targetDir) {
 async function fixSessionContinuity(targetDir, assetsDir) {
   const created = [];
   for (const file of SESSION_CONTINUITY_FILES) {
-    const destPath = join15(targetDir, file);
+    const destPath = join16(targetDir, file);
     try {
       await access4(destPath);
     } catch {
-      const srcPath = join15(assetsDir, file);
-      await mkdir7(dirname9(destPath), { recursive: true });
+      const srcPath = join16(assetsDir, file);
+      await mkdir7(dirname10(destPath), { recursive: true });
       await fsCopyFile(srcPath, destPath);
       created.push(file);
     }
@@ -6864,7 +6887,7 @@ async function checkGovernancePlaceholders(targetDir) {
   const name = "Governance placeholders (ARC-051)";
   let scan;
   try {
-    scan = await scanGovernancePlaceholders(join15(targetDir, ".arcane", "governance"));
+    scan = await scanGovernancePlaceholders(join16(targetDir, ".arcane", "governance"));
   } catch (err) {
     return {
       name,
@@ -6951,7 +6974,7 @@ async function checkNewlyAvailableComponents(targetDir) {
 }
 async function checkMcpConfig(targetDir) {
   const name = "MCP config (per-server timeout, I12)";
-  const filePath = join15(targetDir, ".mcp.json");
+  const filePath = join16(targetDir, ".mcp.json");
   let raw;
   try {
     raw = await readFile13(filePath, "utf8");
@@ -7034,7 +7057,7 @@ function isDelegationsFile(value) {
 }
 async function checkDelegations(targetDir) {
   const name = "Standing delegations (T13)";
-  const filePath = join15(targetDir, ".arcane", "delegations.json");
+  const filePath = join16(targetDir, ".arcane", "delegations.json");
   let raw;
   try {
     raw = await readFile13(filePath, "utf8");
@@ -7147,7 +7170,7 @@ async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
   let probed = false;
   const probe = "spell-status.md";
   try {
-    const entries = await readdir9(join15(storeRoot, USER_TIER_SPELLS_DIR));
+    const entries = await readdir9(join16(storeRoot, USER_TIER_SPELLS_DIR));
     const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
     spellCount = spells.length;
     probed = spells.includes(probe);
@@ -7261,7 +7284,7 @@ import { readFile as readFile15 } from "fs/promises";
 
 // src/modules/ward.ts
 import { readdir as readdir10, readFile as readFile14 } from "fs/promises";
-import { join as join16, relative as relative2 } from "path";
+import { join as join17, relative as relative2 } from "path";
 async function scanFileAllRules(absolutePath, displayPath, rules) {
   const findings = [];
   let content;
@@ -7324,7 +7347,7 @@ async function scanFilenames(root, rules, repoRoot = root) {
     return findings;
   }
   for (const entry of entries) {
-    const absolutePath = join16(root, entry.name);
+    const absolutePath = join17(root, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRECTORIES.has(entry.name)) continue;
       findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
@@ -7439,7 +7462,7 @@ async function runWardCli(targetDir, options = {}, exclusions = []) {
 }
 
 // src/commands/unblock-push.ts
-import { basename as basename2, resolve as resolve3 } from "path";
+import { basename as basename3, resolve as resolve4 } from "path";
 import { input as input4 } from "@inquirer/prompts";
 async function runUnblockPush(targetDir) {
   let manifest;
@@ -7471,7 +7494,7 @@ async function runUnblockPush(targetDir) {
     process.exit(1);
     return;
   }
-  const repoName = basename2(resolve3(targetDir));
+  const repoName = basename3(resolve4(targetDir));
   if (repoName === "") {
     console.error(
       "Could not determine a repository name to confirm against (is this repository at a filesystem root?). Refusing to unblock."
@@ -7756,6 +7779,70 @@ function resolveIdentityEnvironment(env = process.env) {
 import { createServer } from "http";
 import { execFile as execFile3 } from "child_process";
 import * as client from "openid-client";
+
+// src/modules/result-pages.ts
+import { createHash as createHash3 } from "crypto";
+import { readFile as readFile16 } from "fs/promises";
+import { join as join18 } from "path";
+var RESULT_KINDS = ["success", "denied", "failure"];
+function resultPagePath(kind) {
+  return join18("sign-in", `sign-in-callback-${kind}.html`);
+}
+function styleHashes(html) {
+  return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match) => {
+    const text = match[1].replace(/\r\n?/g, "\n");
+    return `'sha256-${createHash3("sha256").update(text, "utf8").digest("base64")}'`;
+  });
+}
+function resultPageHeaders(html) {
+  const hashes = [...new Set(styleHashes(html))];
+  return {
+    "cache-control": "no-store",
+    "content-security-policy": [
+      "default-src 'none'",
+      `style-src ${hashes.length > 0 ? hashes.join(" ") : "'none'"}`,
+      "img-src data:",
+      "font-src data:",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'"
+    ].join("; "),
+    "content-type": "text/html; charset=utf-8",
+    "referrer-policy": "no-referrer",
+    "x-content-type-options": "nosniff"
+  };
+}
+function resultPage(html) {
+  return { html, headers: resultPageHeaders(html) };
+}
+function plainPage(heading, next) {
+  return resultPage(
+    [
+      '<!doctype html><html lang="en"><meta charset="utf-8">',
+      '<meta name="viewport" content="width=device-width, initial-scale=1">',
+      `<title>${heading} \u2014 Arcane</title>`,
+      "<style>:root{color-scheme:light dark}body{font-family:system-ui,sans-serif;margin:3rem;line-height:1.5}</style>",
+      `<body><h1>${heading}</h1><p>${next}</p></body></html>`
+    ].join("")
+  );
+}
+var PLAIN_RESULT_PAGES = {
+  success: plainPage("Signed in to Arcane", "Return to your terminal. Your browser can be closed now."),
+  denied: plainPage("Sign-in was not completed", "Return to your terminal to try again. No new session was stored."),
+  failure: plainPage("Could not finish sign-in", "Return to your terminal for details. No new session was stored.")
+};
+async function loadResultPages(assetsDir) {
+  try {
+    const [success, denied, failure] = await Promise.all(
+      RESULT_KINDS.map(async (kind) => resultPage(await readFile16(join18(assetsDir, resultPagePath(kind)), "utf8")))
+    );
+    return { success, denied, failure };
+  } catch {
+    return null;
+  }
+}
+
+// src/modules/oidc.ts
 var IdentityUnreachableError = class extends Error {
   constructor(host, cause) {
     super(`Could not reach the identity service at ${host}.`);
@@ -7769,6 +7856,12 @@ var LoginTimeoutError = class extends Error {
     this.name = "LoginTimeoutError";
   }
 };
+var LoginBrowserUnavailableError = class extends Error {
+  constructor() {
+    super("No browser could be opened. Run `spell login --device-code` and finish signing in on another device.");
+    this.name = "LoginBrowserUnavailableError";
+  }
+};
 var LoginDeniedError = class extends Error {
   constructor(code) {
     super(`The identity service refused the sign-in (${code}).`);
@@ -7811,25 +7904,17 @@ function toTokenResult(tokens, previousRefreshToken) {
     expiresAt: new Date(now.getTime() + seconds * 1e3)
   };
 }
-var CLOSE_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Signed in to Arcane</h1>',
-  "<p>You can close this window and go back to the terminal.</p></body>"
-].join("");
-var FAILED_PAGE = [
-  '<!doctype html><meta charset="utf-8"><title>Arcane</title>',
-  '<body style="font-family:system-ui;margin:3rem"><h1>Sign-in not completed</h1>',
-  "<p>Go back to the terminal for what to do next.</p></body>"
-].join("");
+var resultPath = (kind) => `/result/${kind}`;
+var RESULT_PATHS = new Set(RESULT_KINDS.map(resultPath));
 async function browserLogin(config, options) {
   const codeVerifier = client.randomPKCECodeVerifier();
   const codeChallenge = await client.calculatePKCECodeChallenge(codeVerifier);
   const state = client.randomState();
   const nonce = client.randomNonce();
   const server = createServer();
-  await new Promise((resolve5, reject) => {
+  await new Promise((resolve6, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolve5());
+    server.listen(0, "127.0.0.1", () => resolve6());
   });
   const address = server.address();
   if (address === null || typeof address === "string") {
@@ -7845,24 +7930,66 @@ async function browserLogin(config, options) {
     state,
     nonce
   });
+  const pages = options.pages ?? PLAIN_RESULT_PAGES;
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let timer;
+  let callbackConsumed = false;
+  let browserResult;
   const close = () => {
     if (timer) clearTimeout(timer);
     server.closeAllConnections?.();
     server.close();
   };
-  const tokens = new Promise((resolve5, reject) => {
+  const tokens = new Promise((resolve6, reject) => {
     server.on("request", (req, res) => {
       const url = new URL(req.url ?? "/", redirectUri);
+      if (RESULT_PATHS.has(url.pathname)) {
+        if (!browserResult || url.pathname !== resultPath(browserResult.kind) || url.search !== "") {
+          res.writeHead(404).end();
+          return;
+        }
+        const served = browserResult;
+        const page = pages[served.kind];
+        const settle = () => {
+          if (served.kind === "success") resolve6(served.result);
+          else reject(served.error);
+        };
+        res.once("finish", settle).once("close", settle);
+        res.writeHead(200, page.headers).end(page.html);
+        return;
+      }
       if (url.pathname !== "/" || !url.searchParams.has("code") && !url.searchParams.has("error")) {
         res.writeHead(404).end();
         return;
       }
+      if (callbackConsumed) {
+        res.writeHead(409, { "cache-control": "no-store" }).end();
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.writeHead(400, pages.failure.headers).end(pages.failure.html);
+        return;
+      }
+      callbackConsumed = true;
+      const redirectToResult = (result) => {
+        browserResult = result;
+        res.writeHead(303, {
+          "cache-control": "no-store",
+          location: resultPath(result.kind),
+          "referrer-policy": "no-referrer"
+        }).end();
+        if (result.kind === "success") {
+          if (timer) clearTimeout(timer);
+          timer = setTimeout(() => resolve6(result.result), Math.min(timeoutMs, 5e3));
+        }
+      };
       const errorCode = url.searchParams.get("error");
       if (errorCode) {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(new LoginDeniedError(errorCode.replace(/[^a-z_]/gi, "")));
+        const code = errorCode.replace(/[^a-z_]/gi, "");
+        redirectToResult({
+          kind: code === "access_denied" ? "denied" : "failure",
+          error: new LoginDeniedError(code)
+        });
         return;
       }
       client.authorizationCodeGrant(config, url, {
@@ -7873,11 +8000,9 @@ async function browserLogin(config, options) {
       }).then(async (response) => {
         const result = toTokenResult(response);
         await options.onValidated?.(result);
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(CLOSE_PAGE);
-        resolve5(result);
+        redirectToResult({ kind: "success", result });
       }).catch((error) => {
-        res.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(FAILED_PAGE);
-        reject(error);
+        redirectToResult({ kind: "failure", error });
       });
     });
     timer = setTimeout(() => reject(new LoginTimeoutError()), timeoutMs);
@@ -7886,7 +8011,10 @@ async function browserLogin(config, options) {
   });
   try {
     const opened = await options.openUrl(authorizationUrl.href);
-    if (!opened) options.onCannotOpen?.(authorizationUrl.href);
+    if (!opened) {
+      options.onCannotOpen?.();
+      throw new LoginBrowserUnavailableError();
+    }
     return await tokens;
   } finally {
     close();
@@ -7904,12 +8032,12 @@ async function refreshSession(config, refreshToken, scopes) {
 }
 function openInDefaultBrowser(url) {
   const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
-      const child = execFile3(command, args, { windowsHide: true }, (error) => resolve5(!error));
-      child.on("error", () => resolve5(false));
+      const child = execFile3(command, args, { windowsHide: true }, (error) => resolve6(!error));
+      child.on("error", () => resolve6(false));
     } catch {
-      resolve5(false);
+      resolve6(false);
     }
   });
 }
@@ -7918,7 +8046,7 @@ function openInDefaultBrowser(url) {
 import { execFileSync } from "child_process";
 import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, existsSync as existsSync2 } from "fs";
 import { userInfo } from "os";
-import { dirname as dirname10, join as join17 } from "path";
+import { dirname as dirname11, join as join19 } from "path";
 
 // src/modules/keychain-backend.ts
 import { createRequire as createRequire2 } from "module";
@@ -8007,7 +8135,7 @@ var FileSecretBackend = class {
       rmSync(this.filePath, { force: true });
       return;
     }
-    mkdirSync(dirname10(this.filePath), { recursive: true });
+    mkdirSync(dirname11(this.filePath), { recursive: true });
     const tmp = `${this.filePath}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(entries), { encoding: "utf8", mode: 384 });
     try {
@@ -8052,7 +8180,7 @@ function restrictToCurrentUser(filePath) {
   });
 }
 function insecureSessionFilePath(homeDir) {
-  return join17(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
+  return join19(userTierRoot(homeDir), INSECURE_SESSION_FILE_NAME);
 }
 function createSessionStorage(options = {}) {
   const keychain = new ChunkedSecretStore(options.keychainBackend ?? createKeychainBackend());
@@ -8118,7 +8246,7 @@ function createSessionStorage(options = {}) {
 }
 
 // src/commands/login.ts
-function defaultLoginDeps() {
+function defaultLoginDeps(assetsDir) {
   return {
     storage: createSessionStorage(),
     environment: () => resolveIdentityEnvironment(),
@@ -8126,10 +8254,12 @@ function defaultLoginDeps() {
     browserLogin,
     deviceLogin,
     openUrl: openInDefaultBrowser,
-    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY)
+    isInteractive: () => Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    resultPages: () => loadResultPages(assetsDir)
   };
 }
 var INSECURE_STORAGE_WARNING = "Insecure storage: the session is kept in a file protected only by your account's file permissions, not in the OS keychain. Run `spell logout` to remove it.";
+var MISSING_RESULT_PAGES_WARNING = "This arcane-cli install is missing its sign-in result pages (assets/sign-in/), so the browser will show a plain page. Reinstall the package to restore them.";
 function safeErrorText(error) {
   const message = error instanceof Error ? error.message : String(error);
   return message.split("\n")[0].replace(/([?&](?:code|state|id_token|access_token|refresh_token)=)[^&\s]+/gi, "$1[redacted]");
@@ -8149,7 +8279,7 @@ function describeAccount(record) {
   const who = record.email ? `${record.email} (${record.sub})` : record.sub;
   return record.environment === "development" ? `${who} [development]` : who;
 }
-async function runLogin(options, deps = defaultLoginDeps()) {
+async function runLogin(options, deps) {
   let environment;
   try {
     environment = deps.environment();
@@ -8195,14 +8325,16 @@ async function runLogin(options, deps = defaultLoginDeps()) {
       });
       saveValidatedSession(result);
     } else {
+      const pages = await deps.resultPages();
+      if (!pages) printWarning(MISSING_RESULT_PAGES_WARNING);
       printInfo("Opening your browser to sign in to Arcane. Come back here when it says you are signed in.");
       await deps.browserLogin(config, {
         scopes: SIGN_IN_SCOPES,
         openUrl: deps.openUrl,
+        pages: pages ?? void 0,
         onValidated: saveValidatedSession,
-        onCannotOpen: (url) => {
-          printWarning("No browser could be opened. Open this address yourself, or run `spell login --device-code`:");
-          printInfo(url);
+        onCannotOpen: () => {
+          printWarning("No browser could be opened. Run `spell login --device-code` to sign in on another device.");
         }
       });
       if (!record) throw new Error("The browser sign-in ended without storing a session.");
@@ -8316,15 +8448,15 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
 
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir11, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
-import { basename as basename3, dirname as dirname11, isAbsolute, join as join19, relative as relative3, resolve as resolve4 } from "path";
+import { mkdir as mkdir8, readdir as readdir11, readFile as readFile18, writeFile as writeFile12 } from "fs/promises";
+import { basename as basename4, dirname as dirname12, isAbsolute, join as join21, relative as relative3, resolve as resolve5 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile16 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile17 } from "fs/promises";
+import { join as join20 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -8597,7 +8729,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path4) {
   try {
-    return await readFile16(path4, "utf8");
+    return await readFile17(path4, "utf8");
   } catch {
     return null;
   }
@@ -8693,13 +8825,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join18(options.rootDir, options.planRelPath);
-  const queueAbsPath = join18(options.rootDir, options.queueRelPath);
+  const planAbsPath = join20(options.rootDir, options.planRelPath);
+  const queueAbsPath = join20(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join18(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join18(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join20(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join20(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile16(planAbsPath, "utf8"),
+    readFile17(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -8895,7 +9027,7 @@ function toPosix(path4) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile17(join19(rootDir, planRelPath), "utf8");
+    planContent = await readFile18(join21(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -8907,13 +9039,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join19(dirname11(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join21(dirname12(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join19(rootDir, "docs", "plans");
+  const plansDir = join21(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir11(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -8931,23 +9063,23 @@ async function discoverPrograms(rootDir) {
   return { programs, skipped };
 }
 async function programFromPlanPath(rootDir, planPath) {
-  const planAbs = isAbsolute(planPath) ? planPath : resolve4(rootDir, planPath);
+  const planAbs = isAbsolute(planPath) ? planPath : resolve5(rootDir, planPath);
   const planRelPath = toPosix(relative3(rootDir, planAbs));
-  return programFromPlan(rootDir, basename3(dirname11(planAbs)), planRelPath);
+  return programFromPlan(rootDir, basename4(dirname12(planAbs)), planRelPath);
 }
 function normalizeLineEndings2(content) {
   return content.replace(/\r\n?/g, "\n");
 }
 async function readOptionalFile(path4) {
   try {
-    return await readFile17(path4, "utf8");
+    return await readFile18(path4, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw error;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile17(join19(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile18(join21(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -8967,7 +9099,7 @@ async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile17(options.templatePath, "utf8");
+  const templateHtml = await readFile18(options.templatePath, "utf8");
   const theme = options.theme ?? "auto";
   const drifted = [];
   const repaired = [];
@@ -8978,19 +9110,19 @@ async function runReportGeneration(options) {
     if (!generated.themeApplied) themeSkipped.push(program2.slug);
     const missing = JSON.parse(generated.json).sections.flatMap((section) => section.rows).filter((row) => row.descriptionState === "unwritten").map((row) => row.id);
     if (missing.length > 0) unwritten.push({ slug: program2.slug, ids: missing });
-    const outAbs = options.outDir ? isAbsolute(options.outDir) ? options.outDir : resolve4(options.rootDir, options.outDir) : resolve4(options.rootDir, dirname11(program2.planRelPath));
+    const outAbs = options.outDir ? isAbsolute(options.outDir) ? options.outDir : resolve5(options.rootDir, options.outDir) : resolve5(options.rootDir, dirname12(program2.planRelPath));
     const outRel = toPosix(relative3(options.rootDir, outAbs));
     const outputs = [
       [`${outRel}/show-report.json`, generated.json],
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join19(options.rootDir, relPath));
+      const actual = await readOptionalFile(join21(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile12(join19(options.rootDir, relPath), expected, "utf8");
+          await writeFile12(join21(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -9001,7 +9133,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join20(assetsDir, "report", "show-report.template.html");
+  const templatePath = join22(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -9075,10 +9207,10 @@ async function runReport(targetDir, options = {}, assetsDir) {
 }
 
 // src/index.ts
-import { realpathSync } from "fs";
+import { realpathSync as realpathSync2 } from "fs";
 var require3 = createRequire3(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join21(dirname12(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join23(dirname13(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -9205,7 +9337,7 @@ program.command("login").description("Sign in to your Arcane account (browser by
   "--insecure-storage",
   "Keep the session in a file under ~/.arcane instead of the OS keychain; protected only by your account's file permissions"
 ).action(async (opts) => {
-  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage });
+  await runLogin({ deviceCode: opts.deviceCode, insecureStorage: opts.insecureStorage }, defaultLoginDeps(ASSETS_DIR));
 });
 program.command("logout").description("Sign out on this machine: remove the stored session").action(() => {
   runLogout();
@@ -9288,7 +9420,7 @@ agentsCommand.command("list").description("Show the current agent roster with as
   const scope = opts.user ? "user" : "repo";
   await runAgentsList(agentsTargetDir(scope, process.cwd()), scope);
 });
-if (realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (realpathSync2(process.argv[1]) === fileURLToPath(import.meta.url)) {
   await program.parseAsync(process.argv);
 }
 export {