beehaven 0.8.24 → 0.8.27

package/dist/agent-state.js

@@ -421,6 +421,25 @@ export function clearAgentSession(name) {
     }
     catch { /* best-effort cleanup */ }
 }
+/**
+ * Forget the ended work session's id, and nothing else (AWO-225 `agent handoff`).
+ *
+ * ⚠ NOT `clearAgentSession`: that also drops `lastLoginAt`, which `agentForScope` uses to choose
+ * between identities bound to one scope. A handoff ends a stretch of work, not the sign-in, so the
+ * terminal must keep resolving to this agent.
+ */
+export function clearAgentSessionId(name) {
+    try {
+        const rec = loadAgent(name);
+        if (!rec)
+            return;
+        const raw = { ...rec };
+        delete raw.sessionId;
+        delete raw.session;
+        saveAgent(name, raw);
+    }
+    catch { /* best-effort cleanup */ }
+}
 /** The last session id we started for this agent, if any. */
 export function loadAgentSession(name) {
     try {

package/dist/browser-login.js

@@ -0,0 +1,283 @@
+/**
+ * The ONE browser sign-in: localhost loopback OAuth against `<web origin>/cli/auth`.
+ *
+ * ⚠⚠ AWO-224 — THERE WERE TWO, AND ONE POINTED AT A ROUTE THAT NO LONGER EXISTS. `beehaven login`
+ * carried this flow inline in cli.ts; the daemon's interactive fallback (no token on start, or an
+ * expired session) had its own copy in setup-relay.ts that opened `/auth/beehaven?callback=` and
+ * waited for a single `token`. The web app removed that route, so the fallback opened a 404 and
+ * hung for two minutes before exiting. Both callers now use this module; the daemon fallback
+ * cannot drift from the command people actually run.
+ *
+ * The pattern is firebase-tools / wrangler / gh / vercel / fly / supabase: start an ephemeral
+ * HTTP server on a free port, open the browser to `/cli/auth?state=…&redirect=http://127.0.0.1:
+ * <port>/callback`. After the user signs in and approves, the page navigates the browser to the
+ * loopback with the Firebase tokens. The CLI validates state, stores the tokens and shuts the
+ * server down. The web origin and the Worker are NOT in the token-exchange path: tokens go from
+ * the browser's authed session straight to localhost, and state (anti-CSRF) stops a malicious site
+ * sending tokens to a CLI that did not ask for them.
+ *
+ * What a caller does AFTER signing in (restart the daemon, install agent skills) stays with the
+ * caller: the daemon fallback runs INSIDE the daemon and must not restart itself.
+ */
+import http from 'http';
+import net from 'net';
+import { spawn } from 'child_process';
+import crypto from 'crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { color } from './spinner.js';
+import { resolveRelaySelection } from './relay-presets.js';
+import { withUtm } from './utm.js';
+import { keychain } from './keychain.js';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Resolve the web origin from the active env so staging users sign in against staging's Pages
+ * alias (or local dev), prod users against prod.
+ */
+const ENV_AUTH_ORIGINS = {
+    prod: 'https://www.clearly.sh',
+    staging: 'https://localhost:3000',
+    dev: 'https://localhost:3000',
+};
+const configPath = () => join(homedir(), '.beehaven', 'config.json');
+function readConfig() {
+    try {
+        const p = configPath();
+        return existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function resolveAuthOrigin(cfg = readConfig(), env = process.env) {
+    let activeEnv = 'prod';
+    try {
+        // Derive env from the canonical endpoint, not the cfg.envName alias (a fresh login / Mac-app
+        // install may write only `endpoint`).
+        const { envName } = resolveRelaySelection(cfg);
+        if (ENV_AUTH_ORIGINS[envName])
+            activeEnv = envName;
+    }
+    catch { }
+    return { authOrigin: env.BEEHAVEN_AUTH_ORIGIN ?? ENV_AUTH_ORIGINS[activeEnv], activeEnv };
+}
+/** The page the web app serves for this flow: app/(auth)/cli/auth. */
+export function cliAuthUrl(authOrigin, state, callbackUrl) {
+    return withUtm(`${authOrigin}/cli/auth?state=${state}&redirect=${encodeURIComponent(callbackUrl)}`);
+}
+/** Pre-warning: a non-prod env requires a local dev server. */
+async function warnIfLocalDevDown() {
+    const probe = await new Promise((resolve) => {
+        const t = setTimeout(() => resolve(false), 800);
+        const sock = net.createConnection(3000, '127.0.0.1');
+        sock.once('connect', () => {
+            clearTimeout(t);
+            sock.destroy();
+            resolve(true);
+        });
+        sock.once('error', () => {
+            clearTimeout(t);
+            resolve(false);
+        });
+    }).catch(() => false);
+    if (!probe) {
+        console.log('');
+        console.log(`  ${color.yellow('!')} localhost:3000 isn't responding.`);
+        console.log(`    Run ${color.cyan('npm run dev')} (with --experimental-https) in the clearly monorepo first.`);
+        console.log('');
+    }
+}
+/**
+ * Best-effort browser open. macOS `open` dispatches to the user's default browser; xdg-open on
+ * Linux; start on Windows. Failure is SURFACED — silent failure was the bug — so the person can
+ * paste the URL themselves.
+ */
+function openInBrowser(url) {
+    try {
+        const opener = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+        const proc = spawn(opener, [url], { stdio: 'ignore', detached: true });
+        proc.unref();
+        proc.on('error', (err) => {
+            console.log(`  ${color.yellow('!')} Couldn't auto-open browser: ${err.message}`);
+            console.log(`    Paste this URL into your browser instead:`);
+            console.log(`    ${color.cyan(url)}`);
+        });
+    }
+    catch (err) {
+        console.log(`  ${color.yellow('!')} Couldn't spawn opener: ${err?.message ?? err}`);
+        console.log(`    Paste this URL into your browser instead:`);
+        console.log(`    ${color.cyan(url)}`);
+    }
+}
+/**
+ * Tiny success page the browser sees AFTER it navigates to the loopback. Self-contained — no
+ * external assets, works offline. Auto-close after 1.5s on supported browsers (Chrome/Firefox allow
+ * window.close on self-opened or scripted-navigated tabs).
+ */
+const successHtml = `<!doctype html>
+<html><head><meta charset="utf-8"><title>beehaven CLI signed in</title>
+<style>
+  body { font: 15px -apple-system, sans-serif; background: #fafaf9; color: #292524;
+         display: grid; place-items: center; min-height: 100vh; margin: 0; }
+  .card { background: white; padding: 32px 40px; border-radius: 14px;
+          box-shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
+          max-width: 420px; }
+  h1 { font-size: 20px; margin: 0 0 8px; letter-spacing: -0.01em; }
+  p { color: #57534e; margin: 8px 0; }
+  .ok { color: #16a34a; }
+  .eyebrow { font-size: 10px; letter-spacing: .22em; color: #a8a29e;
+             text-transform: uppercase; margin-bottom: 8px; }
+</style></head>
+<body><div class="card">
+  <p class="eyebrow">01 — beehaven CLI</p>
+  <h1><span class="ok">✓</span> Signed in</h1>
+  <p>The CLI now has your credentials. You can close this tab and
+     return to your terminal.</p>
+</div>
+<script>setTimeout(() => { try { window.close(); } catch (e) {} }, 1500);</script>
+</body></html>`;
+const errorHtml = (msg) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>beehaven CLI error</title>
+<style>body{font:15px -apple-system,sans-serif;padding:40px;color:#292524}
+.err{color:#dc2626}</style></head>
+<body><h1 class="err">✗ Sign-in error</h1><p>${msg}</p>
+<p><small>Run <code>beehaven login</code> again from your terminal.</small></p>
+</body></html>`;
+/**
+ * Spin up the loopback server (the OS picks a free port), open the browser and resolve with the
+ * tokens the `/cli/auth` page hands back. `open` is injectable so the contract can be exercised
+ * without a browser.
+ */
+export function captureBrowserLogin(opts) {
+    const { authOrigin, timeoutMs = LOGIN_TIMEOUT_MS, open = openInBrowser } = opts;
+    const state = crypto.randomBytes(16).toString('hex');
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            if (req.method !== 'GET' || !(req.url ?? '').startsWith('/callback')) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not Found');
+                return;
+            }
+            // Tokens arrive as ?state=…&idToken=…&refreshToken=…&userId=… because the web side
+            // window.location.assign'd here — fetch() from HTTPS to an HTTP loopback is mixed-content
+            // blocked by every browser since 2020, so top-level navigation is the standard pattern.
+            const url = new URL(req.url, `http://127.0.0.1`);
+            const presentedState = url.searchParams.get('state') ?? '';
+            const idToken = url.searchParams.get('idToken') ?? '';
+            const refreshToken = url.searchParams.get('refreshToken') ?? '';
+            const userId = url.searchParams.get('userId') ?? '';
+            const email = url.searchParams.get('email') ?? undefined;
+            const displayName = url.searchParams.get('displayName') ?? undefined;
+            if (presentedState !== state) {
+                res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end(errorHtml("State mismatch — the CLI didn't initiate this sign-in."));
+                return;
+            }
+            if (!idToken || !refreshToken || !userId) {
+                res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+                res.end(errorHtml('Missing token fields. Try <code>beehaven login</code> again.'));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+            res.end(successHtml);
+            // Tear down after the response flushes so the browser can render the success page before
+            // the connection drops.
+            setTimeout(() => {
+                try {
+                    server.close();
+                }
+                catch { }
+            }, 500);
+            resolve({ idToken, refreshToken, userId, email, displayName });
+        });
+        server.on('error', reject);
+        // An upper bound so a forgotten browser tab doesn't hang the terminal forever.
+        const timeout = setTimeout(() => {
+            try {
+                server.close();
+            }
+            catch { }
+            reject(new Error(`Sign-in timed out after ${Math.round(timeoutMs / 60_000)} minutes.`));
+        }, timeoutMs);
+        server.on('close', () => clearTimeout(timeout));
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = addr && typeof addr === 'object' ? addr.port : 0;
+            const callbackUrl = `http://127.0.0.1:${port}/callback`;
+            const url = cliAuthUrl(authOrigin, state, callbackUrl);
+            console.log('');
+            console.log(`  ${color.cyan('→')} Opening browser to ${authOrigin}/cli/auth …`);
+            console.log(`  ${color.dim("If it doesn't open: ")}${color.dim(url)}`);
+            console.log(`  ${color.dim('Listening on ' + callbackUrl + ` (${Math.round(timeoutMs / 60_000)}-min timeout).`)}`);
+            console.log('');
+            open(url);
+        });
+    });
+}
+/**
+ * Persist the captured tokens. Mirror the Mac app's installDaemon flow exactly: the keychain stores
+ * the **idToken** under service='beehaven', account='daemon-token', because that is what
+ * relay.ts:Relay.loadConfig reads on every daemon launch. The refresh token stays in config.json
+ * where relay.ts:refreshIdToken reads it.
+ *
+ * Earlier the refreshToken went into the keychain — the wrong slot. The daemon then authenticated
+ * its WebSocket with the refresh token, got 401, refreshed successfully but wrote the new idToken
+ * to config.json (not the keychain), and the loop repeated on every restart.
+ *
+ * Throws when config.json cannot be written; a sign-in that saved nothing has not signed anyone in.
+ */
+export function persistBrowserLogin(captured) {
+    try {
+        keychain.setToken(captured.idToken);
+    }
+    catch { }
+    try {
+        const cfgDir = join(homedir(), '.beehaven');
+        if (!existsSync(cfgDir))
+            mkdirSync(cfgDir, { recursive: true, mode: 0o700 });
+        const existing = readConfig();
+        /**
+         * ⚠⚠ SIGNING IN WRITES A DIAL TARGET. It used to write only credentials and lean on
+         * `...existing` to carry `endpoint` forward — which PRESERVES one and can never CREATE one.
+         * So on a config that had none (a fresh install before the Mac app's `install()` ran, or any
+         * config after `logout`, which deletes `endpoint` by name) login produced valid tokens with
+         * nothing to connect to, and the daemon reported "Token refresh failed" while the tray read
+         * "agent offline". A login that leaves the user unable to connect has not signed anyone in.
+         *
+         * ⚠ RESOLVED FROM THE CONFIG, NEVER A HARDCODED CONSTANT — `resolveRelaySelection` keys off
+         * whichever key is present and defaults to prod only when neither is. Pinning a literal here is
+         * the bug the old setup-relay.ts flow had: it sent every staging login to the prod relay.
+         *
+         * ⚠ BOTH KEYS, KEPT IN SYNC, exactly as `beehaven env` writes them — `endpoint` is what the
+         * relay client dials and `relayUrl` is the alias other surfaces read.
+         */
+        const { url: dialUrl } = resolveRelaySelection(existing);
+        const next = {
+            ...existing,
+            onboarded: true,
+            tier: existing.tier ?? 'connected',
+            userId: captured.userId,
+            email: captured.email ?? null,
+            displayName: captured.displayName ?? null,
+            tokenStorage: 'keychain',
+            refreshToken: captured.refreshToken,
+            token: captured.idToken,
+            endpoint: dialUrl,
+            relayUrl: dialUrl,
+        };
+        writeFileSync(configPath(), JSON.stringify(next, null, 2), { mode: 0o600 });
+    }
+    catch (err) {
+        throw new Error(`Failed to write config: ${err?.message ?? err}`);
+    }
+}
+/** Resolve the origin, warn about a missing local dev server, capture and persist. */
+export async function browserLogin() {
+    const { authOrigin, activeEnv } = resolveAuthOrigin();
+    if (activeEnv !== 'prod')
+        await warnIfLocalDevDown();
+    const captured = await captureBrowserLogin({ authOrigin });
+    persistBrowserLogin(captured);
+    return captured;
+}

package/dist/build-channel.js

@@ -53,9 +53,9 @@ export const PUBLIC_BUILD = true;
  * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
  * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
  */
-export const BUILD_SHA = '150d0d2c336a';
+export const BUILD_SHA = 'db2b3eaeb90b';
 /** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
-export const BUILD_TIME = '2026-10-02T08:34Z';
+export const BUILD_TIME = '2026-10-07T02:00Z';
 /**
  * The build identity as one short string, for `--version`.
  *

package/dist/cli.js

@@ -2940,7 +2940,7 @@ async function run() {
                 console.error(`      beehaven start --headless`);
                 console.error(``);
                 console.error(`  The Mac tray is only required for the LOCAL hive — avatar`);
-                console.error(`  building, voice and mood. Install: ${color.dim('https://clearly.sh/docs/beehaven')}`);
+                console.error(`  building, voice and mood. Install: ${color.dim('https://www.clearly.sh/docs/beehaven')}`);
                 process.exit(1);
             }
             console.log(`  Launching ${opened}…`);
@@ -3005,272 +3005,20 @@ async function run() {
                 await login(emailArg, password);
                 break;
             }
-            // ─── Localhost loopback OAuth (firebase-tools / wrangler /
-            //     gh / vercel / fly / supabase pattern) ─────────────────
-            //
-            // The CLI starts an ephemeral HTTP server on a free port,
-            // opens the user's browser to clearly.sh/cli/auth?state=…
-            // &redirect=http://127.0.0.1:<port>/callback. After the user
-            // signs in + clicks Approve, the web page POSTs the user's
-            // Firebase tokens directly to the loopback. The CLI captures,
-            // validates state, stores in keychain + config, and shuts
-            // down the server. Single round-trip, instant feedback.
-            //
-            // The clearly.sh web origin and the worker are NOT in the
-            // token-exchange path — tokens go from the browser's authed
-            // session straight to localhost. State (anti-CSRF) prevents
-            // a malicious site from sending tokens to a CLI that didn't
-            // request them.
-            const http = await import('http');
-            const netMod = await import('net');
-            const childProcess = await import('child_process');
-            const cryptoMod = await import('crypto');
-            const state = cryptoMod.randomBytes(16).toString('hex');
-            // Resolve the web origin from the active env so staging
-            // users sign in against staging's Pages alias (or local
-            // dev), prod users against prod.
-            const ENV_AUTH_ORIGINS = {
-                prod: 'https://clearly.sh',
-                staging: 'https://localhost:3000',
-                dev: 'https://localhost:3000',
-            };
-            let activeEnv = 'prod';
+            // ─── Localhost loopback OAuth — ONE implementation (AWO-224) ───
+            // `browser-login.ts` owns the loopback server, the /cli/auth URL, the
+            // state check and where the tokens are stored. The daemon's interactive
+            // fallback (setup-relay.ts) calls the same function; it used to carry its
+            // own copy aimed at /auth/beehaven, a route the web app no longer serves.
+            // What follows the sign-in — restarting the daemon, teaching the agents —
+            // stays here, because the daemon fallback must not restart itself.
+            let captured;
             try {
-                const cfgPath = join(homedir(), '.beehaven', 'config.json');
-                if (existsSync(cfgPath)) {
-                    const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
-                    // Derive env from the canonical endpoint, not the cfg.envName
-                    // alias (a fresh login / Mac-app install may write only `endpoint`).
-                    const { envName } = resolveRelaySelection(cfg);
-                    if (ENV_AUTH_ORIGINS[envName])
-                        activeEnv = envName;
-                }
-            }
-            catch { }
-            const authOrigin = process.env.BEEHAVEN_AUTH_ORIGIN ?? ENV_AUTH_ORIGINS[activeEnv];
-            // Pre-warning: non-prod env requires a local dev server.
-            if (activeEnv !== 'prod') {
-                const probe = await new Promise((resolve) => {
-                    const t = setTimeout(() => resolve(false), 800);
-                    const sock = netMod.createConnection(3000, '127.0.0.1');
-                    sock.once('connect', () => {
-                        clearTimeout(t);
-                        sock.destroy();
-                        resolve(true);
-                    });
-                    sock.once('error', () => {
-                        clearTimeout(t);
-                        resolve(false);
-                    });
-                }).catch(() => false);
-                if (!probe) {
-                    console.log('');
-                    console.log(`  ${color.yellow('!')} localhost:3000 isn't responding.`);
-                    console.log(`    Run ${color.cyan('npm run dev')} (with --experimental-https) in the clearly monorepo first.`);
-                    console.log('');
-                }
-            }
-            // Spin up the loopback server. OS picks a free port (port 0).
-            const captured = await new Promise((resolve, reject) => {
-                // Tiny success page the browser sees AFTER it navigates to
-                // the loopback. Self-contained — no external assets,
-                // works offline. Auto-close after 1.5s on supported
-                // browsers (Chrome/Firefox allow window.close on
-                // self-opened or scripted-navigated tabs).
-                const successHtml = `<!doctype html>
-<html><head><meta charset="utf-8"><title>beehaven CLI signed in</title>
-<style>
-  body { font: 15px -apple-system, sans-serif; background: #fafaf9; color: #292524;
-         display: grid; place-items: center; min-height: 100vh; margin: 0; }
-  .card { background: white; padding: 32px 40px; border-radius: 14px;
-          box-shadow: 0 1px 3px rgba(0,0,0,.08), 0 8px 24px rgba(0,0,0,.06);
-          max-width: 420px; }
-  h1 { font-size: 20px; margin: 0 0 8px; letter-spacing: -0.01em; }
-  p { color: #57534e; margin: 8px 0; }
-  .ok { color: #16a34a; }
-  .eyebrow { font-size: 10px; letter-spacing: .22em; color: #a8a29e;
-             text-transform: uppercase; margin-bottom: 8px; }
-</style></head>
-<body><div class="card">
-  <p class="eyebrow">01 — beehaven CLI</p>
-  <h1><span class="ok">✓</span> Signed in</h1>
-  <p>The CLI now has your credentials. You can close this tab and
-     return to your terminal.</p>
-</div>
-<script>setTimeout(() => { try { window.close(); } catch (e) {} }, 1500);</script>
-</body></html>`;
-                const errorHtml = (msg) => `<!doctype html>
-<html><head><meta charset="utf-8"><title>beehaven CLI error</title>
-<style>body{font:15px -apple-system,sans-serif;padding:40px;color:#292524}
-.err{color:#dc2626}</style></head>
-<body><h1 class="err">✗ Sign-in error</h1><p>${msg}</p>
-<p><small>Run <code>beehaven login</code> again from your terminal.</small></p>
-</body></html>`;
-                const server = http.createServer((req, res) => {
-                    if (req.method !== 'GET' || !(req.url ?? '').startsWith('/callback')) {
-                        res.writeHead(404, { 'Content-Type': 'text/plain' });
-                        res.end('Not Found');
-                        return;
-                    }
-                    // Parse query params from the GET URL. Tokens arrive
-                    // as ?state=…&idToken=…&refreshToken=…&userId=…
-                    // because the web side window.location.assign'd here
-                    // — fetch() from HTTPS to HTTP loopback is mixed-
-                    // content blocked by every browser since 2020, so
-                    // top-level navigation is the standard pattern (gh,
-                    // wrangler, vercel, firebase-tools all use this).
-                    const url = new URL(req.url, `http://127.0.0.1`);
-                    const presentedState = url.searchParams.get('state') ?? '';
-                    const idToken = url.searchParams.get('idToken') ?? '';
-                    const refreshToken = url.searchParams.get('refreshToken') ?? '';
-                    const userId = url.searchParams.get('userId') ?? '';
-                    const email = url.searchParams.get('email') ?? undefined;
-                    const displayName = url.searchParams.get('displayName') ?? undefined;
-                    if (presentedState !== state) {
-                        res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' });
-                        res.end(errorHtml("State mismatch — the CLI didn't initiate this sign-in."));
-                        return;
-                    }
-                    if (!idToken || !refreshToken || !userId) {
-                        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-                        res.end(errorHtml('Missing token fields. Try <code>beehaven login</code> again.'));
-                        return;
-                    }
-                    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                    res.end(successHtml);
-                    // Tear down the server after the response flushes so
-                    // the browser has a chance to render the success
-                    // page before the connection drops.
-                    setTimeout(() => {
-                        try {
-                            server.close();
-                        }
-                        catch { }
-                    }, 500);
-                    resolve({ idToken, refreshToken, userId, email, displayName });
-                });
-                server.on('error', reject);
-                // 5-minute upper bound so a forgotten browser tab doesn't
-                // hang the terminal forever.
-                const timeout = setTimeout(() => {
-                    try {
-                        server.close();
-                    }
-                    catch { }
-                    reject(new Error('Sign-in timed out after 5 minutes.'));
-                }, 5 * 60 * 1000);
-                server.on('close', () => clearTimeout(timeout));
-                server.listen(0, '127.0.0.1', () => {
-                    const addr = server.address();
-                    const port = addr && typeof addr === 'object' ? addr.port : 0;
-                    const callbackUrl = `http://127.0.0.1:${port}/callback`;
-                    const url = withUtm(`${authOrigin}/cli/auth?state=${state}&redirect=${encodeURIComponent(callbackUrl)}`);
-                    console.log('');
-                    console.log(`  ${color.cyan('→')} Opening browser to ${authOrigin}/cli/auth …`);
-                    console.log(`  ${color.dim("If it doesn't open: ")}${color.dim(url)}`);
-                    console.log(`  ${color.dim('Listening on ' + callbackUrl + ' (5-min timeout).')}`);
-                    console.log('');
-                    try {
-                        // Best-effort browser open. macOS `open` dispatches
-                        // to the user's default browser; xdg-open on Linux;
-                        // start on Windows.
-                        const opener = process.platform === 'darwin'
-                            ? 'open'
-                            : process.platform === 'win32'
-                                ? 'start'
-                                : 'xdg-open';
-                        const proc = childProcess.spawn(opener, [url], {
-                            stdio: 'ignore',
-                            detached: true,
-                        });
-                        proc.unref();
-                        proc.on('error', (err) => {
-                            // Surface — silent failure was the bug. If
-                            // `open` isn't on PATH (e.g. unusual env),
-                            // tell the user so they can paste manually.
-                            console.log(`  ${color.yellow('!')} Couldn't auto-open browser: ${err.message}`);
-                            console.log(`    Paste this URL into your browser instead:`);
-                            console.log(`    ${color.cyan(url)}`);
-                        });
-                    }
-                    catch (err) {
-                        console.log(`  ${color.yellow('!')} Couldn't spawn opener: ${err?.message ?? err}`);
-                        console.log(`    Paste this URL into your browser instead:`);
-                        console.log(`    ${color.cyan(url)}`);
-                    }
-                });
-            });
-            // Persist the captured tokens. Mirror the Mac app's
-            // installDaemon flow exactly: keychain stores the **idToken**
-            // under service='beehaven', account='daemon-token' (because
-            // that's what relay.ts:Relay.loadConfig reads on every
-            // daemon launch — line 116). The refresh token stays in
-            // config.json where relay.ts:refreshIdToken reads it from.
-            //
-            // Earlier this code was storing the refreshToken in the
-            // keychain — wrong slot. The daemon then tried to authenticate
-            // its WebSocket with the refresh token (treating it as an ID
-            // token), got 401, kicked off a refresh that succeeded but
-            // wrote the new idToken to config.json (not keychain), so on
-            // the next daemon restart the loop repeated. Storing idToken
-            // in keychain breaks the loop.
-            const { keychain } = await import('./keychain.js');
-            try {
-                keychain.setToken(captured.idToken);
-            }
-            catch { }
-            try {
-                // Reuse saveCredentials() for the email/identity record.
-                // Tokens themselves go to keychain (above). Plain-file
-                // copy lives in config.json so the daemon can identify
-                // the user without unlocking the keychain on every read.
-                const { existsSync, mkdirSync, writeFileSync } = await import('fs');
-                const cfgDir = join(homedir(), '.beehaven');
-                if (!existsSync(cfgDir))
-                    mkdirSync(cfgDir, { recursive: true, mode: 0o700 });
-                const cfgPath = join(cfgDir, 'config.json');
-                let existing = {};
-                if (existsSync(cfgPath)) {
-                    try {
-                        existing = JSON.parse(readFileSync(cfgPath, 'utf8'));
-                    }
-                    catch { }
-                }
-                /**
-                 * ⚠⚠ SIGNING IN WRITES A DIAL TARGET. It used to write only credentials and lean on
-                 * `...existing` to carry `endpoint` forward — which PRESERVES one and can never CREATE one.
-                 * So on a config that had none (a fresh install before the Mac app's `install()` ran, or
-                 * any config after `logout`, which deletes `endpoint` by name) login produced valid tokens
-                 * with nothing to connect to, and the daemon reported "Token refresh failed" while the tray
-                 * read "agent offline". A login that leaves the user unable to connect has not signed
-                 * anyone in.
-                 *
-                 * ⚠ RESOLVED FROM THE CONFIG, NEVER A HARDCODED CONSTANT — `resolveRelaySelection` keys off
-                 * whichever key is present and defaults to prod only when neither is. Pinning a literal
-                 * here is the bug `setup-relay.ts` had: it sent every staging login to the prod relay.
-                 *
-                 * ⚠ BOTH KEYS, KEPT IN SYNC, exactly as `beehaven env` writes them — `endpoint` is what the
-                 * relay client dials and `relayUrl` is the alias other surfaces read. Writing one and
-                 * leaving the other stale is how they disagree about which environment you are signed into.
-                 */
-                const { url: dialUrl } = resolveRelaySelection(existing);
-                const next = {
-                    ...existing,
-                    onboarded: true,
-                    tier: existing.tier ?? 'connected',
-                    userId: captured.userId,
-                    email: captured.email ?? null,
-                    displayName: captured.displayName ?? null,
-                    tokenStorage: 'keychain',
-                    refreshToken: captured.refreshToken,
-                    token: captured.idToken,
-                    endpoint: dialUrl,
-                    relayUrl: dialUrl,
-                };
-                writeFileSync(cfgPath, JSON.stringify(next, null, 2), { mode: 0o600 });
+                const { browserLogin } = await import('./browser-login.js');
+                captured = await browserLogin();
             }
             catch (err) {
-                console.error(`  ${color.red('✗')} Failed to write config: ${err?.message ?? err}`);
+                console.error(`  ${color.red('✗')} ${err?.message ?? err}`);
                 process.exit(1);
             }
             console.log('');
@@ -3418,7 +3166,7 @@ async function run() {
             const signupUrl = withUtm(
             // Was /avatar/install, which now 301s to the homepage — a signup CTA that lands on
             // the marketing page loses the person it was meant to convert. /signup is live.
-            process.env.BEEHAVEN_SIGNUP_URL ?? 'https://clearly.sh/signup');
+            process.env.BEEHAVEN_SIGNUP_URL ?? 'https://www.clearly.sh/signup');
             console.log('');
             console.log(`  Sign up at ${color.cyan(signupUrl)}.`);
             console.log('  Then run "beehaven login" to wire the CLI to your account.');