expandai 0.0.2 → 0.0.4

package/src/Auth/PendingInit.ts

@@ -0,0 +1,338 @@
+import { createHash } from 'node:crypto'
+import { FileSystem, Path, Error as PlatformError } from '@effect/platform'
+import { NodeContext } from '@effect/platform-node'
+import { DateTime, Effect, Either, Option, Schema } from 'effect'
+import { xdgConfigDirectory } from '../Xdg.js'
+import {
+	CLI_AUTHORIZATION_CLIENT_ID,
+	PendingInitCorrupt,
+	type PendingInitKey,
+	PendingInitRecord,
+	PendingInitStorageError,
+} from './Domain.js'
+
+const PendingInitRecordJson = Schema.parseJson(PendingInitRecord)
+const COMPLETION_CODE_RETENTION_GRACE_MS = 5 * 60 * 1_000
+
+const PendingInitKeyTupleJson = Schema.parseJson(
+	Schema.Tuple(
+		Schema.String,
+		Schema.Literal(CLI_AUTHORIZATION_CLIENT_ID),
+		Schema.Literal('agent-harnesses'),
+		Schema.Literal('project', 'global'),
+		Schema.String,
+	),
+)
+
+function isErrnoCode(input: unknown, code: string): boolean {
+	return typeof input === 'object' && input !== null && 'code' in input && input.code === code
+}
+
+function isAlreadyExists(error: unknown): boolean {
+	return (
+		error instanceof PlatformError.SystemError &&
+		(error.reason === 'AlreadyExists' || isErrnoCode(error.cause, 'EEXIST'))
+	)
+}
+
+/** Canonical, collision-free serialization of all pending authorization key fields. */
+export function serializePendingInitKey(key: PendingInitKey): string {
+	return Schema.encodeSync(PendingInitKeyTupleJson)([
+		key.apiOrigin,
+		key.clientId,
+		key.harness,
+		key.scope,
+		key.canonicalScopeRoot,
+	])
+}
+
+function ancestorPaths(path: Path.Path, current: string): string[] {
+	const parent = path.dirname(current)
+	return parent === current ? [current] : [current, ...ancestorPaths(path, parent)]
+}
+
+export class PendingInitStore extends Effect.Service<PendingInitStore>()('@expandai/cli/Auth/PendingInitStore', {
+	dependencies: [NodeContext.layer],
+	effect: Effect.gen(function* () {
+		const fileSystem = yield* FileSystem.FileSystem
+		const path = yield* Path.Path
+		const configDirectory = path.join(yield* xdgConfigDirectory, 'expandai')
+		const pendingPath = path.join(configDirectory, 'pending-init')
+
+		const storageError = (targetPath: string, error: unknown) =>
+			new PendingInitStorageError({ path: targetPath, error })
+
+		/**
+		 * Maps a platform failure to the domain error for `targetPath`.
+		 *
+		 * Deliberately applied per call rather than once around each function: a
+		 * blanket `mapError` over a whole `Effect.fn` body would also swallow
+		 * `PendingInitCorrupt`, which `decodeRecord` raises and which `Status.ts`
+		 * reports differently — corrupt state is recoverable by deleting the file,
+		 * a storage failure is not.
+		 */
+		const onStorage = <A>(targetPath: string, effect: Effect.Effect<A, PlatformError.PlatformError>) =>
+			effect.pipe(Effect.mapError((error) => storageError(targetPath, error)))
+
+		const assertNotSymbolicLink = Effect.fnUntraced(function* (targetPath: string) {
+			const result = yield* Effect.either(fileSystem.readLink(targetPath))
+			if (Either.isRight(result)) {
+				return yield* storageError(targetPath, new Error('Symbolic links are not allowed for pending authorization'))
+			}
+			const error = result.left
+			if (
+				error instanceof PlatformError.SystemError &&
+				(error.reason === 'InvalidData' ||
+					error.reason === 'NotFound' ||
+					(error.method === 'readLink' && isErrnoCode(error.cause, 'EINVAL')))
+			) {
+				return
+			}
+			return yield* storageError(targetPath, error)
+		})
+
+		const ensureDirectory = Effect.fnUntraced(function* () {
+			yield* assertNotSymbolicLink(configDirectory)
+			yield* assertNotSymbolicLink(pendingPath)
+			yield* onStorage(pendingPath, fileSystem.makeDirectory(pendingPath, { recursive: true, mode: 0o700 }))
+			yield* assertNotSymbolicLink(configDirectory)
+			yield* assertNotSymbolicLink(pendingPath)
+			const directoryInfo = yield* onStorage(pendingPath, fileSystem.stat(pendingPath))
+			if (directoryInfo.type !== 'Directory') {
+				return yield* storageError(pendingPath, new Error('Pending authorization path is not a directory'))
+			}
+			if (process.platform !== 'win32') {
+				yield* onStorage(configDirectory, fileSystem.chmod(configDirectory, 0o700))
+				yield* onStorage(pendingPath, fileSystem.chmod(pendingPath, 0o700))
+			}
+		})
+
+		const recordPath = (key: PendingInitKey) => {
+			const digest = createHash('sha256').update(serializePendingInitKey(key)).digest('hex')
+			return path.join(pendingPath, `${digest}.json`)
+		}
+
+		const decodeRecord = Effect.fnUntraced(function* (targetPath: string, encoded: string) {
+			const record = yield* Schema.decode(PendingInitRecordJson)(encoded).pipe(
+				Effect.mapError(
+					() =>
+						new PendingInitCorrupt({
+							path: targetPath,
+							error: new Error('Stored pending authorization did not match the expected schema'),
+						}),
+				),
+			)
+			if (recordPath(record.key) !== targetPath) {
+				return yield* new PendingInitCorrupt({
+					path: targetPath,
+					error: new Error('Stored pending authorization key did not match its file'),
+				})
+			}
+			return record
+		})
+
+		const readRecordPath = Effect.fnUntraced(function* (targetPath: string) {
+			yield* assertNotSymbolicLink(targetPath)
+			const exists = yield* onStorage(targetPath, fileSystem.exists(targetPath))
+			if (!exists) return Option.none<PendingInitRecord>()
+			const info = yield* onStorage(targetPath, fileSystem.stat(targetPath))
+			if (info.type !== 'File') return yield* storageError(targetPath, new Error('Pending state is not a regular file'))
+			if (process.platform !== 'win32' && (info.mode & 0o777) !== 0o600) {
+				return yield* storageError(targetPath, new Error('Pending state file mode is not 600'))
+			}
+			const encoded = yield* onStorage(targetPath, fileSystem.readFileString(targetPath))
+			return Option.some(yield* decodeRecord(targetPath, encoded))
+		})
+
+		const readRecord = (key: PendingInitKey) => readRecordPath(recordPath(key))
+
+		const isExpired = Effect.fnUntraced(function* (record: PendingInitRecord) {
+			const now = DateTime.toEpochMillis(yield* DateTime.now)
+			return DateTime.toEpochMillis(record.approvalExpiresAt) + COMPLETION_CODE_RETENTION_GRACE_MS <= now
+		})
+
+		const writeExclusive = Effect.fnUntraced(function* (record: PendingInitRecord) {
+			yield* ensureDirectory()
+			const targetPath = recordPath(record.key)
+			const encoded = yield* Schema.encode(PendingInitRecordJson)(record).pipe(
+				Effect.mapError((error) => storageError(targetPath, error)),
+			)
+			const created = yield* Effect.either(
+				Effect.scoped(
+					Effect.gen(function* () {
+						const file = yield* fileSystem.open(targetPath, { flag: 'wx', mode: 0o600 })
+						yield* file.writeAll(new TextEncoder().encode(encoded))
+						yield* file.sync
+					}),
+				),
+			)
+			if (Either.isLeft(created)) {
+				// `wx` means an existing file belongs to another attempt — leave it.
+				if (isAlreadyExists(created.left)) return false
+				// Anything else failed *after* we created the file, so a zero-byte or
+				// half-written record is now sitting at the final path. Left there it
+				// fails every later read of this key, and interrupting between `open`
+				// and `writeAll` is enough to cause it.
+				yield* fileSystem.remove(targetPath).pipe(Effect.ignore)
+				return yield* storageError(targetPath, created.left)
+			}
+			if (process.platform !== 'win32') {
+				const chmodResult = yield* Effect.either(fileSystem.chmod(targetPath, 0o600))
+				if (Either.isLeft(chmodResult)) {
+					yield* fileSystem.remove(targetPath).pipe(Effect.ignore)
+					return yield* storageError(targetPath, chmodResult.left)
+				}
+			}
+			return true
+		})
+
+		/**
+		 * Publishes `next` over the record for the same key, atomically.
+		 *
+		 * The caller used to do `removeIfMatch` then `putIfAbsent`. An interrupt
+		 * between those two — Ctrl-C during the poll that runs on *every* `expandai
+		 * init` while authorization is pending — deleted the pending record and
+		 * wrote nothing back, so the next run minted a fresh code and asked the user
+		 * to approve again with no error to explain it.
+		 *
+		 * `rename` over the target is atomic on POSIX, so an interrupt either leaves
+		 * the old record or completes the new one. It is **not** a cross-process
+		 * compare-and-swap: another process can publish between our read and our
+		 * rename, and ours wins. That race is pre-existing and unaddressed here —
+		 * closing it needs a per-key lock, and Windows replacement semantics need
+		 * checking first. The name says `IfMatch` because it verifies before
+		 * writing, not because it is a CAS.
+		 */
+		const replaceIfMatch = Effect.fn('PendingInitStore.replaceIfMatch')(function* (
+			previous: PendingInitRecord,
+			next: PendingInitRecord,
+		) {
+			yield* ensureDirectory()
+			const targetPath = recordPath(next.key)
+			if (recordPath(previous.key) !== targetPath) {
+				return yield* storageError(targetPath, new Error('Pending authorization replacement changed its key'))
+			}
+			const current = yield* readRecordPath(targetPath)
+			if (Option.isNone(current) || current.value.userCode !== previous.userCode) return false
+
+			const encoded = yield* Schema.encode(PendingInitRecordJson)(next).pipe(
+				Effect.mapError((error) => storageError(targetPath, error)),
+			)
+			// Same directory, so `rename` stays on one filesystem and is atomic.
+			//
+			// `acquireRelease` rather than manual cleanup on the typed-failure branches:
+			// a defect or an interrupt bypasses those branches entirely, and an
+			// abandoned `.tmp` is worse than it looks — it is a second copy of a live
+			// credential, `pruneExpired` only scans `.json` records so it never reaps
+			// one, and a fixed name made the next attempt fail on its own leftovers.
+			const staging = `${targetPath}.${process.pid}.${Math.random().toString(36).slice(2, 10)}.tmp`
+			const published = yield* Effect.scoped(
+				Effect.acquireRelease(Effect.succeed(staging), () => fileSystem.remove(staging).pipe(Effect.ignore)).pipe(
+					Effect.zipRight(
+						Effect.gen(function* () {
+							yield* assertNotSymbolicLink(staging)
+							yield* Effect.scoped(
+								Effect.gen(function* () {
+									const file = yield* fileSystem.open(staging, { flag: 'wx', mode: 0o600 })
+									yield* file.writeAll(new TextEncoder().encode(encoded))
+									yield* file.sync
+								}),
+							)
+							yield* fileSystem.rename(staging, targetPath)
+						}),
+					),
+				),
+			).pipe(Effect.either)
+			if (Either.isLeft(published)) return yield* storageError(targetPath, published.left)
+			return true
+		})
+
+		const removeIfCurrent = Effect.fnUntraced(function* (record: PendingInitRecord) {
+			const targetPath = recordPath(record.key)
+			const current = yield* readRecordPath(targetPath)
+			if (Option.isNone(current) || current.value.userCode !== record.userCode) return false
+			yield* onStorage(targetPath, fileSystem.remove(targetPath))
+			return true
+		})
+
+		const get = Effect.fn('PendingInitStore.get')(function* (key: PendingInitKey) {
+			const record = yield* readRecord(key)
+			if (Option.isNone(record) || !(yield* isExpired(record.value))) return record
+			yield* removeIfCurrent(record.value)
+			return Option.none<PendingInitRecord>()
+		})
+
+		const peek = Effect.fn('PendingInitStore.peek')(function* (key: PendingInitKey) {
+			return yield* readRecord(key)
+		})
+
+		const putIfAbsent = Effect.fn('PendingInitStore.putIfAbsent')(function* (record: PendingInitRecord) {
+			const existing = yield* readRecord(record.key)
+			if (Option.isSome(existing) && !(yield* isExpired(existing.value))) return existing.value
+			if (Option.isSome(existing)) yield* removeIfCurrent(existing.value)
+			if (yield* writeExclusive(record)) return record
+			const winner = yield* readRecord(record.key)
+			return yield* Option.match(winner, {
+				onNone: () => storageError(recordPath(record.key), new Error('Pending record creation lost without a winner')),
+				onSome: Effect.succeed,
+			})
+		})
+
+		const removeIfMatch = Effect.fn('PendingInitStore.removeIfMatch')((record: PendingInitRecord) =>
+			removeIfCurrent(record),
+		)
+
+		const pruneExpired = Effect.fn('PendingInitStore.pruneExpired')(function* () {
+			yield* assertNotSymbolicLink(pendingPath)
+			const exists = yield* onStorage(pendingPath, fileSystem.exists(pendingPath))
+			if (!exists) {
+				return 0
+			}
+			const entries = yield* onStorage(pendingPath, fileSystem.readDirectory(pendingPath))
+			const removed = yield* Effect.forEach(
+				entries.filter((entry) => entry.endsWith('.json')),
+				(entry) =>
+					Effect.gen(function* () {
+						const record = yield* readRecordPath(path.join(pendingPath, entry))
+						if (Option.isNone(record) || !(yield* isExpired(record.value))) {
+							return 0
+						}
+						return (yield* removeIfCurrent(record.value)) ? 1 : 0
+						// One unreadable entry must not fail the sweep. Pruning runs
+						// on every begin, resume and refreshStatus, so a single
+						// corrupt or newer-format file would otherwise block all
+						// three — including the resume that would have recovered.
+					}).pipe(Effect.orElseSucceed(() => 0)),
+			)
+			return removed.reduce<number>((total, count) => total + count, 0)
+		})
+
+		const canonicalScopeRoot = Effect.fn('PendingInitStore.canonicalScopeRoot')(function* (
+			scope: PendingInitKey['scope'],
+			cwd = process.cwd(),
+		) {
+			if (scope === 'global') return 'global'
+			const canonicalCwd = yield* onStorage(cwd, fileSystem.realPath(cwd))
+			const inspected = yield* Effect.forEach(ancestorPaths(path, canonicalCwd), (candidate) =>
+				onStorage(candidate, fileSystem.exists(path.join(candidate, '.git'))).pipe(
+					Effect.map((exists) => ({ candidate, exists })),
+				),
+			)
+			const repositoryRoot = inspected.find(({ exists }) => exists)?.candidate
+			return repositoryRoot === undefined
+				? canonicalCwd
+				: yield* onStorage(repositoryRoot, fileSystem.realPath(repositoryRoot))
+		})
+
+		return {
+			pendingPath,
+			get,
+			peek,
+			putIfAbsent,
+			replaceIfMatch,
+			removeIfMatch,
+			pruneExpired,
+			canonicalScopeRoot,
+		} as const
+	}),
+}) {}

package/src/Auth/Pkce.ts

@@ -0,0 +1,26 @@
+import { createHash, randomBytes } from 'node:crypto'
+import { Redacted } from 'effect'
+
+/**
+ * RFC 7636 requires 43–128 characters of unreserved alphabet; 32 random bytes
+ * encode to 43 base64url characters, which is also what the API's
+ * `^[A-Za-z0-9_-]{43}$` challenge check expects.
+ */
+const VERIFIER_BYTES = 32
+
+/** PKCE code verifier. Redacted so it cannot reach a log or a JSON result. */
+export function createCodeVerifier(): Redacted.Redacted<string> {
+	return Redacted.make(randomBytes(VERIFIER_BYTES).toString('base64url'))
+}
+
+export function codeChallengeFor(verifier: Redacted.Redacted<string>): string {
+	return createHash('sha256').update(Redacted.value(verifier)).digest('base64url')
+}
+
+/**
+ * Opaque high-entropy value for non-PKCE uses such as the OAuth `state`
+ * parameter. Same entropy and encoding, different purpose.
+ */
+export function createHighEntropySecret(): string {
+	return randomBytes(VERIFIER_BYTES).toString('base64url')
+}

package/src/Auth/SetupGrantAuthorization.ts

@@ -0,0 +1,116 @@
+import { Effect, Redacted, Schema } from 'effect'
+import { ConfigManager } from '../Config.js'
+import {
+	ManualAuthorization,
+	ManualAuthorizationCredentialSaveFailed,
+	ManualAuthorizationDenied,
+	ManualAuthorizationRefused,
+} from './ManualAuthorization.js'
+
+interface SetupGrantAuthorizationInput {
+	readonly setupToken: Redacted.Redacted<string>
+	readonly harness: 'agent-harnesses'
+	readonly scope: 'project' | 'global'
+}
+
+export class SetupGrantAuthorizationError extends Schema.TaggedError<SetupGrantAuthorizationError>()(
+	'SetupGrantAuthorizationError',
+	{
+		code: Schema.Literal(
+			'invalid_or_expired',
+			'stored_credential_conflict',
+			'request_failed',
+			'denied',
+			'credential_save_failed',
+			'refused',
+			'config_unreadable',
+		),
+		recoverable: Schema.Boolean,
+	},
+) {
+	get message() {
+		switch (this.code) {
+			// Checked before redemption, so the token is untouched and the user can
+			// retry with the same one after clearing the stored credential.
+			case 'stored_credential_conflict':
+				return 'An Expand API key is already stored on this machine, and completing this setup would replace it with no way to recover it. Nothing was changed and your setup prompt is still valid. Run `expandai logout` to clear the stored key, then run this setup command again.'
+			case 'request_failed':
+				return 'Could not reach Expand to redeem the setup token. Nothing was sent, so the same token is still good — check the network and try again.'
+			case 'denied':
+				return 'This setup authorization was denied. Copy a fresh setup prompt from the Expand dashboard.'
+			// Checked before redemption, so like stored_credential_conflict the token is
+			// untouched and the same prompt works once the file is dealt with.
+			case 'config_unreadable':
+				return 'The Expand config file on this machine could not be read, so setup cannot tell whether completing it would overwrite an existing API key. Nothing was redeemed and your setup prompt is still valid. Run `expandai whoami` to see which file it is, fix or delete it, then run this setup command again.'
+			// Server-side misconfiguration: a fresh prompt is refused identically.
+			case 'refused':
+				return 'Expand refused to redeem this setup token for a reason a fresh prompt cannot fix — most likely an OAuth client, resource, or scope misconfiguration on the server. Do not request another prompt; report this.'
+			// The token redeemed — it is spent — but the credentials could not be
+			// written locally. A fresh prompt hits the same wall until the local
+			// storage problem is fixed, so say that instead of blaming the token.
+			case 'credential_save_failed':
+				return 'The setup token was redeemed, but the credentials could not be saved on this machine. Fix credential storage — run `expandai whoami` to see the path it uses, and check its permissions — then copy a fresh setup prompt from the Expand dashboard.'
+			default:
+				return 'The setup token is invalid, expired, or already used. Copy a fresh setup prompt from the Expand dashboard.'
+		}
+	}
+}
+
+function setupGrantError(code: typeof SetupGrantAuthorizationError.fields.code.Type): SetupGrantAuthorizationError {
+	return new SetupGrantAuthorizationError({
+		code,
+		recoverable: code !== 'denied' && code !== 'credential_save_failed' && code !== 'refused',
+	})
+}
+
+/**
+ * Dashboard-minted setup: the "token" in the prompt is a pre-approved RFC 8628
+ * device code, already bound to the minting user and pinned to their
+ * organization server-side. Redeeming is a single poll of the OAuth token
+ * endpoint — better-auth owns generation, expiry and the single-use burn, so
+ * there is no redemption protocol of ours left to get wrong.
+ */
+export class SetupGrantAuthorization extends Effect.Service<SetupGrantAuthorization>()(
+	'@expandai/cli/Auth/SetupGrantAuthorization',
+	{
+		dependencies: [ConfigManager.Default, ManualAuthorization.Default],
+		effect: Effect.gen(function* () {
+			const configManager = yield* ConfigManager
+			const manualAuthorization = yield* ManualAuthorization
+			const authorize = Effect.fn('SetupGrantAuthorization.authorize')(function* (input: SetupGrantAuthorizationInput) {
+				// The *file*, specifically. `loadConfig` collapses env and file into one
+				// value, so it cannot tell an ambient `EXPAND_API_KEY` — which must
+				// never block setup — from a key written by `expandai login`, which
+				// saving new credentials would overwrite with no way to recover it.
+				//
+				// Refused before redemption: nothing has been spent, so the same prompt
+				// still works once the user clears the stored key.
+				// `readConfigFile` never fails — it reports an unreadable file through
+				// `parseFailed` and hands back an empty config — so `Effect.either` here was
+				// always Right and the ApiKey check silently passed on a corrupt file. That
+				// matters: redemption is single-use, so proceeding would spend the token and
+				// *then* fail to save. Refuse first, while the prompt is still good.
+				const storedFile = yield* configManager.readConfigFile()
+				if (storedFile.parseFailed) return yield* setupGrantError('config_unreadable')
+				if (storedFile.config.authMethod?._tag === 'ApiKey') {
+					return yield* setupGrantError('stored_credential_conflict')
+				}
+				yield* Effect.annotateCurrentSpan({ harness: input.harness, scope: input.scope })
+				yield* manualAuthorization.redeemPreApproved(input.setupToken).pipe(
+					Effect.mapError((error) => {
+						if (error instanceof ManualAuthorizationDenied) return setupGrantError('denied')
+						if (error instanceof ManualAuthorizationCredentialSaveFailed) {
+							return setupGrantError('credential_save_failed')
+						}
+						if (error instanceof ManualAuthorizationRefused) return setupGrantError('refused')
+						if (error._tag === 'ManualAuthorizationApiError' && error.kind === 'request_failed') {
+							return setupGrantError('request_failed')
+						}
+						return setupGrantError('invalid_or_expired')
+					}),
+				)
+			})
+			return { authorize } as const
+		}),
+	},
+) {}

package/src/Authentication.ts

@@ -2,10 +2,13 @@ import { Command, Prompt } from '@effect/cli'
 import { Console, DateTime, Duration, Effect, Either, Match, Schema, String } from 'effect'
 import open from 'open'
 import { BrowserOAuthService } from './BrowserOAuth.js'
-import { ApiKey, ApiKeyConfig, ConfigManager, OAuthConfig } from './Config.js'
-import { Uninstall } from './Install/Uninstall.js'
+import { ApiKey, ApiKeyConfig, type AuthMethod, ConfigManager, isAuthMethodLocallyUsable } from './Config.js'
+
+// Re-exported: these moved to Config.ts, where the credential types live, so
+// that credential precedence can consult usability without a cycle.
+export { type AuthMethodState, authMethodState, isAuthMethodLocallyUsable } from './Config.js'
 
-type AuthMethod = typeof ApiKeyConfig.Type | typeof OAuthConfig.Type
+import { Uninstall } from './Install/Uninstall.js'
 
 /** Render a user-facing description of the current auth state. Pure given DateTime.now. */
 export const formatAuthStatus = Effect.fn('Authentication.formatAuthStatus')(function* (authMethod: AuthMethod) {
@@ -32,6 +35,17 @@ export class Authentication extends Effect.Service<Authentication>()('@expandai/
 		const browserOAuth = yield* BrowserOAuthService
 		const uninstall = yield* Uninstall
 
+		const hasLocallyUsableCredentials = Effect.fn('Authentication.hasLocallyUsableCredentials')(function* () {
+			yield* configManager.ensureSecureStorage()
+			const loaded = yield* Effect.either(configManager.loadConfig())
+			if (Either.isLeft(loaded)) {
+				if (loaded.left._tag === 'NotAuthenticated') return false
+				return yield* Effect.fail(loaded.left)
+			}
+			const now = yield* DateTime.now
+			return isAuthMethodLocallyUsable(loaded.right.authMethod, now)
+		})
+
 		const apiKeyLogin = Effect.fn('Authentication.apiKeyLogin')(function* () {
 			const apiKey = yield* Prompt.password({ message: 'Enter your API Key' })
 			yield* configManager.updateConfig({
@@ -40,13 +54,41 @@ export class Authentication extends Effect.Service<Authentication>()('@expandai/
 			yield* Console.log('API key saved successfully!')
 		})
 
-		const oauthLogin = Effect.fn('Authentication.oauthLogin')(function* () {
+		const browserLogin = Effect.fnUntraced(function* <R>(
+			showAuthorizeUrl: (authorizeUrl: URL) => Effect.Effect<void, unknown, R>,
+		) {
 			yield* Console.log(
 				String.stripMargin(`
 					|
 					|Starting browser authorization...`),
 			)
-			yield* browserOAuth.login((authorizeUrl) =>
+			yield* browserOAuth.login(showAuthorizeUrl)
+			yield* Console.log(
+				String.stripMargin(`
+					|
+					|Successfully authenticated!`),
+			)
+		})
+
+		const printAuthorizeUrl = Effect.fnUntraced(function* (authorizeUrl: URL) {
+			yield* Console.log(
+				String.stripMargin(`
+					|
+					|Open this URL in a browser:
+					|  ${authorizeUrl.toString()}
+					|
+					|Waiting for browser authorization...`),
+			)
+		})
+
+		// `init` already asks for harness and scope. Keep browser login on the
+		// existing loopback OAuth path without introducing a third Prompt choice.
+		const loginWithBrowser = Effect.fn('Authentication.loginWithBrowser')(function* () {
+			yield* browserLogin(printAuthorizeUrl)
+		})
+
+		const oauthLogin = Effect.fn('Authentication.oauthLogin')(function* () {
+			yield* browserLogin((authorizeUrl) =>
 				Effect.gen(function* () {
 					yield* Console.log(
 						String.stripMargin(`
@@ -70,14 +112,10 @@ export class Authentication extends Effect.Service<Authentication>()('@expandai/
 					)
 				}),
 			)
-			yield* Console.log(
-				String.stripMargin(`
-					|
-					|Successfully authenticated!`),
-			)
 		})
 
 		const login = Effect.fn('Authentication.login')(function* () {
+			yield* configManager.ensureSecureStorage()
 			const existing = yield* Effect.either(configManager.loadConfig())
 
 			if (Either.isRight(existing)) {
@@ -144,7 +182,7 @@ export class Authentication extends Effect.Service<Authentication>()('@expandai/
 			yield* Console.log('Logged out.')
 		})
 
-		return { login, whoami, logout } as const
+		return { hasLocallyUsableCredentials, loginWithBrowser, login, whoami, logout } as const
 	}),
 }) {}
 

package/src/BrowserOAuth.ts

@@ -1,8 +1,8 @@
-import { createHash, randomBytes } from 'node:crypto'
 import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http'
 import { HttpClient, HttpClientRequest, HttpClientResponse } from '@effect/platform'
 import { NodeHttpClient } from '@effect/platform-node'
 import { DateTime, Duration, Effect, Inspectable, Redacted, Schema } from 'effect'
+import { codeChallengeFor, createHighEntropySecret } from './Auth/Pkce.js'
 import { ConfigManager, OAuthConfig } from './Config.js'
 
 const CLIENT_ID = 'expandai-cli'
@@ -107,16 +107,8 @@ interface LoopbackServer {
 	readonly close: Effect.Effect<void>
 }
 
-function base64Url(bytes: Uint8Array): string {
-	return Buffer.from(bytes).toString('base64').replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '')
-}
-
-function createHighEntropySecret(): string {
-	return base64Url(randomBytes(32))
-}
-
 export const createCodeChallenge = Effect.fn('BrowserOAuth.createCodeChallenge')(function* (codeVerifier: string) {
-	return base64Url(createHash('sha256').update(codeVerifier).digest())
+	return codeChallengeFor(Redacted.make(codeVerifier))
 })
 
 export const buildAuthorizeUrl = Effect.fn('BrowserOAuth.buildAuthorizeUrl')(function* ({
@@ -253,6 +245,7 @@ export class BrowserOAuthService extends Effect.Service<BrowserOAuthService>()('
 		const exchangeToken = Effect.fn('BrowserOAuthService.exchangeToken')(function* (
 			form: ReadonlyArray<readonly [string, string]>,
 		) {
+			yield* configManager.ensureSecureStorage()
 			const apiUrl = yield* configManager.getApiUrl()
 			const resource = apiUrl.toString()
 			const request = HttpClientRequest.post(new URL(OAUTH_TOKEN_ENDPOINT, apiUrl)).pipe(
@@ -301,10 +294,13 @@ export class BrowserOAuthService extends Effect.Service<BrowserOAuthService>()('
 			])
 		})
 
-		const refreshToken = Effect.fn('BrowserOAuthService.refreshToken')(function* (refreshToken: string) {
+		const refreshToken = Effect.fn('BrowserOAuthService.refreshToken')(function* (
+			refreshToken: string,
+			clientId: string = CLIENT_ID,
+		) {
 			return yield* exchangeToken([
 				['grant_type', 'refresh_token'],
-				['client_id', CLIENT_ID],
+				['client_id', clientId],
 				['refresh_token', refreshToken],
 			])
 		})
@@ -319,6 +315,7 @@ export class BrowserOAuthService extends Effect.Service<BrowserOAuthService>()('
 					refreshToken:
 						tokenResponse.refresh_token === undefined ? undefined : Redacted.make(tokenResponse.refresh_token),
 					expiresAt,
+					clientId: CLIENT_ID,
 				}),
 			})
 		})
@@ -326,6 +323,7 @@ export class BrowserOAuthService extends Effect.Service<BrowserOAuthService>()('
 		const login = Effect.fn('BrowserOAuthService.login')(function* <R>(
 			openAuthorizeUrl: (authorizeUrl: URL) => Effect.Effect<void, unknown, R>,
 		) {
+			yield* configManager.ensureSecureStorage()
 			const codeVerifier = createHighEntropySecret()
 			const state = createHighEntropySecret()
 			const codeChallenge = yield* createCodeChallenge(codeVerifier)

package/src/CommandPath.ts

@@ -0,0 +1,30 @@
+/**
+ * Telemetry-safe command-path extraction. Only tokens that sit in legal
+ * command-path positions of the tree below are ever reported — never
+ * free-form args, URLs, or queries. The walk stops at the first token that
+ * isn't a subcommand of the current node, so positional user input can't
+ * leak even when it happens to equal a command word
+ * (`expandai search snap_abc login` reports just `search`). Choice-arg
+ * values (hosts, scopes) are positional data and deliberately absent.
+ */
+const COMMAND_TREE = new Map<string, ReadonlySet<string>>([
+	['fetch', new Set()],
+	['search', new Set()],
+	['login', new Set()],
+	['whoami', new Set()],
+	['logout', new Set()],
+	['init', new Set()],
+	['status', new Set()],
+	['uninstall', new Set()],
+	['mcp', new Set(['run', 'install', 'uninstall'])],
+	['skill', new Set(['install', 'uninstall'])],
+	['hook', new Set(['claude-code', 'opencode', 'install', 'uninstall'])],
+	['telemetry', new Set(['status', 'enable', 'disable'])],
+])
+
+export function commandFromArgv(argv: readonly string[]): string {
+	const [first, second] = argv.slice(2)
+	const subcommands = first === undefined ? undefined : COMMAND_TREE.get(first)
+	if (first === undefined || subcommands === undefined) return '(none)'
+	return second !== undefined && subcommands.has(second) ? `${first} ${second}` : first
+}