instabox 0.6.4 → 0.7.0

package/README.md

@@ -5,17 +5,17 @@ npx instabox@latest      # sign in, install the CLI and the agent skills
 npx instabox@latest sh   # the same, then start a new box and SSH into it
 ```
 
-`npx instabox@latest` signs you in to instabox in your browser (first run only; confirm its current Instabox account or choose another), installs the `instabox` CLI already signed in or updates an out-of-date one (skip with `--no-cli`), installs or updates the agent skills from [`../skills`](../skills) in `~/.claude/skills` and `~/.agents/skills` (skip with `--no-skills`), and prints the next steps. It does not touch your boxes.
+`npx instabox@latest` signs you in to instabox with a device code (first run only: open the page it prints on any device and enter the code; it opens the page for you where there is a browser, never with `--no-browser`), installs the `instabox` CLI already signed in or updates an out-of-date one (skip with `--no-cli`), installs or updates the agent skills from [`../skills`](../skills) in `~/.claude/skills` and `~/.agents/skills` (skip with `--no-skills`), and prints the next steps. It does not touch your boxes.
 
 `npx instabox@latest sh` does all that, then starts a new box (`box-<hex>`) and drops you into it over SSH, no questions. Run by an agent (no terminal), it starts the box and prints `instabox ssh <box> -- <command>` instead of opening a shell. At the box limit it starts nothing and lists your boxes, to remove one (`instabox rm <box>`) or open one (`instabox ssh <box>`).
 
-A GitHub and a Google sign-in are separate instabox accounts, each with its own boxes. Both this entry point and `instabox login` let the browser confirm the account. Explicit `--github` or `--google` starts that provider directly, as does `instabox login --provider github|google`.
+A GitHub and a Google sign-in are separate instabox accounts, each with its own boxes. Both this entry point and `instabox login` let the sign-in page offer both. `--google` asks for Google directly, as does `instabox login --provider google`.
 
 Any other command line is the instabox CLI's ([`cmd/instabox`](../cmd/instabox)): `npx instabox@latest ls` runs `instabox ls`, installing the CLI first if it is missing.
 
 ## How it works
 
-- `bin/instabox.mjs` runs instabox's loopback sign-in (RFC 8252 + PKCE) and saves the tokens where the CLI keeps its own, `~/.config/instabox/credentials.json`, so both are signed in at once. There is one copy on purpose: the server rotates refresh tokens and ends the session when a rotated one comes back.
+- `bin/instabox.mjs` runs instabox's device-code sign-in (RFC 8628, `POST /v1/auth/device`, then polls `/v1/auth/device/token`), as `instabox login` does, and saves the tokens where the CLI keeps its own, `~/.config/instabox/credentials.json`, so both are signed in at once. There is one copy on purpose: the server rotates refresh tokens and ends the session when a rotated one comes back.
 - `sh` always starts a new box, with no timeout and no idle auto-suspend of its own. An existing box is entered with the CLI: `instabox ssh <box>`.
 - An installed CLI is checked against what the server's `/install.sh` would install: the binary's sha256 against the server's `/dl/SHA256SUMS` (release builds are named after a commit, so their versions do not sort). One the server no longer serves is replaced in place through the same installer; a development build (`instabox dev`, or `-dirty`) is left alone with a one-line notice of the install command.
 - Skills are written only over copies marked `installed-by: instabox`; the output says which were installed, updated, already up to date, or kept because they are the user's own.

package/bin/instabox.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // npx instabox@latest: sign in + CLI + skills; `sh` also starts a new box and SSHes in. Anything else goes to the CLI.
 import { spawn, spawnSync } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import {
   accessSync,
   constants as fsConstants,
@@ -13,7 +13,6 @@ import {
   mkdirSync,
   readdirSync,
 } from 'node:fs';
-import http from 'node:http';
 import { createInterface } from 'node:readline/promises';
 import { tmpdir, homedir } from 'node:os';
 import { join, dirname } from 'node:path';
@@ -22,7 +21,7 @@ import { createClient } from '../lib/api.mjs';
 import { orderBoxes } from '../lib/boxes.mjs';
 import { guestUserNote, localGuestUser } from '../lib/guestuser.mjs';
 import { checkCli, findCli, installCli, installCommand, isOnboarding, real, runCli } from '../lib/cli.mjs';
-import { browserCommand, callbackHandler } from '../lib/login.mjs';
+import { browserCommand, canOpenBrowser, deviceLogin } from '../lib/login.mjs';
 import { makeDirPrivate, sessionArgs } from '../lib/ssh.mjs';
 import { loadCredentials, saveCredentials } from '../lib/credentials.mjs';
 import { agentName, track } from '../lib/telemetry.mjs';
@@ -38,9 +37,10 @@ const API = (
 const IMAGE = process.env.INSTABOX_IMAGE || 'agent-browser';
 // SSH certificate lifetime for a box with no timeout of its own.
 const CERT_MIN = 120;
-// With no provider selected, the browser confirms its existing Instabox account
-// or offers sign-in. Explicit flags still start the chosen provider directly.
+// With no provider selected, the sign-in page offers GitHub or Google; --google asks for Google's.
 const PROVIDER = process.argv.includes('--google') ? 'google' : process.argv.includes('--github') ? 'github' : '';
+// The code is always printed; --no-browser only stops opening the sign-in page.
+const NO_BROWSER = process.argv.includes('--no-browser');
 const bold = (s) => (process.stdout.isTTY ? `\x1b[1m${s}\x1b[0m` : s);
 const dim = (s) => (process.stdout.isTTY ? `\x1b[2m${s}\x1b[0m` : s);
 const green = (s) => (process.stdout.isTTY ? `\x1b[32m${s}\x1b[0m` : s);
@@ -56,10 +56,11 @@ function usage() {
   console.log(`
   ${bold('instabox')}: a cloud box in seconds
 
-  npx instabox@latest               sign in (first time), install the instabox CLI and agent skills
+  npx instabox@latest               sign in with a device code (first time), install the instabox
+                                    CLI and agent skills
   npx instabox@latest sh            the same, then start a new box and SSH into it
-      --github, --google            sign in directly with that provider instead of confirming
-                                    the browser's current Instabox account
+      --github, --google            sign in with that provider
+      --no-browser                  only print the sign-in page and code; do not open a browser
       --no-cli                      do not install or update the instabox CLI
       --no-skills                   do not install the instabox agent skills
   npx instabox@latest <command>     run an instabox CLI command (instabox help lists them)
@@ -89,54 +90,6 @@ function openBrowser(url) {
   } catch {}
 }
 
-// The page the browser lands on after sign-in (served from the loopback listener).
-function signInPage(ok, title, text, who) {
-  const esc = (s) =>
-    String(s ?? '').replace(
-      /[&<>"']/g,
-      (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c],
-    );
-  const accent = ok ? '#6ee7b7' : '#f87171';
-  const icon = ok ? '<path d="M7 12.5l3.2 3.2L17 9" />' : '<path d="M8 8l8 8M16 8l-8 8" />';
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${esc(title)} · instabox</title>
-<style>
-  :root { --bg:#0b0b0c; --panel:#141416; --line:#26262a; --fg:#ededed; --dim:#8b8b92; --accent:${accent}; }
-  * { box-sizing:border-box; }
-  html, body { height:100%; margin:0; }
-  body { background:radial-gradient(1200px 600px at 50% -10%, color-mix(in srgb, var(--accent) 10%, transparent), transparent 60%), var(--bg);
-    color:var(--fg); font:15px/1.5 ui-sans-serif,system-ui,-apple-system,sans-serif; display:grid; place-items:center; padding:24px 16px; }
-  .card { width:100%; max-width:420px; background:var(--panel); border:1px solid var(--line); border-radius:16px; padding:36px 28px 28px; text-align:center;
-    box-shadow:0 30px 80px rgba(0,0,0,.45); animation:rise .5s cubic-bezier(.2,.9,.3,1.1) both; }
-  .brand { font:600 13px ui-monospace,SFMono-Regular,Menlo,monospace; letter-spacing:.08em; color:var(--dim); margin-bottom:28px; }
-  .badge { width:64px; height:64px; margin:0 auto 20px; border-radius:50%; display:grid; place-items:center;
-    background:color-mix(in srgb, var(--accent) 14%, transparent); border:1px solid color-mix(in srgb, var(--accent) 55%, transparent);
-    box-shadow:0 0 36px color-mix(in srgb, var(--accent) 35%, transparent); animation:pop .6s .15s cubic-bezier(.2,.9,.3,1.4) both; }
-  .badge svg { width:30px; height:30px; stroke:var(--accent); stroke-width:2.4; fill:none; stroke-linecap:round; stroke-linejoin:round;
-    stroke-dasharray:30; stroke-dashoffset:30; animation:draw .45s .45s ease-out forwards; }
-  h1 { font-size:22px; margin:0 0 6px; }
-  .who { color:var(--accent); font-weight:600; margin:0 0 10px; }
-  p { color:var(--dim); margin:0; }
-  .hint { margin-top:24px; padding-top:18px; border-top:1px solid var(--line); font-size:13px; color:var(--dim); }
-  kbd { white-space:nowrap; font:12px ui-monospace,SFMono-Regular,Menlo,monospace; background:var(--bg); border:1px solid var(--line); border-radius:6px; padding:2px 6px; color:var(--fg); }
-  @keyframes rise { from { opacity:0; transform:translateY(12px); } }
-  @keyframes pop { from { opacity:0; transform:scale(.4); } }
-  @keyframes draw { to { stroke-dashoffset:0; } }
-  @media (prefers-reduced-motion: reduce) { .card, .badge, .badge svg { animation:none; stroke-dashoffset:0; } }
-</style></head><body>
-<main class="card">
-  <div class="brand">INSTABOX</div>
-  <div class="badge"><svg viewBox="0 0 24 24" aria-hidden="true">${icon}</svg></div>
-  <h1>${esc(title)}</h1>
-  ${who ? `<p class="who">Signed in as ${esc(who)}</p>` : ''}
-  <p>${esc(text)}</p>
-  ${ok ? '<div class="hint">You can close this tab. Next time, <kbd>npx instabox@latest</kbd> skips this step.</div>' : ''}
-</main>
-</body></html>`;
-}
-
-// Browser sign-in, the same loopback flow as instabox's own CLI (RFC 8252 + PKCE): listen on
-// 127.0.0.1, open /auth/cli/start, receive the code at /callback, exchange it with the verifier.
 // askInvite asks for an invite code on the terminal; '' without one (a pipe, CI) or when left empty.
 async function askInvite(again) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) return '';
@@ -151,11 +104,22 @@ async function askInvite(again) {
   }
 }
 
-// signInWithInvite is browserLogin, asking for an invite code when the account is on the waitlist.
+// signInWithInvite is a device-code sign-in, asking for an invite code when the account is on the waitlist.
 async function signInWithInvite() {
   let invite = '';
   for (;;) {
-    const r = await browserLogin(invite);
+    const r = await deviceLogin({
+      anon: client.anon,
+      invite,
+      provider: PROVIDER,
+      show: (ds) => {
+        console.log(`  ${bold('Sign in to instabox')}: open ${ds.verificationUri}`);
+        console.log(`  and enter the code ${bold(ds.userCode)}\n`);
+        console.log(`  ${dim('Waiting for you to sign in…')}`);
+      },
+      open: NO_BROWSER || !canOpenBrowser() ? null : openBrowser,
+      sleep,
+    });
     if (r.tok) return r.tok;
     const waitlisted = r.code === 'invite_required' || r.code === 'invite_invalid';
     if (waitlisted) invite = await askInvite(r.code === 'invite_invalid');
@@ -168,50 +132,7 @@ async function signInWithInvite() {
   }
 }
 
-async function browserLogin(invite) {
-  const verifier = randomBytes(32).toString('base64url');
-  const state = randomBytes(24).toString('base64url');
-  const challenge = createHash('sha256').update(verifier).digest('base64url');
-  let finish;
-  const done = new Promise((r) => {
-    finish = r;
-  });
-  const exchange = async (code) => {
-    const tok = await client.anon('POST', '/v1/auth/cli/token', {
-      code,
-      codeVerifier: verifier,
-      redirectUri: redirect,
-    });
-    client.use(tok);
-    return { tok, me: await client.call('GET', '/v1/me').catch(() => null) };
-  };
-  const page = {
-    stale: () => signInPage(false, 'This sign-in link is stale', 'Run the command in your terminal again.'),
-    again: () => signInPage(true, 'Already signing you in', 'Head back to your terminal.'),
-    ok: (r) => signInPage(true, "You're in", 'Head back to your terminal.', r.me && (r.me.name || r.me.login)),
-    failed: (err, code) =>
-      code === 'invite_required' || code === 'invite_invalid'
-        ? signInPage(false, "You're on the waitlist", 'Return to your terminal to enter an invite code.')
-        : signInPage(false, 'Sign-in failed', `${err}. Return to your terminal and run the command again.`),
-  };
-  const server = http.createServer(callbackHandler({ state, exchange, finish, page }));
-  await new Promise((r) => server.listen(0, '127.0.0.1', r));
-  const redirect = `http://127.0.0.1:${server.address().port}/callback`;
-  const q = { redirect_uri: redirect, state, code_challenge: challenge, code_challenge_method: 'S256' };
-  if (PROVIDER) q.provider = PROVIDER;
-  if (invite) q.invite = invite;
-  const start = `${API}/auth/cli/start?` + new URLSearchParams(q);
-  console.log(`  ${bold('Sign in to instabox')} in your browser ${dim('(opening it now)')}`);
-  console.log(`  ${dim('If it did not open:')} ${start}\n`);
-  openBrowser(start);
-  const timer = setTimeout(() => finish({ err: 'timed out waiting for the browser sign-in' }), 5 * 60_000);
-  const result = await done;
-  clearTimeout(timer);
-  server.close();
-  return result.err ? { err: result.err, code: result.code } : { tok: result.tok };
-}
-
-// The CLI's saved token, a refreshed one, or a browser sign-in; saved where the CLI reads it.
+// The CLI's saved token, a refreshed one, or a device-code sign-in; saved where the CLI reads it.
 async function signedIn() {
   const c = loadCredentials(API);
   if (c?.accessToken && new Date(c.accessExpiresAt) - Date.now() > 60_000) return c;

package/lib/cli.mjs

@@ -5,7 +5,7 @@ import { createReadStream, mkdirSync, realpathSync, renameSync, rmSync, statSync
 import { homedir } from 'node:os';
 import { join, sep } from 'node:path';
 
-const OUR_FLAGS = new Set(['--github', '--google', '--no-cli', '--no-skills']);
+const OUR_FLAGS = new Set(['--github', '--google', '--no-browser', '--no-cli', '--no-skills']);
 
 // Bare `instabox` or `sh`, with only our flags; anything else is a CLI command.
 export function isOnboarding(args) {

package/lib/login.mjs

@@ -1,40 +1,41 @@
-// The loopback sign-in callback (RFC 8252); one code exchange per sign-in, however often it is hit.
-export function callbackHandler({ state, exchange, finish, page }) {
-  let taken = false;
-  return async (req, res) => {
-    const u = new URL(req.url, 'http://127.0.0.1');
-    const html = { 'Content-Type': 'text/html; charset=utf-8' };
-    if (u.pathname !== '/callback') {
-      res.writeHead(404);
-      return res.end();
+// Device-code sign-in (RFC 8628), as `instabox login` does it: POST /v1/auth/device for a code,
+// show it, then poll /v1/auth/device/token until the user approves, denies, or the code expires.
+export async function deviceLogin({ anon, invite = '', provider = '', show, open, sleep, now = Date.now }) {
+  const body = {};
+  if (invite) body.invite = invite;
+  // GitHub is the server's default device sign-in; only WorkOS's offers Google.
+  if (provider === 'google' || provider === 'workos') body.provider = provider;
+  let ds;
+  try {
+    ds = await anon('POST', '/v1/auth/device', body);
+  } catch (e) {
+    return { err: e.message, code: e.code };
+  }
+  if (body.provider && ds.provider !== 'workos')
+    return { err: "this server's device sign-in supports GitHub only: use --github" };
+  show(ds);
+  if (open) open(ds.verificationUriComplete || ds.verificationUri);
+  let interval = (Number.isFinite(ds.interval) && ds.interval >= 0 ? ds.interval : 5) * 1000;
+  const deadline = now() + (ds.expiresIn > 0 ? ds.expiresIn : 900) * 1000;
+  for (;;) {
+    await sleep(interval);
+    try {
+      return { tok: await anon('POST', '/v1/auth/device/token', { deviceCode: ds.deviceCode }) };
+    } catch (e) {
+      if (e.code === 'slow_down') interval += 5000;
+      else if (e.code === 'expired_token') return { err: 'the code expired; run the command again', code: e.code };
+      else if (e.code === 'access_denied') return { err: 'sign-in was denied', code: e.code };
+      else if (e.code !== 'authorization_pending') return { err: e.message, code: e.code };
     }
-    if (u.searchParams.get('state') !== state) {
-      res.writeHead(400, html);
-      return res.end(page.stale());
-    }
-    // A reload or a double navigation: the server revokes the whole session when a code comes back.
-    if (taken) {
-      res.writeHead(200, html);
-      return res.end(page.again());
-    }
-    taken = true;
-    let result;
-    if (u.searchParams.get('error')) {
-      result = {
-        err: u.searchParams.get('error_description') || u.searchParams.get('error'),
-        code: u.searchParams.get('error'),
-      };
-    } else {
-      try {
-        result = await exchange(u.searchParams.get('code'));
-      } catch (e) {
-        result = { err: e.message };
-      }
-    }
-    res.writeHead(200, html);
-    res.end(result.tok ? page.ok(result) : page.failed(result.err, result.code));
-    finish(result);
-  };
+    if (now() > deadline) return { err: 'the code expired; run the command again', code: 'expired_token' };
+  }
+}
+
+// Whether a local browser can show the sign-in page; the code is printed either way.
+export function canOpenBrowser(env = process.env, platform = process.platform) {
+  const display = Boolean(env.DISPLAY || env.WAYLAND_DISPLAY);
+  if (env.SSH_CONNECTION && !display) return false;
+  return display || platform === 'darwin' || platform === 'win32';
 }
 
 // The command that opens url in the browser. On Windows never `cmd /c start`: cmd ends the URL at its first &.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.6.4",
+  "version": "0.7.0",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -13,12 +13,12 @@ An instabox sandbox is a Linux VM (Debian, one user with passwordless sudo: name
 
 ```sh
 instabox whoami              # who is signed in (fails if nobody)
-instabox login               # confirm the browser's account, or choose GitHub / Google
+instabox login               # device code: open the printed page, enter the code
 ```
 
-A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` open account confirmation in the browser: use its current Instabox account or choose another. To go directly to a provider, use `instabox login --provider github|google`, or `npx instabox@latest --github|--google`. The CLI shares the sign-in `npx` made. Device-code sign-in (`--device`) uses GitHub.
+A GitHub sign-in and a Google sign-in with the same verified email share one account; with different emails they are separate accounts with separate boxes. Both `instabox login` and `npx instabox@latest` sign in with a device code: they print a page and a code (and open the page when there is a browser); the user opens it on any device, enters the code and chooses GitHub or Google there. It works the same over SSH or on a machine without a browser. Relay the page and the code to the user and wait; the command finishes on its own. For Google directly, use `instabox login --provider google`, or `npx instabox@latest --google`. The CLI shares the sign-in `npx` made.
 
-For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it in the dashboard: Profile → API keys (account menu)). Never print, commit or log a key.
+For CI or an agent without a browser, use an API key instead: `export INSTABOX_API_KEY=ibk_...` (the user creates it in the dashboard: API keys in the sidebar). Never print, commit or log a key.
 
 ## Templates
 
@@ -68,6 +68,7 @@ instabox rm work                                # delete the box
 - Max run minutes is independent of idle activity: `-1` is unlimited, `0` pauses immediately, and a positive integer forces a pause after that many running minutes. Free boxes have a fixed 480-minute cap that only an admin session can change; paid boxes default to `-1` and can change it. An idle override does not permit changes to a free box's runtime cap. The first limit reached pauses the box; both timers restart after sleep and wake.
 - A runtime pause blocks every wake path during a server-configured cooldown, 10 minutes by default. Wait until the `cooldownUntil` deadline shown by `instabox get`; edits cannot clear it. Afterward, an automatically paused box wakes on `exec`, `ssh`, `files`, a public port request or `instabox wake <box>`. A zero runtime cap must be changed before waking. A normal pause preserves memory and processes.
 - Use `exec` to run a command and read its output, and `ssh` for an interactive shell.
+- `exec` with one argument after `--` runs it as a shell string (`instabox exec work -- 'ls | wc -l'`); several arguments run as that exact argv, each quoted for you (`instabox exec work -- bash -c 'echo a b > /tmp/x'`).
 - `exec` returns the command's exit code and takes `--stdin` to pipe input. It stops the command after `--timeout` seconds: 60 by default, 600 at most. Run longer commands (installs, builds, test suites) over SSH, which also returns the exit code: `instabox ssh work -- 'cd /data/workspace/app && npm ci'`. The box's runtime cap still applies during SSH or exec.
 - The box's HOME has `MACHINE.md` (which box it is, its size, what survives a stop, the installed tools) and `AGENTS.md`. Both are worth reading before working in the box; they appear a moment after it starts.
 - A public URL for a web server in the box: `instabox port publish work 3000` prints it (`instabox port ls`, `instabox port unpublish work 3000`). The URL works while the box runs.
@@ -92,7 +93,7 @@ instabox create --name tenant --no-vault --secrets none
 ```
 
 - Values for `set` come from stdin or a hidden prompt. Never print a credential or put its value into agent output, chat, command arguments, or logs. Before asking for a credential, check metadata with `secrets ls --org <org>` and `secrets show <box>`. A silent check such as `test "${NAME+x}" = x` tests that the placeholder is present without revealing it; it does not prove the upstream accepts the credential.
-- `--host` is required and repeatable: give each exact hostname the credential may be sent to (no scheme, port, path, wildcard or IP address). Use the service's API host, such as `api.openai.com`, never a guess from the credential's value.
+- `--host` is optional and repeatable. Give each exact hostname the credential may be sent to; without `--host` (or with `--host '*'`) every public HTTPS destination is allowed. Schemes, ports, paths, IP addresses, and partial wildcards such as `*.example.com` are rejected. Use the service's API host, such as `api.openai.com`, never a guess from the credential's value.
 - Org commands default to the signed-in user's personal org. Use `--org` for a team, and select only Secrets from the box's org. Value, host and deletion changes require an org owner/admin sign-in. API keys with the appropriate machine scopes can inspect metadata and manage sandbox selections, but cannot retrieve or change Secret values.
 - `secrets select BOX --secrets` replaces the box's selection: `all`, `none`, comma-separated names, or a JSON array (which allows a Secret literally named `all` or `none`). Keep existing names when adding one.
 - Placeholders work only in HTTPS request headers on port 443 to the allowed hosts. Do not hash, encode, or sign with a placeholder; other traffic carries the placeholder unchanged.
@@ -120,7 +121,7 @@ instabox feedback --json --type bug --component cli --area exec \
 
 - `--type`: `bug` when something does not work as its help or the docs say (when instructions did not match reality, also give `--doc`, `--expected` and `--workaround`), `feature-request` when what you need is not supported, `friction` when it works but is confusing or awkward, `other` otherwise.
 - `--component`: `cli`, `api`, `sandbox` (the box itself, its templates or tools), `dashboard`, `skills`, `docs` or `other`. `--severity blocker|major|minor` (default `minor`); `--sandbox NAME` names the box involved.
-- Emails, keys, tokens, home paths and public IPv4 addresses are redacted before sending, but do not paste secrets into it. The report carries the signed-in account (its user ID, and its login unless that is an email address), so the team can follow up.
+- Emails, keys, tokens, home paths and public IPv4 addresses are redacted before sending, but do not paste secrets into it. Signed in, the report opens a support ticket on the account, and the team's replies show in the dashboard at the link it prints (`ticket` in `--json`); signed out or waitlisted, it reaches the team without one.
 - A failed or unconfirmed submission prints a warning and exits 0: do not retry. File one report per problem, not one per attempt.
 
 ## Habits