jaitus 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jaitus",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Jaitus — a coding agent in your terminal.",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js",
+    "test": "node tests/source-sanity.js && node tests/rules.js && node tests/run.js && node tests/commands.js && node tests/login.js && node tests/session.js && node tests/openUrl.js && node tests/ink-tui.js && node tests/tui-render.js && node tests/mouse-e2e.js && node tests/environment.js && node tests/update.js",
     "preview": "node scripts/tui-preview.js",
     "prepublishOnly": "npm test"
   },

package/src/agent/loop.js

@@ -21,7 +21,9 @@
 import { byName, toolSchemas, ToolError, readImageForModel } from './tools.js';
 import { PermissionDenied } from './permissions.js';
 import path from 'node:path';
-import { loadContext, CONTEXT_FILE } from '../project.js';
+import fs from 'node:fs';
+import os from 'node:os';
+import { loadContext, loadIgnore, CONTEXT_FILE } from '../project.js';
 import { c, out, write, spinner, glyph } from '../ui.js';
 import { discoverMcpTools } from '../mcp.js';
 import { unifiedDiff } from '../diff.js';
@@ -43,6 +45,11 @@ const toolMark = (name) => {
 
 export const SYSTEM_PROMPT = `You are Jaitus, a coding agent running in a developer's terminal, inside their project directory.
 
+You work directly on this computer. Your tools read, search, create and edit the files in
+the project and run shell commands in it, and you can fetch web pages. When the user asks
+about their files, their code or their machine, use the tools and answer from what you
+find — never say you cannot access local files, because you can.
+
 How to work:
 - Investigate before you change anything. Read the files you are about to edit; do not guess at their contents.
 - Prefer edit_file over write_file for existing files. Keep changes minimal and in the style of the surrounding code.
@@ -65,10 +72,66 @@ How to talk:
  * Fenced and labelled rather than concatenated, so instructions written by whoever owns
  * the repo are visibly the repo's and cannot be mistaken for part of Jaitus's own rules.
  */
+/**
+ * Where the agent is: the facts it would otherwise guess at, and guess wrong.
+ *
+ * Without these, the model did not know which folder it was in, which OS its commands
+ * would run on (cmd.exe and /bin/sh disagree about almost everything), or today's date —
+ * and a model that does not know where it is tends to say it cannot see your files. The
+ * listing is the top level only, names not contents, and respects .jaitusignore.
+ */
+export function environmentBlock(cwd, { now = new Date(), platform = process.platform } = {}) {
+  if (!cwd) return '';
+  const osName = { win32: 'Windows', darwin: 'macOS', linux: 'Linux' }[platform] || platform;
+  const shell = platform === 'win32' ? 'cmd.exe (run_command uses it)' : '/bin/sh (run_command uses it)';
+  // The repository may start above the working directory, and .git may be a file that
+  // points elsewhere (a worktree or submodule).
+  let branch = null;
+  for (let dir = cwd, i = 0; i < 40; i++) {
+    const dotGit = path.join(dir, '.git');
+    try {
+      let gitDir = dotGit;
+      if (fs.statSync(dotGit).isFile()) {
+        const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(dotGit, 'utf8'));
+        if (m) gitDir = path.resolve(dir, m[1].trim());
+      }
+      const head = fs.readFileSync(path.join(gitDir, 'HEAD'), 'utf8').trim();
+      branch = head.startsWith('ref: refs/heads/') ? head.slice(16) : `detached at ${head.slice(0, 7)}`;
+      break;
+    } catch { /* not here; look one level up */ }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  let listing = '';
+  try {
+    const ignore = loadIgnore(cwd);
+    const SKIP = new Set(['.git', 'node_modules']);
+    const names = fs.readdirSync(cwd, { withFileTypes: true })
+      .filter((d) => !SKIP.has(d.name) && !ignore.matches(d.isDirectory() ? `${d.name}/` : d.name) && !ignore.matches(d.name))
+      .map((d) => (d.isDirectory() ? `${d.name}/` : d.name))
+      .sort((a, b) => (b.endsWith('/') - a.endsWith('/')) || a.localeCompare(b));
+    const MAX = 60;
+    listing = names.slice(0, MAX).join('\n') + (names.length > MAX ? `\n… and ${names.length - MAX} more` : '');
+  } catch { /* unreadable: the tools will say why */ }
+  return `
+
+<environment>
+Working directory: ${cwd}
+Platform: ${osName} (${os.release()})
+Shell: ${shell}
+Today: ${now.toISOString().slice(0, 10)}
+Git: ${branch ? `yes, branch ${branch}` : 'no repository at this folder'}
+Top level of the working directory:
+${listing || '(empty)'}
+</environment>`;
+}
+
 export function systemPrompt(cwd) {
   const project = cwd ? loadContext(cwd) : null;
-  if (!project) return SYSTEM_PROMPT;
-  return `${SYSTEM_PROMPT}
+  const base = `${SYSTEM_PROMPT}${environmentBlock(cwd)}`;
+  if (!project) return base;
+  return `${base}
 
 The project you are working in ships a ${CONTEXT_FILE} with notes for you. Follow it where
 it applies, and prefer what it says over your own assumptions about this codebase.

package/src/commands/login.js

@@ -104,16 +104,15 @@ function awaitCallback(server, expectedState) {
   });
 }
 
-export default async function login(argv) {
+/**
+ * The browser sign-in, with no output of its own.
+ *
+ * The command below prints it to the terminal; the app view shows the same steps in its
+ * transcript. Reports progress through `onUrl` (the link to open, shown in case the
+ * browser does not) and `onStatus`. Resolves to { ok: true, user } or { ok: false, message }.
+ */
+export async function signIn({ onUrl = () => {}, onStatus = () => {} } = {}) {
   const { baseUrl, siteUrl } = endpoints();
-
-  const existing = loadCredentials();
-  if (existing?.refreshToken && !argv.includes('--force')) {
-    out(`Already signed in as ${c.bold(existing.user?.email || 'your account')}.`);
-    const again = await ask(`${c.dim('Sign in again? [y/N] ')}`);
-    if (again.toLowerCase() !== 'y') return 0;
-  }
-
   const state = crypto.randomBytes(24).toString('base64url');
   // PKCE (S256): the challenge goes out through the browser, the verifier stays here and
   // is only ever sent in the final exchange.
@@ -140,27 +139,18 @@ export default async function login(argv) {
   url.searchParams.set('device', device);
   url.searchParams.set('platform', process.platform);
 
-  out('');
-  out(`  ${c.brand('Jaitus')} — sign in`);
-  out('');
-  out(`  Opening ${c.cyan(siteUrl + '/cli-auth')} in your browser.`);
-  out(`  ${c.dim('If it does not open, paste this link:')}`);
-  out(`  ${c.dim(url.toString())}`);
-  out('');
-
+  onUrl(url.toString(), `${siteUrl}/cli-auth`);
   openBrowser(url.toString());
-  const spin = spinner(glyph('Waiting for you to authorise in the browser…', 'Waiting for you to authorise in the browser...'));
+  onStatus('waiting');
 
   let code;
   try {
     ({ code } = await awaitCallback(server, state));
   } catch (e) {
-    spin.stop();
     server.close();
-    fail(e.message);
-    return 1;
+    return { ok: false, message: e.message };
   }
-  spin.update(glyph('Finishing sign-in…', 'Finishing sign-in...'));
+  onStatus('finishing');
 
   try {
     const res = await fetch(`${baseUrl}/api/auth/cli/exchange`, {
@@ -169,13 +159,11 @@ export default async function login(argv) {
       body: JSON.stringify({ code, verifier }),
     });
     const body = await res.json().catch(() => ({}));
-    spin.stop();
     server.close();
 
     if (!res.ok || !body?.data?.accessToken || !body?.data?.refreshToken) {
       // Our own sign-in endpoint's wording, or a plain fallback — never a raw body.
-      fail(typeof body?.message === 'string' && body.message ? body.message : 'Sign-in did not complete. Run `jaitus login` again.');
-      return 1;
+      return { ok: false, message: typeof body?.message === 'string' && body.message ? body.message : 'Sign-in did not complete. Try again.' };
     }
 
     saveCredentials({
@@ -188,14 +176,44 @@ export default async function login(argv) {
       createdAt: new Date().toISOString(),
     });
 
-    const who = body.data.user;
-    ok(`Signed in as ${c.bold(who?.email || 'your account')}${who?.isPaid ? '' : c.dim(' (free plan)')}`);
-    info(`Run ${c.bold('jaitus')} in a project to start, or ${c.bold('jaitus --help')} to see everything.`);
-    return 0;
-  } catch (e) {
-    spin.stop();
+    return { ok: true, user: body.data.user || null };
+  } catch {
     server.close();
-    fail('Could not reach Jaitus. Check your connection and run `jaitus login` again.');
+    return { ok: false, message: 'Could not reach Jaitus. Check your connection and try again.' };
+  }
+}
+
+export default async function login(argv, { then = 'hint' } = {}) {
+  const existing = loadCredentials();
+  if (existing?.refreshToken && !argv.includes('--force')) {
+    out(`Already signed in as ${c.bold(existing.user?.email || 'your account')}.`);
+    const again = await ask(`${c.dim('Sign in again? [y/N] ')}`);
+    if (again.toLowerCase() !== 'y') return 0;
+  }
+
+  let spin = null;
+  const result = await signIn({
+    onUrl: (url, shown) => {
+      out('');
+      out(`  ${c.brand('Jaitus')} — sign in`);
+      out('');
+      out(`  Opening ${c.cyan(shown)} in your browser.`);
+      out(`  ${c.dim('If it does not open, paste this link:')}`);
+      out(`  ${c.dim(url)}`);
+      out('');
+    },
+    onStatus: (s) => {
+      if (s === 'waiting') spin = spinner(glyph('Waiting for you to authorise in the browser…', 'Waiting for you to authorise in the browser...'));
+      else spin?.update(glyph('Finishing sign-in…', 'Finishing sign-in...'));
+    },
+  });
+  spin?.stop();
+  if (!result.ok) {
+    fail(`${result.message}${/login/.test(result.message) ? '' : ` Run ${c.bold('jaitus login')} to try again.`}`);
     return 1;
   }
+  const who = result.user;
+  ok(`Signed in as ${c.bold(who?.email || 'your account')}${who?.isPaid ? '' : c.dim(' (free plan)')}`);
+  if (then === 'hint') info(`Run ${c.bold('jaitus')} in a project to start, or ${c.bold('jaitus --help')} to see everything.`);
+  return 0;
 }

package/src/commands/update.js

@@ -1,12 +1,21 @@
 // ─── jaitus update ──────────────────────────────────────────────────────────────
 //
-// Checks the registry and tells you. It deliberately does NOT run the install itself:
-// the CLI may have been installed globally, with npx, through a version manager, or
-// vendored into a repo, and a tool that guesses wrong there either fails confusingly or
-// modifies something it was never asked to modify.
+// Checks the registry, and installs the new version when it can tell HOW this copy was
+// installed: a global npm install is upgraded with the same npm, after asking. Anything
+// else — npx, a version manager, a copy vendored into a repo — gets the command to run
+// instead, because a tool that guesses wrong there either fails confusingly or modifies
+// something it was never asked to modify.
+//
+// A global install never updates itself, so the app also checks once a day, in the
+// background, and says when a newer version is out (the update-notifier pattern npm and
+// gh use). JAITUS_NO_UPDATE_CHECK=1, NO_UPDATE_NOTIFIER or CI turns that off.
 
-import { c, out, ok, info, warn, present } from '../ui.js';
-import { version } from '../config.js';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { c, out, ok, info, warn, fail, present, askKey } from '../ui.js';
+import { version, HOME } from '../config.js';
 
 const REGISTRY = process.env.JAITUS_REGISTRY || 'https://registry.npmjs.org';
 const TIMEOUT_MS = 5000;
@@ -46,6 +55,74 @@ export async function latestVersion() {
   return (await checkRegistry()).version;
 }
 
+const CHECK_FILE = path.join(HOME, 'update-check.json');
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/** Whether the background check is allowed to run at all. */
+export function updateCheckEnabled(env = process.env) {
+  return !(env.JAITUS_NO_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER || env.CI);
+}
+
+/**
+ * The newest published version, asked of the registry at most once a day.
+ *
+ * Cached so opening the app is never slowed by, or dependent on, the network: a failed
+ * check is remembered too, and simply tried again tomorrow.
+ */
+export async function cachedLatest({ now = Date.now(), file = CHECK_FILE, check = checkRegistry } = {}) {
+  try {
+    const cached = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (cached && now - Number(cached.checkedAt) < DAY_MS) return cached.latest || null;
+  } catch { /* first run, or unreadable: ask */ }
+  const { version: latest } = await check();
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ checkedAt: now, latest: latest || null }));
+  } catch { /* read-only home: check again next time */ }
+  return latest || null;
+}
+
+/** One line for the app to show when a newer version is out, or null. */
+export async function updateNotice(opts = {}) {
+  if (!updateCheckEnabled(opts.env)) return null;
+  const current = opts.current || version();
+  const latest = await cachedLatest(opts).catch(() => null);
+  if (!latest || !isNewer(latest, current)) return null;
+  return `Jaitus v${latest} is out — you have v${current}. Quit and run \`jaitus update\` to install it.`;
+}
+
+function run(cmd, args, { capture = false } = {}) {
+  return new Promise((resolve) => {
+    // npm is npm.cmd on Windows, which spawn cannot start without a shell. The arguments
+    // here are fixed strings (a version number from the registry at most), so they are
+    // joined into one command line rather than passed alongside shell: true, which Node
+    // deprecates because it does not escape them.
+    const stdio = capture ? ['ignore', 'pipe', 'ignore'] : 'inherit';
+    const child = process.platform === 'win32'
+      ? spawn([cmd, ...args].join(' '), { shell: true, stdio })
+      : spawn(cmd, args, { stdio });
+    let stdout = '';
+    child.stdout?.on('data', (d) => { stdout += d; });
+    child.on('error', () => resolve({ code: -1, stdout }));
+    child.on('close', (code) => resolve({ code, stdout }));
+  });
+}
+
+/**
+ * How this copy was installed: 'npm-global', 'npx', or 'other'.
+ *
+ * Decided by where this file actually lives, compared with npm's own global folder —
+ * not by guessing from environment variables.
+ */
+export async function installMethod({ here = fileURLToPath(import.meta.url), npmRoot = null } = {}) {
+  const real = (() => { try { return fs.realpathSync(here); } catch { return here; } })();
+  const norm = (p) => path.resolve(p).toLowerCase();
+  if (/[\\/]_npx[\\/]/.test(real)) return 'npx';
+  const root = npmRoot ?? (await run('npm', ['root', '-g'], { capture: true })).stdout.trim();
+  if (root && norm(real).startsWith(norm(path.join(root, 'jaitus')) + path.sep.toLowerCase())) return 'npm-global';
+  return 'other';
+}
+
 /**
  * Plain semver comparison — is `a` newer than `b`?
  * Prerelease tags are treated as older than the release they lead to, which is what
@@ -67,7 +144,61 @@ export function isNewer(a, b) {
   return false;
 }
 
-export default async function update(argv = [], { json = false } = {}) {
+/**
+ * Update on launch, then reopen: every time `jaitus` starts, the registry is asked
+ * (with a short timeout, so a slow network costs at most that); when a newer version is
+ * out and this copy is a global npm install, it is installed and the same command is
+ * started again on the new version.
+ *
+ * It never blocks the session on a failure. A failed install (commonly: a system-wide
+ * Node on macOS or Linux, where npm -g needs sudo) says so once and is not retried for a
+ * day, so a machine that cannot update does not pay for trying on every start.
+ *
+ * Off with `jaitus config autoUpdate off`, JAITUS_NO_AUTOUPDATE=1, NO_UPDATE_NOTIFIER or CI.
+ * Returns the child's exit code when it relaunched, or null to carry on in this process.
+ */
+export async function autoUpdate({ argv = [], settings = {}, env = process.env, current = version(), log = out,
+  check = () => checkRegistry(), method = () => installMethod(), install = (v) => run('npm', ['install', '-g', `jaitus@${v}`], { capture: true }),
+  relaunch = defaultRelaunch, now = Date.now(), failFile = path.join(HOME, 'update-failed.json') } = {}) {
+  if (env.JAITUS_UPDATED_FROM) return null;                // just relaunched: never loop
+  if (!updateCheckEnabled(env) || env.JAITUS_NO_AUTOUPDATE || settings.autoUpdate === false) return null;
+  if (!process.stdout.isTTY || !process.stdin.isTTY) return null;   // scripts and pipes get a stable version
+  const first = argv.find((a) => !a.startsWith('-'));
+  if (['update', 'completion', 'help', 'logout'].includes(first) || argv.some((a) => ['--version', '-v', '--help', '-h', '--print', '-p'].includes(a))) return null;
+  try {
+    const failed = JSON.parse(fs.readFileSync(failFile, 'utf8'));
+    if (now - Number(failed.at) < DAY_MS) return null;
+  } catch { /* no recent failure */ }
+
+  const { version: latest } = await Promise.race([
+    check(),
+    // unref: a quick command must not sit waiting for this timer after the answer came.
+    new Promise((resolve) => setTimeout(() => resolve({ version: null }), 1500).unref()),
+  ]);
+  if (!latest || !isNewer(latest, current)) return null;
+  if ((await method()) !== 'npm-global') return null;       // the in-app notice covers these
+
+  log(`  ${c.brand('Jaitus')} ${c.dim(`v${current} →`)} ${c.bold(`v${latest}`)} ${c.dim('— updating…')}`);
+  const { code } = await install(latest);
+  if (code !== 0) {
+    try { fs.mkdirSync(path.dirname(failFile), { recursive: true }); fs.writeFileSync(failFile, JSON.stringify({ at: now, version: latest })); } catch { /* best effort */ }
+    log(`  ${c.yellow('!')} ${c.dim('Could not update automatically — continuing on')} v${current}${c.dim('. To update:')} ${c.bold(process.platform === 'win32' ? 'npm install -g jaitus@latest' : 'sudo npm install -g jaitus@latest')}`);
+    return null;
+  }
+  log(`  ${c.accent('✓')} ${c.dim('Updated — reopening')}`);
+  return relaunch({ ...env, JAITUS_UPDATED_FROM: current });
+}
+
+/** Start the same command again on the freshly installed version, in this terminal. */
+function defaultRelaunch(env) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [...process.execArgv, process.argv[1], ...process.argv.slice(2)], { stdio: 'inherit', env });
+    child.on('error', () => resolve(null));
+    child.on('exit', (code, signal) => resolve(signal ? 1 : (code ?? 0)));
+  });
+}
+
+export default async function update(argv = [], { json = false, interactive = true } = {}) {
   const current = version();
   const { version: latest, status } = await checkRegistry();
 
@@ -89,9 +220,36 @@ export default async function update(argv = [], { json = false } = {}) {
     out('');
     out(`  ${c.bold(`v${latest}`)} is available ${c.dim(`— you have v${current}`)}`);
     out('');
-    out(`  ${c.dim('global install')}   ${c.bold('npm install -g jaitus')}`);
+  });
+  if (!available || json) return 0;
+
+  const manual = () => {
+    out(`  ${c.dim('global install')}   ${c.bold('npm install -g jaitus@latest')}`);
     out(`  ${c.dim('no install')}       ${c.bold('npx jaitus@latest')}`);
     out('');
-  });
+  };
+  // Inside the app the running copy cannot be swapped out from under itself.
+  if (!interactive) { info('Quit Jaitus, then run it from your shell:'); manual(); return 0; }
+
+  const method = await installMethod();
+  if (method !== 'npm-global') {
+    info(method === 'npx' ? 'You are running it through npx — use @latest to get the new version:' : 'This copy was not installed with npm -g, so update it the way you installed it, or:');
+    manual();
+    return 0;
+  }
+  const yes = argv.includes('--yes') || argv.includes('-y');
+  if (!yes) {
+    if (!process.stdin.isTTY) { manual(); return 0; }
+    const answer = await askKey(`  Install v${latest} now? ${c.dim('[Y/n]')} `, ['y', 'n', '\r', '\n']);
+    if (answer === 'n') { manual(); return 0; }
+  }
+  out(`  ${c.dim('running')} npm install -g jaitus@${latest}`);
+  const { code } = await run('npm', ['install', '-g', `jaitus@${latest}`]);
+  if (code !== 0) {
+    fail(`npm could not install it (exit ${code}). Try it yourself — on macOS or Linux it may need sudo, or a Node version manager:`);
+    manual();
+    return 1;
+  }
+  ok(`Updated to v${latest}. Start ${c.bold('jaitus')} again to use it.`);
   return 0;
 }

package/src/errors.js

@@ -8,8 +8,8 @@
 // recognise, because the only text that is safe to show is text we wrote.
 
 const CATALOG = {
-  auth_required: { title: 'Not signed in', hint: 'Run `jaitus login` to sign in.' },
-  session_expired: { title: 'Signed out', hint: 'Run `jaitus login` to sign in again.' },
+  auth_required: { title: 'Not signed in', hint: 'Type /login to sign in (or run `jaitus login`).' },
+  session_expired: { title: 'Signed out', hint: 'Type /login to sign in again (or run `jaitus login`).' },
   account_suspended: { title: 'Account suspended', hint: 'Contact support if you think this is a mistake.' },
   email_unverified: { title: 'Email not verified', hint: 'Open the verification link in your inbox, then retry.' },
   free_limit_reached: { title: 'Free prompts used up', hint: 'Subscribe on the website, then retry this turn.' },

package/src/index.js

@@ -41,7 +41,7 @@ const createTui = process.env.JAITUS_RENDERER === 'classic' ? createClassicTui :
 import login from './commands/login.js';
 import logout from './commands/logout.js';
 import doctor from './commands/doctor.js';
-import update from './commands/update.js';
+import update, { updateNotice, autoUpdate } from './commands/update.js';
 import init from './commands/init.js';
 import research from './commands/research.js';
 import explain from './commands/explain.js';
@@ -522,6 +522,12 @@ export function ensureUtf8Codepage() {
 }
 
 async function session({ flags }) {
+  // Signed out: sign in here, in this window, and go straight on into the session —
+  // rather than stopping to tell someone to run another command first.
+  if (!signedIn() && process.stdin.isTTY && process.stdout.isTTY) {
+    const code = await login([], { then: 'continue' });
+    if (code !== 0) return code;
+  }
   const client = requireAuth();
   // Classic conhost speaks an OEM codepage by default, so every ›•─│ the CLI
   // paints arrives as mojibake (the whole UI looks broken, not old). One
@@ -1039,6 +1045,9 @@ async function session({ flags }) {
     : true;
   if (process.stdout.isTTY && wantFullscreen) {
     tui.start({ onLine: handleLine, history: sessionHistory() });
+    // A global install never updates itself; say so when there is something newer.
+    // Background and cached for a day — the app never waits on the network for this.
+    void updateNotice().then((line) => { if (line) tui.notice(line, 'info'); }).catch(() => {});
     // Fresh sessions open on the home moment, opencode-style: the centered
     // two-tone mark, then a tip — the composer below is the whole welcome.
     // The mark is vertically centered in the free space above the pinned
@@ -1992,9 +2001,24 @@ async function slashCommand(verb, args, ctx) {
       return null;
     }
 
-    case '/login':
-      await login(['--force']);
+    case '/login': {
+      // In the app view the steps go to the transcript; the session carries on after,
+      // on the new account — every request reads the saved sign-in fresh.
+      const t = ctx.tui;
+      if (!t) { await login(['--force'], { then: 'none' }); return null; }
+      const { signIn } = await import('./commands/login.js');
+      const result = await signIn({
+        onUrl: (url) => {
+          t.notice('Opening your browser to sign in. If it does not open, paste this link:', 'info');
+          t.notice(url, 'dim');
+        },
+        onStatus: (s) => t.setStatus(s === 'waiting' ? 'Waiting for you to approve in the browser… (Esc does not cancel; close the tab to give up)' : 'Finishing sign-in…'),
+      });
+      t.clearStatus?.();
+      if (result.ok) t.notice(`Signed in as ${result.user?.email || 'your account'}${result.user?.isPaid ? '' : ' (free plan)'}.`, 'ok');
+      else t.notice(result.message, 'warn');
       return null;
+    }
 
     case '/logout': {
       const { default: logout } = await import('./commands/logout.js');
@@ -2031,7 +2055,7 @@ async function slashCommand(verb, args, ctx) {
       return null;
 
     case '/update':
-      await commands.update.run([], { json: false });
+      await update([], { json: false, interactive: false });
       return null;
 
     case '/banner': {
@@ -2288,7 +2312,7 @@ const commands = {
     run: (argv, { json }) => {
       const [key, value] = argv;
       const settings = loadSettings();
-      const ONOFF = ['copyOnSelect', 'wheelAccel', 'autoScroll', 'animations', 'autoCompact', 'mouse'];
+      const ONOFF = ['copyOnSelect', 'wheelAccel', 'autoScroll', 'animations', 'autoCompact', 'mouse', 'autoUpdate'];
       const SECRET = ['braveSearchKey', 'tavilyKey', 'serperKey'];
       if (!key) {
         const e = endpoints();
@@ -2321,7 +2345,7 @@ const commands = {
           ['Auto-scroll', data.autoScroll ? 'on' : 'off'],
           ['Animations', data.animations ? 'on' : 'off'],
           ['Auto-compact', data.autoCompact ? 'on (summarises near the context limit)' : 'off'],
-          ['Mouse', data.mouse ? 'on (wheel scrolls, clicks act; shift+drag selects)' : 'off'],
+          ['Mouse', data.mouse ? 'on (wheel scrolls, clicks act, drag or double-click copies)' : 'off (the terminal selects text itself)'],
           ['Search API', data.searchApi ? `${data.searchApi} (set)` : 'none — using free engines + npm/GitHub/MDN/Stack Overflow'],
           ['Status line', data.statusLine || '(unset — set a command to render one)'],
           ['Config', data.configDir],
@@ -2456,6 +2480,10 @@ export default async function main(argv) {
 
   if (flags.version) { out(VERSION); return 0; }
 
+  // Always on the newest version: install it and reopen before doing anything else.
+  const relaunched = await autoUpdate({ argv, settings: loadSettings() }).catch(() => null);
+  if (relaunched !== null) return relaunched;
+
   const [first, ...others] = rest;
   const cmd = commands[first];