letthemquibble 1.1.0 → 2.0.0

package/dist/quibble.js

@@ -51,11 +51,11 @@ var require_error = __commonJS({
        * @param {string} code an id string representing the error
        * @param {string} message human-readable description of the error
        */
-      constructor(exitCode, code, message) {
+      constructor(exitCode, code2, message) {
         super(message);
         Error.captureStackTrace(this, this.constructor);
         this.name = this.constructor.name;
-        this.code = code;
+        this.code = code2;
         this.exitCode = exitCode;
         this.nestedError = void 0;
       }
@@ -1649,9 +1649,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return never
        * @private
        */
-      _exit(exitCode, code, message) {
+      _exit(exitCode, code2, message) {
         if (this._exitCallback) {
-          this._exitCallback(new CommanderError2(exitCode, code, message));
+          this._exitCallback(new CommanderError2(exitCode, code2, message));
         }
         process3.exit(exitCode);
       }
@@ -2289,14 +2289,14 @@ Expecting one of '${allowedValues.join("', '")}'`);
           });
         }
         const exitCallback = this._exitCallback;
-        proc.on("close", (code) => {
-          code = code ?? 1;
+        proc.on("close", (code2) => {
+          code2 = code2 ?? 1;
           if (!exitCallback) {
-            process3.exit(code);
+            process3.exit(code2);
           } else {
             exitCallback(
               new CommanderError2(
-                code,
+                code2,
                 "commander.executeSubCommandAsync",
                 "(close)"
               )
@@ -2803,8 +2803,8 @@ Expecting one of '${allowedValues.join("', '")}'`);
         }
         const config2 = errorOptions || {};
         const exitCode = config2.exitCode || 1;
-        const code = config2.code || "commander.error";
-        this._exit(exitCode, code, message);
+        const code2 = config2.code || "commander.error";
+        this._exit(exitCode, code2, message);
       }
       /**
        * Apply any option related environment variables, if option does
@@ -6303,9 +6303,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname4) {
-  hostname4.lastIndex = 0;
-  return hostname4.test(url2.hostname);
+function urlHostnameOk(url2, hostname5) {
+  hostname5.lastIndex = 0;
+  return hostname5.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -6578,12 +6578,12 @@ function isIso7064Mod97(iban3) {
   let remainder = 0;
   const len = iban3.length;
   for (let i = 4; i < len; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   for (let i = 0; i < 4; i++) {
-    const code = iban3.charCodeAt(i);
-    remainder = (code >= 65 ? remainder * 100 + (code - 55) : remainder * 10 + (code - 48)) % 97;
+    const code2 = iban3.charCodeAt(i);
+    remainder = (code2 >= 65 ? remainder * 100 + (code2 - 55) : remainder * 10 + (code2 - 48)) % 97;
   }
   return remainder === 1;
 }
@@ -7013,7 +7013,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const catchall = def.catchall;
   let value;
   const memo2 = globalConfig.memoizer;
@@ -7021,7 +7021,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -7157,7 +7157,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return doc.compile();
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject3 = isObject;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -7166,7 +7166,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input2 = payload.value;
-    if (!isObject2(input2)) {
+    if (!isObject3(input2)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -16501,12 +16501,12 @@ function compileFn(schema, options) {
   doc.write(outputAccessor === null ? `return true;` : `return ${outputAccessor};`);
   const constantNames = ["INVALID", ...ctx.constants.keys()];
   const constantValues = [INVALID, ...ctx.constants.values()];
-  const code = doc.content.join("\n");
+  const code2 = doc.content.join("\n");
   const fullCode = options?.debug ? constantNames.length > 0 ? `// Constants: ${constantNames.join(", ")}
-${code}` : code : "";
+${code2}` : code2 : "";
   const F = Function;
   const factoryCode = `return (input) => {
-${code}
+${code2}
 }`;
   let fn;
   try {
@@ -19432,8 +19432,8 @@ function finalize(ctx, schema) {
         compactTypeUnion(entry[1].def ?? entry[1].schema);
       }
     }
-    for (const rewrite of ctx.deferred)
-      rewrite();
+    for (const rewrite2 of ctx.deferred)
+      rewrite2();
     if (ctx.intersections.length) {
       const carriers = /* @__PURE__ */ new Map();
       for (const seen of ctx.seen.values()) {
@@ -23222,7 +23222,7 @@ var RESERVED_SLUGS = [
 ];
 var LOCAL_ORG = "local";
 var DISPLAY_NAME_MAX = 64;
-var PROJECT_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var PROJECT_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 var DEFAULT_LIMIT = 50;
 var MAX_LIMIT = 200;
 var DEFAULT_SEVERITY = "medium";
@@ -23233,14 +23233,22 @@ var ACT_AS_HEADER = "x-quibble-act-as";
 var TRUNCATED_HEADER = "x-quibble-truncated";
 var IDEMPOTENCY_HEADER = "idempotency-key";
 var IDEMPOTENCY_KEY_MAX = 128;
+var CLI_LOGIN_TTL_SECONDS = 600;
+var CLI_LOGIN_POLL_SECONDS = 3;
+var CLI_LOGIN_CODE_ALPHABET = "BCDFGHJKMNPQRSTVWXZ";
+var CLI_LOGIN_CODE_LENGTH = 8;
+var CLI_LOGIN_HOST_MAX = 64;
+var CLI_LOGIN_OS_MAX = 32;
+var CLI_LOGIN_VERSION_MAX = 32;
+var CLI_LOGIN_PAGE_PATH = "/cli-login";
 
 // ../core/dist/errors.js
 var QuibbleError = class extends Error {
   /** Stable machine-readable code, also used by the API error body. */
   code;
-  constructor(code, message, options) {
+  constructor(code2, message, options) {
     super(message, options);
-    this.code = code;
+    this.code = code2;
     this.name = new.target.name;
   }
 };
@@ -23287,6 +23295,35 @@ function describeError(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
 
+// ../core/dist/cli-login.js
+var CLI_LOGIN_CONTROL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/u;
+var CONTROL_GLOBAL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/gu;
+var CLI_LOGIN_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
+var CLI_LOGIN_CODE_MESSAGE = "code: not a login code";
+var HALF = CLI_LOGIN_CODE_LENGTH / 2;
+var CODE_RE = new RegExp(`^([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})-?([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})$`);
+var UNKNOWN_HOST = "unknown";
+function parseCliLoginCode(value) {
+  const match = CODE_RE.exec(value.trim().toUpperCase());
+  if (match === null)
+    throw new ValidationError([CLI_LOGIN_CODE_MESSAGE]);
+  return `${match[1] ?? ""}-${match[2] ?? ""}`;
+}
+function cliLoginUrl(webUrl, code2) {
+  return `${webUrl.replace(/\/+$/, "")}${CLI_LOGIN_PAGE_PATH}?code=${code2}`;
+}
+function cut(value, max) {
+  if (value.length <= max)
+    return value;
+  const head = value.slice(0, max);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+function cliLoginHost(raw) {
+  const host = cut(raw.replace(CONTROL_GLOBAL_RE, "").trim(), CLI_LOGIN_HOST_MAX).trim();
+  return host === "" ? UNKNOWN_HOST : host;
+}
+
 // ../core/dist/fingerprint.js
 function headlineOf(message) {
   for (const line of message.split("\n")) {
@@ -23307,7 +23344,7 @@ var PUNCTUATION_RE = /[^\p{L}\p{N}\s<>]/gu;
 function isHexId(run2) {
   return /[a-f]/.test(run2) && /[0-9]/.test(run2);
 }
-function cut(text, max) {
+function cut2(text, max) {
   if (text.length <= max)
     return text;
   const head = text.slice(0, max);
@@ -23325,7 +23362,7 @@ function fingerprintOf(message) {
   text = text.replace(NUMBER_RE, "<n>");
   text = text.replace(PUNCTUATION_RE, " ");
   text = text.replace(/\s+/gu, " ").trim();
-  text = cut(text, FINGERPRINT_MAX).trim();
+  text = cut2(text, FINGERPRINT_MAX).trim();
   return text === "" ? EMPTY_FINGERPRINT : text;
 }
 function groupComplaints(complaints) {
@@ -23476,7 +23513,10 @@ var timestampSchema = external_exports.string({ message: TIMESTAMP_MESSAGE }).re
 function toMilliseconds(timestamp) {
   return new Date(timestamp).toISOString();
 }
-var projectNameSchema = external_exports.string({ message: PROJECT_MESSAGE }).regex(PROJECT_NAME_RE, { message: PROJECT_MESSAGE });
+function foldProjectName(name) {
+  return name.replace(/[A-Z]+/g, (letters) => letters.toLowerCase());
+}
+var projectNameSchema = external_exports.string({ message: PROJECT_MESSAGE }).overwrite(foldProjectName).regex(PROJECT_NAME_RE, { message: PROJECT_MESSAGE });
 var orgSlugSchema = external_exports.string({ message: SLUG_MESSAGE }).refine((value) => ORG_SLUG_RE.test(value) && !value.includes("--"), {
   message: SLUG_MESSAGE
 });
@@ -23903,6 +23943,23 @@ function newTokenSchema(now) {
     ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
   }));
 }
+function reportedField(max) {
+  const message = lengthMessage(1, max);
+  return external_exports.string({ message }).trim().min(1, { message }).max(max, { message }).refine((value) => !CLI_LOGIN_CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
+}
+var newCliLoginSchema = external_exports.strictObject({
+  host: reportedField(CLI_LOGIN_HOST_MAX),
+  os: reportedField(CLI_LOGIN_OS_MAX),
+  version: reportedField(CLI_LOGIN_VERSION_MAX)
+}).transform((input2) => ({
+  host: input2.host,
+  os: input2.os,
+  version: input2.version
+}));
+var LOGIN_KEY_MESSAGE = "must be 43 base64url characters";
+var cliLoginPollSchema = external_exports.strictObject({
+  loginKey: external_exports.string({ message: LOGIN_KEY_MESSAGE }).regex(CLI_LOGIN_KEY_RE, { message: LOGIN_KEY_MESSAGE })
+}).transform((input2) => ({ loginKey: input2.loginKey }));
 var UNKNOWN_KEY_MESSAGE = "unknown key";
 var emptyBodySchema = external_exports.strictObject({});
 function formatIssues(error62) {
@@ -24046,6 +24103,34 @@ function listQueryOf(filter) {
   return pairs;
 }
 
+// ../core/dist/endpoint.js
+var DEFAULT_ENDPOINT = "https://api.letthemquibble.com";
+var DISCOVERY_PATH = "/.well-known/quibble.json";
+var LOCAL_ENDPOINT = "local";
+var LOOPBACK_HOSTS = ["localhost", "127.0.0.1"];
+function trimSlash(url2) {
+  return url2.replace(/\/+$/, "");
+}
+function normalizeEndpoint(url2) {
+  const text = trimSlash(url2.trim());
+  try {
+    const parsed = new URL(text);
+    return `${parsed.protocol}//${parsed.host}${trimSlash(parsed.pathname)}`;
+  } catch {
+    return text;
+  }
+}
+function isDefaultEndpoint(url2) {
+  return normalizeEndpoint(url2) === DEFAULT_ENDPOINT;
+}
+function isLoopbackUrl(url2) {
+  try {
+    return LOOPBACK_HOSTS.includes(new URL(url2).hostname);
+  } catch {
+    return false;
+  }
+}
+
 // ../core/dist/service.js
 import { createHash, randomUUID } from "node:crypto";
 function applyTagRules(tags, allowedTags) {
@@ -24459,7 +24544,7 @@ function defaultConfigPath(env = process.env) {
 }
 
 // src/config.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, isAbsolute, join as join3, relative, resolve, sep } from "node:path";
 
 // src/credentials.ts
@@ -24473,6 +24558,92 @@ import {
   writeFileSync
 } from "node:fs";
 import { dirname as dirname2, join as join2 } from "node:path";
+var CREDENTIALS_FILENAME = "credentials.json";
+var CREDENTIALS_MODE = 384;
+var HOME_MODE = 448;
+function defaultCredentialsPath(env) {
+  return join2(defaultQuibbleHome(env), CREDENTIALS_FILENAME);
+}
+function readEntry(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return void 0;
+  }
+  const raw = value;
+  const keys = ["endpoint", "refreshToken", "accessToken", "expiresAt", "sub", "email"];
+  for (const key of keys) {
+    if (typeof raw[key] !== "string" || raw[key] === "") return void 0;
+  }
+  return {
+    endpoint: raw["endpoint"],
+    refreshToken: raw["refreshToken"],
+    accessToken: raw["accessToken"],
+    expiresAt: raw["expiresAt"],
+    sub: raw["sub"],
+    email: raw["email"]
+  };
+}
+function readCredentials(env) {
+  const path = defaultCredentialsPath(env);
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return {};
+    throw new ConfigError(`cannot read ${path}`, path, { cause: error62 });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error62) {
+    throw new ConfigError(`invalid JSON in ${path}`, path, { cause: error62 });
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ConfigError(`invalid credentials in ${path}: must be a JSON object`, path);
+  }
+  const entries = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    const entry = readEntry(value);
+    if (entry !== void 0) entries[key] = entry;
+  }
+  return entries;
+}
+function findCredential(env, endpoint) {
+  return readCredentials(env)[normalizeEndpoint(endpoint)];
+}
+function writeCredentials(env, entries) {
+  const path = defaultCredentialsPath(env);
+  mkdirSync(dirname2(path), { recursive: true, mode: HOME_MODE });
+  const temp = join2(
+    dirname2(path),
+    `.${CREDENTIALS_FILENAME}.${randomBytes(6).toString("hex")}`
+  );
+  try {
+    writeFileSync(temp, `${JSON.stringify(entries, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: CREDENTIALS_MODE
+    });
+    chmodSync(temp, CREDENTIALS_MODE);
+    renameSync(temp, path);
+  } catch (error62) {
+    rmSync(temp, { force: true });
+    throw error62;
+  }
+}
+function saveCredential(env, credential) {
+  const key = normalizeEndpoint(credential.endpoint);
+  const stored = { ...credential, endpoint: key };
+  writeCredentials(env, { ...readCredentials(env), [key]: stored });
+  return stored;
+}
+function removeCredential(env, endpoint) {
+  const entries = readCredentials(env);
+  const key = normalizeEndpoint(endpoint);
+  if (entries[key] === void 0) return false;
+  delete entries[key];
+  writeCredentials(env, entries);
+  return true;
+}
 
 // src/errors.ts
 var AMBIGUOUS_ID = "ambiguous_id";
@@ -24525,7 +24696,7 @@ var DEBUG_ENV = "QUIBBLE_DEBUG";
 function debugEnabled(env) {
   return env[DEBUG_ENV] === "1";
 }
-function trimSlash(url2) {
+function trimSlash2(url2) {
   return url2.replace(/\/+$/, "");
 }
 function originOf(url2) {
@@ -24629,103 +24800,6 @@ function remoteFailure(site, response, text) {
   });
 }
 
-// src/credentials.ts
-var CREDENTIALS_FILENAME = "credentials.json";
-var CREDENTIALS_MODE = 384;
-var HOME_MODE = 448;
-function defaultCredentialsPath(env) {
-  return join2(defaultQuibbleHome(env), CREDENTIALS_FILENAME);
-}
-function normalizeEndpoint(endpoint) {
-  const text = trimSlash(endpoint.trim());
-  try {
-    const url2 = new URL(text);
-    return `${url2.protocol}//${url2.host}${trimSlash(url2.pathname)}`;
-  } catch {
-    return text;
-  }
-}
-function readEntry(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return void 0;
-  }
-  const raw = value;
-  const keys = ["endpoint", "refreshToken", "accessToken", "expiresAt", "sub", "email"];
-  for (const key of keys) {
-    if (typeof raw[key] !== "string" || raw[key] === "") return void 0;
-  }
-  return {
-    endpoint: raw["endpoint"],
-    refreshToken: raw["refreshToken"],
-    accessToken: raw["accessToken"],
-    expiresAt: raw["expiresAt"],
-    sub: raw["sub"],
-    email: raw["email"]
-  };
-}
-function readCredentials(env) {
-  const path = defaultCredentialsPath(env);
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch (error62) {
-    if (isNotFound(error62)) return {};
-    throw new ConfigError(`cannot read ${path}`, path, { cause: error62 });
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (error62) {
-    throw new ConfigError(`invalid JSON in ${path}`, path, { cause: error62 });
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new ConfigError(`invalid credentials in ${path}: must be a JSON object`, path);
-  }
-  const entries = {};
-  for (const [key, value] of Object.entries(parsed)) {
-    const entry = readEntry(value);
-    if (entry !== void 0) entries[key] = entry;
-  }
-  return entries;
-}
-function findCredential(env, endpoint) {
-  return readCredentials(env)[normalizeEndpoint(endpoint)];
-}
-function writeCredentials(env, entries) {
-  const path = defaultCredentialsPath(env);
-  mkdirSync(dirname2(path), { recursive: true, mode: HOME_MODE });
-  const temp = join2(
-    dirname2(path),
-    `.${CREDENTIALS_FILENAME}.${randomBytes(6).toString("hex")}`
-  );
-  try {
-    writeFileSync(temp, `${JSON.stringify(entries, null, 2)}
-`, {
-      encoding: "utf8",
-      mode: CREDENTIALS_MODE
-    });
-    chmodSync(temp, CREDENTIALS_MODE);
-    renameSync(temp, path);
-  } catch (error62) {
-    rmSync(temp, { force: true });
-    throw error62;
-  }
-}
-function saveCredential(env, credential) {
-  const key = normalizeEndpoint(credential.endpoint);
-  const stored = { ...credential, endpoint: key };
-  writeCredentials(env, { ...readCredentials(env), [key]: stored });
-  return stored;
-}
-function removeCredential(env, endpoint) {
-  const entries = readCredentials(env);
-  const key = normalizeEndpoint(endpoint);
-  if (entries[key] === void 0) return false;
-  delete entries[key];
-  writeCredentials(env, entries);
-  return true;
-}
-
 // src/cognito.ts
 var TARGET_PREFIX = "AWSCognitoIdentityProviderService.";
 var CONTENT_TYPE = "application/x-amz-json-1.1";
@@ -24736,6 +24810,7 @@ var TOO_MANY_LINE = "Too many attempts. Try again later.";
 var WRONG_CODE_LINE = "Wrong code.";
 var EXPIRED_CODE_LINE = "That code has expired. Request a new one.";
 var PASSWORD_POLICY_LINE = "Use at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.";
+var BROWSER_REFUSED_LINE = "the browser approval could not be used: run quibble login again";
 var UNREACHABLE_TYPE = "Unreachable";
 var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
 var CognitoError = class extends RemoteError {
@@ -24752,14 +24827,15 @@ var CognitoError = class extends RemoteError {
 function endpointUrl(region) {
   return `https://cognito-idp.${region}.amazonaws.com/`;
 }
-function errorLineOf(type, detail2, signIn2) {
+function errorLineOf(type, detail2, step) {
   switch (type) {
     case UNREACHABLE_TYPE:
       return UNREACHABLE_LINE;
     case "UserNotFoundException":
-      return signIn2 ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      return step === "sign-in" ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "NotAuthorizedException":
-      return signIn2 && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      if (step === "browser") return BROWSER_REFUSED_LINE;
+      return step === "sign-in" && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "LimitExceededException":
     case "TooManyRequestsException":
     case "TooManyFailedAttemptsException":
@@ -24780,7 +24856,7 @@ function typeOf(value) {
   const hash2 = value.indexOf("#");
   return hash2 === -1 ? value : value.slice(hash2 + 1);
 }
-async function call(endpoint, operation, body, signIn2 = false) {
+async function call(endpoint, operation, body, step = "other") {
   const url2 = endpointUrl(endpoint.region);
   const send2 = endpoint.fetch ?? globalThis.fetch;
   const site = {
@@ -24792,7 +24868,7 @@ async function call(endpoint, operation, body, signIn2 = false) {
     throw new CognitoError(
       type,
       detail2,
-      errorLineOf(type, detail2, signIn2),
+      errorLineOf(type, detail2, step),
       detail(site, status)
     );
   };
@@ -24875,14 +24951,27 @@ function authAnswerOf(body) {
     }
   };
 }
+function flowOf(input2) {
+  switch (input2.flow) {
+    case "USER_PASSWORD_AUTH":
+      return {
+        parameters: { USERNAME: input2.username, PASSWORD: input2.password },
+        step: "sign-in"
+      };
+    case "REFRESH_TOKEN_AUTH":
+      return { parameters: { REFRESH_TOKEN: input2.refreshToken }, step: "other" };
+    case "CUSTOM_AUTH":
+      return { parameters: { USERNAME: input2.username }, step: "browser" };
+  }
+}
 async function initiateAuth(endpoint, input2) {
-  const parameters = input2.flow === "USER_PASSWORD_AUTH" ? { USERNAME: input2.username, PASSWORD: input2.password } : { REFRESH_TOKEN: input2.refreshToken };
+  const { parameters, step } = flowOf(input2);
   return authAnswerOf(
     await call(
       endpoint,
       "InitiateAuth",
       { ClientId: input2.clientId, AuthFlow: input2.flow, AuthParameters: parameters },
-      input2.flow === "USER_PASSWORD_AUTH"
+      step
     )
   );
 }
@@ -24897,6 +24986,22 @@ async function respondToAuthChallenge(endpoint, input2) {
     })
   );
 }
+async function respondToCustomChallenge(endpoint, input2) {
+  const username = input2.challenge.challengeParameters["USERNAME"] ?? input2.username;
+  return authAnswerOf(
+    await call(
+      endpoint,
+      "RespondToAuthChallenge",
+      {
+        ClientId: input2.clientId,
+        ChallengeName: input2.challenge.challengeName,
+        Session: input2.challenge.session,
+        ChallengeResponses: { USERNAME: username, ANSWER: input2.answer }
+      },
+      "browser"
+    )
+  );
+}
 async function revokeToken(endpoint, input2) {
   await call(endpoint, "RevokeToken", { ClientId: input2.clientId, Token: input2.token });
 }
@@ -24925,9 +25030,8 @@ function actAsRefused(sub, endpoint) {
 function clockOf(options) {
   return options.now ?? (() => /* @__PURE__ */ new Date());
 }
-var LOCAL_HOSTS = ["localhost", "127.0.0.1"];
 async function fetchAuthConfig(endpoint, options = {}) {
-  const url2 = `${trimSlash(endpoint)}${AUTH_CONFIG_PATH}`;
+  const url2 = `${trimSlash2(endpoint)}${AUTH_CONFIG_PATH}`;
   const site = { method: "GET", url: url2, debug: options.debug };
   const response = await send(url2, { method: "GET", ...options });
   const text = await readText(response, site);
@@ -24956,13 +25060,6 @@ function bearerAuthorizer(token) {
   };
 }
 var DEV_TOKEN = "dev";
-function isLoopback(endpoint) {
-  try {
-    return LOCAL_HOSTS.includes(new URL(endpoint).hostname);
-  } catch {
-    return false;
-  }
-}
 var DevAuthorizer = class {
   actAs;
   #endpoint;
@@ -25067,12 +25164,97 @@ function createAuthorizer(endpoint, options) {
   return new SessionAuthorizer(endpoint, options);
 }
 
+// src/endpoint.ts
+var DISCOVERY_TIMEOUT_MS = 5e3;
+var SCHEMES = ["http:", "https:"];
+function parseEndpoint(value, from) {
+  const text = value.trim();
+  if (text.toLowerCase() === LOCAL_ENDPOINT) return { kind: "local" };
+  const invalid = new ConfigError(
+    `invalid endpoint "${text}" from ${from}: pass an https URL, a host, or local`
+  );
+  let url2 = text;
+  if (!text.includes("://")) {
+    url2 = isLoopbackUrl(`http://${text}`) ? `http://${text}` : `https://${text}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    throw invalid;
+  }
+  if (!SCHEMES.includes(parsed.protocol) || parsed.hostname === "") throw invalid;
+  return { kind: "url", url: normalizeEndpoint(url2) };
+}
+var discoveries = /* @__PURE__ */ new Map();
+function resetDiscovery() {
+  discoveries.clear();
+}
+function discoverApiUrl(url2, options = {}) {
+  const key = normalizeEndpoint(url2);
+  if (isDefaultEndpoint(key)) return Promise.resolve(DEFAULT_ENDPOINT);
+  const known = discoveries.get(key);
+  if (known !== void 0) return known;
+  const found = lookup(key, options).then((api) => {
+    if (!discoveries.has(api)) discoveries.set(api, Promise.resolve(api));
+    return api;
+  });
+  discoveries.set(key, found);
+  return found;
+}
+async function lookup(url2, options) {
+  const target = `${url2}${DISCOVERY_PATH}`;
+  try {
+    const response = await send(target, {
+      method: "GET",
+      headers: { accept: "application/json" },
+      fetch: options.fetch,
+      debug: options.debug,
+      timeoutMs: options.timeoutMs ?? DISCOVERY_TIMEOUT_MS
+    });
+    const text = await readText(response, { method: "GET", url: target });
+    if (!response.ok) return url2;
+    const api = stringOf(asRecord(parseQuietly(text)), "api");
+    if (api === void 0) return url2;
+    const parsed = new URL(api.trim());
+    if (!SCHEMES.includes(parsed.protocol)) return url2;
+    return normalizeEndpoint(api);
+  } catch {
+    return url2;
+  }
+}
+
 // src/config.ts
-var NO_ENDPOINT_MESSAGE = "no endpoint: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
 function requireEndpoint(context) {
-  if (context.endpoint === void 0) throw new ConfigError(NO_ENDPOINT_MESSAGE);
+  if (context.endpoint === void 0) {
+    throw new ConfigError(`local mode has no endpoint: ${context.localFix ?? ""}`);
+  }
   return context.endpoint;
 }
+async function resolveEndpoint(context, io) {
+  const endpoint = requireEndpoint(context);
+  if (context.discovered) return endpoint;
+  const api = await discoverApiUrl(endpoint, {
+    fetch: io.fetch,
+    debug: context.debug,
+    timeoutMs: context.timeoutMs
+  });
+  context.endpoint = api;
+  context.credential = findCredential(io.env, api);
+  context.discovered = true;
+  return api;
+}
+function foreignOrgMessage(context) {
+  const slug = context.slug;
+  if (context.mode !== "local" || slug === void 0 || slug === LOCAL_ORG) {
+    return void 0;
+  }
+  return `local mode holds the organization ${LOCAL_ORG} only, not ${slug}: ${context.localFix ?? ""} to file to ${slug} on a server, or pass --org ${LOCAL_ORG}`;
+}
+function refuseForeignOrg(context) {
+  const message = foreignOrgMessage(context);
+  if (message !== void 0) throw new ConfigError(message);
+}
 var NO_ORG_MESSAGE = "no organization: pass --org <slug> or run `quibble init --org <slug>`";
 function requireOrg(context) {
   if (context.org === void 0) throw new ConfigError(NO_ORG_MESSAGE);
@@ -25196,20 +25378,76 @@ function firstValue(...values) {
   }
   return void 0;
 }
-function resolveContext(options) {
-  const project = findProjectConfig(options.cwd);
-  const user = loadUserConfig(options.env);
-  const endpoint = firstValue(
-    options.endpoint,
-    options.env["QUIBBLE_ENDPOINT"],
-    project?.endpoint,
-    user.endpoint
+function localFixOf(candidate) {
+  switch (candidate.source) {
+    case "--endpoint":
+      return "drop --endpoint local";
+    case "QUIBBLE_ENDPOINT":
+      return "unset QUIBBLE_ENDPOINT";
+    default:
+      return `remove "endpoint": "local" from ${candidate.path ?? ""}`;
+  }
+}
+function resolveEndpointSource(options, project, user) {
+  if (options.local === true) {
+    return {
+      mode: "local",
+      endpoint: void 0,
+      endpointSource: "--local",
+      localFix: "drop --local"
+    };
+  }
+  const candidates2 = [
+    { source: "--endpoint", value: options.endpoint },
+    { source: "QUIBBLE_ENDPOINT", value: options.env["QUIBBLE_ENDPOINT"] },
+    { source: ".quibblerc", value: project?.endpoint, path: project?.path },
+    {
+      source: "config.json",
+      value: user.endpoint,
+      path: defaultConfigPath(options.env)
+    }
+  ];
+  const chosen = candidates2.find(
+    (candidate) => candidate.value !== void 0 && candidate.value.trim() !== ""
   );
-  const name = firstValue(options.project, project?.project);
-  const given = firstValue(options.org, project?.org);
-  const slug = given === void 0 ? void 0 : parseOrgSlug(given);
+  if (chosen === void 0) {
+    return {
+      mode: "remote",
+      endpoint: DEFAULT_ENDPOINT,
+      endpointSource: "default",
+      localFix: void 0
+    };
+  }
+  const value = parseEndpoint(chosen.value ?? "", chosen.path ?? chosen.source);
+  if (value.kind === "local") {
+    return {
+      mode: "local",
+      endpoint: void 0,
+      endpointSource: chosen.source,
+      localFix: localFixOf(chosen)
+    };
+  }
+  return {
+    mode: "remote",
+    endpoint: value.url,
+    endpointSource: chosen.source,
+    localFix: void 0
+  };
+}
+function resolveContext(options) {
+  const project = findProjectConfig(options.cwd);
+  const user = loadUserConfig(options.env);
+  const { mode, endpoint, endpointSource, localFix } = resolveEndpointSource(
+    options,
+    project,
+    user
+  );
+  const given = firstValue(options.project, project?.project);
+  const name = given === void 0 ? void 0 : foldProjectName(given);
+  const org = firstValue(options.org, project?.org);
+  const slug = org === void 0 ? void 0 : parseOrgSlug(org);
   const token = firstValue(options.env[TOKEN_ENV]);
-  const mode = options.local === true || endpoint === void 0 ? "local" : "remote";
+  const discovered = endpoint !== void 0 && isDefaultEndpoint(endpoint);
   return {
     project: name,
     org: mode === "local" ? LOCAL_ORG : slug,
@@ -25219,10 +25457,12 @@ function resolveContext(options) {
     cwd: project === void 0 ? void 0 : relativeCwd(project.root, options.cwd),
     mode,
     endpoint,
+    endpointSource,
+    localFix,
+    discovered,
+    timeoutMs: void 0,
     token,
-    // `quibble config` diagnoses a missing session, so the entry is read here
-    // and no command has to read the file to describe the session.
-    credential: endpoint === void 0 ? void 0 : findCredential(options.env, endpoint),
+    credential: discovered && endpoint !== void 0 ? findCredential(options.env, endpoint) : void 0,
     actAs: firstValue(options.env[ACT_AS_ENV]),
     debug: debugEnabled(options.env),
     agent: firstValue(options.agent, user.agent) ?? DEFAULT_AGENT,
@@ -25235,6 +25475,15 @@ function resolveContext(options) {
     projectConfig: project
   };
 }
+function rememberEndpoint(env, endpoint) {
+  const path = defaultConfigPath(env);
+  const raw = readJsonFile(path) ?? {};
+  if (stringField(raw, "endpoint", path) !== void 0) return void 0;
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify({ ...raw, endpoint }, null, 2)}
+`, "utf8");
+  return path;
+}
 
 // src/ids.ts
 var FULL_ID_LENGTH = 36;
@@ -25438,7 +25687,7 @@ var ApiClient = class {
   constructor(options) {
     this.endpoint = options.endpoint;
     this.org = options.org;
-    this.#base = trimSlash(options.endpoint);
+    this.#base = trimSlash2(options.endpoint);
     this.#auth = options.authorizer;
     this.#beforeFirst = options.beforeFirst;
     this.#http = {
@@ -25516,6 +25765,13 @@ var ApiClient = class {
     const retagged = answer2.body["retagged"];
     return { ...answer2, retagged: typeof retagged === "number" ? retagged : 0 };
   }
+  /**
+   * Soft-deletes a project (section 7.5). The route hides it and its
+   * complaints everywhere and revokes its tokens, and answers `204`.
+   */
+  async deleteProject(name) {
+    await this.request("DELETE", this.projectPath(name));
+  }
   /** Lists the tokens of a project, newest first, as the route sorts them. */
   async tokens(project) {
     const body = await this.request("GET", `${this.projectPath(project)}/tokens`);
@@ -25804,7 +26060,7 @@ import {
   closeSync,
   fstatSync,
   linkSync,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   openSync,
   readFileSync as readFileSync3,
   readSync,
@@ -25878,7 +26134,7 @@ function endsInsideLine(path) {
 }
 function appendLine(path, value) {
   try {
-    mkdirSync2(dirname4(path), { recursive: true, mode: HOME_MODE });
+    mkdirSync3(dirname4(path), { recursive: true, mode: HOME_MODE });
     const lead = endsInsideLine(path) ? "\n" : "";
     appendFileSync(path, `${lead}${JSON.stringify(value)}
 `, {
@@ -25996,7 +26252,7 @@ function createLock(lock, owner = { pid: process.pid, host: hostname3(), at: (/*
   const text = JSON.stringify(owner);
   let fd;
   try {
-    mkdirSync2(dirname4(lock), { recursive: true, mode: HOME_MODE });
+    mkdirSync3(dirname4(lock), { recursive: true, mode: HOME_MODE });
     fd = openSync(lock, "wx", QUEUE_MODE);
   } catch (error62) {
     if (error62.code === "EEXIST") return void 0;
@@ -26046,8 +26302,8 @@ function releaseLock(lock, text) {
 }
 function stopReason(status, text) {
   if (status >= 500) return `the API answered ${status}`;
-  const code = serverCode(text);
-  const stops = status === 429 || status === 401 || status === 403 || status === 404 && code === ORG_NOT_FOUND;
+  const code2 = serverCode(text);
+  const stops = status === 429 || status === 401 || status === 403 || status === 404 && code2 === ORG_NOT_FOUND;
   if (!stops) return void 0;
   const message = stringOf(asRecord(asRecord(parseQuietly(text))?.["error"]), "message");
   return message ?? `the API answered ${status}`;
@@ -26117,12 +26373,12 @@ async function flushQueue(options) {
         return result;
       }
       const record2 = asRecord(asRecord(parseQuietly(text))?.["error"]);
-      const code = stringOf(record2, "code") ?? `http_${status}`;
+      const code2 = stringOf(record2, "code") ?? `http_${status}`;
       const message = stringOf(record2, "message") ?? `the API answered ${status}`;
       appendLine(options.path, {
         op: "dropped",
         key: entry.key,
-        code,
+        code: code2,
         message,
         droppedAt: now().toISOString()
       });
@@ -26176,23 +26432,23 @@ function actAsProblem(context) {
   if (context.credential !== void 0) {
     return `you are logged in to ${endpoint}`;
   }
-  if (!isLoopback(endpoint)) return `${endpoint} is not a loopback endpoint`;
+  if (!isLoopbackUrl(endpoint)) return `${endpoint} is not a loopback endpoint`;
   return void 0;
 }
 function checkActAs(context) {
   const problem = actAsProblem(context);
   if (problem !== void 0) throw actAsNotApplicable(problem);
 }
-function openClient(context, io, options = {}) {
+async function openClient(context, io, options = {}) {
+  const endpoint = await resolveEndpoint(context, io);
   checkActAs(context);
-  const endpoint = requireEndpoint(context);
-  const http = { debug: context.debug, fetch: io.fetch };
+  const http = { debug: context.debug, fetch: io.fetch, timeoutMs: context.timeoutMs };
   const org = {
     ...context.org === void 0 ? {} : { org: context.org },
     ...options.queue === false ? {} : { beforeFirst: queueSender(context, endpoint, io) }
   };
   if (context.token === void 0 && context.credential === void 0) {
-    if (!isLoopback(endpoint)) throw notLoggedIn(endpoint);
+    if (!isLoopbackUrl(endpoint)) throw notLoggedIn(endpoint);
     return new ApiClient({
       endpoint,
       authorizer: devAuthorizer(endpoint, context.actAs, http),
@@ -26207,26 +26463,27 @@ function openClient(context, io, options = {}) {
     ...http
   });
 }
-function openOrgClient(context, io) {
-  checkActAs(context);
+async function openOrgClient(context, io, options = {}) {
+  if (context.mode === "local") checkActAs(context);
   requireOrg(context);
-  return openClient(context, io);
+  return openClient(context, io, options);
 }
-function openBackend(context, io) {
+async function openBackend(context, io) {
   if (context.mode === "local") {
     checkActAs(context);
+    refuseForeignOrg(context);
     const local = new FileStore(context.storePath);
     return { store: local, client: void 0, local };
   }
-  const client = openOrgClient(context, io);
+  const client = await openOrgClient(context, io);
   return { store: new RemoteStore(client), client, local: void 0 };
 }
-function openStore(context, io) {
-  return openBackend(context, io).store;
+async function openStore(context, io) {
+  return (await openBackend(context, io)).store;
 }
 function needsServer(command, context) {
   return new ConfigError(
-    context.endpoint === void 0 ? `${command} needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc` : `${command} needs a server: drop --local`
+    `${command} needs a server: ${context.localFix ?? "drop --local"}`
   );
 }
 function requireServer(command, context) {
@@ -26242,7 +26499,7 @@ async function runComplain(message, options, context, io) {
     throw new UsageError(REMOTE_REPORTER_MESSAGE);
   }
   const body = await readMessage(message, io);
-  const store = openStore(context, io);
+  const store = await openStore(context, io);
   const input2 = {
     org,
     project,
@@ -26266,6 +26523,7 @@ async function runComplain(message, options, context, io) {
   }
   if (options.json === true) {
     writeJson(io.stdout, complaint);
+    localNotice(context, io);
     return 0;
   }
   const scope = context.mode === "remote" ? `${complaint.org}/${complaint.project}` : complaint.project;
@@ -26274,8 +26532,16 @@ async function runComplain(message, options, context, io) {
     `Filed complaint ${complaint.id} for ${scope} (${complaint.severity})`
   );
   for (const line of matchLines(complaint)) writeLine(io.stdout, line);
+  localNotice(context, io);
   return 0;
 }
+function localNotice(context, io) {
+  if (context.mode !== "local") return;
+  writeLine(
+    io.stderr,
+    `quibble: local mode: nothing was sent; the complaint is in ${context.storePath}`
+  );
+}
 function matchLines(complaint) {
   const lines = [];
   if (complaint.openMatches === 1) {
@@ -26319,7 +26585,7 @@ function describeCredential(context) {
   if (context.credential !== void 0) {
     return `logged in as ${context.credential.email}`;
   }
-  if (context.endpoint !== void 0 && isLoopback(context.endpoint)) {
+  if (context.endpoint !== void 0 && isLoopbackUrl(context.endpoint)) {
     return "loopback dev token";
   }
   return "not logged in";
@@ -26331,14 +26597,18 @@ function describeAuth(context) {
   if (problem === void 0) return `${credential}, acting as ${context.actAs}`;
   return `${credential}; ${ACT_AS_ENV} does not apply: ${problem}`;
 }
-function runConfig(options, context, io) {
+async function runConfig(options, context, io) {
+  if (context.mode === "remote") await resolveEndpoint(context, io);
+  const ignored = foreignOrgMessage(context) === void 0 ? void 0 : context.slug;
   const report = {
     project: context.project ?? "none",
     org: context.org ?? null,
+    orgIgnored: ignored ?? null,
     projectRoot: context.projectRoot ?? null,
     configPath: context.configPath ?? null,
     mode: context.mode,
-    endpoint: context.endpoint ?? null,
+    endpoint: context.endpoint ?? "local",
+    endpointSource: context.endpointSource,
     storePath: context.storePath,
     agent: context.agent,
     reporter: context.reporter,
@@ -26351,16 +26621,84 @@ function runConfig(options, context, io) {
     writeJson(io.stdout, report);
     return 0;
   }
-  const width = Math.max(...Object.keys(report).map((key) => key.length));
-  for (const [key, value] of Object.entries(report)) {
-    writeLine(io.stdout, `${key.padEnd(width)}  ${value ?? "none"}`);
+  const { orgIgnored, ...lines } = report;
+  const text = { ...lines };
+  if (orgIgnored !== null) {
+    text["org"] = `${report.org ?? ""}; ${orgIgnored} does not apply: ${context.localFix ?? ""}`;
+  }
+  const width = Math.max(...Object.keys(text).map((key) => key.length));
+  for (const [key, value] of Object.entries(text)) {
+    writeLine(io.stdout, `${key.padEnd(width)}  ${String(value ?? "none")}`);
   }
   return 0;
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename2, join as join6, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { basename as basename2, join as join7, resolve as resolve3 } from "node:path";
+
+// src/hook.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join5 } from "node:path";
+var SETTINGS_PATH = ".claude/settings.json";
+var HOOK_COMMAND = "command -v quibble >/dev/null 2>&1 && quibble sync --quiet || true";
+var HOOK_MARK = "quibble sync --quiet";
+function hookEntry() {
+  return {
+    matcher: "startup",
+    hooks: [{ type: "command", command: HOOK_COMMAND }]
+  };
+}
+function isObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function runsSync(entry) {
+  if (!isObject2(entry) || !Array.isArray(entry["hooks"])) return false;
+  return entry["hooks"].some(
+    (hook) => isObject2(hook) && typeof hook["command"] === "string" && hook["command"].includes(HOOK_MARK)
+  );
+}
+function planHook(root) {
+  const path = join5(root, SETTINGS_PATH);
+  let text;
+  try {
+    text = readFileSync4(path, "utf8");
+  } catch (error62) {
+    if (!isNotFound(error62)) throw error62;
+    const created = { hooks: { SessionStart: [hookEntry()] } };
+    return { path, text: `${JSON.stringify(created, null, 2)}
+` };
+  }
+  const invalid = new UsageError(
+    `${path} is not valid JSON: fix it, then run the command again`
+  );
+  let settings;
+  try {
+    settings = JSON.parse(text);
+  } catch {
+    throw invalid;
+  }
+  if (!isObject2(settings)) throw invalid;
+  const hooks = settings["hooks"] === void 0 ? {} : settings["hooks"];
+  if (!isObject2(hooks)) throw new UsageError(`${path}: hooks must be an object`);
+  const start = hooks["SessionStart"] === void 0 ? [] : hooks["SessionStart"];
+  if (!Array.isArray(start)) {
+    throw new UsageError(`${path}: hooks.SessionStart must be an array`);
+  }
+  if (start.some(runsSync)) return { path, text: void 0 };
+  const merged = {
+    ...settings,
+    hooks: { ...hooks, SessionStart: [...start, hookEntry()] }
+  };
+  return { path, text: `${JSON.stringify(merged, null, 2)}
+` };
+}
+function applyHook(plan) {
+  if (plan.text === void 0) return `${plan.path} already runs quibble sync`;
+  mkdirSync4(dirname5(plan.path), { recursive: true });
+  writeFileSync3(plan.path, plan.text, "utf8");
+  return `Added the quibble sync hook to ${plan.path}`;
+}
 
 // src/snippet.ts
 import { basename } from "node:path";
@@ -26423,57 +26761,131 @@ function agentForFile(path) {
 function hasSnippet(text) {
   return text.split(/\r?\n/).some((line) => line.trimEnd() === SNIPPET_HEADING);
 }
+function splitLines(text) {
+  const lines = [];
+  const pattern = /([^\r\n]*)(\r\n|\n|\r)?/g;
+  let match;
+  while ((match = pattern.exec(text)) !== null) {
+    const [whole, content = "", eol = ""] = match;
+    if (whole === "") break;
+    lines.push({ text: content, eol });
+  }
+  return lines;
+}
+function fenceOf(text) {
+  if (text.startsWith("```")) return "```";
+  if (text.startsWith("~~~")) return "~~~";
+  return void 0;
+}
+function endsSection(text) {
+  return text.startsWith("# ") || text.startsWith("## ");
+}
+function agentOfText(lines) {
+  const line = lines.find(
+    (text) => text.includes("quibble complain") && text.includes("--agent")
+  );
+  if (line === void 0) return void 0;
+  return /--agent\s+(\S+)/.exec(line)?.[1];
+}
+function findSection(text) {
+  const lines = splitLines(text);
+  const start = lines.findIndex((line) => line.text.trimEnd() === SNIPPET_HEADING);
+  if (start < 0) return void 0;
+  let next = lines.length;
+  let fence;
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const content = lines[index]?.text ?? "";
+    if (fence !== void 0) {
+      if (content.startsWith(fence)) fence = void 0;
+      continue;
+    }
+    fence = fenceOf(content);
+    if (fence === void 0 && endsSection(content)) {
+      next = index;
+      break;
+    }
+  }
+  let end = next;
+  while (end > start + 1 && (lines[end - 1]?.text.trim() ?? "") === "") end -= 1;
+  const eol = lines[start]?.eol || "\n";
+  return { lines, start, end, eol: eol === "\r\n" ? "\r\n" : "\n" };
+}
+function sectionText(section) {
+  return section.lines.slice(section.start, section.end).map((line) => line.text);
+}
+function replaceSection(section, snippet) {
+  const join9 = (lines) => lines.map((line) => `${line.text}${line.eol}`).join("");
+  const body = snippet.split("\n").map((line) => `${line}${section.eol}`).join("");
+  return `${join9(section.lines.slice(0, section.start))}${body}${join9(section.lines.slice(section.end))}`;
+}
+function withLineBreak(text, old) {
+  return old.includes("\r\n") ? text.replace(/\r?\n/g, "\r\n") : text;
+}
+function orList(items) {
+  if (items.length <= 1) return items.join("");
+  return `${items.slice(0, -1).join(", ")} or ${items.at(-1) ?? ""}`;
+}
+function refreshedLine(project, tags) {
+  const lead = `Quibble refreshed its instructions for ${project}:`;
+  if (tags === void 0 || tags.length === 0) return `${lead} any tag is allowed.`;
+  return `${lead} tag each complaint with ${orList(tags)}, or ${OTHER_TAG_PREFIX}<name> when none fits.`;
+}
 
 // src/commands/snippet.ts
-import { existsSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, join as join5, resolve as resolve2 } from "node:path";
+import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
 function existsError(path) {
   return new UsageError(`${path} already exists: pass --force to overwrite it`);
 }
 function readOptional2(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch (error62) {
     if (isNotFound(error62)) return "";
     throw error62;
   }
 }
 function writeSkill(path, snippet) {
-  mkdirSync3(dirname5(path), { recursive: true });
-  writeFileSync2(path, skillFile(snippet), "utf8");
+  mkdirSync5(dirname6(path), { recursive: true });
+  writeFileSync4(path, skillFile(snippet), "utf8");
+}
+async function snippetSource(project, context, io, options = {}) {
+  let tags;
+  if (context.mode === "remote") {
+    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
+  } else {
+    checkActAs(context);
+    tags = context.allowedTags;
+  }
+  const scope = {
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...context.slug === void 0 ? {} : { org: context.slug }
+  };
+  return { tags, scope };
 }
 async function runSnippet(options, context, io) {
   const project = requireProject(context);
   const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
   const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
-  const skillPath = options.skill === true ? join5(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
+  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
   const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
   if (options.append !== void 0 && hasSnippet(existing)) {
     throw new UsageError(
-      `${options.append} already has a "${SNIPPET_HEADING}" section: edit it by hand`
+      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
     );
   }
   if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
     throw existsError(skillPath);
   }
-  let tags;
-  if (context.mode === "remote") {
-    tags = (await openOrgClient(context, io).project(project)).tags;
-  } else {
-    checkActAs(context);
-    tags = context.allowedTags;
-  }
-  const scope = {
-    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
-    ...context.slug === void 0 ? {} : { org: context.slug }
-  };
+  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
+  const { tags, scope } = await snippetSource(project, context, io);
   let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
   shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
   if (appendPath !== void 0) {
     const agent = override ?? agentForFile(appendPath);
     const snippet = agentSnippet(tags, { ...scope, agent });
     const kept = existing.replace(/\s+$/, "");
-    writeFileSync2(appendPath, kept === "" ? `${snippet}
+    writeFileSync4(appendPath, kept === "" ? `${snippet}
 ` : `${kept}
 
 ${snippet}
@@ -26486,23 +26898,25 @@ ${snippet}
     writeSkill(skillPath, snippet);
     if (appendPath === void 0) shown = { agent, snippet };
   }
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
   if (options.json === true) {
     writeJson(io.stdout, {
       snippet: shown.snippet,
       agent: shown.agent,
       appended: appendPath ?? null,
-      skill: skillPath ?? null
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null
     });
     return 0;
   }
   if (appendPath === void 0 && skillPath === void 0) {
     writeLine(io.stdout, shown.snippet);
-    return 0;
   }
   if (appendPath !== void 0) {
     writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
   }
   if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
   return 0;
 }
 
@@ -26513,34 +26927,47 @@ function agentLead(agent) {
 }
 async function runInit(options, io) {
   const directory = resolve3(io.cwd);
-  const path = join6(directory, PROJECT_CONFIG_FILENAME);
+  const path = join7(directory, PROJECT_CONFIG_FILENAME);
   if (existsSync2(path) && options.force !== true) {
     throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
   }
-  const skillPath = options.skill === true ? join6(directory, SKILL_PATH) : void 0;
+  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
   if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
     throw existsError(skillPath);
   }
   const project = resolveProjectName(options.project, directory);
   const org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
-  const endpoint = options.endpoint?.trim();
   const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
   const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
+  const hook = options.hook === true ? planHook(directory) : void 0;
+  const endpoint = await endpointToWrite(options.endpoint, io);
   const config2 = {
     project,
     ...org === void 0 ? {} : { org },
-    ...endpoint === void 0 || endpoint === "" ? {} : { endpoint },
+    ...endpoint === void 0 ? {} : { endpoint },
     ...tags === void 0 ? {} : { tags }
   };
-  writeFileSync3(path, `${JSON.stringify(config2, null, 2)}
+  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
+  const context = {
+    ...resolveContext({
+      cwd: io.cwd,
+      env: io.env,
+      endpoint: options.endpoint,
+      org: options.org,
+      local: options.local
+    }),
+    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
+    actAs: void 0
+  };
   const snippet = agentSnippet(tags, {
     agent,
-    ...endpoint === void 0 ? {} : { endpoint },
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
     ...org === void 0 ? {} : { org }
   });
   if (skillPath !== void 0) writeSkill(skillPath, snippet);
-  const check2 = await checkServer(options, project, io);
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  const check2 = await checkServer(context, project, io);
   if (options.json === true) {
     writeJson(io.stdout, {
       path,
@@ -26548,12 +26975,14 @@ async function runInit(options, io) {
       org: org ?? null,
       tags: tags ?? null,
       skill: skillPath ?? null,
+      hook: hook?.path ?? null,
       server: check2.server
     });
     return 0;
   }
   writeLine(io.stdout, `Wrote ${path}`);
   if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
   writeLine(io.stdout, `Project: ${project}`);
   if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
   if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
@@ -26571,26 +27000,28 @@ async function runInit(options, io) {
   }
   return 0;
 }
-async function checkServer(options, project, io) {
-  const context = {
-    ...resolveContext({
-      cwd: io.cwd,
-      env: io.env,
-      endpoint: options.endpoint,
-      org: options.org,
-      local: options.local
-    }),
-    actAs: void 0
-  };
-  const { endpoint, org } = context;
-  if (context.mode !== "remote" || endpoint === void 0 || org === void 0 || context.token === void 0 && context.credential === void 0 && !isLoopback(endpoint)) {
+async function endpointToWrite(given, io) {
+  if (given === void 0 || given.trim() === "") return void 0;
+  const value = parseEndpoint(given, "--endpoint");
+  if (value.kind === "local") return LOCAL_ENDPOINT;
+  const api = await discoverApiUrl(value.url, {
+    fetch: io.fetch,
+    debug: debugEnabled(io.env)
+  });
+  return isDefaultEndpoint(api) ? void 0 : api;
+}
+async function checkServer(context, project, io) {
+  const org = context.org;
+  if (context.mode !== "remote" || org === void 0) return { server: "unchecked" };
+  const endpoint = await resolveEndpoint(context, io);
+  if (context.token === void 0 && context.credential === void 0 && !isLoopbackUrl(endpoint)) {
     return { server: "unchecked" };
   }
   const warn = (text) => {
     writeLine(io.stderr, `quibble: warning: ${text}`);
   };
   try {
-    await openClient(context, io, { queue: false }).project(project);
+    await (await openClient(context, io, { queue: false })).project(project);
     return { server: "found", line: `Project ${org}/${project} exists on ${endpoint}.` };
   } catch (error62) {
     if (error62 instanceof RemoteError && error62.status === 404) {
@@ -26742,12 +27173,12 @@ var REPORTER_WIDTH = 20;
 var TAGS_WIDTH = 24;
 var SUMMARY_MAX = 60;
 var RECURRED_MARK = "\u21BB";
-function cut2(text, width) {
+function cut3(text, width) {
   if (text.length <= width) return text;
   return `${text.slice(0, width - 3)}...`;
 }
 function summaryOf(complaint) {
-  return cut2(printable(summarize(complaint.message)), SUMMARY_MAX);
+  return cut3(printable(summarize(complaint.message)), SUMMARY_MAX);
 }
 function limitNote(count, limit, more) {
   if (limit >= MAX_LIMIT) {
@@ -26760,7 +27191,7 @@ async function runList(options, context, io) {
   if (options.ids === true && options.json === true) {
     throw new UsageError("--ids and --json cannot be used together");
   }
-  const { store, client } = openBackend(context, io);
+  const { store, client } = await openBackend(context, io);
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
@@ -26801,7 +27232,7 @@ async function runList(options, context, io) {
   return 0;
 }
 function reporterOf(complaint) {
-  return cut2(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+  return cut3(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
 }
 function groupCell(group) {
   const count = group.count > 1 ? `\xD7${group.count}` : "";
@@ -26818,7 +27249,7 @@ function formatTable(rows2) {
       status: complaint.status,
       project: complaint.project,
       reporter: reporterOf(complaint),
-      tags: cut2(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      tags: cut3(printable(complaint.tags.join(",")), TAGS_WIDTH),
       group: group === void 0 ? "" : groupCell(group),
       summary: summaryOf(complaint)
     };
@@ -26835,13 +27266,13 @@ function formatTable(rows2) {
 }
 
 // src/commands/orgs.ts
-var ORGS_NEEDS_SERVER = "orgs needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
 var ORGS_PAGE = "/orgs";
 var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
 async function runOrgs(options, context, io) {
-  if (context.mode !== "remote") throw new ConfigError(ORGS_NEEDS_SERVER);
+  requireServer("orgs", context);
+  const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const answer2 = await openClient(context, io).orgs();
+  const answer2 = await client.orgs();
   if (options.json === true) {
     writeJson(io.stdout, answer2.body);
     return 0;
@@ -26849,9 +27280,10 @@ async function runOrgs(options, context, io) {
   if (answer2.orgs.length === 0) {
     const config2 = await fetchAuthConfig(endpoint, {
       debug: context.debug,
-      fetch: io.fetch
+      fetch: io.fetch,
+      timeoutMs: context.timeoutMs
     });
-    const webUrl = config2.mode === "cognito" ? trimSlash(config2.webUrl) : endpoint;
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
     writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE}.`);
     return 0;
   }
@@ -26874,6 +27306,81 @@ function formatOrgs(orgs) {
   return [format(COLUMNS2), ...rows2.map(format)];
 }
 
+// src/commands/login.ts
+import { hostname as hostname4 } from "node:os";
+
+// src/opener.ts
+import { spawn as nodeSpawn } from "node:child_process";
+var OPEN_TIMEOUT_MS = 5e3;
+var OPENABLE_URL_RE = /^https?:\/\/[A-Za-z0-9.:[\]-]+(?:\/[A-Za-z0-9/?=._~-]*)?$/;
+function isWsl(platform, env) {
+  if (platform !== "linux") return false;
+  const set2 = (name) => (env[name] ?? "") !== "";
+  return set2("WSL_DISTRO_NAME") || set2("WSL_INTEROP");
+}
+function openCommands(url2, platform, env) {
+  if (platform === "darwin") return [{ command: "open", args: [url2] }];
+  if (platform === "win32") {
+    return [{ command: "cmd", args: ["/c", "start", "", url2] }];
+  }
+  if (isWsl(platform, env)) {
+    return [
+      { command: "wslview", args: [url2] },
+      { command: "cmd.exe", args: ["/c", "start", "", url2] }
+    ];
+  }
+  return [{ command: "xdg-open", args: [url2] }];
+}
+function attempt(spawn, entry, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const settle2 = (opened) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(opened);
+    };
+    const timer = setTimeout(() => {
+      settle2(false);
+    }, timeoutMs);
+    timer.unref();
+    let child;
+    try {
+      child = spawn(entry.command, entry.args, {
+        shell: false,
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch {
+      settle2(false);
+      return;
+    }
+    child.on("error", () => {
+      settle2(false);
+    });
+    child.on("exit", (code2) => {
+      settle2(code2 === 0);
+    });
+    child.unref();
+  });
+}
+function platformOpener(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const spawn = options.spawn ?? nodeSpawn;
+  const timeoutMs = options.timeoutMs ?? OPEN_TIMEOUT_MS;
+  return {
+    async open(url2) {
+      if (!OPENABLE_URL_RE.test(url2)) return false;
+      for (const entry of openCommands(url2, platform, env)) {
+        if (await attempt(spawn, entry, timeoutMs)) return true;
+      }
+      return false;
+    }
+  };
+}
+
 // src/terminal.ts
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -26911,19 +27418,19 @@ var NodeTerminal = class {
   #interface() {
     if (this.#rl !== void 0) return this.#rl;
     const output2 = this.#output;
-    const sink = new Writable({
+    const sink2 = new Writable({
       write: (chunk, _encoding, done) => {
         if (!this.#muted) output2.write(chunk);
         done();
       }
     });
-    Object.defineProperties(sink, {
+    Object.defineProperties(sink2, {
       columns: { get: () => output2.columns },
       rows: { get: () => output2.rows }
     });
     const rl = createInterface({
       input: this.#input,
-      output: sink,
+      output: sink2,
       terminal: true,
       // No answer enters the history, so an arrow key recalls no password.
       historySize: 0
@@ -26995,15 +27502,40 @@ function nodeTerminal(input2, output2) {
 
 // src/commands/login.ts
 var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var NEEDS_TERMINAL_MESSAGE = "quibble login --password needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var CI_MESSAGE = "quibble login needs a person to approve it in a browser: in CI, set QUIBBLE_TOKEN instead";
+var NO_BROWSER_MESSAGE = "--no-browser applies to the browser login only";
+var DENIED_MESSAGE = "login was denied in the browser";
+var EXPIRED_MESSAGE = "the login request expired: run quibble login again";
+var MALFORMED_MESSAGE = "the API answered a malformed login request";
+var UNKNOWN_STATUS_MESSAGE = "the API answered an unknown login status";
+var MFA_NEEDS_TERMINAL_MESSAGE = "this account needs a two-factor code: run quibble login in a terminal";
 var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
+var CUSTOM_CHALLENGE = "CUSTOM_CHALLENGE";
 var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
+var CLI_LOGINS_PATH = "/v1/cli-logins";
+var CLI_LOGIN_POLL_PATH = "/v1/cli-logins/poll";
+var MIN_INTERVAL_SECONDS = 1;
+var MAX_INTERVAL_SECONDS = 30;
+var PLAIN_HOST_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::[0-9]+)?$/;
 var LOGIN_PAGE = "/login";
 var ORGS_PAGE2 = "/orgs";
 var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
 function terminalOf(io) {
   return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
 }
+function clockOf2(io) {
+  return io.now ?? (() => /* @__PURE__ */ new Date());
+}
+function sleepOf(io) {
+  return io.sleep ?? ((ms) => new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  }));
+}
+function ciIsSet(env) {
+  const value = (env["CI"] ?? "").trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false";
+}
 async function answer(terminal, label, hidden = false) {
   const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
   const value = hidden ? text : text.trim();
@@ -27011,6 +27543,23 @@ async function answer(terminal, label, hidden = false) {
     throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
   return value;
 }
+function unsupportedStep(name) {
+  return new RemoteError(
+    `this account needs a sign-in step that quibble doesn't support (${name})`
+  );
+}
+function pageError(error62, webUrl) {
+  if (error62 instanceof CognitoError) {
+    const page = `${trimSlash2(webUrl)}${LOGIN_PAGE}`;
+    if (error62.type === "PasswordResetRequiredException") {
+      return new ConfigError(`reset your password at ${page}`);
+    }
+    if (error62.type === "UserNotConfirmedException") {
+      return new ConfigError(`finish your sign-up at ${page}`);
+    }
+  }
+  return error62;
+}
 async function signIn(terminal, identity, config2) {
   const email3 = await answer(terminal, "Email:");
   const password = await answer(terminal, "Password:", true);
@@ -27023,43 +27572,40 @@ async function signIn(terminal, identity, config2) {
       password
     });
     if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
-      const code = await answer(terminal, "Code:");
+      const code2 = await answer(terminal, "Code:");
       result = await respondToAuthChallenge(identity, {
         clientId,
         challenge: result.challenge,
         email: email3,
-        code
+        code: code2
       });
     }
     if (result.kind === "challenge") {
       const name = result.challenge.challengeName;
       if (name === NEW_PASSWORD_CHALLENGE) {
         throw new ConfigError(
-          `finish your first sign-in at ${trimSlash(config2.webUrl)}${LOGIN_PAGE}`
+          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
         );
       }
-      throw new RemoteError(
-        `this account needs a sign-in step that quibble doesn't support (${name})`
-      );
+      throw unsupportedStep(name);
     }
     return result.tokens;
   } catch (error62) {
-    if (error62 instanceof CognitoError) {
-      const page = `${trimSlash(config2.webUrl)}${LOGIN_PAGE}`;
-      if (error62.type === "PasswordResetRequiredException") {
-        throw new ConfigError(`reset your password at ${page}`);
-      }
-      if (error62.type === "UserNotConfirmedException") {
-        throw new ConfigError(`finish your sign-up at ${page}`);
-      }
-    }
-    throw error62;
+    throw pageError(error62, config2.webUrl);
   }
 }
 async function runLogin(options, context, io) {
-  const endpoint = requireEndpoint(context);
+  requireServer("login", context);
+  if (options.password === true) {
+    if (options.browser === false) throw new UsageError(NO_BROWSER_MESSAGE);
+    return passwordLogin(options, context, io);
+  }
+  return browserLogin(options, context, io);
+}
+async function passwordLogin(options, context, io) {
   const terminal = terminalOf(io);
   if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
   const http = { debug: context.debug, fetch: io.fetch };
   const config2 = await fetchAuthConfig(endpoint, http);
   if (config2.mode === "local") {
@@ -27072,15 +27618,203 @@ async function runLogin(options, context, io) {
   } finally {
     terminal.close();
   }
+  return finishLogin(tokens, endpoint, config2, options, context, io);
+}
+async function browserLogin(options, context, io) {
+  if (ciIsSet(io.env)) throw new UsageError(CI_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const http = { debug: context.debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") {
+    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
+    return 0;
+  }
+  const clock = clockOf2(io);
+  const started = await startLogin(endpoint, config2.webUrl, http, {
+    host: cliLoginHost((io.hostname ?? hostname4)()),
+    os: process.platform,
+    version: options.version
+  });
+  const deadline = clock().getTime() + (CLI_LOGIN_TTL_SECONDS + started.interval) * 1e3;
+  writeLine(
+    io.stderr,
+    `Approve this login in your browser: ${started.url} (code ${started.code}). Waiting...`
+  );
+  if (options.browser !== false) {
+    const opener = io.opener ?? platformOpener({ env: io.env });
+    void opener.open(started.url).catch(() => false);
+  }
+  const approval = await waitForApproval(endpoint, started, deadline, http, io);
+  const tokens = await browserSignIn(
+    { region: config2.region, ...http },
+    config2,
+    approval,
+    io
+  );
+  return finishLogin(tokens, endpoint, config2, options, context, io);
+}
+function postJson(url2, body, http) {
+  return send(url2, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    ...http
+  });
+}
+async function startLogin(endpoint, webUrl, http, body) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGINS_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  const response = await postJson(url2, body, http);
+  const text = await readText(response, site);
+  if (response.status === 404) {
+    throw new RemoteError(
+      `${endpoint} does not support the browser login: run quibble login --password${detail(site, 404)}`,
+      { status: 404 }
+    );
+  }
+  if (!response.ok) throw remoteFailure(site, response, text);
+  const started = checkStart(asRecord(parseQuietly(text)), webUrl);
+  if (started === void 0) {
+    throw new RemoteError(`${MALFORMED_MESSAGE}${detail(site, response.status)}`);
+  }
+  return started;
+}
+function checkStart(body, webUrl) {
+  const loginKey = body?.["loginKey"];
+  const code2 = body?.["code"];
+  const url2 = body?.["url"];
+  if (typeof loginKey !== "string" || !CLI_LOGIN_KEY_RE.test(loginKey)) return void 0;
+  if (typeof code2 !== "string" || typeof url2 !== "string") return void 0;
+  try {
+    if (parseCliLoginCode(code2) !== code2) return void 0;
+  } catch {
+    return void 0;
+  }
+  let origin;
+  try {
+    const web = new URL(webUrl);
+    const secure = web.protocol === "https:" || web.protocol === "http:" && isLoopbackUrl(web.origin);
+    if (!secure || !PLAIN_HOST_RE.test(web.host)) return void 0;
+    origin = web.origin;
+  } catch {
+    return void 0;
+  }
+  if (url2 !== cliLoginUrl(origin, code2)) return void 0;
+  const raw = body?.["interval"];
+  const interval = typeof raw === "number" && Number.isInteger(raw) ? Math.min(MAX_INTERVAL_SECONDS, Math.max(MIN_INTERVAL_SECONDS, raw)) : CLI_LOGIN_POLL_SECONDS;
+  return { loginKey, code: code2, url: url2, interval };
+}
+async function waitForApproval(endpoint, started, deadline, http, io) {
+  const clock = clockOf2(io);
+  const sleep = sleepOf(io);
+  for (; ; ) {
+    await sleep(started.interval * 1e3);
+    if (clock().getTime() > deadline) throw new ConfigError(EXPIRED_MESSAGE);
+    const answer2 = await poll(endpoint, started.loginKey, http);
+    if (answer2 === void 0) continue;
+    const status = answer2["status"];
+    switch (status) {
+      case "pending":
+        continue;
+      case "denied":
+        throw new ConfigError(DENIED_MESSAGE);
+      case "expired":
+        throw new ConfigError(EXPIRED_MESSAGE);
+      case "approved": {
+        const username = answer2["username"];
+        const secret = answer2["secret"];
+        if (typeof username !== "string" || username === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        if (typeof secret !== "string" || secret === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        return { username, secret };
+      }
+      default:
+        throw new RemoteError(UNKNOWN_STATUS_MESSAGE);
+    }
+  }
+}
+async function poll(endpoint, loginKey, http) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGIN_POLL_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  let response;
+  let text;
+  try {
+    response = await postJson(url2, { loginKey }, http);
+    text = await readText(response, site);
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.unanswered) return void 0;
+    throw error62;
+  }
+  if (!response.ok) {
+    if (response.status >= 500 || response.status === 429) return void 0;
+    throw remoteFailure(site, response, text);
+  }
+  return asRecord(parseJson(text, site, response.status)) ?? {};
+}
+async function browserSignIn(identity, config2, approval, io) {
+  const clientId = config2.cliClientId;
+  try {
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "CUSTOM_AUTH",
+      username: approval.username
+    });
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name !== CUSTOM_CHALLENGE) throw unsupportedStep(name);
+      result = await respondToCustomChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        username: approval.username,
+        answer: approval.secret
+      });
+    }
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      result = await answerCode(
+        identity,
+        clientId,
+        result.challenge,
+        approval.username,
+        io
+      );
+    }
+    if (result.kind === "challenge") {
+      throw unsupportedStep(result.challenge.challengeName);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
+  }
+}
+async function answerCode(identity, clientId, challenge, username, io) {
+  const terminal = terminalOf(io);
+  try {
+    if (!terminal.isTTY) throw new ConfigError(MFA_NEEDS_TERMINAL_MESSAGE);
+    const code2 = await answer(terminal, "Code:");
+    return await respondToAuthChallenge(identity, {
+      clientId,
+      challenge,
+      email: username,
+      code: code2
+    });
+  } finally {
+    terminal.close();
+  }
+}
+async function finishLogin(tokens, endpoint, config2, options, context, io) {
   if (tokens.refreshToken === void 0) {
     throw new RemoteError("sign-in didn't return a refresh token");
   }
-  const now = /* @__PURE__ */ new Date();
+  const now = clockOf2(io)();
   const me = await readProfile(
     new ApiClient({
       endpoint,
       authorizer: bearerAuthorizer(tokens.accessToken),
-      ...http
+      debug: context.debug,
+      fetch: io.fetch
     }),
     config2.webUrl
   );
@@ -27097,25 +27831,36 @@ async function runLogin(options, context, io) {
     sub: me.sub,
     email: me.email
   });
+  const saved = saveEndpoint(context, endpoint, io.env);
   if (options.json === true) {
-    writeJson(io.stdout, { ...me.body, endpoint });
+    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
     return 0;
   }
   writeLine(io.stdout, `Logged in to ${endpoint} as ${me.email}.`);
+  if (saved !== void 0) {
+    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+  }
   return 0;
 }
+function saveEndpoint(context, endpoint, env) {
+  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
+    return void 0;
+  }
+  return rememberEndpoint(env, endpoint);
+}
 async function readProfile(client, webUrl) {
   try {
     return await client.me();
   } catch (error62) {
     if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
-      throw new ConfigError(`finish your account at ${trimSlash(webUrl)}${LOGIN_PAGE}`);
+      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
     }
     throw error62;
   }
 }
 async function runLogout(context, io) {
-  const endpoint = requireEndpoint(context);
+  requireServer("logout", context);
+  const endpoint = await resolveEndpoint(context, io);
   const credential = findCredential(io.env, endpoint);
   if (credential === void 0) {
     writeLine(io.stdout, `Not logged in to ${endpoint}.`);
@@ -27151,8 +27896,8 @@ async function runWhoami(options, context, io) {
     writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
     return 0;
   }
+  const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const client = openClient(context, io);
   const me = await client.me();
   const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
   if (options.json === true) {
@@ -27169,7 +27914,7 @@ async function runWhoami(options, context, io) {
       debug: context.debug,
       fetch: io.fetch
     });
-    const webUrl = config2.mode === "cognito" ? trimSlash(config2.webUrl) : endpoint;
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
     lines.push("", `Create one at ${webUrl}${ORGS_PAGE2}.`);
   }
   for (const line of lines) writeLine(io.stdout, line);
@@ -27209,18 +27954,40 @@ function whoamiLines(endpoint, me, org) {
   return lines;
 }
 
+// src/commands/project.ts
+var DELETE_NEEDS_YES = "project delete needs --yes when stdin is not a terminal";
+var DELETE_MISMATCH = "the name did not match: nothing was deleted";
+async function confirm(org, project, io) {
+  const terminal = io.terminal ?? nodeTerminal(io.stdin, io.stderr);
+  if (!terminal.isTTY) throw new UsageError(DELETE_NEEDS_YES);
+  let answer2;
+  try {
+    answer2 = await terminal.prompt(`Type the project name to delete ${org}/${project}:`);
+  } finally {
+    terminal.close();
+  }
+  if (foldProjectName(answer2.trim()) !== project) throw new UsageError(DELETE_MISMATCH);
+}
+async function runProjectDelete(name, options, context, io) {
+  requireServer("project delete", context);
+  const project = parseProjectName(name);
+  const org = requireOrg(context);
+  if (options.yes !== true) await confirm(org, project, io);
+  await (await openOrgClient(context, io)).deleteProject(project);
+  if (options.json === true) {
+    writeJson(io.stdout, { org, project, deleted: true });
+    return 0;
+  }
+  writeLine(io.stdout, `Deleted project ${org}/${project}.`);
+  return 0;
+}
+
 // src/commands/promote.ts
-var PROMOTE_NEEDS_SERVER = "promote needs a server: pass --endpoint <url>, set QUIBBLE_ENDPOINT, or add one to .quibblerc";
-var PROMOTE_NEEDS_SERVER_LOCAL = "promote needs a server: drop --local";
 async function runPromote(tag, options, context, io) {
-  if (context.mode !== "remote") {
-    throw new ConfigError(
-      context.endpoint === void 0 ? PROMOTE_NEEDS_SERVER : PROMOTE_NEEDS_SERVER_LOCAL
-    );
-  }
+  requireServer("promote", context);
   const project = requireProject(context);
   const promotion = parseTagPromotion({ tag });
-  const result = await openOrgClient(context, io).promoteTag(project, promotion.tag);
+  const result = await (await openOrgClient(context, io)).promoteTag(project, promotion.tag);
   if (options.json === true) {
     writeJson(io.stdout, {
       project,
@@ -27245,7 +28012,7 @@ var NO_TAG_MESSAGE = "retag needs at least one --tag";
 async function runRetag(value, options, context, io) {
   const tags = options.tag ?? [];
   if (tags.length === 0) throw new UsageError(NO_TAG_MESSAGE);
-  const { store, client, local } = openBackend(context, io);
+  const { store, client, local } = await openBackend(context, io);
   const [id] = await resolveIds([value], { store, local, context });
   if (id === void 0) throw new NotFoundError(`no complaint with id ${value}`);
   const allowedTags = client === void 0 ? await localAllowedTags(store, id, context) : void 0;
@@ -27274,9 +28041,9 @@ async function localAllowedTags(store, id, context) {
 // src/commands/retry.ts
 async function runRetry(options, context, io) {
   requireServer("retry", context);
+  const client = await openClient(context, io, { queue: false });
   const endpoint = requireEndpoint(context);
   const path = queuePath(io.env);
-  const client = openClient(context, io, { queue: false });
   const result = await flushQueue({
     path,
     endpoint,
@@ -27348,7 +28115,7 @@ function showLines(complaint, groupCount, remote) {
   return [...lines, "", printableLines(complaint.message)];
 }
 async function runShow(value, options, context, io) {
-  const { store, local } = openBackend(context, io);
+  const { store, local } = await openBackend(context, io);
   const [id] = await resolveIds([value], { store, local, context });
   const complaint = id === void 0 ? void 0 : await getComplaint(store, id);
   if (id === void 0 || complaint === void 0) {
@@ -27403,7 +28170,7 @@ async function runStatusChange(status, values, options, context, io) {
   };
   parseStatusChange(draft);
   const given = await readIdArguments(values, io);
-  const backend = openBackend(context, io);
+  const backend = await openBackend(context, io);
   const extra = options.duplicateOf === void 0 ? [] : [options.duplicateOf];
   const resolved = await resolveIds([...given, ...extra], {
     store: backend.store,
@@ -27442,10 +28209,10 @@ async function runStatusChange(status, values, options, context, io) {
         writeLine(io.stdout, successLine(status, result.complaint));
       continue;
     }
-    const code = result.error?.code ?? NOT_FOUND;
-    const message = code === NOT_FOUND ? noComplaint(result.id) : result.error?.message;
+    const code2 = result.error?.code ?? NOT_FOUND;
+    const message = code2 === NOT_FOUND ? noComplaint(result.id) : result.error?.message;
     writeLine(io.stderr, `quibble: ${result.id}: ${message ?? "the change failed"}`);
-    failures.push({ remote: backend.store instanceof RemoteStore && code !== NOT_FOUND });
+    failures.push({ remote: backend.store instanceof RemoteStore && code2 !== NOT_FOUND });
   }
   if (options.json === true) writeJson(io.stdout, results);
   if (error62 !== void 0) throw error62;
@@ -27499,7 +28266,7 @@ async function runSummary(options, context, io) {
     throw new UsageError("--json and --format cannot be used together");
   }
   const format = readFormat(options.format);
-  const { store, client } = openBackend(context, io);
+  const { store, client } = await openBackend(context, io);
   const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
   const filter = parseListFilter({
     ...resolveScope(options, context),
@@ -27609,11 +28376,127 @@ function markdownLines(filter, summary, note) {
   return lines;
 }
 
+// src/commands/sync.ts
+import { existsSync as existsSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join8 } from "node:path";
+import { Writable as Writable2 } from "node:stream";
+var SYNC_TIMEOUT_MS = 3e3;
+var SECTION_FILES = ["CLAUDE.md", "AGENTS.md"];
+function readOptional3(path) {
+  try {
+    return readFileSync6(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return void 0;
+    throw error62;
+  }
+}
+function holders(root) {
+  const found = [];
+  for (const name of SECTION_FILES) {
+    const path = join8(root, name);
+    const text = readOptional3(path);
+    if (text !== void 0 && findSection(text) !== void 0) {
+      found.push({ path, text, skill: false });
+    }
+  }
+  const skill = join8(root, SKILL_PATH);
+  if (existsSync3(skill)) {
+    found.push({ path: skill, text: readOptional3(skill) ?? "", skill: true });
+  }
+  return found;
+}
+function agentOf(lines, path) {
+  const named = agentOfText(lines);
+  if (named !== void 0) {
+    try {
+      return parseAgentName(named);
+    } catch {
+    }
+  }
+  return agentForFile(path);
+}
+function rewrite(holder, tags, scope) {
+  if (holder.skill) {
+    const agent2 = agentOf(holder.text.split(/\r?\n/), holder.path);
+    return withLineBreak(skillFile(agentSnippet(tags, { ...scope, agent: agent2 })), holder.text);
+  }
+  const section = findSection(holder.text);
+  if (section === void 0) return holder.text;
+  const agent = agentOf(sectionText(section), holder.path);
+  return replaceSection(section, agentSnippet(tags, { ...scope, agent }));
+}
+function sink() {
+  return new Writable2({
+    write(_chunk, _encoding, done) {
+      done();
+    }
+  });
+}
+async function runSync(options, contextOf, io) {
+  if (options.quiet !== true) return sync(options, contextOf(), io);
+  const silent = { ...io, stdout: sink(), stderr: sink() };
+  try {
+    const context = contextOf();
+    context.timeoutMs = SYNC_TIMEOUT_MS;
+    const result = await syncFiles({ hook: options.hook }, context, silent);
+    if (result.files.some((file2) => file2.updated)) {
+      writeLine(io.stdout, refreshedLine(result.project, result.tags));
+    }
+  } catch {
+  }
+  return 0;
+}
+async function sync(options, context, io) {
+  const result = await syncFiles(options, context, io);
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      project: result.project,
+      tags: result.tags ?? null,
+      files: result.files,
+      hook: result.hook ?? null
+    });
+    return 0;
+  }
+  for (const file2 of result.files) {
+    writeLine(
+      io.stdout,
+      file2.updated ? `Updated ${file2.path}` : `${file2.path} is up to date`
+    );
+  }
+  return 0;
+}
+async function syncFiles(options, context, io) {
+  const project = requireProject(context);
+  const root = context.projectRoot ?? io.cwd;
+  let hook;
+  if (options.hook === true) {
+    const plan = planHook(root);
+    const line = applyHook(plan);
+    hook = plan.path;
+    if (options.json !== true) writeLine(io.stdout, line);
+  }
+  const found = holders(root);
+  if (found.length === 0) {
+    throw new UsageError(
+      `no Quibble snippet under ${root}: run quibble snippet --append CLAUDE.md`
+    );
+  }
+  const { tags, scope } = await snippetSource(project, context, io, { queue: false });
+  const files = [];
+  for (const holder of found) {
+    const next = rewrite(holder, tags, scope);
+    const updated = next !== holder.text;
+    if (updated) writeFileSync6(holder.path, next, "utf8");
+    files.push({ path: holder.path, updated });
+  }
+  return { project, tags, files, hook };
+}
+
 // src/commands/tags.ts
 async function runTags(options, context, io) {
   const project = requireProject(context);
   if (context.mode !== "remote") checkActAs(context);
-  const tags = context.mode === "remote" ? (await openOrgClient(context, io).project(project)).tags : context.allowedTags;
+  const tags = context.mode === "remote" ? (await (await openOrgClient(context, io)).project(project)).tags : context.allowedTags;
   if (options.json === true) {
     writeJson(io.stdout, { project, tags: tags ?? null });
     return 0;
@@ -27634,7 +28517,7 @@ async function runTagsEdit(edit, given, options, context, io) {
   const project = requireProject(context);
   if (given.length === 0) throw new UsageError(`tags ${edit} needs at least one tag`);
   const named = parseAllowedTags(given);
-  const client = openOrgClient(context, io);
+  const client = await openOrgClient(context, io);
   let next;
   if (edit === "set") {
     next = named;
@@ -27695,7 +28578,7 @@ async function runTokenCreate(name, options, context, io, now = /* @__PURE__ */
     { name, ...expiresAt === void 0 ? {} : { expiresAt } },
     now
   );
-  const client = openOrgClient(context, io);
+  const client = await openOrgClient(context, io);
   const minted = await client.createToken(project, body);
   if (options.json === true) {
     writeJson(io.stdout, minted.body);
@@ -27705,13 +28588,13 @@ async function runTokenCreate(name, options, context, io, now = /* @__PURE__ */
     io.stdout,
     `Created token ${minted.token.name} for ${org}/${project}. It is shown once:`
   );
-  writeLine(io.stdout, `QUIBBLE_ENDPOINT=${trimSlash(client.endpoint)}`);
+  writeLine(io.stdout, `QUIBBLE_ENDPOINT=${trimSlash2(client.endpoint)}`);
   writeLine(io.stdout, `QUIBBLE_TOKEN=${minted.plaintext}`);
   return 0;
 }
 async function runTokenList(options, context, io, now = /* @__PURE__ */ new Date()) {
   const { project } = scopeOf(context);
-  const answer2 = await openOrgClient(context, io).tokens(project);
+  const answer2 = await (await openOrgClient(context, io)).tokens(project);
   if (options.json === true) {
     writeJson(io.stdout, answer2.body);
     return 0;
@@ -27750,7 +28633,7 @@ function findToken(tokens, value) {
 }
 async function runTokenRevoke(value, options, context, io) {
   const { project, org } = scopeOf(context);
-  const client = openOrgClient(context, io);
+  const client = await openOrgClient(context, io);
   const token = findToken((await client.tokens(project)).tokens, value);
   await client.revokeToken(project, token.id);
   if (options.json === true) {
@@ -27785,6 +28668,7 @@ var TAGS_EDITS = [
 var ID_HELP = `complaint id, or a unique prefix of at least ${SHORT_ID_MIN} characters`;
 var REASON_HELP = `${REASONS.slice(0, -1).join(", ")} or ${REASONS.at(-1) ?? ""}`;
 function packageVersion() {
+  if (typeof QUIBBLE_BUILD_VERSION === "string") return QUIBBLE_BUILD_VERSION;
   const require2 = createRequire(import.meta.url);
   const manifest = require2("../package.json");
   return typeof manifest.version === "string" ? manifest.version : "0.0.0";
@@ -27798,7 +28682,7 @@ function rejectEmptyOptions(options) {
   }
 }
 function withGlobalOptions(command) {
-  return command.option("--local", "use the local store even if an endpoint is set").option("--endpoint <url>", "base URL of the Quibble API").option("--org <slug>", "organization to use in remote mode").option("--json", "print JSON instead of text");
+  return command.option("--local", "use the local store, whatever the endpoint says").option("--endpoint <url>", "API URL, web URL, host, or local").option("--org <slug>", "organization to use in remote mode").option("--json", "print JSON instead of text");
 }
 function globals(program2, command) {
   const outer = program2.opts();
@@ -27836,19 +28720,34 @@ function buildProgram(io, setCode) {
   }).exitOverride();
   withGlobalOptions(program2);
   withGlobalOptions(
-    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--force", "overwrite an existing .quibblerc or skill file")
+    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--force", "overwrite an existing .quibblerc or skill file")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runInit(options, io));
   });
   withGlobalOptions(
-    program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")
+    program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--hook", "add the quibble sync hook to .claude/settings.json").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
     setCode(await runSnippet(options, contextFor(options, io), io));
   });
+  withGlobalOptions(
+    program2.command("sync").description("rewrite the agent snippet in place with the current tags").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--quiet", "print nothing but a changed tag list, and always exit 0").option("--project <name>", "project name (overrides .quibblerc)")
+  ).action(async function() {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    setCode(
+      await runSync(
+        options,
+        () => {
+          rejectEmptyOptions(options);
+          return contextFor(options, io);
+        },
+        io
+      )
+    );
+  });
   withGlobalOptions(
     program2.command("complain").description("file a complaint").argument("[message]", "what went wrong; omit it or pass `-` to read stdin").option("-s, --severity <level>", "low, medium or high").option("-t, --tag <tag>", "tag (repeatable)", collect).option("--agent <name>", "name of the agent filing it").option("--reporter <name>", "person you are filing for (local mode only)").option("--project <name>", "project name (overrides .quibblerc)").option("--cmd <command>", "the command that failed")
   ).action(async function(message) {
@@ -27944,6 +28843,14 @@ function buildProgram(io, setCode) {
     rejectEmptyOptions(options);
     setCode(await runTokenRevoke(value, options, contextFor(options, io), io));
   });
+  const projectCommand = program2.command("project").description("manage the projects of the organization (remote only)");
+  withGlobalOptions(
+    projectCommand.command("delete").description("delete a project and hide its complaints").argument("<name>", "project name").option("--yes", "skip the question")
+  ).action(async function(name) {
+    const options = { ...this.opts(), ...globals(program2, this) };
+    rejectEmptyOptions(options);
+    setCode(await runProjectDelete(name, options, contextFor(options, io), io));
+  });
   withGlobalOptions(
     program2.command("retry").description("send the complaints queued while offline")
   ).action(async function() {
@@ -27966,11 +28873,17 @@ function buildProgram(io, setCode) {
     setCode(await runOrgs(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("login").description("log in to the endpoint")
+    program2.command("login").description("log in to the endpoint, approved in a browser").option("--no-browser", "print the approval URL, and open no browser").option("--password", "log in with an email and a password on the terminal")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(await runLogin(options, contextFor(options, io), io));
+    setCode(
+      await runLogin(
+        { ...options, version: packageVersion() },
+        contextFor(options, io),
+        io
+      )
+    );
   });
   withGlobalOptions(
     program2.command("logout").description("log out of the endpoint")
@@ -27988,10 +28901,10 @@ function buildProgram(io, setCode) {
   });
   withGlobalOptions(
     program2.command("config").description("print the resolved configuration")
-  ).action(function() {
+  ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(runConfig(options, contextFor(options, io), io));
+    setCode(await runConfig(options, contextFor(options, io), io));
   });
   return program2;
 }
@@ -27999,9 +28912,10 @@ function stripErrorPrefix(message) {
   return message.replace(/^error:\s*/i, "");
 }
 async function main(argv, io) {
-  let code = 0;
+  resetDiscovery();
+  let code2 = 0;
   const program2 = buildProgram(io, (value) => {
-    code = value;
+    code2 = value;
   });
   if (argv.length === 0) {
     io.stdout.write(program2.helpInformation());
@@ -28009,7 +28923,7 @@ async function main(argv, io) {
   }
   try {
     await program2.parseAsync(argv, { from: "user" });
-    return code;
+    return code2;
   } catch (error62) {
     if (error62 instanceof CommanderError) {
       if (error62.code === "commander.help" || error62.code === "commander.helpDisplayed") {
@@ -28031,10 +28945,18 @@ for (const stream of [process2.stdout, process2.stderr]) {
     throw error62;
   });
 }
-process2.exitCode = await main(process2.argv.slice(2), {
+function flushed(stream) {
+  return new Promise((resolve4) => {
+    stream.write("", () => resolve4());
+  });
+}
+var code = await main(process2.argv.slice(2), {
   stdin: process2.stdin,
   stdout: process2.stdout,
   stderr: process2.stderr,
   env: process2.env,
   cwd: process2.cwd()
 });
+process2.exitCode = code;
+await Promise.all([flushed(process2.stdout), flushed(process2.stderr)]);
+process2.exit(code);