letthemquibble 1.2.0 → 2.0.0

package/README.md

@@ -50,6 +50,13 @@ quibble list
 quibble summary
 ```
 
+`quibble login` opens the browser, where you check the code and approve the
+login. It needs no terminal, so a coding agent can start it too. Over SSH or
+in WSL, open the printed URL on any device where you are signed in, or pass
+`--no-browser` to print it alone. `quibble login --password` asks for the
+email, the password and, when two-factor sign-in is on, a code in the
+terminal instead.
+
 `quibble init` writes a `.quibblerc` and prints a short section for your
 `CLAUDE.md` or `AGENTS.md`. It tells the agent when to complain and how, for
 example:
@@ -98,6 +105,7 @@ once.
 
 For CI, a maintainer runs `quibble token create ci`, and the job sets the two
 lines it prints, `QUIBBLE_ENDPOINT` and `QUIBBLE_TOKEN`, instead of logging in.
+A plain `quibble login` refuses to run when `CI` is set.
 A complaint that cannot reach the API waits in `~/.quibble/unsent.jsonl` and
 goes out with the next remote command, or with `quibble retry`.
 
@@ -105,5 +113,6 @@ Run `quibble --help` for every command.
 
 ## More
 
+- <https://letthemquibble.com/help>: install, update, setup and login
 - <https://github.com/repineap/quibble>
 - <https://letthemquibble.com>

package/dist/quibble.js

@@ -6303,9 +6303,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname4) {
-  hostname4.lastIndex = 0;
-  return hostname4.test(url2.hostname);
+function urlHostnameOk(url2, hostname5) {
+  hostname5.lastIndex = 0;
+  return hostname5.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -23233,6 +23233,14 @@ var ACT_AS_HEADER = "x-quibble-act-as";
 var TRUNCATED_HEADER = "x-quibble-truncated";
 var IDEMPOTENCY_HEADER = "idempotency-key";
 var IDEMPOTENCY_KEY_MAX = 128;
+var CLI_LOGIN_TTL_SECONDS = 600;
+var CLI_LOGIN_POLL_SECONDS = 3;
+var CLI_LOGIN_CODE_ALPHABET = "BCDFGHJKMNPQRSTVWXZ";
+var CLI_LOGIN_CODE_LENGTH = 8;
+var CLI_LOGIN_HOST_MAX = 64;
+var CLI_LOGIN_OS_MAX = 32;
+var CLI_LOGIN_VERSION_MAX = 32;
+var CLI_LOGIN_PAGE_PATH = "/cli-login";
 
 // ../core/dist/errors.js
 var QuibbleError = class extends Error {
@@ -23287,6 +23295,35 @@ function describeError(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
 
+// ../core/dist/cli-login.js
+var CLI_LOGIN_CONTROL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/u;
+var CONTROL_GLOBAL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/gu;
+var CLI_LOGIN_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
+var CLI_LOGIN_CODE_MESSAGE = "code: not a login code";
+var HALF = CLI_LOGIN_CODE_LENGTH / 2;
+var CODE_RE = new RegExp(`^([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})-?([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})$`);
+var UNKNOWN_HOST = "unknown";
+function parseCliLoginCode(value) {
+  const match = CODE_RE.exec(value.trim().toUpperCase());
+  if (match === null)
+    throw new ValidationError([CLI_LOGIN_CODE_MESSAGE]);
+  return `${match[1] ?? ""}-${match[2] ?? ""}`;
+}
+function cliLoginUrl(webUrl, code2) {
+  return `${webUrl.replace(/\/+$/, "")}${CLI_LOGIN_PAGE_PATH}?code=${code2}`;
+}
+function cut(value, max) {
+  if (value.length <= max)
+    return value;
+  const head = value.slice(0, max);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+function cliLoginHost(raw) {
+  const host = cut(raw.replace(CONTROL_GLOBAL_RE, "").trim(), CLI_LOGIN_HOST_MAX).trim();
+  return host === "" ? UNKNOWN_HOST : host;
+}
+
 // ../core/dist/fingerprint.js
 function headlineOf(message) {
   for (const line of message.split("\n")) {
@@ -23307,7 +23344,7 @@ var PUNCTUATION_RE = /[^\p{L}\p{N}\s<>]/gu;
 function isHexId(run2) {
   return /[a-f]/.test(run2) && /[0-9]/.test(run2);
 }
-function cut(text, max) {
+function cut2(text, max) {
   if (text.length <= max)
     return text;
   const head = text.slice(0, max);
@@ -23325,7 +23362,7 @@ function fingerprintOf(message) {
   text = text.replace(NUMBER_RE, "<n>");
   text = text.replace(PUNCTUATION_RE, " ");
   text = text.replace(/\s+/gu, " ").trim();
-  text = cut(text, FINGERPRINT_MAX).trim();
+  text = cut2(text, FINGERPRINT_MAX).trim();
   return text === "" ? EMPTY_FINGERPRINT : text;
 }
 function groupComplaints(complaints) {
@@ -23906,6 +23943,23 @@ function newTokenSchema(now) {
     ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
   }));
 }
+function reportedField(max) {
+  const message = lengthMessage(1, max);
+  return external_exports.string({ message }).trim().min(1, { message }).max(max, { message }).refine((value) => !CLI_LOGIN_CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
+}
+var newCliLoginSchema = external_exports.strictObject({
+  host: reportedField(CLI_LOGIN_HOST_MAX),
+  os: reportedField(CLI_LOGIN_OS_MAX),
+  version: reportedField(CLI_LOGIN_VERSION_MAX)
+}).transform((input2) => ({
+  host: input2.host,
+  os: input2.os,
+  version: input2.version
+}));
+var LOGIN_KEY_MESSAGE = "must be 43 base64url characters";
+var cliLoginPollSchema = external_exports.strictObject({
+  loginKey: external_exports.string({ message: LOGIN_KEY_MESSAGE }).regex(CLI_LOGIN_KEY_RE, { message: LOGIN_KEY_MESSAGE })
+}).transform((input2) => ({ loginKey: input2.loginKey }));
 var UNKNOWN_KEY_MESSAGE = "unknown key";
 var emptyBodySchema = external_exports.strictObject({});
 function formatIssues(error62) {
@@ -24756,6 +24810,7 @@ var TOO_MANY_LINE = "Too many attempts. Try again later.";
 var WRONG_CODE_LINE = "Wrong code.";
 var EXPIRED_CODE_LINE = "That code has expired. Request a new one.";
 var PASSWORD_POLICY_LINE = "Use at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.";
+var BROWSER_REFUSED_LINE = "the browser approval could not be used: run quibble login again";
 var UNREACHABLE_TYPE = "Unreachable";
 var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
 var CognitoError = class extends RemoteError {
@@ -24772,14 +24827,15 @@ var CognitoError = class extends RemoteError {
 function endpointUrl(region) {
   return `https://cognito-idp.${region}.amazonaws.com/`;
 }
-function errorLineOf(type, detail2, signIn2) {
+function errorLineOf(type, detail2, step) {
   switch (type) {
     case UNREACHABLE_TYPE:
       return UNREACHABLE_LINE;
     case "UserNotFoundException":
-      return signIn2 ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      return step === "sign-in" ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "NotAuthorizedException":
-      return signIn2 && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      if (step === "browser") return BROWSER_REFUSED_LINE;
+      return step === "sign-in" && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "LimitExceededException":
     case "TooManyRequestsException":
     case "TooManyFailedAttemptsException":
@@ -24800,7 +24856,7 @@ function typeOf(value) {
   const hash2 = value.indexOf("#");
   return hash2 === -1 ? value : value.slice(hash2 + 1);
 }
-async function call(endpoint, operation, body, signIn2 = false) {
+async function call(endpoint, operation, body, step = "other") {
   const url2 = endpointUrl(endpoint.region);
   const send2 = endpoint.fetch ?? globalThis.fetch;
   const site = {
@@ -24812,7 +24868,7 @@ async function call(endpoint, operation, body, signIn2 = false) {
     throw new CognitoError(
       type,
       detail2,
-      errorLineOf(type, detail2, signIn2),
+      errorLineOf(type, detail2, step),
       detail(site, status)
     );
   };
@@ -24895,14 +24951,27 @@ function authAnswerOf(body) {
     }
   };
 }
+function flowOf(input2) {
+  switch (input2.flow) {
+    case "USER_PASSWORD_AUTH":
+      return {
+        parameters: { USERNAME: input2.username, PASSWORD: input2.password },
+        step: "sign-in"
+      };
+    case "REFRESH_TOKEN_AUTH":
+      return { parameters: { REFRESH_TOKEN: input2.refreshToken }, step: "other" };
+    case "CUSTOM_AUTH":
+      return { parameters: { USERNAME: input2.username }, step: "browser" };
+  }
+}
 async function initiateAuth(endpoint, input2) {
-  const parameters = input2.flow === "USER_PASSWORD_AUTH" ? { USERNAME: input2.username, PASSWORD: input2.password } : { REFRESH_TOKEN: input2.refreshToken };
+  const { parameters, step } = flowOf(input2);
   return authAnswerOf(
     await call(
       endpoint,
       "InitiateAuth",
       { ClientId: input2.clientId, AuthFlow: input2.flow, AuthParameters: parameters },
-      input2.flow === "USER_PASSWORD_AUTH"
+      step
     )
   );
 }
@@ -24917,6 +24986,22 @@ async function respondToAuthChallenge(endpoint, input2) {
     })
   );
 }
+async function respondToCustomChallenge(endpoint, input2) {
+  const username = input2.challenge.challengeParameters["USERNAME"] ?? input2.username;
+  return authAnswerOf(
+    await call(
+      endpoint,
+      "RespondToAuthChallenge",
+      {
+        ClientId: input2.clientId,
+        ChallengeName: input2.challenge.challengeName,
+        Session: input2.challenge.session,
+        ChallengeResponses: { USERNAME: username, ANSWER: input2.answer }
+      },
+      "browser"
+    )
+  );
+}
 async function revokeToken(endpoint, input2) {
   await call(endpoint, "RevokeToken", { ClientId: input2.clientId, Token: input2.token });
 }
@@ -27088,12 +27173,12 @@ var REPORTER_WIDTH = 20;
 var TAGS_WIDTH = 24;
 var SUMMARY_MAX = 60;
 var RECURRED_MARK = "\u21BB";
-function cut2(text, width) {
+function cut3(text, width) {
   if (text.length <= width) return text;
   return `${text.slice(0, width - 3)}...`;
 }
 function summaryOf(complaint) {
-  return cut2(printable(summarize(complaint.message)), SUMMARY_MAX);
+  return cut3(printable(summarize(complaint.message)), SUMMARY_MAX);
 }
 function limitNote(count, limit, more) {
   if (limit >= MAX_LIMIT) {
@@ -27147,7 +27232,7 @@ async function runList(options, context, io) {
   return 0;
 }
 function reporterOf(complaint) {
-  return cut2(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+  return cut3(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
 }
 function groupCell(group) {
   const count = group.count > 1 ? `\xD7${group.count}` : "";
@@ -27164,7 +27249,7 @@ function formatTable(rows2) {
       status: complaint.status,
       project: complaint.project,
       reporter: reporterOf(complaint),
-      tags: cut2(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      tags: cut3(printable(complaint.tags.join(",")), TAGS_WIDTH),
       group: group === void 0 ? "" : groupCell(group),
       summary: summaryOf(complaint)
     };
@@ -27221,6 +27306,81 @@ function formatOrgs(orgs) {
   return [format(COLUMNS2), ...rows2.map(format)];
 }
 
+// src/commands/login.ts
+import { hostname as hostname4 } from "node:os";
+
+// src/opener.ts
+import { spawn as nodeSpawn } from "node:child_process";
+var OPEN_TIMEOUT_MS = 5e3;
+var OPENABLE_URL_RE = /^https?:\/\/[A-Za-z0-9.:[\]-]+(?:\/[A-Za-z0-9/?=._~-]*)?$/;
+function isWsl(platform, env) {
+  if (platform !== "linux") return false;
+  const set2 = (name) => (env[name] ?? "") !== "";
+  return set2("WSL_DISTRO_NAME") || set2("WSL_INTEROP");
+}
+function openCommands(url2, platform, env) {
+  if (platform === "darwin") return [{ command: "open", args: [url2] }];
+  if (platform === "win32") {
+    return [{ command: "cmd", args: ["/c", "start", "", url2] }];
+  }
+  if (isWsl(platform, env)) {
+    return [
+      { command: "wslview", args: [url2] },
+      { command: "cmd.exe", args: ["/c", "start", "", url2] }
+    ];
+  }
+  return [{ command: "xdg-open", args: [url2] }];
+}
+function attempt(spawn, entry, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const settle2 = (opened) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(opened);
+    };
+    const timer = setTimeout(() => {
+      settle2(false);
+    }, timeoutMs);
+    timer.unref();
+    let child;
+    try {
+      child = spawn(entry.command, entry.args, {
+        shell: false,
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch {
+      settle2(false);
+      return;
+    }
+    child.on("error", () => {
+      settle2(false);
+    });
+    child.on("exit", (code2) => {
+      settle2(code2 === 0);
+    });
+    child.unref();
+  });
+}
+function platformOpener(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const spawn = options.spawn ?? nodeSpawn;
+  const timeoutMs = options.timeoutMs ?? OPEN_TIMEOUT_MS;
+  return {
+    async open(url2) {
+      if (!OPENABLE_URL_RE.test(url2)) return false;
+      for (const entry of openCommands(url2, platform, env)) {
+        if (await attempt(spawn, entry, timeoutMs)) return true;
+      }
+      return false;
+    }
+  };
+}
+
 // src/terminal.ts
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
@@ -27342,15 +27502,40 @@ function nodeTerminal(input2, output2) {
 
 // src/commands/login.ts
 var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var NEEDS_TERMINAL_MESSAGE = "quibble login --password needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var CI_MESSAGE = "quibble login needs a person to approve it in a browser: in CI, set QUIBBLE_TOKEN instead";
+var NO_BROWSER_MESSAGE = "--no-browser applies to the browser login only";
+var DENIED_MESSAGE = "login was denied in the browser";
+var EXPIRED_MESSAGE = "the login request expired: run quibble login again";
+var MALFORMED_MESSAGE = "the API answered a malformed login request";
+var UNKNOWN_STATUS_MESSAGE = "the API answered an unknown login status";
+var MFA_NEEDS_TERMINAL_MESSAGE = "this account needs a two-factor code: run quibble login in a terminal";
 var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
+var CUSTOM_CHALLENGE = "CUSTOM_CHALLENGE";
 var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
+var CLI_LOGINS_PATH = "/v1/cli-logins";
+var CLI_LOGIN_POLL_PATH = "/v1/cli-logins/poll";
+var MIN_INTERVAL_SECONDS = 1;
+var MAX_INTERVAL_SECONDS = 30;
+var PLAIN_HOST_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::[0-9]+)?$/;
 var LOGIN_PAGE = "/login";
 var ORGS_PAGE2 = "/orgs";
 var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
 function terminalOf(io) {
   return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
 }
+function clockOf2(io) {
+  return io.now ?? (() => /* @__PURE__ */ new Date());
+}
+function sleepOf(io) {
+  return io.sleep ?? ((ms) => new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  }));
+}
+function ciIsSet(env) {
+  const value = (env["CI"] ?? "").trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false";
+}
 async function answer(terminal, label, hidden = false) {
   const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
   const value = hidden ? text : text.trim();
@@ -27358,6 +27543,23 @@ async function answer(terminal, label, hidden = false) {
     throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
   return value;
 }
+function unsupportedStep(name) {
+  return new RemoteError(
+    `this account needs a sign-in step that quibble doesn't support (${name})`
+  );
+}
+function pageError(error62, webUrl) {
+  if (error62 instanceof CognitoError) {
+    const page = `${trimSlash2(webUrl)}${LOGIN_PAGE}`;
+    if (error62.type === "PasswordResetRequiredException") {
+      return new ConfigError(`reset your password at ${page}`);
+    }
+    if (error62.type === "UserNotConfirmedException") {
+      return new ConfigError(`finish your sign-up at ${page}`);
+    }
+  }
+  return error62;
+}
 async function signIn(terminal, identity, config2) {
   const email3 = await answer(terminal, "Email:");
   const password = await answer(terminal, "Password:", true);
@@ -27385,26 +27587,22 @@ async function signIn(terminal, identity, config2) {
           `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
         );
       }
-      throw new RemoteError(
-        `this account needs a sign-in step that quibble doesn't support (${name})`
-      );
+      throw unsupportedStep(name);
     }
     return result.tokens;
   } catch (error62) {
-    if (error62 instanceof CognitoError) {
-      const page = `${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`;
-      if (error62.type === "PasswordResetRequiredException") {
-        throw new ConfigError(`reset your password at ${page}`);
-      }
-      if (error62.type === "UserNotConfirmedException") {
-        throw new ConfigError(`finish your sign-up at ${page}`);
-      }
-    }
-    throw error62;
+    throw pageError(error62, config2.webUrl);
   }
 }
 async function runLogin(options, context, io) {
   requireServer("login", context);
+  if (options.password === true) {
+    if (options.browser === false) throw new UsageError(NO_BROWSER_MESSAGE);
+    return passwordLogin(options, context, io);
+  }
+  return browserLogin(options, context, io);
+}
+async function passwordLogin(options, context, io) {
   const terminal = terminalOf(io);
   if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
   const endpoint = await resolveEndpoint(context, io);
@@ -27420,15 +27618,203 @@ async function runLogin(options, context, io) {
   } finally {
     terminal.close();
   }
+  return finishLogin(tokens, endpoint, config2, options, context, io);
+}
+async function browserLogin(options, context, io) {
+  if (ciIsSet(io.env)) throw new UsageError(CI_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const http = { debug: context.debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") {
+    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
+    return 0;
+  }
+  const clock = clockOf2(io);
+  const started = await startLogin(endpoint, config2.webUrl, http, {
+    host: cliLoginHost((io.hostname ?? hostname4)()),
+    os: process.platform,
+    version: options.version
+  });
+  const deadline = clock().getTime() + (CLI_LOGIN_TTL_SECONDS + started.interval) * 1e3;
+  writeLine(
+    io.stderr,
+    `Approve this login in your browser: ${started.url} (code ${started.code}). Waiting...`
+  );
+  if (options.browser !== false) {
+    const opener = io.opener ?? platformOpener({ env: io.env });
+    void opener.open(started.url).catch(() => false);
+  }
+  const approval = await waitForApproval(endpoint, started, deadline, http, io);
+  const tokens = await browserSignIn(
+    { region: config2.region, ...http },
+    config2,
+    approval,
+    io
+  );
+  return finishLogin(tokens, endpoint, config2, options, context, io);
+}
+function postJson(url2, body, http) {
+  return send(url2, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    ...http
+  });
+}
+async function startLogin(endpoint, webUrl, http, body) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGINS_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  const response = await postJson(url2, body, http);
+  const text = await readText(response, site);
+  if (response.status === 404) {
+    throw new RemoteError(
+      `${endpoint} does not support the browser login: run quibble login --password${detail(site, 404)}`,
+      { status: 404 }
+    );
+  }
+  if (!response.ok) throw remoteFailure(site, response, text);
+  const started = checkStart(asRecord(parseQuietly(text)), webUrl);
+  if (started === void 0) {
+    throw new RemoteError(`${MALFORMED_MESSAGE}${detail(site, response.status)}`);
+  }
+  return started;
+}
+function checkStart(body, webUrl) {
+  const loginKey = body?.["loginKey"];
+  const code2 = body?.["code"];
+  const url2 = body?.["url"];
+  if (typeof loginKey !== "string" || !CLI_LOGIN_KEY_RE.test(loginKey)) return void 0;
+  if (typeof code2 !== "string" || typeof url2 !== "string") return void 0;
+  try {
+    if (parseCliLoginCode(code2) !== code2) return void 0;
+  } catch {
+    return void 0;
+  }
+  let origin;
+  try {
+    const web = new URL(webUrl);
+    const secure = web.protocol === "https:" || web.protocol === "http:" && isLoopbackUrl(web.origin);
+    if (!secure || !PLAIN_HOST_RE.test(web.host)) return void 0;
+    origin = web.origin;
+  } catch {
+    return void 0;
+  }
+  if (url2 !== cliLoginUrl(origin, code2)) return void 0;
+  const raw = body?.["interval"];
+  const interval = typeof raw === "number" && Number.isInteger(raw) ? Math.min(MAX_INTERVAL_SECONDS, Math.max(MIN_INTERVAL_SECONDS, raw)) : CLI_LOGIN_POLL_SECONDS;
+  return { loginKey, code: code2, url: url2, interval };
+}
+async function waitForApproval(endpoint, started, deadline, http, io) {
+  const clock = clockOf2(io);
+  const sleep = sleepOf(io);
+  for (; ; ) {
+    await sleep(started.interval * 1e3);
+    if (clock().getTime() > deadline) throw new ConfigError(EXPIRED_MESSAGE);
+    const answer2 = await poll(endpoint, started.loginKey, http);
+    if (answer2 === void 0) continue;
+    const status = answer2["status"];
+    switch (status) {
+      case "pending":
+        continue;
+      case "denied":
+        throw new ConfigError(DENIED_MESSAGE);
+      case "expired":
+        throw new ConfigError(EXPIRED_MESSAGE);
+      case "approved": {
+        const username = answer2["username"];
+        const secret = answer2["secret"];
+        if (typeof username !== "string" || username === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        if (typeof secret !== "string" || secret === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        return { username, secret };
+      }
+      default:
+        throw new RemoteError(UNKNOWN_STATUS_MESSAGE);
+    }
+  }
+}
+async function poll(endpoint, loginKey, http) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGIN_POLL_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  let response;
+  let text;
+  try {
+    response = await postJson(url2, { loginKey }, http);
+    text = await readText(response, site);
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.unanswered) return void 0;
+    throw error62;
+  }
+  if (!response.ok) {
+    if (response.status >= 500 || response.status === 429) return void 0;
+    throw remoteFailure(site, response, text);
+  }
+  return asRecord(parseJson(text, site, response.status)) ?? {};
+}
+async function browserSignIn(identity, config2, approval, io) {
+  const clientId = config2.cliClientId;
+  try {
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "CUSTOM_AUTH",
+      username: approval.username
+    });
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name !== CUSTOM_CHALLENGE) throw unsupportedStep(name);
+      result = await respondToCustomChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        username: approval.username,
+        answer: approval.secret
+      });
+    }
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      result = await answerCode(
+        identity,
+        clientId,
+        result.challenge,
+        approval.username,
+        io
+      );
+    }
+    if (result.kind === "challenge") {
+      throw unsupportedStep(result.challenge.challengeName);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
+  }
+}
+async function answerCode(identity, clientId, challenge, username, io) {
+  const terminal = terminalOf(io);
+  try {
+    if (!terminal.isTTY) throw new ConfigError(MFA_NEEDS_TERMINAL_MESSAGE);
+    const code2 = await answer(terminal, "Code:");
+    return await respondToAuthChallenge(identity, {
+      clientId,
+      challenge,
+      email: username,
+      code: code2
+    });
+  } finally {
+    terminal.close();
+  }
+}
+async function finishLogin(tokens, endpoint, config2, options, context, io) {
   if (tokens.refreshToken === void 0) {
     throw new RemoteError("sign-in didn't return a refresh token");
   }
-  const now = /* @__PURE__ */ new Date();
+  const now = clockOf2(io)();
   const me = await readProfile(
     new ApiClient({
       endpoint,
       authorizer: bearerAuthorizer(tokens.accessToken),
-      ...http
+      debug: context.debug,
+      fetch: io.fetch
     }),
     config2.webUrl
   );
@@ -28487,11 +28873,17 @@ function buildProgram(io, setCode) {
     setCode(await runOrgs(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("login").description("log in to the endpoint")
+    program2.command("login").description("log in to the endpoint, approved in a browser").option("--no-browser", "print the approval URL, and open no browser").option("--password", "log in with an email and a password on the terminal")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(await runLogin(options, contextFor(options, io), io));
+    setCode(
+      await runLogin(
+        { ...options, version: packageVersion() },
+        contextFor(options, io),
+        io
+      )
+    );
   });
   withGlobalOptions(
     program2.command("logout").description("log out of the endpoint")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "letthemquibble",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "description": "File complaints about the project you work in, from a coding agent or a shell.",
   "license": "MIT",
   "type": "module",