letthemquibble 1.2.0 → 2.1.0

package/dist/quibble.js

@@ -6303,9 +6303,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname4) {
-  hostname4.lastIndex = 0;
-  return hostname4.test(url2.hostname);
+function urlHostnameOk(url2, hostname5) {
+  hostname5.lastIndex = 0;
+  return hostname5.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -23233,6 +23233,14 @@ var ACT_AS_HEADER = "x-quibble-act-as";
 var TRUNCATED_HEADER = "x-quibble-truncated";
 var IDEMPOTENCY_HEADER = "idempotency-key";
 var IDEMPOTENCY_KEY_MAX = 128;
+var CLI_LOGIN_TTL_SECONDS = 600;
+var CLI_LOGIN_POLL_SECONDS = 3;
+var CLI_LOGIN_CODE_ALPHABET = "BCDFGHJKMNPQRSTVWXZ";
+var CLI_LOGIN_CODE_LENGTH = 8;
+var CLI_LOGIN_HOST_MAX = 64;
+var CLI_LOGIN_OS_MAX = 32;
+var CLI_LOGIN_VERSION_MAX = 32;
+var CLI_LOGIN_PAGE_PATH = "/cli-login";
 
 // ../core/dist/errors.js
 var QuibbleError = class extends Error {
@@ -23287,6 +23295,35 @@ function describeError(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
 
+// ../core/dist/cli-login.js
+var CLI_LOGIN_CONTROL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/u;
+var CONTROL_GLOBAL_RE = /[\u0000-\u001F\u007F-\u009F\p{Cf}]/gu;
+var CLI_LOGIN_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
+var CLI_LOGIN_CODE_MESSAGE = "code: not a login code";
+var HALF = CLI_LOGIN_CODE_LENGTH / 2;
+var CODE_RE = new RegExp(`^([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})-?([${CLI_LOGIN_CODE_ALPHABET}]{${HALF}})$`);
+var UNKNOWN_HOST = "unknown";
+function parseCliLoginCode(value) {
+  const match = CODE_RE.exec(value.trim().toUpperCase());
+  if (match === null)
+    throw new ValidationError([CLI_LOGIN_CODE_MESSAGE]);
+  return `${match[1] ?? ""}-${match[2] ?? ""}`;
+}
+function cliLoginUrl(webUrl, code2) {
+  return `${webUrl.replace(/\/+$/, "")}${CLI_LOGIN_PAGE_PATH}?code=${code2}`;
+}
+function cut(value, max) {
+  if (value.length <= max)
+    return value;
+  const head = value.slice(0, max);
+  const last = head.charCodeAt(head.length - 1);
+  return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
+}
+function cliLoginHost(raw) {
+  const host = cut(raw.replace(CONTROL_GLOBAL_RE, "").trim(), CLI_LOGIN_HOST_MAX).trim();
+  return host === "" ? UNKNOWN_HOST : host;
+}
+
 // ../core/dist/fingerprint.js
 function headlineOf(message) {
   for (const line of message.split("\n")) {
@@ -23307,7 +23344,7 @@ var PUNCTUATION_RE = /[^\p{L}\p{N}\s<>]/gu;
 function isHexId(run2) {
   return /[a-f]/.test(run2) && /[0-9]/.test(run2);
 }
-function cut(text, max) {
+function cut2(text, max) {
   if (text.length <= max)
     return text;
   const head = text.slice(0, max);
@@ -23325,7 +23362,7 @@ function fingerprintOf(message) {
   text = text.replace(NUMBER_RE, "<n>");
   text = text.replace(PUNCTUATION_RE, " ");
   text = text.replace(/\s+/gu, " ").trim();
-  text = cut(text, FINGERPRINT_MAX).trim();
+  text = cut2(text, FINGERPRINT_MAX).trim();
   return text === "" ? EMPTY_FINGERPRINT : text;
 }
 function groupComplaints(complaints) {
@@ -23461,6 +23498,43 @@ function freeText(max, typeMessage) {
   const message = lengthMessage(1, max);
   return external_exports.string({ message: typeMessage ?? message }).overwrite((value) => value.replace(/\r\n?/g, "\n")).trim().min(1, { message }).max(max, { message }).refine((value) => !CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
 }
+var SECRET_PATTERNS = [
+  {
+    kind: "an AWS access key",
+    pattern: /(?<![A-Za-z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9])/
+  },
+  {
+    kind: "a GitHub token",
+    pattern: /(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])|(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{22,}/
+  },
+  {
+    kind: "an API key",
+    pattern: /(?<![A-Za-z0-9-])sk-(?:ant-|proj-)?(?=[A-Za-z_-]*[0-9])[A-Za-z0-9_-]{32,}/
+  },
+  { kind: "a Stripe live key", pattern: /(?<![A-Za-z0-9])[rs]k_live_[A-Za-z0-9]{20,}/ },
+  { kind: "a Slack token", pattern: /(?<![A-Za-z0-9])xox[abposr]-[A-Za-z0-9-]{10,}/ },
+  {
+    kind: "a Quibble project token",
+    pattern: /(?<![A-Za-z0-9])qbp_[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/
+  },
+  { kind: "a private key", pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/ }
+];
+function findSecret(text) {
+  return SECRET_PATTERNS.find(({ pattern }) => pattern.test(text))?.kind;
+}
+function secretFree(schema, max) {
+  return schema.superRefine((value, ctx) => {
+    if (value.length > max || CONTROL_RE.test(value))
+      return;
+    const kind = findSecret(value);
+    if (kind !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: `holds what looks like ${kind}: remove the secret and file again`
+      });
+    }
+  });
+}
 var SEVERITY_MESSAGE = `must be one of ${SEVERITIES.join(", ")}`;
 var STATUS_MESSAGE = `must be one of ${STATUSES.join(", ")}`;
 var LIMIT_MESSAGE = `must be an integer between 1 and ${MAX_LIMIT}`;
@@ -23613,7 +23687,7 @@ var agentSchema = freeText(AGENT_MAX);
 var newComplaintShape = {
   org: orgSlugSchema,
   project: projectNameSchema,
-  message: freeText(MESSAGE_MAX),
+  message: secretFree(freeText(MESSAGE_MAX), MESSAGE_MAX),
   severity: severitySchema.optional(),
   tags: tagsSchema.optional(),
   agent: agentSchema.optional(),
@@ -23621,7 +23695,7 @@ var newComplaintShape = {
   reporterName: freeText(REPORTER_MAX).optional(),
   cwd: cwdSchema.optional(),
   // Free text: it is trimmed and may hold newlines, and nothing parses it.
-  cmd: freeText(CMD_MAX).optional()
+  cmd: secretFree(freeText(CMD_MAX), CMD_MAX).optional()
 };
 var newComplaintObject = external_exports.strictObject(newComplaintShape);
 function withDefaults(input2) {
@@ -23906,6 +23980,23 @@ function newTokenSchema(now) {
     ...input2.expiresAt === void 0 ? {} : { expiresAt: input2.expiresAt }
   }));
 }
+function reportedField(max) {
+  const message = lengthMessage(1, max);
+  return external_exports.string({ message }).trim().min(1, { message }).max(max, { message }).refine((value) => !CLI_LOGIN_CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
+}
+var newCliLoginSchema = external_exports.strictObject({
+  host: reportedField(CLI_LOGIN_HOST_MAX),
+  os: reportedField(CLI_LOGIN_OS_MAX),
+  version: reportedField(CLI_LOGIN_VERSION_MAX)
+}).transform((input2) => ({
+  host: input2.host,
+  os: input2.os,
+  version: input2.version
+}));
+var LOGIN_KEY_MESSAGE = "must be 43 base64url characters";
+var cliLoginPollSchema = external_exports.strictObject({
+  loginKey: external_exports.string({ message: LOGIN_KEY_MESSAGE }).regex(CLI_LOGIN_KEY_RE, { message: LOGIN_KEY_MESSAGE })
+}).transform((input2) => ({ loginKey: input2.loginKey }));
 var UNKNOWN_KEY_MESSAGE = "unknown key";
 var emptyBodySchema = external_exports.strictObject({});
 function formatIssues(error62) {
@@ -24756,6 +24847,7 @@ var TOO_MANY_LINE = "Too many attempts. Try again later.";
 var WRONG_CODE_LINE = "Wrong code.";
 var EXPIRED_CODE_LINE = "That code has expired. Request a new one.";
 var PASSWORD_POLICY_LINE = "Use at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol.";
+var BROWSER_REFUSED_LINE = "the browser approval could not be used: run quibble login again";
 var UNREACHABLE_TYPE = "Unreachable";
 var INCORRECT_CREDENTIALS_MESSAGE = "Incorrect username or password.";
 var CognitoError = class extends RemoteError {
@@ -24772,14 +24864,15 @@ var CognitoError = class extends RemoteError {
 function endpointUrl(region) {
   return `https://cognito-idp.${region}.amazonaws.com/`;
 }
-function errorLineOf(type, detail2, signIn2) {
+function errorLineOf(type, detail2, step) {
   switch (type) {
     case UNREACHABLE_TYPE:
       return UNREACHABLE_LINE;
     case "UserNotFoundException":
-      return signIn2 ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      return step === "sign-in" ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "NotAuthorizedException":
-      return signIn2 && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
+      if (step === "browser") return BROWSER_REFUSED_LINE;
+      return step === "sign-in" && detail2 === INCORRECT_CREDENTIALS_MESSAGE ? WRONG_CREDENTIALS_LINE : detail2 ?? type;
     case "LimitExceededException":
     case "TooManyRequestsException":
     case "TooManyFailedAttemptsException":
@@ -24800,7 +24893,7 @@ function typeOf(value) {
   const hash2 = value.indexOf("#");
   return hash2 === -1 ? value : value.slice(hash2 + 1);
 }
-async function call(endpoint, operation, body, signIn2 = false) {
+async function call(endpoint, operation, body, step = "other") {
   const url2 = endpointUrl(endpoint.region);
   const send2 = endpoint.fetch ?? globalThis.fetch;
   const site = {
@@ -24812,7 +24905,7 @@ async function call(endpoint, operation, body, signIn2 = false) {
     throw new CognitoError(
       type,
       detail2,
-      errorLineOf(type, detail2, signIn2),
+      errorLineOf(type, detail2, step),
       detail(site, status)
     );
   };
@@ -24895,14 +24988,27 @@ function authAnswerOf(body) {
     }
   };
 }
+function flowOf(input2) {
+  switch (input2.flow) {
+    case "USER_PASSWORD_AUTH":
+      return {
+        parameters: { USERNAME: input2.username, PASSWORD: input2.password },
+        step: "sign-in"
+      };
+    case "REFRESH_TOKEN_AUTH":
+      return { parameters: { REFRESH_TOKEN: input2.refreshToken }, step: "other" };
+    case "CUSTOM_AUTH":
+      return { parameters: { USERNAME: input2.username }, step: "browser" };
+  }
+}
 async function initiateAuth(endpoint, input2) {
-  const parameters = input2.flow === "USER_PASSWORD_AUTH" ? { USERNAME: input2.username, PASSWORD: input2.password } : { REFRESH_TOKEN: input2.refreshToken };
+  const { parameters, step } = flowOf(input2);
   return authAnswerOf(
     await call(
       endpoint,
       "InitiateAuth",
       { ClientId: input2.clientId, AuthFlow: input2.flow, AuthParameters: parameters },
-      input2.flow === "USER_PASSWORD_AUTH"
+      step
     )
   );
 }
@@ -24917,6 +25023,22 @@ async function respondToAuthChallenge(endpoint, input2) {
     })
   );
 }
+async function respondToCustomChallenge(endpoint, input2) {
+  const username = input2.challenge.challengeParameters["USERNAME"] ?? input2.username;
+  return authAnswerOf(
+    await call(
+      endpoint,
+      "RespondToAuthChallenge",
+      {
+        ClientId: input2.clientId,
+        ChallengeName: input2.challenge.challengeName,
+        Session: input2.challenge.session,
+        ChallengeResponses: { USERNAME: username, ANSWER: input2.answer }
+      },
+      "browser"
+    )
+  );
+}
 async function revokeToken(endpoint, input2) {
   await call(endpoint, "RevokeToken", { ClientId: input2.clientId, Token: input2.token });
 }
@@ -25350,7 +25472,7 @@ function resolveEndpointSource(options, project, user) {
   };
 }
 function resolveContext(options) {
-  const project = findProjectConfig(options.cwd);
+  const project = options.readProjectConfig === false ? void 0 : findProjectConfig(options.cwd);
   const user = loadUserConfig(options.env);
   const { mode, endpoint, endpointSource, localFix } = resolveEndpointSource(
     options,
@@ -25591,7 +25713,7 @@ function readComplaint(body) {
     throw new RemoteError(NOT_A_COMPLAINT, { cause: error62 });
   }
 }
-var ApiClient = class {
+var ApiClient = class _ApiClient {
   endpoint;
   /** The organization of every org-scoped path, when the command resolved one. */
   org;
@@ -25639,6 +25761,19 @@ var ApiClient = class {
     if (this.org === void 0) throw new ConfigError(NO_ORG_MESSAGE);
     return `/v1/orgs/${encodeURIComponent(this.org)}`;
   }
+  /**
+   * The same client for one organization, with the same authorizer, so a
+   * command that learns the organization from `GET /v1/me` reads the auth
+   * config and refreshes a session once. It runs no `beforeFirst`.
+   */
+  forOrg(org) {
+    return new _ApiClient({
+      endpoint: this.endpoint,
+      authorizer: this.#auth,
+      org,
+      ...this.#http
+    });
+  }
   /** Reads the caller's own identity. */
   async me() {
     return parseMe(await this.request("GET", "/v1/me"));
@@ -25666,6 +25801,18 @@ var ApiClient = class {
   async project(name) {
     return readProject(await this.request("GET", this.projectPath(name)), name);
   }
+  /**
+   * Creates a project, or restores a deleted one of that name (section 7.5).
+   * The route needs `admin`, and answers `201` with the record.
+   */
+  async createProject(name, tags) {
+    const body = await this.request(
+      "POST",
+      `${this.orgPath()}/projects`,
+      JSON.stringify({ project: name, ...tags === void 0 ? {} : { tags } })
+    );
+    return readProject(body, name);
+  }
   /**
    * Replaces the allowed tag list of a project, or clears it with `null`. The
    * route retags the stored complaints and answers how many it rewrote.
@@ -26229,7 +26376,9 @@ function projectOf(entry) {
 }
 function headlineOfEntry(entry) {
   const message = entry.body["message"];
-  return typeof message === "string" ? printable(summarize(message)) : "?";
+  if (typeof message !== "string") return '"?"';
+  const headline = summarize(message);
+  return findSecret(headline) === void 0 ? `"${printable(headline)}"` : `key ${printable(entry.key)}`;
 }
 function queuedCount(n) {
   return `${n} queued ${n === 1 ? "complaint" : "complaints"}`;
@@ -26300,7 +26449,7 @@ async function flushQueue(options) {
       result.dropped += 1;
       writeLine(
         options.stderr,
-        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, "${headlineOfEntry(entry)}": ${printable(message)}`
+        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, ${headlineOfEntry(entry)}: ${printable(message)}`
       );
     }
     return result;
@@ -26552,6 +26701,75 @@ async function runConfig(options, context, io) {
 import { existsSync as existsSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename2, join as join7, resolve as resolve3 } from "node:path";
 
+// src/git.ts
+import { spawn as nodeSpawn } from "node:child_process";
+var GIT_TIMEOUT_MS = 5e3;
+var ORIGIN_ARGS = ["remote", "get-url", "origin"];
+function nodeGit(options = {}) {
+  const spawn = options.spawn ?? nodeSpawn;
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUT_MS;
+  return {
+    originUrl(cwd) {
+      return new Promise((resolve4) => {
+        let settled = false;
+        let child;
+        let output2 = "";
+        const settle2 = (url2) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          resolve4(url2);
+        };
+        const timer = setTimeout(() => {
+          settle2(void 0);
+          child?.kill();
+        }, timeoutMs);
+        timer.unref();
+        try {
+          child = spawn("git", [...ORIGIN_ARGS], {
+            cwd,
+            shell: false,
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true
+          });
+        } catch {
+          settle2(void 0);
+          return;
+        }
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+          output2 += chunk;
+        });
+        child.on("error", () => {
+          settle2(void 0);
+        });
+        child.on("close", (code2) => {
+          const url2 = output2.trim();
+          settle2(code2 === 0 && url2 !== "" ? url2 : void 0);
+        });
+      });
+    }
+  };
+}
+function remoteSegment(url2) {
+  let rest = url2.trim();
+  if (rest.endsWith("/")) rest = rest.slice(0, -1);
+  if (rest.endsWith(".git")) rest = rest.slice(0, -".git".length);
+  const slash = rest.lastIndexOf("/");
+  const colon = rest.lastIndexOf(":");
+  const scpLike = !rest.includes("://") && colon > slash;
+  return rest.slice((scpLike ? colon : slash) + 1);
+}
+function projectOfRemote(url2) {
+  const segment = remoteSegment(url2);
+  if (segment === "") return void 0;
+  try {
+    return parseProjectName(segment);
+  } catch {
+    return void 0;
+  }
+}
+
 // src/hook.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname5, join as join5 } from "node:path";
@@ -26624,11 +26842,13 @@ var DEFAULT_SNIPPET_AGENT = "claude";
 var AGENTS_FILE_AGENT = "codex";
 var SNIPPET_INTRO = `This project uses Quibble. When the build, tests, docs or tooling waste your
 time, file a complaint instead of quietly working around the problem.`;
+var SNIPPET_SECRETS = "- Never paste secrets, tokens or .env lines into a complaint; Quibble refuses them.";
 var SNIPPET_USAGE = `- Set severity with \`-s low|medium|high\`. Add tags with \`-t <tag>\` (repeatable).
 - Put a one-line summary first; it is the headline everywhere. Add details below.
 - Name the command that failed with \`--cmd "<command>"\`.
 - Pipe a long message on stdin with \`quibble complain -\`.
-- File one complaint per problem, as soon as you hit it, not at the end of the task.`;
+- File one complaint per problem, as soon as you hit it, not at the end of the task.
+${SNIPPET_SECRETS}`;
 var SKILL_FRONT_MATTER = `---
 name: quibble
 description: File a Quibble complaint when the build, tests, docs or tooling of this project waste your time. Use it as soon as you hit the problem, not at the end of the task.
@@ -26746,826 +26966,1273 @@ function refreshedLine(project, tags) {
   return `${lead} tag each complaint with ${orList(tags)}, or ${OTHER_TAG_PREFIX}<name> when none fits.`;
 }
 
-// src/commands/snippet.ts
-import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
-function existsError(path) {
-  return new UsageError(`${path} already exists: pass --force to overwrite it`);
-}
-function readOptional2(path) {
-  try {
-    return readFileSync5(path, "utf8");
-  } catch (error62) {
-    if (isNotFound(error62)) return "";
-    throw error62;
-  }
-}
-function writeSkill(path, snippet) {
-  mkdirSync5(dirname6(path), { recursive: true });
-  writeFileSync4(path, skillFile(snippet), "utf8");
+// src/commands/login.ts
+import { hostname as hostname4 } from "node:os";
+
+// src/opener.ts
+import { spawn as nodeSpawn2 } from "node:child_process";
+var OPEN_TIMEOUT_MS = 5e3;
+var OPENABLE_URL_RE = /^https?:\/\/[A-Za-z0-9.:[\]-]+(?:\/[A-Za-z0-9/?=._~-]*)?$/;
+function isWsl(platform, env) {
+  if (platform !== "linux") return false;
+  const set2 = (name) => (env[name] ?? "") !== "";
+  return set2("WSL_DISTRO_NAME") || set2("WSL_INTEROP");
+}
+function openCommands(url2, platform, env) {
+  if (platform === "darwin") return [{ command: "open", args: [url2] }];
+  if (platform === "win32") {
+    return [{ command: "cmd", args: ["/c", "start", "", url2] }];
+  }
+  if (isWsl(platform, env)) {
+    return [
+      { command: "wslview", args: [url2] },
+      { command: "cmd.exe", args: ["/c", "start", "", url2] }
+    ];
+  }
+  return [{ command: "xdg-open", args: [url2] }];
+}
+function attempt(spawn, entry, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const settle2 = (opened) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(opened);
+    };
+    const timer = setTimeout(() => {
+      settle2(false);
+    }, timeoutMs);
+    timer.unref();
+    let child;
+    try {
+      child = spawn(entry.command, entry.args, {
+        shell: false,
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch {
+      settle2(false);
+      return;
+    }
+    child.on("error", () => {
+      settle2(false);
+    });
+    child.on("exit", (code2) => {
+      settle2(code2 === 0);
+    });
+    child.unref();
+  });
 }
-async function snippetSource(project, context, io, options = {}) {
-  let tags;
-  if (context.mode === "remote") {
-    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
-  } else {
-    checkActAs(context);
-    tags = context.allowedTags;
-  }
-  const scope = {
-    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
-    ...context.slug === void 0 ? {} : { org: context.slug }
+function platformOpener(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const spawn = options.spawn ?? nodeSpawn2;
+  const timeoutMs = options.timeoutMs ?? OPEN_TIMEOUT_MS;
+  return {
+    async open(url2) {
+      if (!OPENABLE_URL_RE.test(url2)) return false;
+      for (const entry of openCommands(url2, platform, env)) {
+        if (await attempt(spawn, entry, timeoutMs)) return true;
+      }
+      return false;
+    }
   };
-  return { tags, scope };
 }
-async function runSnippet(options, context, io) {
-  const project = requireProject(context);
-  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
-  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
-  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
-  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
-  if (options.append !== void 0 && hasSnippet(existing)) {
-    throw new UsageError(
-      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
-    );
-  }
-  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
-    throw existsError(skillPath);
-  }
-  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
-  const { tags, scope } = await snippetSource(project, context, io);
-  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
-  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
-  if (appendPath !== void 0) {
-    const agent = override ?? agentForFile(appendPath);
-    const snippet = agentSnippet(tags, { ...scope, agent });
-    const kept = existing.replace(/\s+$/, "");
-    writeFileSync4(appendPath, kept === "" ? `${snippet}
-` : `${kept}
 
-${snippet}
-`);
-    shown = { agent, snippet };
-  }
-  if (skillPath !== void 0) {
-    const agent = override ?? DEFAULT_SNIPPET_AGENT;
-    const snippet = agentSnippet(tags, { ...scope, agent });
-    writeSkill(skillPath, snippet);
-    if (appendPath === void 0) shown = { agent, snippet };
+// src/terminal.ts
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+var NodeTerminal = class {
+  isTTY;
+  #input;
+  #output;
+  #rl;
+  /**
+   * True unless a visible prompt is waiting, so a line that arrives early,
+   * a pasted password after the email for one, echoes nowhere.
+   */
+  #muted = true;
+  /** Lines that arrived before a prompt asked for them. */
+  #lines = [];
+  #waiting;
+  #closed = false;
+  constructor(input2, output2) {
+    this.#input = input2;
+    this.#output = output2;
+    this.isTTY = input2.isTTY === true;
   }
-  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
-  if (options.json === true) {
-    writeJson(io.stdout, {
-      snippet: shown.snippet,
-      agent: shown.agent,
-      appended: appendPath ?? null,
-      skill: skillPath ?? null,
-      hook: hook?.path ?? null
-    });
-    return 0;
+  prompt(label) {
+    return this.#read(label, false);
   }
-  if (appendPath === void 0 && skillPath === void 0) {
-    writeLine(io.stdout, shown.snippet);
+  promptHidden(label) {
+    return this.#read(label, true);
   }
-  if (appendPath !== void 0) {
-    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
+  close() {
+    this.#closed = true;
+    this.#rl?.close();
+    this.#rl = void 0;
   }
-  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
-  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
-  return 0;
-}
-
-// src/commands/init.ts
-var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
-function agentLead(agent) {
-  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
-}
-async function runInit(options, io) {
-  const directory = resolve3(io.cwd);
-  const path = join7(directory, PROJECT_CONFIG_FILENAME);
-  if (existsSync2(path) && options.force !== true) {
-    throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
+  /** The one interface, created on the first prompt. */
+  #interface() {
+    if (this.#rl !== void 0) return this.#rl;
+    const output2 = this.#output;
+    const sink2 = new Writable({
+      write: (chunk, _encoding, done) => {
+        if (!this.#muted) output2.write(chunk);
+        done();
+      }
+    });
+    Object.defineProperties(sink2, {
+      columns: { get: () => output2.columns },
+      rows: { get: () => output2.rows }
+    });
+    const rl = createInterface({
+      input: this.#input,
+      output: sink2,
+      terminal: true,
+      // No answer enters the history, so an arrow key recalls no password.
+      historySize: 0
+    });
+    rl.on("line", (line) => {
+      this.#muted = true;
+      if (this.#waiting !== void 0) {
+        const settle2 = this.#waiting;
+        this.#waiting = void 0;
+        settle2(line);
+        return;
+      }
+      this.#lines.push(line);
+    });
+    rl.on("close", () => {
+      this.#closed = true;
+      this.#waiting?.("");
+      this.#waiting = void 0;
+    });
+    rl.on("SIGINT", () => {
+      this.close();
+      this.#output.write("\n");
+      process.kill(process.pid, "SIGINT");
+    });
+    this.#rl = rl;
+    return rl;
   }
-  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
-  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
-    throw existsError(skillPath);
+  /** Waits for the next line, which a paste may have delivered already. */
+  #next() {
+    const queued = this.#lines.shift();
+    if (queued !== void 0) return Promise.resolve(queued);
+    if (this.#closed) return Promise.resolve("");
+    return new Promise((resolve4) => {
+      this.#waiting = resolve4;
+    });
   }
-  const project = resolveProjectName(options.project, directory);
-  const org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
-  const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
-  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
-  const hook = options.hook === true ? planHook(directory) : void 0;
-  const endpoint = await endpointToWrite(options.endpoint, io);
-  const config2 = {
-    project,
-    ...org === void 0 ? {} : { org },
-    ...endpoint === void 0 ? {} : { endpoint },
-    ...tags === void 0 ? {} : { tags }
-  };
-  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
-`, "utf8");
-  const context = {
-    ...resolveContext({
-      cwd: io.cwd,
-      env: io.env,
-      endpoint: options.endpoint,
-      org: options.org,
-      local: options.local
-    }),
-    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
-    actAs: void 0
-  };
-  const snippet = agentSnippet(tags, {
-    agent,
-    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
-    ...org === void 0 ? {} : { org }
-  });
-  if (skillPath !== void 0) writeSkill(skillPath, snippet);
-  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
-  const check2 = await checkServer(context, project, io);
-  if (options.json === true) {
-    writeJson(io.stdout, {
-      path,
-      project,
-      org: org ?? null,
-      tags: tags ?? null,
-      skill: skillPath ?? null,
-      hook: hook?.path ?? null,
-      server: check2.server
+  async #read(label, hidden) {
+    if (this.#closed) return "";
+    const rl = this.#interface();
+    if (hidden) {
+      this.#output.write(`${label} `);
+      rl.setPrompt("");
+      rl.prompt();
+      try {
+        return await this.#next();
+      } finally {
+        this.#output.write("\n");
+      }
+    }
+    const queued = this.#lines.shift();
+    if (queued !== void 0) {
+      this.#output.write(`${label} ${queued}
+`);
+      return queued;
+    }
+    rl.setPrompt(`${label} `);
+    this.#muted = false;
+    rl.prompt();
+    try {
+      return await this.#next();
+    } finally {
+      this.#muted = true;
+    }
+  }
+};
+function nodeTerminal(input2, output2) {
+  return new NodeTerminal(input2, output2);
+}
+
+// src/commands/login.ts
+var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
+var NEEDS_TERMINAL_MESSAGE = "quibble login --password needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var CI_MESSAGE = "quibble login needs a person to approve it in a browser: in CI, set QUIBBLE_TOKEN instead";
+var NO_BROWSER_MESSAGE = "--no-browser applies to the browser login only";
+var DENIED_MESSAGE = "login was denied in the browser";
+var EXPIRED_MESSAGE = "the login request expired: run quibble login again";
+var MALFORMED_MESSAGE = "the API answered a malformed login request";
+var UNKNOWN_STATUS_MESSAGE = "the API answered an unknown login status";
+var MFA_NEEDS_TERMINAL_MESSAGE = "this account needs a two-factor code: run quibble login in a terminal";
+var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
+var CUSTOM_CHALLENGE = "CUSTOM_CHALLENGE";
+var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
+var CLI_LOGINS_PATH = "/v1/cli-logins";
+var CLI_LOGIN_POLL_PATH = "/v1/cli-logins/poll";
+var MIN_INTERVAL_SECONDS = 1;
+var MAX_INTERVAL_SECONDS = 30;
+var PLAIN_HOST_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::[0-9]+)?$/;
+var LOGIN_PAGE = "/login";
+var ORGS_PAGE = "/orgs";
+var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
+function localModeLine(endpoint) {
+  return `${endpoint} is in local mode: no login needed.`;
+}
+function terminalOf(io) {
+  return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
+}
+function clockOf2(io) {
+  return io.now ?? (() => /* @__PURE__ */ new Date());
+}
+function sleepOf(io) {
+  return io.sleep ?? ((ms) => new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  }));
+}
+function ciIsSet(env) {
+  const value = (env["CI"] ?? "").trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false";
+}
+async function answer(terminal, label, hidden = false) {
+  const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
+  const value = hidden ? text : text.trim();
+  if (value === "")
+    throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
+  return value;
+}
+function unsupportedStep(name) {
+  return new RemoteError(
+    `this account needs a sign-in step that quibble doesn't support (${name})`
+  );
+}
+function pageError(error62, webUrl) {
+  if (error62 instanceof CognitoError) {
+    const page = `${trimSlash2(webUrl)}${LOGIN_PAGE}`;
+    if (error62.type === "PasswordResetRequiredException") {
+      return new ConfigError(`reset your password at ${page}`);
+    }
+    if (error62.type === "UserNotConfirmedException") {
+      return new ConfigError(`finish your sign-up at ${page}`);
+    }
+  }
+  return error62;
+}
+async function signIn(terminal, identity, config2) {
+  const email3 = await answer(terminal, "Email:");
+  const password = await answer(terminal, "Password:", true);
+  const clientId = config2.cliClientId;
+  try {
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "USER_PASSWORD_AUTH",
+      username: email3,
+      password
     });
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      const code2 = await answer(terminal, "Code:");
+      result = await respondToAuthChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        email: email3,
+        code: code2
+      });
+    }
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name === NEW_PASSWORD_CHALLENGE) {
+        throw new ConfigError(
+          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
+        );
+      }
+      throw unsupportedStep(name);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
+  }
+}
+async function runLogin(options, context, io) {
+  requireServer("login", context);
+  if (options.password === true) {
+    if (options.browser === false) throw new UsageError(NO_BROWSER_MESSAGE);
+    return passwordLogin(options, context, io);
+  }
+  return browserLogin(options, context, io);
+}
+async function passwordLogin(options, context, io) {
+  const terminal = terminalOf(io);
+  if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const http = { debug: context.debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") {
+    writeLine(io.stdout, localModeLine(endpoint));
     return 0;
   }
-  writeLine(io.stdout, `Wrote ${path}`);
-  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
-  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
-  writeLine(io.stdout, `Project: ${project}`);
-  if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
-  if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
-  writeLine(io.stdout);
-  writeLine(io.stdout, agentLead(agent));
-  writeLine(io.stdout);
-  writeLine(io.stdout, snippet);
-  if (agent === DEFAULT_SNIPPET_AGENT) {
-    writeLine(io.stdout);
-    writeLine(io.stdout, CODEX_LINE);
+  let tokens;
+  try {
+    tokens = await signIn(terminal, { region: config2.region, ...http }, config2);
+  } finally {
+    terminal.close();
   }
-  if (check2.line !== void 0) {
-    writeLine(io.stdout);
-    writeLine(io.stdout, check2.line);
+  const me = await storeSession(tokens, endpoint, config2, http, io);
+  return reportLogin(me, endpoint, options, context, io);
+}
+async function browserLogin(options, context, io) {
+  if (ciIsSet(io.env)) throw new UsageError(CI_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const session = await browserSession(endpoint, options, context.debug, io);
+  if (session === void 0) {
+    writeLine(io.stdout, localModeLine(endpoint));
+    return 0;
   }
-  return 0;
+  return reportLogin(session.me, endpoint, options, context, io);
 }
-async function endpointToWrite(given, io) {
-  if (given === void 0 || given.trim() === "") return void 0;
-  const value = parseEndpoint(given, "--endpoint");
-  if (value.kind === "local") return LOCAL_ENDPOINT;
-  const api = await discoverApiUrl(value.url, {
-    fetch: io.fetch,
-    debug: debugEnabled(io.env)
+async function browserSession(endpoint, options, debug, io) {
+  const http = { debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") return void 0;
+  const clock = clockOf2(io);
+  const started = await startLogin(endpoint, config2.webUrl, http, {
+    host: cliLoginHost((io.hostname ?? hostname4)()),
+    os: process.platform,
+    version: options.version
   });
-  return isDefaultEndpoint(api) ? void 0 : api;
+  const deadline = clock().getTime() + (CLI_LOGIN_TTL_SECONDS + started.interval) * 1e3;
+  writeLine(
+    io.stderr,
+    `Approve this login in your browser: ${started.url} (code ${started.code}). Waiting...`
+  );
+  if (options.browser !== false) {
+    const opener = io.opener ?? platformOpener({ env: io.env });
+    void opener.open(started.url).catch(() => false);
+  }
+  const approval = await waitForApproval(endpoint, started, deadline, http, io);
+  const tokens = await browserSignIn(
+    { region: config2.region, ...http },
+    config2,
+    approval,
+    io
+  );
+  const me = await storeSession(tokens, endpoint, config2, http, io);
+  return { me, webUrl: config2.webUrl };
 }
-async function checkServer(context, project, io) {
-  const org = context.org;
-  if (context.mode !== "remote" || org === void 0) return { server: "unchecked" };
-  const endpoint = await resolveEndpoint(context, io);
-  if (context.token === void 0 && context.credential === void 0 && !isLoopbackUrl(endpoint)) {
-    return { server: "unchecked" };
+function postJson(url2, body, http) {
+  return send(url2, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    ...http
+  });
+}
+async function startLogin(endpoint, webUrl, http, body) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGINS_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  const response = await postJson(url2, body, http);
+  const text = await readText(response, site);
+  if (response.status === 404) {
+    throw new RemoteError(
+      `${endpoint} does not support the browser login: run quibble login --password${detail(site, 404)}`,
+      { status: 404 }
+    );
   }
-  const warn = (text) => {
-    writeLine(io.stderr, `quibble: warning: ${text}`);
-  };
+  if (!response.ok) throw remoteFailure(site, response, text);
+  const started = checkStart(asRecord(parseQuietly(text)), webUrl);
+  if (started === void 0) {
+    throw new RemoteError(`${MALFORMED_MESSAGE}${detail(site, response.status)}`);
+  }
+  return started;
+}
+function checkStart(body, webUrl) {
+  const loginKey = body?.["loginKey"];
+  const code2 = body?.["code"];
+  const url2 = body?.["url"];
+  if (typeof loginKey !== "string" || !CLI_LOGIN_KEY_RE.test(loginKey)) return void 0;
+  if (typeof code2 !== "string" || typeof url2 !== "string") return void 0;
   try {
-    await (await openClient(context, io, { queue: false })).project(project);
-    return { server: "found", line: `Project ${org}/${project} exists on ${endpoint}.` };
-  } catch (error62) {
-    if (error62 instanceof RemoteError && error62.status === 404) {
-      if (error62.serverCode === ORG_NOT_FOUND) {
-        warn(`no organization ${org} on ${endpoint} for this account`);
-        return { server: "no_org" };
+    if (parseCliLoginCode(code2) !== code2) return void 0;
+  } catch {
+    return void 0;
+  }
+  let origin;
+  try {
+    const web = new URL(webUrl);
+    const secure = web.protocol === "https:" || web.protocol === "http:" && isLoopbackUrl(web.origin);
+    if (!secure || !PLAIN_HOST_RE.test(web.host)) return void 0;
+    origin = web.origin;
+  } catch {
+    return void 0;
+  }
+  if (url2 !== cliLoginUrl(origin, code2)) return void 0;
+  const raw = body?.["interval"];
+  const interval = typeof raw === "number" && Number.isInteger(raw) ? Math.min(MAX_INTERVAL_SECONDS, Math.max(MIN_INTERVAL_SECONDS, raw)) : CLI_LOGIN_POLL_SECONDS;
+  return { loginKey, code: code2, url: url2, interval };
+}
+async function waitForApproval(endpoint, started, deadline, http, io) {
+  const clock = clockOf2(io);
+  const sleep = sleepOf(io);
+  for (; ; ) {
+    await sleep(started.interval * 1e3);
+    if (clock().getTime() > deadline) throw new ConfigError(EXPIRED_MESSAGE);
+    const answer2 = await poll(endpoint, started.loginKey, http);
+    if (answer2 === void 0) continue;
+    const status = answer2["status"];
+    switch (status) {
+      case "pending":
+        continue;
+      case "denied":
+        throw new ConfigError(DENIED_MESSAGE);
+      case "expired":
+        throw new ConfigError(EXPIRED_MESSAGE);
+      case "approved": {
+        const username = answer2["username"];
+        const secret = answer2["secret"];
+        if (typeof username !== "string" || username === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        if (typeof secret !== "string" || secret === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        return { username, secret };
       }
-      warn(
-        `${org} has no project ${project} on ${endpoint}: an admin creates it in the organization settings`
-      );
-      return { server: "no_project" };
+      default:
+        throw new RemoteError(UNKNOWN_STATUS_MESSAGE);
     }
-    warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
-    return { server: "unreachable" };
   }
 }
-function resolveProjectName(given, directory) {
-  const candidate = given?.trim();
-  if (candidate !== void 0 && candidate !== "") return parseProjectName(candidate);
-  const name = basename2(directory);
+async function poll(endpoint, loginKey, http) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGIN_POLL_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  let response;
+  let text;
   try {
-    return parseProjectName(name);
+    response = await postJson(url2, { loginKey }, http);
+    text = await readText(response, site);
   } catch (error62) {
-    throw new ConfigError(
-      `cannot use the directory name "${name}" as a project name: pass --project <name>`,
-      void 0,
-      { cause: error62 }
-    );
+    if (error62 instanceof RemoteError && error62.unanswered) return void 0;
+    throw error62;
+  }
+  if (!response.ok) {
+    if (response.status >= 500 || response.status === 429) return void 0;
+    throw remoteFailure(site, response, text);
   }
+  return asRecord(parseJson(text, site, response.status)) ?? {};
 }
-
-// src/mine.ts
-function mineMessage(env) {
-  return `--mine needs a reporter: set "reporter" in ${defaultConfigPath(env)}`;
+async function browserSignIn(identity, config2, approval, io) {
+  const clientId = config2.cliClientId;
+  try {
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "CUSTOM_AUTH",
+      username: approval.username
+    });
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name !== CUSTOM_CHALLENGE) throw unsupportedStep(name);
+      result = await respondToCustomChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        username: approval.username,
+        answer: approval.secret
+      });
+    }
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      result = await answerCode(
+        identity,
+        clientId,
+        result.challenge,
+        approval.username,
+        io
+      );
+    }
+    if (result.kind === "challenge") {
+      throw unsupportedStep(result.challenge.challengeName);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
+  }
 }
-async function resolveMine(context, client, env) {
-  if (client === void 0) {
-    if (context.reporter === DEFAULT_REPORTER) throw new UsageError(mineMessage(env));
-    return context.reporter;
+async function answerCode(identity, clientId, challenge, username, io) {
+  const terminal = terminalOf(io);
+  try {
+    if (!terminal.isTTY) throw new ConfigError(MFA_NEEDS_TERMINAL_MESSAGE);
+    const code2 = await answer(terminal, "Code:");
+    return await respondToAuthChallenge(identity, {
+      clientId,
+      challenge,
+      email: username,
+      code: code2
+    });
+  } finally {
+    terminal.close();
   }
-  return (await client.me()).reporter;
 }
-
-// src/since.ts
-var SINCE_MESSAGE = "--since must be a duration like 7d, a date like 2026-09-01, or an ISO 8601 UTC timestamp";
-var DURATION_RE = /^(\d+)(m|h|d|w)$/;
-var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
-var MINUTE_MS = 6e4;
-var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS3 = 24 * HOUR_MS;
-var UNIT_MS = {
-  m: MINUTE_MS,
-  h: HOUR_MS,
-  d: DAY_MS3,
-  w: 7 * DAY_MS3
-};
-var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
-function reject(message = SINCE_MESSAGE) {
-  throw new UsageError(message);
-}
-function iso(at) {
-  if (Number.isNaN(at.getTime())) reject();
-  return at.toISOString();
-}
-function durationMs(digits, unit) {
-  if (digits.startsWith("0")) return void 0;
-  const step = UNIT_MS[unit];
-  return step === void 0 ? void 0 : Number(digits) * step;
+async function storeSession(tokens, endpoint, config2, http, io) {
+  if (tokens.refreshToken === void 0) {
+    throw new RemoteError("sign-in didn't return a refresh token");
+  }
+  const now = clockOf2(io)();
+  const me = await readProfile(
+    new ApiClient({
+      endpoint,
+      authorizer: bearerAuthorizer(tokens.accessToken),
+      ...http
+    }),
+    config2.webUrl
+  );
+  if (me.sub === void 0 || me.email === void 0) {
+    throw new RemoteError(
+      "unexpected response from the API: identity has no sub or email"
+    );
+  }
+  saveCredential(io.env, {
+    endpoint,
+    refreshToken: tokens.refreshToken,
+    accessToken: tokens.accessToken,
+    expiresAt: new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString(),
+    sub: me.sub,
+    email: me.email
+  });
+  return me;
 }
-function fromDuration(digits, unit, now) {
-  const span = durationMs(digits, unit);
-  if (span === void 0) reject();
-  return iso(new Date(now.getTime() - span));
+function reportLogin(me, endpoint, options, context, io) {
+  const saved = saveEndpoint(context, endpoint, io.env);
+  if (options.json === true) {
+    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
+    return 0;
+  }
+  writeLine(io.stdout, loggedInLine(endpoint, me));
+  if (saved !== void 0) {
+    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+  }
+  return 0;
 }
-function fromDate(value) {
-  const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
-  const stamp2 = iso(at);
-  if (!stamp2.startsWith(value)) reject();
-  return stamp2;
+function loggedInLine(endpoint, me) {
+  return `Logged in to ${endpoint} as ${me.email ?? me.reporter}.`;
 }
-function parseSince(text, now) {
-  const value = text.trim();
-  const duration3 = DURATION_RE.exec(value);
-  if (duration3 !== null) {
-    return fromDuration(duration3[1] ?? "", duration3[2] ?? "", now);
+function saveEndpoint(context, endpoint, env) {
+  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
+    return void 0;
   }
-  if (DATE_RE.test(value)) return fromDate(value);
-  if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
-  return reject();
+  return rememberEndpoint(env, endpoint);
 }
-function parseExpires(text, now) {
-  const value = text.trim();
-  const duration3 = DURATION_RE.exec(value);
-  let stamp2;
+async function readProfile(client, webUrl) {
   try {
-    if (duration3 !== null) {
-      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
-      if (span === void 0) reject(EXPIRES_MESSAGE);
-      stamp2 = iso(new Date(now.getTime() + span));
-    } else if (DATE_RE.test(value)) {
-      stamp2 = fromDate(value);
-    } else if (TIMESTAMP_RE.test(value)) {
-      stamp2 = iso(new Date(value));
-    } else {
-      return reject(EXPIRES_MESSAGE);
+    return await client.me();
+  } catch (error62) {
+    if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
+      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
     }
-  } catch {
-    return reject(EXPIRES_MESSAGE);
+    throw error62;
   }
-  return stamp2;
 }
-
-// src/scope.ts
-function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
-  if (options.project !== void 0 && options.all === true) {
-    throw new UsageError("--project and --all cannot be used together");
+async function runLogout(context, io) {
+  requireServer("logout", context);
+  const endpoint = await resolveEndpoint(context, io);
+  const credential = findCredential(io.env, endpoint);
+  if (credential === void 0) {
+    writeLine(io.stdout, `Not logged in to ${endpoint}.`);
+    return 0;
   }
-  if (options.open === true && options.status !== void 0) {
-    throw new UsageError("--open and --status cannot be used together");
+  const http = { debug: context.debug, fetch: io.fetch };
+  if (!await revoke(endpoint, credential.refreshToken, http)) {
+    writeLine(
+      io.stderr,
+      `quibble: warning: could not revoke the refresh token at ${endpoint}`
+    );
   }
-  const project = options.project ?? (options.all === true ? void 0 : context.project);
-  const status = options.open === true ? "open" : options.status;
-  return {
-    // No list reads two organizations, because the path names one.
-    org: requireOrg(context),
-    ...project === void 0 ? {} : { project },
-    ...status === void 0 ? {} : { status },
-    ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
-  };
-}
-function tagFilter(tags) {
-  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
-}
-
-// src/commands/list.ts
-var COLUMNS = [
-  "id",
-  "created",
-  "severity",
-  "status",
-  "project",
-  "reporter",
-  "tags",
-  "group",
-  "summary"
-];
-var REPORTER_WIDTH = 20;
-var TAGS_WIDTH = 24;
-var SUMMARY_MAX = 60;
-var RECURRED_MARK = "\u21BB";
-function cut2(text, width) {
-  if (text.length <= width) return text;
-  return `${text.slice(0, width - 3)}...`;
-}
-function summaryOf(complaint) {
-  return cut2(printable(summarize(complaint.message)), SUMMARY_MAX);
+  removeCredential(io.env, endpoint);
+  writeLine(io.stdout, `Logged out of ${endpoint}.`);
+  return 0;
 }
-function limitNote(count, limit, more) {
-  if (limit >= MAX_LIMIT) {
-    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
+async function revoke(endpoint, refreshToken, http) {
+  try {
+    const config2 = await fetchAuthConfig(endpoint, http);
+    if (config2.mode === "local") return true;
+    await revokeToken(
+      { region: config2.region, ...http },
+      { clientId: config2.cliClientId, token: refreshToken }
+    );
+    return true;
+  } catch {
+    return false;
   }
-  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
 }
-var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
-async function runList(options, context, io) {
-  if (options.ids === true && options.json === true) {
-    throw new UsageError("--ids and --json cannot be used together");
-  }
-  const { store, client } = await openBackend(context, io);
-  const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
-  const filter = parseListFilter({
-    ...resolveScope(options, context),
-    ...options.severity === void 0 ? {} : { severity: options.severity },
-    ...tagFilter(options.tag),
-    ...options.search === void 0 ? {} : { q: options.search },
-    ...reporter === void 0 ? {} : { reporter },
-    ...options.limit === void 0 ? {} : { limit: options.limit }
-  });
-  const limit = filter.limit ?? DEFAULT_LIMIT;
-  const page = await listComplaintPage(store, {
-    ...filter,
-    limit: Math.min(limit + 1, MAX_LIMIT)
-  });
-  const complaints = page.complaints.slice(0, limit);
-  if (options.json === true) {
-    writeJson(io.stdout, complaints);
+async function runWhoami(options, context, io) {
+  if (context.mode === "local") {
+    checkActAs(context);
+    writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
     return 0;
   }
-  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
-  if (note !== void 0) writeLine(io.stderr, note);
-  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
-  if (options.ids === true) {
-    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
+  const client = await openClient(context, io);
+  const endpoint = requireEndpoint(context);
+  const me = await client.me();
+  const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      ...me.body,
+      endpoint,
+      ...org === void 0 ? {} : { org: org.body }
+    });
     return 0;
   }
-  if (complaints.length === 0) {
-    writeLine(io.stdout, "No complaints found.");
-    return 0;
+  const lines = whoamiLines(endpoint, me, org);
+  if (me.kind !== "token" && me.orgs.length === 0) {
+    const config2 = await fetchAuthConfig(endpoint, {
+      debug: context.debug,
+      fetch: io.fetch
+    });
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
+    lines.push("", `Create one at ${webUrl}${ORGS_PAGE}.`);
   }
-  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
-    groupComplaints(complaints).map((group) => ({
-      complaint: group.head,
-      group
-    }))
-  );
   for (const line of lines) writeLine(io.stdout, line);
   return 0;
 }
-function reporterOf(complaint) {
-  return cut2(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+function rows(pairs) {
+  const width = Math.max(...pairs.map(([key]) => key.length));
+  return pairs.map(([key, value]) => `${key.padEnd(width)}  ${value}`);
 }
-function groupCell(group) {
-  const count = group.count > 1 ? `\xD7${group.count}` : "";
-  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
+function block(entries) {
+  if (entries.length === 0) return ["  none"];
+  const width = Math.max(...entries.map(([key]) => key.length));
+  return entries.map(([key, value]) => `  ${key.padEnd(width)}  ${value}`);
 }
-function formatTable(rows2) {
-  const grouped = rows2.some((row) => row.group !== void 0);
-  const columns = COLUMNS.filter((name) => grouped || name !== "group");
-  const cells = rows2.map(({ complaint, group }) => {
-    const values = {
-      id: complaint.id.slice(0, 8),
-      created: complaint.createdAt.slice(0, 16),
-      severity: complaint.severity,
-      status: complaint.status,
-      project: complaint.project,
-      reporter: reporterOf(complaint),
-      tags: cut2(printable(complaint.tags.join(",")), TAGS_WIDTH),
-      group: group === void 0 ? "" : groupCell(group),
-      summary: summaryOf(complaint)
-    };
-    return columns.map((name) => values[name]);
-  });
-  const widths = columns.map(
-    (name, column) => cells.reduce(
-      (width, row) => Math.max(width, (row[column] ?? "").length),
-      name.length
-    )
-  );
-  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [format(columns), ...cells.map(format)];
+function whoamiLines(endpoint, me, org) {
+  if (me.kind === "token") {
+    return rows([
+      ["endpoint", endpoint],
+      ["token", me.name ?? me.reporter],
+      ["org", me.org ?? ""],
+      ["project", me.project ?? ""],
+      ["role", me.role ?? "filer"]
+    ]);
+  }
+  const lines = rows([
+    ["endpoint", endpoint],
+    ["email", me.email ?? ""],
+    ["name", me.name ?? ""],
+    ["sub", me.sub ?? ""],
+    ["platform", me.platform ? "yes" : "no"]
+  ]);
+  lines.push("", "Organizations");
+  lines.push(...block(me.orgs.map((entry) => [entry.org, entry.role])));
+  if (org === void 0) return lines;
+  lines.push("", `Roles in ${org.org}`);
+  lines.push(...block(org.roles.map((entry) => [entry.project, entry.role])));
+  return lines;
 }
 
-// src/commands/orgs.ts
-var ORGS_PAGE = "/orgs";
-var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
-async function runOrgs(options, context, io) {
-  requireServer("orgs", context);
-  const client = await openClient(context, io);
-  const endpoint = requireEndpoint(context);
-  const answer2 = await client.orgs();
-  if (options.json === true) {
-    writeJson(io.stdout, answer2.body);
-    return 0;
+// src/commands/snippet.ts
+import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
+function existsError(path) {
+  return new UsageError(`${path} already exists: pass --force to overwrite it`);
+}
+function readOptional2(path) {
+  try {
+    return readFileSync5(path, "utf8");
+  } catch (error62) {
+    if (isNotFound(error62)) return "";
+    throw error62;
   }
-  if (answer2.orgs.length === 0) {
-    const config2 = await fetchAuthConfig(endpoint, {
-      debug: context.debug,
-      fetch: io.fetch,
-      timeoutMs: context.timeoutMs
+}
+function writeSkill(path, snippet) {
+  mkdirSync5(dirname6(path), { recursive: true });
+  writeFileSync4(path, skillFile(snippet), "utf8");
+}
+async function snippetSource(project, context, io, options = {}) {
+  let tags;
+  if (context.mode === "remote") {
+    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
+  } else {
+    checkActAs(context);
+    tags = context.allowedTags;
+  }
+  const scope = {
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...context.slug === void 0 ? {} : { org: context.slug }
+  };
+  return { tags, scope };
+}
+async function runSnippet(options, context, io) {
+  const project = requireProject(context);
+  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
+  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
+  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
+  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
+  if (options.append !== void 0 && hasSnippet(existing)) {
+    throw new UsageError(
+      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
+    );
+  }
+  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
+  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
+  const { tags, scope } = await snippetSource(project, context, io);
+  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
+  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
+  if (appendPath !== void 0) {
+    const agent = override ?? agentForFile(appendPath);
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    const kept = existing.replace(/\s+$/, "");
+    writeFileSync4(appendPath, kept === "" ? `${snippet}
+` : `${kept}
+
+${snippet}
+`);
+    shown = { agent, snippet };
+  }
+  if (skillPath !== void 0) {
+    const agent = override ?? DEFAULT_SNIPPET_AGENT;
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    writeSkill(skillPath, snippet);
+    if (appendPath === void 0) shown = { agent, snippet };
+  }
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      snippet: shown.snippet,
+      agent: shown.agent,
+      appended: appendPath ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null
     });
-    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
-    writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE}.`);
     return 0;
   }
-  for (const line of formatOrgs(answer2.orgs)) writeLine(io.stdout, line);
+  if (appendPath === void 0 && skillPath === void 0) {
+    writeLine(io.stdout, shown.snippet);
+  }
+  if (appendPath !== void 0) {
+    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
+  }
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
   return 0;
 }
-function formatOrgs(orgs) {
-  const rows2 = [...orgs].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((entry) => [
-    entry.org,
-    entry.name,
-    entry.role,
-    entry.openCount === void 0 ? "" : String(entry.openCount)
-  ]);
-  const widths = COLUMNS2.map(
-    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
-  );
-  const format = (cells) => cells.map(
-    (cell2, column) => column === COLUMNS2.length - 1 ? cell2.padStart(widths[column] ?? 0) : cell2.padEnd(widths[column] ?? 0)
-  ).join("  ").trimEnd();
-  return [format(COLUMNS2), ...rows2.map(format)];
-}
 
-// src/terminal.ts
-import { createInterface } from "node:readline";
-import { Writable } from "node:stream";
-var NodeTerminal = class {
-  isTTY;
-  #input;
-  #output;
-  #rl;
-  /**
-   * True unless a visible prompt is waiting, so a line that arrives early,
-   * a pasted password after the email for one, echoes nowhere.
-   */
-  #muted = true;
-  /** Lines that arrived before a prompt asked for them. */
-  #lines = [];
-  #waiting;
-  #closed = false;
-  constructor(input2, output2) {
-    this.#input = input2;
-    this.#output = output2;
-    this.isTTY = input2.isTTY === true;
+// src/commands/init.ts
+var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
+var LOGIN_PAGE2 = "/login";
+var ORGS_PAGE2 = "/orgs";
+var CONFLICT = "conflict";
+function agentLead(agent) {
+  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
+}
+var SOURCE_NOTES = {
+  flag: "",
+  git: " (from the git remote origin)",
+  directory: " (from the directory name)",
+  token: " (from the project token)"
+};
+async function runInit(options, io) {
+  const directory = resolve3(io.cwd);
+  const path = join7(directory, PROJECT_CONFIG_FILENAME);
+  if (existsSync2(path) && options.force !== true) {
+    throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
   }
-  prompt(label) {
-    return this.#read(label, false);
+  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
+  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
   }
-  promptHidden(label) {
-    return this.#read(label, true);
+  const given = options.project?.trim();
+  const flagProject = given === void 0 || given === "" ? void 0 : parseProjectName(given);
+  let org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
+  const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
+  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
+  const hook = options.hook === true ? planHook(directory) : void 0;
+  const endpoint = await endpointToWrite(options.endpoint, io);
+  const context = {
+    ...resolveContext({
+      cwd: io.cwd,
+      env: io.env,
+      endpoint: options.endpoint,
+      local: options.local,
+      readProjectConfig: false
+    }),
+    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
+    actAs: void 0
+  };
+  let named;
+  let nameRefusal;
+  if (flagProject !== void 0) {
+    named = { project: flagProject, source: "flag" };
+  } else {
+    try {
+      named = await nameFromRepository(directory, io);
+    } catch (error62) {
+      if (!(error62 instanceof ConfigError) || context.token === void 0) throw error62;
+      nameRefusal = error62;
+    }
   }
-  close() {
-    this.#closed = true;
-    this.#rl?.close();
-    this.#rl = void 0;
+  let remote;
+  if (context.mode === "remote") {
+    const login = await logIn(context, options, io);
+    if (login === "local") return 0;
+    remote = login;
   }
-  /** The one interface, created on the first prompt. */
-  #interface() {
-    if (this.#rl !== void 0) return this.#rl;
-    const output2 = this.#output;
-    const sink2 = new Writable({
-      write: (chunk, _encoding, done) => {
-        if (!this.#muted) output2.write(chunk);
-        done();
-      }
-    });
-    Object.defineProperties(sink2, {
-      columns: { get: () => output2.columns },
-      rows: { get: () => output2.rows }
-    });
-    const rl = createInterface({
-      input: this.#input,
-      output: sink2,
-      terminal: true,
-      // No answer enters the history, so an arrow key recalls no password.
-      historySize: 0
-    });
-    rl.on("line", (line) => {
-      this.#muted = true;
-      if (this.#waiting !== void 0) {
-        const settle2 = this.#waiting;
-        this.#waiting = void 0;
-        settle2(line);
-        return;
-      }
-      this.#lines.push(line);
-    });
-    rl.on("close", () => {
-      this.#closed = true;
-      this.#waiting?.("");
-      this.#waiting = void 0;
-    });
-    rl.on("SIGINT", () => {
-      this.close();
-      this.#output.write("\n");
-      process.kill(process.pid, "SIGINT");
+  if (org === void 0 && remote?.client !== void 0) {
+    const account = await findOrganization(remote.client, remote, context, io);
+    org = account.org;
+    if (account.project !== void 0 && flagProject === void 0) {
+      named = { project: account.project, source: "token" };
+    }
+  }
+  if (named === void 0) throw nameRefusal;
+  const { project, source } = named;
+  const config2 = {
+    project,
+    ...org === void 0 ? {} : { org },
+    ...endpoint === void 0 ? {} : { endpoint },
+    ...tags === void 0 ? {} : { tags }
+  };
+  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
+`, "utf8");
+  const snippet = agentSnippet(tags, {
+    agent,
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...org === void 0 ? {} : { org }
+  });
+  if (skillPath !== void 0) writeSkill(skillPath, snippet);
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  const check2 = remote?.client === void 0 || org === void 0 ? { server: "unchecked" } : await checkServer(remote.client.forOrg(org), remote.endpoint, context, {
+    org,
+    project,
+    tags,
+    io
+  });
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      path,
+      project,
+      projectSource: source,
+      org: org ?? null,
+      tags: tags ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null,
+      server: check2.server
     });
-    this.#rl = rl;
-    return rl;
+    return 0;
   }
-  /** Waits for the next line, which a paste may have delivered already. */
-  #next() {
-    const queued = this.#lines.shift();
-    if (queued !== void 0) return Promise.resolve(queued);
-    if (this.#closed) return Promise.resolve("");
-    return new Promise((resolve4) => {
-      this.#waiting = resolve4;
-    });
+  writeLine(io.stdout, `Wrote ${path}`);
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
+  writeLine(io.stdout, `Project: ${project}${SOURCE_NOTES[source]}`);
+  if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
+  if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
+  writeLine(io.stdout);
+  writeLine(io.stdout, agentLead(agent));
+  writeLine(io.stdout);
+  writeLine(io.stdout, snippet);
+  if (agent === DEFAULT_SNIPPET_AGENT) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, CODEX_LINE);
   }
-  async #read(label, hidden) {
-    if (this.#closed) return "";
-    const rl = this.#interface();
-    if (hidden) {
-      this.#output.write(`${label} `);
-      rl.setPrompt("");
-      rl.prompt();
-      try {
-        return await this.#next();
-      } finally {
-        this.#output.write("\n");
-      }
-    }
-    const queued = this.#lines.shift();
-    if (queued !== void 0) {
-      this.#output.write(`${label} ${queued}
-`);
-      return queued;
-    }
-    rl.setPrompt(`${label} `);
-    this.#muted = false;
-    rl.prompt();
-    try {
-      return await this.#next();
-    } finally {
-      this.#muted = true;
-    }
+  if (check2.line !== void 0) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, check2.line);
   }
-};
-function nodeTerminal(input2, output2) {
-  return new NodeTerminal(input2, output2);
-}
-
-// src/commands/login.ts
-var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login needs a terminal: in CI, set QUIBBLE_TOKEN instead";
-var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
-var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
-var LOGIN_PAGE = "/login";
-var ORGS_PAGE2 = "/orgs";
-var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
-function terminalOf(io) {
-  return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
+  return 0;
 }
-async function answer(terminal, label, hidden = false) {
-  const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
-  const value = hidden ? text : text.trim();
-  if (value === "")
-    throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
-  return value;
+async function endpointToWrite(given, io) {
+  if (given === void 0 || given.trim() === "") return void 0;
+  const value = parseEndpoint(given, "--endpoint");
+  if (value.kind === "local") return LOCAL_ENDPOINT;
+  const api = await discoverApiUrl(value.url, {
+    fetch: io.fetch,
+    debug: debugEnabled(io.env)
+  });
+  return isDefaultEndpoint(api) ? void 0 : api;
 }
-async function signIn(terminal, identity, config2) {
-  const email3 = await answer(terminal, "Email:");
-  const password = await answer(terminal, "Password:", true);
-  const clientId = config2.cliClientId;
+async function nameFromRepository(directory, io) {
+  const url2 = await (io.git ?? nodeGit()).originUrl(directory);
+  const fromGit = url2 === void 0 ? void 0 : projectOfRemote(url2);
+  if (fromGit !== void 0) return { project: fromGit, source: "git" };
+  const name = basename2(directory);
   try {
-    let result = await initiateAuth(identity, {
-      clientId,
-      flow: "USER_PASSWORD_AUTH",
-      username: email3,
-      password
-    });
-    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
-      const code2 = await answer(terminal, "Code:");
-      result = await respondToAuthChallenge(identity, {
-        clientId,
-        challenge: result.challenge,
-        email: email3,
-        code: code2
-      });
-    }
-    if (result.kind === "challenge") {
-      const name = result.challenge.challengeName;
-      if (name === NEW_PASSWORD_CHALLENGE) {
-        throw new ConfigError(
-          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
-        );
-      }
-      throw new RemoteError(
-        `this account needs a sign-in step that quibble doesn't support (${name})`
-      );
-    }
-    return result.tokens;
+    return { project: parseProjectName(name), source: "directory" };
   } catch (error62) {
-    if (error62 instanceof CognitoError) {
-      const page = `${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`;
-      if (error62.type === "PasswordResetRequiredException") {
-        throw new ConfigError(`reset your password at ${page}`);
-      }
-      if (error62.type === "UserNotConfirmedException") {
-        throw new ConfigError(`finish your sign-up at ${page}`);
-      }
-    }
-    throw error62;
+    throw new ConfigError(
+      `cannot use the directory name "${name}" as a project name: pass --project <name>`,
+      void 0,
+      { cause: error62 }
+    );
   }
 }
-async function runLogin(options, context, io) {
-  requireServer("login", context);
-  const terminal = terminalOf(io);
-  if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
+async function logIn(context, options, io) {
   const endpoint = await resolveEndpoint(context, io);
-  const http = { debug: context.debug, fetch: io.fetch };
-  const config2 = await fetchAuthConfig(endpoint, http);
-  if (config2.mode === "local") {
-    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
-    return 0;
+  let webUrl;
+  const loopback = isLoopbackUrl(endpoint);
+  if (context.token === void 0 && context.credential === void 0 && !loopback) {
+    if (options.login === false || ciIsSet(io.env)) {
+      return { endpoint, client: void 0, webUrl };
+    }
+    const session = await browserSession(
+      endpoint,
+      { version: options.version },
+      context.debug,
+      io
+    );
+    if (session === void 0) {
+      writeLine(io.stderr, localModeLine(endpoint));
+      return "local";
+    }
+    writeLine(io.stderr, loggedInLine(endpoint, session.me));
+    webUrl = session.webUrl;
+    context.credential = findCredential(io.env, endpoint);
   }
-  let tokens;
+  const client = await openClient(context, io, { queue: false });
+  return { endpoint, client, webUrl };
+}
+async function findOrganization(client, remote, context, io) {
+  const endpoint = remote.endpoint;
+  let me;
   try {
-    tokens = await signIn(terminal, { region: config2.region, ...http }, config2);
-  } finally {
-    terminal.close();
+    me = await client.me();
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.status === 404 && error62.serverCode !== ORG_NOT_FOUND) {
+      const webUrl = await webUrlOf(remote, context, io);
+      throw new ConfigError(`finish your account at ${webUrl}${LOGIN_PAGE2}`);
+    }
+    writeLine(
+      io.stderr,
+      `quibble: warning: could not read the organizations of ${endpoint}: ${describeError(error62)}`
+    );
+    return { org: void 0, project: void 0 };
   }
-  if (tokens.refreshToken === void 0) {
-    throw new RemoteError("sign-in didn't return a refresh token");
+  if (me.kind === "token") {
+    return {
+      org: me.org,
+      project: me.project === void 0 ? void 0 : parseProjectName(me.project)
+    };
   }
-  const now = /* @__PURE__ */ new Date();
-  const me = await readProfile(
-    new ApiClient({
-      endpoint,
-      authorizer: bearerAuthorizer(tokens.accessToken),
-      ...http
-    }),
-    config2.webUrl
-  );
-  if (me.sub === void 0 || me.email === void 0) {
-    throw new RemoteError(
-      "unexpected response from the API: identity has no sub or email"
+  const who = me.email ?? me.reporter;
+  const slugs = me.orgs.map((entry) => entry.org).sort();
+  const [only] = slugs;
+  if (slugs.length === 1 && only !== void 0) return { org: only, project: void 0 };
+  if (slugs.length === 0) {
+    const webUrl = await webUrlOf(remote, context, io);
+    throw new ConfigError(
+      `${who} belongs to no organization on ${endpoint}: create one at ${webUrl}${ORGS_PAGE2}, then run quibble init again`
     );
   }
-  saveCredential(io.env, {
-    endpoint,
-    refreshToken: tokens.refreshToken,
-    accessToken: tokens.accessToken,
-    expiresAt: new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString(),
-    sub: me.sub,
-    email: me.email
+  throw new UsageError(
+    `${who} belongs to several organizations on ${endpoint}: ${slugs.join(", ")}. Pass --org <slug>`
+  );
+}
+async function webUrlOf(remote, context, io) {
+  if (remote.webUrl !== void 0) return trimSlash2(remote.webUrl);
+  const config2 = await fetchAuthConfig(remote.endpoint, {
+    debug: context.debug,
+    fetch: io.fetch
   });
-  const saved = saveEndpoint(context, endpoint, io.env);
-  if (options.json === true) {
-    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
-    return 0;
+  return config2.mode === "cognito" ? trimSlash2(config2.webUrl) : remote.endpoint;
+}
+async function checkServer(client, endpoint, context, input2) {
+  const { org, project, io } = input2;
+  const warn = (text) => {
+    writeLine(io.stderr, `quibble: warning: ${text}`);
+  };
+  const found = {
+    server: "found",
+    line: `Project ${org}/${project} exists on ${endpoint}.`
+  };
+  try {
+    await client.project(project);
+    return found;
+  } catch (error62) {
+    if (!(error62 instanceof RemoteError && error62.status === 404)) {
+      warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
+      return { server: "unreachable" };
+    }
+    if (error62.serverCode === ORG_NOT_FOUND) {
+      warn(`no organization ${org} on ${endpoint} for this account`);
+      return { server: "no_org" };
+    }
   }
-  writeLine(io.stdout, `Logged in to ${endpoint} as ${me.email}.`);
-  if (saved !== void 0) {
-    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+  const noAdmin = () => {
+    warn(
+      `${org} has no project ${project} on ${endpoint}: ask an admin of ${org} to create it`
+    );
+    return { server: "no_project" };
+  };
+  if (context.token !== void 0) return noAdmin();
+  try {
+    await client.createProject(project, input2.tags);
+    return {
+      server: "created",
+      line: `Created the project ${org}/${project} on ${endpoint}.`
+    };
+  } catch (error62) {
+    if (error62 instanceof RemoteError) {
+      if (error62.status === 409 && error62.serverCode === CONFLICT) return found;
+      if (error62.status === 403) return noAdmin();
+    }
+    warn(
+      `could not create the project ${org}/${project} on ${endpoint}: ${describeError(error62)}`
+    );
+    return { server: "no_project" };
   }
-  return 0;
 }
-function saveEndpoint(context, endpoint, env) {
-  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
-    return void 0;
+
+// src/mine.ts
+function mineMessage(env) {
+  return `--mine needs a reporter: set "reporter" in ${defaultConfigPath(env)}`;
+}
+async function resolveMine(context, client, env) {
+  if (client === void 0) {
+    if (context.reporter === DEFAULT_REPORTER) throw new UsageError(mineMessage(env));
+    return context.reporter;
+  }
+  return (await client.me()).reporter;
+}
+
+// src/since.ts
+var SINCE_MESSAGE = "--since must be a duration like 7d, a date like 2026-09-01, or an ISO 8601 UTC timestamp";
+var DURATION_RE = /^(\d+)(m|h|d|w)$/;
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS3 = 24 * HOUR_MS;
+var UNIT_MS = {
+  m: MINUTE_MS,
+  h: HOUR_MS,
+  d: DAY_MS3,
+  w: 7 * DAY_MS3
+};
+var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
+function reject(message = SINCE_MESSAGE) {
+  throw new UsageError(message);
+}
+function iso(at) {
+  if (Number.isNaN(at.getTime())) reject();
+  return at.toISOString();
+}
+function durationMs(digits, unit) {
+  if (digits.startsWith("0")) return void 0;
+  const step = UNIT_MS[unit];
+  return step === void 0 ? void 0 : Number(digits) * step;
+}
+function fromDuration(digits, unit, now) {
+  const span = durationMs(digits, unit);
+  if (span === void 0) reject();
+  return iso(new Date(now.getTime() - span));
+}
+function fromDate(value) {
+  const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
+  const stamp2 = iso(at);
+  if (!stamp2.startsWith(value)) reject();
+  return stamp2;
+}
+function parseSince(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  if (duration3 !== null) {
+    return fromDuration(duration3[1] ?? "", duration3[2] ?? "", now);
   }
-  return rememberEndpoint(env, endpoint);
+  if (DATE_RE.test(value)) return fromDate(value);
+  if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
+  return reject();
 }
-async function readProfile(client, webUrl) {
+function parseExpires(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  let stamp2;
   try {
-    return await client.me();
-  } catch (error62) {
-    if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
-      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
+    if (duration3 !== null) {
+      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
+      if (span === void 0) reject(EXPIRES_MESSAGE);
+      stamp2 = iso(new Date(now.getTime() + span));
+    } else if (DATE_RE.test(value)) {
+      stamp2 = fromDate(value);
+    } else if (TIMESTAMP_RE.test(value)) {
+      stamp2 = iso(new Date(value));
+    } else {
+      return reject(EXPIRES_MESSAGE);
     }
-    throw error62;
+  } catch {
+    return reject(EXPIRES_MESSAGE);
   }
+  return stamp2;
 }
-async function runLogout(context, io) {
-  requireServer("logout", context);
-  const endpoint = await resolveEndpoint(context, io);
-  const credential = findCredential(io.env, endpoint);
-  if (credential === void 0) {
-    writeLine(io.stdout, `Not logged in to ${endpoint}.`);
-    return 0;
+
+// src/scope.ts
+function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
+  if (options.project !== void 0 && options.all === true) {
+    throw new UsageError("--project and --all cannot be used together");
   }
-  const http = { debug: context.debug, fetch: io.fetch };
-  if (!await revoke(endpoint, credential.refreshToken, http)) {
-    writeLine(
-      io.stderr,
-      `quibble: warning: could not revoke the refresh token at ${endpoint}`
-    );
+  if (options.open === true && options.status !== void 0) {
+    throw new UsageError("--open and --status cannot be used together");
   }
-  removeCredential(io.env, endpoint);
-  writeLine(io.stdout, `Logged out of ${endpoint}.`);
-  return 0;
+  const project = options.project ?? (options.all === true ? void 0 : context.project);
+  const status = options.open === true ? "open" : options.status;
+  return {
+    // No list reads two organizations, because the path names one.
+    org: requireOrg(context),
+    ...project === void 0 ? {} : { project },
+    ...status === void 0 ? {} : { status },
+    ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
+  };
 }
-async function revoke(endpoint, refreshToken, http) {
-  try {
-    const config2 = await fetchAuthConfig(endpoint, http);
-    if (config2.mode === "local") return true;
-    await revokeToken(
-      { region: config2.region, ...http },
-      { clientId: config2.cliClientId, token: refreshToken }
-    );
-    return true;
-  } catch {
-    return false;
+function tagFilter(tags) {
+  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
+}
+
+// src/commands/list.ts
+var COLUMNS = [
+  "id",
+  "created",
+  "severity",
+  "status",
+  "project",
+  "reporter",
+  "tags",
+  "group",
+  "summary"
+];
+var REPORTER_WIDTH = 20;
+var TAGS_WIDTH = 24;
+var SUMMARY_MAX = 60;
+var RECURRED_MARK = "\u21BB";
+function cut3(text, width) {
+  if (text.length <= width) return text;
+  return `${text.slice(0, width - 3)}...`;
+}
+function summaryOf(complaint) {
+  return cut3(printable(summarize(complaint.message)), SUMMARY_MAX);
+}
+function limitNote(count, limit, more) {
+  if (limit >= MAX_LIMIT) {
+    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
   }
+  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
 }
-async function runWhoami(options, context, io) {
-  if (context.mode === "local") {
-    checkActAs(context);
-    writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
+var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
+async function runList(options, context, io) {
+  if (options.ids === true && options.json === true) {
+    throw new UsageError("--ids and --json cannot be used together");
+  }
+  const { store, client } = await openBackend(context, io);
+  const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
+  const filter = parseListFilter({
+    ...resolveScope(options, context),
+    ...options.severity === void 0 ? {} : { severity: options.severity },
+    ...tagFilter(options.tag),
+    ...options.search === void 0 ? {} : { q: options.search },
+    ...reporter === void 0 ? {} : { reporter },
+    ...options.limit === void 0 ? {} : { limit: options.limit }
+  });
+  const limit = filter.limit ?? DEFAULT_LIMIT;
+  const page = await listComplaintPage(store, {
+    ...filter,
+    limit: Math.min(limit + 1, MAX_LIMIT)
+  });
+  const complaints = page.complaints.slice(0, limit);
+  if (options.json === true) {
+    writeJson(io.stdout, complaints);
+    return 0;
+  }
+  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
+  if (note !== void 0) writeLine(io.stderr, note);
+  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
+  if (options.ids === true) {
+    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
+    return 0;
+  }
+  if (complaints.length === 0) {
+    writeLine(io.stdout, "No complaints found.");
     return 0;
   }
+  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
+    groupComplaints(complaints).map((group) => ({
+      complaint: group.head,
+      group
+    }))
+  );
+  for (const line of lines) writeLine(io.stdout, line);
+  return 0;
+}
+function reporterOf(complaint) {
+  return cut3(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+}
+function groupCell(group) {
+  const count = group.count > 1 ? `\xD7${group.count}` : "";
+  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
+}
+function formatTable(rows2) {
+  const grouped = rows2.some((row) => row.group !== void 0);
+  const columns = COLUMNS.filter((name) => grouped || name !== "group");
+  const cells = rows2.map(({ complaint, group }) => {
+    const values = {
+      id: complaint.id.slice(0, 8),
+      created: complaint.createdAt.slice(0, 16),
+      severity: complaint.severity,
+      status: complaint.status,
+      project: complaint.project,
+      reporter: reporterOf(complaint),
+      tags: cut3(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      group: group === void 0 ? "" : groupCell(group),
+      summary: summaryOf(complaint)
+    };
+    return columns.map((name) => values[name]);
+  });
+  const widths = columns.map(
+    (name, column) => cells.reduce(
+      (width, row) => Math.max(width, (row[column] ?? "").length),
+      name.length
+    )
+  );
+  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(columns), ...cells.map(format)];
+}
+
+// src/commands/orgs.ts
+var ORGS_PAGE3 = "/orgs";
+var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
+async function runOrgs(options, context, io) {
+  requireServer("orgs", context);
   const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const me = await client.me();
-  const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
+  const answer2 = await client.orgs();
   if (options.json === true) {
-    writeJson(io.stdout, {
-      ...me.body,
-      endpoint,
-      ...org === void 0 ? {} : { org: org.body }
-    });
+    writeJson(io.stdout, answer2.body);
     return 0;
   }
-  const lines = whoamiLines(endpoint, me, org);
-  if (me.kind !== "token" && me.orgs.length === 0) {
+  if (answer2.orgs.length === 0) {
     const config2 = await fetchAuthConfig(endpoint, {
       debug: context.debug,
-      fetch: io.fetch
+      fetch: io.fetch,
+      timeoutMs: context.timeoutMs
     });
     const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
-    lines.push("", `Create one at ${webUrl}${ORGS_PAGE2}.`);
+    writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE3}.`);
+    return 0;
   }
-  for (const line of lines) writeLine(io.stdout, line);
+  for (const line of formatOrgs(answer2.orgs)) writeLine(io.stdout, line);
   return 0;
 }
-function rows(pairs) {
-  const width = Math.max(...pairs.map(([key]) => key.length));
-  return pairs.map(([key, value]) => `${key.padEnd(width)}  ${value}`);
-}
-function block(entries) {
-  if (entries.length === 0) return ["  none"];
-  const width = Math.max(...entries.map(([key]) => key.length));
-  return entries.map(([key, value]) => `  ${key.padEnd(width)}  ${value}`);
-}
-function whoamiLines(endpoint, me, org) {
-  if (me.kind === "token") {
-    return rows([
-      ["endpoint", endpoint],
-      ["token", me.name ?? me.reporter],
-      ["org", me.org ?? ""],
-      ["project", me.project ?? ""],
-      ["role", me.role ?? "filer"]
-    ]);
-  }
-  const lines = rows([
-    ["endpoint", endpoint],
-    ["email", me.email ?? ""],
-    ["name", me.name ?? ""],
-    ["sub", me.sub ?? ""],
-    ["platform", me.platform ? "yes" : "no"]
+function formatOrgs(orgs) {
+  const rows2 = [...orgs].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((entry) => [
+    entry.org,
+    entry.name,
+    entry.role,
+    entry.openCount === void 0 ? "" : String(entry.openCount)
   ]);
-  lines.push("", "Organizations");
-  lines.push(...block(me.orgs.map((entry) => [entry.org, entry.role])));
-  if (org === void 0) return lines;
-  lines.push("", `Roles in ${org.org}`);
-  lines.push(...block(org.roles.map((entry) => [entry.project, entry.role])));
-  return lines;
+  const widths = COLUMNS2.map(
+    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  );
+  const format = (cells) => cells.map(
+    (cell2, column) => column === COLUMNS2.length - 1 ? cell2.padStart(widths[column] ?? 0) : cell2.padEnd(widths[column] ?? 0)
+  ).join("  ").trimEnd();
+  return [format(COLUMNS2), ...rows2.map(format)];
 }
 
 // src/commands/project.ts
@@ -28334,11 +29001,14 @@ function buildProgram(io, setCode) {
   }).exitOverride();
   withGlobalOptions(program2);
   withGlobalOptions(
-    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--force", "overwrite an existing .quibblerc or skill file")
+    program2.command("init").description("write a .quibblerc in the current directory").option(
+      "--project <name>",
+      "project name (default: the git remote origin, else the directory name)"
+    ).option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--no-login", "do not log in through the browser without a credential").option("--force", "overwrite an existing .quibblerc or skill file")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(await runInit(options, io));
+    setCode(await runInit({ ...options, version: packageVersion() }, io));
   });
   withGlobalOptions(
     program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--hook", "add the quibble sync hook to .claude/settings.json").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")
@@ -28487,11 +29157,17 @@ function buildProgram(io, setCode) {
     setCode(await runOrgs(options, contextFor(options, io), io));
   });
   withGlobalOptions(
-    program2.command("login").description("log in to the endpoint")
+    program2.command("login").description("log in to the endpoint, approved in a browser").option("--no-browser", "print the approval URL, and open no browser").option("--password", "log in with an email and a password on the terminal")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(await runLogin(options, contextFor(options, io), io));
+    setCode(
+      await runLogin(
+        { ...options, version: packageVersion() },
+        contextFor(options, io),
+        io
+      )
+    );
   });
   withGlobalOptions(
     program2.command("logout").description("log out of the endpoint")