letthemquibble 2.0.0 → 2.1.0

package/dist/quibble.js

@@ -23498,6 +23498,43 @@ function freeText(max, typeMessage) {
   const message = lengthMessage(1, max);
   return external_exports.string({ message: typeMessage ?? message }).overwrite((value) => value.replace(/\r\n?/g, "\n")).trim().min(1, { message }).max(max, { message }).refine((value) => !CONTROL_RE.test(value), { message: CONTROL_MESSAGE });
 }
+var SECRET_PATTERNS = [
+  {
+    kind: "an AWS access key",
+    pattern: /(?<![A-Za-z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9])/
+  },
+  {
+    kind: "a GitHub token",
+    pattern: /(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])|(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{22,}/
+  },
+  {
+    kind: "an API key",
+    pattern: /(?<![A-Za-z0-9-])sk-(?:ant-|proj-)?(?=[A-Za-z_-]*[0-9])[A-Za-z0-9_-]{32,}/
+  },
+  { kind: "a Stripe live key", pattern: /(?<![A-Za-z0-9])[rs]k_live_[A-Za-z0-9]{20,}/ },
+  { kind: "a Slack token", pattern: /(?<![A-Za-z0-9])xox[abposr]-[A-Za-z0-9-]{10,}/ },
+  {
+    kind: "a Quibble project token",
+    pattern: /(?<![A-Za-z0-9])qbp_[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/
+  },
+  { kind: "a private key", pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/ }
+];
+function findSecret(text) {
+  return SECRET_PATTERNS.find(({ pattern }) => pattern.test(text))?.kind;
+}
+function secretFree(schema, max) {
+  return schema.superRefine((value, ctx) => {
+    if (value.length > max || CONTROL_RE.test(value))
+      return;
+    const kind = findSecret(value);
+    if (kind !== void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: `holds what looks like ${kind}: remove the secret and file again`
+      });
+    }
+  });
+}
 var SEVERITY_MESSAGE = `must be one of ${SEVERITIES.join(", ")}`;
 var STATUS_MESSAGE = `must be one of ${STATUSES.join(", ")}`;
 var LIMIT_MESSAGE = `must be an integer between 1 and ${MAX_LIMIT}`;
@@ -23650,7 +23687,7 @@ var agentSchema = freeText(AGENT_MAX);
 var newComplaintShape = {
   org: orgSlugSchema,
   project: projectNameSchema,
-  message: freeText(MESSAGE_MAX),
+  message: secretFree(freeText(MESSAGE_MAX), MESSAGE_MAX),
   severity: severitySchema.optional(),
   tags: tagsSchema.optional(),
   agent: agentSchema.optional(),
@@ -23658,7 +23695,7 @@ var newComplaintShape = {
   reporterName: freeText(REPORTER_MAX).optional(),
   cwd: cwdSchema.optional(),
   // Free text: it is trimmed and may hold newlines, and nothing parses it.
-  cmd: freeText(CMD_MAX).optional()
+  cmd: secretFree(freeText(CMD_MAX), CMD_MAX).optional()
 };
 var newComplaintObject = external_exports.strictObject(newComplaintShape);
 function withDefaults(input2) {
@@ -25435,7 +25472,7 @@ function resolveEndpointSource(options, project, user) {
   };
 }
 function resolveContext(options) {
-  const project = findProjectConfig(options.cwd);
+  const project = options.readProjectConfig === false ? void 0 : findProjectConfig(options.cwd);
   const user = loadUserConfig(options.env);
   const { mode, endpoint, endpointSource, localFix } = resolveEndpointSource(
     options,
@@ -25676,7 +25713,7 @@ function readComplaint(body) {
     throw new RemoteError(NOT_A_COMPLAINT, { cause: error62 });
   }
 }
-var ApiClient = class {
+var ApiClient = class _ApiClient {
   endpoint;
   /** The organization of every org-scoped path, when the command resolved one. */
   org;
@@ -25724,6 +25761,19 @@ var ApiClient = class {
     if (this.org === void 0) throw new ConfigError(NO_ORG_MESSAGE);
     return `/v1/orgs/${encodeURIComponent(this.org)}`;
   }
+  /**
+   * The same client for one organization, with the same authorizer, so a
+   * command that learns the organization from `GET /v1/me` reads the auth
+   * config and refreshes a session once. It runs no `beforeFirst`.
+   */
+  forOrg(org) {
+    return new _ApiClient({
+      endpoint: this.endpoint,
+      authorizer: this.#auth,
+      org,
+      ...this.#http
+    });
+  }
   /** Reads the caller's own identity. */
   async me() {
     return parseMe(await this.request("GET", "/v1/me"));
@@ -25751,6 +25801,18 @@ var ApiClient = class {
   async project(name) {
     return readProject(await this.request("GET", this.projectPath(name)), name);
   }
+  /**
+   * Creates a project, or restores a deleted one of that name (section 7.5).
+   * The route needs `admin`, and answers `201` with the record.
+   */
+  async createProject(name, tags) {
+    const body = await this.request(
+      "POST",
+      `${this.orgPath()}/projects`,
+      JSON.stringify({ project: name, ...tags === void 0 ? {} : { tags } })
+    );
+    return readProject(body, name);
+  }
   /**
    * Replaces the allowed tag list of a project, or clears it with `null`. The
    * route retags the stored complaints and answers how many it rewrote.
@@ -26314,7 +26376,9 @@ function projectOf(entry) {
 }
 function headlineOfEntry(entry) {
   const message = entry.body["message"];
-  return typeof message === "string" ? printable(summarize(message)) : "?";
+  if (typeof message !== "string") return '"?"';
+  const headline = summarize(message);
+  return findSecret(headline) === void 0 ? `"${printable(headline)}"` : `key ${printable(entry.key)}`;
 }
 function queuedCount(n) {
   return `${n} queued ${n === 1 ? "complaint" : "complaints"}`;
@@ -26385,7 +26449,7 @@ async function flushQueue(options) {
       result.dropped += 1;
       writeLine(
         options.stderr,
-        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, "${headlineOfEntry(entry)}": ${printable(message)}`
+        `quibble: dropped a queued complaint for ${entry.org}/${projectOf(entry)}, ${headlineOfEntry(entry)}: ${printable(message)}`
       );
     }
     return result;
@@ -26637,6 +26701,75 @@ async function runConfig(options, context, io) {
 import { existsSync as existsSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename2, join as join7, resolve as resolve3 } from "node:path";
 
+// src/git.ts
+import { spawn as nodeSpawn } from "node:child_process";
+var GIT_TIMEOUT_MS = 5e3;
+var ORIGIN_ARGS = ["remote", "get-url", "origin"];
+function nodeGit(options = {}) {
+  const spawn = options.spawn ?? nodeSpawn;
+  const timeoutMs = options.timeoutMs ?? GIT_TIMEOUT_MS;
+  return {
+    originUrl(cwd) {
+      return new Promise((resolve4) => {
+        let settled = false;
+        let child;
+        let output2 = "";
+        const settle2 = (url2) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          resolve4(url2);
+        };
+        const timer = setTimeout(() => {
+          settle2(void 0);
+          child?.kill();
+        }, timeoutMs);
+        timer.unref();
+        try {
+          child = spawn("git", [...ORIGIN_ARGS], {
+            cwd,
+            shell: false,
+            stdio: ["ignore", "pipe", "ignore"],
+            windowsHide: true
+          });
+        } catch {
+          settle2(void 0);
+          return;
+        }
+        child.stdout?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+          output2 += chunk;
+        });
+        child.on("error", () => {
+          settle2(void 0);
+        });
+        child.on("close", (code2) => {
+          const url2 = output2.trim();
+          settle2(code2 === 0 && url2 !== "" ? url2 : void 0);
+        });
+      });
+    }
+  };
+}
+function remoteSegment(url2) {
+  let rest = url2.trim();
+  if (rest.endsWith("/")) rest = rest.slice(0, -1);
+  if (rest.endsWith(".git")) rest = rest.slice(0, -".git".length);
+  const slash = rest.lastIndexOf("/");
+  const colon = rest.lastIndexOf(":");
+  const scpLike = !rest.includes("://") && colon > slash;
+  return rest.slice((scpLike ? colon : slash) + 1);
+}
+function projectOfRemote(url2) {
+  const segment = remoteSegment(url2);
+  if (segment === "") return void 0;
+  try {
+    return parseProjectName(segment);
+  } catch {
+    return void 0;
+  }
+}
+
 // src/hook.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname5, join as join5 } from "node:path";
@@ -26709,11 +26842,13 @@ var DEFAULT_SNIPPET_AGENT = "claude";
 var AGENTS_FILE_AGENT = "codex";
 var SNIPPET_INTRO = `This project uses Quibble. When the build, tests, docs or tooling waste your
 time, file a complaint instead of quietly working around the problem.`;
+var SNIPPET_SECRETS = "- Never paste secrets, tokens or .env lines into a complaint; Quibble refuses them.";
 var SNIPPET_USAGE = `- Set severity with \`-s low|medium|high\`. Add tags with \`-t <tag>\` (repeatable).
 - Put a one-line summary first; it is the headline everywhere. Add details below.
 - Name the command that failed with \`--cmd "<command>"\`.
 - Pipe a long message on stdin with \`quibble complain -\`.
-- File one complaint per problem, as soon as you hit it, not at the end of the task.`;
+- File one complaint per problem, as soon as you hit it, not at the end of the task.
+${SNIPPET_SECRETS}`;
 var SKILL_FRONT_MATTER = `---
 name: quibble
 description: File a Quibble complaint when the build, tests, docs or tooling of this project waste your time. Use it as soon as you hit the problem, not at the end of the task.
@@ -26831,1127 +26966,1273 @@ function refreshedLine(project, tags) {
   return `${lead} tag each complaint with ${orList(tags)}, or ${OTHER_TAG_PREFIX}<name> when none fits.`;
 }
 
-// src/commands/snippet.ts
-import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
-function existsError(path) {
-  return new UsageError(`${path} already exists: pass --force to overwrite it`);
+// src/commands/login.ts
+import { hostname as hostname4 } from "node:os";
+
+// src/opener.ts
+import { spawn as nodeSpawn2 } from "node:child_process";
+var OPEN_TIMEOUT_MS = 5e3;
+var OPENABLE_URL_RE = /^https?:\/\/[A-Za-z0-9.:[\]-]+(?:\/[A-Za-z0-9/?=._~-]*)?$/;
+function isWsl(platform, env) {
+  if (platform !== "linux") return false;
+  const set2 = (name) => (env[name] ?? "") !== "";
+  return set2("WSL_DISTRO_NAME") || set2("WSL_INTEROP");
 }
-function readOptional2(path) {
-  try {
-    return readFileSync5(path, "utf8");
-  } catch (error62) {
-    if (isNotFound(error62)) return "";
-    throw error62;
+function openCommands(url2, platform, env) {
+  if (platform === "darwin") return [{ command: "open", args: [url2] }];
+  if (platform === "win32") {
+    return [{ command: "cmd", args: ["/c", "start", "", url2] }];
+  }
+  if (isWsl(platform, env)) {
+    return [
+      { command: "wslview", args: [url2] },
+      { command: "cmd.exe", args: ["/c", "start", "", url2] }
+    ];
   }
+  return [{ command: "xdg-open", args: [url2] }];
 }
-function writeSkill(path, snippet) {
-  mkdirSync5(dirname6(path), { recursive: true });
-  writeFileSync4(path, skillFile(snippet), "utf8");
+function attempt(spawn, entry, timeoutMs) {
+  return new Promise((resolve4) => {
+    let settled = false;
+    const settle2 = (opened) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(opened);
+    };
+    const timer = setTimeout(() => {
+      settle2(false);
+    }, timeoutMs);
+    timer.unref();
+    let child;
+    try {
+      child = spawn(entry.command, entry.args, {
+        shell: false,
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true
+      });
+    } catch {
+      settle2(false);
+      return;
+    }
+    child.on("error", () => {
+      settle2(false);
+    });
+    child.on("exit", (code2) => {
+      settle2(code2 === 0);
+    });
+    child.unref();
+  });
 }
-async function snippetSource(project, context, io, options = {}) {
-  let tags;
-  if (context.mode === "remote") {
-    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
-  } else {
-    checkActAs(context);
-    tags = context.allowedTags;
-  }
-  const scope = {
-    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
-    ...context.slug === void 0 ? {} : { org: context.slug }
+function platformOpener(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const spawn = options.spawn ?? nodeSpawn2;
+  const timeoutMs = options.timeoutMs ?? OPEN_TIMEOUT_MS;
+  return {
+    async open(url2) {
+      if (!OPENABLE_URL_RE.test(url2)) return false;
+      for (const entry of openCommands(url2, platform, env)) {
+        if (await attempt(spawn, entry, timeoutMs)) return true;
+      }
+      return false;
+    }
   };
-  return { tags, scope };
 }
-async function runSnippet(options, context, io) {
-  const project = requireProject(context);
-  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
-  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
-  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
-  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
-  if (options.append !== void 0 && hasSnippet(existing)) {
-    throw new UsageError(
-      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
-    );
-  }
-  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
-    throw existsError(skillPath);
-  }
-  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
-  const { tags, scope } = await snippetSource(project, context, io);
-  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
-  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
-  if (appendPath !== void 0) {
-    const agent = override ?? agentForFile(appendPath);
-    const snippet = agentSnippet(tags, { ...scope, agent });
-    const kept = existing.replace(/\s+$/, "");
-    writeFileSync4(appendPath, kept === "" ? `${snippet}
-` : `${kept}
 
-${snippet}
-`);
-    shown = { agent, snippet };
+// src/terminal.ts
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+var NodeTerminal = class {
+  isTTY;
+  #input;
+  #output;
+  #rl;
+  /**
+   * True unless a visible prompt is waiting, so a line that arrives early,
+   * a pasted password after the email for one, echoes nowhere.
+   */
+  #muted = true;
+  /** Lines that arrived before a prompt asked for them. */
+  #lines = [];
+  #waiting;
+  #closed = false;
+  constructor(input2, output2) {
+    this.#input = input2;
+    this.#output = output2;
+    this.isTTY = input2.isTTY === true;
   }
-  if (skillPath !== void 0) {
-    const agent = override ?? DEFAULT_SNIPPET_AGENT;
-    const snippet = agentSnippet(tags, { ...scope, agent });
-    writeSkill(skillPath, snippet);
-    if (appendPath === void 0) shown = { agent, snippet };
+  prompt(label) {
+    return this.#read(label, false);
   }
-  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
-  if (options.json === true) {
-    writeJson(io.stdout, {
-      snippet: shown.snippet,
-      agent: shown.agent,
-      appended: appendPath ?? null,
-      skill: skillPath ?? null,
-      hook: hook?.path ?? null
-    });
-    return 0;
+  promptHidden(label) {
+    return this.#read(label, true);
   }
-  if (appendPath === void 0 && skillPath === void 0) {
-    writeLine(io.stdout, shown.snippet);
+  close() {
+    this.#closed = true;
+    this.#rl?.close();
+    this.#rl = void 0;
   }
-  if (appendPath !== void 0) {
-    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
+  /** The one interface, created on the first prompt. */
+  #interface() {
+    if (this.#rl !== void 0) return this.#rl;
+    const output2 = this.#output;
+    const sink2 = new Writable({
+      write: (chunk, _encoding, done) => {
+        if (!this.#muted) output2.write(chunk);
+        done();
+      }
+    });
+    Object.defineProperties(sink2, {
+      columns: { get: () => output2.columns },
+      rows: { get: () => output2.rows }
+    });
+    const rl = createInterface({
+      input: this.#input,
+      output: sink2,
+      terminal: true,
+      // No answer enters the history, so an arrow key recalls no password.
+      historySize: 0
+    });
+    rl.on("line", (line) => {
+      this.#muted = true;
+      if (this.#waiting !== void 0) {
+        const settle2 = this.#waiting;
+        this.#waiting = void 0;
+        settle2(line);
+        return;
+      }
+      this.#lines.push(line);
+    });
+    rl.on("close", () => {
+      this.#closed = true;
+      this.#waiting?.("");
+      this.#waiting = void 0;
+    });
+    rl.on("SIGINT", () => {
+      this.close();
+      this.#output.write("\n");
+      process.kill(process.pid, "SIGINT");
+    });
+    this.#rl = rl;
+    return rl;
   }
-  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
-  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
-  return 0;
-}
-
-// src/commands/init.ts
-var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
-function agentLead(agent) {
-  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
-}
-async function runInit(options, io) {
-  const directory = resolve3(io.cwd);
-  const path = join7(directory, PROJECT_CONFIG_FILENAME);
-  if (existsSync2(path) && options.force !== true) {
-    throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
-  }
-  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
-  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
-    throw existsError(skillPath);
-  }
-  const project = resolveProjectName(options.project, directory);
-  const org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
-  const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
-  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
-  const hook = options.hook === true ? planHook(directory) : void 0;
-  const endpoint = await endpointToWrite(options.endpoint, io);
-  const config2 = {
-    project,
-    ...org === void 0 ? {} : { org },
-    ...endpoint === void 0 ? {} : { endpoint },
-    ...tags === void 0 ? {} : { tags }
-  };
-  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
-`, "utf8");
-  const context = {
-    ...resolveContext({
-      cwd: io.cwd,
-      env: io.env,
-      endpoint: options.endpoint,
-      org: options.org,
-      local: options.local
-    }),
-    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
-    actAs: void 0
-  };
-  const snippet = agentSnippet(tags, {
-    agent,
-    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
-    ...org === void 0 ? {} : { org }
-  });
-  if (skillPath !== void 0) writeSkill(skillPath, snippet);
-  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
-  const check2 = await checkServer(context, project, io);
-  if (options.json === true) {
-    writeJson(io.stdout, {
-      path,
-      project,
-      org: org ?? null,
-      tags: tags ?? null,
-      skill: skillPath ?? null,
-      hook: hook?.path ?? null,
-      server: check2.server
+  /** Waits for the next line, which a paste may have delivered already. */
+  #next() {
+    const queued = this.#lines.shift();
+    if (queued !== void 0) return Promise.resolve(queued);
+    if (this.#closed) return Promise.resolve("");
+    return new Promise((resolve4) => {
+      this.#waiting = resolve4;
     });
-    return 0;
   }
-  writeLine(io.stdout, `Wrote ${path}`);
-  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
-  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
-  writeLine(io.stdout, `Project: ${project}`);
-  if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
-  if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
-  writeLine(io.stdout);
-  writeLine(io.stdout, agentLead(agent));
-  writeLine(io.stdout);
-  writeLine(io.stdout, snippet);
-  if (agent === DEFAULT_SNIPPET_AGENT) {
-    writeLine(io.stdout);
-    writeLine(io.stdout, CODEX_LINE);
-  }
-  if (check2.line !== void 0) {
-    writeLine(io.stdout);
-    writeLine(io.stdout, check2.line);
-  }
-  return 0;
-}
-async function endpointToWrite(given, io) {
-  if (given === void 0 || given.trim() === "") return void 0;
-  const value = parseEndpoint(given, "--endpoint");
-  if (value.kind === "local") return LOCAL_ENDPOINT;
-  const api = await discoverApiUrl(value.url, {
-    fetch: io.fetch,
-    debug: debugEnabled(io.env)
-  });
-  return isDefaultEndpoint(api) ? void 0 : api;
-}
-async function checkServer(context, project, io) {
-  const org = context.org;
-  if (context.mode !== "remote" || org === void 0) return { server: "unchecked" };
-  const endpoint = await resolveEndpoint(context, io);
-  if (context.token === void 0 && context.credential === void 0 && !isLoopbackUrl(endpoint)) {
-    return { server: "unchecked" };
-  }
-  const warn = (text) => {
-    writeLine(io.stderr, `quibble: warning: ${text}`);
-  };
-  try {
-    await (await openClient(context, io, { queue: false })).project(project);
-    return { server: "found", line: `Project ${org}/${project} exists on ${endpoint}.` };
-  } catch (error62) {
-    if (error62 instanceof RemoteError && error62.status === 404) {
-      if (error62.serverCode === ORG_NOT_FOUND) {
-        warn(`no organization ${org} on ${endpoint} for this account`);
-        return { server: "no_org" };
+  async #read(label, hidden) {
+    if (this.#closed) return "";
+    const rl = this.#interface();
+    if (hidden) {
+      this.#output.write(`${label} `);
+      rl.setPrompt("");
+      rl.prompt();
+      try {
+        return await this.#next();
+      } finally {
+        this.#output.write("\n");
       }
-      warn(
-        `${org} has no project ${project} on ${endpoint}: an admin creates it in the organization settings`
-      );
-      return { server: "no_project" };
     }
-    warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
-    return { server: "unreachable" };
-  }
-}
-function resolveProjectName(given, directory) {
-  const candidate = given?.trim();
-  if (candidate !== void 0 && candidate !== "") return parseProjectName(candidate);
-  const name = basename2(directory);
-  try {
-    return parseProjectName(name);
-  } catch (error62) {
-    throw new ConfigError(
-      `cannot use the directory name "${name}" as a project name: pass --project <name>`,
-      void 0,
-      { cause: error62 }
-    );
+    const queued = this.#lines.shift();
+    if (queued !== void 0) {
+      this.#output.write(`${label} ${queued}
+`);
+      return queued;
+    }
+    rl.setPrompt(`${label} `);
+    this.#muted = false;
+    rl.prompt();
+    try {
+      return await this.#next();
+    } finally {
+      this.#muted = true;
+    }
   }
+};
+function nodeTerminal(input2, output2) {
+  return new NodeTerminal(input2, output2);
 }
 
-// src/mine.ts
-function mineMessage(env) {
-  return `--mine needs a reporter: set "reporter" in ${defaultConfigPath(env)}`;
+// src/commands/login.ts
+var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
+var NEEDS_TERMINAL_MESSAGE = "quibble login --password needs a terminal: in CI, set QUIBBLE_TOKEN instead";
+var CI_MESSAGE = "quibble login needs a person to approve it in a browser: in CI, set QUIBBLE_TOKEN instead";
+var NO_BROWSER_MESSAGE = "--no-browser applies to the browser login only";
+var DENIED_MESSAGE = "login was denied in the browser";
+var EXPIRED_MESSAGE = "the login request expired: run quibble login again";
+var MALFORMED_MESSAGE = "the API answered a malformed login request";
+var UNKNOWN_STATUS_MESSAGE = "the API answered an unknown login status";
+var MFA_NEEDS_TERMINAL_MESSAGE = "this account needs a two-factor code: run quibble login in a terminal";
+var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
+var CUSTOM_CHALLENGE = "CUSTOM_CHALLENGE";
+var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
+var CLI_LOGINS_PATH = "/v1/cli-logins";
+var CLI_LOGIN_POLL_PATH = "/v1/cli-logins/poll";
+var MIN_INTERVAL_SECONDS = 1;
+var MAX_INTERVAL_SECONDS = 30;
+var PLAIN_HOST_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::[0-9]+)?$/;
+var LOGIN_PAGE = "/login";
+var ORGS_PAGE = "/orgs";
+var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
+function localModeLine(endpoint) {
+  return `${endpoint} is in local mode: no login needed.`;
 }
-async function resolveMine(context, client, env) {
-  if (client === void 0) {
-    if (context.reporter === DEFAULT_REPORTER) throw new UsageError(mineMessage(env));
-    return context.reporter;
-  }
-  return (await client.me()).reporter;
+function terminalOf(io) {
+  return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
 }
-
-// src/since.ts
-var SINCE_MESSAGE = "--since must be a duration like 7d, a date like 2026-09-01, or an ISO 8601 UTC timestamp";
-var DURATION_RE = /^(\d+)(m|h|d|w)$/;
-var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
-var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
-var MINUTE_MS = 6e4;
-var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS3 = 24 * HOUR_MS;
-var UNIT_MS = {
-  m: MINUTE_MS,
-  h: HOUR_MS,
-  d: DAY_MS3,
-  w: 7 * DAY_MS3
-};
-var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
-function reject(message = SINCE_MESSAGE) {
-  throw new UsageError(message);
+function clockOf2(io) {
+  return io.now ?? (() => /* @__PURE__ */ new Date());
 }
-function iso(at) {
-  if (Number.isNaN(at.getTime())) reject();
-  return at.toISOString();
+function sleepOf(io) {
+  return io.sleep ?? ((ms) => new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  }));
 }
-function durationMs(digits, unit) {
-  if (digits.startsWith("0")) return void 0;
-  const step = UNIT_MS[unit];
-  return step === void 0 ? void 0 : Number(digits) * step;
+function ciIsSet(env) {
+  const value = (env["CI"] ?? "").trim().toLowerCase();
+  return value !== "" && value !== "0" && value !== "false";
 }
-function fromDuration(digits, unit, now) {
-  const span = durationMs(digits, unit);
-  if (span === void 0) reject();
-  return iso(new Date(now.getTime() - span));
+async function answer(terminal, label, hidden = false) {
+  const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
+  const value = hidden ? text : text.trim();
+  if (value === "")
+    throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
+  return value;
 }
-function fromDate(value) {
-  const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
-  const stamp2 = iso(at);
-  if (!stamp2.startsWith(value)) reject();
-  return stamp2;
+function unsupportedStep(name) {
+  return new RemoteError(
+    `this account needs a sign-in step that quibble doesn't support (${name})`
+  );
 }
-function parseSince(text, now) {
-  const value = text.trim();
-  const duration3 = DURATION_RE.exec(value);
-  if (duration3 !== null) {
-    return fromDuration(duration3[1] ?? "", duration3[2] ?? "", now);
+function pageError(error62, webUrl) {
+  if (error62 instanceof CognitoError) {
+    const page = `${trimSlash2(webUrl)}${LOGIN_PAGE}`;
+    if (error62.type === "PasswordResetRequiredException") {
+      return new ConfigError(`reset your password at ${page}`);
+    }
+    if (error62.type === "UserNotConfirmedException") {
+      return new ConfigError(`finish your sign-up at ${page}`);
+    }
   }
-  if (DATE_RE.test(value)) return fromDate(value);
-  if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
-  return reject();
+  return error62;
 }
-function parseExpires(text, now) {
-  const value = text.trim();
-  const duration3 = DURATION_RE.exec(value);
-  let stamp2;
+async function signIn(terminal, identity, config2) {
+  const email3 = await answer(terminal, "Email:");
+  const password = await answer(terminal, "Password:", true);
+  const clientId = config2.cliClientId;
   try {
-    if (duration3 !== null) {
-      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
-      if (span === void 0) reject(EXPIRES_MESSAGE);
-      stamp2 = iso(new Date(now.getTime() + span));
-    } else if (DATE_RE.test(value)) {
-      stamp2 = fromDate(value);
-    } else if (TIMESTAMP_RE.test(value)) {
-      stamp2 = iso(new Date(value));
-    } else {
-      return reject(EXPIRES_MESSAGE);
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "USER_PASSWORD_AUTH",
+      username: email3,
+      password
+    });
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      const code2 = await answer(terminal, "Code:");
+      result = await respondToAuthChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        email: email3,
+        code: code2
+      });
     }
-  } catch {
-    return reject(EXPIRES_MESSAGE);
-  }
-  return stamp2;
-}
-
-// src/scope.ts
-function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
-  if (options.project !== void 0 && options.all === true) {
-    throw new UsageError("--project and --all cannot be used together");
-  }
-  if (options.open === true && options.status !== void 0) {
-    throw new UsageError("--open and --status cannot be used together");
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name === NEW_PASSWORD_CHALLENGE) {
+        throw new ConfigError(
+          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
+        );
+      }
+      throw unsupportedStep(name);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
   }
-  const project = options.project ?? (options.all === true ? void 0 : context.project);
-  const status = options.open === true ? "open" : options.status;
-  return {
-    // No list reads two organizations, because the path names one.
-    org: requireOrg(context),
-    ...project === void 0 ? {} : { project },
-    ...status === void 0 ? {} : { status },
-    ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
-  };
-}
-function tagFilter(tags) {
-  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
-}
-
-// src/commands/list.ts
-var COLUMNS = [
-  "id",
-  "created",
-  "severity",
-  "status",
-  "project",
-  "reporter",
-  "tags",
-  "group",
-  "summary"
-];
-var REPORTER_WIDTH = 20;
-var TAGS_WIDTH = 24;
-var SUMMARY_MAX = 60;
-var RECURRED_MARK = "\u21BB";
-function cut3(text, width) {
-  if (text.length <= width) return text;
-  return `${text.slice(0, width - 3)}...`;
 }
-function summaryOf(complaint) {
-  return cut3(printable(summarize(complaint.message)), SUMMARY_MAX);
-}
-function limitNote(count, limit, more) {
-  if (limit >= MAX_LIMIT) {
-    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
+async function runLogin(options, context, io) {
+  requireServer("login", context);
+  if (options.password === true) {
+    if (options.browser === false) throw new UsageError(NO_BROWSER_MESSAGE);
+    return passwordLogin(options, context, io);
   }
-  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
+  return browserLogin(options, context, io);
 }
-var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
-async function runList(options, context, io) {
-  if (options.ids === true && options.json === true) {
-    throw new UsageError("--ids and --json cannot be used together");
-  }
-  const { store, client } = await openBackend(context, io);
-  const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
-  const filter = parseListFilter({
-    ...resolveScope(options, context),
-    ...options.severity === void 0 ? {} : { severity: options.severity },
-    ...tagFilter(options.tag),
-    ...options.search === void 0 ? {} : { q: options.search },
-    ...reporter === void 0 ? {} : { reporter },
-    ...options.limit === void 0 ? {} : { limit: options.limit }
-  });
-  const limit = filter.limit ?? DEFAULT_LIMIT;
-  const page = await listComplaintPage(store, {
-    ...filter,
-    limit: Math.min(limit + 1, MAX_LIMIT)
-  });
-  const complaints = page.complaints.slice(0, limit);
-  if (options.json === true) {
-    writeJson(io.stdout, complaints);
+async function passwordLogin(options, context, io) {
+  const terminal = terminalOf(io);
+  if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const http = { debug: context.debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") {
+    writeLine(io.stdout, localModeLine(endpoint));
     return 0;
   }
-  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
-  if (note !== void 0) writeLine(io.stderr, note);
-  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
-  if (options.ids === true) {
-    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
-    return 0;
+  let tokens;
+  try {
+    tokens = await signIn(terminal, { region: config2.region, ...http }, config2);
+  } finally {
+    terminal.close();
   }
-  if (complaints.length === 0) {
-    writeLine(io.stdout, "No complaints found.");
+  const me = await storeSession(tokens, endpoint, config2, http, io);
+  return reportLogin(me, endpoint, options, context, io);
+}
+async function browserLogin(options, context, io) {
+  if (ciIsSet(io.env)) throw new UsageError(CI_MESSAGE);
+  const endpoint = await resolveEndpoint(context, io);
+  const session = await browserSession(endpoint, options, context.debug, io);
+  if (session === void 0) {
+    writeLine(io.stdout, localModeLine(endpoint));
     return 0;
   }
-  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
-    groupComplaints(complaints).map((group) => ({
-      complaint: group.head,
-      group
-    }))
-  );
-  for (const line of lines) writeLine(io.stdout, line);
-  return 0;
+  return reportLogin(session.me, endpoint, options, context, io);
 }
-function reporterOf(complaint) {
-  return cut3(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
-}
-function groupCell(group) {
-  const count = group.count > 1 ? `\xD7${group.count}` : "";
-  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
-}
-function formatTable(rows2) {
-  const grouped = rows2.some((row) => row.group !== void 0);
-  const columns = COLUMNS.filter((name) => grouped || name !== "group");
-  const cells = rows2.map(({ complaint, group }) => {
-    const values = {
-      id: complaint.id.slice(0, 8),
-      created: complaint.createdAt.slice(0, 16),
-      severity: complaint.severity,
-      status: complaint.status,
-      project: complaint.project,
-      reporter: reporterOf(complaint),
-      tags: cut3(printable(complaint.tags.join(",")), TAGS_WIDTH),
-      group: group === void 0 ? "" : groupCell(group),
-      summary: summaryOf(complaint)
-    };
-    return columns.map((name) => values[name]);
+async function browserSession(endpoint, options, debug, io) {
+  const http = { debug, fetch: io.fetch };
+  const config2 = await fetchAuthConfig(endpoint, http);
+  if (config2.mode === "local") return void 0;
+  const clock = clockOf2(io);
+  const started = await startLogin(endpoint, config2.webUrl, http, {
+    host: cliLoginHost((io.hostname ?? hostname4)()),
+    os: process.platform,
+    version: options.version
   });
-  const widths = columns.map(
-    (name, column) => cells.reduce(
-      (width, row) => Math.max(width, (row[column] ?? "").length),
-      name.length
-    )
+  const deadline = clock().getTime() + (CLI_LOGIN_TTL_SECONDS + started.interval) * 1e3;
+  writeLine(
+    io.stderr,
+    `Approve this login in your browser: ${started.url} (code ${started.code}). Waiting...`
   );
-  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
-  return [format(columns), ...cells.map(format)];
-}
-
-// src/commands/orgs.ts
-var ORGS_PAGE = "/orgs";
-var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
-async function runOrgs(options, context, io) {
-  requireServer("orgs", context);
-  const client = await openClient(context, io);
-  const endpoint = requireEndpoint(context);
-  const answer2 = await client.orgs();
-  if (options.json === true) {
-    writeJson(io.stdout, answer2.body);
-    return 0;
-  }
-  if (answer2.orgs.length === 0) {
-    const config2 = await fetchAuthConfig(endpoint, {
-      debug: context.debug,
-      fetch: io.fetch,
-      timeoutMs: context.timeoutMs
-    });
-    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
-    writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE}.`);
-    return 0;
+  if (options.browser !== false) {
+    const opener = io.opener ?? platformOpener({ env: io.env });
+    void opener.open(started.url).catch(() => false);
   }
-  for (const line of formatOrgs(answer2.orgs)) writeLine(io.stdout, line);
-  return 0;
-}
-function formatOrgs(orgs) {
-  const rows2 = [...orgs].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((entry) => [
-    entry.org,
-    entry.name,
-    entry.role,
-    entry.openCount === void 0 ? "" : String(entry.openCount)
-  ]);
-  const widths = COLUMNS2.map(
-    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  const approval = await waitForApproval(endpoint, started, deadline, http, io);
+  const tokens = await browserSignIn(
+    { region: config2.region, ...http },
+    config2,
+    approval,
+    io
   );
-  const format = (cells) => cells.map(
-    (cell2, column) => column === COLUMNS2.length - 1 ? cell2.padStart(widths[column] ?? 0) : cell2.padEnd(widths[column] ?? 0)
-  ).join("  ").trimEnd();
-  return [format(COLUMNS2), ...rows2.map(format)];
+  const me = await storeSession(tokens, endpoint, config2, http, io);
+  return { me, webUrl: config2.webUrl };
 }
-
-// src/commands/login.ts
-import { hostname as hostname4 } from "node:os";
-
-// src/opener.ts
-import { spawn as nodeSpawn } from "node:child_process";
-var OPEN_TIMEOUT_MS = 5e3;
-var OPENABLE_URL_RE = /^https?:\/\/[A-Za-z0-9.:[\]-]+(?:\/[A-Za-z0-9/?=._~-]*)?$/;
-function isWsl(platform, env) {
-  if (platform !== "linux") return false;
-  const set2 = (name) => (env[name] ?? "") !== "";
-  return set2("WSL_DISTRO_NAME") || set2("WSL_INTEROP");
+function postJson(url2, body, http) {
+  return send(url2, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    ...http
+  });
 }
-function openCommands(url2, platform, env) {
-  if (platform === "darwin") return [{ command: "open", args: [url2] }];
-  if (platform === "win32") {
-    return [{ command: "cmd", args: ["/c", "start", "", url2] }];
-  }
-  if (isWsl(platform, env)) {
-    return [
-      { command: "wslview", args: [url2] },
-      { command: "cmd.exe", args: ["/c", "start", "", url2] }
-    ];
+async function startLogin(endpoint, webUrl, http, body) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGINS_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  const response = await postJson(url2, body, http);
+  const text = await readText(response, site);
+  if (response.status === 404) {
+    throw new RemoteError(
+      `${endpoint} does not support the browser login: run quibble login --password${detail(site, 404)}`,
+      { status: 404 }
+    );
   }
-  return [{ command: "xdg-open", args: [url2] }];
+  if (!response.ok) throw remoteFailure(site, response, text);
+  const started = checkStart(asRecord(parseQuietly(text)), webUrl);
+  if (started === void 0) {
+    throw new RemoteError(`${MALFORMED_MESSAGE}${detail(site, response.status)}`);
+  }
+  return started;
 }
-function attempt(spawn, entry, timeoutMs) {
-  return new Promise((resolve4) => {
-    let settled = false;
-    const settle2 = (opened) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve4(opened);
-    };
-    const timer = setTimeout(() => {
-      settle2(false);
-    }, timeoutMs);
-    timer.unref();
-    let child;
-    try {
-      child = spawn(entry.command, entry.args, {
-        shell: false,
-        detached: true,
-        stdio: "ignore",
-        windowsHide: true
-      });
-    } catch {
-      settle2(false);
-      return;
-    }
-    child.on("error", () => {
-      settle2(false);
-    });
-    child.on("exit", (code2) => {
-      settle2(code2 === 0);
-    });
-    child.unref();
-  });
+function checkStart(body, webUrl) {
+  const loginKey = body?.["loginKey"];
+  const code2 = body?.["code"];
+  const url2 = body?.["url"];
+  if (typeof loginKey !== "string" || !CLI_LOGIN_KEY_RE.test(loginKey)) return void 0;
+  if (typeof code2 !== "string" || typeof url2 !== "string") return void 0;
+  try {
+    if (parseCliLoginCode(code2) !== code2) return void 0;
+  } catch {
+    return void 0;
+  }
+  let origin;
+  try {
+    const web = new URL(webUrl);
+    const secure = web.protocol === "https:" || web.protocol === "http:" && isLoopbackUrl(web.origin);
+    if (!secure || !PLAIN_HOST_RE.test(web.host)) return void 0;
+    origin = web.origin;
+  } catch {
+    return void 0;
+  }
+  if (url2 !== cliLoginUrl(origin, code2)) return void 0;
+  const raw = body?.["interval"];
+  const interval = typeof raw === "number" && Number.isInteger(raw) ? Math.min(MAX_INTERVAL_SECONDS, Math.max(MIN_INTERVAL_SECONDS, raw)) : CLI_LOGIN_POLL_SECONDS;
+  return { loginKey, code: code2, url: url2, interval };
 }
-function platformOpener(options = {}) {
-  const platform = options.platform ?? process.platform;
-  const env = options.env ?? process.env;
-  const spawn = options.spawn ?? nodeSpawn;
-  const timeoutMs = options.timeoutMs ?? OPEN_TIMEOUT_MS;
-  return {
-    async open(url2) {
-      if (!OPENABLE_URL_RE.test(url2)) return false;
-      for (const entry of openCommands(url2, platform, env)) {
-        if (await attempt(spawn, entry, timeoutMs)) return true;
+async function waitForApproval(endpoint, started, deadline, http, io) {
+  const clock = clockOf2(io);
+  const sleep = sleepOf(io);
+  for (; ; ) {
+    await sleep(started.interval * 1e3);
+    if (clock().getTime() > deadline) throw new ConfigError(EXPIRED_MESSAGE);
+    const answer2 = await poll(endpoint, started.loginKey, http);
+    if (answer2 === void 0) continue;
+    const status = answer2["status"];
+    switch (status) {
+      case "pending":
+        continue;
+      case "denied":
+        throw new ConfigError(DENIED_MESSAGE);
+      case "expired":
+        throw new ConfigError(EXPIRED_MESSAGE);
+      case "approved": {
+        const username = answer2["username"];
+        const secret = answer2["secret"];
+        if (typeof username !== "string" || username === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        if (typeof secret !== "string" || secret === "") {
+          throw new RemoteError(MALFORMED_MESSAGE);
+        }
+        return { username, secret };
       }
-      return false;
+      default:
+        throw new RemoteError(UNKNOWN_STATUS_MESSAGE);
     }
-  };
-}
-
-// src/terminal.ts
-import { createInterface } from "node:readline";
-import { Writable } from "node:stream";
-var NodeTerminal = class {
-  isTTY;
-  #input;
-  #output;
-  #rl;
-  /**
-   * True unless a visible prompt is waiting, so a line that arrives early,
-   * a pasted password after the email for one, echoes nowhere.
-   */
-  #muted = true;
-  /** Lines that arrived before a prompt asked for them. */
-  #lines = [];
-  #waiting;
-  #closed = false;
-  constructor(input2, output2) {
-    this.#input = input2;
-    this.#output = output2;
-    this.isTTY = input2.isTTY === true;
   }
-  prompt(label) {
-    return this.#read(label, false);
-  }
-  promptHidden(label) {
-    return this.#read(label, true);
+}
+async function poll(endpoint, loginKey, http) {
+  const url2 = `${trimSlash2(endpoint)}${CLI_LOGIN_POLL_PATH}`;
+  const site = { method: "POST", url: url2, debug: http.debug };
+  let response;
+  let text;
+  try {
+    response = await postJson(url2, { loginKey }, http);
+    text = await readText(response, site);
+  } catch (error62) {
+    if (error62 instanceof RemoteError && error62.unanswered) return void 0;
+    throw error62;
   }
-  close() {
-    this.#closed = true;
-    this.#rl?.close();
-    this.#rl = void 0;
+  if (!response.ok) {
+    if (response.status >= 500 || response.status === 429) return void 0;
+    throw remoteFailure(site, response, text);
   }
-  /** The one interface, created on the first prompt. */
-  #interface() {
-    if (this.#rl !== void 0) return this.#rl;
-    const output2 = this.#output;
-    const sink2 = new Writable({
-      write: (chunk, _encoding, done) => {
-        if (!this.#muted) output2.write(chunk);
-        done();
-      }
-    });
-    Object.defineProperties(sink2, {
-      columns: { get: () => output2.columns },
-      rows: { get: () => output2.rows }
-    });
-    const rl = createInterface({
-      input: this.#input,
-      output: sink2,
-      terminal: true,
-      // No answer enters the history, so an arrow key recalls no password.
-      historySize: 0
-    });
-    rl.on("line", (line) => {
-      this.#muted = true;
-      if (this.#waiting !== void 0) {
-        const settle2 = this.#waiting;
-        this.#waiting = void 0;
-        settle2(line);
-        return;
-      }
-      this.#lines.push(line);
-    });
-    rl.on("close", () => {
-      this.#closed = true;
-      this.#waiting?.("");
-      this.#waiting = void 0;
-    });
-    rl.on("SIGINT", () => {
-      this.close();
-      this.#output.write("\n");
-      process.kill(process.pid, "SIGINT");
+  return asRecord(parseJson(text, site, response.status)) ?? {};
+}
+async function browserSignIn(identity, config2, approval, io) {
+  const clientId = config2.cliClientId;
+  try {
+    let result = await initiateAuth(identity, {
+      clientId,
+      flow: "CUSTOM_AUTH",
+      username: approval.username
     });
-    this.#rl = rl;
-    return rl;
+    if (result.kind === "challenge") {
+      const name = result.challenge.challengeName;
+      if (name !== CUSTOM_CHALLENGE) throw unsupportedStep(name);
+      result = await respondToCustomChallenge(identity, {
+        clientId,
+        challenge: result.challenge,
+        username: approval.username,
+        answer: approval.secret
+      });
+    }
+    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
+      result = await answerCode(
+        identity,
+        clientId,
+        result.challenge,
+        approval.username,
+        io
+      );
+    }
+    if (result.kind === "challenge") {
+      throw unsupportedStep(result.challenge.challengeName);
+    }
+    return result.tokens;
+  } catch (error62) {
+    throw pageError(error62, config2.webUrl);
   }
-  /** Waits for the next line, which a paste may have delivered already. */
-  #next() {
-    const queued = this.#lines.shift();
-    if (queued !== void 0) return Promise.resolve(queued);
-    if (this.#closed) return Promise.resolve("");
-    return new Promise((resolve4) => {
-      this.#waiting = resolve4;
+}
+async function answerCode(identity, clientId, challenge, username, io) {
+  const terminal = terminalOf(io);
+  try {
+    if (!terminal.isTTY) throw new ConfigError(MFA_NEEDS_TERMINAL_MESSAGE);
+    const code2 = await answer(terminal, "Code:");
+    return await respondToAuthChallenge(identity, {
+      clientId,
+      challenge,
+      email: username,
+      code: code2
     });
+  } finally {
+    terminal.close();
   }
-  async #read(label, hidden) {
-    if (this.#closed) return "";
-    const rl = this.#interface();
-    if (hidden) {
-      this.#output.write(`${label} `);
-      rl.setPrompt("");
-      rl.prompt();
-      try {
-        return await this.#next();
-      } finally {
-        this.#output.write("\n");
-      }
-    }
-    const queued = this.#lines.shift();
-    if (queued !== void 0) {
-      this.#output.write(`${label} ${queued}
-`);
-      return queued;
-    }
-    rl.setPrompt(`${label} `);
-    this.#muted = false;
-    rl.prompt();
-    try {
-      return await this.#next();
-    } finally {
-      this.#muted = true;
+}
+async function storeSession(tokens, endpoint, config2, http, io) {
+  if (tokens.refreshToken === void 0) {
+    throw new RemoteError("sign-in didn't return a refresh token");
+  }
+  const now = clockOf2(io)();
+  const me = await readProfile(
+    new ApiClient({
+      endpoint,
+      authorizer: bearerAuthorizer(tokens.accessToken),
+      ...http
+    }),
+    config2.webUrl
+  );
+  if (me.sub === void 0 || me.email === void 0) {
+    throw new RemoteError(
+      "unexpected response from the API: identity has no sub or email"
+    );
+  }
+  saveCredential(io.env, {
+    endpoint,
+    refreshToken: tokens.refreshToken,
+    accessToken: tokens.accessToken,
+    expiresAt: new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString(),
+    sub: me.sub,
+    email: me.email
+  });
+  return me;
+}
+function reportLogin(me, endpoint, options, context, io) {
+  const saved = saveEndpoint(context, endpoint, io.env);
+  if (options.json === true) {
+    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
+    return 0;
+  }
+  writeLine(io.stdout, loggedInLine(endpoint, me));
+  if (saved !== void 0) {
+    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+  }
+  return 0;
+}
+function loggedInLine(endpoint, me) {
+  return `Logged in to ${endpoint} as ${me.email ?? me.reporter}.`;
+}
+function saveEndpoint(context, endpoint, env) {
+  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
+    return void 0;
+  }
+  return rememberEndpoint(env, endpoint);
+}
+async function readProfile(client, webUrl) {
+  try {
+    return await client.me();
+  } catch (error62) {
+    if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
+      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
     }
+    throw error62;
   }
-};
-function nodeTerminal(input2, output2) {
-  return new NodeTerminal(input2, output2);
 }
-
-// src/commands/login.ts
-var LOCAL_IDENTITY_MESSAGE = "local mode: no identity.";
-var NEEDS_TERMINAL_MESSAGE = "quibble login --password needs a terminal: in CI, set QUIBBLE_TOKEN instead";
-var CI_MESSAGE = "quibble login needs a person to approve it in a browser: in CI, set QUIBBLE_TOKEN instead";
-var NO_BROWSER_MESSAGE = "--no-browser applies to the browser login only";
-var DENIED_MESSAGE = "login was denied in the browser";
-var EXPIRED_MESSAGE = "the login request expired: run quibble login again";
-var MALFORMED_MESSAGE = "the API answered a malformed login request";
-var UNKNOWN_STATUS_MESSAGE = "the API answered an unknown login status";
-var MFA_NEEDS_TERMINAL_MESSAGE = "this account needs a two-factor code: run quibble login in a terminal";
-var MFA_CHALLENGE = "SOFTWARE_TOKEN_MFA";
-var CUSTOM_CHALLENGE = "CUSTOM_CHALLENGE";
-var NEW_PASSWORD_CHALLENGE = "NEW_PASSWORD_REQUIRED";
-var CLI_LOGINS_PATH = "/v1/cli-logins";
-var CLI_LOGIN_POLL_PATH = "/v1/cli-logins/poll";
-var MIN_INTERVAL_SECONDS = 1;
-var MAX_INTERVAL_SECONDS = 30;
-var PLAIN_HOST_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::[0-9]+)?$/;
-var LOGIN_PAGE = "/login";
-var ORGS_PAGE2 = "/orgs";
-var NO_PROFILE_STATUSES = /* @__PURE__ */ new Set([404, 409]);
-function terminalOf(io) {
-  return io.terminal ?? nodeTerminal(io.stdin, io.stderr);
+async function runLogout(context, io) {
+  requireServer("logout", context);
+  const endpoint = await resolveEndpoint(context, io);
+  const credential = findCredential(io.env, endpoint);
+  if (credential === void 0) {
+    writeLine(io.stdout, `Not logged in to ${endpoint}.`);
+    return 0;
+  }
+  const http = { debug: context.debug, fetch: io.fetch };
+  if (!await revoke(endpoint, credential.refreshToken, http)) {
+    writeLine(
+      io.stderr,
+      `quibble: warning: could not revoke the refresh token at ${endpoint}`
+    );
+  }
+  removeCredential(io.env, endpoint);
+  writeLine(io.stdout, `Logged out of ${endpoint}.`);
+  return 0;
 }
-function clockOf2(io) {
-  return io.now ?? (() => /* @__PURE__ */ new Date());
+async function revoke(endpoint, refreshToken, http) {
+  try {
+    const config2 = await fetchAuthConfig(endpoint, http);
+    if (config2.mode === "local") return true;
+    await revokeToken(
+      { region: config2.region, ...http },
+      { clientId: config2.cliClientId, token: refreshToken }
+    );
+    return true;
+  } catch {
+    return false;
+  }
 }
-function sleepOf(io) {
-  return io.sleep ?? ((ms) => new Promise((resolve4) => {
-    setTimeout(resolve4, ms);
-  }));
+async function runWhoami(options, context, io) {
+  if (context.mode === "local") {
+    checkActAs(context);
+    writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
+    return 0;
+  }
+  const client = await openClient(context, io);
+  const endpoint = requireEndpoint(context);
+  const me = await client.me();
+  const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      ...me.body,
+      endpoint,
+      ...org === void 0 ? {} : { org: org.body }
+    });
+    return 0;
+  }
+  const lines = whoamiLines(endpoint, me, org);
+  if (me.kind !== "token" && me.orgs.length === 0) {
+    const config2 = await fetchAuthConfig(endpoint, {
+      debug: context.debug,
+      fetch: io.fetch
+    });
+    const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
+    lines.push("", `Create one at ${webUrl}${ORGS_PAGE}.`);
+  }
+  for (const line of lines) writeLine(io.stdout, line);
+  return 0;
 }
-function ciIsSet(env) {
-  const value = (env["CI"] ?? "").trim().toLowerCase();
-  return value !== "" && value !== "0" && value !== "false";
+function rows(pairs) {
+  const width = Math.max(...pairs.map(([key]) => key.length));
+  return pairs.map(([key, value]) => `${key.padEnd(width)}  ${value}`);
 }
-async function answer(terminal, label, hidden = false) {
-  const text = hidden ? await terminal.promptHidden(label) : await terminal.prompt(label);
-  const value = hidden ? text : text.trim();
-  if (value === "")
-    throw new UsageError(`${label.replace(/:$/, "").toLowerCase()} must not be empty`);
-  return value;
+function block(entries) {
+  if (entries.length === 0) return ["  none"];
+  const width = Math.max(...entries.map(([key]) => key.length));
+  return entries.map(([key, value]) => `  ${key.padEnd(width)}  ${value}`);
 }
-function unsupportedStep(name) {
-  return new RemoteError(
-    `this account needs a sign-in step that quibble doesn't support (${name})`
-  );
+function whoamiLines(endpoint, me, org) {
+  if (me.kind === "token") {
+    return rows([
+      ["endpoint", endpoint],
+      ["token", me.name ?? me.reporter],
+      ["org", me.org ?? ""],
+      ["project", me.project ?? ""],
+      ["role", me.role ?? "filer"]
+    ]);
+  }
+  const lines = rows([
+    ["endpoint", endpoint],
+    ["email", me.email ?? ""],
+    ["name", me.name ?? ""],
+    ["sub", me.sub ?? ""],
+    ["platform", me.platform ? "yes" : "no"]
+  ]);
+  lines.push("", "Organizations");
+  lines.push(...block(me.orgs.map((entry) => [entry.org, entry.role])));
+  if (org === void 0) return lines;
+  lines.push("", `Roles in ${org.org}`);
+  lines.push(...block(org.roles.map((entry) => [entry.project, entry.role])));
+  return lines;
 }
-function pageError(error62, webUrl) {
-  if (error62 instanceof CognitoError) {
-    const page = `${trimSlash2(webUrl)}${LOGIN_PAGE}`;
-    if (error62.type === "PasswordResetRequiredException") {
-      return new ConfigError(`reset your password at ${page}`);
-    }
-    if (error62.type === "UserNotConfirmedException") {
-      return new ConfigError(`finish your sign-up at ${page}`);
-    }
-  }
-  return error62;
+
+// src/commands/snippet.ts
+import { existsSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join6, resolve as resolve2 } from "node:path";
+function existsError(path) {
+  return new UsageError(`${path} already exists: pass --force to overwrite it`);
 }
-async function signIn(terminal, identity, config2) {
-  const email3 = await answer(terminal, "Email:");
-  const password = await answer(terminal, "Password:", true);
-  const clientId = config2.cliClientId;
+function readOptional2(path) {
   try {
-    let result = await initiateAuth(identity, {
-      clientId,
-      flow: "USER_PASSWORD_AUTH",
-      username: email3,
-      password
-    });
-    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
-      const code2 = await answer(terminal, "Code:");
-      result = await respondToAuthChallenge(identity, {
-        clientId,
-        challenge: result.challenge,
-        email: email3,
-        code: code2
-      });
-    }
-    if (result.kind === "challenge") {
-      const name = result.challenge.challengeName;
-      if (name === NEW_PASSWORD_CHALLENGE) {
-        throw new ConfigError(
-          `finish your first sign-in at ${trimSlash2(config2.webUrl)}${LOGIN_PAGE}`
-        );
-      }
-      throw unsupportedStep(name);
-    }
-    return result.tokens;
+    return readFileSync5(path, "utf8");
   } catch (error62) {
-    throw pageError(error62, config2.webUrl);
+    if (isNotFound(error62)) return "";
+    throw error62;
   }
 }
-async function runLogin(options, context, io) {
-  requireServer("login", context);
-  if (options.password === true) {
-    if (options.browser === false) throw new UsageError(NO_BROWSER_MESSAGE);
-    return passwordLogin(options, context, io);
+function writeSkill(path, snippet) {
+  mkdirSync5(dirname6(path), { recursive: true });
+  writeFileSync4(path, skillFile(snippet), "utf8");
+}
+async function snippetSource(project, context, io, options = {}) {
+  let tags;
+  if (context.mode === "remote") {
+    tags = (await (await openOrgClient(context, io, options)).project(project)).tags;
+  } else {
+    checkActAs(context);
+    tags = context.allowedTags;
   }
-  return browserLogin(options, context, io);
+  const scope = {
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...context.slug === void 0 ? {} : { org: context.slug }
+  };
+  return { tags, scope };
 }
-async function passwordLogin(options, context, io) {
-  const terminal = terminalOf(io);
-  if (!terminal.isTTY) throw new UsageError(NEEDS_TERMINAL_MESSAGE);
-  const endpoint = await resolveEndpoint(context, io);
-  const http = { debug: context.debug, fetch: io.fetch };
-  const config2 = await fetchAuthConfig(endpoint, http);
-  if (config2.mode === "local") {
-    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
+async function runSnippet(options, context, io) {
+  const project = requireProject(context);
+  const override = options.agent === void 0 ? void 0 : parseAgentName(options.agent);
+  const appendPath = options.append === void 0 ? void 0 : resolve2(io.cwd, options.append);
+  const skillPath = options.skill === true ? join6(context.projectRoot ?? io.cwd, SKILL_PATH) : void 0;
+  const existing = appendPath === void 0 ? "" : readOptional2(appendPath);
+  if (options.append !== void 0 && hasSnippet(existing)) {
+    throw new UsageError(
+      `${options.append} already has a "${SNIPPET_HEADING}" section: run quibble sync to refresh it`
+    );
+  }
+  if (skillPath !== void 0 && existsSync(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
+  }
+  const hook = options.hook === true ? planHook(context.projectRoot ?? io.cwd) : void 0;
+  const { tags, scope } = await snippetSource(project, context, io);
+  let shown = { agent: override ?? DEFAULT_SNIPPET_AGENT, snippet: "" };
+  shown.snippet = agentSnippet(tags, { ...scope, agent: shown.agent });
+  if (appendPath !== void 0) {
+    const agent = override ?? agentForFile(appendPath);
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    const kept = existing.replace(/\s+$/, "");
+    writeFileSync4(appendPath, kept === "" ? `${snippet}
+` : `${kept}
+
+${snippet}
+`);
+    shown = { agent, snippet };
+  }
+  if (skillPath !== void 0) {
+    const agent = override ?? DEFAULT_SNIPPET_AGENT;
+    const snippet = agentSnippet(tags, { ...scope, agent });
+    writeSkill(skillPath, snippet);
+    if (appendPath === void 0) shown = { agent, snippet };
+  }
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      snippet: shown.snippet,
+      agent: shown.agent,
+      appended: appendPath ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null
+    });
     return 0;
   }
-  let tokens;
-  try {
-    tokens = await signIn(terminal, { region: config2.region, ...http }, config2);
-  } finally {
-    terminal.close();
+  if (appendPath === void 0 && skillPath === void 0) {
+    writeLine(io.stdout, shown.snippet);
+  }
+  if (appendPath !== void 0) {
+    writeLine(io.stdout, `Appended the Quibble snippet to ${appendPath}`);
   }
-  return finishLogin(tokens, endpoint, config2, options, context, io);
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
+  return 0;
 }
-async function browserLogin(options, context, io) {
-  if (ciIsSet(io.env)) throw new UsageError(CI_MESSAGE);
-  const endpoint = await resolveEndpoint(context, io);
-  const http = { debug: context.debug, fetch: io.fetch };
-  const config2 = await fetchAuthConfig(endpoint, http);
-  if (config2.mode === "local") {
-    writeLine(io.stdout, `${endpoint} is in local mode: no login needed.`);
-    return 0;
+
+// src/commands/init.ts
+var CODEX_LINE = "For Codex, run `quibble snippet --append AGENTS.md`, which names the agent codex.";
+var LOGIN_PAGE2 = "/login";
+var ORGS_PAGE2 = "/orgs";
+var CONFLICT = "conflict";
+function agentLead(agent) {
+  return agent === DEFAULT_SNIPPET_AGENT ? "Add this to your CLAUDE.md:" : "Add this to your agent's instructions file:";
+}
+var SOURCE_NOTES = {
+  flag: "",
+  git: " (from the git remote origin)",
+  directory: " (from the directory name)",
+  token: " (from the project token)"
+};
+async function runInit(options, io) {
+  const directory = resolve3(io.cwd);
+  const path = join7(directory, PROJECT_CONFIG_FILENAME);
+  if (existsSync2(path) && options.force !== true) {
+    throw new ConfigError(`${path} already exists: pass --force to overwrite it`, path);
   }
-  const clock = clockOf2(io);
-  const started = await startLogin(endpoint, config2.webUrl, http, {
-    host: cliLoginHost((io.hostname ?? hostname4)()),
-    os: process.platform,
-    version: options.version
-  });
-  const deadline = clock().getTime() + (CLI_LOGIN_TTL_SECONDS + started.interval) * 1e3;
-  writeLine(
-    io.stderr,
-    `Approve this login in your browser: ${started.url} (code ${started.code}). Waiting...`
-  );
-  if (options.browser !== false) {
-    const opener = io.opener ?? platformOpener({ env: io.env });
-    void opener.open(started.url).catch(() => false);
+  const skillPath = options.skill === true ? join7(directory, SKILL_PATH) : void 0;
+  if (skillPath !== void 0 && existsSync2(skillPath) && options.force !== true) {
+    throw existsError(skillPath);
   }
-  const approval = await waitForApproval(endpoint, started, deadline, http, io);
-  const tokens = await browserSignIn(
-    { region: config2.region, ...http },
-    config2,
-    approval,
+  const given = options.project?.trim();
+  const flagProject = given === void 0 || given === "" ? void 0 : parseProjectName(given);
+  let org = options.org === void 0 || options.org.trim() === "" ? void 0 : parseOrgSlug(options.org);
+  const tags = options.tag === void 0 ? void 0 : parseAllowedTags(options.tag);
+  const agent = options.agent === void 0 ? DEFAULT_SNIPPET_AGENT : parseAgentName(options.agent);
+  const hook = options.hook === true ? planHook(directory) : void 0;
+  const endpoint = await endpointToWrite(options.endpoint, io);
+  const context = {
+    ...resolveContext({
+      cwd: io.cwd,
+      env: io.env,
+      endpoint: options.endpoint,
+      local: options.local,
+      readProjectConfig: false
+    }),
+    // `init` acts as nobody, so it ignores `QUIBBLE_ACT_AS`.
+    actAs: void 0
+  };
+  let named;
+  let nameRefusal;
+  if (flagProject !== void 0) {
+    named = { project: flagProject, source: "flag" };
+  } else {
+    try {
+      named = await nameFromRepository(directory, io);
+    } catch (error62) {
+      if (!(error62 instanceof ConfigError) || context.token === void 0) throw error62;
+      nameRefusal = error62;
+    }
+  }
+  let remote;
+  if (context.mode === "remote") {
+    const login = await logIn(context, options, io);
+    if (login === "local") return 0;
+    remote = login;
+  }
+  if (org === void 0 && remote?.client !== void 0) {
+    const account = await findOrganization(remote.client, remote, context, io);
+    org = account.org;
+    if (account.project !== void 0 && flagProject === void 0) {
+      named = { project: account.project, source: "token" };
+    }
+  }
+  if (named === void 0) throw nameRefusal;
+  const { project, source } = named;
+  const config2 = {
+    project,
+    ...org === void 0 ? {} : { org },
+    ...endpoint === void 0 ? {} : { endpoint },
+    ...tags === void 0 ? {} : { tags }
+  };
+  writeFileSync5(path, `${JSON.stringify(config2, null, 2)}
+`, "utf8");
+  const snippet = agentSnippet(tags, {
+    agent,
+    ...context.mode === "remote" ? { endpoint: context.endpoint } : {},
+    ...org === void 0 ? {} : { org }
+  });
+  if (skillPath !== void 0) writeSkill(skillPath, snippet);
+  const hookLine = hook === void 0 ? void 0 : applyHook(hook);
+  const check2 = remote?.client === void 0 || org === void 0 ? { server: "unchecked" } : await checkServer(remote.client.forOrg(org), remote.endpoint, context, {
+    org,
+    project,
+    tags,
     io
-  );
-  return finishLogin(tokens, endpoint, config2, options, context, io);
-}
-function postJson(url2, body, http) {
-  return send(url2, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body),
-    ...http
   });
-}
-async function startLogin(endpoint, webUrl, http, body) {
-  const url2 = `${trimSlash2(endpoint)}${CLI_LOGINS_PATH}`;
-  const site = { method: "POST", url: url2, debug: http.debug };
-  const response = await postJson(url2, body, http);
-  const text = await readText(response, site);
-  if (response.status === 404) {
-    throw new RemoteError(
-      `${endpoint} does not support the browser login: run quibble login --password${detail(site, 404)}`,
-      { status: 404 }
-    );
+  if (options.json === true) {
+    writeJson(io.stdout, {
+      path,
+      project,
+      projectSource: source,
+      org: org ?? null,
+      tags: tags ?? null,
+      skill: skillPath ?? null,
+      hook: hook?.path ?? null,
+      server: check2.server
+    });
+    return 0;
+  }
+  writeLine(io.stdout, `Wrote ${path}`);
+  if (skillPath !== void 0) writeLine(io.stdout, `Wrote ${skillPath}`);
+  if (hookLine !== void 0) writeLine(io.stdout, hookLine);
+  writeLine(io.stdout, `Project: ${project}${SOURCE_NOTES[source]}`);
+  if (org !== void 0) writeLine(io.stdout, `Organization: ${org}`);
+  if (tags !== void 0) writeLine(io.stdout, `Tags: ${tags.join(", ")}`);
+  writeLine(io.stdout);
+  writeLine(io.stdout, agentLead(agent));
+  writeLine(io.stdout);
+  writeLine(io.stdout, snippet);
+  if (agent === DEFAULT_SNIPPET_AGENT) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, CODEX_LINE);
   }
-  if (!response.ok) throw remoteFailure(site, response, text);
-  const started = checkStart(asRecord(parseQuietly(text)), webUrl);
-  if (started === void 0) {
-    throw new RemoteError(`${MALFORMED_MESSAGE}${detail(site, response.status)}`);
+  if (check2.line !== void 0) {
+    writeLine(io.stdout);
+    writeLine(io.stdout, check2.line);
   }
-  return started;
+  return 0;
 }
-function checkStart(body, webUrl) {
-  const loginKey = body?.["loginKey"];
-  const code2 = body?.["code"];
-  const url2 = body?.["url"];
-  if (typeof loginKey !== "string" || !CLI_LOGIN_KEY_RE.test(loginKey)) return void 0;
-  if (typeof code2 !== "string" || typeof url2 !== "string") return void 0;
-  try {
-    if (parseCliLoginCode(code2) !== code2) return void 0;
-  } catch {
-    return void 0;
-  }
-  let origin;
+async function endpointToWrite(given, io) {
+  if (given === void 0 || given.trim() === "") return void 0;
+  const value = parseEndpoint(given, "--endpoint");
+  if (value.kind === "local") return LOCAL_ENDPOINT;
+  const api = await discoverApiUrl(value.url, {
+    fetch: io.fetch,
+    debug: debugEnabled(io.env)
+  });
+  return isDefaultEndpoint(api) ? void 0 : api;
+}
+async function nameFromRepository(directory, io) {
+  const url2 = await (io.git ?? nodeGit()).originUrl(directory);
+  const fromGit = url2 === void 0 ? void 0 : projectOfRemote(url2);
+  if (fromGit !== void 0) return { project: fromGit, source: "git" };
+  const name = basename2(directory);
   try {
-    const web = new URL(webUrl);
-    const secure = web.protocol === "https:" || web.protocol === "http:" && isLoopbackUrl(web.origin);
-    if (!secure || !PLAIN_HOST_RE.test(web.host)) return void 0;
-    origin = web.origin;
-  } catch {
-    return void 0;
+    return { project: parseProjectName(name), source: "directory" };
+  } catch (error62) {
+    throw new ConfigError(
+      `cannot use the directory name "${name}" as a project name: pass --project <name>`,
+      void 0,
+      { cause: error62 }
+    );
   }
-  if (url2 !== cliLoginUrl(origin, code2)) return void 0;
-  const raw = body?.["interval"];
-  const interval = typeof raw === "number" && Number.isInteger(raw) ? Math.min(MAX_INTERVAL_SECONDS, Math.max(MIN_INTERVAL_SECONDS, raw)) : CLI_LOGIN_POLL_SECONDS;
-  return { loginKey, code: code2, url: url2, interval };
 }
-async function waitForApproval(endpoint, started, deadline, http, io) {
-  const clock = clockOf2(io);
-  const sleep = sleepOf(io);
-  for (; ; ) {
-    await sleep(started.interval * 1e3);
-    if (clock().getTime() > deadline) throw new ConfigError(EXPIRED_MESSAGE);
-    const answer2 = await poll(endpoint, started.loginKey, http);
-    if (answer2 === void 0) continue;
-    const status = answer2["status"];
-    switch (status) {
-      case "pending":
-        continue;
-      case "denied":
-        throw new ConfigError(DENIED_MESSAGE);
-      case "expired":
-        throw new ConfigError(EXPIRED_MESSAGE);
-      case "approved": {
-        const username = answer2["username"];
-        const secret = answer2["secret"];
-        if (typeof username !== "string" || username === "") {
-          throw new RemoteError(MALFORMED_MESSAGE);
-        }
-        if (typeof secret !== "string" || secret === "") {
-          throw new RemoteError(MALFORMED_MESSAGE);
-        }
-        return { username, secret };
-      }
-      default:
-        throw new RemoteError(UNKNOWN_STATUS_MESSAGE);
+async function logIn(context, options, io) {
+  const endpoint = await resolveEndpoint(context, io);
+  let webUrl;
+  const loopback = isLoopbackUrl(endpoint);
+  if (context.token === void 0 && context.credential === void 0 && !loopback) {
+    if (options.login === false || ciIsSet(io.env)) {
+      return { endpoint, client: void 0, webUrl };
+    }
+    const session = await browserSession(
+      endpoint,
+      { version: options.version },
+      context.debug,
+      io
+    );
+    if (session === void 0) {
+      writeLine(io.stderr, localModeLine(endpoint));
+      return "local";
     }
+    writeLine(io.stderr, loggedInLine(endpoint, session.me));
+    webUrl = session.webUrl;
+    context.credential = findCredential(io.env, endpoint);
   }
+  const client = await openClient(context, io, { queue: false });
+  return { endpoint, client, webUrl };
 }
-async function poll(endpoint, loginKey, http) {
-  const url2 = `${trimSlash2(endpoint)}${CLI_LOGIN_POLL_PATH}`;
-  const site = { method: "POST", url: url2, debug: http.debug };
-  let response;
-  let text;
+async function findOrganization(client, remote, context, io) {
+  const endpoint = remote.endpoint;
+  let me;
   try {
-    response = await postJson(url2, { loginKey }, http);
-    text = await readText(response, site);
+    me = await client.me();
   } catch (error62) {
-    if (error62 instanceof RemoteError && error62.unanswered) return void 0;
-    throw error62;
+    if (error62 instanceof RemoteError && error62.status === 404 && error62.serverCode !== ORG_NOT_FOUND) {
+      const webUrl = await webUrlOf(remote, context, io);
+      throw new ConfigError(`finish your account at ${webUrl}${LOGIN_PAGE2}`);
+    }
+    writeLine(
+      io.stderr,
+      `quibble: warning: could not read the organizations of ${endpoint}: ${describeError(error62)}`
+    );
+    return { org: void 0, project: void 0 };
   }
-  if (!response.ok) {
-    if (response.status >= 500 || response.status === 429) return void 0;
-    throw remoteFailure(site, response, text);
+  if (me.kind === "token") {
+    return {
+      org: me.org,
+      project: me.project === void 0 ? void 0 : parseProjectName(me.project)
+    };
   }
-  return asRecord(parseJson(text, site, response.status)) ?? {};
+  const who = me.email ?? me.reporter;
+  const slugs = me.orgs.map((entry) => entry.org).sort();
+  const [only] = slugs;
+  if (slugs.length === 1 && only !== void 0) return { org: only, project: void 0 };
+  if (slugs.length === 0) {
+    const webUrl = await webUrlOf(remote, context, io);
+    throw new ConfigError(
+      `${who} belongs to no organization on ${endpoint}: create one at ${webUrl}${ORGS_PAGE2}, then run quibble init again`
+    );
+  }
+  throw new UsageError(
+    `${who} belongs to several organizations on ${endpoint}: ${slugs.join(", ")}. Pass --org <slug>`
+  );
 }
-async function browserSignIn(identity, config2, approval, io) {
-  const clientId = config2.cliClientId;
+async function webUrlOf(remote, context, io) {
+  if (remote.webUrl !== void 0) return trimSlash2(remote.webUrl);
+  const config2 = await fetchAuthConfig(remote.endpoint, {
+    debug: context.debug,
+    fetch: io.fetch
+  });
+  return config2.mode === "cognito" ? trimSlash2(config2.webUrl) : remote.endpoint;
+}
+async function checkServer(client, endpoint, context, input2) {
+  const { org, project, io } = input2;
+  const warn = (text) => {
+    writeLine(io.stderr, `quibble: warning: ${text}`);
+  };
+  const found = {
+    server: "found",
+    line: `Project ${org}/${project} exists on ${endpoint}.`
+  };
   try {
-    let result = await initiateAuth(identity, {
-      clientId,
-      flow: "CUSTOM_AUTH",
-      username: approval.username
-    });
-    if (result.kind === "challenge") {
-      const name = result.challenge.challengeName;
-      if (name !== CUSTOM_CHALLENGE) throw unsupportedStep(name);
-      result = await respondToCustomChallenge(identity, {
-        clientId,
-        challenge: result.challenge,
-        username: approval.username,
-        answer: approval.secret
-      });
-    }
-    if (result.kind === "challenge" && result.challenge.challengeName === MFA_CHALLENGE) {
-      result = await answerCode(
-        identity,
-        clientId,
-        result.challenge,
-        approval.username,
-        io
-      );
+    await client.project(project);
+    return found;
+  } catch (error62) {
+    if (!(error62 instanceof RemoteError && error62.status === 404)) {
+      warn(`could not check the project on ${endpoint}: ${describeError(error62)}`);
+      return { server: "unreachable" };
     }
-    if (result.kind === "challenge") {
-      throw unsupportedStep(result.challenge.challengeName);
+    if (error62.serverCode === ORG_NOT_FOUND) {
+      warn(`no organization ${org} on ${endpoint} for this account`);
+      return { server: "no_org" };
     }
-    return result.tokens;
-  } catch (error62) {
-    throw pageError(error62, config2.webUrl);
   }
-}
-async function answerCode(identity, clientId, challenge, username, io) {
-  const terminal = terminalOf(io);
+  const noAdmin = () => {
+    warn(
+      `${org} has no project ${project} on ${endpoint}: ask an admin of ${org} to create it`
+    );
+    return { server: "no_project" };
+  };
+  if (context.token !== void 0) return noAdmin();
   try {
-    if (!terminal.isTTY) throw new ConfigError(MFA_NEEDS_TERMINAL_MESSAGE);
-    const code2 = await answer(terminal, "Code:");
-    return await respondToAuthChallenge(identity, {
-      clientId,
-      challenge,
-      email: username,
-      code: code2
-    });
-  } finally {
-    terminal.close();
-  }
-}
-async function finishLogin(tokens, endpoint, config2, options, context, io) {
-  if (tokens.refreshToken === void 0) {
-    throw new RemoteError("sign-in didn't return a refresh token");
-  }
-  const now = clockOf2(io)();
-  const me = await readProfile(
-    new ApiClient({
-      endpoint,
-      authorizer: bearerAuthorizer(tokens.accessToken),
-      debug: context.debug,
-      fetch: io.fetch
-    }),
-    config2.webUrl
-  );
-  if (me.sub === void 0 || me.email === void 0) {
-    throw new RemoteError(
-      "unexpected response from the API: identity has no sub or email"
+    await client.createProject(project, input2.tags);
+    return {
+      server: "created",
+      line: `Created the project ${org}/${project} on ${endpoint}.`
+    };
+  } catch (error62) {
+    if (error62 instanceof RemoteError) {
+      if (error62.status === 409 && error62.serverCode === CONFLICT) return found;
+      if (error62.status === 403) return noAdmin();
+    }
+    warn(
+      `could not create the project ${org}/${project} on ${endpoint}: ${describeError(error62)}`
     );
+    return { server: "no_project" };
   }
-  saveCredential(io.env, {
-    endpoint,
-    refreshToken: tokens.refreshToken,
-    accessToken: tokens.accessToken,
-    expiresAt: new Date(now.getTime() + tokens.expiresIn * 1e3).toISOString(),
-    sub: me.sub,
-    email: me.email
-  });
-  const saved = saveEndpoint(context, endpoint, io.env);
-  if (options.json === true) {
-    writeJson(io.stdout, { ...me.body, endpoint, saved: saved ?? null });
-    return 0;
-  }
-  writeLine(io.stdout, `Logged in to ${endpoint} as ${me.email}.`);
-  if (saved !== void 0) {
-    writeLine(io.stdout, `Saved ${endpoint} as your endpoint in ${saved}.`);
+}
+
+// src/mine.ts
+function mineMessage(env) {
+  return `--mine needs a reporter: set "reporter" in ${defaultConfigPath(env)}`;
+}
+async function resolveMine(context, client, env) {
+  if (client === void 0) {
+    if (context.reporter === DEFAULT_REPORTER) throw new UsageError(mineMessage(env));
+    return context.reporter;
   }
-  return 0;
+  return (await client.me()).reporter;
+}
+
+// src/since.ts
+var SINCE_MESSAGE = "--since must be a duration like 7d, a date like 2026-09-01, or an ISO 8601 UTC timestamp";
+var DURATION_RE = /^(\d+)(m|h|d|w)$/;
+var DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+var TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS3 = 24 * HOUR_MS;
+var UNIT_MS = {
+  m: MINUTE_MS,
+  h: HOUR_MS,
+  d: DAY_MS3,
+  w: 7 * DAY_MS3
+};
+var EXPIRES_MESSAGE = "--expires must be a duration like 30d, a date like 2026-12-01, or an ISO 8601 UTC timestamp";
+function reject(message = SINCE_MESSAGE) {
+  throw new UsageError(message);
+}
+function iso(at) {
+  if (Number.isNaN(at.getTime())) reject();
+  return at.toISOString();
+}
+function durationMs(digits, unit) {
+  if (digits.startsWith("0")) return void 0;
+  const step = UNIT_MS[unit];
+  return step === void 0 ? void 0 : Number(digits) * step;
+}
+function fromDuration(digits, unit, now) {
+  const span = durationMs(digits, unit);
+  if (span === void 0) reject();
+  return iso(new Date(now.getTime() - span));
+}
+function fromDate(value) {
+  const at = /* @__PURE__ */ new Date(`${value}T00:00:00.000Z`);
+  const stamp2 = iso(at);
+  if (!stamp2.startsWith(value)) reject();
+  return stamp2;
 }
-function saveEndpoint(context, endpoint, env) {
-  if (context.endpointSource !== "--endpoint" || isDefaultEndpoint(endpoint)) {
-    return void 0;
+function parseSince(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  if (duration3 !== null) {
+    return fromDuration(duration3[1] ?? "", duration3[2] ?? "", now);
   }
-  return rememberEndpoint(env, endpoint);
+  if (DATE_RE.test(value)) return fromDate(value);
+  if (TIMESTAMP_RE.test(value)) return iso(new Date(value));
+  return reject();
 }
-async function readProfile(client, webUrl) {
+function parseExpires(text, now) {
+  const value = text.trim();
+  const duration3 = DURATION_RE.exec(value);
+  let stamp2;
   try {
-    return await client.me();
-  } catch (error62) {
-    if (error62 instanceof RemoteError && NO_PROFILE_STATUSES.has(error62.status ?? 0)) {
-      throw new ConfigError(`finish your account at ${trimSlash2(webUrl)}${LOGIN_PAGE}`);
+    if (duration3 !== null) {
+      const span = durationMs(duration3[1] ?? "", duration3[2] ?? "");
+      if (span === void 0) reject(EXPIRES_MESSAGE);
+      stamp2 = iso(new Date(now.getTime() + span));
+    } else if (DATE_RE.test(value)) {
+      stamp2 = fromDate(value);
+    } else if (TIMESTAMP_RE.test(value)) {
+      stamp2 = iso(new Date(value));
+    } else {
+      return reject(EXPIRES_MESSAGE);
     }
-    throw error62;
+  } catch {
+    return reject(EXPIRES_MESSAGE);
   }
+  return stamp2;
 }
-async function runLogout(context, io) {
-  requireServer("logout", context);
-  const endpoint = await resolveEndpoint(context, io);
-  const credential = findCredential(io.env, endpoint);
-  if (credential === void 0) {
-    writeLine(io.stdout, `Not logged in to ${endpoint}.`);
-    return 0;
+
+// src/scope.ts
+function resolveScope(options, context, now = /* @__PURE__ */ new Date()) {
+  if (options.project !== void 0 && options.all === true) {
+    throw new UsageError("--project and --all cannot be used together");
   }
-  const http = { debug: context.debug, fetch: io.fetch };
-  if (!await revoke(endpoint, credential.refreshToken, http)) {
-    writeLine(
-      io.stderr,
-      `quibble: warning: could not revoke the refresh token at ${endpoint}`
-    );
+  if (options.open === true && options.status !== void 0) {
+    throw new UsageError("--open and --status cannot be used together");
   }
-  removeCredential(io.env, endpoint);
-  writeLine(io.stdout, `Logged out of ${endpoint}.`);
-  return 0;
+  const project = options.project ?? (options.all === true ? void 0 : context.project);
+  const status = options.open === true ? "open" : options.status;
+  return {
+    // No list reads two organizations, because the path names one.
+    org: requireOrg(context),
+    ...project === void 0 ? {} : { project },
+    ...status === void 0 ? {} : { status },
+    ...options.since === void 0 ? {} : { since: parseSince(options.since, now) }
+  };
 }
-async function revoke(endpoint, refreshToken, http) {
-  try {
-    const config2 = await fetchAuthConfig(endpoint, http);
-    if (config2.mode === "local") return true;
-    await revokeToken(
-      { region: config2.region, ...http },
-      { clientId: config2.cliClientId, token: refreshToken }
-    );
-    return true;
-  } catch {
-    return false;
+function tagFilter(tags) {
+  return tags === void 0 || tags.length === 0 ? {} : { tags: [...tags] };
+}
+
+// src/commands/list.ts
+var COLUMNS = [
+  "id",
+  "created",
+  "severity",
+  "status",
+  "project",
+  "reporter",
+  "tags",
+  "group",
+  "summary"
+];
+var REPORTER_WIDTH = 20;
+var TAGS_WIDTH = 24;
+var SUMMARY_MAX = 60;
+var RECURRED_MARK = "\u21BB";
+function cut3(text, width) {
+  if (text.length <= width) return text;
+  return `${text.slice(0, width - 3)}...`;
+}
+function summaryOf(complaint) {
+  return cut3(printable(summarize(complaint.message)), SUMMARY_MAX);
+}
+function limitNote(count, limit, more) {
+  if (limit >= MAX_LIMIT) {
+    return count >= MAX_LIMIT ? `Showing the newest ${MAX_LIMIT} complaints: older ones may exist, narrow the filters to see them.` : void 0;
   }
+  return more ? `Showing the newest ${limit} complaints: pass --limit to see more (up to ${MAX_LIMIT}).` : void 0;
 }
-async function runWhoami(options, context, io) {
-  if (context.mode === "local") {
-    checkActAs(context);
-    writeLine(io.stdout, LOCAL_IDENTITY_MESSAGE);
+var BUDGET_NOTE = "The server stopped searching early, so older matches may exist: narrow the filters or pass --since.";
+async function runList(options, context, io) {
+  if (options.ids === true && options.json === true) {
+    throw new UsageError("--ids and --json cannot be used together");
+  }
+  const { store, client } = await openBackend(context, io);
+  const reporter = options.mine === true ? await resolveMine(context, client, io.env) : void 0;
+  const filter = parseListFilter({
+    ...resolveScope(options, context),
+    ...options.severity === void 0 ? {} : { severity: options.severity },
+    ...tagFilter(options.tag),
+    ...options.search === void 0 ? {} : { q: options.search },
+    ...reporter === void 0 ? {} : { reporter },
+    ...options.limit === void 0 ? {} : { limit: options.limit }
+  });
+  const limit = filter.limit ?? DEFAULT_LIMIT;
+  const page = await listComplaintPage(store, {
+    ...filter,
+    limit: Math.min(limit + 1, MAX_LIMIT)
+  });
+  const complaints = page.complaints.slice(0, limit);
+  if (options.json === true) {
+    writeJson(io.stdout, complaints);
+    return 0;
+  }
+  const note = limitNote(complaints.length, limit, page.complaints.length > limit);
+  if (note !== void 0) writeLine(io.stderr, note);
+  if (page.truncated) writeLine(io.stderr, BUDGET_NOTE);
+  if (options.ids === true) {
+    for (const complaint of complaints) writeLine(io.stdout, complaint.id);
+    return 0;
+  }
+  if (complaints.length === 0) {
+    writeLine(io.stdout, "No complaints found.");
     return 0;
   }
+  const lines = options.ungroup === true ? formatTable(complaints.map((complaint) => ({ complaint }))) : formatTable(
+    groupComplaints(complaints).map((group) => ({
+      complaint: group.head,
+      group
+    }))
+  );
+  for (const line of lines) writeLine(io.stdout, line);
+  return 0;
+}
+function reporterOf(complaint) {
+  return cut3(printable(complaint.reporterName ?? complaint.reporter), REPORTER_WIDTH);
+}
+function groupCell(group) {
+  const count = group.count > 1 ? `\xD7${group.count}` : "";
+  return `${count}${group.recurred ? RECURRED_MARK : ""}`;
+}
+function formatTable(rows2) {
+  const grouped = rows2.some((row) => row.group !== void 0);
+  const columns = COLUMNS.filter((name) => grouped || name !== "group");
+  const cells = rows2.map(({ complaint, group }) => {
+    const values = {
+      id: complaint.id.slice(0, 8),
+      created: complaint.createdAt.slice(0, 16),
+      severity: complaint.severity,
+      status: complaint.status,
+      project: complaint.project,
+      reporter: reporterOf(complaint),
+      tags: cut3(printable(complaint.tags.join(",")), TAGS_WIDTH),
+      group: group === void 0 ? "" : groupCell(group),
+      summary: summaryOf(complaint)
+    };
+    return columns.map((name) => values[name]);
+  });
+  const widths = columns.map(
+    (name, column) => cells.reduce(
+      (width, row) => Math.max(width, (row[column] ?? "").length),
+      name.length
+    )
+  );
+  const format = (line) => line.map((cell2, column) => cell2.padEnd(widths[column] ?? 0)).join("  ").trimEnd();
+  return [format(columns), ...cells.map(format)];
+}
+
+// src/commands/orgs.ts
+var ORGS_PAGE3 = "/orgs";
+var COLUMNS2 = ["SLUG", "NAME", "ROLE", "OPEN"];
+async function runOrgs(options, context, io) {
+  requireServer("orgs", context);
   const client = await openClient(context, io);
   const endpoint = requireEndpoint(context);
-  const me = await client.me();
-  const org = me.kind === "token" || client.org === void 0 ? void 0 : await client.organization();
+  const answer2 = await client.orgs();
   if (options.json === true) {
-    writeJson(io.stdout, {
-      ...me.body,
-      endpoint,
-      ...org === void 0 ? {} : { org: org.body }
-    });
+    writeJson(io.stdout, answer2.body);
     return 0;
   }
-  const lines = whoamiLines(endpoint, me, org);
-  if (me.kind !== "token" && me.orgs.length === 0) {
+  if (answer2.orgs.length === 0) {
     const config2 = await fetchAuthConfig(endpoint, {
       debug: context.debug,
-      fetch: io.fetch
+      fetch: io.fetch,
+      timeoutMs: context.timeoutMs
     });
     const webUrl = config2.mode === "cognito" ? trimSlash2(config2.webUrl) : endpoint;
-    lines.push("", `Create one at ${webUrl}${ORGS_PAGE2}.`);
+    writeLine(io.stdout, `No organizations yet: create one at ${webUrl}${ORGS_PAGE3}.`);
+    return 0;
   }
-  for (const line of lines) writeLine(io.stdout, line);
+  for (const line of formatOrgs(answer2.orgs)) writeLine(io.stdout, line);
   return 0;
 }
-function rows(pairs) {
-  const width = Math.max(...pairs.map(([key]) => key.length));
-  return pairs.map(([key, value]) => `${key.padEnd(width)}  ${value}`);
-}
-function block(entries) {
-  if (entries.length === 0) return ["  none"];
-  const width = Math.max(...entries.map(([key]) => key.length));
-  return entries.map(([key, value]) => `  ${key.padEnd(width)}  ${value}`);
-}
-function whoamiLines(endpoint, me, org) {
-  if (me.kind === "token") {
-    return rows([
-      ["endpoint", endpoint],
-      ["token", me.name ?? me.reporter],
-      ["org", me.org ?? ""],
-      ["project", me.project ?? ""],
-      ["role", me.role ?? "filer"]
-    ]);
-  }
-  const lines = rows([
-    ["endpoint", endpoint],
-    ["email", me.email ?? ""],
-    ["name", me.name ?? ""],
-    ["sub", me.sub ?? ""],
-    ["platform", me.platform ? "yes" : "no"]
+function formatOrgs(orgs) {
+  const rows2 = [...orgs].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map((entry) => [
+    entry.org,
+    entry.name,
+    entry.role,
+    entry.openCount === void 0 ? "" : String(entry.openCount)
   ]);
-  lines.push("", "Organizations");
-  lines.push(...block(me.orgs.map((entry) => [entry.org, entry.role])));
-  if (org === void 0) return lines;
-  lines.push("", `Roles in ${org.org}`);
-  lines.push(...block(org.roles.map((entry) => [entry.project, entry.role])));
-  return lines;
+  const widths = COLUMNS2.map(
+    (name, column) => rows2.reduce((width, row) => Math.max(width, (row[column] ?? "").length), name.length)
+  );
+  const format = (cells) => cells.map(
+    (cell2, column) => column === COLUMNS2.length - 1 ? cell2.padStart(widths[column] ?? 0) : cell2.padEnd(widths[column] ?? 0)
+  ).join("  ").trimEnd();
+  return [format(COLUMNS2), ...rows2.map(format)];
 }
 
 // src/commands/project.ts
@@ -28720,11 +29001,14 @@ function buildProgram(io, setCode) {
   }).exitOverride();
   withGlobalOptions(program2);
   withGlobalOptions(
-    program2.command("init").description("write a .quibblerc in the current directory").option("--project <name>", "project name (default: the directory name)").option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--force", "overwrite an existing .quibblerc or skill file")
+    program2.command("init").description("write a .quibblerc in the current directory").option(
+      "--project <name>",
+      "project name (default: the git remote origin, else the directory name)"
+    ).option("-t, --tag <tag>", "allowed tag (repeatable)", collect).option("--agent <name>", "agent named in the snippet (default: claude)").option("--skill", "also write .claude/skills/quibble/SKILL.md").option("--hook", "also add the quibble sync hook to .claude/settings.json").option("--no-login", "do not log in through the browser without a credential").option("--force", "overwrite an existing .quibblerc or skill file")
   ).action(async function() {
     const options = { ...this.opts(), ...globals(program2, this) };
     rejectEmptyOptions(options);
-    setCode(await runInit(options, io));
+    setCode(await runInit({ ...options, version: packageVersion() }, io));
   });
   withGlobalOptions(
     program2.command("snippet").description("print or write the agent snippet of this project").option("--append <file>", "append the snippet to a file such as CLAUDE.md").option("--skill", "write .claude/skills/quibble/SKILL.md").option("--hook", "add the quibble sync hook to .claude/settings.json").option("--agent <name>", "agent named in the snippet").option("--project <name>", "project name (overrides .quibblerc)").option("--force", "overwrite an existing skill file")