moodle-cli 0.9.0 → 0.9.2

package/dist/moodle.js

@@ -98,10 +98,10 @@ function postRow(p, subject, tz = "UTC") {
 }
 
 // src/doctor.ts
-import { access, readdir as readdir2, readFile as readFile4 } from "fs/promises";
-import { constants as constants2 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { access as access3, readdir as readdir3, readFile as readFile4 } from "fs/promises";
+import { constants as constants3 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join9 } from "path";
 
 // src/session-fetch.ts
 var MAX_REDIRECTS = 5;
@@ -127,7 +127,12 @@ async function fetchWithSession(input2, init, moodleOrigin, cookie, fetchImpl =
       headers.delete("authorization");
       headers.delete("proxy-authorization");
     }
-    const response = await fetchImpl(url.toString(), { ...init, method, body, headers: Object.fromEntries(headers), signal, redirect: "manual" });
+    let response;
+    try {
+      response = await fetchImpl(url.toString(), { ...init, method, body, headers: Object.fromEntries(headers), signal, redirect: "manual" });
+    } catch (error) {
+      throw requestFailure(error, url, deadline);
+    }
     if (!REDIRECT_STATUSES.has(response.status)) return response;
     const location = response.headers.get("location");
     if (!location) return response;
@@ -148,13 +153,31 @@ async function fetchWithSession(input2, init, moodleOrigin, cookie, fetchImpl =
     url = next;
   }
 }
+var RequestFailed = class extends Error {
+  host;
+  timedOut;
+  constructor(host, timedOut, cause) {
+    super(timedOut ? `${host} did not respond within ${REQUEST_TIMEOUT_MS / 1e3}s.` : `Could not reach ${host}: ${cause}`);
+    this.name = "RequestFailed";
+    this.host = host;
+    this.timedOut = timedOut;
+  }
+};
+function requestFailure(error, url, deadline) {
+  if (deadline.aborted) {
+    return new RequestFailed(url.host, true);
+  }
+  if (!(error instanceof Error)) {
+    return error;
+  }
+  return new RequestFailed(url.host, false, error.cause instanceof Error ? error.cause.message : error.message);
+}
 
 // src/auth.ts
 import { ALL_PROFILES, getCookies } from "@steipete/sweet-cookie";
-import { execFile as execFileCallback } from "child_process";
-import { readdir } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { join as join5 } from "path";
 
 // src/constants.ts
 var PACKAGE_NAME = "moodle-cli";
@@ -174,6 +197,15 @@ var GRADE_REPORT_INDEX_PATH = "/grade/report/index.php";
 var GRADE_REPORT_OVERVIEW_PATH = "/grade/report/overview/index.php";
 var GRADE_REPORT_PATH = "/grade/report/user/index.php";
 var LOGIN_PATH = "/login/index.php";
+var MOBILE_LAUNCH_PATH = "/admin/tool/mobile/launch.php";
+var MOBILE_AUTOLOGIN_PATH = "/admin/tool/mobile/autologin.php";
+var WEBSERVICE_REST_PATH = "/webservice/rest/server.php";
+var SERVICE_NOLOGIN_PATH = "/lib/ajax/service-nologin.php";
+var MOBILE_SERVICE_SHORTNAME = "moodle_mobile_app";
+var MOBILE_URL_SCHEME = "moodlecli";
+var MOBILE_USER_AGENT = "MoodleMobile 4.5.0 (moodle-cli)";
+var FUNC_MOBILE_PUBLIC_CONFIG = "tool_mobile_get_public_config";
+var FUNC_MOBILE_AUTOLOGIN_KEY = "tool_mobile_get_autologin_key";
 var FUNC_GET_SITE_INFO = "core_webservice_get_site_info";
 var FUNC_GET_COURSES = "core_enrol_get_users_courses";
 var FUNC_GET_COURSES_BY_TIMELINE = "core_course_get_enrolled_courses_by_timeline_classification";
@@ -192,6 +224,7 @@ var CONFIG_FILENAME = "config.yaml";
 var CONFIG_DIR_NAME = ".config/moodle-cli";
 var CACHE_DIR_NAME = ".cache/moodle-cli";
 var SESSION_CACHE_FILENAME = "session.json";
+var CDP_PROFILE_DIR_NAME = ".cache/moodle-cli/browser-profile";
 var DEFAULT_SESSION_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var KEEPALIVE_LAUNCH_AGENT_LABEL = "com.moodle-cli.keepalive";
 var KEEPALIVE_DEFAULT_INTERVAL_MINUTES = 30;
@@ -204,6 +237,466 @@ var ENV_MOODLE_TOKEN = "MOODLE_TOKEN";
 var MOODLE_SESSION_COOKIE_PREFIX = "MoodleSession";
 var WRANGLER_VERSION = "4.131.0";
 
+// src/cookie-stores.ts
+import { constants } from "fs";
+import { access, readdir } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var CHROMIUM_ROOTS = [
+  ["Chrome", "Google/Chrome"],
+  ["Edge", "Microsoft Edge"],
+  ["Brave", "BraveSoftware/Brave-Browser"]
+];
+var CHROMIUM_FILES = ["Cookies", "Network/Cookies"];
+var SAFARI_FILES = [
+  "Library/Cookies/Cookies.binarycookies",
+  "Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies"
+];
+function probe(path5, mode) {
+  return access(path5, mode).then(() => true, () => false);
+}
+async function chromiumProfiles(root) {
+  const entries = await readdir(root).catch(() => []);
+  const profiles = entries.filter((entry) => entry === "Default" || entry.startsWith("Profile "));
+  return profiles.length ? profiles : ["Default"];
+}
+async function browserCookieStores(options = {}) {
+  if ((options.platform ?? process.platform) !== "darwin") {
+    return [];
+  }
+  const home = options.homeDir ?? homedir();
+  const stores = [];
+  const add = async (browser, path5) => {
+    if (await probe(path5, constants.F_OK)) {
+      stores.push({ browser, path: path5, readable: await probe(path5, constants.R_OK) });
+    }
+  };
+  for (const [browser, directory] of CHROMIUM_ROOTS) {
+    const root = join(home, "Library/Application Support", directory);
+    for (const profile of await chromiumProfiles(root)) {
+      for (const file2 of CHROMIUM_FILES) {
+        await add(browser, join(root, profile, file2));
+      }
+    }
+  }
+  const firefoxRoot = join(home, "Library/Application Support/Firefox/Profiles");
+  for (const profile of await readdir(firefoxRoot).catch(() => [])) {
+    await add("Firefox", join(firefoxRoot, profile, "cookies.sqlite"));
+  }
+  for (const file2 of SAFARI_FILES) {
+    await add("Safari", join(home, file2));
+  }
+  return stores;
+}
+function unreadableCookieStores(stores) {
+  return stores.filter((store) => !store.readable);
+}
+function cookieStoresBlocked(stores) {
+  return stores.length > 0 && stores.every((store) => !store.readable);
+}
+
+// src/cdp-login.ts
+import { spawn } from "child_process";
+import { access as access2, mkdir } from "fs/promises";
+import { accessSync, constants as fsConstants } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+var CdpError = class extends Error {
+  constructor(message, hint) {
+    super(message);
+    this.hint = hint;
+    this.name = "CdpError";
+  }
+  hint;
+};
+var NO_CHROMIUM_HINT = "Install Google Chrome, Microsoft Edge, Brave, or Chromium, or run `moodle auth login --paste` to hand over the cookie yourself.";
+var DEFAULT_INTERACTIVE_TIMEOUT_MS = 3e5;
+var DEFAULT_HEADLESS_TIMEOUT_MS = 45e3;
+var HANDSHAKE_TIMEOUT_MS = 15e3;
+var RPC_TIMEOUT_MS = 1e4;
+var CLOSE_TIMEOUT_MS = 2e3;
+var KILL_GRACE_MS = 1e3;
+function withTimeout(promise, ms, onTimeout) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => resolve(onTimeout()), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
+}
+function cdpProfileDir(homeDir = homedir2()) {
+  return join2(homeDir, CDP_PROFILE_DIR_NAME);
+}
+function launchFlags(profileDir, url, headless) {
+  return [
+    `--user-data-dir=${profileDir}`,
+    "--remote-debugging-pipe",
+    "--no-first-run",
+    "--no-default-browser-check",
+    "--no-service-autorun",
+    "--disable-sync",
+    "--disable-background-networking",
+    "--disable-features=Translate,MediaRouter,OptimizationHints",
+    // macOS: use an in-memory key so decrypting cookies never prompts Keychain.
+    "--use-mock-keychain",
+    // Linux: avoid a gnome-keyring/kwallet unlock prompt for the same reason.
+    "--password-store=basic",
+    ...headless ? ["--headless=new"] : [],
+    url
+  ];
+}
+var MAC_BROWSERS = [
+  { name: "Google Chrome", path: "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" },
+  { name: "Microsoft Edge", path: "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge" },
+  { name: "Brave", path: "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser" },
+  { name: "Chromium", path: "/Applications/Chromium.app/Contents/MacOS/Chromium" }
+];
+var LINUX_BROWSERS = [
+  { name: "Google Chrome", path: "google-chrome" },
+  { name: "Google Chrome", path: "google-chrome-stable" },
+  { name: "Chromium", path: "chromium" },
+  { name: "Chromium", path: "chromium-browser" },
+  { name: "Microsoft Edge", path: "microsoft-edge" },
+  { name: "Brave", path: "brave-browser" }
+];
+function windowsBrowsers(env) {
+  const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter(Boolean);
+  const relative = [
+    ["Google Chrome", "Google/Chrome/Application/chrome.exe"],
+    ["Microsoft Edge", "Microsoft/Edge/Application/msedge.exe"],
+    ["Brave", "BraveSoftware/Brave-Browser/Application/brave.exe"],
+    ["Chromium", "Chromium/Application/chrome.exe"]
+  ];
+  return roots.flatMap((root) => relative.map(([name, tail]) => ({ name, path: join2(root, tail) })));
+}
+async function findChromiumBrowser(options = {}) {
+  if (options.browserPath) {
+    return { name: "Chromium", path: options.browserPath };
+  }
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  if (platform === "linux") {
+    for (const candidate of LINUX_BROWSERS) {
+      const resolved = resolveFromPath(candidate.path, env, platform);
+      if (resolved) return { name: candidate.name, path: resolved };
+    }
+    return null;
+  }
+  const candidates = platform === "win32" ? windowsBrowsers(env) : MAC_BROWSERS;
+  for (const candidate of candidates) {
+    if (await isExecutable(candidate.path)) return candidate;
+  }
+  return null;
+}
+async function loginWithCdp(options) {
+  const browser = await findChromiumBrowser(options);
+  if (!browser) {
+    throw new CdpError("No Chromium-family browser is installed.", NO_CHROMIUM_HINT);
+  }
+  const profileDir = options.profileDir ?? cdpProfileDir(options.homeDir);
+  await mkdir(profileDir, { recursive: true, mode: 448 });
+  const headless = options.headless ?? false;
+  const spawnImpl = options.spawn ?? spawn;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const now = options.now ?? Date.now;
+  const timeoutMs = options.timeoutMs ?? (headless ? DEFAULT_HEADLESS_TIMEOUT_MS : DEFAULT_INTERACTIVE_TIMEOUT_MS);
+  const pollIntervalMs = options.pollIntervalMs ?? 500;
+  const child = spawnImpl(browser.path, launchFlags(profileDir, options.url, headless), {
+    stdio: ["ignore", "ignore", "pipe", "pipe", "pipe"]
+  });
+  const connection = new CdpConnection(child, { rpc: options.rpcTimeoutMs, close: options.closeTimeoutMs });
+  try {
+    await connection.handshake(options.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS);
+    options.onOpened?.();
+    const deadline = now() + timeoutMs;
+    while (now() < deadline) {
+      if (connection.closed) {
+        throw new CdpError(
+          "The browser closed before sign-in completed.",
+          "Another moodle login or renewal may be using the same browser profile. Wait for it to finish, then retry."
+        );
+      }
+      const cookies = await connection.getCookies();
+      if (await options.isDone(cookies)) {
+        return { cookies, browserName: browser.name };
+      }
+      await sleep(pollIntervalMs);
+    }
+    throw new CdpError(
+      headless ? "Timed out renewing the session in the background browser." : "Timed out waiting for sign-in.",
+      headless ? "Run `moodle auth login` to sign in again." : "Complete the sign-in in the browser window, then retry."
+    );
+  } finally {
+    await connection.close();
+  }
+}
+var CdpConnection = class {
+  constructor(child, timeouts = {}) {
+    this.child = child;
+    this.timeouts = timeouts;
+    child.on("exit", () => {
+      this.exited = true;
+      clearTimeout(this.hardKill);
+      this.markClosed();
+    });
+    child.on("error", () => this.markClosed());
+    const toBrowser = child.stdio[3];
+    toBrowser?.on("error", () => this.markClosed());
+    const fromBrowser = child.stdio[4];
+    fromBrowser?.on("error", () => this.markClosed());
+    fromBrowser?.on("data", (chunk) => this.consume(chunk));
+  }
+  child;
+  timeouts;
+  nextId = 1;
+  buffer = "";
+  pending = /* @__PURE__ */ new Map();
+  closed = false;
+  exited = false;
+  hardKill;
+  markClosed() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const resolve of this.pending.values()) resolve({ error: { message: "browser closed" } });
+    this.pending.clear();
+  }
+  consume(chunk) {
+    this.buffer += chunk.toString("utf8");
+    let index;
+    while ((index = this.buffer.indexOf("\0")) !== -1) {
+      const raw = this.buffer.slice(0, index);
+      this.buffer = this.buffer.slice(index + 1);
+      let message;
+      try {
+        message = JSON.parse(raw);
+      } catch {
+        continue;
+      }
+      if (typeof message.id === "number") {
+        this.pending.get(message.id)?.(message);
+        this.pending.delete(message.id);
+      }
+    }
+  }
+  call(method, params = {}, timeoutMs = this.timeouts.rpc ?? RPC_TIMEOUT_MS) {
+    if (this.closed) return Promise.resolve({ error: { message: "browser closed" } });
+    const id2 = this.nextId++;
+    const toBrowser = this.child.stdio[3];
+    const request = new Promise((resolve) => {
+      this.pending.set(id2, resolve);
+      try {
+        toBrowser?.write(`${JSON.stringify({ id: id2, method, params })}\0`);
+      } catch {
+        this.pending.delete(id2);
+        resolve({ error: { message: "pipe write failed" } });
+      }
+    });
+    return withTimeout(request, timeoutMs, () => {
+      this.pending.delete(id2);
+      return { error: { message: "timeout" } };
+    });
+  }
+  async handshake(timeoutMs) {
+    const version = await this.call("Browser.getVersion", {}, timeoutMs);
+    if (version.error || this.closed) {
+      throw new CdpError(
+        "Could not talk to the browser over remote debugging.",
+        "Update the browser, or run `moodle auth login --paste` instead."
+      );
+    }
+  }
+  async getCookies() {
+    const response = await this.call("Storage.getCookies");
+    const cookies = response.result?.cookies ?? [];
+    return cookies.map((cookie) => ({
+      name: String(cookie.name ?? ""),
+      value: String(cookie.value ?? ""),
+      domain: String(cookie.domain ?? ""),
+      path: typeof cookie.path === "string" ? cookie.path : void 0,
+      secure: Boolean(cookie.secure),
+      httpOnly: Boolean(cookie.httpOnly)
+    }));
+  }
+  async close() {
+    if (!this.closed) {
+      await this.call("Browser.close", {}, this.timeouts.close ?? CLOSE_TIMEOUT_MS);
+    }
+    if (this.exited) return;
+    if (!this.child.killed) this.child.kill();
+    if (!this.exited) {
+      this.hardKill = setTimeout(() => {
+        if (!this.exited) this.child.kill("SIGKILL");
+      }, KILL_GRACE_MS);
+      this.hardKill.unref?.();
+    }
+  }
+};
+async function isExecutable(path5) {
+  try {
+    await access2(path5, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveFromPath(name, env, platform) {
+  if (name.includes("/")) return null;
+  const separator = platform === "win32" ? ";" : ":";
+  for (const dir of (env.PATH ?? "").split(separator).filter(Boolean)) {
+    const candidate = join2(dir, name);
+    try {
+      accessSync(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/mobile-login-core.ts
+function parseLaunchToken(location) {
+  const match = /token=([^&#]+)/.exec(location);
+  if (!match) return null;
+  let decoded;
+  try {
+    decoded = Buffer.from(decodeURIComponent(match[1]), "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  const parts = decoded.split(":::");
+  if (parts.length < 2 || !parts[1]) return null;
+  return { wstoken: parts[1], privatetoken: parts[2] || void 0 };
+}
+async function readMobilePublicConfig(baseUrl, fetchImpl = fetch) {
+  const url = new URL(SERVICE_NOLOGIN_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("info", FUNC_MOBILE_PUBLIC_CONFIG);
+  const body = JSON.stringify([{ index: 0, methodname: FUNC_MOBILE_PUBLIC_CONFIG, args: {} }]);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return null;
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return null;
+  }
+  const data = Array.isArray(payload) ? payload[0] : void 0;
+  if (!data || data.error) return null;
+  const config = data.data;
+  if (!config) return null;
+  return {
+    webserviceEnabled: config.enablewebservices === 1 || config.enablewebservices === true,
+    mobileServiceEnabled: config.enablemobilewebservice === 1 || config.enablemobilewebservice === true
+  };
+}
+async function fetchMobileToken(baseUrl, cookie, fetchImpl = fetch) {
+  const url = new URL(MOBILE_LAUNCH_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("service", MOBILE_SERVICE_SHORTNAME);
+  url.searchParams.set("passport", randomPassport());
+  url.searchParams.set("urlscheme", MOBILE_URL_SCHEME);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "GET",
+      headers: { "user-agent": MOBILE_USER_AGENT, cookie: `${cookie.name}=${cookie.value}` },
+      redirect: "manual"
+    });
+  } catch {
+    return null;
+  }
+  const location = response.headers.get("location");
+  if (location) {
+    await response.body?.cancel();
+    return parseLaunchToken(location);
+  }
+  const html = await response.text().catch(() => "");
+  const inline = new RegExp(`${MOBILE_URL_SCHEME}://[^"'\\s]*token=[^"'\\s]+`).exec(html);
+  return inline ? parseLaunchToken(inline[0]) : null;
+}
+async function mintSessionFromMobileToken(baseUrl, userid, token, fetchImpl = fetch) {
+  if (!token.privatetoken) return null;
+  const key = await requestAutologinKey(baseUrl, token, fetchImpl);
+  if (!key) return null;
+  return exchangeAutologinKey(baseUrl, userid, key, fetchImpl);
+}
+async function requestAutologinKey(baseUrl, token, fetchImpl) {
+  const url = new URL(WEBSERVICE_REST_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("moodlewsrestformat", "json");
+  url.searchParams.set("wsfunction", FUNC_MOBILE_AUTOLOGIN_KEY);
+  url.searchParams.set("wstoken", token.wstoken);
+  const form = new URLSearchParams({ privatetoken: token.privatetoken ?? "" });
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", "user-agent": MOBILE_USER_AGENT },
+      body: form.toString()
+    });
+  } catch {
+    return null;
+  }
+  if (!response.ok) return null;
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || "exception" in payload) return null;
+  const key = payload.key;
+  return typeof key === "string" && key ? key : null;
+}
+async function exchangeAutologinKey(baseUrl, userid, key, fetchImpl) {
+  const url = new URL(MOBILE_AUTOLOGIN_PATH, ensureTrailingSlash(baseUrl));
+  url.searchParams.set("userid", String(userid));
+  url.searchParams.set("key", key);
+  let response;
+  try {
+    response = await fetchImpl(url.toString(), {
+      method: "GET",
+      headers: { "user-agent": MOBILE_USER_AGENT },
+      redirect: "manual"
+    });
+  } catch {
+    return null;
+  }
+  const value = extractSessionCookie(response);
+  return value ? { cookie: { name: value.name, value: value.value, source: "mobile-token" } } : null;
+}
+function extractSessionCookie(response) {
+  const headers = typeof response.headers.getSetCookie === "function" ? response.headers.getSetCookie() : [response.headers.get("set-cookie") ?? ""].filter(Boolean);
+  for (const header of headers) {
+    const match = new RegExp(`(${MOODLE_SESSION_COOKIE_PREFIX}\\w*)=([^;\\s]+)`).exec(header);
+    if (match && match[2] && match[2] !== "deleted") {
+      return { name: match[1], value: match[2] };
+    }
+  }
+  return null;
+}
+function ensureTrailingSlash(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/`;
+}
+function randomPassport() {
+  return (Math.random() * 1e3).toFixed(10);
+}
+
 // src/errors.ts
 import { CliError } from "@bunizao/cli-kit";
 import { CliError as CliError2 } from "@bunizao/cli-kit";
@@ -242,15 +735,18 @@ function isLoginRequiredError(error) {
 function isLoginErrorCode(code) {
   return ["servicerequireslogin", "sitepolicynotagreed"].includes(code ?? "");
 }
+function asNetworkError(error) {
+  return error instanceof RequestFailed ? new CliError("network", error.message, "Check the connection or VPN, then retry.") : null;
+}
 
 // src/session-cache.ts
 import { createHash, randomBytes } from "crypto";
 
 // src/mcp/credentials/node-store.ts
-import { spawn } from "child_process";
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join, win32 as windowsPath } from "path";
+import { spawn as spawn2 } from "child_process";
+import { chmod, mkdir as mkdir2, readFile, rename, rm, writeFile } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3, win32 as windowsPath } from "path";
 
 // src/mcp/credentials/store.ts
 var TOKEN_OVERLAP_MS = 10 * 60 * 1e3;
@@ -475,7 +971,7 @@ if ([IO.File]::Exists($payload.path)) { Remove-Item -LiteralPath $payload.path -
 var NodeCredentialCommandRunner = class {
   async run(command, args, input2) {
     return new Promise((resolve, reject) => {
-      const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+      const child = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
       let stdout = "";
       let stderr = "";
       child.stdout.setEncoding("utf8").on("data", (chunk) => {
@@ -720,7 +1216,7 @@ var UnavailableCredentialBackend = class {
   }
 };
 var PrivateFileCredentialBackend = class {
-  constructor(baseDirectory = join(homedir(), ".config", "moodle-cli", "mcp", "credentials")) {
+  constructor(baseDirectory = join3(homedir3(), ".config", "moodle-cli", "mcp", "credentials")) {
     this.baseDirectory = baseDirectory;
   }
   baseDirectory;
@@ -739,7 +1235,7 @@ var PrivateFileCredentialBackend = class {
   async write(profile, credentials) {
     const path5 = this.path(profile);
     const temporary = `${path5}.${process.pid}.tmp`;
-    await mkdir(dirname(path5), { recursive: true, mode: 448 });
+    await mkdir2(dirname(path5), { recursive: true, mode: 448 });
     await chmod(dirname(path5), 448);
     await writeFile(temporary, `${JSON.stringify(credentials)}
 `, { encoding: "utf8", mode: 384 });
@@ -752,15 +1248,15 @@ var PrivateFileCredentialBackend = class {
   }
   path(profile) {
     validateProfile(profile);
-    return join(this.baseDirectory, `${profile}.json`);
+    return join3(this.baseDirectory, `${profile}.json`);
   }
 };
 function createDefaultCredentialStore(options = {}) {
   const platform = options.platform ?? process.platform;
   const runner = options.runner ?? new NodeCredentialCommandRunner();
   const preferred = platform === "darwin" ? new MacOSKeychainCredentialBackend(runner) : platform === "linux" ? new LinuxSecretServiceCredentialBackend(runner) : platform === "win32" ? new WindowsCredentialManagerBackend(runner) : new UnavailableCredentialBackend(`${platform} credential store`);
-  const home = options.homeDirectory ?? homedir();
-  const fallbackDirectory = platform === "win32" ? windowsPath.join(home, "AppData", "Local", "moodle-cli", "credentials") : join(home, ".config", "moodle-cli", "mcp", "credentials");
+  const home = options.homeDirectory ?? homedir3();
+  const fallbackDirectory = platform === "win32" ? windowsPath.join(home, "AppData", "Local", "moodle-cli", "credentials") : join3(home, ".config", "moodle-cli", "mcp", "credentials");
   const fallback = platform === "win32" ? new WindowsDpapiFileCredentialBackend(fallbackDirectory, runner) : new PrivateFileCredentialBackend(fallbackDirectory);
   return new SafeCredentialStore(preferred, fallback, platform !== "win32");
 }
@@ -897,16 +1393,16 @@ function isRecord(value) {
 }
 
 // src/session-cache.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-var nodeFs = { readFile: readFile2, writeFile: writeFile2, mkdir: mkdir2, rm: rm2, chmod: chmod2 };
-function sessionCachePath(homeDir = homedir2()) {
-  return join2(homeDir, CACHE_DIR_NAME, SESSION_CACHE_FILENAME);
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+var nodeFs = { readFile: readFile2, writeFile: writeFile2, mkdir: mkdir3, rm: rm2, chmod: chmod2 };
+function sessionCachePath(homeDir = homedir4()) {
+  return join4(homeDir, CACHE_DIR_NAME, SESSION_CACHE_FILENAME);
 }
 function isCachedSessionFresh(session, ttlMs = DEFAULT_SESSION_CACHE_TTL_MS, now = Date.now) {
   const age = now() - session.savedAt;
-  return age >= 0 && age <= ttlMs;
+  return !session.cookieInvalidated && age >= 0 && age <= ttlMs;
 }
 async function readCachedSession(baseUrl, options = {}) {
   if (options.noCache) {
@@ -941,7 +1437,7 @@ async function readCachedSession(baseUrl, options = {}) {
     return null;
   }
   const ttlMs = options.ttlMs ?? DEFAULT_SESSION_CACHE_TTL_MS;
-  return isCachedSessionFresh(session, ttlMs, options.now ?? Date.now) ? session : null;
+  return options.allowExpired || isCachedSessionFresh(session, ttlMs, options.now ?? Date.now) ? session : null;
 }
 async function writeCachedSession(session, options = {}) {
   if (options.noCache) return;
@@ -955,7 +1451,7 @@ async function writeCachedSession(session, options = {}) {
   await fs.chmod(path5, 384);
 }
 async function deleteCachedSession(baseUrl, options = {}) {
-  const current2 = await readCachedSession(baseUrl, { ...options, noCache: false, ttlMs: Number.MAX_SAFE_INTEGER });
+  const current2 = await readCachedSession(baseUrl, { ...options, noCache: false, allowExpired: true });
   if (!current2) {
     return;
   }
@@ -989,9 +1485,12 @@ function parseCachedSession(raw) {
     sesskey: session.sesskey,
     userid: session.userid,
     savedAt: session.savedAt,
+    ...session.cookieInvalidated === true ? { cookieInvalidated: true } : {},
     ...typeof session.cookieSource === "string" ? { cookieSource: session.cookieSource } : {},
     ...Array.isArray(session.unavailable) && session.unavailable.every((name) => typeof name === "string") ? { unavailable: session.unavailable } : {},
-    ...isRecord2(session.user) && typeof session.user.fullname === "string" && typeof session.user.userid === "number" ? { user: session.user } : {}
+    ...isRecord2(session.user) && typeof session.user.fullname === "string" && typeof session.user.userid === "number" ? { user: session.user } : {},
+    ...isRecord2(session.mobileToken) && typeof session.mobileToken.wstoken === "string" ? { mobileToken: { wstoken: session.mobileToken.wstoken, ...typeof session.mobileToken.privatetoken === "string" ? { privatetoken: session.mobileToken.privatetoken } : {} } } : {},
+    ...typeof session.mobileServiceEnabled === "boolean" ? { mobileServiceEnabled: session.mobileServiceEnabled } : {}
   };
 }
 function sameBaseUrl(left, right) {
@@ -1010,7 +1509,7 @@ function isMissingFileError(error) {
 var pendingCacheKeys = /* @__PURE__ */ new Map();
 async function cacheEncryptionKey(options) {
   if (options.encryptionKey) return options.encryptionKey();
-  const homeDirectory = options.homeDir ?? homedir2();
+  const homeDirectory = options.homeDir ?? homedir4();
   let pending = pendingCacheKeys.get(homeDirectory);
   if (!pending) {
     pending = (async () => {
@@ -1029,6 +1528,23 @@ async function cacheEncryptionKey(options) {
 }
 
 // src/auth.ts
+var COOKIE_STORE_TIMEOUT_MS = 8e3;
+function withTimeoutValue(promise, ms, onTimeout) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => resolve(onTimeout()), ms);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timer);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      }
+    );
+  });
+}
 async function getAuthenticatedSession(baseUrl, options = {}) {
   const envSession = loadSessionFromEnv(options.env);
   const validate = options.validateSession ?? validateSessionWithFetch(options);
@@ -1047,6 +1563,10 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
   if (cached) {
     return cached;
   }
+  const minted = await mintFromStoredToken(baseUrl, options, validate);
+  if (minted) {
+    return minted;
+  }
   const cookieWarnings = [];
   const providerOptions = {
     ...options,
@@ -1062,17 +1582,25 @@ async function getAuthenticatedSession(baseUrl, options = {}) {
     await refreshSessionCache(baseUrl, browserSession.cookie, browserSession.context, options);
     return { baseUrl, cookie: browserSession.cookie, ...browserSession.context, fromCache: false };
   }
+  const stores = await browserCookieStores({ homeDir: options.homeDir, platform: options.platform });
   throw new AuthError(
     `No usable MoodleSession found for ${baseUrl}.`,
-    authFailureHint(baseUrl, cookieWarnings, options.platform)
+    authFailureHint(baseUrl, cookieWarnings, options.platform, unreadableCookieStores(stores), options.env)
   );
 }
 async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {}) {
   const cookieWarnings = [];
+  const rawProvider = options.browserCookieProvider ?? defaultBrowserCookieProvider;
+  const cookieStoreTimeoutMs = options.cookieStoreTimeoutMs ?? COOKIE_STORE_TIMEOUT_MS;
+  const boundedProvider = (url, opts) => withTimeoutValue(rawProvider(url, opts), cookieStoreTimeoutMs, () => {
+    opts.onCookieWarnings?.(["Reading the browser cookie store timed out; opening a browser to sign in."]);
+    return [];
+  });
   const authOptions = {
     ...options,
     noCache: true,
     nonInteractive: true,
+    browserCookieProvider: boundedProvider,
     onCookieWarnings: (warnings) => {
       cookieWarnings.push(...warnings);
       options.onCookieWarnings?.(warnings);
@@ -1098,34 +1626,92 @@ async function getAuthenticatedSessionWithBrowserFallback(baseUrl, options = {})
       }
     }
   }
-  if (cookieAccessBlocked(cookieWarnings)) {
-    throw new AuthError(
-      `Cannot read browser cookies for ${baseUrl}.`,
-      cookieAccessHint(cookieWarnings, options.platform)
-    );
+  const probeBrowser = options.findBrowser ?? findChromiumBrowser;
+  const hasBrowser = Boolean(await probeBrowser({ ...options }));
+  if (!hasBrowser) {
+    const stores = await browserCookieStores({ homeDir: options.homeDir, platform: options.platform });
+    if (cookieAccessBlocked(cookieWarnings) || cookieStoresBlocked(stores)) {
+      throw new AuthError(
+        `Cannot read browser cookies for ${baseUrl}.`,
+        cookieAccessHint(cookieWarnings, options.platform, unreadableCookieStores(stores), options.env)
+      );
+    }
   }
+  return loginViaCdp(baseUrl, { ...options, ...browserAuthOptions });
+}
+function toSessionCookie(cookie) {
+  return { name: cookie.name, value: cookie.value, domain: cookie.domain, path: cookie.path, source: "cdp" };
+}
+async function loginViaCdp(baseUrl, options) {
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const runCdp = options.cdpLogin ?? loginWithCdp;
   const url = loginUrl(baseUrl);
-  await (options.openBrowser ?? ((target) => openSystemBrowser(target, options)))(url);
-  options.onBrowserOpened?.(url);
-  const pollIntervalMs = options.browserLoginPollIntervalMs ?? 1e3;
-  const timeoutMs = options.browserLoginTimeoutMs ?? 12e4;
-  const attempts = Math.max(1, Math.ceil(timeoutMs / pollIntervalMs));
-  const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
-  const pollOptions = browserAuthOptions;
-  for (let attempt = 0; attempt < attempts; attempt += 1) {
-    await sleep(pollIntervalMs);
-    try {
-      return await getAuthenticatedSession(baseUrl, pollOptions);
-    } catch (error) {
-      if (!(error instanceof AuthError)) {
-        throw error;
+  let resolved = null;
+  let lastChecked = "";
+  try {
+    await runCdp({
+      url,
+      headless: options.headlessCdp ?? false,
+      homeDir: options.homeDir,
+      platform: options.platform,
+      env: options.env,
+      onOpened: () => options.onBrowserOpened?.(url),
+      isDone: async (cookies) => {
+        if (resolved) return true;
+        const top = matchingMoodleSessionCookies(cookies.map(toSessionCookie), baseUrl)[0];
+        if (!top || top.value === lastChecked) return false;
+        lastChecked = top.value;
+        const context = await validate(baseUrl, top);
+        if (context) {
+          resolved = { cookie: top, context };
+          return true;
+        }
+        return false;
       }
+    });
+  } catch (error) {
+    if (error instanceof CdpError) {
+      throw new AuthError(error.message, error.hint ?? authFailureHint(baseUrl, [], options.platform, [], options.env));
     }
+    throw error;
   }
-  throw new AuthError(
-    `Timed out waiting for browser login at ${baseUrl}.`,
-    `Complete the login in your browser, then rerun: moodle auth login`
-  );
+  const session = resolved;
+  if (!session) {
+    throw new AuthError(`Sign-in did not complete for ${baseUrl}.`, `Run: moodle auth login`);
+  }
+  await refreshSessionCache(baseUrl, session.cookie, session.context, { ...options, noCache: false });
+  return { baseUrl, cookie: session.cookie, ...session.context, fromCache: false };
+}
+function parsePastedSessionCookie(raw) {
+  const text2 = raw.trim();
+  if (!text2) {
+    return null;
+  }
+  const pair = /\b(MoodleSession\w*)=([^;\s'"\\]+)/.exec(text2);
+  if (pair) {
+    return { name: pair[1], value: pair[2], source: "paste" };
+  }
+  return /[\s=;]/.test(text2) ? null : { name: MOODLE_SESSION_COOKIE_PREFIX, value: text2, source: "paste" };
+}
+async function authenticateWithPastedCookie(baseUrl, raw, options = {}) {
+  const cookie = parsePastedSessionCookie(raw);
+  if (!cookie) {
+    throw new AuthError(`That is not a ${MOODLE_SESSION_COOKIE_PREFIX} cookie value.`, pastedCookieHint(baseUrl));
+  }
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const context = await validate(baseUrl, cookie);
+  if (!context) {
+    throw new AuthError(`The pasted cookie did not authenticate for ${baseUrl}.`, pastedCookieHint(baseUrl));
+  }
+  await refreshSessionCache(baseUrl, cookie, context, { ...options, noCache: false });
+  return { baseUrl, cookie, ...context, fromCache: false };
+}
+function pastedCookieHint(baseUrl) {
+  return [
+    `Sign in at ${loginUrl(baseUrl)}, then open the browser developer tools.`,
+    'In the Network tab, right-click any request to the site and choose "Copy as cURL", then paste the whole command.',
+    `Copying the ${MOODLE_SESSION_COOKIE_PREFIX} value from Application (or Storage) > Cookies works too.`
+  ].join("\n");
 }
 function loadSessionFromEnv(env = process.env) {
   const source = env[ENV_MOODLE_TOKEN] ? ENV_MOODLE_TOKEN : ENV_MOODLE_SESSION;
@@ -1177,17 +1763,17 @@ async function defaultBrowserCookieProvider(baseUrl, options = {}) {
   }));
 }
 async function braveProfilePaths(options = {}) {
-  const home = options.homeDir ?? homedir3();
+  const home = options.homeDir ?? homedir5();
   const platform = options.platform ?? process.platform;
   const roots = platform === "linux" ? [
-    join3(home, ".config/BraveSoftware/Brave-Browser"),
-    join3(home, ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser")
-  ] : platform === "win32" ? [join3(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : platform === "darwin" ? [join3(home, "Library/Application Support/BraveSoftware/Brave-Browser")] : [];
+    join5(home, ".config/BraveSoftware/Brave-Browser"),
+    join5(home, ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser")
+  ] : platform === "win32" ? [join5(home, "AppData/Local/BraveSoftware/Brave-Browser/User Data")] : platform === "darwin" ? [join5(home, "Library/Application Support/BraveSoftware/Brave-Browser")] : [];
   const profiles = [];
   for (const root of roots) {
     try {
       profiles.push(
-        ...(await readdir(root, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => name === "Default" || name === "Guest Profile" || name.startsWith("Profile ")).sort().map((name) => join3(root, name))
+        ...(await readdir2(root, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => name === "Default" || name === "Guest Profile" || name.startsWith("Profile ")).sort().map((name) => join5(root, name))
       );
     } catch {
       continue;
@@ -1195,46 +1781,70 @@ async function braveProfilePaths(options = {}) {
   }
   return profiles;
 }
+var FULL_DISK_ACCESS_PANE = "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles";
+var TERMINAL_APPLICATIONS = {
+  Apple_Terminal: "Terminal",
+  ghostty: "Ghostty",
+  Hyper: "Hyper",
+  "iTerm.app": "iTerm",
+  Tabby: "Tabby",
+  vscode: "Visual Studio Code",
+  WarpTerminal: "Warp",
+  WezTerm: "WezTerm"
+};
+function hostApplicationName(env = process.env) {
+  const program = env.TERM_PROGRAM?.trim();
+  return program ? TERMINAL_APPLICATIONS[program] ?? program : null;
+}
 var COOKIE_ACCESS_DENIED = /EPERM|EACCES|operation not permitted|permission denied/i;
 var COOKIE_SQLITE_UNAVAILABLE = /No such built-in module: node:sqlite/i;
 var MINIMUM_NODE_FOR_BROWSER_COOKIES = "22.13.0";
 function cookieAccessBlocked(warnings) {
   return warnings.some((warning) => COOKIE_ACCESS_DENIED.test(warning) || COOKIE_SQLITE_UNAVAILABLE.test(warning));
 }
-function cookieAccessHint(warnings, platform = process.platform) {
-  const grant = platform === "darwin" ? "Grant Full Disk Access to the application running this command (System Settings > Privacy & Security > Full Disk Access), then restart it." : "Run this command as the user that owns the browser profile, or grant it read access to the browser cookie store.";
-  const remedy = warnings.some((warning) => COOKIE_SQLITE_UNAVAILABLE.test(warning)) ? [
-    `This Node.js runtime has no node:sqlite, which is needed to read browser cookies. Use Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or run the CLI with Bun (bunx --bun moodle-cli).`
-  ] : [
-    "If this runs inside a sandboxed app (an IDE or agent terminal), rerun it from a regular terminal first.",
-    grant
-  ];
+function cookieAccessHint(warnings, platform = process.platform, unreadable = [], env = process.env) {
+  const grant = platform === "darwin" ? [
+    `Grant Full Disk Access to ${hostApplicationName(env) ?? "the application running this command"}, then restart it:`,
+    `  open "${FULL_DISK_ACCESS_PANE}"`
+  ].join("\n") : "Run this command as the user that owns the browser profile, or grant it read access to the browser cookie store.";
+  const remedy = [];
+  if (warnings.some((warning) => COOKIE_SQLITE_UNAVAILABLE.test(warning))) {
+    remedy.push(
+      `This Node.js runtime has no node:sqlite, which is needed to read browser cookies. Use Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or run the CLI with Bun (bunx --bun moodle-cli).`
+    );
+  }
+  if (unreadable.length || !remedy.length) {
+    remedy.push(
+      "If this runs inside a sandboxed app (an IDE or agent terminal), rerun it from a regular terminal first.",
+      grant
+    );
+  }
   return [
     "The browser cookie store could not be read, so the session could not be detected.",
     ...remedy,
+    "Or skip the store entirely: `moodle auth login --paste` takes the cookie by hand and caches it.",
     "Run moodle doctor for runtime and browser diagnostics.",
-    `Alternatively set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`,
-    "",
-    "Cookie store diagnostics:",
-    ...warnings.map((warning) => `  - ${warning}`)
+    ...cookieDiagnostics(warnings, unreadable)
   ].join("\n");
 }
-function authFailureHint(baseUrl, cookieWarnings = [], platform = process.platform) {
-  if (cookieAccessBlocked(cookieWarnings)) {
-    return cookieAccessHint(cookieWarnings, platform);
-  }
+function cookieDiagnostics(warnings, unreadable) {
+  const probed = unreadable.map((store) => store.path);
   const lines = [
-    `Log in to ${loginUrl(baseUrl)} in your browser, then rerun the command.`,
-    "Or run `moodle auth login` to sign in through a browser window this command controls.",
-    `Or set ${ENV_MOODLE_SESSION} to a valid MoodleSession cookie value.`
+    ...unreadable.map((store) => `  - ${store.browser} cookie store exists but cannot be opened: ${store.path}`),
+    ...warnings.filter((warning) => COOKIE_ACCESS_DENIED.test(warning) || COOKIE_SQLITE_UNAVAILABLE.test(warning)).filter((warning) => !probed.some((path5) => warning.includes(path5))).map((warning) => `  - ${warning}`)
   ];
-  if (cookieWarnings.length) {
-    lines.push("", "Cookie store diagnostics:", ...cookieWarnings.map((warning) => `  - ${warning}`));
-  }
-  return lines.join("\n");
+  return lines.length ? ["", "Cookie store diagnostics:", ...lines] : [];
 }
-async function invalidateCachedSession(baseUrl, options = {}) {
-  await deleteCachedSession(baseUrl, cacheOptions(options));
+function authFailureHint(baseUrl, cookieWarnings = [], platform = process.platform, unreadable = [], env = process.env) {
+  if (cookieAccessBlocked(cookieWarnings) || unreadable.length) {
+    return cookieAccessHint(cookieWarnings, platform, unreadable, env);
+  }
+  return [
+    `Log in to ${loginUrl(baseUrl)} in your browser, then rerun the command.`,
+    "Or run `moodle auth login` to sign in through a browser window this command controls.",
+    "Or run `moodle auth login --paste` to hand over the cookie yourself.",
+    ...cookieDiagnostics(cookieWarnings, unreadable)
+  ].join("\n");
 }
 function parseSessionContext(html) {
   const sesskey = firstMatch(html, [
@@ -1262,7 +1872,11 @@ function validateSessionWithFetch(options) {
     let response;
     try {
       response = await fetchWithSession(`${baseUrl}${DASHBOARD_PATH}`, {}, baseUrl, cookie, fetcher);
-    } catch {
+    } catch (error) {
+      const network = asNetworkError(error);
+      if (network) {
+        throw network;
+      }
       return null;
     }
     if (response.status >= 400 || isLoginRedirect(response.url, baseUrl)) {
@@ -1303,16 +1917,59 @@ async function refreshSessionCache(baseUrl, cookie, context, options) {
     savedAt: (options.now ?? Date.now)()
   };
   try {
-    const previous = await readCachedSession(baseUrl, { ...cacheOptions(options), ttlMs: Number.MAX_SAFE_INTEGER });
+    const previous = await readCachedSession(baseUrl, { ...cacheOptions(options), allowExpired: true });
+    if (typeof previous?.mobileServiceEnabled === "boolean") session.mobileServiceEnabled = previous.mobileServiceEnabled;
     if (previous?.userid === context.userid) {
       if (previous.unavailable?.length) session.unavailable = previous.unavailable;
       if (previous.user) session.user = previous.user;
+      if (previous.mobileToken?.privatetoken) session.mobileToken = previous.mobileToken;
+    }
+    const newCookie = !previous || previous.cookieValue !== cookie.value;
+    if (!session.mobileToken && newCookie && options.captureMobileToken && session.mobileServiceEnabled !== false) {
+      const captured = await captureMobileToken(baseUrl, cookie, options);
+      session.mobileServiceEnabled = captured.supported;
+      if (captured.token) session.mobileToken = captured.token;
     }
     await writeCachedSession(session, cacheOptions(options));
   } catch {
     return;
   }
 }
+async function captureMobileToken(baseUrl, cookie, options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  try {
+    const config = await readMobilePublicConfig(baseUrl, fetchImpl);
+    if (config && !config.mobileServiceEnabled) return { supported: false };
+    const token = await fetchMobileToken(baseUrl, cookie, fetchImpl) ?? void 0;
+    return { supported: config?.mobileServiceEnabled ?? (token ? true : void 0), token };
+  } catch {
+    return {};
+  }
+}
+async function mintValidatedSession(baseUrl, stored, options = {}) {
+  if (!stored.mobileToken?.privatetoken) return null;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  const minted = await mintSessionFromMobileToken(baseUrl, stored.userid, stored.mobileToken, fetchImpl);
+  if (!minted) return null;
+  const cookie = { name: minted.cookie.name, value: minted.cookie.value, source: minted.cookie.source };
+  const validate = options.validateSession ?? validateSessionWithFetch(options);
+  const context = await validate(baseUrl, cookie);
+  if (!context || context.userid === 0 || context.userid !== stored.userid) return null;
+  return { cookie, context };
+}
+async function mintFromStoredToken(baseUrl, options, validate) {
+  let stored;
+  try {
+    stored = await readCachedSession(baseUrl, { ...cacheOptions(options), allowExpired: true });
+  } catch {
+    return null;
+  }
+  if (!stored?.mobileToken?.privatetoken) return null;
+  const result = await mintValidatedSession(baseUrl, stored, { ...options, validateSession: validate });
+  if (!result) return null;
+  await refreshSessionCache(baseUrl, result.cookie, result.context, options);
+  return { baseUrl, cookie: result.cookie, ...result.context, fromCache: false };
+}
 function cachedSessionToAuth(baseUrl, cached) {
   return {
     baseUrl,
@@ -1368,32 +2025,11 @@ function firstMatch(value, patterns) {
 function decodeHtml(value) {
   return value.replace(/&amp;/g, "&").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
 }
-async function openSystemBrowser(url, options) {
-  const platform = options.platform ?? process.platform;
-  const command = platform === "darwin" ? { file: "open", args: [url] } : platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url] } : { file: "xdg-open", args: [url] };
-  const result = await (options.execFile ?? defaultExecFile)(command.file, command.args);
-  if (result.exitCode !== 0) {
-    throw new AuthError(
-      `Could not open the browser for Moodle login.`,
-      `Open ${url} manually, then rerun: moodle auth login`
-    );
-  }
-}
-var defaultExecFile = (file2, args) => new Promise((resolve) => {
-  execFileCallback(file2, args, { encoding: "utf8" }, (error, stdout, stderr) => {
-    const errorWithCode = error;
-    resolve({
-      stdout: String(stdout ?? ""),
-      stderr: String(stderr ?? ""),
-      exitCode: errorWithCode ? Number(errorWithCode.code) || 1 : 0
-    });
-  });
-});
 
 // src/config.ts
-import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname3, join as join4 } from "path";
+import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname3, join as join6 } from "path";
 import { createUi, isAgentEnvironment } from "@bunizao/cli-kit";
 
 // src/wordmark.ts
@@ -1413,12 +2049,12 @@ function showWordmark(ui) {
 
 // src/config.ts
 import YAML from "yaml";
-var nodeFs2 = { readFile: readFile3, writeFile: writeFile3, mkdir: mkdir3 };
+var nodeFs2 = { readFile: readFile3, writeFile: writeFile3, mkdir: mkdir4 };
 function cwdConfigPath(cwd = process.cwd()) {
-  return join4(cwd, CONFIG_FILENAME);
+  return join6(cwd, CONFIG_FILENAME);
 }
-function userConfigPath(homeDir = homedir4()) {
-  return join4(homeDir, CONFIG_DIR_NAME, CONFIG_FILENAME);
+function userConfigPath(homeDir = homedir6()) {
+  return join6(homeDir, CONFIG_DIR_NAME, CONFIG_FILENAME);
 }
 function normalizeBaseUrl(value) {
   const raw = value.trim();
@@ -1493,12 +2129,12 @@ async function promptForBaseUrl(options = {}) {
     }
     const spin = ui.spinner();
     spin.start(`Checking ${baseUrl}`);
-    const probe = await probeBaseUrl(baseUrl, options);
-    if (probe.ok) {
+    const probe2 = await probeBaseUrl(baseUrl, options);
+    if (probe2.ok) {
       spin.stop(`${baseUrl} looks like Moodle`);
       return baseUrl;
     }
-    spin.error(`Validation failed: ${probe.message ?? "site did not look like Moodle"}`);
+    spin.error(`Validation failed: ${probe2.message ?? "site did not look like Moodle"}`);
   }
 }
 async function probeBaseUrl(baseUrl, options = {}) {
@@ -1594,15 +2230,15 @@ function isMissingFileError2(error) {
 }
 
 // src/mcp/self-command.ts
-import { accessSync, constants, realpathSync } from "fs";
-import { delimiter, join as join5 } from "path";
+import { accessSync as accessSync2, constants as constants2, realpathSync } from "fs";
+import { delimiter, join as join7 } from "path";
 import { spawnSync } from "child_process";
 function findExecutable(name, env = process.env) {
   for (const dir of (env.PATH ?? "").split(delimiter).filter(Boolean)) {
     for (const suffix of process.platform === "win32" ? [".exe", ".cmd", ""] : [""]) {
-      const file2 = join5(dir, name + suffix);
+      const file2 = join7(dir, name + suffix);
       try {
-        accessSync(file2, constants.X_OK);
+        accessSync2(file2, constants2.X_OK);
         return realpathSync(file2);
       } catch {
       }
@@ -1632,9 +2268,9 @@ function runtimeCommand(command, args) {
 // src/keepalive.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { mkdir as mkdir4, rm as rm3, stat, writeFile as writeFile4 } from "fs/promises";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { mkdir as mkdir5, rm as rm3, stat, writeFile as writeFile4 } from "fs/promises";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname4, join as join8 } from "path";
 async function touchMoodleSession(baseUrl, cookie, sesskey, fetchImpl = fetch, extend = true) {
   const methods = extend ? [FUNC_SESSION_TOUCH, FUNC_SESSION_TIME_REMAINING] : [FUNC_SESSION_TIME_REMAINING];
   const url = `${baseUrl.replace(/\/$/, "")}${AJAX_SERVICE_PATH}?sesskey=${encodeURIComponent(sesskey)}&info=${methods.join(",")}`;
@@ -1680,13 +2316,13 @@ async function touchMoodleSession(baseUrl, cookie, sesskey, fetchImpl = fetch, e
 async function keepAliveOnce(baseUrl, options = {}) {
   const session = await readCachedSession(baseUrl, {
     homeDir: options.homeDir,
-    ttlMs: Number.MAX_SAFE_INTEGER,
+    allowExpired: true,
     now: options.now
   });
   if (!session) {
     return { status: "no_session", time_remaining_seconds: null };
   }
-  const touch = await touchMoodleSession(
+  const touch = session.cookieInvalidated ? { alive: false, timeRemainingSeconds: null } : await touchMoodleSession(
     baseUrl,
     { name: session.cookieName, value: session.cookieValue },
     session.sesskey,
@@ -1702,6 +2338,10 @@ async function keepAliveOnce(baseUrl, options = {}) {
   if (options.renewOnExpiry === false) {
     return { status: "expired", time_remaining_seconds: null };
   }
+  if (session.mobileToken) {
+    const renewed = await renewViaMobileToken(baseUrl, session, options);
+    if (renewed) return renewed;
+  }
   const authenticate = options.authenticate ?? ((url) => getAuthenticatedSession(url, {
     homeDir: options.homeDir,
     fetch: options.fetchImpl,
@@ -1717,12 +2357,29 @@ async function keepAliveOnce(baseUrl, options = {}) {
     return { status: "expired", time_remaining_seconds: null };
   }
 }
+async function renewViaMobileToken(baseUrl, session, options) {
+  const result = await mintValidatedSession(baseUrl, session, { fetch: options.fetchImpl }).catch(() => null);
+  if (!result) return null;
+  await writeCachedSession(
+    {
+      ...session,
+      cookieInvalidated: false,
+      cookieName: result.cookie.name,
+      cookieValue: result.cookie.value,
+      cookieSource: result.cookie.source,
+      sesskey: result.context.sesskey,
+      savedAt: (options.now ?? Date.now)()
+    },
+    { homeDir: options.homeDir }
+  );
+  return { status: "reauthenticated", time_remaining_seconds: null };
+}
 async function getAuthStatus(baseUrl, options = {}) {
   const now = options.now ?? Date.now;
   const keepalive = await keepaliveStatus(options.homeDir);
   const session = await readCachedSession(baseUrl, {
     homeDir: options.homeDir,
-    ttlMs: Number.MAX_SAFE_INTEGER,
+    allowExpired: true,
     now: options.now
   });
   if (!session) {
@@ -1736,7 +2393,7 @@ async function getAuthStatus(baseUrl, options = {}) {
       keepalive_plist_path: keepalive.plist_path
     };
   }
-  const touch = await touchMoodleSession(
+  const touch = session.cookieInvalidated ? { alive: false, timeRemainingSeconds: null } : await touchMoodleSession(
     baseUrl,
     { name: session.cookieName, value: session.cookieValue },
     session.sesskey,
@@ -1754,11 +2411,11 @@ async function getAuthStatus(baseUrl, options = {}) {
     keepalive_plist_path: keepalive.plist_path
   };
 }
-function keepalivePlistPath(homeDir = homedir5()) {
-  return join6(homeDir, "Library/LaunchAgents", `${KEEPALIVE_LAUNCH_AGENT_LABEL}.plist`);
+function keepalivePlistPath(homeDir = homedir7()) {
+  return join8(homeDir, "Library/LaunchAgents", `${KEEPALIVE_LAUNCH_AGENT_LABEL}.plist`);
 }
-function keepaliveLogPath(homeDir = homedir5()) {
-  return join6(homeDir, CACHE_DIR_NAME, KEEPALIVE_LOG_FILENAME);
+function keepaliveLogPath(homeDir = homedir7()) {
+  return join8(homeDir, CACHE_DIR_NAME, KEEPALIVE_LOG_FILENAME);
 }
 function buildKeepalivePlist(programArguments2, intervalMinutes, logPath) {
   const args = programArguments2.map((arg) => `    <string>${escapeXml(arg)}</string>`).join("\n");
@@ -1800,13 +2457,13 @@ async function installKeepalive(options = {}) {
       `This runtime (${process.version}) cannot read browser cookies, and the launch agent would be pinned to it. Reinstall with Node.js ${MINIMUM_NODE_FOR_BROWSER_COOKIES} or newer, or with Bun.`
     );
   }
-  const homeDir = options.homeDir ?? homedir5();
+  const homeDir = options.homeDir ?? homedir7();
   const intervalMinutes = options.intervalMinutes ?? KEEPALIVE_DEFAULT_INTERVAL_MINUTES;
   const plistPath = keepalivePlistPath(homeDir);
   const logPath = keepaliveLogPath(homeDir);
   const command = [selectedRuntime.command, ...selectedRuntime.args, "auth", "keepalive", "--json"];
-  await mkdir4(dirname4(plistPath), { recursive: true });
-  await mkdir4(dirname4(logPath), { recursive: true, mode: 448 });
+  await mkdir5(dirname4(plistPath), { recursive: true });
+  await mkdir5(dirname4(logPath), { recursive: true, mode: 448 });
   await writeFile4(plistPath, buildKeepalivePlist(command, intervalMinutes, logPath), "utf8");
   const runCommand = options.runCommand ?? spawnSync2;
   const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
@@ -1821,7 +2478,7 @@ async function installKeepalive(options = {}) {
   return { plist_path: plistPath, interval_minutes: intervalMinutes, log_path: logPath, command };
 }
 async function uninstallKeepalive(options = {}) {
-  const homeDir = options.homeDir ?? homedir5();
+  const homeDir = options.homeDir ?? homedir7();
   const plistPath = keepalivePlistPath(homeDir);
   const runCommand = options.runCommand ?? spawnSync2;
   const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0);
@@ -1829,7 +2486,7 @@ async function uninstallKeepalive(options = {}) {
   await rm3(plistPath, { force: true });
   return { installed: false, plist_path: plistPath };
 }
-async function keepaliveStatus(homeDir = homedir5()) {
+async function keepaliveStatus(homeDir = homedir7()) {
   const plistPath = keepalivePlistPath(homeDir);
   try {
     return { installed: (await stat(plistPath)).isFile(), plist_path: plistPath };
@@ -1842,20 +2499,21 @@ function escapeXml(value) {
 }
 
 // src/doctor.ts
-async function ownedJobs(homeDir = homedir6()) {
-  const root = join7(homeDir, "Library", "LaunchAgents");
-  const files = await readdir2(root).catch(() => []);
+async function ownedJobs(homeDir = homedir8()) {
+  const root = join9(homeDir, "Library", "LaunchAgents");
+  const files = await readdir3(root).catch(() => []);
   const jobs = [];
   for (const name of files.filter((n2) => n2 === "com.moodle-cli.keepalive.plist" || /^com\.moodle-cli\.mcp-renewal\.[a-z0-9_-]+\.plist$/u.test(n2))) {
-    const path5 = join7(root, name);
+    const path5 = join9(root, name);
     const content = await readFile4(path5, "utf8");
     jobs.push({ path: path5, profile: name.match(/mcp-renewal\.(.+)\.plist$/u)?.[1], interpreter: content.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/u)?.[1] });
   }
   return jobs;
 }
 async function doctor(options = {}) {
-  const home = options.homeDir ?? homedir6();
+  const home = options.homeDir ?? homedir8();
   const checks = [];
+  const stores = await browserCookieStores({ homeDir: home });
   const cookies = runtimeSupportsCookies();
   checks.push({ name: "sqlite", status: cookies ? "pass" : "fail", detail: `${process.versions.bun ? "bun" : "node"} ${process.versions.bun ?? process.versions.node}`, ...cookies ? {} : { hint: "Install Bun or Node 22.13+; Safari cookie reads do not require SQLite." } });
   let baseUrl;
@@ -1875,43 +2533,19 @@ async function doctor(options = {}) {
     const warnings = [];
     try {
       const found = await defaultBrowserCookieProvider(baseUrl, { homeDir: home, onCookieWarnings: (items) => warnings.push(...items) });
-      const blocked = warnings.some((w) => /EPERM|EACCES|permission denied|operation not permitted/iu.test(w));
-      checks.push({ name: "browser", status: blocked ? "fail" : found.length ? "pass" : "warn", detail: blocked ? "Browser store access was denied." : found.length ? `Cookie sources: ${[...new Set(found.map((c) => c.source || "browser"))].join(", ")}` : "No browser session found.", ...blocked ? { hint: "System Settings > Privacy & Security > Full Disk Access: enable the app running this command, then restart it." } : !found.length ? { hint: "Sign in to Moodle in a supported browser, then run moodle auth login." } : {} });
+      const blocked = !found.length && (cookieStoresBlocked(stores) || warnings.some((w) => /EPERM|EACCES|permission denied|operation not permitted/iu.test(w)));
+      checks.push({ name: "browser", status: blocked ? "fail" : found.length ? "pass" : "warn", detail: blocked ? `Browser store access was denied (${unreadableCookieStores(stores).length} unreadable store(s)).` : found.length ? `Cookie sources: ${[...new Set(found.map((c) => c.source || "browser"))].join(", ")}` : "No browser session found.", ...blocked ? { hint: `System Settings > Privacy & Security > Full Disk Access: enable ${hostApplicationName(options.env) ?? "the app running this command"}, then restart it.` } : !found.length ? { hint: "Sign in to Moodle in a supported browser, then run moodle auth login." } : {} });
     } catch {
       checks.push({ name: "browser", status: "warn", detail: "Could not inspect browser stores.", hint: "Run moodle auth login from a regular terminal." });
     }
   }
-  const stores = [];
-  if (process.platform === "darwin") {
-    for (const [browser, directory] of [["Chrome", "Google/Chrome"], ["Edge", "Microsoft Edge"], ["Brave", "BraveSoftware/Brave-Browser"], ["Firefox", "Firefox/Profiles"]]) {
-      const root = join7(home, "Library/Application Support", directory);
-      for (const profile of await readdir2(root).catch(() => [])) {
-        if (browser !== "Firefox" && profile !== "Default" && !profile.startsWith("Profile ")) continue;
-        for (const name of browser === "Firefox" ? ["cookies.sqlite"] : ["Cookies", "Network/Cookies"]) {
-          const file2 = join7(root, profile, name);
-          try {
-            await access(file2);
-            stores.push({ browser, path: file2, readable: await access(file2, constants2.R_OK).then(() => true, () => false) });
-          } catch {
-          }
-        }
-      }
-    }
-    for (const file2 of [join7(home, "Library/Cookies/Cookies.binarycookies"), join7(home, "Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies")]) {
-      try {
-        await access(file2);
-        stores.push({ browser: "Safari", path: file2, readable: await access(file2, constants2.R_OK).then(() => true, () => false) });
-      } catch {
-      }
-    }
-  }
   const jobs = await ownedJobs(home);
   for (const job of jobs) {
-    const present = job.interpreter ? await access(job.interpreter, constants2.X_OK).then(() => true, () => false) : false;
+    const present = job.interpreter ? await access3(job.interpreter, constants3.X_OK).then(() => true, () => false) : false;
     const supported = present && (job.interpreter === process.execPath && !runtimeCommand().args.length || runtimeSupportsCookies(job.interpreter));
     checks.push({ name: "job", status: supported ? "pass" : "warn", detail: `${job.path}: ${job.interpreter ?? "missing interpreter"}`, ...!supported ? { hint: job.profile ? "Run moodle mcp deploy to repair renewal." : "Run moodle auth keepalive install." } : {} });
   }
-  const profiles = await readdir2(join7(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
+  const profiles = await readdir3(join9(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
   checks.push({ name: "mcp", status: profiles.length ? "pass" : "warn", detail: profiles.length ? `${profiles.length} local deployment receipts. Run moodle mcp status for remote readiness.` : "No managed MCP deployment; optional for CLI use." });
   let pin;
   try {
@@ -1922,8 +2556,8 @@ async function doctor(options = {}) {
 }
 
 // src/cli.ts
-import { rm as rm7, readdir as readdir3 } from "fs/promises";
-import { homedir as homedir13 } from "os";
+import { rm as rm7, readdir as readdir4 } from "fs/promises";
+import { homedir as homedir15 } from "os";
 
 // src/mcp/renewal/decision.ts
 function decideRenewal(snapshot) {
@@ -2212,15 +2846,15 @@ async function sendRenewalNotification(kind, sender) {
 }
 
 // src/mcp/renewal/node-renewal.ts
-import { execFile as execFileCallback2 } from "child_process";
-import { chmod as chmod3, mkdir as mkdir5, readFile as readFile5, rm as rm4, writeFile as writeFile5 } from "fs/promises";
-import { homedir as homedir7 } from "os";
+import { execFile as execFileCallback } from "child_process";
+import { chmod as chmod3, mkdir as mkdir6, readFile as readFile5, rm as rm4, writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir9 } from "os";
 import { dirname as dirname5 } from "path";
 import { promisify } from "util";
-var execFile = promisify(execFileCallback2);
+var execFile = promisify(execFileCallback);
 var NodeRenewalInstallerIO = class {
   async writePrivate(path5, content, mode) {
-    await mkdir5(dirname5(path5), { recursive: true, mode: 448 });
+    await mkdir6(dirname5(path5), { recursive: true, mode: 448 });
     await writeFile5(path5, content, { encoding: "utf8", mode });
     await chmod3(path5, mode);
   }
@@ -2259,7 +2893,7 @@ function createDefaultRenewalInstaller(profile, options = {}) {
     profile,
     executable: runtime.command,
     executableArgs: runtime.args,
-    homeDirectory: options.homeDirectory ?? homedir7(),
+    homeDirectory: options.homeDirectory ?? homedir9(),
     uid: options.uid ?? (typeof process.getuid === "function" ? process.getuid() : void 0),
     intervalMinutes: options.intervalMinutes
   });
@@ -2895,7 +3529,12 @@ function configureTerminalTables(options) {
 function renderTerminalTable(columns, rows, options = {}) {
   const theme = createTheme(colorEnabled());
   const width = Math.max(20, options.width ?? process.stdout.columns ?? DEFAULT_WIDTH);
-  const clean = rows.map((row) => columns.map((_, i) => sanitizeTerminalText(row[i] ?? "").replace(/\s+/gu, " ")));
+  const cellText = (cell) => typeof cell === "string" ? cell : cell?.text ?? "";
+  const tones = rows.map((row) => columns.map((_, i) => {
+    const cell = row[i];
+    return typeof cell === "object" ? cell.tone : void 0;
+  }));
+  const clean = rows.map((row) => columns.map((_, i) => sanitizeTerminalText(cellText(row[i])).replace(/\s+/gu, " ")));
   const lengths = columns.map((c, i) => Math.max(c.label.length, ...clean.map((r) => Array.from(r[i]).length)));
   const flexible = columns.map((c, i) => c.flex || /name|title|subject|feedback|description|value|course|unit/iu.test(c.label) ? i : -1).filter((i) => i >= 0);
   const widths = columns.map((c, i) => c.width ?? (flexible.includes(i) ? Math.min(lengths[i], 36) : lengths[i]));
@@ -2919,7 +3558,8 @@ function renderTerminalTable(columns, rows, options = {}) {
     const trimmed = chars.length > w ? `${chars.slice(0, w - 1).join("")}\u2026` : v;
     return trimmed + " ".repeat(Math.max(0, w - Array.from(trimmed).length));
   };
-  const paint = (cell, i, row) => {
+  const paint = (cell, i, row, tone) => {
+    if (tone) return theme.tone(tone, cell);
     if (options.keyValue) return i === 0 ? theme.dim(cell) : /status|grading|action/iu.test(row[0] ?? "") ? theme.status(cell) : cell;
     return i === 0 ? theme.key(cell) : TONED_LABEL.test(columns[i]?.label ?? "") ? theme.status(cell) : cell;
   };
@@ -2931,7 +3571,7 @@ function renderTerminalTable(columns, rows, options = {}) {
     border("\u250C", "\u252C", "\u2510"),
     line(columns.map((c) => c.label), (cell) => theme.dim(cell)),
     border("\u251C", "\u253C", "\u2524"),
-    ...clean.map((row) => line(row, (cell, i) => paint(cell, i, row))),
+    ...clean.map((row, r) => line(row, (cell, i) => paint(cell, i, row, tones[r][i]))),
     border("\u2514", "\u2534", "\u2518")
   ].join("\n");
 }
@@ -2966,22 +3606,29 @@ function moment(value, now) {
   const sameYear = new Date(now).getFullYear() === Number(year);
   return `${weekday} ${Number(day)} ${MONTHS[Number(month) - 1]}${sameYear ? "" : ` ${year}`}${hour ? `, ${hour}:${minute}` : ""}`;
 }
+function tryLines(commands) {
+  return commands.map((command, index) => `${index ? "     " : "Try  "}${command}`).join("\n");
+}
 function renderScreen(data, options = {}) {
   const lines = [];
   const now = options.now ?? Date.now();
   const theme = createTheme2(Boolean(options.color));
-  const dueText = (row) => {
-    if (!row.due_at) return theme.status(text(row.status || row.submission_status));
+  const due = (row) => {
     const days = Math.ceil((Number(row.due_at) * 1e3 - now) / 864e5);
     const value = `${days < 0 ? `${-days} days overdue` : days === 0 ? "today" : days === 1 ? "tomorrow" : `in ${days} days`} \xB7 ${moment(row.due, now)}`;
-    return days < 0 ? theme.tone("danger", value) : days <= 2 ? theme.tone("warning", value) : theme.dim(value);
+    return { text: value, tone: days < 0 ? "danger" : days <= 2 ? "warning" : "muted" };
+  };
+  const dueText = (row) => {
+    if (!row.due_at) return theme.status(text(row.status || row.submission_status));
+    const { text: value, tone } = due(row);
+    return theme.tone(tone, value);
   };
   const rows = (items, title) => {
     lines.push(theme.subject(title));
     if (!items.length) lines.push(theme.dim("  None"));
     for (const r of items) lines.push(`  ${theme.key(text(r.unit_code || r.type))}  ${text(r.name)}${r.due_at ? `  ${dueText(r)}` : ""}${r.id ? `  ${theme.dim(`#${r.id}`)}` : ""}`);
   };
-  let next = "moodle due --days 30 \xB7 moodle grades";
+  let next = ["moodle due --days 30", "moodle grades"];
   if (data.home) {
     const h = record(data.home);
     lines.push(`${text(h.name)} \xB7 ${moment(h.today, now)} \xB7 ${text(h.timezone)}${h.timezone_source === "site" ? "" : ` (${text(h.timezone_source)})`}`, text(h.siteurl), "");
@@ -3012,11 +3659,12 @@ function renderScreen(data, options = {}) {
       rows(array(data.news), "Latest news");
     }
     const unit = JSON.stringify(u.code || u.name);
-    next = array(data.sections).some((s2) => s2.activities) ? `moodle ${unit} "TASK" \xB7 moodle get "UNIT TASK" --to .` : `moodle ${unit} SECTION \xB7 moodle ${unit} grades`;
+    next = array(data.sections).some((s2) => s2.activities) ? [`moodle ${unit} "TASK"`, `moodle get "UNIT TASK" --to .`] : [`moodle ${unit} SECTION`, `moodle ${unit} grades`];
   } else if (data.grades) {
     for (const g of array(data.grades)) {
       lines.push(`${text(g.code)} \xB7 ${g.graded} of ${g.total} graded`);
-      lines.push(renderTerminalTable([{ label: "Name", flex: true }, { label: "Grade" }, { label: "Range" }, { label: "Feedback", flex: true }], array(g.items).map((i) => [text(i.name), text(i.grade), text(i.range), text(i.feedback || (i.due ? dueText(i) : ""))]), { width: options.width }));
+      const feedback = (i) => i.feedback ? text(i.feedback) : i.due_at ? due(i) : "";
+      lines.push(renderTerminalTable([{ label: "Name", flex: true }, { label: "Grade" }, { label: "Range" }, { label: "Feedback", flex: true }], array(g.items).map((i) => [text(i.name), text(i.grade), text(i.range), feedback(i)]), { width: options.width }));
     }
   } else if (data.item) {
     const i = record(data.item);
@@ -3024,13 +3672,13 @@ function renderScreen(data, options = {}) {
     for (const [k, v] of Object.entries(i)) if (!["id", "name", "type", "files"].includes(k) && !k.endsWith("_at") && typeof v !== "object") lines.push(`${k.replaceAll("_", " ")}: ${moment(v, now)}`);
     for (const f of array(i.files)) lines.push(`File  ${text(f.name)}  ${text(f.url)}`);
     if (data.threads) rows(array(data.threads), "Threads");
-    next = `moodle get ${i.id} --to DIR`;
+    next = [`moodle get ${i.id} --to DIR`];
   } else if (data.thread) {
     const t = record(data.thread);
     lines.push(text(t.name));
     for (const p of array(t.posts)) lines.push("", `${text(record(p.author).name)} \xB7 ${moment(p.created, now)}`, text(p.message_text), ...array(p.links).map((l) => `${text(l.text)} ${text(l.url)}`));
     lines.push(`Posts ${Number(t.offset) + array(t.posts).length} of ${t.posts_total}`);
-    next = `moodle threads show ${t.id} --offset ${Number(t.offset) + array(t.posts).length}`;
+    next = [`moodle threads show ${t.id} --offset ${Number(t.offset) + array(t.posts).length}`];
   } else if (data.news) {
     for (const n2 of array(data.news)) {
       const p = record(n2.post);
@@ -3038,13 +3686,13 @@ function renderScreen(data, options = {}) {
     }
   } else if (data.units) {
     lines.push(renderTerminalTable([{ label: "ID" }, { label: "Code" }, { label: "Name", flex: true }], array(data.units).map((u) => [text(u.id), text(u.code), text(u.name)]), { width: options.width }));
-    next = "moodle UNIT \xB7 moodle find QUERY";
+    next = ["moodle UNIT", "moodle find QUERY"];
   } else {
     const key = ["due", "results", "activities", "forums"].find((k) => k in data);
     rows(array(key ? data[key] : []), key === "due" ? "Due" : "Matches");
     if (data.total !== void 0) lines.push(`${data.total} total`);
   }
-  lines.push("", theme.dim(`Try  ${next}`));
+  lines.push("", ...tryLines(next).split("\n").map((line) => theme.dim(line)));
   const width = Math.max(40, options.width || 80);
   return lines.flatMap((line) => {
     if (line.includes("\x1B[") || line.startsWith("\u2502") || /^[┌└├]/u.test(line)) return [line];
@@ -3065,13 +3713,13 @@ function renderScreen(data, options = {}) {
 }
 
 // src/cli.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import {
   banner,
   colorEnabled as colorEnabled2,
   confirm,
   createProgram,
-  createTheme as createTheme3,
+  createTheme as createTheme5,
   createUi as createUi3,
   detectAudience,
   examples,
@@ -5537,10 +6185,10 @@ function safeUrl(value) {
 
 // src/submit.ts
 import { readFile as readFile6, stat as stat2 } from "fs/promises";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir10 } from "os";
 import path from "path";
 function resolveSubmissionPath(given, cwd = process.cwd()) {
-  return path.resolve(cwd, given.startsWith("~/") ? path.join(homedir8(), given.slice(2)) : given);
+  return path.resolve(cwd, given.startsWith("~/") ? path.join(homedir10(), given.slice(2)) : given);
 }
 async function readSubmissionFiles(paths, cwd = process.cwd()) {
   const files = [];
@@ -5599,7 +6247,7 @@ async function createMoodleClient(baseUrl, options = {}) {
       });
     }
   }
-  const stale = options.noCache ? null : await readCachedSession(baseUrl, { ...cacheOptions2, ttlMs: Number.MAX_SAFE_INTEGER }).catch(() => null);
+  const stale = options.noCache ? null : await readCachedSession(baseUrl, { ...cacheOptions2, allowExpired: true }).catch(() => null);
   const session = authToClientSession(await getAuthenticatedSession(baseUrl, authOptions));
   return new MoodleClient(baseUrl, {
     fetchImpl: options.fetchImpl,
@@ -5612,11 +6260,21 @@ async function createMoodleClient(baseUrl, options = {}) {
 }
 function persistenceCallbacks(baseUrl, options) {
   return {
-    clearSessionCache: () => deleteCachedSession(baseUrl, options),
-    writeSessionCache: (session) => writeCachedSession({
-      ...session,
-      savedAt: (options.now ?? Date.now)()
-    }, options)
+    clearSessionCache: async () => {
+      const cached = await readCachedSession(baseUrl, { ...options, allowExpired: true });
+      if (cached) await writeCachedSession({ ...cached, cookieInvalidated: true }, options);
+    },
+    writeSessionCache: async (session) => {
+      const previous = await readCachedSession(baseUrl, { ...options, allowExpired: true });
+      await writeCachedSession({
+        ...session,
+        // Client snapshots contain cookie state only. Keep renewal credentials
+        // for the same account without carrying them across an account switch.
+        ...previous?.userid === session.userid ? { mobileToken: previous.mobileToken } : {},
+        mobileServiceEnabled: previous?.mobileServiceEnabled,
+        savedAt: (options.now ?? Date.now)()
+      }, options);
+    }
   };
 }
 function authToClientSession(auth) {
@@ -6340,8 +6998,165 @@ function readSkillTemplate(relativePath = "skill.template.md") {
   return readFileSync(path3.join(process.cwd(), "src", relativePath), "utf8");
 }
 
+// src/onboarding.ts
+async function signInInteractively(ui, deps) {
+  deps.showWordmark(ui);
+  const login = loginUrl(deps.baseUrl);
+  let blocked = await deps.storesBlocked();
+  ui.note([
+    `No Moodle session for ${deps.baseUrl}.`,
+    "Sign in once; later commands reuse that session.",
+    ...blocked ? ["", "This terminal cannot read your browser's cookies, so the sign-in happens in a browser window the CLI opens."] : []
+  ].join("\n"), "One-time setup");
+  let session;
+  for (let attempt = 0; !session; attempt++) {
+    const method = await ui.select(attempt ? "Try another way?" : "How do you want to sign in?", [
+      ...blocked ? [] : [{ value: "own-browser", label: "Sign in in my own browser", hint: "the login page opens; press Enter here when done" }],
+      { value: "cli-browser", label: "Open a browser window from here", hint: "a Chrome, Edge or Brave the CLI controls" },
+      { value: "paste", label: "Paste the MoodleSession cookie", hint: "from the browser's developer tools" },
+      { value: "stop", label: "Not now", hint: "moodle auth login works any time" }
+    ]);
+    if (method === "stop") throw new AuthError(`No usable MoodleSession found for ${deps.baseUrl}.`, "Run moodle auth login when you are ready.");
+    if (method === "own-browser") {
+      await deps.openInBrowser(login).catch(() => void 0);
+      if (!await ui.confirm(`Signed in at ${login}? Enter reads the session from your browser`, { initial: true })) continue;
+      const spin = ui.spinner();
+      spin.start("Reading the session from your browser");
+      try {
+        session = await deps.readBrowserSession();
+        spin.stop(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) {
+          spin.error("Could not read the browser session");
+          throw error;
+        }
+        spin.error(error.message);
+        blocked = await deps.storesBlocked();
+        if (blocked) ui.warn(error.hint ?? "The browser cookie store could not be read.");
+        else ui.info(`Finish signing in at ${login} in the browser you use, then choose the first option again.`);
+      }
+    } else if (method === "cli-browser") {
+      const spin = ui.spinner();
+      spin.start("Opening a browser window");
+      try {
+        session = await deps.browserLogin((url) => spin.message(`Finish signing in at ${url}`));
+        spin.stop(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) {
+          spin.error("Sign-in did not complete");
+          throw error;
+        }
+        spin.error(error.message);
+        if (error.hint) ui.info(error.hint);
+      }
+    } else {
+      try {
+        session = await deps.pasteLogin();
+        ui.step(`Signed in as userid ${session.userid}`);
+      } catch (error) {
+        if (!(error instanceof AuthError)) throw error;
+        ui.warn([error.message, error.hint].filter(Boolean).join("\n"));
+      }
+    }
+  }
+  await offerRenewal(ui, deps);
+  return session;
+}
+async function offerRenewal(ui, deps) {
+  if (deps.platform !== "darwin" || await deps.keepaliveInstalled()) return;
+  ui.note([
+    `A background job can renew this session every ${KEEPALIVE_DEFAULT_INTERVAL_MINUTES} minutes, so it rarely expires.`,
+    "It runs moodle auth keepalive; moodle auth keepalive uninstall removes it."
+  ].join("\n"), "Stay signed in");
+  const wanted = await ui.confirm("Renew the session automatically?", { initial: true }).catch((error) => {
+    if (error instanceof CliError2 && error.code === "cancelled") return false;
+    throw error;
+  });
+  if (!wanted) {
+    ui.info("Later: moodle auth keepalive install");
+    return;
+  }
+  try {
+    const result = await deps.installKeepalive();
+    ui.step(`Renewing every ${result.interval_minutes} min; agent at ${result.plist_path}`);
+  } catch (error) {
+    ui.warn(`${error instanceof Error ? error.message : String(error)}
+Later: moodle auth keepalive install`);
+  }
+}
+
+// src/secret-input.ts
+var PASTE_MODE_ON = "\x1B[?2004h";
+var PASTE_MODE_OFF = "\x1B[?2004l";
+var PASTE_START = "\x1B[200~";
+var PASTE_END = "\x1B[201~";
+async function readSecretLine(input2, output, prompt) {
+  if (!input2.isTTY) {
+    return (await readAll(input2)).trim();
+  }
+  const wasRaw = input2.isRaw;
+  input2.setRawMode(true);
+  input2.resume();
+  output.write(prompt);
+  output.write(PASTE_MODE_ON);
+  try {
+    return await new Promise((resolve) => {
+      let content = "";
+      let pasting = false;
+      let esc = "";
+      const finish = (value) => {
+        input2.off("data", onData);
+        resolve(value);
+      };
+      const onData = (chunk) => {
+        for (const ch of chunk.toString("utf8")) {
+          if (esc) {
+            esc += ch;
+            if (esc === PASTE_START) {
+              pasting = true;
+              esc = "";
+            } else if (esc === PASTE_END) {
+              esc = "";
+              return finish(content.trim());
+            } else if (!PASTE_START.startsWith(esc) && !PASTE_END.startsWith(esc)) {
+              esc = "";
+            }
+            continue;
+          }
+          const code = ch.charCodeAt(0);
+          if (code === 27) {
+            esc = "\x1B";
+            continue;
+          }
+          if (pasting) {
+            content += ch;
+            continue;
+          }
+          if (code === 3 || code === 4) return finish(null);
+          if (code === 13 || code === 10) return finish(content.trim());
+          if (code === 8 || code === 127) content = content.slice(0, -1);
+          else if (code >= 32) content += ch;
+        }
+      };
+      input2.on("data", onData);
+    });
+  } finally {
+    output.write(PASTE_MODE_OFF);
+    input2.setRawMode(wasRaw);
+    input2.pause();
+    output.write("\n");
+  }
+}
+async function readAll(input2) {
+  const chunks2 = [];
+  for await (const chunk of input2) {
+    chunks2.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"));
+  }
+  return chunks2.join("");
+}
+
 // src/version.ts
-var VERSION = "0.9.0";
+var VERSION = "0.9.2";
 
 // src/forum.ts
 function parseDiscussionReference(value) {
@@ -6495,10 +7310,11 @@ function resolveTopLevelUrl(baseUrlOrOptions, targetValue, resolveCourseIdForUrl
 }
 
 // src/mcp/cli.ts
+import { createTheme as createTheme4 } from "@bunizao/cli-kit";
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile9 } from "fs/promises";
-import { homedir as homedir12 } from "os";
-import { join as join11 } from "path";
+import { homedir as homedir14 } from "os";
+import { join as join13 } from "path";
 import { createInterface } from "readline/promises";
 import { fileURLToPath } from "url";
 
@@ -7032,9 +7848,9 @@ function resolveConnection(options) {
 }
 
 // src/mcp/connectors/node-connectors.ts
-import { chmod as chmod4, mkdir as mkdir6, readFile as readFile7, rm as rm5, stat as stat3, writeFile as writeFile6 } from "fs/promises";
-import { homedir as homedir9 } from "os";
-import { dirname as dirname6, join as join8 } from "path";
+import { chmod as chmod4, mkdir as mkdir7, readFile as readFile7, rm as rm5, stat as stat3, writeFile as writeFile6 } from "fs/promises";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname6, join as join10 } from "path";
 var NodeConnectorFileSystem = class {
   async exists(path5) {
     try {
@@ -7051,7 +7867,7 @@ var NodeConnectorFileSystem = class {
     return readFile7(path5, "utf8");
   }
   async writePrivate(path5, content) {
-    await mkdir6(dirname6(path5), { recursive: true, mode: 448 });
+    await mkdir7(dirname6(path5), { recursive: true, mode: 448 });
     await writeFile6(path5, content, { encoding: "utf8", mode: 384 });
     await chmod4(path5, 384);
   }
@@ -7060,7 +7876,7 @@ var NodeConnectorFileSystem = class {
   }
 };
 function createDefaultClientConnectors(profile, options = {}) {
-  const home = options.homeDirectory ?? homedir9();
+  const home = options.homeDirectory ?? homedir11();
   const platform = options.platform ?? process.platform;
   const fileSystem = options.fileSystem ?? new NodeConnectorFileSystem();
   const runtime = runtimeCommand(options.command, options.commandArgs);
@@ -7072,14 +7888,14 @@ function createDefaultClientConnectors(profile, options = {}) {
     endpoint: options.endpoint,
     accessToken: options.accessToken
   };
-  const claudeDesktop = platform === "darwin" ? join8(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform === "win32" ? join8(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json") : join8(home, ".config", "Claude", "claude_desktop_config.json");
-  const vscodeUser = platform === "darwin" ? join8(home, "Library", "Application Support", "Code", "User", "mcp.json") : platform === "win32" ? join8(home, "AppData", "Roaming", "Code", "User", "mcp.json") : join8(home, ".config", "Code", "User", "mcp.json");
+  const claudeDesktop = platform === "darwin" ? join10(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : platform === "win32" ? join10(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json") : join10(home, ".config", "Claude", "claude_desktop_config.json");
+  const vscodeUser = platform === "darwin" ? join10(home, "Library", "Application Support", "Code", "User", "mcp.json") : platform === "win32" ? join10(home, "AppData", "Roaming", "Code", "User", "mcp.json") : join10(home, ".config", "Code", "User", "mcp.json");
   return [
-    createCodexConnector({ ...shared, configPath: join8(home, ".codex", "config.toml"), detectionPath: join8(home, ".codex") }, fileSystem),
+    createCodexConnector({ ...shared, configPath: join10(home, ".codex", "config.toml"), detectionPath: join10(home, ".codex") }, fileSystem),
     createClaudeDesktopConnector({ ...shared, configPath: claudeDesktop, detectionPath: dirname6(claudeDesktop) }, fileSystem),
-    createClaudeCodeConnector({ ...shared, configPath: join8(home, ".claude.json"), detectionPath: join8(home, ".claude") }, fileSystem),
+    createClaudeCodeConnector({ ...shared, configPath: join10(home, ".claude.json"), detectionPath: join10(home, ".claude") }, fileSystem),
     createVsCodeConnector({ ...shared, configPath: vscodeUser, detectionPath: dirname6(vscodeUser) }, fileSystem),
-    createCursorConnector({ ...shared, configPath: join8(home, ".cursor", "mcp.json"), detectionPath: join8(home, ".cursor") }, fileSystem)
+    createCursorConnector({ ...shared, configPath: join10(home, ".cursor", "mcp.json"), detectionPath: join10(home, ".cursor") }, fileSystem)
   ];
 }
 var DefaultClientIntegration = class {
@@ -7119,6 +7935,8 @@ function isMissing3(error) {
 }
 
 // src/mcp/deployment/onboarding.ts
+import { createTheme as createTheme3 } from "@bunizao/cli-kit";
+var PLAIN = createTheme3(false);
 var ONBOARDING_STAGES = [
   { id: "validate_moodle_session", index: 1, label: "Validating Moodle session" },
   { id: "check_cloudflare_access", index: 2, label: "Checking Cloudflare access" },
@@ -7210,39 +8028,41 @@ var ONBOARDING_COPY = {
     "Wrangler will request Cloudflare authorization again."
   ].join("\n")
 };
-function formatOnboardingStage(stageId, status) {
+function formatOnboardingStage(stageId, status, theme = PLAIN) {
   const stage = ONBOARDING_STAGES.find((item) => item.id === stageId);
   if (!stage) {
     throw new Error(`Unknown onboarding stage: ${stageId}`);
   }
   const line = `[${stage.index}/8] ${stage.label}`;
-  return status === "completed" ? `\u2713 ${line}` : line;
+  return status === "completed" ? `${theme.tone("success", "\u2713")} ${line}` : line;
 }
-function successfulDeploymentCopy(input2) {
-  const connectedClients = input2.clients.length ? input2.clients.map((client) => `  \u2713 ${client}`).join("\n") : "  No supported clients detected";
+function successfulDeploymentCopy(input2, theme = PLAIN) {
+  const connectedClients = input2.clients.length ? input2.clients.map((client) => `  ${theme.tone("success", "\u2713")} ${client}`).join("\n") : `  ${theme.dim("No supported clients detected")}`;
+  const field = (label, value) => `  ${theme.dim(`${label}:`)} ${value}`;
   return [
-    "Moodle MCP is ready.",
+    theme.tone("success", "Moodle MCP is ready."),
     "",
-    "Endpoint",
-    `  ${input2.endpoint}`,
+    theme.subject("Endpoint"),
+    // The one line a person copies into a client, so it reads as an identifier, not a footnote.
+    `  ${theme.key(input2.endpoint)}`,
     "",
-    "Protocol",
-    "  MCP 2026-07-28",
-    "  Stateless legacy compatibility: 2025-11-25",
+    theme.subject("Protocol"),
+    `  ${theme.dim("MCP")} ${MODERN_PROTOCOL_VERSION}`,
+    `  ${theme.dim(`Stateless legacy compatibility: ${LEGACY_PROTOCOL_VERSION}`)}`,
     "",
-    "Moodle",
-    `  Site: ${input2.moodleSite}`,
-    `  User: ${input2.moodleUser}`,
-    "  Session: ready",
+    theme.subject("Moodle"),
+    field("Site", theme.target(input2.moodleSite)),
+    field("User", input2.moodleUser),
+    field("Session", theme.status("ready", { ready: "success" })),
     "",
-    "Renewal",
-    "  Installed on this computer",
-    "  Next check: within 30 minutes",
+    theme.subject("Renewal"),
+    `  ${theme.dim("Installed on this computer")}`,
+    `  ${theme.dim("Next check: within 30 minutes")}`,
     "",
-    "Connected clients",
+    theme.subject("Connected clients"),
     connectedClients,
     "",
-    "Run `moodle mcp status` at any time."
+    `Run ${theme.key("moodle mcp status")} at any time.`
   ].join("\n");
 }
 
@@ -7552,7 +8372,8 @@ var ManagedMcpDeployment = class {
         clientsConnected: await this.dependencies.clients.inspect(profile),
         readiness: "unknown",
         readinessReasonCode: "NOT_DEPLOYED",
-        sessionRevision: null
+        sessionRevision: null,
+        recoveryActive: false
       };
     }
     const [worker, credentials, renewalInstalled, clientsConnected] = await Promise.all([
@@ -7581,7 +8402,8 @@ var ManagedMcpDeployment = class {
       clientsConnected,
       readiness,
       readinessReasonCode,
-      sessionRevision
+      sessionRevision,
+      recoveryActive: receipt.releaseDigest.endsWith("-recovery")
     };
   }
   async recover(profile) {
@@ -7840,16 +8662,19 @@ function asDeploymentError(error) {
   if (error instanceof DeploymentApplyError) {
     return error;
   }
+  if (error instanceof CliError2) {
+    return error;
+  }
   const detail = error instanceof Error && error.message ? `: ${error.message}` : "";
   return new DeploymentApplyError("DEPLOYMENT_FAILED", `The managed Moodle MCP deployment failed${detail}`, { cause: error });
 }
 
 // src/mcp/wrangler.ts
 import { createUi as createUi2 } from "@bunizao/cli-kit";
-import { mkdir as mkdir7 } from "fs/promises";
+import { mkdir as mkdir8, writeFile as writeFile7 } from "fs/promises";
 import { existsSync } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join9 } from "path";
+import { homedir as homedir12 } from "os";
+import { join as join11 } from "path";
 async function resolveWrangler(runner, options = {}) {
   const env = options.env ?? process.env;
   const notice = options.notice ?? ((text2) => process.stderr.write(`${text2}
@@ -7860,8 +8685,8 @@ async function resolveWrangler(runner, options = {}) {
     if (version && sameMajorAtLeast(version, WRANGLER_VERSION)) return { command: existing, args: [] };
     notice(`Ignoring ${existing} (${version ?? "unknown version"}); Cloudflare management needs Wrangler ${WRANGLER_VERSION.split(".")[0]}.x.`);
   }
-  const root = join9(options.homeDir ?? homedir10(), ".config", "moodle-cli", "tools", `wrangler@${WRANGLER_VERSION}`);
-  const script = join9(root, "node_modules", "wrangler", "bin", "wrangler.js");
+  const root = join11(options.homeDir ?? homedir12(), ".config", "moodle-cli", "tools", `wrangler@${WRANGLER_VERSION}`);
+  const script = join11(root, "node_modules", "wrangler", "bin", "wrangler.js");
   const bun = findExecutable("bun", env);
   const node = findExecutable("node", env);
   if (!bun && !node) throw new Error("Cloudflare management needs Bun or Node 22.13+. Install either, then retry moodle mcp deploy.");
@@ -7877,9 +8702,16 @@ async function resolveWrangler(runner, options = {}) {
       }
     }
     notice(`Cloudflare management needs Wrangler ${WRANGLER_VERSION}; downloading once to ${root}.`);
-    await mkdir7(root, { recursive: true, mode: 448 });
-    await runner.run(bun ?? npm, bun ? ["install", "--cwd", root, "--no-save", `wrangler@${WRANGLER_VERSION}`] : ["install", "--prefix", root, "--no-save", "--package-lock=false", "--no-audit", "--no-fund", `wrangler@${WRANGLER_VERSION}`]);
-    if (!existsSync(script)) throw new Error("Wrangler installation did not create the expected executable. Retry moodle mcp deploy.");
+    await mkdir8(root, { recursive: true, mode: 448 });
+    await writeFile7(join11(root, "package.json"), '{ "private": true }\n');
+    const result = await runner.run(bun ?? npm, bun ? ["install", "--cwd", root, "--no-save", `wrangler@${WRANGLER_VERSION}`] : ["install", "--prefix", root, "--no-save", "--package-lock=false", "--no-audit", "--no-fund", `wrangler@${WRANGLER_VERSION}`]);
+    if (!existsSync(script)) {
+      const output = `${result.stderr}
+${result.stdout}`.trim().split(/\r?\n/u).slice(-5).join("\n");
+      throw new Error(`Wrangler installation did not create ${script}.${output ? `
+${output}` : ""}
+Remove ${root} and retry moodle mcp deploy.`);
+    }
   }
   return { command: node ?? bun, args: [script] };
 }
@@ -7891,18 +8723,18 @@ function sameMajorAtLeast(actual, pinned) {
 
 // src/mcp/deployment/node-adapters.ts
 import { isDeepStrictEqual } from "util";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { chmod as chmod5, mkdir as mkdir8, mkdtemp, readFile as readFile8, rm as rm6, writeFile as writeFile7 } from "fs/promises";
-import { homedir as homedir11, tmpdir } from "os";
-import { basename, dirname as dirname7, join as join10 } from "path";
+import { chmod as chmod5, mkdir as mkdir9, mkdtemp, readFile as readFile8, rm as rm6, writeFile as writeFile8 } from "fs/promises";
+import { homedir as homedir13, tmpdir } from "os";
+import { basename, dirname as dirname7, join as join12 } from "path";
 var MODERN_MCP_VERSION = "2026-07-28";
 var WORKER_PROPAGATION_ATTEMPTS = 10;
 var WORKER_PROPAGATION_MAX_DELAY_MS = 4e3;
 var NodeDeploymentCommandRunner = class {
   async run(command, args, environment = {}) {
     return new Promise((resolve, reject) => {
-      const child = spawn2(command, args, {
+      const child = spawn3(command, args, {
         env: { ...process.env, ...environment },
         stdio: ["ignore", "pipe", "pipe"],
         windowsHide: true
@@ -8118,6 +8950,10 @@ ${error.stderr}`)) {
     }
     await this.wrangler(["delete", input2.workerName, "--force"], input2.accountId);
   }
+  /** Locate or download Wrangler now, so a first-use prompt is not drawn under a spinner later. */
+  async prepare(options = {}) {
+    if (!this.wranglerBinPath) await resolveWrangler(this.runner, options);
+  }
   async wrangler(args, accountId, environmentOverrides = {}) {
     const environment = { ...environmentOverrides };
     if (accountId) {
@@ -8132,7 +8968,7 @@ ${error.stderr}`)) {
   }
 };
 async function copyReleaseBundle(source, destination) {
-  await writeFile7(destination, await readFile8(source));
+  await writeFile8(destination, await readFile8(source));
 }
 var NodeReleaseMaterializer = class {
   constructor(options) {
@@ -8141,13 +8977,13 @@ var NodeReleaseMaterializer = class {
   options;
   async prepare(plan, credentials) {
     const temporaryRoot = this.options.temporaryRoot ?? tmpdir();
-    await mkdir8(temporaryRoot, { recursive: true });
-    const artifactDirectory = await mkdtemp(join10(temporaryRoot, "moodle-mcp-"));
+    await mkdir9(temporaryRoot, { recursive: true });
+    const artifactDirectory = await mkdtemp(join12(temporaryRoot, "moodle-mcp-"));
     await chmod5(artifactDirectory, 448);
-    const workerFile = join10(artifactDirectory, basename(this.options.workerBundlePath));
+    const workerFile = join12(artifactDirectory, basename(this.options.workerBundlePath));
     await copyReleaseBundle(this.options.workerBundlePath, workerFile);
-    const wranglerConfigPath = join10(artifactDirectory, "wrangler.json");
-    const secretsFilePath = join10(artifactDirectory, "secrets.json");
+    const wranglerConfigPath = join12(artifactDirectory, "wrangler.json");
+    const secretsFilePath = join12(artifactDirectory, "secrets.json");
     const expectedHosts = endpointHosts(plan.intent.workerName, plan.existing?.productionEndpoint);
     const config = {
       $schema: "node_modules/wrangler/config-schema.json",
@@ -8187,18 +9023,18 @@ var NodeReleaseMaterializer = class {
     if (credentials.previousTokensExpireAt !== void 0 && Number.isFinite(credentials.previousTokensExpireAt)) {
       secrets.TOKEN_OVERLAP_EXPIRES_AT = String(credentials.previousTokensExpireAt);
     }
-    await writeFile7(wranglerConfigPath, `${JSON.stringify(config, null, 2)}
+    await writeFile8(wranglerConfigPath, `${JSON.stringify(config, null, 2)}
 `, { mode: 384 });
-    await writeFile7(secretsFilePath, `${JSON.stringify(secrets)}
+    await writeFile8(secretsFilePath, `${JSON.stringify(secrets)}
 `, { mode: 384 });
     await chmod5(wranglerConfigPath, 384);
     await chmod5(secretsFilePath, 384);
     let recoveryConfigPath;
     try {
-      const recoveryBundle = process.env.MOODLE_BUNDLED_RECOVERY ?? join10(dirname7(this.options.workerBundlePath), "recovery.js");
-      await copyReleaseBundle(recoveryBundle, join10(artifactDirectory, "recovery.js"));
-      recoveryConfigPath = join10(artifactDirectory, "wrangler-recovery.json");
-      await writeFile7(recoveryConfigPath, `${JSON.stringify({ ...config, main: "./recovery.js" })}
+      const recoveryBundle = process.env.MOODLE_BUNDLED_RECOVERY ?? join12(dirname7(this.options.workerBundlePath), "recovery.js");
+      await copyReleaseBundle(recoveryBundle, join12(artifactDirectory, "recovery.js"));
+      recoveryConfigPath = join12(artifactDirectory, "wrangler-recovery.json");
+      await writeFile8(recoveryConfigPath, `${JSON.stringify({ ...config, main: "./recovery.js" })}
 `, { mode: 384 });
     } catch (error) {
       if (!isMissing4(error) || plan.existing) throw error;
@@ -8307,28 +9143,25 @@ var FetchManagedWorkerClient = class {
     }
     await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "server/discover", {}, 1);
     await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/list", {}, 2);
-    const userResult = await this.mcpCall(
-      input2.endpoint,
-      input2.mcpAccessToken,
-      "tools/call",
-      { name: "get_user", arguments: {} },
-      3
-    );
-    const moodleUser = mcpUserFullname(userResult);
+    const homeResult = await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "home", arguments: {} }, 3);
+    const moodleUser = smokeMoodleUser(homeResult);
     if (!moodleUser) {
-      throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP get_user check returned no Moodle user");
+      throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP home check returned no Moodle user");
     }
-    const coursesResult = await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "list_courses", arguments: { limit: 1 } }, 4);
-    const courses = readableToolResult(coursesResult).courses;
-    if (!Array.isArray(courses)) throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP list_courses returned no course list");
-    if (courses.length) {
-      const first2 = courses[0];
+    const unitsResult = await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "units", arguments: { limit: 1 } }, 4);
+    const units = readableToolResult(unitsResult).units;
+    if (!Array.isArray(units)) throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP units returned no unit list");
+    if (units.length) {
+      const first2 = units[0];
       if (!isRecord9(first2) || !Number.isSafeInteger(first2.id) || Number(first2.id) <= 0) {
-        throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP list_courses returned no usable course ID");
+        throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP units returned no usable unit ID");
       }
-      const detail = readableToolResult(await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "get_course", arguments: { courseId: first2.id } }, 5));
-      if (!isRecord9(detail.course) || !isRecord9(detail.course.course) || detail.course.course.id !== first2.id || !Array.isArray(detail.course.sections)) {
-        throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP course lookup did not match the listed course");
+      const detail = readableToolResult(await this.mcpCall(input2.endpoint, input2.mcpAccessToken, "tools/call", { name: "unit", arguments: { unit: first2.id } }, 5));
+      if (!isRecord9(detail.unit) || detail.unit.id !== first2.id) {
+        throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP unit lookup did not match the listed unit");
+      }
+      if (detail.sections !== void 0 && !Array.isArray(detail.sections)) {
+        throw new DeploymentApplyError("MCP_SMOKE_FAILED", "MCP unit lookup returned an unusable section list");
       }
     }
     return { moodleUser };
@@ -8406,7 +9239,7 @@ var FetchManagedWorkerClient = class {
   }
 };
 var PrivateDeploymentReceiptStore = class {
-  constructor(baseDirectory = join10(homedir11(), ".config", "moodle-cli", "mcp", "deployments")) {
+  constructor(baseDirectory = join12(homedir13(), ".config", "moodle-cli", "mcp", "deployments")) {
     this.baseDirectory = baseDirectory;
   }
   baseDirectory;
@@ -8423,8 +9256,8 @@ var PrivateDeploymentReceiptStore = class {
   }
   async write(receipt) {
     const path5 = this.path(receipt.profile);
-    await mkdir8(dirname7(path5), { recursive: true, mode: 448 });
-    await writeFile7(path5, `${JSON.stringify(receipt, null, 2)}
+    await mkdir9(dirname7(path5), { recursive: true, mode: 448 });
+    await writeFile8(path5, `${JSON.stringify(receipt, null, 2)}
 `, { mode: 384 });
     await chmod5(path5, 384);
   }
@@ -8435,11 +9268,11 @@ var PrivateDeploymentReceiptStore = class {
     if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(profile)) {
       throw new Error("Invalid Moodle MCP profile name");
     }
-    return join10(this.baseDirectory, `${profile}.json`);
+    return join12(this.baseDirectory, `${profile}.json`);
   }
 };
 function createDefaultManagedDeployment(options) {
-  const homeDirectory = options.homeDirectory ?? homedir11();
+  const homeDirectory = options.homeDirectory ?? homedir13();
   const platform = options.platform ?? process.platform;
   const runtime = runtimeCommand(options.executable, options.executableArgs);
   const defaults = {
@@ -8466,7 +9299,7 @@ function createDefaultManagedDeployment(options) {
       command: runtime.command,
       commandArgs: runtime.args
     }),
-    receipts: new PrivateDeploymentReceiptStore(join10(homeDirectory, ".config", "moodle-cli", "mcp", "deployments")),
+    receipts: new PrivateDeploymentReceiptStore(join12(homeDirectory, ".config", "moodle-cli", "mcp", "deployments")),
     createToken: () => randomBytes2(32).toString("base64url")
   };
   return new ManagedMcpDeployment({ ...defaults, ...options.dependencies });
@@ -8495,7 +9328,7 @@ async function pinExpectedHosts(configPath, workerName, productionEndpoint) {
     throw new DeploymentApplyError("MISSING_ENDPOINT", "The Worker production endpoint is invalid");
   }
   config.vars.EXPECTED_HOSTS = hosts.join(",");
-  await writeFile7(configPath, `${JSON.stringify(config, null, 2)}
+  await writeFile8(configPath, `${JSON.stringify(config, null, 2)}
 `, { mode: 384 });
 }
 function endpointHosts(workerName, endpoint) {
@@ -8544,9 +9377,9 @@ function readableToolResult(result) {
   }
   throw new DeploymentApplyError("MCP_CONTENT_INCOMPLETE", "MCP text content is missing the complete structured result");
 }
-function mcpUserFullname(result) {
-  const user = readableToolResult(result).user;
-  return isRecord9(user) && typeof user.fullname === "string" && user.fullname.trim() ? user.fullname.trim() : null;
+function smokeMoodleUser(result) {
+  const home = readableToolResult(result).home;
+  return isRecord9(home) && typeof home.name === "string" && home.name.trim() ? home.name.trim() : null;
 }
 function parseJsonOutput(output) {
   const candidates = [output.indexOf("{"), output.indexOf("[")].filter((index) => index >= 0).sort((a, b) => a - b);
@@ -9005,9 +9838,9 @@ function deriveMcpWorkerName(moodleOrigin) {
 var DefaultMcpCommandService = class {
   constructor(options) {
     this.options = options;
-    this.homeDirectory = options.homeDir ?? homedir12();
+    this.homeDirectory = options.homeDir ?? homedir14();
     this.wranglerInstance = options.wrangler;
-    this.receipts = options.receipts ?? new PrivateDeploymentReceiptStore(join11(this.homeDirectory, ".config", "moodle-cli", "mcp", "deployments"));
+    this.receipts = options.receipts ?? new PrivateDeploymentReceiptStore(join13(this.homeDirectory, ".config", "moodle-cli", "mcp", "deployments"));
     this.credentials = options.credentials ?? createDefaultCredentialStore({ platform: process.platform, homeDirectory: this.homeDirectory });
     this.worker = options.worker ?? new FetchManagedWorkerClient(options.fetchImpl);
     this.renewal = options.renewal ?? new DefaultRenewalIntegration({
@@ -9032,6 +9865,8 @@ var DefaultMcpCommandService = class {
   notifyRenewalSignIn;
   progressReporter;
   async deploy(input2) {
+    await this.prepareToolchain(input2.yes);
+    const theme = this.theme();
     const progress = this.progress();
     try {
       progress.begin("Reading Cloudflare account and deployment state");
@@ -9074,8 +9909,8 @@ var DefaultMcpCommandService = class {
       const events = [];
       for await (const event2 of deployment.apply(plan)) {
         events.push(event2);
-        if (event2.status === "started") progress.begin(formatOnboardingStage(event2.stageId, "pending"));
-        else if (event2.status === "completed") progress.end(formatOnboardingStage(event2.stageId, "completed"));
+        if (event2.status === "started") progress.begin(formatOnboardingStage(event2.stageId, "pending", theme));
+        else if (event2.status === "completed") progress.end(formatOnboardingStage(event2.stageId, "completed", theme));
         else progress.clear();
       }
       progress.begin("Reading deployment status");
@@ -9098,7 +9933,7 @@ var DefaultMcpCommandService = class {
         moodleSite: identity.moodleOrigin,
         moodleUser: events.find((event2) => event2.moodleUser)?.moodleUser ?? "Unknown Moodle user",
         clients: await this.connectedClientNames(identity.profile)
-      })
+      }, this.theme())
     };
   }
   async planDeployment(deployment, initialIntent) {
@@ -9142,6 +9977,7 @@ var DefaultMcpCommandService = class {
   async status(input2) {
     const config = await this.config();
     const profile = deriveMcpProfile(config.baseUrl);
+    await this.prepareToolchain();
     const progress = this.progress();
     let managed;
     try {
@@ -9169,21 +10005,25 @@ var DefaultMcpCommandService = class {
       ...input2.verbose ? { serviceVersion: VERSION } : {},
       ...input2.logs ? { logs: { available: false, reason: "live_tail_required" } } : {}
     };
+    const theme = this.theme();
+    const row = (label, value) => `${theme.dim(`${label}:`)} ${theme.status(value, { pass: "success", warn: "warning", fail: "danger", unknown: "muted", "not deployed": "warning", missing: "warning", "not connected": "warning", stored: "success", installed: "success", connected: "success" })}`;
     return {
       data,
       text: [
-        `Moodle MCP: ${managed.readiness}`,
-        `Worker: ${managed.worker?.workerName ?? "not deployed"}`,
-        `Credentials: ${managed.credentialsStored ? "stored" : "missing"}`,
-        `Renewal: ${managed.renewalInstalled ? "installed" : "missing"}`,
-        `Clients: ${managed.clientsConnected ? "connected" : "not connected"}`,
-        ...updateAvailable ? ["Update: remote Worker is behind this CLI. Run `moodle mcp deploy` to update it."] : [],
-        ...input2.logs ? ["Logs: use a live sanitized tail from an interactive terminal"] : []
+        row("Moodle MCP", managed.readiness),
+        row("Worker", managed.worker?.workerName ?? "not deployed"),
+        row("Credentials", managed.credentialsStored ? "stored" : "missing"),
+        row("Renewal", managed.renewalInstalled ? "installed" : "missing"),
+        row("Clients", managed.clientsConnected ? "connected" : "not connected"),
+        ...managed.recoveryActive ? [`${theme.dim("Release:")} ${theme.tone("warning", "the recovery Worker is live; OAuth sign-in is disabled until")} ${theme.key("moodle mcp deploy")} ${theme.tone("warning", "succeeds.")}`] : [],
+        ...updateAvailable ? [`${theme.dim("Update:")} remote Worker is behind this CLI. Run ${theme.key("moodle mcp deploy")} to update it.`] : [],
+        ...input2.logs ? [`${theme.dim("Logs:")} use a live sanitized tail from an interactive terminal`] : []
       ].join("\n")
     };
   }
   async login() {
     const profile = deriveMcpProfile((await this.config()).baseUrl);
+    await this.prepareToolchain();
     const progress = this.progress();
     try {
       progress.begin("Reading your Moodle session (a browser sign-in may be required)");
@@ -9417,7 +10257,7 @@ var DefaultMcpCommandService = class {
   async pushSessionFromStdin() {
     const config = await this.config();
     const profile = deriveMcpProfile(config.baseUrl);
-    const raw = (await readAll(this.options.stdin ?? process.stdin)).trim();
+    const raw = (await readAll2(this.options.stdin ?? process.stdin)).trim();
     const cookieValue = raw.startsWith("MoodleSession=") ? raw.slice("MoodleSession=".length).trim() : raw;
     if (!cookieValue || /[\r\n]/u.test(cookieValue)) throw new UsageError("Standard input did not contain one Moodle session cookie.");
     const session = await getAuthenticatedSession(config.baseUrl, {
@@ -9572,6 +10412,12 @@ Selection: `)).trim());
     this.wranglerInstance ??= new NodeWranglerDeploymentAdapter();
     return this.wranglerInstance;
   }
+  // The first-use Wrangler download asks a question, so it runs before a spinner
+  // owns the terminal rather than drawing its prompt underneath one.
+  async prepareToolchain(yes = false) {
+    if (this.options.createDeployment || this.options.wrangler) return;
+    await this.wrangler().prepare({ yes });
+  }
   releaseDigest() {
     return readFile9(this.workerBundlePath()).then((content) => sha256(content));
   }
@@ -9593,6 +10439,9 @@ Selection: `)).trim());
   }
   // Progress belongs on stderr so that --json and --yaml keep stdout to themselves.
   // One shared reporter, so anything else that writes can stop the animation first.
+  theme() {
+    return createTheme4(this.options.color?.() ?? false);
+  }
   progress() {
     this.progressReporter ??= createProgressReporter({ stream: this.options.stderr ?? process.stderr });
     return this.progressReporter;
@@ -9697,7 +10546,7 @@ function displayClientName(client) {
   };
   return names[client];
 }
-async function readAll(input2) {
+async function readAll2(input2) {
   const decoder = new TextDecoder();
   let value = "";
   for await (const chunk of input2) value += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
@@ -9815,7 +10664,9 @@ function buildProgram(io = {}) {
       const merged = { ...program.opts(), ...options };
       const format = outputFormat(merged, stdout);
       const human2 = format === "table" ? formatter() : "";
-      const text2 = format === "table" ? `${human2}${human2.includes("Try  ") ? "" : "\n\nTry  moodle due \xB7 moodle units \xB7 moodle --help"}
+      const text2 = format === "table" ? `${human2}${human2.includes("Try  ") ? "" : `
+
+${tryLines(["moodle due", "moodle units", "moodle --help"])}`}
 ` : format === "json" ? `${JSON.stringify(JSON.parse(render(data, { format, fields: parseFields(data, merged.fields) })), null, merged.pretty ? 2 : void 0)}
 ` : render(data, { format, fields: parseFields(data, merged.fields) });
       if (io.stdout && !merged.output) {
@@ -9834,7 +10685,9 @@ function buildProgram(io = {}) {
       stdin: io.stdin,
       stdout,
       stderr,
-      fetchImpl: io.fetchImpl
+      fetchImpl: io.fetchImpl,
+      // Progress goes to stderr and the summary to stdout, so both streams must want colour.
+      color: () => colorEnabled2(stdout, io.env) && colorEnabled2(stderr, io.env) && program.opts().color !== false
     });
     return mcpService;
   };
@@ -9849,23 +10702,26 @@ function buildProgram(io = {}) {
     env: io.env ?? process.env,
     format: outputFormat(program.opts(), stdout)
   }) === "human";
-  const theme = () => createTheme3(colorEnabled2(stderr, io.env) && program.opts().color !== false);
+  const theme = () => createTheme5(colorEnabled2(stderr, io.env) && program.opts().color !== false);
   const signIn = async (baseUrl) => {
     const ui = createUi3({ input: io.stdin ?? process.stdin, output: stderr, interactive: true });
-    showWordmark(ui);
-    ui.note(`No Moodle session for ${baseUrl}.
-Sign in once in your browser; later commands reuse that session.`, "One-time setup");
-    if (!await ui.confirm("Open the browser to sign in?", { initial: true })) {
-      throw new AuthError(`No usable MoodleSession found for ${baseUrl}.`, "Run moodle auth login when you are ready.");
-    }
-    const spin = ui.spinner();
-    spin.start("Opening the browser");
+    const auth2 = { env: io.env, fetch: io.fetchImpl, homeDir: io.homeDir, captureMobileToken: true };
+    runtime.busy = true;
     try {
-      const session = await getAuthenticatedSessionWithBrowserFallback(baseUrl, { env: io.env, fetch: io.fetchImpl, homeDir: io.homeDir, onBrowserOpened: (url) => spin.message(`Finish signing in at ${url}`) });
-      spin.stop(`Signed in as userid ${session.userid}`);
-    } catch (error) {
-      spin.error("Sign-in did not complete");
-      throw error;
+      await signInInteractively(ui, {
+        baseUrl,
+        platform: process.platform,
+        showWordmark,
+        storesBlocked: async () => cookieStoresBlocked(await browserCookieStores({ homeDir: io.homeDir })),
+        openInBrowser,
+        readBrowserSession: () => getAuthenticatedSession(baseUrl, { ...auth2, noCache: true, nonInteractive: true }),
+        browserLogin: (onBrowserOpened) => getAuthenticatedSessionWithBrowserFallback(baseUrl, { ...auth2, onBrowserOpened }),
+        pasteLogin: () => pasteLogin(baseUrl, true),
+        keepaliveInstalled: async () => (await keepaliveStatus(io.homeDir)).installed,
+        installKeepalive: () => installKeepalive({ homeDir: io.homeDir })
+      });
+    } finally {
+      runtime.busy = false;
     }
   };
   const choose = async (action, retry) => {
@@ -9992,11 +10848,7 @@ Sign in once in your browser; later commands reuse that session.`, "One-time set
       }
     }
     if (!url || !/^https?:/u.test(url)) throw new UsageError("This item has no browser URL.");
-    await new Promise((resolve, reject) => {
-      const child = spawn3(process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open", [url], { stdio: "ignore" });
-      child.once("error", reject);
-      child.once("exit", (code) => code === 0 ? resolve() : reject(new Error("Could not open the browser.")));
-    });
+    await openInBrowser(url);
     await runtime.output({ opened: url }, () => `Opened ${url}`, options);
   });
   addOutputOptions(program.command("user").description("Show authenticated user info.")).action(async (options) => {
@@ -10090,7 +10942,10 @@ Sign in once in your browser; later commands reuse that session.`, "One-time set
   addOutputOptions(program.command("doctor").description("Diagnose runtime, browser access, session, background jobs and MCP setup.").summary("Diagnose runtime, session and MCP setup")).action(async (options) => {
     const result = await doctor(io);
     await runtime.output(result, () => result.checks.map((c) => `${c.status.toUpperCase()} ${c.name}: ${c.detail}${c.hint ? `
-  ${c.hint}` : ""}`).join("\n") + "\n\nTry  moodle auth login \xB7 moodle mcp status", options);
+  ${c.hint}` : ""}`).join("\n") + `
+
+${tryLines(doctorNextSteps(result.checks))}`, options);
+    if (result.checks.some((c) => c.status === "fail")) process.exitCode = 3;
   });
   program.command("completion").description("Print shell completion for zsh, bash or fish.").addArgument(program.createArgument("<shell>", "Shell to target").choices(["zsh", "bash", "fish"])).action((shell) => {
     const names = program.commands.filter((c) => c.name() !== "help").flatMap((c) => [c.name(), ...c.aliases()]);
@@ -10103,9 +10958,9 @@ _arguments '1:command:(${names.join(" ")})' '*:reference:'
     else throw new UsageError("Choose zsh, bash or fish.");
   });
   addOutputOptions(mutating(program.command("uninstall").description("Remove local background jobs; optionally remove the selected Worker and configuration.").summary("Remove background jobs, Worker and config"))).option("--remote", "Also remove the configured managed MCP deployment.").option("--purge", "Also delete local Moodle CLI configuration, receipts and cache.").action(async (options) => {
-    const home = io.homeDir ?? homedir13();
+    const home = io.homeDir ?? homedir15();
     const jobs = await ownedJobs(home);
-    const receipts = await readdir3(path4.join(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
+    const receipts = await readdir4(path4.join(home, ".config", "moodle-cli", "mcp", "deployments")).catch(() => []);
     const result = { jobs: jobs.map((j) => j.path), remote: Boolean(options.remote), purge: Boolean(options.purge), config: path4.join(home, CONFIG_DIR_NAME), cache: path4.join(home, CACHE_DIR_NAME), package_command: "npm rm -g moodle-cli (or bun remove -g moodle-cli); for the standalone install: rm ~/.local/bin/moodle", remaining: options.remote ? "Only the configured Worker is removed. Other profiles remain remote." : "Remote Workers and credentials remain unless removed with moodle mcp remove." };
     if (program.opts().dryRun) return runtime.output(result, () => JSON.stringify(result, null, 2), options);
     if (options.purge && receipts.length && !options.remote) throw new UsageError("Managed deployment receipts exist; remove the Worker before purging its recovery information.", "Run moodle mcp remove for each configured site, then moodle uninstall --purge.");
@@ -10138,23 +10993,36 @@ ${result.package_command}`, options);
 ${note}`, options);
     }
   );
-  addOutputOptions(auth.command("login").description("Extract a fresh session, opening the browser when needed.")).action(
+  addOutputOptions(
+    auth.command("login").description("Sign in through a browser the CLI controls, then capture the session.").option("--paste", "Take the MoodleSession cookie from a prompt instead of the browser store.")
+  ).action(
     async (options) => {
       const baseUrl = await runtime.baseUrl();
-      await invalidateCachedSession(baseUrl, { homeDir: io.homeDir });
       const humanOutput = outputFormat(options, stdout) === "table";
-      const session = await getAuthenticatedSessionWithBrowserFallback(baseUrl, {
+      const session = options.paste ? await pasteLogin(baseUrl, humanOutput) : await getAuthenticatedSessionWithBrowserFallback(baseUrl, {
         env: io.env,
         fetch: io.fetchImpl,
         homeDir: io.homeDir,
-        onBrowserOpened: humanOutput ? (url) => stderr.write(`No active Moodle session found. Complete login in your browser:
-${url}
-`) : void 0
+        captureMobileToken: true,
+        onBrowserOpened: humanOutput ? () => stderr.write("A browser window opened. Sign in there; I'll capture the session automatically.\n") : void 0
       });
       const result = { base_url: baseUrl, userid: session.userid, cookie_source: session.cookie.source ?? "unknown" };
       await runtime.output(result, () => `Authenticated as userid ${result.userid} via ${result.cookie_source}`, options);
     }
   );
+  async function pasteLogin(baseUrl, humanOutput) {
+    const input2 = io.stdin ?? process.stdin;
+    if (humanOutput && input2.isTTY) {
+      stderr.write(`Copy the ${MOODLE_SESSION_COOKIE_PREFIX} cookie for ${baseUrl} from your browser's developer tools.
+The value is not echoed and is stored in the encrypted session cache.
+`);
+    }
+    const raw = await readSecretLine(input2, stderr, input2.isTTY ? `${MOODLE_SESSION_COOKIE_PREFIX}: ` : "");
+    if (raw === null) {
+      throw new CliError2("cancelled", "Login cancelled.");
+    }
+    return authenticateWithPastedCookie(baseUrl, raw, { env: io.env, fetch: io.fetchImpl, homeDir: io.homeDir, captureMobileToken: true });
+  }
   const keepalive = addOutputOptions(
     auth.command("keepalive").description("Renew the Moodle session once; used by the background keepalive agent.").summary("Renew the session once").option("--no-renew", "Only touch the session; skip re-login when it is expired.")
   ).action(async (options) => {
@@ -10171,7 +11039,7 @@ ${url}
       { yes: Boolean(globals.yes), dryRun: Boolean(globals.dryRun), interactive: human() }
     )) return;
     const baseUrl = await runtime.baseUrl();
-    await getAuthenticatedSessionWithBrowserFallback(baseUrl, { env: io.env, homeDir: io.homeDir, fetch: io.fetchImpl, noCache: true, nonInteractive: true });
+    await getAuthenticatedSessionWithBrowserFallback(baseUrl, { env: io.env, homeDir: io.homeDir, fetch: io.fetchImpl, noCache: true, nonInteractive: true, captureMobileToken: true });
     const result = await installKeepalive({ homeDir: io.homeDir, intervalMinutes: options.interval });
     await runtime.output(result, () => `Keepalive installed: renews every ${result.interval_minutes} min
 Agent: ${result.plist_path}
@@ -10328,9 +11196,9 @@ async function runCli(argv = process.argv, io = {}) {
       return 0;
     }
     const format = errorOutputFormat(args, stdout);
-    const normalized = normalizeError(error);
+    const normalized = normalizeError(asNetworkError(error) ?? error);
     const reference = error instanceof ReferenceError ? error : void 0;
-    const reported = reportError(error, "json");
+    const reported = reportError(asNetworkError(error) ?? error, "json");
     const envelope = JSON.parse(reported.text);
     const hint = reference?.hint || normalized.hint || { auth: "Run moodle auth login, or moodle doctor.", config: "Run moodle doctor to check configuration.", not_found: "Run moodle units or moodle find QUERY.", usage: "Run moodle --help or moodle commands --json.", upstream: "Run moodle doctor, then retry.", network: "Check the connection, then retry.", unexpected: "Run moodle doctor; use --verbose for request timings.", cancelled: "Retry when ready." }[normalized.code];
     envelope.error.hint = hint;
@@ -10347,6 +11215,23 @@ ${hint}
     return envelope.exit_code;
   }
 }
+function openInBrowser(url) {
+  return new Promise((resolve, reject) => {
+    const child = spawn4(process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open", [url], { stdio: "ignore" });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? resolve() : reject(new Error("Could not open the browser.")));
+  });
+}
+function doctorNextSteps(checks) {
+  const failing = new Set(checks.filter((c) => c.status !== "pass").map((c) => c.name));
+  const steps = [];
+  if (failing.has("browser")) steps.push("grant Full Disk Access, then rerun moodle doctor");
+  else if (failing.has("session")) steps.push("moodle auth login");
+  if (failing.has("sqlite")) steps.push("install Node 22.13+ or Bun");
+  if (failing.has("config")) steps.push("moodle units");
+  if (failing.has("job")) steps.push("moodle auth keepalive install");
+  return steps.length ? steps : ["moodle todo", "moodle mcp status"];
+}
 async function dispatchUrl(runtime, target, options) {
   const client = await runtime.getClient();
   const resolved = await resolveTopLevelUrl(client.baseUrl, target, (url) => client.resolveCourseIdForUrl(url));
@@ -10514,7 +11399,7 @@ function pathsReferToSameFile(moduleUrl, executable) {
 var isMain = import.meta.main === true || pathsReferToSameFile(import.meta.url, process.argv[1]);
 if (isMain) {
   runCli().then((code) => {
-    process.exitCode = code;
+    process.exitCode = code || process.exitCode;
   });
 }
 export {