nexrall-code 0.5.206 → 0.5.208

package/dist/index.js

@@ -10114,6 +10114,8 @@ var require_client = __commonJS({
     exports.getUsageDaily = getUsageDaily;
     exports.exchangeVscodeCode = exchangeVscodeCode;
     exports.login = login2;
+    exports.exchangeAuthCode = exchangeAuthCode2;
+    exports.checkToken = checkToken2;
     exports.getUserProfile = getUserProfile;
     exports.clampScheduleMinutes = clampScheduleMinutes;
     exports.listCloudSchedules = listCloudSchedules3;
@@ -10173,7 +10175,7 @@ var require_client = __commonJS({
     function authHeaders() {
       const token = (0, index_1.getToken)();
       if (!token) {
-        throw new Error("Not authenticated. Run `nexrall-code login` first.");
+        throw new Error("Not authenticated. Run `nex auth` first.");
       }
       const headers = {
         "Content-Type": "application/json",
@@ -11159,6 +11161,42 @@ var require_client = __commonJS({
         email: data.email ?? email
       };
     }
+    async function exchangeAuthCode2(code) {
+      const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/vscode-exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...deviceHeader() },
+        body: JSON.stringify({ code })
+      });
+      if (response.status === 401 || response.status === 400) {
+        throw new Error("That sign-in code is invalid or has expired (codes last 5 minutes). Run `nex auth --browser` again.");
+      }
+      if (!response.ok) {
+        const errText3 = await response.text().catch(() => "");
+        throw new Error(`Sign-in failed (${response.status}): ${errText3}`);
+      }
+      const data = await response.json();
+      if (!data.token)
+        throw new Error("Sign-in response missing token");
+      return {
+        token: data.token,
+        ...data.refreshToken ? { refreshToken: data.refreshToken } : {},
+        email: data.user?.email ?? ""
+      };
+    }
+    async function checkToken2(token) {
+      try {
+        const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/user/profile`, {
+          method: "GET",
+          headers: { Authorization: `Bearer ${token}`, ...deviceHeader() }
+        });
+        if (!response.ok)
+          return { ok: false, status: response.status };
+        const data = await response.json().catch(() => ({}));
+        return { ok: true, status: response.status, ...data.email ? { email: data.email } : {} };
+      } catch {
+        return { ok: false, status: 0 };
+      }
+    }
     async function getUserProfile() {
       const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/user/profile`, { method: "GET", headers: authHeaders() });
       let response = await fetchOnce();
@@ -11393,6 +11431,102 @@ var require_client = __commonJS({
   }
 });
 
+// ../core/dist/util/proc.js
+var require_proc = __commonJS({
+  "../core/dist/util/proc.js"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.DETACH_GROUP = exports.IS_WINDOWS = exports.execFile = exports.execFileSync = exports.execSync = exports.spawnSync = exports.spawn = void 0;
+    exports.killProcessTree = killProcessTree3;
+    var cp = __importStar(__require("child_process"));
+    var isOpts = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+    function hide(args, insertAt2) {
+      const out = args.slice();
+      for (let i2 = 1; i2 < out.length; i2++) {
+        if (isOpts(out[i2])) {
+          out[i2] = { windowsHide: true, ...out[i2] };
+          return out;
+        }
+      }
+      let at = insertAt2;
+      if (Array.isArray(out[1]))
+        at = Math.max(at, 2);
+      out.splice(at, 0, { windowsHide: true });
+      return out;
+    }
+    exports.spawn = (...a) => cp.spawn(...hide(a, 1));
+    exports.spawnSync = (...a) => cp.spawnSync(...hide(a, 1));
+    exports.execSync = (...a) => cp.execSync(...hide(a, 1));
+    exports.execFileSync = (...a) => cp.execFileSync(...hide(a, 1));
+    exports.execFile = (...a) => cp.execFile(...hide(a, 1));
+    exports.IS_WINDOWS = process.platform === "win32";
+    exports.DETACH_GROUP = !exports.IS_WINDOWS;
+    function killProcessTree3(pid, sig = "SIGTERM") {
+      if (!pid)
+        return;
+      if (exports.IS_WINDOWS) {
+        try {
+          cp.spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore", timeout: 5e3 });
+        } catch {
+        }
+        return;
+      }
+      try {
+        process.kill(-pid, sig);
+      } catch {
+        try {
+          process.kill(pid, sig);
+        } catch {
+        }
+      }
+    }
+  }
+});
+
 // ../core/dist/tools/sandbox.js
 var require_sandbox = __commonJS({
   "../core/dist/tools/sandbox.js"(exports) {
@@ -11444,7 +11578,7 @@ var require_sandbox = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.parseSandboxConfig = parseSandboxConfig;
     exports.wrapCommandForSandbox = wrapCommandForSandbox;
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var os25 = __importStar(__require("os"));
     function parseSandboxConfig(raw) {
       if (raw === void 0 || raw === null || raw === false || raw === "off")
@@ -11467,7 +11601,7 @@ var require_sandbox = __commonJS({
     var _bwrapAvailable = false;
     function commandExists3(cmd) {
       try {
-        (0, child_process_1.execSync)(`command -v ${cmd}`, { stdio: "ignore" });
+        (0, proc_1.execSync)(process.platform === "win32" ? `where ${cmd}` : `command -v ${cmd}`, { stdio: "ignore" });
         return true;
       } catch {
         return false;
@@ -15869,7 +16003,7 @@ var require_loader = __commonJS({
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
     var os25 = __importStar(__require("os"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var index_1 = require_plugins();
     var frontmatter_1 = require_frontmatter();
     var agentTypes_1 = require_agentTypes();
@@ -15958,7 +16092,7 @@ var require_loader = __commonJS({
       let out = body;
       out = out.replace(/!`([^`]+)`/g, (_m, c) => {
         try {
-          const stdout = (0, child_process_1.execSync)(c, {
+          const stdout = (0, proc_1.execSync)(c, {
             cwd: workDir,
             encoding: "utf-8",
             timeout: 15e3,
@@ -16063,7 +16197,7 @@ var require_skills = __commonJS({
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
     var os25 = __importStar(__require("os"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var index_1 = require_plugins();
     var resolve_1 = require_resolve();
     var loader_1 = require_loader();
@@ -16447,7 +16581,7 @@ var require_skills = __commonJS({
         verdict = true;
       } else {
         try {
-          const r2 = (0, child_process_1.spawnSync)("git", ["-C", workDir, "check-ignore", "-q", "--", dir], {
+          const r2 = (0, proc_1.spawnSync)("git", ["-C", workDir, "check-ignore", "-q", "--", dir], {
             stdio: "ignore",
             timeout: 3e3
           });
@@ -18583,7 +18717,7 @@ var require_executor = __commonJS({
     var https3 = __importStar(__require("https"));
     var http4 = __importStar(__require("http"));
     var dns = __importStar(__require("dns"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var sandbox_1 = require_sandbox();
     var auth_1 = require_auth();
     var client_1 = require_client();
@@ -19105,11 +19239,11 @@ Resolve the conflict (remove <<<<<<< / ======= / >>>>>>> markers and keep the in
     }
     function startBackgroundShell(command, displayCommand, workDir, note) {
       const id = `bg_${++_bgCounter}`;
-      const child = (0, child_process_1.spawn)(command, {
+      const child = (0, proc_1.spawn)(command, {
         shell: true,
         cwd: workDir ?? process.cwd(),
         env: bashSpawnEnv(workDir),
-        detached: true,
+        detached: proc_1.DETACH_GROUP,
         stdio: ["ignore", "pipe", "pipe"]
       });
       const shell = {
@@ -19224,14 +19358,10 @@ ${fresh || "(no new output)"}${trunc}` };
       if (shell.status === "running") {
         shell.status = "killed";
         const killTree = (sig) => {
+          (0, proc_1.killProcessTree)(shell.child.pid, sig);
           try {
-            if (shell.child.pid)
-              process.kill(-shell.child.pid, sig);
+            shell.child.kill(sig);
           } catch {
-            try {
-              shell.child.kill(sig);
-            } catch {
-            }
           }
         };
         killTree("SIGTERM");
@@ -19273,22 +19403,18 @@ ${fresh || "(no new output)"}${trunc}` };
 ${r2.output}`;
           return r2;
         };
-        const child = (0, child_process_1.spawn)(effectiveCommand, {
+        const child = (0, proc_1.spawn)(effectiveCommand, {
           shell: true,
           cwd: workDir ?? process.cwd(),
           env: bashSpawnEnv(workDir),
-          detached: true,
+          detached: proc_1.DETACH_GROUP,
           stdio: ["ignore", "pipe", "pipe"]
         });
         const killTree = (sig) => {
+          (0, proc_1.killProcessTree)(child.pid, sig);
           try {
-            if (child.pid)
-              process.kill(-child.pid, sig);
+            child.kill(sig);
           } catch {
-            try {
-              child.kill(sig);
-            } catch {
-            }
           }
         };
         const HEAD_CHARS = Math.floor(MAX_OUTPUT_CHARS * 0.25);
@@ -19473,7 +19599,7 @@ ${(0, safeSlice_1.sliceSafeStart)(output, output.length - tailLen)}`;
         let settled = false;
         let child;
         try {
-          child = (0, child_process_1.spawn)(cmd, args, { cwd: opts.cwd, stdio: ["ignore", "pipe", "pipe"] });
+          child = (0, proc_1.spawn)(cmd, args, { cwd: opts.cwd, stdio: ["ignore", "pipe", "pipe"] });
         } catch (e2) {
           resolve19({ stdout: "", stderr: "", status: null, signal: null, error: e2 });
           return;
@@ -19610,7 +19736,7 @@ ${(0, safeSlice_1.sliceSafeStart)(output, output.length - tailLen)}`;
         for (const bin of ripgrepCandidates()) {
           if (path36.isAbsolute(bin) && !fs33.existsSync(bin))
             continue;
-          const probe = (0, child_process_1.spawnSync)(bin, ["--version"], { encoding: "utf-8", timeout: 3e3 });
+          const probe = (0, proc_1.spawnSync)(bin, ["--version"], { encoding: "utf-8", timeout: 3e3 });
           if (probe.status === 0) {
             _rgBin = bin;
             _rgAvailable = true;
@@ -20994,7 +21120,7 @@ ${lines.join("\n")}`;
         return { error: "Missing required parameter: path" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       let imageUrl;
       let cost;
       let balance;
@@ -21048,7 +21174,7 @@ ${lines.join("\n")}`;
         return { error: "Missing required parameter: query" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       let photos;
       try {
         const u = new URL(`${client_2.API_BASE}/api/code/assets/stock`);
@@ -21105,7 +21231,7 @@ ${lines.join("\n")}` };
         return { error: "Missing required parameter: query" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       try {
         const r2 = await _httpsPost(`${client_2.API_BASE}/api/code/tools/web_search`, JSON.stringify({ query, ...(0, client_1.billingOverrideFields)() }), { "Content-Type": "application/json", Authorization: `Bearer ${token}` }, 3e4, abortSignal);
         let json = {};
@@ -22643,7 +22769,7 @@ var require_worktree = __commonJS({
     exports.findWorktreeByName = findWorktreeByName2;
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var crypto6 = __importStar(__require("crypto"));
     var rules_1 = require_rules();
     function prRefFromUrl(spec) {
@@ -22669,7 +22795,7 @@ var require_worktree = __commonJS({
     }
     function resolveFreshStartPoint(gitRoot) {
       const run = (args) => {
-        const r2 = (0, child_process_1.spawnSync)("git", args, { cwd: gitRoot, encoding: "utf-8", timeout: 1e4 });
+        const r2 = (0, proc_1.spawnSync)("git", args, { cwd: gitRoot, encoding: "utf-8", timeout: 1e4 });
         return { status: r2.status, stdout: r2.stdout };
       };
       const head = run(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
@@ -22698,7 +22824,7 @@ var require_worktree = __commonJS({
     ]);
     function isGitRepo2(dir) {
       try {
-        const r2 = (0, child_process_1.spawnSync)("git", ["rev-parse", "--show-toplevel"], {
+        const r2 = (0, proc_1.spawnSync)("git", ["rev-parse", "--show-toplevel"], {
           cwd: dir,
           encoding: "utf-8",
           timeout: 5e3
@@ -22739,7 +22865,7 @@ var require_worktree = __commonJS({
       if (!cmd)
         return { ran: false, ok: false };
       try {
-        const r2 = (0, child_process_1.spawnSync)(cmd, {
+        const r2 = (0, proc_1.spawnSync)(cmd, {
           shell: true,
           cwd: workDir,
           timeout: 6e4,
@@ -22806,7 +22932,7 @@ var require_worktree = __commonJS({
         let startPoint;
         let baseLabel;
         if (prRef) {
-          const fetched = (0, child_process_1.spawnSync)("git", ["fetch", "--no-tags", "origin", prRef.refspec], {
+          const fetched = (0, proc_1.spawnSync)("git", ["fetch", "--no-tags", "origin", prRef.refspec], {
             cwd: git.root,
             encoding: "utf-8",
             timeout: 12e4
@@ -22817,7 +22943,7 @@ var require_worktree = __commonJS({
               error: `Could not fetch ${prRef.label} (${prRef.refspec}): ${(fetched.stderr ?? fetched.stdout ?? "").trim() || "unknown error"}`
             };
           }
-          const head = (0, child_process_1.spawnSync)("git", ["rev-parse", "FETCH_HEAD"], { cwd: git.root, encoding: "utf-8", timeout: 1e4 });
+          const head = (0, proc_1.spawnSync)("git", ["rev-parse", "FETCH_HEAD"], { cwd: git.root, encoding: "utf-8", timeout: 1e4 });
           const sha = head.status === 0 ? (head.stdout ?? "").trim() : "";
           if (!/^[0-9a-f]{40}$/i.test(sha)) {
             return { ok: false, error: `Fetched ${prRef.label} but could not resolve its commit.` };
@@ -22834,7 +22960,7 @@ var require_worktree = __commonJS({
           baseLabel = startPoint;
         }
         const args = ["worktree", "add", "-b", branch, worktreePath, ...startPoint ? [startPoint] : []];
-        const r2 = (0, child_process_1.spawnSync)("git", args, {
+        const r2 = (0, proc_1.spawnSync)("git", args, {
           cwd: git.root,
           encoding: "utf-8",
           timeout: 3e4
@@ -22865,7 +22991,7 @@ var require_worktree = __commonJS({
     function worktreeHasWork2(state) {
       if (state.backend === "git") {
         try {
-          const status = (0, child_process_1.spawnSync)("git", ["status", "--porcelain"], {
+          const status = (0, proc_1.spawnSync)("git", ["status", "--porcelain"], {
             cwd: state.worktreePath,
             encoding: "utf-8",
             timeout: 1e4
@@ -22873,7 +22999,7 @@ var require_worktree = __commonJS({
           const meaningfulLines = (status.stdout ?? "").split("\n").filter((line) => line.trim().length > 0 && !line.includes(METADATA_FILENAME));
           if (meaningfulLines.length > 0)
             return true;
-          const unpushed = (0, child_process_1.spawnSync)("git", ["log", "@{u}..HEAD", "--oneline"], {
+          const unpushed = (0, proc_1.spawnSync)("git", ["log", "@{u}..HEAD", "--oneline"], {
             cwd: state.worktreePath,
             encoding: "utf-8",
             timeout: 1e4
@@ -22911,7 +23037,7 @@ var require_worktree = __commonJS({
           fs33.unlinkSync(metadataPath(state.worktreePath));
         } catch {
         }
-        const r2 = (0, child_process_1.spawnSync)("git", ["worktree", "remove", state.worktreePath, ...opts.force ? ["--force"] : []], {
+        const r2 = (0, proc_1.spawnSync)("git", ["worktree", "remove", state.worktreePath, ...opts.force ? ["--force"] : []], {
           cwd: state.mainCheckout,
           encoding: "utf-8",
           timeout: 3e4
@@ -22923,7 +23049,7 @@ var require_worktree = __commonJS({
           };
         }
         if (state.branch) {
-          (0, child_process_1.spawnSync)("git", ["branch", "-D", state.branch], { cwd: state.mainCheckout, encoding: "utf-8", timeout: 1e4 });
+          (0, proc_1.spawnSync)("git", ["branch", "-D", state.branch], { cwd: state.mainCheckout, encoding: "utf-8", timeout: 1e4 });
         }
         return { ok: true };
       }
@@ -23685,7 +23811,7 @@ var require_hooks = __commonJS({
     var data_1 = require_data();
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     function withAgentHooks(base, agent) {
       if (!agent)
         return base;
@@ -24019,7 +24145,7 @@ ${d.text}
         };
         let child;
         try {
-          child = (0, child_process_1.spawn)(command, {
+          child = (0, proc_1.spawn)(command, {
             shell: true,
             cwd: opts.cwd,
             env: opts.env ?? process.env,
@@ -28722,6 +28848,50 @@ ${s2.prompt}`;
 var require_client2 = __commonJS({
   "../core/dist/mcp/client.js"(exports) {
     "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m2, k);
+      if (!desc || ("get" in desc ? !m2.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m2[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    } : function(o, m2, k, k2) {
+      if (k2 === void 0)
+        k2 = k;
+      o[k2] = m2[k];
+    });
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    } : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2)
+            if (Object.prototype.hasOwnProperty.call(o2, k))
+              ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule)
+          return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i2 = 0; i2 < k.length; i2++)
+            if (k[i2] !== "default")
+              __createBinding(result, mod, k[i2]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    }();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.McpClient = exports.MCP_PROTOCOL_VERSION = exports.MCP_PROTOCOL_VERSIONS = exports.MCP_ELICITATION_CAPABILITY = exports.MAX_RESULT_SIZE_CHARS = void 0;
     exports.toolResultSizeCap = toolResultSizeCap;
@@ -28730,7 +28900,8 @@ var require_client2 = __commonJS({
     exports.elicitationCapability = elicitationCapability;
     exports.normalizeElicitationRequest = normalizeElicitationRequest;
     exports.serverRequestReply = serverRequestReply;
-    var child_process_1 = __require("child_process");
+    var path36 = __importStar(__require("path"));
+    var proc_1 = require_proc();
     exports.MAX_RESULT_SIZE_CHARS = 5e5;
     function toolResultSizeCap(tool) {
       const raw = (tool._meta ?? {})["anthropic/maxResultSizeChars"];
@@ -28843,10 +29014,11 @@ var require_client2 = __commonJS({
         if (!this.config.command)
           throw new Error(`MCP server "${this.name}" has no command (stdio transport requires one).`);
         const env3 = { ...process.env, ...this.config.env ?? {} };
-        this._proc = (0, child_process_1.spawn)(this.config.command, this.config.args ?? [], {
+        const needsShell = process.platform === "win32" && /^(npx|npm|pnpm|yarn|bunx)(\.cmd)?$/i.test(path36.basename(this.config.command));
+        this._proc = (0, proc_1.spawn)(this.config.command, this.config.args ?? [], {
           env: env3,
           stdio: ["pipe", "pipe", "pipe"],
-          shell: false
+          shell: needsShell
         });
         this._proc.stdout.on("data", (chunk) => {
           this._buf += chunk.toString("utf-8");
@@ -30522,7 +30694,7 @@ var require_manager2 = __commonJS({
     var os25 = __importStar(__require("os"));
     var path36 = __importStar(__require("path"));
     var crypto6 = __importStar(__require("crypto"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var MAX_SNAPSHOT_BYTES = 2 * 1024 * 1024;
     var MAX_PERSISTED_TURNS = 50;
     var MUTATING_TOOLS = /* @__PURE__ */ new Set([
@@ -30663,7 +30835,7 @@ var require_manager2 = __commonJS({
       }
       tryGitStashCreate() {
         try {
-          const r2 = (0, child_process_1.spawnSync)("git", ["stash", "create", "nexrall-checkpoint"], {
+          const r2 = (0, proc_1.spawnSync)("git", ["stash", "create", "nexrall-checkpoint"], {
             cwd: this.workDir,
             encoding: "utf-8",
             timeout: 1e4
@@ -31524,7 +31696,7 @@ var require_installer = __commonJS({
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
     var os25 = __importStar(__require("os"));
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var client_1 = require_client();
     var index_1 = require_plugins();
     var data_1 = require_data();
@@ -31882,7 +32054,7 @@ var require_installer = __commonJS({
     }
     function extractTarball(tarFile, destDir) {
       fs33.mkdirSync(destDir, { recursive: true });
-      (0, child_process_1.execFileSync)("tar", ["-xzf", tarFile, "-C", destDir], { stdio: "pipe" });
+      (0, proc_1.execFileSync)("tar", ["-xzf", tarFile, "-C", destDir], { stdio: "pipe" });
       const entries = fs33.readdirSync(destDir).filter((e2) => {
         try {
           return fs33.statSync(path36.join(destDir, e2)).isDirectory();
@@ -32939,7 +33111,7 @@ var require_monitor = __commonJS({
     exports.stopMonitor = stopMonitor;
     exports.stopAllMonitors = stopAllMonitors;
     exports.executeMonitorTool = executeMonitorTool2;
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     exports.MONITOR_TOOL_NAME = "monitor";
     exports.DEFAULT_TIMEOUT_MS = 5 * 6e4;
     exports.MAX_TIMEOUT_MS = 30 * 6e4;
@@ -32967,10 +33139,8 @@ var require_monitor = __commonJS({
     }
     function killTree(m2) {
       try {
-        if (m2.child.pid)
-          process.kill(-m2.child.pid, "SIGTERM");
-        else
-          m2.child.kill("SIGTERM");
+        (0, proc_1.killProcessTree)(m2.child.pid, "SIGTERM");
+        m2.child.kill("SIGTERM");
       } catch {
       }
       if (m2.killTimer)
@@ -32978,8 +33148,7 @@ var require_monitor = __commonJS({
       m2.killTimer = setTimeout(() => {
         m2.killTimer = null;
         try {
-          if (m2.child.pid)
-            process.kill(-m2.child.pid, "SIGKILL");
+          (0, proc_1.killProcessTree)(m2.child.pid, "SIGKILL");
         } catch {
         }
       }, m2.timing.killGraceMs);
@@ -33100,7 +33269,7 @@ var require_monitor = __commonJS({
       const now = opts.now ?? Date.now;
       const id = `mon${++_seq}`;
       const label = opts.label && String(opts.label).trim().slice(0, 60) || command.slice(0, 60);
-      const spawnFn = opts.spawnFn ?? child_process_1.spawn;
+      const spawnFn = opts.spawnFn ?? proc_1.spawn;
       let child;
       try {
         child = spawnFn(command, {
@@ -33110,7 +33279,7 @@ var require_monitor = __commonJS({
           // Own process group so the deadline kill reaches `sh -c "tail -f | grep"`
           // trees; stdin closed so a watcher that reads blocks on nothing and gets
           // EOF instead of hanging the watch until its deadline.
-          detached: true,
+          detached: proc_1.DETACH_GROUP,
           stdio: ["ignore", "pipe", "pipe"]
         });
       } catch (e2) {
@@ -33206,8 +33375,7 @@ var require_monitor = __commonJS({
         if (silent) {
           const m2 = _monitors.get(id);
           try {
-            if (m2.child.pid)
-              process.kill(-m2.child.pid, "SIGKILL");
+            (0, proc_1.killProcessTree)(m2.child.pid, "SIGKILL");
           } catch {
           }
           finalize(m2);
@@ -33964,12 +34132,12 @@ var require_collect = __commonJS({
     exports.gitDiffRaw = gitDiffRaw2;
     exports.collectChangedFiles = collectChangedFiles2;
     exports.gitBranch = gitBranch2;
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var fs33 = __importStar(__require("fs"));
     var path36 = __importStar(__require("path"));
     var diffView_1 = require_diffView();
     function gitDiffRaw2(cwd2) {
-      const run = (args) => (0, child_process_1.execFileSync)("git", args, {
+      const run = (args) => (0, proc_1.execFileSync)("git", args, {
         cwd: cwd2,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -47693,7 +47861,7 @@ var require_mergeAssistant = __commonJS({
     exports.parseMergeTree = parseMergeTree2;
     exports.checkBranchMerges = checkBranchMerges2;
     exports.formatMergePanel = formatMergePanel2;
-    var child_process_1 = __require("child_process");
+    var proc_1 = require_proc();
     var globalSearch_1 = require_globalSearch();
     var collect_1 = require_collect();
     exports.MAX_NODE_FILES = 40;
@@ -47709,7 +47877,7 @@ var require_mergeAssistant = __commonJS({
     }
     var gitRunnerForMerge2 = (cwd2, args) => {
       try {
-        const stdout = (0, child_process_1.execFileSync)("git", args, {
+        const stdout = (0, proc_1.execFileSync)("git", args, {
           cwd: cwd2,
           encoding: "utf-8",
           stdio: ["ignore", "pipe", "pipe"],
@@ -78310,7 +78478,7 @@ import * as fs32 from "fs";
 import { createRequire as createRequire2 } from "module";
 
 // src/commands/auth.ts
-var import_code_core = __toESM(require_dist2(), 1);
+var import_code_core2 = __toESM(require_dist2(), 1);
 import * as readline from "readline";
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
@@ -79626,7 +79794,452 @@ function formatUsage(outputTokens) {
   return paint.dim(`\u2193 ${tok} tokens`);
 }
 
+// src/mcp/oauth.ts
+var import_proc = __toESM(require_proc(), 1);
+var import_code_core = __toESM(require_dist2(), 1);
+import * as fs2 from "fs";
+import * as os2 from "os";
+import * as path from "path";
+import * as http3 from "http";
+import * as crypto from "crypto";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function tokensFile(env3 = process.env) {
+  return env3.NEXRALL_MCP_AUTH_FILE || path.join(os2.homedir(), ".nexrall", "mcp-auth.json");
+}
+function readStore(file) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(file, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      const b = v;
+      if (b && typeof b.access_token === "string" && typeof b.token_endpoint === "string")
+        out[k] = b;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeStore(file, store) {
+  fs2.mkdirSync(path.dirname(file), { recursive: true });
+  fs2.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 384 });
+  try {
+    fs2.chmodSync(file, 384);
+  } catch {
+  }
+}
+function loadToken(server, file = tokensFile()) {
+  return readStore(file)[server] ?? null;
+}
+function saveToken(server, bundle, file = tokensFile()) {
+  const store = readStore(file);
+  store[server] = bundle;
+  writeStore(file, store);
+}
+function clearToken(server, file = tokensFile()) {
+  const store = readStore(file);
+  if (!(server in store))
+    return false;
+  delete store[server];
+  writeStore(file, store);
+  return true;
+}
+function defaultFetch() {
+  const f3 = globalThis.fetch;
+  if (typeof f3 !== "function")
+    throw new Error("global fetch unavailable \u2014 Node 18+ is required for MCP OAuth");
+  return f3;
+}
+async function getValidAccessToken(server, opts = {}) {
+  const file = opts.file ?? tokensFile();
+  const bundle = loadToken(server, file);
+  if (!bundle)
+    return null;
+  const fresh = !bundle.expires_at || bundle.expires_at - Date.now() > 6e4;
+  if (fresh || !bundle.refresh_token)
+    return bundle.access_token;
+  try {
+    const refreshed = await refreshAccessToken(bundle, opts.fetchImpl ?? defaultFetch());
+    saveToken(server, refreshed, file);
+    return refreshed.access_token;
+  } catch {
+    return bundle.access_token;
+  }
+}
+function parseResourceMetadataUrl(wwwAuthenticate) {
+  const m2 = /resource_metadata\s*=\s*"([^"]+)"/i.exec(wwwAuthenticate || "");
+  return m2 ? m2[1] : null;
+}
+function protectedResourceCandidates(serverUrl) {
+  const u = new URL(serverUrl);
+  const base = u.origin;
+  const p = u.pathname.replace(/\/$/, "");
+  return [
+    ...p ? [`${base}/.well-known/oauth-protected-resource${p}`] : [],
+    `${base}/.well-known/oauth-protected-resource`
+  ];
+}
+function authServerCandidates(authServer) {
+  const u = new URL(authServer);
+  const base = u.origin;
+  const p = u.pathname.replace(/\/$/, "");
+  const root = authServer.replace(/\/$/, "");
+  return [
+    `${base}/.well-known/oauth-authorization-server${p}`,
+    `${base}/.well-known/openid-configuration${p}`,
+    `${root}/.well-known/oauth-authorization-server`,
+    `${root}/.well-known/openid-configuration`
+  ];
+}
+function buildAuthorizeUrl(meta, p) {
+  const url = new URL(meta.authorization_endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", p.clientId);
+  url.searchParams.set("redirect_uri", p.redirectUri);
+  url.searchParams.set("state", p.state);
+  url.searchParams.set("code_challenge", p.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("resource", meta.resource);
+  if (meta.scope)
+    url.searchParams.set("scope", meta.scope);
+  return url.toString();
+}
+function toBundle(data, p) {
+  const accessToken = data.access_token;
+  if (!accessToken)
+    throw new Error("Token response had no access_token");
+  const expiresIn = typeof data.expires_in === "number" ? data.expires_in : void 0;
+  return {
+    access_token: accessToken,
+    refresh_token: data.refresh_token ?? p.prevRefresh,
+    expires_at: expiresIn ? Date.now() + expiresIn * 1e3 : void 0,
+    token_endpoint: p.tokenEndpoint,
+    client_id: p.clientId,
+    client_secret: p.clientSecret,
+    resource: p.resource,
+    scope: data.scope ?? p.scope
+  };
+}
+async function fetchJsonSafe(f3, url) {
+  try {
+    const resp = await f3(url, { headers: { Accept: "application/json" } });
+    if (!resp.ok)
+      return null;
+    return await resp.json();
+  } catch {
+    return null;
+  }
+}
+async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
+  const origin = new URL(serverUrl).origin;
+  let authServer = null;
+  let resource = serverUrl;
+  let scope;
+  const prmCandidates = [parseResourceMetadataUrl(wwwAuthenticate), ...protectedResourceCandidates(serverUrl)].filter(
+    (u) => Boolean(u)
+  );
+  let prm = null;
+  for (const url of new Set(prmCandidates)) {
+    prm = await fetchJsonSafe(f3, url);
+    if (prm)
+      break;
+  }
+  if (prm) {
+    const servers = prm.authorization_servers;
+    if (Array.isArray(servers) && servers.length)
+      authServer = servers[0];
+    if (typeof prm.resource === "string")
+      resource = prm.resource;
+    const scopes = prm.scopes_supported;
+    if (Array.isArray(scopes) && scopes.length)
+      scope = scopes.join(" ");
+  }
+  if (!authServer)
+    authServer = origin;
+  let asm = null;
+  for (const url of authServerCandidates(authServer)) {
+    asm = await fetchJsonSafe(f3, url);
+    if (asm && asm.authorization_endpoint && asm.token_endpoint)
+      break;
+    asm = null;
+  }
+  if (!asm)
+    throw new Error(`No OAuth metadata found for authorization server ${authServer}`);
+  return {
+    authorization_endpoint: asm.authorization_endpoint,
+    token_endpoint: asm.token_endpoint,
+    registration_endpoint: asm.registration_endpoint,
+    resource,
+    scope
+  };
+}
+async function registerClient(meta, redirectUri, f3) {
+  if (!meta.registration_endpoint) {
+    throw new Error(
+      'Authorization server does not support dynamic client registration; a client_id must be configured manually \u2014 create an OAuth client for this server, then re-run `nex mcp login <server> --client-id <id> [--client-secret <secret>]` (or set "clientId" / "clientSecret" in its mcp.json entry).'
+    );
+  }
+  const resp = await f3(meta.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "Nexrall Code CLI",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: meta.scope
+    })
+  });
+  if (!resp.ok)
+    throw new Error(`Client registration failed (HTTP ${resp.status})`);
+  const data = await resp.json();
+  if (!data.client_id)
+    throw new Error("Client registration returned no client_id");
+  return data.client_id;
+}
+async function postToken(tokenEndpoint, body, f3) {
+  const resp = await f3(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: body.toString()
+  });
+  if (!resp.ok) {
+    const txt = await resp.text().catch(() => "");
+    throw new Error(`Token endpoint error (HTTP ${resp.status})${txt ? `: ${txt.slice(0, 200)}` : ""}`);
+  }
+  return await resp.json();
+}
+async function exchangeCode(meta, clientId, clientSecret, code, verifier, redirectUri, f3) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: clientId,
+    code_verifier: verifier,
+    resource: meta.resource
+  });
+  if (clientSecret)
+    body.set("client_secret", clientSecret);
+  const data = await postToken(meta.token_endpoint, body, f3);
+  return toBundle(data, {
+    tokenEndpoint: meta.token_endpoint,
+    clientId,
+    clientSecret,
+    resource: meta.resource,
+    scope: meta.scope
+  });
+}
+async function refreshAccessToken(bundle, f3) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: bundle.refresh_token,
+    client_id: bundle.client_id,
+    resource: bundle.resource
+  });
+  if (bundle.client_secret)
+    body.set("client_secret", bundle.client_secret);
+  const data = await postToken(bundle.token_endpoint, body, f3);
+  return toBundle(data, {
+    tokenEndpoint: bundle.token_endpoint,
+    clientId: bundle.client_id,
+    clientSecret: bundle.client_secret,
+    resource: bundle.resource,
+    scope: bundle.scope,
+    prevRefresh: bundle.refresh_token
+  });
+}
+function startLoopback() {
+  return new Promise((resolve19, reject) => {
+    let resolveCode;
+    let rejectCode;
+    const codePromise = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    codePromise.catch(() => void 0);
+    const server = http3.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+      res.end(
+        `<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:40px"><h2>${error || !code ? "Authentication failed" : "Authentication complete"}</h2><p>You can close this tab and return to the terminal.</p></body></html>`
+      );
+      if (error) {
+        rejectCode(new Error(`Authorization denied: ${error}`));
+        return;
+      }
+      if (!code) {
+        rejectCode(new Error("No authorization code in redirect"));
+        return;
+      }
+      resolveCode({ code, state });
+    });
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve19({
+        port,
+        waitForCode(expectedState) {
+          const timeout = setTimeout(
+            () => rejectCode(new Error("Timed out waiting for authorization")),
+            CALLBACK_TIMEOUT_MS
+          );
+          return codePromise.then(
+            ({ code, state }) => {
+              clearTimeout(timeout);
+              if (state !== expectedState)
+                throw new Error("OAuth state mismatch \u2014 possible CSRF, aborting");
+              return code;
+            },
+            // A denial must clear the timer too: otherwise `nex mcp login` reports the
+            // failure but the process sits on a 5-minute keep-alive before exiting.
+            (err) => {
+              clearTimeout(timeout);
+              throw err;
+            }
+          );
+        },
+        close() {
+          try {
+            server.closeAllConnections?.();
+          } catch {
+          }
+          try {
+            server.close();
+          } catch {
+          }
+        }
+      });
+    });
+  });
+}
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function openInBrowser(url) {
+  const win = process.platform === "win32";
+  const cmd = process.platform === "darwin" ? "open" : win ? "rundll32" : "xdg-open";
+  const args = win ? ["url.dll,FileProtocolHandler", url] : [url];
+  try {
+    const child = (0, import_proc.spawn)(cmd, args, { stdio: "ignore", detached: !win });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+async function probeAuthChallenge(serverUrl, f3 = defaultFetch()) {
+  const steps = [
+    {
+      method: "initialize",
+      params: {
+        protocolVersion: import_code_core.MCP_PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "nexrall-code", version: "1.0" }
+      }
+    },
+    { method: "tools/list", params: {} }
+  ];
+  for (const { method, params } of steps) {
+    try {
+      const resp = await f3(serverUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      });
+      const challenge = resp.headers?.get("www-authenticate") ?? "";
+      if (challenge)
+        return challenge;
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+async function authorizeServer(o) {
+  const f3 = o.fetchImpl ?? defaultFetch();
+  const challenge = o.wwwAuthenticate ?? await probeAuthChallenge(o.serverUrl, f3);
+  const meta = await discover(o.serverUrl, challenge, f3);
+  const scope = [meta.scope, (0, import_code_core.parseOAuthChallenge)(challenge).scope, o.extraScope].map((s2) => s2?.trim()).filter((s2) => Boolean(s2)).join(" ").split(/\s+/).filter((s2, i2, a) => Boolean(s2) && a.indexOf(s2) === i2).join(" ");
+  meta.scope = scope || void 0;
+  const loopback = await startLoopback();
+  const redirectUri = `http://127.0.0.1:${loopback.port}/callback`;
+  try {
+    const creds = o.credentials ?? {};
+    let clientId;
+    if (creds.clientId) {
+      clientId = creds.clientId;
+      o.onStep?.("Using the OAuth client configured for this server\u2026");
+    } else {
+      o.onStep?.(`Registering with ${new URL(meta.token_endpoint).origin}\u2026`);
+      clientId = await registerClient(meta, redirectUri, f3);
+    }
+    const verifier = b64url(crypto.randomBytes(32));
+    const challengeB64 = b64url(crypto.createHash("sha256").update(verifier).digest());
+    const state = b64url(crypto.randomBytes(16));
+    const authUrl = buildAuthorizeUrl(meta, { clientId, redirectUri, codeChallenge: challengeB64, state });
+    o.onStep?.("Opening your browser to authorize\u2026");
+    await o.openUrl(authUrl);
+    const code = await loopback.waitForCode(state);
+    const bundle = await exchangeCode(meta, clientId, creds.clientSecret, code, verifier, redirectUri, f3);
+    saveToken(o.server, bundle, o.file ?? tokensFile());
+  } finally {
+    loopback.close();
+  }
+}
+var isRemote = (cfg) => cfg.type === "http" || cfg.type === "sse" || !cfg.command && !!cfg.url;
+async function injectMcpTokens(config, opts = {}) {
+  const file = opts.file ?? tokensFile();
+  const injected = [];
+  for (const [name, cfg] of Object.entries(config.mcpServers ?? {})) {
+    if (!isRemote(cfg))
+      continue;
+    const hasAuth = cfg.headers && Object.keys(cfg.headers).some((h2) => h2.toLowerCase() === "authorization");
+    if (hasAuth)
+      continue;
+    let token;
+    try {
+      token = await getValidAccessToken(name, { file, fetchImpl: opts.fetchImpl });
+    } catch {
+      token = null;
+    }
+    if (!token)
+      continue;
+    cfg.headers = { ...cfg.headers ?? {}, Authorization: `Bearer ${token}` };
+    injected.push(name);
+  }
+  return injected;
+}
+
 // src/commands/auth.ts
+var AUTH_APP_URL = "https://app.nexrall.com";
+function browserAuthUrl() {
+  return `${AUTH_APP_URL}/auth/vscode?cli=1`;
+}
+function normalizeAuthCode(raw) {
+  const cleaned = raw.trim().replace(/^[`'"“”‘’]+|[`'"“”‘’]+$/g, "").trim();
+  const fromUrl = /[?&]code=([^&\s]+)/.exec(cleaned);
+  return fromUrl ? decodeURIComponent(fromUrl[1]) : cleaned.replace(/\s+/g, "");
+}
+function parseAuthMethod(input) {
+  const v = input.trim().toLowerCase();
+  if (v === "" || v === "1" || v === "b" || v === "browser")
+    return "browser";
+  if (v === "2" || v === "p" || v === "e" || v === "email" || v === "password")
+    return "password";
+  if (v === "3" || v === "t" || v === "token")
+    return "token";
+  return null;
+}
 function prompt(question, hidden = false) {
   return new Promise((resolve19) => {
     const rl = readline.createInterface({
@@ -79653,13 +80266,14 @@ function prompt(question, hidden = false) {
             process.exit(0);
           }
           resolve19(value);
-        } else if (char === "\x7F" || char === "\b") {
-          if (value.length > 0) {
+          return;
+        }
+        if (char === "\x7F" || char === "\b") {
+          if (value.length > 0)
             value = value.slice(0, -1);
-          }
-        } else {
-          value += char;
+          return;
         }
+        value += char;
       };
       stdin.on("data", onData);
     } else {
@@ -79670,12 +80284,12 @@ function prompt(question, hidden = false) {
     }
   });
 }
-async function authCommand() {
+async function authCommand(opts = {}) {
   console.log();
   console.log(paint.boldBlue("  Nexrall Code \u2014 Login"));
   console.log(paint.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
-  if ((0, import_code_core.isAuthenticated)()) {
+  if ((0, import_code_core2.isAuthenticated)() && !opts.token && !opts.code) {
     const overwrite = await prompt(paint.yellow("  Already logged in. Login again? ") + paint.dim("[y/n] > "));
     if (overwrite !== "y" && overwrite !== "yes") {
       console.log(paint.dim("  Cancelled."));
@@ -79683,21 +80297,90 @@ async function authCommand() {
     }
     console.log();
   }
+  if (opts.token)
+    return loginWithToken(opts.token);
+  if (opts.browser || opts.code)
+    return loginWithBrowser(opts.code);
+  if (opts.password)
+    return loginWithPassword();
+  if (!process.stdin.isTTY)
+    return loginWithPassword();
+  const method = await chooseMethod();
+  if (method === null) {
+    console.log(paint.dim("  Cancelled."));
+    return;
+  }
+  if (method === "browser")
+    return loginWithBrowser();
+  if (method === "token")
+    return loginWithTokenPrompt();
+  return loginWithPassword();
+}
+async function chooseMethod() {
+  console.log("  How do you want to sign in?");
+  console.log();
+  console.log(
+    `    ${paint.bold("1.")} Browser          ${paint.dim("Google, Apple, SSO or email + password \u2014 recommended")}`
+  );
+  console.log(`    ${paint.bold("2.")} Email + password ${paint.dim("typed here in the terminal")}`);
+  console.log(`    ${paint.bold("3.")} Token            ${paint.dim("CI / headless \u2014 paste a token")}`);
+  console.log();
+  for (; ; ) {
+    const answer = await prompt(paint.bold("  Choose ") + paint.dim("[1] > "));
+    const method = parseAuthMethod(answer);
+    if (method)
+      return method;
+    console.log(paint.yellow("  Pick 1, 2 or 3."));
+  }
+}
+async function loginWithBrowser(codeArg) {
+  let code = codeArg ? normalizeAuthCode(codeArg) : "";
+  if (!code) {
+    const url = browserAuthUrl();
+    openInBrowser(url);
+    console.log(paint.dim("  Opened: ") + paint.cyan(url));
+    console.log();
+    console.log("  Sign in there \u2014 Google, Apple, SSO or your password all work.");
+    console.log(paint.dim("  Copy the code the page shows, then paste it here."));
+    console.log();
+    code = normalizeAuthCode(await prompt(paint.bold("  Code ") + paint.dim("> ")));
+  }
+  if (!code) {
+    console.log(paint.red("  \u2717 No code entered."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  console.log();
+  const spinner = startSpinner("Signing in\u2026");
+  try {
+    const authConfig = await (0, import_code_core2.exchangeAuthCode)(code);
+    (0, import_code_core2.saveAuth)(authConfig);
+    stopSpinner(spinner);
+    console.log(paint.green("  \u2713 Logged in as ") + paint.bold(authConfig.email || "your account"));
+    await showBalance();
+    console.log();
+    console.log(paint.dim("  Run ") + paint.bold("nex") + paint.dim(" to start coding."));
+    console.log();
+  } catch (err) {
+    stopSpinner(spinner);
+    console.log();
+    console.log(paint.red("  \u2717 Login failed: ") + String(err.message));
+    console.log();
+    process.exitCode = 1;
+  }
+}
+async function loginWithPassword() {
   const email = await prompt(paint.bold("  Email    ") + paint.dim("> "));
   const password = await prompt(paint.bold("  Password ") + paint.dim("> "), true);
   console.log();
   const spinner = startSpinner("Logging in\u2026");
   try {
-    const authConfig = await (0, import_code_core.login)(email, password);
-    (0, import_code_core.saveAuth)(authConfig);
+    const authConfig = await (0, import_code_core2.login)(email, password);
+    (0, import_code_core2.saveAuth)(authConfig);
     stopSpinner(spinner);
     console.log(paint.green("  \u2713 Logged in as ") + paint.bold(authConfig.email ?? email));
-    console.log();
-    try {
-      const balance = await (0, import_code_core.getBalance)();
-      console.log(paint.dim("  Wallet balance: ") + paint.cyan(`$${balance.toFixed(4)}`));
-    } catch {
-    }
+    await showBalance();
     console.log();
     console.log(paint.dim("  Run ") + paint.bold("nex") + paint.dim(" to start coding."));
     console.log();
@@ -79706,12 +80389,71 @@ async function authCommand() {
     console.log();
     console.log(paint.red("  \u2717 Login failed: ") + String(err.message));
     console.log();
-    process.exit(1);
+    process.exitCode = 1;
+  }
+}
+async function loginWithTokenPrompt() {
+  console.log(paint.dim("  Paste a token from the Nexrall dashboard."));
+  const token = await prompt(paint.bold("  Token    ") + paint.dim("> "), true);
+  if (!token) {
+    console.log(paint.red("  \u2717 No token entered."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  await loginWithToken(token);
+}
+async function loginWithToken(rawToken) {
+  const token = rawToken.trim();
+  if (!token) {
+    console.log(paint.red("  \u2717 Empty token."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  console.log();
+  const spinner = startSpinner("Checking the token\u2026");
+  const check2 = await (0, import_code_core2.checkToken)(token);
+  if (!check2.ok && check2.status !== 0) {
+    stopSpinner(spinner);
+    console.log();
+    console.log(paint.red(`  \u2717 The API refused this token (HTTP ${check2.status}).`) + paint.dim(" Nothing was saved."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  (0, import_code_core2.saveAuth)({ token, ...check2.email ? { email: check2.email } : {} });
+  stopSpinner(spinner);
+  console.log(paint.green("  \u2713 Token saved") + (check2.email ? paint.dim(` for ${check2.email}`) : ""));
+  if (check2.status === 0) {
+    console.log(paint.yellow("    Could not reach the API to verify it \u2014 check the token once you are online."));
+  }
+  warnIfEnvTokenWins();
+  await showBalance();
+  console.log();
+}
+function warnIfEnvTokenWins() {
+  const envToken = process.env.NEXRALL_TOKEN?.trim();
+  if (!envToken)
+    return;
+  console.log(
+    paint.yellow("    NEXRALL_TOKEN is set in this shell and takes precedence over the saved login.") + paint.dim(" Unset it to use what you just saved.")
+  );
+}
+async function showBalance() {
+  try {
+    const balance = await (0, import_code_core2.getBalance)();
+    console.log(paint.dim("  Wallet balance: ") + paint.cyan(`$${balance.toFixed(4)}`));
+  } catch {
   }
 }
+async function signOut() {
+  await (0, import_code_core2.revokeRefreshToken)();
+  (0, import_code_core2.clearAuth)();
+}
 async function logoutCommand() {
   console.log();
-  if (!(0, import_code_core.isAuthenticated)()) {
+  if (!(0, import_code_core2.isAuthenticated)()) {
     console.log(paint.dim("  Not logged in."));
     console.log();
     return;
@@ -79722,9 +80464,13 @@ async function logoutCommand() {
     console.log();
     return;
   }
-  await (0, import_code_core.revokeRefreshToken)();
-  (0, import_code_core.clearAuth)();
+  await signOut();
   console.log(paint.green("  \u2713 Logged out."));
+  if (process.env.NEXRALL_TOKEN?.trim()) {
+    console.log(
+      paint.yellow("    NEXRALL_TOKEN is still set in this shell") + paint.dim(" \u2014 unset it, or the CLI stays signed in with that token.")
+    );
+  }
   console.log();
 }
 function startSpinner(text) {
@@ -79743,12 +80489,12 @@ function stopSpinner(handle2) {
 }
 
 // src/commands/billing.ts
-var import_code_core2 = __toESM(require_dist2(), 1);
+var import_code_core3 = __toESM(require_dist2(), 1);
 function money(usd) {
   return "$" + usd.toFixed(2);
 }
 async function requireAuth() {
-  if ((0, import_code_core2.isAuthenticated)())
+  if ((0, import_code_core3.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   return false;
@@ -79758,7 +80504,7 @@ async function billingStatusCommand() {
     return;
   let orgs;
   try {
-    orgs = await (0, import_code_core2.getOrgs)();
+    orgs = await (0, import_code_core3.getOrgs)();
   } catch {
     console.log(paint.yellow("Could not read your billing target (offline, or a server without team support)."));
     return;
@@ -79790,7 +80536,7 @@ async function billingStatusCommand() {
     console.log("");
     console.log(paint.gray("Change it with `nex billing use <id>` or `nex billing use personal`."));
   }
-  const override = (0, import_code_core2.billingOverrideFields)();
+  const override = (0, import_code_core3.billingOverrideFields)();
   if ("teamId" in override) {
     console.log("");
     console.log(
@@ -79818,7 +80564,7 @@ async function billingUseCommand(target) {
 }
 async function applyTarget(teamId, label) {
   try {
-    await (0, import_code_core2.setBillingTarget)(teamId);
+    await (0, import_code_core3.setBillingTarget)(teamId);
   } catch (e2) {
     console.log(paint.red(e2.message));
     process.exitCode = 1;
@@ -79832,14 +80578,14 @@ async function applyTarget(teamId, label) {
 
 // src/commands/schedule.ts
 var import_prompts = __toESM(require_prompts3(), 1);
-var import_code_core4 = __toESM(require_dist2(), 1);
+var import_code_core5 = __toESM(require_dist2(), 1);
 
 // src/ui/scheduleLines.ts
-var import_code_core3 = __toESM(require_dist2(), 1);
+var import_code_core4 = __toESM(require_dist2(), 1);
 
 // src/commands/schedule.ts
 async function requireAuth2() {
-  if ((0, import_code_core4.isAuthenticated)())
+  if ((0, import_code_core5.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   process.exitCode = 1;
@@ -79860,7 +80606,7 @@ async function scheduleListCommand(opts = {}) {
     return;
   let list;
   try {
-    list = await (0, import_code_core4.listCloudSchedules)();
+    list = await (0, import_code_core5.listCloudSchedules)();
   } catch (e2) {
     fail(errText(e2));
     return;
@@ -79869,7 +80615,7 @@ async function scheduleListCommand(opts = {}) {
     console.log(JSON.stringify(list, null, 2));
     return;
   }
-  for (const line of (0, import_code_core3.scheduleListLines)(list, { cols: cols() }))
+  for (const line of (0, import_code_core4.scheduleListLines)(list, { cols: cols() }))
     console.log(line);
   if (list.length) {
     console.log(paint.dim(`
@@ -79889,7 +80635,7 @@ async function scheduleAddCommand(taskParts, opts) {
     fail("Missing --every. Usage: nex schedule add --every 1d <task>   (e.g. --every 2h)");
     return;
   }
-  const every = (0, import_code_core3.parseScheduleEvery)(everyRaw);
+  const every = (0, import_code_core4.parseScheduleEvery)(everyRaw);
   if ("error" in every) {
     fail(every.error);
     return;
@@ -79897,7 +80643,7 @@ async function scheduleAddCommand(taskParts, opts) {
   const domains = (opts.domains ?? "").split(",").map((d) => d.trim()).filter(Boolean);
   let s2;
   try {
-    s2 = await (0, import_code_core4.createCloudSchedule)({
+    s2 = await (0, import_code_core5.createCloudSchedule)({
       task,
       intervalMinutes: every.minutes,
       startUrl: opts.startUrl,
@@ -79909,12 +80655,12 @@ async function scheduleAddCommand(taskParts, opts) {
     return;
   }
   console.log(
-    `\u2714 Scheduled ${paint.bold(`#${s2.id}`)} \u2014 every ${(0, import_code_core3.formatEvery)(s2.intervalMinutes)}${s2.enabled ? "" : paint.yellow(" (paused)")}`
+    `\u2714 Scheduled ${paint.bold(`#${s2.id}`)} \u2014 every ${(0, import_code_core4.formatEvery)(s2.intervalMinutes)}${s2.enabled ? "" : paint.yellow(" (paused)")}`
   );
   console.log(`  ${s2.task}`);
   if (s2.nextRunAt) {
     console.log(
-      paint.dim(`  Next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)} \u2014 on Nexrall's servers; your laptop can be closed.`)
+      paint.dim(`  Next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)} \u2014 on Nexrall's servers; your laptop can be closed.`)
     );
   }
   console.log(paint.dim(`  History: nex schedule runs ${s2.id}   \xB7   Pause: nex schedule pause ${s2.id}`));
@@ -79927,8 +80673,8 @@ async function scheduleSetEnabled(id, enabled) {
     return;
   }
   try {
-    const s2 = await (0, import_code_core4.updateCloudSchedule)(id, { enabled });
-    const next = s2.nextRunAt ? paint.dim(` \u2014 next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)}`) : "";
+    const s2 = await (0, import_code_core5.updateCloudSchedule)(id, { enabled });
+    const next = s2.nextRunAt ? paint.dim(` \u2014 next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)}`) : "";
     console.log(`\u2714 Schedule #${s2.id} is now ${s2.enabled ? "on" : "paused"}${next}`);
   } catch (e2) {
     fail(errText(e2));
@@ -79949,7 +80695,7 @@ async function scheduleRunCommand(id) {
     return;
   }
   try {
-    const s2 = await (0, import_code_core4.runCloudScheduleNow)(clean);
+    const s2 = await (0, import_code_core5.runCloudScheduleNow)(clean);
     console.log(`\u2714 Schedule #${s2.id} armed \u2014 the cloud runner picks it up within ~60s.`);
     console.log(paint.dim(`  Result: nex schedule runs ${s2.id}`));
   } catch (e2) {
@@ -79983,7 +80729,7 @@ async function scheduleRemoveCommand(id, opts = {}) {
     }
   }
   try {
-    await (0, import_code_core4.deleteCloudSchedule)(clean);
+    await (0, import_code_core5.deleteCloudSchedule)(clean);
     console.log(`\u2714 Removed schedule #${clean}`);
   } catch (e2) {
     fail(errText(e2));
@@ -79999,7 +80745,7 @@ async function scheduleRunsCommand(id, opts = {}) {
   }
   let runs2;
   try {
-    runs2 = await (0, import_code_core4.getCloudScheduleRuns)(clean);
+    runs2 = await (0, import_code_core5.getCloudScheduleRuns)(clean);
   } catch (e2) {
     fail(errText(e2));
     return;
@@ -80008,7 +80754,7 @@ async function scheduleRunsCommand(id, opts = {}) {
     console.log(JSON.stringify(runs2, null, 2));
     return;
   }
-  for (const line of (0, import_code_core3.scheduleRunsLines)(runs2, { cols: cols() }))
+  for (const line of (0, import_code_core4.scheduleRunsLines)(runs2, { cols: cols() }))
     console.log(line);
   if (runs2.length) {
     console.log(
@@ -80021,10 +80767,10 @@ async function scheduleRunsCommand(id, opts = {}) {
 }
 
 // src/commands/cloud.ts
-var import_code_core5 = __toESM(require_dist2(), 1);
-import { spawn } from "child_process";
+var import_proc2 = __toESM(require_proc(), 1);
+var import_code_core6 = __toESM(require_dist2(), 1);
 async function requireAuth3() {
-  if ((0, import_code_core5.isAuthenticated)())
+  if ((0, import_code_core6.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   process.exitCode = 1;
@@ -80058,10 +80804,11 @@ var writeRaw = (s2) => {
   process.stdout.write(s2);
 };
 function openUrl(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const win = process.platform === "win32";
+  const cmd = process.platform === "darwin" ? "open" : win ? "rundll32" : "xdg-open";
+  const args = win ? ["url.dll,FileProtocolHandler", url] : [url];
   try {
-    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    const child = (0, import_proc2.spawn)(cmd, args, { stdio: "ignore", detached: !win });
     child.on("error", () => {
     });
     child.unref();
@@ -80093,7 +80840,7 @@ async function cloudRunCommand(taskParts, opts) {
   }
   let created;
   try {
-    created = await (0, import_code_core5.createCloudSession)({ repo: opts.repo, task, baseBranch: opts.base, pat: pat || void 0 });
+    created = await (0, import_code_core6.createCloudSession)({ repo: opts.repo, task, baseBranch: opts.base, pat: pat || void 0 });
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80112,7 +80859,7 @@ async function cloudListCommand(opts = {}) {
     return;
   let list;
   try {
-    list = await (0, import_code_core5.listCloudSessions)();
+    list = await (0, import_code_core6.listCloudSessions)();
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80120,7 +80867,7 @@ async function cloudListCommand(opts = {}) {
     console.log(JSON.stringify({ sessions: list }, null, 2));
     return;
   }
-  for (const line of (0, import_code_core5.cloudListLines)(list, { cols: cols2() }))
+  for (const line of (0, import_code_core6.cloudListLines)(list, { cols: cols2() }))
     console.log(`  ${line}`);
 }
 async function cloudLogsCommand(id, opts) {
@@ -80133,7 +80880,7 @@ async function cloudLogsCommand(id, opts) {
   if (!opts.follow) {
     let r2;
     try {
-      r2 = await (0, import_code_core5.getCloudSessionLogs)(id, tail ?? 300);
+      r2 = await (0, import_code_core6.getCloudSessionLogs)(id, tail ?? 300);
     } catch (e2) {
       return fail2(errText2(e2));
     }
@@ -80159,7 +80906,7 @@ async function cloudLogsCommand(id, opts) {
   for (; ; ) {
     let r2;
     try {
-      r2 = await (0, import_code_core5.getCloudSessionLogs)(id, tail ?? 1e3);
+      r2 = await (0, import_code_core6.getCloudSessionLogs)(id, tail ?? 1e3);
       consecutiveErrors = 0;
     } catch (e2) {
       const msg = errText2(e2);
@@ -80208,7 +80955,7 @@ async function cloudStopCommand(id) {
     return;
   let s2;
   try {
-    s2 = await (0, import_code_core5.stopCloudSession)(id);
+    s2 = await (0, import_code_core6.stopCloudSession)(id);
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80223,7 +80970,7 @@ async function cloudWatchCommand(id, opts = {}) {
     return;
   let s2;
   try {
-    s2 = await (0, import_code_core5.getCloudSession)(id);
+    s2 = await (0, import_code_core6.getCloudSession)(id);
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80393,11 +81140,11 @@ async function channelPushCommand(textParts, opts, deps = {}) {
 }
 
 // src/commands/usageCmd.ts
-import fs2 from "node:fs";
-import path from "node:path";
+import fs3 from "node:fs";
+import path2 from "node:path";
 
 // src/sessionEvents.ts
-var import_code_core6 = __toESM(require_dist2(), 1);
+var import_code_core7 = __toESM(require_dist2(), 1);
 
 // src/usageExport.ts
 var DURATION_RE = /^(\d+)([mhdw])$/;
@@ -80694,7 +81441,7 @@ var USAGE_FORMATS = ["json", "jsonl", "csv"];
 function logFileIds(dir) {
   let names;
   try {
-    names = fs2.readdirSync(dir);
+    names = fs3.readdirSync(dir);
   } catch {
     return [];
   }
@@ -80704,7 +81451,7 @@ function readRows(file) {
   const rows = [];
   let text;
   try {
-    text = fs2.readFileSync(file, "utf8");
+    text = fs3.readFileSync(file, "utf8");
   } catch {
     return rows;
   }
@@ -80752,13 +81499,13 @@ function usageExportCommand(opts, deps = {}) {
     }
     limit = n;
   }
-  const dir = deps.eventsDirPath ?? (0, import_code_core6.eventsDir)(deps.env ?? process.env);
+  const dir = deps.eventsDirPath ?? (0, import_code_core7.eventsDir)(deps.env ?? process.env);
   const ids = logFileIds(dir);
   const acc = createAccumulator({ since, until });
   acc.filesTotal = ids.length;
   let candidates = ids;
   if (opts.session) {
-    const wanted = (0, import_code_core6.safeId)(opts.session);
+    const wanted = (0, import_code_core7.safeId)(opts.session);
     if (!candidates.includes(wanted)) {
       stderr(paint.red(`Session not found: ${opts.session}`));
       stderr(paint.dim(`  Logs live in ${dir} (one .jsonl per session).`));
@@ -80769,7 +81516,7 @@ function usageExportCommand(opts, deps = {}) {
   if (since !== void 0) {
     candidates = candidates.filter((id) => {
       try {
-        return fs2.statSync(path.join(dir, `${id}.jsonl`)).mtimeMs >= since;
+        return fs3.statSync(path2.join(dir, `${id}.jsonl`)).mtimeMs >= since;
       } catch {
         return false;
       }
@@ -80777,7 +81524,7 @@ function usageExportCommand(opts, deps = {}) {
   }
   const byNewest = candidates.map((id) => {
     try {
-      return { id, mtime: fs2.statSync(path.join(dir, `${id}.jsonl`)).mtimeMs };
+      return { id, mtime: fs3.statSync(path2.join(dir, `${id}.jsonl`)).mtimeMs };
     } catch {
       return { id, mtime: 0 };
     }
@@ -80786,7 +81533,7 @@ function usageExportCommand(opts, deps = {}) {
   acc.truncated = taken.length < byNewest.length;
   for (const { id } of taken) {
     acc.filesRead += 1;
-    addSessionFile(acc, id, readRows(path.join(dir, `${id}.jsonl`)));
+    addSessionFile(acc, id, readRows(path2.join(dir, `${id}.jsonl`)));
   }
   const report = finalizeUsage(acc, now);
   let content;
@@ -80798,7 +81545,7 @@ function usageExportCommand(opts, deps = {}) {
     content = formatUsageJson(report);
   if (opts.out) {
     try {
-      fs2.writeFileSync(opts.out, content);
+      fs3.writeFileSync(opts.out, content);
     } catch (e2) {
       stderr(paint.red(`Could not write ${opts.out}: ${e2.message}`));
       return USAGE_EXIT.FAIL;
@@ -80832,7 +81579,7 @@ import * as path27 from "path";
 import * as fs26 from "fs";
 
 // src/ui/diffView.ts
-var import_code_core7 = __toESM(require_dist2(), 1);
+var import_code_core8 = __toESM(require_dist2(), 1);
 function paintLine(l) {
   switch (l.kind) {
     case "file":
@@ -80853,431 +81600,7 @@ function paintLine(l) {
 }
 
 // src/ui/reviewQueue.ts
-var import_code_core8 = __toESM(require_dist2(), 1);
-
-// src/mcp/oauth.ts
 var import_code_core9 = __toESM(require_dist2(), 1);
-import * as fs3 from "fs";
-import * as os2 from "os";
-import * as path2 from "path";
-import * as http3 from "http";
-import * as crypto from "crypto";
-import { spawn as spawn2 } from "child_process";
-var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
-function tokensFile(env3 = process.env) {
-  return env3.NEXRALL_MCP_AUTH_FILE || path2.join(os2.homedir(), ".nexrall", "mcp-auth.json");
-}
-function readStore(file) {
-  try {
-    const parsed = JSON.parse(fs3.readFileSync(file, "utf-8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return {};
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      const b = v;
-      if (b && typeof b.access_token === "string" && typeof b.token_endpoint === "string")
-        out[k] = b;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-function writeStore(file, store) {
-  fs3.mkdirSync(path2.dirname(file), { recursive: true });
-  fs3.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 384 });
-  try {
-    fs3.chmodSync(file, 384);
-  } catch {
-  }
-}
-function loadToken(server, file = tokensFile()) {
-  return readStore(file)[server] ?? null;
-}
-function saveToken(server, bundle, file = tokensFile()) {
-  const store = readStore(file);
-  store[server] = bundle;
-  writeStore(file, store);
-}
-function clearToken(server, file = tokensFile()) {
-  const store = readStore(file);
-  if (!(server in store))
-    return false;
-  delete store[server];
-  writeStore(file, store);
-  return true;
-}
-function defaultFetch() {
-  const f3 = globalThis.fetch;
-  if (typeof f3 !== "function")
-    throw new Error("global fetch unavailable \u2014 Node 18+ is required for MCP OAuth");
-  return f3;
-}
-async function getValidAccessToken(server, opts = {}) {
-  const file = opts.file ?? tokensFile();
-  const bundle = loadToken(server, file);
-  if (!bundle)
-    return null;
-  const fresh = !bundle.expires_at || bundle.expires_at - Date.now() > 6e4;
-  if (fresh || !bundle.refresh_token)
-    return bundle.access_token;
-  try {
-    const refreshed = await refreshAccessToken(bundle, opts.fetchImpl ?? defaultFetch());
-    saveToken(server, refreshed, file);
-    return refreshed.access_token;
-  } catch {
-    return bundle.access_token;
-  }
-}
-function parseResourceMetadataUrl(wwwAuthenticate) {
-  const m2 = /resource_metadata\s*=\s*"([^"]+)"/i.exec(wwwAuthenticate || "");
-  return m2 ? m2[1] : null;
-}
-function protectedResourceCandidates(serverUrl) {
-  const u = new URL(serverUrl);
-  const base = u.origin;
-  const p = u.pathname.replace(/\/$/, "");
-  return [
-    ...p ? [`${base}/.well-known/oauth-protected-resource${p}`] : [],
-    `${base}/.well-known/oauth-protected-resource`
-  ];
-}
-function authServerCandidates(authServer) {
-  const u = new URL(authServer);
-  const base = u.origin;
-  const p = u.pathname.replace(/\/$/, "");
-  const root = authServer.replace(/\/$/, "");
-  return [
-    `${base}/.well-known/oauth-authorization-server${p}`,
-    `${base}/.well-known/openid-configuration${p}`,
-    `${root}/.well-known/oauth-authorization-server`,
-    `${root}/.well-known/openid-configuration`
-  ];
-}
-function buildAuthorizeUrl(meta, p) {
-  const url = new URL(meta.authorization_endpoint);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", p.clientId);
-  url.searchParams.set("redirect_uri", p.redirectUri);
-  url.searchParams.set("state", p.state);
-  url.searchParams.set("code_challenge", p.codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("resource", meta.resource);
-  if (meta.scope)
-    url.searchParams.set("scope", meta.scope);
-  return url.toString();
-}
-function toBundle(data, p) {
-  const accessToken = data.access_token;
-  if (!accessToken)
-    throw new Error("Token response had no access_token");
-  const expiresIn = typeof data.expires_in === "number" ? data.expires_in : void 0;
-  return {
-    access_token: accessToken,
-    refresh_token: data.refresh_token ?? p.prevRefresh,
-    expires_at: expiresIn ? Date.now() + expiresIn * 1e3 : void 0,
-    token_endpoint: p.tokenEndpoint,
-    client_id: p.clientId,
-    client_secret: p.clientSecret,
-    resource: p.resource,
-    scope: data.scope ?? p.scope
-  };
-}
-async function fetchJsonSafe(f3, url) {
-  try {
-    const resp = await f3(url, { headers: { Accept: "application/json" } });
-    if (!resp.ok)
-      return null;
-    return await resp.json();
-  } catch {
-    return null;
-  }
-}
-async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
-  const origin = new URL(serverUrl).origin;
-  let authServer = null;
-  let resource = serverUrl;
-  let scope;
-  const prmCandidates = [parseResourceMetadataUrl(wwwAuthenticate), ...protectedResourceCandidates(serverUrl)].filter(
-    (u) => Boolean(u)
-  );
-  let prm = null;
-  for (const url of new Set(prmCandidates)) {
-    prm = await fetchJsonSafe(f3, url);
-    if (prm)
-      break;
-  }
-  if (prm) {
-    const servers = prm.authorization_servers;
-    if (Array.isArray(servers) && servers.length)
-      authServer = servers[0];
-    if (typeof prm.resource === "string")
-      resource = prm.resource;
-    const scopes = prm.scopes_supported;
-    if (Array.isArray(scopes) && scopes.length)
-      scope = scopes.join(" ");
-  }
-  if (!authServer)
-    authServer = origin;
-  let asm = null;
-  for (const url of authServerCandidates(authServer)) {
-    asm = await fetchJsonSafe(f3, url);
-    if (asm && asm.authorization_endpoint && asm.token_endpoint)
-      break;
-    asm = null;
-  }
-  if (!asm)
-    throw new Error(`No OAuth metadata found for authorization server ${authServer}`);
-  return {
-    authorization_endpoint: asm.authorization_endpoint,
-    token_endpoint: asm.token_endpoint,
-    registration_endpoint: asm.registration_endpoint,
-    resource,
-    scope
-  };
-}
-async function registerClient(meta, redirectUri, f3) {
-  if (!meta.registration_endpoint) {
-    throw new Error(
-      'Authorization server does not support dynamic client registration; a client_id must be configured manually \u2014 create an OAuth client for this server, then re-run `nex mcp login <server> --client-id <id> [--client-secret <secret>]` (or set "clientId" / "clientSecret" in its mcp.json entry).'
-    );
-  }
-  const resp = await f3(meta.registration_endpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      client_name: "Nexrall Code CLI",
-      redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      scope: meta.scope
-    })
-  });
-  if (!resp.ok)
-    throw new Error(`Client registration failed (HTTP ${resp.status})`);
-  const data = await resp.json();
-  if (!data.client_id)
-    throw new Error("Client registration returned no client_id");
-  return data.client_id;
-}
-async function postToken(tokenEndpoint, body, f3) {
-  const resp = await f3(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-    body: body.toString()
-  });
-  if (!resp.ok) {
-    const txt = await resp.text().catch(() => "");
-    throw new Error(`Token endpoint error (HTTP ${resp.status})${txt ? `: ${txt.slice(0, 200)}` : ""}`);
-  }
-  return await resp.json();
-}
-async function exchangeCode(meta, clientId, clientSecret, code, verifier, redirectUri, f3) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: redirectUri,
-    client_id: clientId,
-    code_verifier: verifier,
-    resource: meta.resource
-  });
-  if (clientSecret)
-    body.set("client_secret", clientSecret);
-  const data = await postToken(meta.token_endpoint, body, f3);
-  return toBundle(data, {
-    tokenEndpoint: meta.token_endpoint,
-    clientId,
-    clientSecret,
-    resource: meta.resource,
-    scope: meta.scope
-  });
-}
-async function refreshAccessToken(bundle, f3) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: bundle.refresh_token,
-    client_id: bundle.client_id,
-    resource: bundle.resource
-  });
-  if (bundle.client_secret)
-    body.set("client_secret", bundle.client_secret);
-  const data = await postToken(bundle.token_endpoint, body, f3);
-  return toBundle(data, {
-    tokenEndpoint: bundle.token_endpoint,
-    clientId: bundle.client_id,
-    clientSecret: bundle.client_secret,
-    resource: bundle.resource,
-    scope: bundle.scope,
-    prevRefresh: bundle.refresh_token
-  });
-}
-function startLoopback() {
-  return new Promise((resolve19, reject) => {
-    let resolveCode;
-    let rejectCode;
-    const codePromise = new Promise((res, rej) => {
-      resolveCode = res;
-      rejectCode = rej;
-    });
-    codePromise.catch(() => void 0);
-    const server = http3.createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end(
-        `<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:40px"><h2>${error || !code ? "Authentication failed" : "Authentication complete"}</h2><p>You can close this tab and return to the terminal.</p></body></html>`
-      );
-      if (error) {
-        rejectCode(new Error(`Authorization denied: ${error}`));
-        return;
-      }
-      if (!code) {
-        rejectCode(new Error("No authorization code in redirect"));
-        return;
-      }
-      resolveCode({ code, state });
-    });
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolve19({
-        port,
-        waitForCode(expectedState) {
-          const timeout = setTimeout(
-            () => rejectCode(new Error("Timed out waiting for authorization")),
-            CALLBACK_TIMEOUT_MS
-          );
-          return codePromise.then(
-            ({ code, state }) => {
-              clearTimeout(timeout);
-              if (state !== expectedState)
-                throw new Error("OAuth state mismatch \u2014 possible CSRF, aborting");
-              return code;
-            },
-            // A denial must clear the timer too: otherwise `nex mcp login` reports the
-            // failure but the process sits on a 5-minute keep-alive before exiting.
-            (err) => {
-              clearTimeout(timeout);
-              throw err;
-            }
-          );
-        },
-        close() {
-          try {
-            server.closeAllConnections?.();
-          } catch {
-          }
-          try {
-            server.close();
-          } catch {
-          }
-        }
-      });
-    });
-  });
-}
-function b64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function openInBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    const child = spawn2(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" });
-    child.on("error", () => void 0);
-    child.unref();
-  } catch {
-  }
-}
-async function probeAuthChallenge(serverUrl, f3 = defaultFetch()) {
-  const steps = [
-    {
-      method: "initialize",
-      params: {
-        protocolVersion: import_code_core9.MCP_PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: "nexrall-code", version: "1.0" }
-      }
-    },
-    { method: "tools/list", params: {} }
-  ];
-  for (const { method, params } of steps) {
-    try {
-      const resp = await f3(serverUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
-      });
-      const challenge = resp.headers?.get("www-authenticate") ?? "";
-      if (challenge)
-        return challenge;
-    } catch {
-      return "";
-    }
-  }
-  return "";
-}
-async function authorizeServer(o) {
-  const f3 = o.fetchImpl ?? defaultFetch();
-  const challenge = o.wwwAuthenticate ?? await probeAuthChallenge(o.serverUrl, f3);
-  const meta = await discover(o.serverUrl, challenge, f3);
-  const scope = [meta.scope, (0, import_code_core9.parseOAuthChallenge)(challenge).scope, o.extraScope].map((s2) => s2?.trim()).filter((s2) => Boolean(s2)).join(" ").split(/\s+/).filter((s2, i2, a) => Boolean(s2) && a.indexOf(s2) === i2).join(" ");
-  meta.scope = scope || void 0;
-  const loopback = await startLoopback();
-  const redirectUri = `http://127.0.0.1:${loopback.port}/callback`;
-  try {
-    const creds = o.credentials ?? {};
-    let clientId;
-    if (creds.clientId) {
-      clientId = creds.clientId;
-      o.onStep?.("Using the OAuth client configured for this server\u2026");
-    } else {
-      o.onStep?.(`Registering with ${new URL(meta.token_endpoint).origin}\u2026`);
-      clientId = await registerClient(meta, redirectUri, f3);
-    }
-    const verifier = b64url(crypto.randomBytes(32));
-    const challengeB64 = b64url(crypto.createHash("sha256").update(verifier).digest());
-    const state = b64url(crypto.randomBytes(16));
-    const authUrl = buildAuthorizeUrl(meta, { clientId, redirectUri, codeChallenge: challengeB64, state });
-    o.onStep?.("Opening your browser to authorize\u2026");
-    await o.openUrl(authUrl);
-    const code = await loopback.waitForCode(state);
-    const bundle = await exchangeCode(meta, clientId, creds.clientSecret, code, verifier, redirectUri, f3);
-    saveToken(o.server, bundle, o.file ?? tokensFile());
-  } finally {
-    loopback.close();
-  }
-}
-var isRemote = (cfg) => cfg.type === "http" || cfg.type === "sse" || !cfg.command && !!cfg.url;
-async function injectMcpTokens(config, opts = {}) {
-  const file = opts.file ?? tokensFile();
-  const injected = [];
-  for (const [name, cfg] of Object.entries(config.mcpServers ?? {})) {
-    if (!isRemote(cfg))
-      continue;
-    const hasAuth = cfg.headers && Object.keys(cfg.headers).some((h2) => h2.toLowerCase() === "authorization");
-    if (hasAuth)
-      continue;
-    let token;
-    try {
-      token = await getValidAccessToken(name, { file, fetchImpl: opts.fetchImpl });
-    } catch {
-      token = null;
-    }
-    if (!token)
-      continue;
-    cfg.headers = { ...cfg.headers ?? {}, Authorization: `Bearer ${token}` };
-    injected.push(name);
-  }
-  return injected;
-}
 
 // src/commands/mcpCmd.ts
 var import_code_core10 = __toESM(require_dist2(), 1);
@@ -82344,7 +82667,7 @@ function classify(err, opts) {
     return {
       kind: "auth",
       title: "Not signed in",
-      hints: ["Run `nexrall-code login` to sign in again", "Your session keeps its place: /resume picks it back up"]
+      hints: ["Run `nex auth` to sign in again", "Your session keeps its place: /resume picks it back up"]
     };
   }
   if (status === 429 || RATE_RE.test(msg)) {
@@ -82463,15 +82786,15 @@ async function executeMcpResourceTool(name, input, mgr) {
 }
 
 // src/ui/clipboardImage.ts
+var import_proc3 = __toESM(require_proc(), 1);
 import * as fs6 from "fs";
 import * as os3 from "os";
 import * as path5 from "path";
-import { spawnSync } from "child_process";
 var MAX_PASTE_BYTES = 10 * 1024 * 1024;
 var PNG_MAGIC = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
 var realRunner = (cmd, args) => {
   try {
-    return spawnSync(cmd, args, { stdio: "ignore", timeout: 8e3 }).status === 0;
+    return (0, import_proc3.spawnSync)(cmd, args, { stdio: "ignore", timeout: 8e3 }).status === 0;
   } catch {
     return false;
   }
@@ -83009,7 +83332,7 @@ function capEffortForScale(levels, effort, cap) {
 var import_code_core26 = __toESM(require_dist2(), 1);
 
 // src/ui/statusLine.ts
-import { spawn as spawn3 } from "child_process";
+var import_proc4 = __toESM(require_proc(), 1);
 var STATUSLINE_TIMEOUT_MS = 2e3;
 var MIN_INTERVAL_MS2 = 1500;
 var MAX_OUTPUT_BYTES = 4096;
@@ -83056,7 +83379,7 @@ var shellRunner = (command, stdin, cwd2, timeoutMs) => new Promise((resolve19) =
   };
   let child;
   try {
-    child = spawn3(command, { shell: true, cwd: cwd2, stdio: ["pipe", "pipe", "ignore"], env: process.env });
+    child = (0, import_proc4.spawn)(command, { shell: true, cwd: cwd2, stdio: ["pipe", "pipe", "ignore"], env: process.env });
   } catch {
     resolve19(null);
     return;
@@ -84838,12 +85161,12 @@ function formatDeployTargets(targets, cols3) {
 }
 
 // src/commands/chat.ts
+var import_proc12 = __toESM(require_proc(), 1);
 var import_code_core66 = __toESM(require_dist2(), 1);
 import * as os17 from "os";
 import * as crypto4 from "crypto";
 import { createRequire } from "module";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { execFile as execFile2, execFileSync as execFileSync6 } from "child_process";
 
 // src/permissions/handler.ts
 import * as readline2 from "readline";
@@ -87118,17 +87441,17 @@ function debugLog(event, fields) {
 }
 
 // src/commands/doctor.ts
+var import_proc6 = __toESM(require_proc(), 1);
 var import_code_core46 = __toESM(require_dist2(), 1);
 import fs11 from "fs";
 import os6 from "os";
 import path13 from "path";
-import { spawnSync as spawnSync3, execFileSync as execFileSync2 } from "child_process";
 
 // src/commands/sessionTools.ts
+var import_proc5 = __toESM(require_proc(), 1);
 var import_code_core42 = __toESM(require_dist2(), 1);
 var import_code_core43 = __toESM(require_dist2(), 1);
 var import_code_core44 = __toESM(require_dist2(), 1);
-import { spawnSync as spawnSync2, execFileSync } from "child_process";
 var UsageTotals = class {
   input = 0;
   output = 0;
@@ -87221,7 +87544,7 @@ function copyToClipboard(text, platform3 = process.platform) {
   ];
   for (const [cmd, args] of candidates) {
     try {
-      const r2 = spawnSync2(cmd, args, { input: text, stdio: ["pipe", "ignore", "ignore"], timeout: 5e3 });
+      const r2 = (0, import_proc5.spawnSync)(cmd, args, { input: text, stdio: ["pipe", "ignore", "ignore"], timeout: 5e3 });
       if (!r2.error && r2.status === 0)
         return cmd;
     } catch {
@@ -87233,7 +87556,7 @@ function osc52(text) {
   return `\x1B]52;c;${Buffer.from(text, "utf8").toString("base64")}\x07`;
 }
 function gitChanges(cwd2) {
-  const run = (args) => execFileSync("git", args, { cwd: cwd2, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }).trimEnd();
+  const run = (args) => (0, import_proc5.execFileSync)("git", args, { cwd: cwd2, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1e4 }).trimEnd();
   try {
     run(["rev-parse", "--is-inside-work-tree"]);
     return { status: run(["status", "--short"]), stat: run(["diff", "--stat", "HEAD"]) };
@@ -87714,7 +88037,7 @@ function doctorExitCode(checks) {
   return checks.some((c) => c.status === "fail") ? 1 : 0;
 }
 function commandExists(cmd, platform3 = process.platform) {
-  const r2 = spawnSync3(platform3 === "win32" ? "where" : "which", [cmd], { stdio: "ignore", timeout: 5e3 });
+  const r2 = (0, import_proc6.spawnSync)(platform3 === "win32" ? "where" : "which", [cmd], { stdio: "ignore", timeout: 5e3 });
   return !r2.error && r2.status === 0;
 }
 function ripgrepInstallHint(platform3) {
@@ -87765,7 +88088,7 @@ function realProbes(c) {
     resolveRipgrep: () => (0, import_code_core46.resolveRipgrepBinary)(),
     gitInfo: () => {
       try {
-        execFileSync2("git", ["rev-parse", "--is-inside-work-tree"], { cwd: c.workDir, stdio: "ignore", timeout: 5e3 });
+        (0, import_proc6.execFileSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd: c.workDir, stdio: "ignore", timeout: 5e3 });
         return { inRepo: true, branch: (0, import_code_core43.gitBranch)(c.workDir) ?? void 0 };
       } catch {
         return { inRepo: false };
@@ -87847,7 +88170,7 @@ function knownSessionIds() {
     }
   };
   add(SESSIONS_DIR, ".json");
-  add((0, import_code_core6.eventsDir)(), ".jsonl");
+  add((0, import_code_core7.eventsDir)(), ".jsonl");
   return [...ids];
 }
 function findSessionsByLink(link2) {
@@ -87920,7 +88243,7 @@ function deleteSession(id) {
     return false;
   }
   try {
-    fs12.unlinkSync((0, import_code_core6.eventsPath)(r2.id));
+    fs12.unlinkSync((0, import_code_core7.eventsPath)(r2.id));
   } catch {
   }
   return true;
@@ -87954,7 +88277,7 @@ function exportSession(id, events) {
     version: 1,
     exportedAt: Date.now(),
     session,
-    events: events ?? (0, import_code_core6.readEvents)(r2.id)
+    events: events ?? (0, import_code_core7.readEvents)(r2.id)
   };
   return JSON.stringify(bundle, null, 2);
 }
@@ -87996,7 +88319,7 @@ function importSession(bundle) {
     renamed = true;
   }
   saveSession(id, title, bundle.session.workDir || process.cwd(), bundle.session.messages);
-  (0, import_code_core6.writeEvents)(id, bundle.events);
+  (0, import_code_core7.writeEvents)(id, bundle.events);
   return { id, messages: bundle.session.messages.length, renamed };
 }
 
@@ -88232,7 +88555,7 @@ async function enableAppleTerminalOptionAsMeta(deps) {
 }
 
 // src/commands/update.ts
-import { execFileSync as execFileSync3, spawn as spawn4 } from "child_process";
+var import_proc7 = __toESM(require_proc(), 1);
 import * as fs13 from "fs";
 import * as https2 from "https";
 import * as path16 from "path";
@@ -88285,7 +88608,7 @@ function installArgs(version) {
 }
 function installedGlobalVersion() {
   try {
-    const root = execFileSync3("npm", ["root", "-g"], { encoding: "utf-8" }).trim();
+    const root = (0, import_proc7.execFileSync)("npm", ["root", "-g"], { encoding: "utf-8" }).trim();
     return JSON.parse(fs13.readFileSync(path16.join(root, "nexrall-code", "package.json"), "utf-8")).version ?? null;
   } catch {
     return null;
@@ -88293,7 +88616,7 @@ function installedGlobalVersion() {
 }
 function npmInstallGlobal(version) {
   return new Promise((resolve19) => {
-    const child = spawn4("npm", installArgs(version), { stdio: "pipe" });
+    const child = (0, import_proc7.spawn)("npm", installArgs(version), { stdio: "pipe" });
     let stderr = "";
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
@@ -88302,7 +88625,7 @@ function npmInstallGlobal(version) {
       if (code === 0)
         return resolve19({ ok: true, usedSudo: false });
       if (/EACCES|permission denied/i.test(stderr)) {
-        const sudo = spawn4("sudo", ["npm", ...installArgs(version)], { stdio: "inherit" });
+        const sudo = (0, import_proc7.spawn)("sudo", ["npm", ...installArgs(version)], { stdio: "inherit" });
         sudo.on("close", (sudoCode) => resolve19({ ok: sudoCode === 0, usedSudo: true }));
       } else {
         console.error(paint.dim(stderr.trim()));
@@ -98194,6 +98517,11 @@ var BUILTIN_SLASH_COMMANDS = [
     kind: "builtin"
   },
   { name: "cost", description: "Where the tokens and money went (per model, per agent, per turn)", kind: "builtin" },
+  {
+    name: "logout",
+    description: "Sign out on this machine (revokes the saved refresh token)",
+    kind: "builtin"
+  },
   {
     name: "stats",
     description: "Usage across sessions: activity by day, tokens and models (local event logs)",
@@ -99340,9 +99668,9 @@ function decidePick(item, tab2) {
 }
 
 // src/commands/bangShell.ts
+var import_proc8 = __toESM(require_proc(), 1);
 var import_code_core50 = __toESM(require_dist2(), 1);
 var import_code_core51 = __toESM(require_dist2(), 1);
-import { spawn as spawn5 } from "child_process";
 function parseBang(line) {
   const t2 = line.trim();
   if (!t2.startsWith("!"))
@@ -99365,18 +99693,14 @@ function runBang(cmd, opts) {
     let aborted = false;
     let settled = false;
     let detached = false;
-    const child = spawn5("bash", ["-c", cmd], {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: process.platform !== "win32"
-    });
+    const common = { cwd: opts.cwd, env: opts.env ?? process.env, stdio: ["ignore", "pipe", "pipe"] };
+    const child = import_proc8.IS_WINDOWS ? (0, import_proc8.spawn)(cmd, { ...common, shell: true }) : (0, import_proc8.spawn)("bash", ["-c", cmd], { ...common, detached: true });
     const kill = () => {
       try {
         if (child.pid && process.platform !== "win32")
           process.kill(-child.pid, "SIGTERM");
         else
-          child.kill("SIGTERM");
+          (0, import_proc8.killProcessTree)(child.pid);
       } catch {
       }
       setTimeout(() => {
@@ -99537,16 +99861,16 @@ function searchMeta(scope, origin) {
 var SEARCH_HINT = "  type to search \xB7 Ctrl+R older \xB7 Ctrl+S all/this project \xB7 Enter/Tab use it \xB7 Esc cancel";
 
 // src/ui/externalEditor.ts
+var import_proc9 = __toESM(require_proc(), 1);
 import * as fs20 from "fs";
 import * as os13 from "os";
 import * as path20 from "path";
-import { spawnSync as spawnSync4 } from "child_process";
 function resolveEditor(env3) {
   const pick = (v) => v && v.trim() ? v.trim() : null;
   return pick(env3.VISUAL) ?? pick(env3.EDITOR) ?? "vi";
 }
 function defaultRun(editor, file) {
-  const r2 = spawnSync4("sh", ["-c", `${editor} "$1"`, "sh", file], { stdio: "inherit" });
+  const r2 = process.platform === "win32" ? (0, import_proc9.spawnSync)(`${editor} "${file}"`, { stdio: "inherit", shell: true }) : (0, import_proc9.spawnSync)("sh", ["-c", `${editor} "$1"`, "sh", file], { stdio: "inherit" });
   return { status: r2.status, error: r2.error };
 }
 function editInEditor(text, opts = {}) {
@@ -99579,7 +99903,7 @@ function editInEditor(text, opts = {}) {
 }
 
 // src/ui/openInEditor.ts
-import { spawn as spawn6, spawnSync as spawnSync5 } from "node:child_process";
+var import_proc10 = __toESM(require_proc(), 1);
 import * as fs21 from "node:fs";
 import * as os14 from "node:os";
 import * as path21 from "node:path";
@@ -99799,7 +100123,7 @@ function launchEditor(spec, target, opts = {}) {
   const needsShell = /\s/.test(spec.command);
   const argv = () => needsShell ? ["sh", ["-c", `${spec.command} "$@"`, "sh", ...args]] : [spec.command, args];
   if (spec.kind === "gui") {
-    const runSpawn = opts.spawnImpl ?? spawn6;
+    const runSpawn = opts.spawnImpl ?? import_proc10.spawn;
     try {
       const child = runSpawn(...argv(), { detached: true, stdio: "ignore" });
       child.on("error", (e2) => opts.onAsyncError?.(`could not start ${spec.command}: ${e2.message}`));
@@ -99809,7 +100133,7 @@ function launchEditor(spec, target, opts = {}) {
       return { ok: false, reason: `could not start ${spec.command}: ${e2.message}` };
     }
   }
-  const r2 = (opts.spawnSyncImpl ?? spawnSync5)(...argv(), { stdio: "inherit" });
+  const r2 = (opts.spawnSyncImpl ?? import_proc10.spawnSync)(...argv(), { stdio: "inherit" });
   if (r2.error)
     return { ok: false, reason: `could not start ${spec.command}: ${r2.error.message}` };
   if (typeof r2.status === "number" && r2.status !== 0)
@@ -99826,9 +100150,9 @@ function describeOpen(spec, target, cwd2) {
 }
 
 // src/ui/fileMention.ts
+var import_proc11 = __toESM(require_proc(), 1);
 import * as fs22 from "fs";
 import * as path22 from "path";
-import { execFile, execFileSync as execFileSync5 } from "child_process";
 
 // src/ui/contextFiles.ts
 var import_code_core52 = __toESM(require_dist2(), 1);
@@ -99873,7 +100197,7 @@ function listProjectFiles(cwd2) {
 function listProjectFilesFrom(cwd2) {
   let files = null;
   try {
-    const out = execFileSync5("git", ["-C", cwd2, "ls-files", "-co", "--exclude-standard", "-z"], {
+    const out = (0, import_proc11.execFileSync)("git", ["-C", cwd2, "ls-files", "-co", "--exclude-standard", "-z"], {
       encoding: "utf-8",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
@@ -100009,7 +100333,7 @@ function primeMentionIndex(cwd2) {
     building.cancelled = true;
   const job = { cwd: cwd2, cancelled: false };
   building = job;
-  execFile(
+  (0, import_proc11.execFile)(
     "git",
     ["-C", cwd2, "ls-files", "-co", "--exclude-standard", "-z"],
     {
@@ -103752,7 +104076,7 @@ function scanRecentSkillEvents(dir, maxFiles = DOCTOR_SESSION_WINDOW) {
   const out = [];
   for (const { full } of withTime.slice(0, maxFiles)) {
     try {
-      out.push((0, import_code_core6.readEvents)("", { file: full }));
+      out.push((0, import_code_core7.readEvents)("", { file: full }));
     } catch {
     }
   }
@@ -104364,7 +104688,7 @@ function agentFooterBadge() {
 }
 var runGitForMerge = (cwd2, args) => {
   try {
-    const stdout = execFileSync6("git", args, {
+    const stdout = (0, import_proc12.execFileSync)("git", args, {
       cwd: cwd2,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -104621,7 +104945,7 @@ function resolveModelLabel(alias) {
 async function tryExecAsync(file, args, cwd2) {
   return new Promise((resolve19) => {
     try {
-      execFile2(file, args, { cwd: cwd2, encoding: "utf-8" }, (err, stdout) => {
+      (0, import_proc12.execFile)(file, args, { cwd: cwd2, encoding: "utf-8" }, (err, stdout) => {
         resolve19(err ? void 0 : String(stdout).trim() || void 0);
       });
     } catch {
@@ -105300,7 +105624,7 @@ function emitEvent(type, data = {}) {
 }
 function startSessionLog(id, resumed, extra = {}) {
   const previous = liveSessionId;
-  sessionLog = (0, import_code_core6.eventsEnabled)() ? new import_code_core6.EventLog(id) : null;
+  sessionLog = (0, import_code_core7.eventsEnabled)() ? new import_code_core7.EventLog(id) : null;
   liveSessionId = id;
   if (previous && previous !== id)
     (0, import_code_core22.rebindSessionShare)(id);
@@ -105645,7 +105969,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
       emitEvent("tool.started", {
         name,
         sub: !!isSubTask,
-        target: name === "use_skill" && typeof input.name === "string" ? input.name : (0, import_code_core6.toolTarget)(name, input)
+        target: name === "use_skill" && typeof input.name === "string" ? input.name : (0, import_code_core7.toolTarget)(name, input)
       });
       if (!isSubTask)
         sessionToolCalls++;
@@ -105698,7 +106022,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
         const changed = noteToolResult(turnStats, tracked?.name ?? name, tracked?.input, cmdOk);
         for (const t2 of changed)
           failureLedger.noteEdit(t2);
-        for (const t2 of changed.slice(0, import_code_core6.MAX_FILE_EVENTS))
+        for (const t2 of changed.slice(0, import_code_core7.MAX_FILE_EVENTS))
           emitEvent("file.changed", { path: t2 });
       }
       if (!isSubTask && tracked?.command)
@@ -106040,7 +106364,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env3
     onToolUse: (name, input, isSubTask, meta) => {
       debugLog("tool_use", { tool: name, sub: !!isSubTask });
       emit({ type: "tool_use", tool: name, input, ...toolIds(isSubTask, meta) });
-      verbose(`[verbose] -> ${name}${isSubTask ? " (sub-agent)" : ""} ${(0, import_code_core6.toolTarget)(name, input)}`);
+      verbose(`[verbose] -> ${name}${isSubTask ? " (sub-agent)" : ""} ${(0, import_code_core7.toolTarget)(name, input)}`);
     },
     // Live bash progress for scripted/CI consumers — lets a wrapper tail a
     // long-running build/test command instead of blocking silently until
@@ -106320,6 +106644,7 @@ function printHelp() {
     ["/yolo", "Auto-approve all permissions"],
     ["/balance", "Show what is paying (personal wallet or team) and what is left"],
     ["/team [use <id|personal>]", "List your teams, or switch what usage is billed to"],
+    ["/logout", "Sign out on this machine (revokes the saved refresh token)"],
     ["/cost [--all]", "Cost and tokens: per model, per sub-agent, per turn (/balance shows the wallet)"],
     ["/stats", "Usage across sessions: activity by day, tokens and models (local event logs)"],
     [
@@ -107036,7 +107361,7 @@ Resume it with: nex --worktree ${worktreeState.name}
       console.log(paint.green(`  Resumed session: ${paint.bold(stored.title.slice(0, 60))}`));
       console.log(paint.dim(`  ${messages.length} messages restored`));
       if (autoRecap) {
-        const recap = (0, import_code_core33.buildRecap)((0, import_code_core6.readEvents)(stored.id, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
+        const recap = (0, import_code_core33.buildRecap)((0, import_code_core7.readEvents)(stored.id, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
         if (recap)
           console.log(paint.dim(`  Recap: ${recap}`));
       }
@@ -108876,6 +109201,26 @@ ${dirList}`;
           rl.prompt();
           return;
         }
+        case "/logout": {
+          const answer = await new Promise(
+            (resolve19) => rl.question(paint.yellow("  Sign out on this machine? ") + paint.dim("[y/n] "), (a) => resolve19(a.trim()))
+          );
+          if (answer !== "y" && answer !== "yes") {
+            console.log(paint.dim("  Cancelled."));
+            rl.prompt();
+            return;
+          }
+          await signOut();
+          console.log(paint.green("  \u2713 Logged out."));
+          if (process.env.NEXRALL_TOKEN?.trim()) {
+            console.log(
+              paint.yellow("    NEXRALL_TOKEN is still set in this shell") + paint.dim(" \u2014 unset it, or the CLI stays signed in with that token.")
+            );
+          }
+          console.log(paint.dim("  Run `nex auth` (in any terminal) to sign in again; this session picks it up."));
+          rl.prompt();
+          return;
+        }
         case "/cost": {
           const parsed = parseCostArgs(arg);
           if ("error" in parsed) {
@@ -108938,14 +109283,14 @@ ${dirList}`;
           return;
         }
         case "/recap": {
-          if (!(0, import_code_core6.eventsEnabled)()) {
+          if (!(0, import_code_core7.eventsEnabled)()) {
             console.log(
               paint.dim("  Events are off for this run (NEXRALL_EVENTS=off), so there is nothing to read back.")
             );
             rl.prompt();
             return;
           }
-          const recap = (0, import_code_core33.buildRecap)((0, import_code_core6.readEvents)(sessionId, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
+          const recap = (0, import_code_core33.buildRecap)((0, import_code_core7.readEvents)(sessionId, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
           console.log();
           if (recap)
             console.log(`  ${paint.bold("Recap: ")}${recap}`);
@@ -109509,11 +109854,11 @@ ${dirList}`;
             return;
           }
           if (!(0, import_code_core64.getToken)()) {
-            console.log(paint.yellow("  Sign in first (`nex login`) \u2014 watching uses your Nexrall account."));
+            console.log(paint.yellow("  Sign in first (`nex auth`) \u2014 watching uses your Nexrall account."));
             rl.prompt();
             return;
           }
-          if (!(0, import_code_core6.eventsEnabled)()) {
+          if (!(0, import_code_core7.eventsEnabled)()) {
             console.log(
               paint.yellow("  Sharing follows the event stream, and this run has it off (NEXRALL_EVENTS=off).")
             );
@@ -109617,7 +109962,7 @@ ${dirList}`;
             }
             if (!(0, import_code_core64.getToken)()) {
               console.log(
-                paint.yellow("  Sign in first (`nex login`) \u2014 pushes find this session through your account.")
+                paint.yellow("  Sign in first (`nex auth`) \u2014 pushes find this session through your account.")
               );
               rl.prompt();
               return;
@@ -109688,7 +110033,7 @@ ${dirList}`;
         }
         case "/schedule":
         case "/routines": {
-          const action = (0, import_code_core3.parseScheduleChatArg)(arg);
+          const action = (0, import_code_core4.parseScheduleChatArg)(arg);
           if (action.kind === "error") {
             console.log(paint.yellow("  " + action.message));
             rl.prompt();
@@ -109699,7 +110044,7 @@ ${dirList}`;
             const panelCols = Math.max(60, (process.stdout.columns || 100) - 2);
             if (action.kind === "list") {
               const list = await (0, import_code_core63.listCloudSchedules)();
-              for (const l of (0, import_code_core3.scheduleListLines)(list, { cols: panelCols }))
+              for (const l of (0, import_code_core4.scheduleListLines)(list, { cols: panelCols }))
                 console.log("  " + l);
               if (list.length)
                 console.log(
@@ -109709,7 +110054,7 @@ ${dirList}`;
               const s2 = await (0, import_code_core63.createCloudSchedule)({ task: action.task, intervalMinutes: action.intervalMinutes });
               console.log(
                 paint.green(
-                  `  \u2713 Scheduled #${s2.id} \u2014 every ${(0, import_code_core3.formatEvery)(s2.intervalMinutes)}${s2.nextRunAt ? `, next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)}` : ""}.`
+                  `  \u2713 Scheduled #${s2.id} \u2014 every ${(0, import_code_core4.formatEvery)(s2.intervalMinutes)}${s2.nextRunAt ? `, next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)}` : ""}.`
                 )
               );
               console.log(
@@ -109727,7 +110072,7 @@ ${dirList}`;
               console.log(paint.dim(`  Removed schedule #${action.id} \u2014 no further runs fire.`));
             } else {
               const runs2 = await (0, import_code_core63.getCloudScheduleRuns)(action.id);
-              for (const l of (0, import_code_core3.scheduleRunsLines)(runs2, { cols: panelCols }))
+              for (const l of (0, import_code_core4.scheduleRunsLines)(runs2, { cols: panelCols }))
                 console.log("  " + l);
             }
           } catch (err) {
@@ -109945,7 +110290,7 @@ ${dirList}`;
           };
           const want = arg.trim();
           if (want) {
-            const hit = (0, import_code_core7.findFiles)(files, want);
+            const hit = (0, import_code_core8.findFiles)(files, want);
             if (!hit.length)
               console.log(paint.dim(`  No changed file matches "${want}".  (/diff lists them all)`));
             else if (hit.length > 1) {
@@ -109954,14 +110299,14 @@ ${dirList}`;
                 console.log("  " + f3.path);
             } else {
               verification.noteDiffReviewed();
-              out((0, import_code_core7.capLines)((0, import_code_core7.renderFile)(hit[0], { foldHunks: false })));
+              out((0, import_code_core8.capLines)((0, import_code_core8.renderFile)(hit[0], { foldHunks: false })));
             }
           } else {
             console.log(paint.bold("  Uncommitted changes"));
-            out((0, import_code_core7.summaryLines)(files));
+            out((0, import_code_core8.summaryLines)(files));
             console.log();
             verification.noteDiffReviewed();
-            out((0, import_code_core7.renderAll)(files));
+            out((0, import_code_core8.renderAll)(files));
           }
           rl.prompt();
           return;
@@ -109982,7 +110327,7 @@ ${dirList}`;
           const emit = (line) => console.log(truncateCells(line, cols3));
           const want = arg.replace(/(^|\s)--all(?=\s|$)/, " ").trim();
           if (want) {
-            const hit = (0, import_code_core7.findFiles)(files, want);
+            const hit = (0, import_code_core8.findFiles)(files, want);
             if (!hit.length)
               emit(paint.dim(`  No changed file matches "${want}".  (/review lists them all)`));
             else if (hit.length > 1) {
@@ -109990,14 +110335,14 @@ ${dirList}`;
               for (const f3 of hit.slice(0, 10))
                 emit("  " + f3.path);
             } else {
-              const ctx = { tests: files.filter((x2) => (0, import_code_core8.isTestPath)(x2.path)) };
-              for (const line of (0, import_code_core8.formatReviewDetail)((0, import_code_core8.classifyFile)(hit[0], ctx), cols3))
+              const ctx = { tests: files.filter((x2) => (0, import_code_core9.isTestPath)(x2.path)) };
+              for (const line of (0, import_code_core9.formatReviewDetail)((0, import_code_core9.classifyFile)(hit[0], ctx), cols3))
                 emit("  " + line);
             }
           } else {
             const all = /(^|\s)--all(\s|$)/.test(arg);
-            const q = (0, import_code_core8.buildReviewQueue)(files, all ? Number.POSITIVE_INFINITY : import_code_core8.DEFAULT_PER_GROUP);
-            for (const line of (0, import_code_core8.formatReviewQueue)(q, cols3))
+            const q = (0, import_code_core9.buildReviewQueue)(files, all ? Number.POSITIVE_INFINITY : import_code_core9.DEFAULT_PER_GROUP);
+            for (const line of (0, import_code_core9.formatReviewQueue)(q, cols3))
               emit("  " + line);
             emit(paint.dim("  /review <file> for one entry's reasons \xB7 /diff for the change itself"));
           }
@@ -110643,7 +110988,7 @@ ${text}
             const res = await enableAppleTerminalOptionAsMeta({
               run: async (cmd2, args) => {
                 try {
-                  const stdout = execFileSync6(cmd2, args, { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+                  const stdout = (0, import_proc12.execFileSync)(cmd2, args, { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
                   return { code: 0, stdout };
                 } catch (err) {
                   const e2 = err;
@@ -110774,7 +111119,7 @@ ${text}
         }
         case "/skill-doctor": {
           const loadedSkills = (0, import_code_core66.loadSkills)(workDir);
-          const usage2 = collectSkillUsage(scanRecentSkillEvents((0, import_code_core6.eventsDir)()));
+          const usage2 = collectSkillUsage(scanRecentSkillEvents((0, import_code_core7.eventsDir)()));
           for (const l of buildSkillDoctorReport(loadedSkills, usage2).lines)
             console.log(l);
           rl.prompt();
@@ -112212,11 +112557,11 @@ function pluginSourceRemoveCommand(name, opts) {
 }
 
 // src/commands/pluginEvalCmd.ts
+var import_proc13 = __toESM(require_proc(), 1);
 var import_code_core71 = __toESM(require_dist2(), 1);
 import * as fs27 from "fs";
 import * as os18 from "os";
 import * as path28 from "path";
-import { spawn as spawn7 } from "node:child_process";
 function pluginEvalInitCommand(dir) {
   const target = path28.resolve(dir ?? process.cwd());
   const displayPath = (p) => {
@@ -112328,7 +112673,7 @@ function walkFiles(root) {
 }
 function runChild(args, cwd2, env3, timeoutMs) {
   return new Promise((resolve19) => {
-    const child = spawn7(process.execPath, args, {
+    const child = (0, import_proc13.spawn)(process.execPath, args, {
       cwd: cwd2,
       env: env3,
       stdio: ["ignore", "pipe", "pipe"]
@@ -112682,7 +113027,7 @@ function planProjectPurge(targetDir, env3 = process.env) {
     }
   }
   for (const id of sessionIds) {
-    const p = (0, import_code_core6.eventsPath)(id, env3);
+    const p = (0, import_code_core7.eventsPath)(id, env3);
     if (fs28.existsSync(p))
       items.push({ kind: "events", path: p, dir: false });
   }
@@ -112836,11 +113181,11 @@ async function projectPurgeCommand(dir, opts = {}) {
 }
 
 // src/commands/sessionPlugins.ts
+var import_proc14 = __toESM(require_proc(), 1);
 var import_code_core73 = __toESM(require_dist2(), 1);
 import * as fs29 from "node:fs";
 import * as os20 from "node:os";
 import * as path30 from "node:path";
-import { spawnSync as spawnSync6 } from "node:child_process";
 var MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
 function mkTemp(label) {
   return fs29.mkdtempSync(path30.join(os20.tmpdir(), `nex-${label}-`));
@@ -112862,7 +113207,14 @@ function descendIntoWrapper(root) {
   return root;
 }
 function extractZip(archive, dest) {
-  const r2 = spawnSync6("unzip", ["-o", "-q", archive, "-d", dest], { encoding: "utf-8", timeout: 6e4 });
+  if (process.platform === "win32") {
+    const t2 = (0, import_proc14.spawnSync)("tar", ["-xf", archive, "-C", dest], { encoding: "utf-8", timeout: 6e4 });
+    if (t2.status !== 0) {
+      return { ok: false, error: `tar failed: ${(t2.stderr ?? "").trim() || (t2.error?.message ?? "unknown error")}` };
+    }
+    return { ok: true };
+  }
+  const r2 = (0, import_proc14.spawnSync)("unzip", ["-o", "-q", archive, "-d", dest], { encoding: "utf-8", timeout: 6e4 });
   if (r2.error && r2.error.code === "ENOENT") {
     return { ok: false, error: "The `unzip` command was not found \u2014 install it, or use a .tar.gz archive." };
   }
@@ -112872,7 +113224,7 @@ function extractZip(archive, dest) {
   return { ok: true };
 }
 function extractTarGz(archive, dest) {
-  const r2 = spawnSync6("tar", ["-xzf", archive, "-C", dest], { encoding: "utf-8", timeout: 6e4 });
+  const r2 = (0, import_proc14.spawnSync)("tar", ["-xzf", archive, "-C", dest], { encoding: "utf-8", timeout: 6e4 });
   if (r2.status !== 0) {
     return { ok: false, error: `tar failed: ${(r2.stderr ?? "").trim() || (r2.error?.message ?? "unknown error")}` };
   }
@@ -113239,11 +113591,11 @@ async function autoModeResetCommand(opts) {
 var import_code_core79 = __toESM(require_dist2(), 1);
 
 // src/commands/bgJobs.ts
+var import_proc15 = __toESM(require_proc(), 1);
 import * as fs31 from "node:fs";
 import * as os22 from "node:os";
 import * as path32 from "node:path";
 import * as crypto5 from "node:crypto";
-import { spawn as spawn8 } from "node:child_process";
 function bgDir(env3 = process.env) {
   return env3.NEXRALL_CLI_BG_DIR || path32.join(os22.homedir(), ".nexrall", "cli-bg");
 }
@@ -113306,9 +113658,11 @@ function startJob(o) {
   const codeFile = path32.join(dir, `${id}.code`);
   const fd = fs31.openSync(log, "a");
   const command = o.shell !== void 0 ? ["/bin/sh", "-c", o.shell] : [o.execPath ?? process.execPath, o.script ?? "", ...o.args ?? []];
-  const child = spawn8("/bin/sh", ["-c", '"$@"; echo $? > "$0"', codeFile, ...command], {
+  const [wrapBin, wrapArgs] = wrapperArgv(codeFile, command, o.shell, process.execPath);
+  const child = (0, import_proc15.spawn)(wrapBin, wrapArgs, {
     cwd: o.cwd,
-    detached: true,
+    detached: !import_proc15.IS_WINDOWS,
+    // detached on Windows = DETACHED_PROCESS: ignores windowsHide, pops a console
     stdio: ["ignore", fd, fd],
     env: { ...process.env, NEXRALL_BG_JOB: id }
   });
@@ -113368,6 +113722,23 @@ function respawnJob(job, opts) {
   });
   return { ok: true, job: meta };
 }
+var WIN_WRAPPER = [
+  "const {spawn}=require('child_process'),fs=require('fs');",
+  "const [codeFile,mode,...rest]=process.argv.slice(1);",
+  "const o={stdio:'inherit',windowsHide:true};",
+  "const c=mode==='shell'?spawn(rest[0],{...o,shell:true}):spawn(rest[0],rest.slice(1),o);",
+  "c.on('error',()=>{fs.writeFileSync(codeFile,'127\\n');process.exit(127)});",
+  "c.on('exit',(code)=>{fs.writeFileSync(codeFile,String(code??1)+'\\n');process.exit(code??1)});"
+].join("");
+function wrapperArgv(codeFile, command, shell, nodePath) {
+  if (import_proc15.IS_WINDOWS) {
+    return [
+      nodePath,
+      ["-e", WIN_WRAPPER, codeFile, shell !== void 0 ? "shell" : "argv", ...shell !== void 0 ? [shell] : command]
+    ];
+  }
+  return ["/bin/sh", ["-c", '"$@"; echo $? > "$0"', codeFile, ...command]];
+}
 function killJob(job, dir = bgDir()) {
   if (job.state !== "running")
     return false;
@@ -113375,6 +113746,10 @@ function killJob(job, dir = bgDir()) {
     fs31.writeFileSync(path32.join(dir, `${job.id}.killed`), "");
   } catch {
   }
+  if (import_proc15.IS_WINDOWS) {
+    (0, import_proc15.killProcessTree)(job.pid);
+    return true;
+  }
   try {
     process.kill(-job.pid, "SIGTERM");
     return true;
@@ -113936,7 +114311,7 @@ var NEX_VERSION = require3("../package.json").version;
 installEpipeGuard();
 var program2 = new Command();
 program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version(NEX_VERSION).enablePositionalOptions();
-var auth = program2.command("auth").description("Login to your Nexrall account").action(authCommand);
+var auth = program2.command("auth").alias("login").description("Log in (browser, email + password, or a token)").option("--browser", "Sign in through the browser \u2014 works for Google, Apple and SSO accounts").option("--code <code>", "Finish a browser sign-in with a code you already copied (no browser is opened)").option("--token <token>", "Save a token directly (CI/headless). Prefer NEXRALL_TOKEN where you can").option("--password", "Ask for email and password in this terminal (skips the method menu)").action(authCommand);
 auth.command("status").description("Show whether you are logged in (exit 0 = yes, 1 = no). --json for scripts; the token is never printed").option("--json", "Machine-readable output").action((opts) => {
   const r2 = authStatusReport((0, import_code_core79.loadAuth)(), process.env);
   if (opts.json)
@@ -114394,7 +114769,7 @@ program2.command("sessions").description("List, export, import, or delete saved
       process.exitCode = 1;
       return;
     }
-    const events = (0, import_code_core6.readEvents)(hit.id, { last: Number.isFinite(want) && want > 0 ? want : 20 });
+    const events = (0, import_code_core7.readEvents)(hit.id, { last: Number.isFinite(want) && want > 0 ? want : 20 });
     if (!events.length) {
       console.log(
         paint.dim(`  No events recorded for ${hit.id.slice(0, 8)} (NEXRALL_EVENTS=off disables the stream).`)
@@ -114409,9 +114784,9 @@ program2.command("sessions").description("List, export, import, or delete saved
     console.log();
     console.log(paint.bold(`  Events for ${hit.id.slice(0, 8)}  `) + paint.dim(`(last ${events.length})`));
     for (const ev of events)
-      console.log("  " + paint.dim((0, import_code_core6.summarizeEvent)(ev)));
+      console.log("  " + paint.dim((0, import_code_core7.summarizeEvent)(ev)));
     console.log(paint.dim(`
-  Raw JSONL: ${(0, import_code_core6.eventsPath)(hit.id)}`));
+  Raw JSONL: ${(0, import_code_core7.eventsPath)(hit.id)}`));
     console.log();
     return;
   }