nexrall-code 0.5.207 → 0.5.209

package/dist/index.js

@@ -10114,6 +10114,8 @@ var require_client = __commonJS({
     exports.getUsageDaily = getUsageDaily;
     exports.exchangeVscodeCode = exchangeVscodeCode;
     exports.login = login2;
+    exports.exchangeAuthCode = exchangeAuthCode2;
+    exports.checkToken = checkToken2;
     exports.getUserProfile = getUserProfile;
     exports.clampScheduleMinutes = clampScheduleMinutes;
     exports.listCloudSchedules = listCloudSchedules3;
@@ -10173,7 +10175,7 @@ var require_client = __commonJS({
     function authHeaders() {
       const token = (0, index_1.getToken)();
       if (!token) {
-        throw new Error("Not authenticated. Run `nexrall-code login` first.");
+        throw new Error("Not authenticated. Run `nex auth` first.");
       }
       const headers = {
         "Content-Type": "application/json",
@@ -11159,6 +11161,42 @@ var require_client = __commonJS({
         email: data.email ?? email
       };
     }
+    async function exchangeAuthCode2(code) {
+      const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/auth/vscode-exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...deviceHeader() },
+        body: JSON.stringify({ code })
+      });
+      if (response.status === 401 || response.status === 400) {
+        throw new Error("That sign-in code is invalid or has expired (codes last 5 minutes). Run `nex auth --browser` again.");
+      }
+      if (!response.ok) {
+        const errText3 = await response.text().catch(() => "");
+        throw new Error(`Sign-in failed (${response.status}): ${errText3}`);
+      }
+      const data = await response.json();
+      if (!data.token)
+        throw new Error("Sign-in response missing token");
+      return {
+        token: data.token,
+        ...data.refreshToken ? { refreshToken: data.refreshToken } : {},
+        email: data.user?.email ?? ""
+      };
+    }
+    async function checkToken2(token) {
+      try {
+        const response = await (0, node_fetch_1.default)(`${exports.API_BASE}/api/user/profile`, {
+          method: "GET",
+          headers: { Authorization: `Bearer ${token}`, ...deviceHeader() }
+        });
+        if (!response.ok)
+          return { ok: false, status: response.status };
+        const data = await response.json().catch(() => ({}));
+        return { ok: true, status: response.status, ...data.email ? { email: data.email } : {} };
+      } catch {
+        return { ok: false, status: 0 };
+      }
+    }
     async function getUserProfile() {
       const fetchOnce = () => (0, node_fetch_1.default)(`${exports.API_BASE}/api/user/profile`, { method: "GET", headers: authHeaders() });
       let response = await fetchOnce();
@@ -21082,7 +21120,7 @@ ${lines.join("\n")}`;
         return { error: "Missing required parameter: path" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       let imageUrl;
       let cost;
       let balance;
@@ -21136,7 +21174,7 @@ ${lines.join("\n")}`;
         return { error: "Missing required parameter: query" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       let photos;
       try {
         const u = new URL(`${client_2.API_BASE}/api/code/assets/stock`);
@@ -21193,7 +21231,7 @@ ${lines.join("\n")}` };
         return { error: "Missing required parameter: query" };
       const token = (0, auth_1.getToken)();
       if (!token)
-        return { error: "Not authenticated. Run `nexrall-code login` first." };
+        return { error: "Not authenticated. Run `nex auth` first." };
       try {
         const r2 = await _httpsPost(`${client_2.API_BASE}/api/code/tools/web_search`, JSON.stringify({ query, ...(0, client_1.billingOverrideFields)() }), { "Content-Type": "application/json", Authorization: `Bearer ${token}` }, 3e4, abortSignal);
         let json = {};
@@ -78440,7 +78478,7 @@ import * as fs32 from "fs";
 import { createRequire as createRequire2 } from "module";
 
 // src/commands/auth.ts
-var import_code_core = __toESM(require_dist2(), 1);
+var import_code_core2 = __toESM(require_dist2(), 1);
 import * as readline from "readline";
 
 // ../../node_modules/.pnpm/chalk@5.6.2/node_modules/chalk/source/vendor/ansi-styles/index.js
@@ -79756,7 +79794,458 @@ function formatUsage(outputTokens) {
   return paint.dim(`\u2193 ${tok} tokens`);
 }
 
+// src/mcp/oauth.ts
+var import_proc = __toESM(require_proc(), 1);
+var import_code_core = __toESM(require_dist2(), 1);
+import * as fs2 from "fs";
+import * as os2 from "os";
+import * as path from "path";
+import * as http3 from "http";
+import * as crypto from "crypto";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function tokensFile(env3 = process.env) {
+  return env3.NEXRALL_MCP_AUTH_FILE || path.join(os2.homedir(), ".nexrall", "mcp-auth.json");
+}
+function readStore(file) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(file, "utf-8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+      return {};
+    const out = {};
+    for (const [k, v] of Object.entries(parsed)) {
+      const b = v;
+      if (b && typeof b.access_token === "string" && typeof b.token_endpoint === "string")
+        out[k] = b;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeStore(file, store) {
+  fs2.mkdirSync(path.dirname(file), { recursive: true });
+  fs2.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 384 });
+  try {
+    fs2.chmodSync(file, 384);
+  } catch {
+  }
+}
+function loadToken(server, file = tokensFile()) {
+  return readStore(file)[server] ?? null;
+}
+function saveToken(server, bundle, file = tokensFile()) {
+  const store = readStore(file);
+  store[server] = bundle;
+  writeStore(file, store);
+}
+function clearToken(server, file = tokensFile()) {
+  const store = readStore(file);
+  if (!(server in store))
+    return false;
+  delete store[server];
+  writeStore(file, store);
+  return true;
+}
+function defaultFetch() {
+  const f3 = globalThis.fetch;
+  if (typeof f3 !== "function")
+    throw new Error("global fetch unavailable \u2014 Node 18+ is required for MCP OAuth");
+  return f3;
+}
+async function getValidAccessToken(server, opts = {}) {
+  const file = opts.file ?? tokensFile();
+  const bundle = loadToken(server, file);
+  if (!bundle)
+    return null;
+  const fresh = !bundle.expires_at || bundle.expires_at - Date.now() > 6e4;
+  if (fresh || !bundle.refresh_token)
+    return bundle.access_token;
+  try {
+    const refreshed = await refreshAccessToken(bundle, opts.fetchImpl ?? defaultFetch());
+    saveToken(server, refreshed, file);
+    return refreshed.access_token;
+  } catch {
+    return bundle.access_token;
+  }
+}
+function parseResourceMetadataUrl(wwwAuthenticate) {
+  const m2 = /resource_metadata\s*=\s*"([^"]+)"/i.exec(wwwAuthenticate || "");
+  return m2 ? m2[1] : null;
+}
+function protectedResourceCandidates(serverUrl) {
+  const u = new URL(serverUrl);
+  const base = u.origin;
+  const p = u.pathname.replace(/\/$/, "");
+  return [
+    ...p ? [`${base}/.well-known/oauth-protected-resource${p}`] : [],
+    `${base}/.well-known/oauth-protected-resource`
+  ];
+}
+function authServerCandidates(authServer) {
+  const u = new URL(authServer);
+  const base = u.origin;
+  const p = u.pathname.replace(/\/$/, "");
+  const root = authServer.replace(/\/$/, "");
+  return [
+    `${base}/.well-known/oauth-authorization-server${p}`,
+    `${base}/.well-known/openid-configuration${p}`,
+    `${root}/.well-known/oauth-authorization-server`,
+    `${root}/.well-known/openid-configuration`
+  ];
+}
+function buildAuthorizeUrl(meta, p) {
+  const url = new URL(meta.authorization_endpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", p.clientId);
+  url.searchParams.set("redirect_uri", p.redirectUri);
+  url.searchParams.set("state", p.state);
+  url.searchParams.set("code_challenge", p.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("resource", meta.resource);
+  if (meta.scope)
+    url.searchParams.set("scope", meta.scope);
+  return url.toString();
+}
+function toBundle(data, p) {
+  const accessToken = data.access_token;
+  if (!accessToken)
+    throw new Error("Token response had no access_token");
+  const expiresIn = typeof data.expires_in === "number" ? data.expires_in : void 0;
+  return {
+    access_token: accessToken,
+    refresh_token: data.refresh_token ?? p.prevRefresh,
+    expires_at: expiresIn ? Date.now() + expiresIn * 1e3 : void 0,
+    token_endpoint: p.tokenEndpoint,
+    client_id: p.clientId,
+    client_secret: p.clientSecret,
+    resource: p.resource,
+    scope: data.scope ?? p.scope
+  };
+}
+async function fetchJsonSafe(f3, url) {
+  try {
+    const resp = await f3(url, { headers: { Accept: "application/json" } });
+    if (!resp.ok)
+      return null;
+    return await resp.json();
+  } catch {
+    return null;
+  }
+}
+async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
+  const origin = new URL(serverUrl).origin;
+  let authServer = null;
+  let resource = serverUrl;
+  let scope;
+  const prmCandidates = [parseResourceMetadataUrl(wwwAuthenticate), ...protectedResourceCandidates(serverUrl)].filter(
+    (u) => Boolean(u)
+  );
+  let prm = null;
+  for (const url of new Set(prmCandidates)) {
+    prm = await fetchJsonSafe(f3, url);
+    if (prm)
+      break;
+  }
+  if (prm) {
+    const servers = prm.authorization_servers;
+    if (Array.isArray(servers) && servers.length)
+      authServer = servers[0];
+    if (typeof prm.resource === "string")
+      resource = prm.resource;
+    const scopes = prm.scopes_supported;
+    if (Array.isArray(scopes) && scopes.length)
+      scope = scopes.join(" ");
+  }
+  if (!authServer)
+    authServer = origin;
+  let asm = null;
+  for (const url of authServerCandidates(authServer)) {
+    asm = await fetchJsonSafe(f3, url);
+    if (asm && asm.authorization_endpoint && asm.token_endpoint)
+      break;
+    asm = null;
+  }
+  if (!asm)
+    throw new Error(`No OAuth metadata found for authorization server ${authServer}`);
+  return {
+    authorization_endpoint: asm.authorization_endpoint,
+    token_endpoint: asm.token_endpoint,
+    registration_endpoint: asm.registration_endpoint,
+    resource,
+    scope
+  };
+}
+async function registerClient(meta, redirectUri, f3) {
+  if (!meta.registration_endpoint) {
+    throw new Error(
+      'Authorization server does not support dynamic client registration; a client_id must be configured manually \u2014 create an OAuth client for this server, then re-run `nex mcp login <server> --client-id <id> [--client-secret <secret>]` (or set "clientId" / "clientSecret" in its mcp.json entry).'
+    );
+  }
+  const resp = await f3(meta.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      client_name: "Nexrall Code CLI",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: meta.scope
+    })
+  });
+  if (!resp.ok)
+    throw new Error(`Client registration failed (HTTP ${resp.status})`);
+  const data = await resp.json();
+  if (!data.client_id)
+    throw new Error("Client registration returned no client_id");
+  return data.client_id;
+}
+async function postToken(tokenEndpoint, body, f3) {
+  const resp = await f3(tokenEndpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+    body: body.toString()
+  });
+  if (!resp.ok) {
+    const txt = await resp.text().catch(() => "");
+    throw new Error(`Token endpoint error (HTTP ${resp.status})${txt ? `: ${txt.slice(0, 200)}` : ""}`);
+  }
+  return await resp.json();
+}
+async function exchangeCode(meta, clientId, clientSecret, code, verifier, redirectUri, f3) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: clientId,
+    code_verifier: verifier,
+    resource: meta.resource
+  });
+  if (clientSecret)
+    body.set("client_secret", clientSecret);
+  const data = await postToken(meta.token_endpoint, body, f3);
+  return toBundle(data, {
+    tokenEndpoint: meta.token_endpoint,
+    clientId,
+    clientSecret,
+    resource: meta.resource,
+    scope: meta.scope
+  });
+}
+async function refreshAccessToken(bundle, f3) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: bundle.refresh_token,
+    client_id: bundle.client_id,
+    resource: bundle.resource
+  });
+  if (bundle.client_secret)
+    body.set("client_secret", bundle.client_secret);
+  const data = await postToken(bundle.token_endpoint, body, f3);
+  return toBundle(data, {
+    tokenEndpoint: bundle.token_endpoint,
+    clientId: bundle.client_id,
+    clientSecret: bundle.client_secret,
+    resource: bundle.resource,
+    scope: bundle.scope,
+    prevRefresh: bundle.refresh_token
+  });
+}
+function startLoopback() {
+  return new Promise((resolve19, reject) => {
+    let resolveCode;
+    let rejectCode;
+    const codePromise = new Promise((res, rej) => {
+      resolveCode = res;
+      rejectCode = rej;
+    });
+    codePromise.catch(() => void 0);
+    const server = http3.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+      res.end(
+        `<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:40px"><h2>${error || !code ? "Authentication failed" : "Authentication complete"}</h2><p>You can close this tab and return to the terminal.</p></body></html>`
+      );
+      if (error) {
+        rejectCode(new Error(`Authorization denied: ${error}`));
+        return;
+      }
+      if (!code) {
+        rejectCode(new Error("No authorization code in redirect"));
+        return;
+      }
+      resolveCode({ code, state });
+    });
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve19({
+        port,
+        waitForCode(expectedState) {
+          const timeout = setTimeout(
+            () => rejectCode(new Error("Timed out waiting for authorization")),
+            CALLBACK_TIMEOUT_MS
+          );
+          return codePromise.then(
+            ({ code, state }) => {
+              clearTimeout(timeout);
+              if (state !== expectedState)
+                throw new Error("OAuth state mismatch \u2014 possible CSRF, aborting");
+              return code;
+            },
+            // A denial must clear the timer too: otherwise `nex mcp login` reports the
+            // failure but the process sits on a 5-minute keep-alive before exiting.
+            (err) => {
+              clearTimeout(timeout);
+              throw err;
+            }
+          );
+        },
+        close() {
+          try {
+            server.closeAllConnections?.();
+          } catch {
+          }
+          try {
+            server.close();
+          } catch {
+          }
+        }
+      });
+    });
+  });
+}
+function b64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function openInBrowser(url) {
+  const win = process.platform === "win32";
+  const cmd = process.platform === "darwin" ? "open" : win ? "rundll32" : "xdg-open";
+  const args = win ? ["url.dll,FileProtocolHandler", url] : [url];
+  try {
+    const child = (0, import_proc.spawn)(cmd, args, { stdio: "ignore", detached: !win });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+async function probeAuthChallenge(serverUrl, f3 = defaultFetch()) {
+  const steps = [
+    {
+      method: "initialize",
+      params: {
+        protocolVersion: import_code_core.MCP_PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "nexrall-code", version: "1.0" }
+      }
+    },
+    { method: "tools/list", params: {} }
+  ];
+  for (const { method, params } of steps) {
+    try {
+      const resp = await f3(serverUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
+      });
+      const challenge = resp.headers?.get("www-authenticate") ?? "";
+      if (challenge)
+        return challenge;
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+async function authorizeServer(o) {
+  const f3 = o.fetchImpl ?? defaultFetch();
+  const challenge = o.wwwAuthenticate ?? await probeAuthChallenge(o.serverUrl, f3);
+  const meta = await discover(o.serverUrl, challenge, f3);
+  const scope = [meta.scope, (0, import_code_core.parseOAuthChallenge)(challenge).scope, o.extraScope].map((s2) => s2?.trim()).filter((s2) => Boolean(s2)).join(" ").split(/\s+/).filter((s2, i2, a) => Boolean(s2) && a.indexOf(s2) === i2).join(" ");
+  meta.scope = scope || void 0;
+  const loopback = await startLoopback();
+  const redirectUri = `http://127.0.0.1:${loopback.port}/callback`;
+  try {
+    const creds = o.credentials ?? {};
+    let clientId;
+    if (creds.clientId) {
+      clientId = creds.clientId;
+      o.onStep?.("Using the OAuth client configured for this server\u2026");
+    } else {
+      o.onStep?.(`Registering with ${new URL(meta.token_endpoint).origin}\u2026`);
+      clientId = await registerClient(meta, redirectUri, f3);
+    }
+    const verifier = b64url(crypto.randomBytes(32));
+    const challengeB64 = b64url(crypto.createHash("sha256").update(verifier).digest());
+    const state = b64url(crypto.randomBytes(16));
+    const authUrl = buildAuthorizeUrl(meta, { clientId, redirectUri, codeChallenge: challengeB64, state });
+    o.onStep?.("Opening your browser to authorize\u2026");
+    await o.openUrl(authUrl);
+    const code = await loopback.waitForCode(state);
+    const bundle = await exchangeCode(meta, clientId, creds.clientSecret, code, verifier, redirectUri, f3);
+    saveToken(o.server, bundle, o.file ?? tokensFile());
+  } finally {
+    loopback.close();
+  }
+}
+var isRemote = (cfg) => cfg.type === "http" || cfg.type === "sse" || !cfg.command && !!cfg.url;
+async function injectMcpTokens(config, opts = {}) {
+  const file = opts.file ?? tokensFile();
+  const injected = [];
+  for (const [name, cfg] of Object.entries(config.mcpServers ?? {})) {
+    if (!isRemote(cfg))
+      continue;
+    const hasAuth = cfg.headers && Object.keys(cfg.headers).some((h2) => h2.toLowerCase() === "authorization");
+    if (hasAuth)
+      continue;
+    let token;
+    try {
+      token = await getValidAccessToken(name, { file, fetchImpl: opts.fetchImpl });
+    } catch {
+      token = null;
+    }
+    if (!token)
+      continue;
+    cfg.headers = { ...cfg.headers ?? {}, Authorization: `Bearer ${token}` };
+    injected.push(name);
+  }
+  return injected;
+}
+
 // src/commands/auth.ts
+var AUTH_APP_URL = "https://app.nexrall.com";
+function browserAuthUrl() {
+  return `${AUTH_APP_URL}/auth/vscode?cli=1`;
+}
+function normalizeAuthCode(raw) {
+  const cleaned = raw.trim().replace(/^[`'"“”‘’]+|[`'"“”‘’]+$/g, "").trim();
+  const fromUrl = /[?&]code=([^&\s]+)/.exec(cleaned);
+  return fromUrl ? decodeURIComponent(fromUrl[1]) : cleaned.replace(/\s+/g, "");
+}
+function parseAuthMethod(input) {
+  const v = input.trim().toLowerCase();
+  if (v === "" || v === "1" || v === "b" || v === "browser")
+    return "browser";
+  if (v === "2" || v === "p" || v === "e" || v === "email" || v === "password")
+    return "password";
+  if (v === "3" || v === "t" || v === "token")
+    return "token";
+  return null;
+}
+function shouldOfferLogin(ctx) {
+  return ctx.isTTY && !ctx.headless;
+}
+function stripPasteMarkers(raw) {
+  return raw.replace(/\u001b\[[0-9;?]*[~A-Za-z]/g, "").replace(/\u001b/g, "");
+}
 function prompt(question, hidden = false) {
   return new Promise((resolve19) => {
     const rl = readline.createInterface({
@@ -79767,27 +80256,36 @@ function prompt(question, hidden = false) {
     if (hidden) {
       process.stdout.write(question);
       let value = "";
+      let finished = false;
       const { stdin } = process;
       const wasRaw = stdin.isRaw;
       stdin.setRawMode(true);
       stdin.resume();
       stdin.setEncoding("utf8");
-      const onData = (char) => {
-        if (char === "\n" || char === "\r" || char === "") {
-          stdin.setRawMode(wasRaw ?? false);
-          stdin.pause();
-          stdin.removeListener("data", onData);
-          rl.close();
-          process.stdout.write("\n");
-          if (char === "") {
-            process.exit(0);
-          }
-          resolve19(value);
-        } else if (char === "\x7F" || char === "\b") {
-          if (value.length > 0) {
-            value = value.slice(0, -1);
+      const finish = (submit) => {
+        if (finished)
+          return;
+        finished = true;
+        stdin.setRawMode(wasRaw ?? false);
+        stdin.pause();
+        stdin.removeListener("data", onData);
+        rl.close();
+        process.stdout.write("\n");
+        if (!submit)
+          process.exit(0);
+        resolve19(stripPasteMarkers(value));
+      };
+      const onData = (chunk) => {
+        for (const char of chunk) {
+          if (char === "\n" || char === "\r")
+            return finish(true);
+          if (char === "")
+            return finish(false);
+          if (char === "\x7F" || char === "\b") {
+            if (value.length > 0)
+              value = value.slice(0, -1);
+            continue;
           }
-        } else {
           value += char;
         }
       };
@@ -79800,12 +80298,12 @@ function prompt(question, hidden = false) {
     }
   });
 }
-async function authCommand() {
+async function authCommand(opts = {}) {
   console.log();
   console.log(paint.boldBlue("  Nexrall Code \u2014 Login"));
   console.log(paint.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
-  if ((0, import_code_core.isAuthenticated)()) {
+  if ((0, import_code_core2.isAuthenticated)() && !opts.token && !opts.code) {
     const overwrite = await prompt(paint.yellow("  Already logged in. Login again? ") + paint.dim("[y/n] > "));
     if (overwrite !== "y" && overwrite !== "yes") {
       console.log(paint.dim("  Cancelled."));
@@ -79813,21 +80311,90 @@ async function authCommand() {
     }
     console.log();
   }
+  if (opts.token)
+    return loginWithToken(opts.token);
+  if (opts.browser || opts.code)
+    return loginWithBrowser(opts.code);
+  if (opts.password)
+    return loginWithPassword();
+  if (!process.stdin.isTTY)
+    return loginWithPassword();
+  const method = await chooseMethod();
+  if (method === null) {
+    console.log(paint.dim("  Cancelled."));
+    return;
+  }
+  if (method === "browser")
+    return loginWithBrowser();
+  if (method === "token")
+    return loginWithTokenPrompt();
+  return loginWithPassword();
+}
+async function chooseMethod() {
+  console.log("  How do you want to sign in?");
+  console.log();
+  console.log(
+    `    ${paint.bold("1.")} Browser          ${paint.dim("Google, Apple, SSO or email + password \u2014 recommended")}`
+  );
+  console.log(`    ${paint.bold("2.")} Email + password ${paint.dim("typed here in the terminal")}`);
+  console.log(`    ${paint.bold("3.")} Token            ${paint.dim("CI / headless \u2014 paste a token")}`);
+  console.log();
+  for (; ; ) {
+    const answer = await prompt(paint.bold("  Choose ") + paint.dim("[1] > "));
+    const method = parseAuthMethod(answer);
+    if (method)
+      return method;
+    console.log(paint.yellow("  Pick 1, 2 or 3."));
+  }
+}
+async function loginWithBrowser(codeArg) {
+  let code = codeArg ? normalizeAuthCode(codeArg) : "";
+  if (!code) {
+    const url = browserAuthUrl();
+    openInBrowser(url);
+    console.log(paint.dim("  Opened: ") + paint.cyan(url));
+    console.log();
+    console.log("  Sign in there \u2014 Google, Apple, SSO or your password all work.");
+    console.log(paint.dim("  Copy the code the page shows, then paste it here."));
+    console.log();
+    code = normalizeAuthCode(await prompt(paint.bold("  Code ") + paint.dim("> ")));
+  }
+  if (!code) {
+    console.log(paint.red("  \u2717 No code entered."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  console.log();
+  const spinner = startSpinner("Signing in\u2026");
+  try {
+    const authConfig = await (0, import_code_core2.exchangeAuthCode)(code);
+    (0, import_code_core2.saveAuth)(authConfig);
+    stopSpinner(spinner);
+    console.log(paint.green("  \u2713 Logged in as ") + paint.bold(authConfig.email || "your account"));
+    await showBalance();
+    console.log();
+    console.log(paint.dim("  Run ") + paint.bold("nex") + paint.dim(" to start coding."));
+    console.log();
+  } catch (err) {
+    stopSpinner(spinner);
+    console.log();
+    console.log(paint.red("  \u2717 Login failed: ") + String(err.message));
+    console.log();
+    process.exitCode = 1;
+  }
+}
+async function loginWithPassword() {
   const email = await prompt(paint.bold("  Email    ") + paint.dim("> "));
   const password = await prompt(paint.bold("  Password ") + paint.dim("> "), true);
   console.log();
   const spinner = startSpinner("Logging in\u2026");
   try {
-    const authConfig = await (0, import_code_core.login)(email, password);
-    (0, import_code_core.saveAuth)(authConfig);
+    const authConfig = await (0, import_code_core2.login)(email, password);
+    (0, import_code_core2.saveAuth)(authConfig);
     stopSpinner(spinner);
     console.log(paint.green("  \u2713 Logged in as ") + paint.bold(authConfig.email ?? email));
-    console.log();
-    try {
-      const balance = await (0, import_code_core.getBalance)();
-      console.log(paint.dim("  Wallet balance: ") + paint.cyan(`$${balance.toFixed(4)}`));
-    } catch {
-    }
+    await showBalance();
     console.log();
     console.log(paint.dim("  Run ") + paint.bold("nex") + paint.dim(" to start coding."));
     console.log();
@@ -79836,12 +80403,71 @@ async function authCommand() {
     console.log();
     console.log(paint.red("  \u2717 Login failed: ") + String(err.message));
     console.log();
-    process.exit(1);
+    process.exitCode = 1;
   }
 }
+async function loginWithTokenPrompt() {
+  console.log(paint.dim("  Paste a token from the Nexrall dashboard."));
+  const token = await prompt(paint.bold("  Token    ") + paint.dim("> "), true);
+  if (!token) {
+    console.log(paint.red("  \u2717 No token entered."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  await loginWithToken(token);
+}
+async function loginWithToken(rawToken) {
+  const token = rawToken.trim();
+  if (!token) {
+    console.log(paint.red("  \u2717 Empty token."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  console.log();
+  const spinner = startSpinner("Checking the token\u2026");
+  const check2 = await (0, import_code_core2.checkToken)(token);
+  if (!check2.ok && check2.status !== 0) {
+    stopSpinner(spinner);
+    console.log();
+    console.log(paint.red(`  \u2717 The API refused this token (HTTP ${check2.status}).`) + paint.dim(" Nothing was saved."));
+    console.log();
+    process.exitCode = 1;
+    return;
+  }
+  (0, import_code_core2.saveAuth)({ token, ...check2.email ? { email: check2.email } : {} });
+  stopSpinner(spinner);
+  console.log(paint.green("  \u2713 Token saved") + (check2.email ? paint.dim(` for ${check2.email}`) : ""));
+  if (check2.status === 0) {
+    console.log(paint.yellow("    Could not reach the API to verify it \u2014 check the token once you are online."));
+  }
+  warnIfEnvTokenWins();
+  await showBalance();
+  console.log();
+}
+function warnIfEnvTokenWins() {
+  const envToken = process.env.NEXRALL_TOKEN?.trim();
+  if (!envToken)
+    return;
+  console.log(
+    paint.yellow("    NEXRALL_TOKEN is set in this shell and takes precedence over the saved login.") + paint.dim(" Unset it to use what you just saved.")
+  );
+}
+async function showBalance() {
+  try {
+    const balance = await (0, import_code_core2.getBalance)();
+    console.log(paint.dim("  Wallet balance: ") + paint.cyan(`$${balance.toFixed(4)}`));
+  } catch {
+  }
+}
+async function signOut() {
+  await (0, import_code_core2.revokeRefreshToken)();
+  (0, import_code_core2.clearAuth)();
+}
 async function logoutCommand() {
   console.log();
-  if (!(0, import_code_core.isAuthenticated)()) {
+  if (!(0, import_code_core2.isAuthenticated)()) {
     console.log(paint.dim("  Not logged in."));
     console.log();
     return;
@@ -79852,9 +80478,13 @@ async function logoutCommand() {
     console.log();
     return;
   }
-  await (0, import_code_core.revokeRefreshToken)();
-  (0, import_code_core.clearAuth)();
+  await signOut();
   console.log(paint.green("  \u2713 Logged out."));
+  if (process.env.NEXRALL_TOKEN?.trim()) {
+    console.log(
+      paint.yellow("    NEXRALL_TOKEN is still set in this shell") + paint.dim(" \u2014 unset it, or the CLI stays signed in with that token.")
+    );
+  }
   console.log();
 }
 function startSpinner(text) {
@@ -79873,12 +80503,12 @@ function stopSpinner(handle2) {
 }
 
 // src/commands/billing.ts
-var import_code_core2 = __toESM(require_dist2(), 1);
+var import_code_core3 = __toESM(require_dist2(), 1);
 function money(usd) {
   return "$" + usd.toFixed(2);
 }
 async function requireAuth() {
-  if ((0, import_code_core2.isAuthenticated)())
+  if ((0, import_code_core3.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   return false;
@@ -79888,7 +80518,7 @@ async function billingStatusCommand() {
     return;
   let orgs;
   try {
-    orgs = await (0, import_code_core2.getOrgs)();
+    orgs = await (0, import_code_core3.getOrgs)();
   } catch {
     console.log(paint.yellow("Could not read your billing target (offline, or a server without team support)."));
     return;
@@ -79920,7 +80550,7 @@ async function billingStatusCommand() {
     console.log("");
     console.log(paint.gray("Change it with `nex billing use <id>` or `nex billing use personal`."));
   }
-  const override = (0, import_code_core2.billingOverrideFields)();
+  const override = (0, import_code_core3.billingOverrideFields)();
   if ("teamId" in override) {
     console.log("");
     console.log(
@@ -79948,7 +80578,7 @@ async function billingUseCommand(target) {
 }
 async function applyTarget(teamId, label) {
   try {
-    await (0, import_code_core2.setBillingTarget)(teamId);
+    await (0, import_code_core3.setBillingTarget)(teamId);
   } catch (e2) {
     console.log(paint.red(e2.message));
     process.exitCode = 1;
@@ -79962,14 +80592,14 @@ async function applyTarget(teamId, label) {
 
 // src/commands/schedule.ts
 var import_prompts = __toESM(require_prompts3(), 1);
-var import_code_core4 = __toESM(require_dist2(), 1);
+var import_code_core5 = __toESM(require_dist2(), 1);
 
 // src/ui/scheduleLines.ts
-var import_code_core3 = __toESM(require_dist2(), 1);
+var import_code_core4 = __toESM(require_dist2(), 1);
 
 // src/commands/schedule.ts
 async function requireAuth2() {
-  if ((0, import_code_core4.isAuthenticated)())
+  if ((0, import_code_core5.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   process.exitCode = 1;
@@ -79990,7 +80620,7 @@ async function scheduleListCommand(opts = {}) {
     return;
   let list;
   try {
-    list = await (0, import_code_core4.listCloudSchedules)();
+    list = await (0, import_code_core5.listCloudSchedules)();
   } catch (e2) {
     fail(errText(e2));
     return;
@@ -79999,7 +80629,7 @@ async function scheduleListCommand(opts = {}) {
     console.log(JSON.stringify(list, null, 2));
     return;
   }
-  for (const line of (0, import_code_core3.scheduleListLines)(list, { cols: cols() }))
+  for (const line of (0, import_code_core4.scheduleListLines)(list, { cols: cols() }))
     console.log(line);
   if (list.length) {
     console.log(paint.dim(`
@@ -80019,7 +80649,7 @@ async function scheduleAddCommand(taskParts, opts) {
     fail("Missing --every. Usage: nex schedule add --every 1d <task>   (e.g. --every 2h)");
     return;
   }
-  const every = (0, import_code_core3.parseScheduleEvery)(everyRaw);
+  const every = (0, import_code_core4.parseScheduleEvery)(everyRaw);
   if ("error" in every) {
     fail(every.error);
     return;
@@ -80027,7 +80657,7 @@ async function scheduleAddCommand(taskParts, opts) {
   const domains = (opts.domains ?? "").split(",").map((d) => d.trim()).filter(Boolean);
   let s2;
   try {
-    s2 = await (0, import_code_core4.createCloudSchedule)({
+    s2 = await (0, import_code_core5.createCloudSchedule)({
       task,
       intervalMinutes: every.minutes,
       startUrl: opts.startUrl,
@@ -80039,12 +80669,12 @@ async function scheduleAddCommand(taskParts, opts) {
     return;
   }
   console.log(
-    `\u2714 Scheduled ${paint.bold(`#${s2.id}`)} \u2014 every ${(0, import_code_core3.formatEvery)(s2.intervalMinutes)}${s2.enabled ? "" : paint.yellow(" (paused)")}`
+    `\u2714 Scheduled ${paint.bold(`#${s2.id}`)} \u2014 every ${(0, import_code_core4.formatEvery)(s2.intervalMinutes)}${s2.enabled ? "" : paint.yellow(" (paused)")}`
   );
   console.log(`  ${s2.task}`);
   if (s2.nextRunAt) {
     console.log(
-      paint.dim(`  Next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)} \u2014 on Nexrall's servers; your laptop can be closed.`)
+      paint.dim(`  Next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)} \u2014 on Nexrall's servers; your laptop can be closed.`)
     );
   }
   console.log(paint.dim(`  History: nex schedule runs ${s2.id}   \xB7   Pause: nex schedule pause ${s2.id}`));
@@ -80057,8 +80687,8 @@ async function scheduleSetEnabled(id, enabled) {
     return;
   }
   try {
-    const s2 = await (0, import_code_core4.updateCloudSchedule)(id, { enabled });
-    const next = s2.nextRunAt ? paint.dim(` \u2014 next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)}`) : "";
+    const s2 = await (0, import_code_core5.updateCloudSchedule)(id, { enabled });
+    const next = s2.nextRunAt ? paint.dim(` \u2014 next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)}`) : "";
     console.log(`\u2714 Schedule #${s2.id} is now ${s2.enabled ? "on" : "paused"}${next}`);
   } catch (e2) {
     fail(errText(e2));
@@ -80079,7 +80709,7 @@ async function scheduleRunCommand(id) {
     return;
   }
   try {
-    const s2 = await (0, import_code_core4.runCloudScheduleNow)(clean);
+    const s2 = await (0, import_code_core5.runCloudScheduleNow)(clean);
     console.log(`\u2714 Schedule #${s2.id} armed \u2014 the cloud runner picks it up within ~60s.`);
     console.log(paint.dim(`  Result: nex schedule runs ${s2.id}`));
   } catch (e2) {
@@ -80113,7 +80743,7 @@ async function scheduleRemoveCommand(id, opts = {}) {
     }
   }
   try {
-    await (0, import_code_core4.deleteCloudSchedule)(clean);
+    await (0, import_code_core5.deleteCloudSchedule)(clean);
     console.log(`\u2714 Removed schedule #${clean}`);
   } catch (e2) {
     fail(errText(e2));
@@ -80129,7 +80759,7 @@ async function scheduleRunsCommand(id, opts = {}) {
   }
   let runs2;
   try {
-    runs2 = await (0, import_code_core4.getCloudScheduleRuns)(clean);
+    runs2 = await (0, import_code_core5.getCloudScheduleRuns)(clean);
   } catch (e2) {
     fail(errText(e2));
     return;
@@ -80138,7 +80768,7 @@ async function scheduleRunsCommand(id, opts = {}) {
     console.log(JSON.stringify(runs2, null, 2));
     return;
   }
-  for (const line of (0, import_code_core3.scheduleRunsLines)(runs2, { cols: cols() }))
+  for (const line of (0, import_code_core4.scheduleRunsLines)(runs2, { cols: cols() }))
     console.log(line);
   if (runs2.length) {
     console.log(
@@ -80151,10 +80781,10 @@ async function scheduleRunsCommand(id, opts = {}) {
 }
 
 // src/commands/cloud.ts
-var import_proc = __toESM(require_proc(), 1);
-var import_code_core5 = __toESM(require_dist2(), 1);
+var import_proc2 = __toESM(require_proc(), 1);
+var import_code_core6 = __toESM(require_dist2(), 1);
 async function requireAuth3() {
-  if ((0, import_code_core5.isAuthenticated)())
+  if ((0, import_code_core6.isAuthenticated)())
     return true;
   console.log(paint.red("Not logged in. Run `nex auth` first."));
   process.exitCode = 1;
@@ -80192,7 +80822,7 @@ function openUrl(url) {
   const cmd = process.platform === "darwin" ? "open" : win ? "rundll32" : "xdg-open";
   const args = win ? ["url.dll,FileProtocolHandler", url] : [url];
   try {
-    const child = (0, import_proc.spawn)(cmd, args, { stdio: "ignore", detached: !win });
+    const child = (0, import_proc2.spawn)(cmd, args, { stdio: "ignore", detached: !win });
     child.on("error", () => {
     });
     child.unref();
@@ -80224,7 +80854,7 @@ async function cloudRunCommand(taskParts, opts) {
   }
   let created;
   try {
-    created = await (0, import_code_core5.createCloudSession)({ repo: opts.repo, task, baseBranch: opts.base, pat: pat || void 0 });
+    created = await (0, import_code_core6.createCloudSession)({ repo: opts.repo, task, baseBranch: opts.base, pat: pat || void 0 });
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80243,7 +80873,7 @@ async function cloudListCommand(opts = {}) {
     return;
   let list;
   try {
-    list = await (0, import_code_core5.listCloudSessions)();
+    list = await (0, import_code_core6.listCloudSessions)();
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80251,7 +80881,7 @@ async function cloudListCommand(opts = {}) {
     console.log(JSON.stringify({ sessions: list }, null, 2));
     return;
   }
-  for (const line of (0, import_code_core5.cloudListLines)(list, { cols: cols2() }))
+  for (const line of (0, import_code_core6.cloudListLines)(list, { cols: cols2() }))
     console.log(`  ${line}`);
 }
 async function cloudLogsCommand(id, opts) {
@@ -80264,7 +80894,7 @@ async function cloudLogsCommand(id, opts) {
   if (!opts.follow) {
     let r2;
     try {
-      r2 = await (0, import_code_core5.getCloudSessionLogs)(id, tail ?? 300);
+      r2 = await (0, import_code_core6.getCloudSessionLogs)(id, tail ?? 300);
     } catch (e2) {
       return fail2(errText2(e2));
     }
@@ -80290,7 +80920,7 @@ async function cloudLogsCommand(id, opts) {
   for (; ; ) {
     let r2;
     try {
-      r2 = await (0, import_code_core5.getCloudSessionLogs)(id, tail ?? 1e3);
+      r2 = await (0, import_code_core6.getCloudSessionLogs)(id, tail ?? 1e3);
       consecutiveErrors = 0;
     } catch (e2) {
       const msg = errText2(e2);
@@ -80339,7 +80969,7 @@ async function cloudStopCommand(id) {
     return;
   let s2;
   try {
-    s2 = await (0, import_code_core5.stopCloudSession)(id);
+    s2 = await (0, import_code_core6.stopCloudSession)(id);
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80354,7 +80984,7 @@ async function cloudWatchCommand(id, opts = {}) {
     return;
   let s2;
   try {
-    s2 = await (0, import_code_core5.getCloudSession)(id);
+    s2 = await (0, import_code_core6.getCloudSession)(id);
   } catch (e2) {
     return fail2(errText2(e2));
   }
@@ -80524,11 +81154,11 @@ async function channelPushCommand(textParts, opts, deps = {}) {
 }
 
 // src/commands/usageCmd.ts
-import fs2 from "node:fs";
-import path from "node:path";
+import fs3 from "node:fs";
+import path2 from "node:path";
 
 // src/sessionEvents.ts
-var import_code_core6 = __toESM(require_dist2(), 1);
+var import_code_core7 = __toESM(require_dist2(), 1);
 
 // src/usageExport.ts
 var DURATION_RE = /^(\d+)([mhdw])$/;
@@ -80825,7 +81455,7 @@ var USAGE_FORMATS = ["json", "jsonl", "csv"];
 function logFileIds(dir) {
   let names;
   try {
-    names = fs2.readdirSync(dir);
+    names = fs3.readdirSync(dir);
   } catch {
     return [];
   }
@@ -80835,7 +81465,7 @@ function readRows(file) {
   const rows = [];
   let text;
   try {
-    text = fs2.readFileSync(file, "utf8");
+    text = fs3.readFileSync(file, "utf8");
   } catch {
     return rows;
   }
@@ -80883,13 +81513,13 @@ function usageExportCommand(opts, deps = {}) {
     }
     limit = n;
   }
-  const dir = deps.eventsDirPath ?? (0, import_code_core6.eventsDir)(deps.env ?? process.env);
+  const dir = deps.eventsDirPath ?? (0, import_code_core7.eventsDir)(deps.env ?? process.env);
   const ids = logFileIds(dir);
   const acc = createAccumulator({ since, until });
   acc.filesTotal = ids.length;
   let candidates = ids;
   if (opts.session) {
-    const wanted = (0, import_code_core6.safeId)(opts.session);
+    const wanted = (0, import_code_core7.safeId)(opts.session);
     if (!candidates.includes(wanted)) {
       stderr(paint.red(`Session not found: ${opts.session}`));
       stderr(paint.dim(`  Logs live in ${dir} (one .jsonl per session).`));
@@ -80900,7 +81530,7 @@ function usageExportCommand(opts, deps = {}) {
   if (since !== void 0) {
     candidates = candidates.filter((id) => {
       try {
-        return fs2.statSync(path.join(dir, `${id}.jsonl`)).mtimeMs >= since;
+        return fs3.statSync(path2.join(dir, `${id}.jsonl`)).mtimeMs >= since;
       } catch {
         return false;
       }
@@ -80908,7 +81538,7 @@ function usageExportCommand(opts, deps = {}) {
   }
   const byNewest = candidates.map((id) => {
     try {
-      return { id, mtime: fs2.statSync(path.join(dir, `${id}.jsonl`)).mtimeMs };
+      return { id, mtime: fs3.statSync(path2.join(dir, `${id}.jsonl`)).mtimeMs };
     } catch {
       return { id, mtime: 0 };
     }
@@ -80917,7 +81547,7 @@ function usageExportCommand(opts, deps = {}) {
   acc.truncated = taken.length < byNewest.length;
   for (const { id } of taken) {
     acc.filesRead += 1;
-    addSessionFile(acc, id, readRows(path.join(dir, `${id}.jsonl`)));
+    addSessionFile(acc, id, readRows(path2.join(dir, `${id}.jsonl`)));
   }
   const report = finalizeUsage(acc, now);
   let content;
@@ -80929,7 +81559,7 @@ function usageExportCommand(opts, deps = {}) {
     content = formatUsageJson(report);
   if (opts.out) {
     try {
-      fs2.writeFileSync(opts.out, content);
+      fs3.writeFileSync(opts.out, content);
     } catch (e2) {
       stderr(paint.red(`Could not write ${opts.out}: ${e2.message}`));
       return USAGE_EXIT.FAIL;
@@ -80963,7 +81593,7 @@ import * as path27 from "path";
 import * as fs26 from "fs";
 
 // src/ui/diffView.ts
-var import_code_core7 = __toESM(require_dist2(), 1);
+var import_code_core8 = __toESM(require_dist2(), 1);
 function paintLine(l) {
   switch (l.kind) {
     case "file":
@@ -80984,433 +81614,7 @@ function paintLine(l) {
 }
 
 // src/ui/reviewQueue.ts
-var import_code_core8 = __toESM(require_dist2(), 1);
-
-// src/mcp/oauth.ts
-var import_proc2 = __toESM(require_proc(), 1);
 var import_code_core9 = __toESM(require_dist2(), 1);
-import * as fs3 from "fs";
-import * as os2 from "os";
-import * as path2 from "path";
-import * as http3 from "http";
-import * as crypto from "crypto";
-var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
-function tokensFile(env3 = process.env) {
-  return env3.NEXRALL_MCP_AUTH_FILE || path2.join(os2.homedir(), ".nexrall", "mcp-auth.json");
-}
-function readStore(file) {
-  try {
-    const parsed = JSON.parse(fs3.readFileSync(file, "utf-8"));
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-      return {};
-    const out = {};
-    for (const [k, v] of Object.entries(parsed)) {
-      const b = v;
-      if (b && typeof b.access_token === "string" && typeof b.token_endpoint === "string")
-        out[k] = b;
-    }
-    return out;
-  } catch {
-    return {};
-  }
-}
-function writeStore(file, store) {
-  fs3.mkdirSync(path2.dirname(file), { recursive: true });
-  fs3.writeFileSync(file, JSON.stringify(store, null, 2), { mode: 384 });
-  try {
-    fs3.chmodSync(file, 384);
-  } catch {
-  }
-}
-function loadToken(server, file = tokensFile()) {
-  return readStore(file)[server] ?? null;
-}
-function saveToken(server, bundle, file = tokensFile()) {
-  const store = readStore(file);
-  store[server] = bundle;
-  writeStore(file, store);
-}
-function clearToken(server, file = tokensFile()) {
-  const store = readStore(file);
-  if (!(server in store))
-    return false;
-  delete store[server];
-  writeStore(file, store);
-  return true;
-}
-function defaultFetch() {
-  const f3 = globalThis.fetch;
-  if (typeof f3 !== "function")
-    throw new Error("global fetch unavailable \u2014 Node 18+ is required for MCP OAuth");
-  return f3;
-}
-async function getValidAccessToken(server, opts = {}) {
-  const file = opts.file ?? tokensFile();
-  const bundle = loadToken(server, file);
-  if (!bundle)
-    return null;
-  const fresh = !bundle.expires_at || bundle.expires_at - Date.now() > 6e4;
-  if (fresh || !bundle.refresh_token)
-    return bundle.access_token;
-  try {
-    const refreshed = await refreshAccessToken(bundle, opts.fetchImpl ?? defaultFetch());
-    saveToken(server, refreshed, file);
-    return refreshed.access_token;
-  } catch {
-    return bundle.access_token;
-  }
-}
-function parseResourceMetadataUrl(wwwAuthenticate) {
-  const m2 = /resource_metadata\s*=\s*"([^"]+)"/i.exec(wwwAuthenticate || "");
-  return m2 ? m2[1] : null;
-}
-function protectedResourceCandidates(serverUrl) {
-  const u = new URL(serverUrl);
-  const base = u.origin;
-  const p = u.pathname.replace(/\/$/, "");
-  return [
-    ...p ? [`${base}/.well-known/oauth-protected-resource${p}`] : [],
-    `${base}/.well-known/oauth-protected-resource`
-  ];
-}
-function authServerCandidates(authServer) {
-  const u = new URL(authServer);
-  const base = u.origin;
-  const p = u.pathname.replace(/\/$/, "");
-  const root = authServer.replace(/\/$/, "");
-  return [
-    `${base}/.well-known/oauth-authorization-server${p}`,
-    `${base}/.well-known/openid-configuration${p}`,
-    `${root}/.well-known/oauth-authorization-server`,
-    `${root}/.well-known/openid-configuration`
-  ];
-}
-function buildAuthorizeUrl(meta, p) {
-  const url = new URL(meta.authorization_endpoint);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", p.clientId);
-  url.searchParams.set("redirect_uri", p.redirectUri);
-  url.searchParams.set("state", p.state);
-  url.searchParams.set("code_challenge", p.codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("resource", meta.resource);
-  if (meta.scope)
-    url.searchParams.set("scope", meta.scope);
-  return url.toString();
-}
-function toBundle(data, p) {
-  const accessToken = data.access_token;
-  if (!accessToken)
-    throw new Error("Token response had no access_token");
-  const expiresIn = typeof data.expires_in === "number" ? data.expires_in : void 0;
-  return {
-    access_token: accessToken,
-    refresh_token: data.refresh_token ?? p.prevRefresh,
-    expires_at: expiresIn ? Date.now() + expiresIn * 1e3 : void 0,
-    token_endpoint: p.tokenEndpoint,
-    client_id: p.clientId,
-    client_secret: p.clientSecret,
-    resource: p.resource,
-    scope: data.scope ?? p.scope
-  };
-}
-async function fetchJsonSafe(f3, url) {
-  try {
-    const resp = await f3(url, { headers: { Accept: "application/json" } });
-    if (!resp.ok)
-      return null;
-    return await resp.json();
-  } catch {
-    return null;
-  }
-}
-async function discover(serverUrl, wwwAuthenticate, f3 = defaultFetch()) {
-  const origin = new URL(serverUrl).origin;
-  let authServer = null;
-  let resource = serverUrl;
-  let scope;
-  const prmCandidates = [parseResourceMetadataUrl(wwwAuthenticate), ...protectedResourceCandidates(serverUrl)].filter(
-    (u) => Boolean(u)
-  );
-  let prm = null;
-  for (const url of new Set(prmCandidates)) {
-    prm = await fetchJsonSafe(f3, url);
-    if (prm)
-      break;
-  }
-  if (prm) {
-    const servers = prm.authorization_servers;
-    if (Array.isArray(servers) && servers.length)
-      authServer = servers[0];
-    if (typeof prm.resource === "string")
-      resource = prm.resource;
-    const scopes = prm.scopes_supported;
-    if (Array.isArray(scopes) && scopes.length)
-      scope = scopes.join(" ");
-  }
-  if (!authServer)
-    authServer = origin;
-  let asm = null;
-  for (const url of authServerCandidates(authServer)) {
-    asm = await fetchJsonSafe(f3, url);
-    if (asm && asm.authorization_endpoint && asm.token_endpoint)
-      break;
-    asm = null;
-  }
-  if (!asm)
-    throw new Error(`No OAuth metadata found for authorization server ${authServer}`);
-  return {
-    authorization_endpoint: asm.authorization_endpoint,
-    token_endpoint: asm.token_endpoint,
-    registration_endpoint: asm.registration_endpoint,
-    resource,
-    scope
-  };
-}
-async function registerClient(meta, redirectUri, f3) {
-  if (!meta.registration_endpoint) {
-    throw new Error(
-      'Authorization server does not support dynamic client registration; a client_id must be configured manually \u2014 create an OAuth client for this server, then re-run `nex mcp login <server> --client-id <id> [--client-secret <secret>]` (or set "clientId" / "clientSecret" in its mcp.json entry).'
-    );
-  }
-  const resp = await f3(meta.registration_endpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      client_name: "Nexrall Code CLI",
-      redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      token_endpoint_auth_method: "none",
-      scope: meta.scope
-    })
-  });
-  if (!resp.ok)
-    throw new Error(`Client registration failed (HTTP ${resp.status})`);
-  const data = await resp.json();
-  if (!data.client_id)
-    throw new Error("Client registration returned no client_id");
-  return data.client_id;
-}
-async function postToken(tokenEndpoint, body, f3) {
-  const resp = await f3(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
-    body: body.toString()
-  });
-  if (!resp.ok) {
-    const txt = await resp.text().catch(() => "");
-    throw new Error(`Token endpoint error (HTTP ${resp.status})${txt ? `: ${txt.slice(0, 200)}` : ""}`);
-  }
-  return await resp.json();
-}
-async function exchangeCode(meta, clientId, clientSecret, code, verifier, redirectUri, f3) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code,
-    redirect_uri: redirectUri,
-    client_id: clientId,
-    code_verifier: verifier,
-    resource: meta.resource
-  });
-  if (clientSecret)
-    body.set("client_secret", clientSecret);
-  const data = await postToken(meta.token_endpoint, body, f3);
-  return toBundle(data, {
-    tokenEndpoint: meta.token_endpoint,
-    clientId,
-    clientSecret,
-    resource: meta.resource,
-    scope: meta.scope
-  });
-}
-async function refreshAccessToken(bundle, f3) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: bundle.refresh_token,
-    client_id: bundle.client_id,
-    resource: bundle.resource
-  });
-  if (bundle.client_secret)
-    body.set("client_secret", bundle.client_secret);
-  const data = await postToken(bundle.token_endpoint, body, f3);
-  return toBundle(data, {
-    tokenEndpoint: bundle.token_endpoint,
-    clientId: bundle.client_id,
-    clientSecret: bundle.client_secret,
-    resource: bundle.resource,
-    scope: bundle.scope,
-    prevRefresh: bundle.refresh_token
-  });
-}
-function startLoopback() {
-  return new Promise((resolve19, reject) => {
-    let resolveCode;
-    let rejectCode;
-    const codePromise = new Promise((res, rej) => {
-      resolveCode = res;
-      rejectCode = rej;
-    });
-    codePromise.catch(() => void 0);
-    const server = http3.createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const code = url.searchParams.get("code");
-      const state = url.searchParams.get("state");
-      const error = url.searchParams.get("error");
-      res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-      res.end(
-        `<!doctype html><html><body style="font-family:system-ui;text-align:center;padding:40px"><h2>${error || !code ? "Authentication failed" : "Authentication complete"}</h2><p>You can close this tab and return to the terminal.</p></body></html>`
-      );
-      if (error) {
-        rejectCode(new Error(`Authorization denied: ${error}`));
-        return;
-      }
-      if (!code) {
-        rejectCode(new Error("No authorization code in redirect"));
-        return;
-      }
-      resolveCode({ code, state });
-    });
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      resolve19({
-        port,
-        waitForCode(expectedState) {
-          const timeout = setTimeout(
-            () => rejectCode(new Error("Timed out waiting for authorization")),
-            CALLBACK_TIMEOUT_MS
-          );
-          return codePromise.then(
-            ({ code, state }) => {
-              clearTimeout(timeout);
-              if (state !== expectedState)
-                throw new Error("OAuth state mismatch \u2014 possible CSRF, aborting");
-              return code;
-            },
-            // A denial must clear the timer too: otherwise `nex mcp login` reports the
-            // failure but the process sits on a 5-minute keep-alive before exiting.
-            (err) => {
-              clearTimeout(timeout);
-              throw err;
-            }
-          );
-        },
-        close() {
-          try {
-            server.closeAllConnections?.();
-          } catch {
-          }
-          try {
-            server.close();
-          } catch {
-          }
-        }
-      });
-    });
-  });
-}
-function b64url(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function openInBrowser(url) {
-  const win = process.platform === "win32";
-  const cmd = process.platform === "darwin" ? "open" : win ? "rundll32" : "xdg-open";
-  const args = win ? ["url.dll,FileProtocolHandler", url] : [url];
-  try {
-    const child = (0, import_proc2.spawn)(cmd, args, { stdio: "ignore", detached: !win });
-    child.on("error", () => void 0);
-    child.unref();
-  } catch {
-  }
-}
-async function probeAuthChallenge(serverUrl, f3 = defaultFetch()) {
-  const steps = [
-    {
-      method: "initialize",
-      params: {
-        protocolVersion: import_code_core9.MCP_PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: "nexrall-code", version: "1.0" }
-      }
-    },
-    { method: "tools/list", params: {} }
-  ];
-  for (const { method, params } of steps) {
-    try {
-      const resp = await f3(serverUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream" },
-        body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params })
-      });
-      const challenge = resp.headers?.get("www-authenticate") ?? "";
-      if (challenge)
-        return challenge;
-    } catch {
-      return "";
-    }
-  }
-  return "";
-}
-async function authorizeServer(o) {
-  const f3 = o.fetchImpl ?? defaultFetch();
-  const challenge = o.wwwAuthenticate ?? await probeAuthChallenge(o.serverUrl, f3);
-  const meta = await discover(o.serverUrl, challenge, f3);
-  const scope = [meta.scope, (0, import_code_core9.parseOAuthChallenge)(challenge).scope, o.extraScope].map((s2) => s2?.trim()).filter((s2) => Boolean(s2)).join(" ").split(/\s+/).filter((s2, i2, a) => Boolean(s2) && a.indexOf(s2) === i2).join(" ");
-  meta.scope = scope || void 0;
-  const loopback = await startLoopback();
-  const redirectUri = `http://127.0.0.1:${loopback.port}/callback`;
-  try {
-    const creds = o.credentials ?? {};
-    let clientId;
-    if (creds.clientId) {
-      clientId = creds.clientId;
-      o.onStep?.("Using the OAuth client configured for this server\u2026");
-    } else {
-      o.onStep?.(`Registering with ${new URL(meta.token_endpoint).origin}\u2026`);
-      clientId = await registerClient(meta, redirectUri, f3);
-    }
-    const verifier = b64url(crypto.randomBytes(32));
-    const challengeB64 = b64url(crypto.createHash("sha256").update(verifier).digest());
-    const state = b64url(crypto.randomBytes(16));
-    const authUrl = buildAuthorizeUrl(meta, { clientId, redirectUri, codeChallenge: challengeB64, state });
-    o.onStep?.("Opening your browser to authorize\u2026");
-    await o.openUrl(authUrl);
-    const code = await loopback.waitForCode(state);
-    const bundle = await exchangeCode(meta, clientId, creds.clientSecret, code, verifier, redirectUri, f3);
-    saveToken(o.server, bundle, o.file ?? tokensFile());
-  } finally {
-    loopback.close();
-  }
-}
-var isRemote = (cfg) => cfg.type === "http" || cfg.type === "sse" || !cfg.command && !!cfg.url;
-async function injectMcpTokens(config, opts = {}) {
-  const file = opts.file ?? tokensFile();
-  const injected = [];
-  for (const [name, cfg] of Object.entries(config.mcpServers ?? {})) {
-    if (!isRemote(cfg))
-      continue;
-    const hasAuth = cfg.headers && Object.keys(cfg.headers).some((h2) => h2.toLowerCase() === "authorization");
-    if (hasAuth)
-      continue;
-    let token;
-    try {
-      token = await getValidAccessToken(name, { file, fetchImpl: opts.fetchImpl });
-    } catch {
-      token = null;
-    }
-    if (!token)
-      continue;
-    cfg.headers = { ...cfg.headers ?? {}, Authorization: `Bearer ${token}` };
-    injected.push(name);
-  }
-  return injected;
-}
 
 // src/commands/mcpCmd.ts
 var import_code_core10 = __toESM(require_dist2(), 1);
@@ -82477,7 +82681,7 @@ function classify(err, opts) {
     return {
       kind: "auth",
       title: "Not signed in",
-      hints: ["Run `nexrall-code login` to sign in again", "Your session keeps its place: /resume picks it back up"]
+      hints: ["Run `nex auth` to sign in again", "Your session keeps its place: /resume picks it back up"]
     };
   }
   if (status === 429 || RATE_RE.test(msg)) {
@@ -87980,7 +88184,7 @@ function knownSessionIds() {
     }
   };
   add(SESSIONS_DIR, ".json");
-  add((0, import_code_core6.eventsDir)(), ".jsonl");
+  add((0, import_code_core7.eventsDir)(), ".jsonl");
   return [...ids];
 }
 function findSessionsByLink(link2) {
@@ -88053,7 +88257,7 @@ function deleteSession(id) {
     return false;
   }
   try {
-    fs12.unlinkSync((0, import_code_core6.eventsPath)(r2.id));
+    fs12.unlinkSync((0, import_code_core7.eventsPath)(r2.id));
   } catch {
   }
   return true;
@@ -88087,7 +88291,7 @@ function exportSession(id, events) {
     version: 1,
     exportedAt: Date.now(),
     session,
-    events: events ?? (0, import_code_core6.readEvents)(r2.id)
+    events: events ?? (0, import_code_core7.readEvents)(r2.id)
   };
   return JSON.stringify(bundle, null, 2);
 }
@@ -88129,7 +88333,7 @@ function importSession(bundle) {
     renamed = true;
   }
   saveSession(id, title, bundle.session.workDir || process.cwd(), bundle.session.messages);
-  (0, import_code_core6.writeEvents)(id, bundle.events);
+  (0, import_code_core7.writeEvents)(id, bundle.events);
   return { id, messages: bundle.session.messages.length, renamed };
 }
 
@@ -98327,6 +98531,11 @@ var BUILTIN_SLASH_COMMANDS = [
     kind: "builtin"
   },
   { name: "cost", description: "Where the tokens and money went (per model, per agent, per turn)", kind: "builtin" },
+  {
+    name: "logout",
+    description: "Sign out on this machine (revokes the saved refresh token)",
+    kind: "builtin"
+  },
   {
     name: "stats",
     description: "Usage across sessions: activity by day, tokens and models (local event logs)",
@@ -103881,7 +104090,7 @@ function scanRecentSkillEvents(dir, maxFiles = DOCTOR_SESSION_WINDOW) {
   const out = [];
   for (const { full } of withTime.slice(0, maxFiles)) {
     try {
-      out.push((0, import_code_core6.readEvents)("", { file: full }));
+      out.push((0, import_code_core7.readEvents)("", { file: full }));
     } catch {
     }
   }
@@ -105429,7 +105638,7 @@ function emitEvent(type, data = {}) {
 }
 function startSessionLog(id, resumed, extra = {}) {
   const previous = liveSessionId;
-  sessionLog = (0, import_code_core6.eventsEnabled)() ? new import_code_core6.EventLog(id) : null;
+  sessionLog = (0, import_code_core7.eventsEnabled)() ? new import_code_core7.EventLog(id) : null;
   liveSessionId = id;
   if (previous && previous !== id)
     (0, import_code_core22.rebindSessionShare)(id);
@@ -105774,7 +105983,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
       emitEvent("tool.started", {
         name,
         sub: !!isSubTask,
-        target: name === "use_skill" && typeof input.name === "string" ? input.name : (0, import_code_core6.toolTarget)(name, input)
+        target: name === "use_skill" && typeof input.name === "string" ? input.name : (0, import_code_core7.toolTarget)(name, input)
       });
       if (!isSubTask)
         sessionToolCalls++;
@@ -105827,7 +106036,7 @@ async function runTurn(messages, modelAlias, workDir, abortSignal, env3, nexrall
         const changed = noteToolResult(turnStats, tracked?.name ?? name, tracked?.input, cmdOk);
         for (const t2 of changed)
           failureLedger.noteEdit(t2);
-        for (const t2 of changed.slice(0, import_code_core6.MAX_FILE_EVENTS))
+        for (const t2 of changed.slice(0, import_code_core7.MAX_FILE_EVENTS))
           emitEvent("file.changed", { path: t2 });
       }
       if (!isSubTask && tracked?.command)
@@ -106169,7 +106378,7 @@ async function runTurnHeadless(messages, modelAlias, workDir, _abortSignal, env3
     onToolUse: (name, input, isSubTask, meta) => {
       debugLog("tool_use", { tool: name, sub: !!isSubTask });
       emit({ type: "tool_use", tool: name, input, ...toolIds(isSubTask, meta) });
-      verbose(`[verbose] -> ${name}${isSubTask ? " (sub-agent)" : ""} ${(0, import_code_core6.toolTarget)(name, input)}`);
+      verbose(`[verbose] -> ${name}${isSubTask ? " (sub-agent)" : ""} ${(0, import_code_core7.toolTarget)(name, input)}`);
     },
     // Live bash progress for scripted/CI consumers — lets a wrapper tail a
     // long-running build/test command instead of blocking silently until
@@ -106449,6 +106658,7 @@ function printHelp() {
     ["/yolo", "Auto-approve all permissions"],
     ["/balance", "Show what is paying (personal wallet or team) and what is left"],
     ["/team [use <id|personal>]", "List your teams, or switch what usage is billed to"],
+    ["/logout", "Sign out on this machine (revokes the saved refresh token)"],
     ["/cost [--all]", "Cost and tokens: per model, per sub-agent, per turn (/balance shows the wallet)"],
     ["/stats", "Usage across sessions: activity by day, tokens and models (local event logs)"],
     [
@@ -107165,7 +107375,7 @@ Resume it with: nex --worktree ${worktreeState.name}
       console.log(paint.green(`  Resumed session: ${paint.bold(stored.title.slice(0, 60))}`));
       console.log(paint.dim(`  ${messages.length} messages restored`));
       if (autoRecap) {
-        const recap = (0, import_code_core33.buildRecap)((0, import_code_core6.readEvents)(stored.id, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
+        const recap = (0, import_code_core33.buildRecap)((0, import_code_core7.readEvents)(stored.id, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
         if (recap)
           console.log(paint.dim(`  Recap: ${recap}`));
       }
@@ -109005,6 +109215,26 @@ ${dirList}`;
           rl.prompt();
           return;
         }
+        case "/logout": {
+          const answer = await new Promise(
+            (resolve19) => rl.question(paint.yellow("  Sign out on this machine? ") + paint.dim("[y/n] "), (a) => resolve19(a.trim()))
+          );
+          if (answer !== "y" && answer !== "yes") {
+            console.log(paint.dim("  Cancelled."));
+            rl.prompt();
+            return;
+          }
+          await signOut();
+          console.log(paint.green("  \u2713 Logged out."));
+          if (process.env.NEXRALL_TOKEN?.trim()) {
+            console.log(
+              paint.yellow("    NEXRALL_TOKEN is still set in this shell") + paint.dim(" \u2014 unset it, or the CLI stays signed in with that token.")
+            );
+          }
+          console.log(paint.dim("  Run `nex auth` (in any terminal) to sign in again; this session picks it up."));
+          rl.prompt();
+          return;
+        }
         case "/cost": {
           const parsed = parseCostArgs(arg);
           if ("error" in parsed) {
@@ -109067,14 +109297,14 @@ ${dirList}`;
           return;
         }
         case "/recap": {
-          if (!(0, import_code_core6.eventsEnabled)()) {
+          if (!(0, import_code_core7.eventsEnabled)()) {
             console.log(
               paint.dim("  Events are off for this run (NEXRALL_EVENTS=off), so there is nothing to read back.")
             );
             rl.prompt();
             return;
           }
-          const recap = (0, import_code_core33.buildRecap)((0, import_code_core6.readEvents)(sessionId, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
+          const recap = (0, import_code_core33.buildRecap)((0, import_code_core7.readEvents)(sessionId, { last: import_code_core33.RECAP_EVENT_WINDOW }), { now: Date.now() });
           console.log();
           if (recap)
             console.log(`  ${paint.bold("Recap: ")}${recap}`);
@@ -109638,11 +109868,11 @@ ${dirList}`;
             return;
           }
           if (!(0, import_code_core64.getToken)()) {
-            console.log(paint.yellow("  Sign in first (`nex login`) \u2014 watching uses your Nexrall account."));
+            console.log(paint.yellow("  Sign in first (`nex auth`) \u2014 watching uses your Nexrall account."));
             rl.prompt();
             return;
           }
-          if (!(0, import_code_core6.eventsEnabled)()) {
+          if (!(0, import_code_core7.eventsEnabled)()) {
             console.log(
               paint.yellow("  Sharing follows the event stream, and this run has it off (NEXRALL_EVENTS=off).")
             );
@@ -109746,7 +109976,7 @@ ${dirList}`;
             }
             if (!(0, import_code_core64.getToken)()) {
               console.log(
-                paint.yellow("  Sign in first (`nex login`) \u2014 pushes find this session through your account.")
+                paint.yellow("  Sign in first (`nex auth`) \u2014 pushes find this session through your account.")
               );
               rl.prompt();
               return;
@@ -109817,7 +110047,7 @@ ${dirList}`;
         }
         case "/schedule":
         case "/routines": {
-          const action = (0, import_code_core3.parseScheduleChatArg)(arg);
+          const action = (0, import_code_core4.parseScheduleChatArg)(arg);
           if (action.kind === "error") {
             console.log(paint.yellow("  " + action.message));
             rl.prompt();
@@ -109828,7 +110058,7 @@ ${dirList}`;
             const panelCols = Math.max(60, (process.stdout.columns || 100) - 2);
             if (action.kind === "list") {
               const list = await (0, import_code_core63.listCloudSchedules)();
-              for (const l of (0, import_code_core3.scheduleListLines)(list, { cols: panelCols }))
+              for (const l of (0, import_code_core4.scheduleListLines)(list, { cols: panelCols }))
                 console.log("  " + l);
               if (list.length)
                 console.log(
@@ -109838,7 +110068,7 @@ ${dirList}`;
               const s2 = await (0, import_code_core63.createCloudSchedule)({ task: action.task, intervalMinutes: action.intervalMinutes });
               console.log(
                 paint.green(
-                  `  \u2713 Scheduled #${s2.id} \u2014 every ${(0, import_code_core3.formatEvery)(s2.intervalMinutes)}${s2.nextRunAt ? `, next run ${(0, import_code_core3.fmtScheduleWhen)(s2.nextRunAt)}` : ""}.`
+                  `  \u2713 Scheduled #${s2.id} \u2014 every ${(0, import_code_core4.formatEvery)(s2.intervalMinutes)}${s2.nextRunAt ? `, next run ${(0, import_code_core4.fmtScheduleWhen)(s2.nextRunAt)}` : ""}.`
                 )
               );
               console.log(
@@ -109856,7 +110086,7 @@ ${dirList}`;
               console.log(paint.dim(`  Removed schedule #${action.id} \u2014 no further runs fire.`));
             } else {
               const runs2 = await (0, import_code_core63.getCloudScheduleRuns)(action.id);
-              for (const l of (0, import_code_core3.scheduleRunsLines)(runs2, { cols: panelCols }))
+              for (const l of (0, import_code_core4.scheduleRunsLines)(runs2, { cols: panelCols }))
                 console.log("  " + l);
             }
           } catch (err) {
@@ -110074,7 +110304,7 @@ ${dirList}`;
           };
           const want = arg.trim();
           if (want) {
-            const hit = (0, import_code_core7.findFiles)(files, want);
+            const hit = (0, import_code_core8.findFiles)(files, want);
             if (!hit.length)
               console.log(paint.dim(`  No changed file matches "${want}".  (/diff lists them all)`));
             else if (hit.length > 1) {
@@ -110083,14 +110313,14 @@ ${dirList}`;
                 console.log("  " + f3.path);
             } else {
               verification.noteDiffReviewed();
-              out((0, import_code_core7.capLines)((0, import_code_core7.renderFile)(hit[0], { foldHunks: false })));
+              out((0, import_code_core8.capLines)((0, import_code_core8.renderFile)(hit[0], { foldHunks: false })));
             }
           } else {
             console.log(paint.bold("  Uncommitted changes"));
-            out((0, import_code_core7.summaryLines)(files));
+            out((0, import_code_core8.summaryLines)(files));
             console.log();
             verification.noteDiffReviewed();
-            out((0, import_code_core7.renderAll)(files));
+            out((0, import_code_core8.renderAll)(files));
           }
           rl.prompt();
           return;
@@ -110111,7 +110341,7 @@ ${dirList}`;
           const emit = (line) => console.log(truncateCells(line, cols3));
           const want = arg.replace(/(^|\s)--all(?=\s|$)/, " ").trim();
           if (want) {
-            const hit = (0, import_code_core7.findFiles)(files, want);
+            const hit = (0, import_code_core8.findFiles)(files, want);
             if (!hit.length)
               emit(paint.dim(`  No changed file matches "${want}".  (/review lists them all)`));
             else if (hit.length > 1) {
@@ -110119,14 +110349,14 @@ ${dirList}`;
               for (const f3 of hit.slice(0, 10))
                 emit("  " + f3.path);
             } else {
-              const ctx = { tests: files.filter((x2) => (0, import_code_core8.isTestPath)(x2.path)) };
-              for (const line of (0, import_code_core8.formatReviewDetail)((0, import_code_core8.classifyFile)(hit[0], ctx), cols3))
+              const ctx = { tests: files.filter((x2) => (0, import_code_core9.isTestPath)(x2.path)) };
+              for (const line of (0, import_code_core9.formatReviewDetail)((0, import_code_core9.classifyFile)(hit[0], ctx), cols3))
                 emit("  " + line);
             }
           } else {
             const all = /(^|\s)--all(\s|$)/.test(arg);
-            const q = (0, import_code_core8.buildReviewQueue)(files, all ? Number.POSITIVE_INFINITY : import_code_core8.DEFAULT_PER_GROUP);
-            for (const line of (0, import_code_core8.formatReviewQueue)(q, cols3))
+            const q = (0, import_code_core9.buildReviewQueue)(files, all ? Number.POSITIVE_INFINITY : import_code_core9.DEFAULT_PER_GROUP);
+            for (const line of (0, import_code_core9.formatReviewQueue)(q, cols3))
               emit("  " + line);
             emit(paint.dim("  /review <file> for one entry's reasons \xB7 /diff for the change itself"));
           }
@@ -110903,7 +111133,7 @@ ${text}
         }
         case "/skill-doctor": {
           const loadedSkills = (0, import_code_core66.loadSkills)(workDir);
-          const usage2 = collectSkillUsage(scanRecentSkillEvents((0, import_code_core6.eventsDir)()));
+          const usage2 = collectSkillUsage(scanRecentSkillEvents((0, import_code_core7.eventsDir)()));
           for (const l of buildSkillDoctorReport(loadedSkills, usage2).lines)
             console.log(l);
           rl.prompt();
@@ -112811,7 +113041,7 @@ function planProjectPurge(targetDir, env3 = process.env) {
     }
   }
   for (const id of sessionIds) {
-    const p = (0, import_code_core6.eventsPath)(id, env3);
+    const p = (0, import_code_core7.eventsPath)(id, env3);
     if (fs28.existsSync(p))
       items.push({ kind: "events", path: p, dir: false });
   }
@@ -114095,7 +114325,7 @@ var NEX_VERSION = require3("../package.json").version;
 installEpipeGuard();
 var program2 = new Command();
 program2.name("nex").description("Nexrall Code \u2014 AI coding assistant (powered by Nexrall)").version(NEX_VERSION).enablePositionalOptions();
-var auth = program2.command("auth").description("Login to your Nexrall account").action(authCommand);
+var auth = program2.command("auth").alias("login").description("Log in (browser, email + password, or a token)").option("--browser", "Sign in through the browser \u2014 works for Google, Apple and SSO accounts").option("--code <code>", "Finish a browser sign-in with a code you already copied (no browser is opened)").option("--token <token>", "Save a token directly (CI/headless). Prefer NEXRALL_TOKEN where you can").option("--password", "Ask for email and password in this terminal (skips the method menu)").action(authCommand);
 auth.command("status").description("Show whether you are logged in (exit 0 = yes, 1 = no). --json for scripts; the token is never printed").option("--json", "Machine-readable output").action((opts) => {
   const r2 = authStatusReport((0, import_code_core79.loadAuth)(), process.env);
   if (opts.json)
@@ -114553,7 +114783,7 @@ program2.command("sessions").description("List, export, import, or delete saved
       process.exitCode = 1;
       return;
     }
-    const events = (0, import_code_core6.readEvents)(hit.id, { last: Number.isFinite(want) && want > 0 ? want : 20 });
+    const events = (0, import_code_core7.readEvents)(hit.id, { last: Number.isFinite(want) && want > 0 ? want : 20 });
     if (!events.length) {
       console.log(
         paint.dim(`  No events recorded for ${hit.id.slice(0, 8)} (NEXRALL_EVENTS=off disables the stream).`)
@@ -114568,9 +114798,9 @@ program2.command("sessions").description("List, export, import, or delete saved
     console.log();
     console.log(paint.bold(`  Events for ${hit.id.slice(0, 8)}  `) + paint.dim(`(last ${events.length})`));
     for (const ev of events)
-      console.log("  " + paint.dim((0, import_code_core6.summarizeEvent)(ev)));
+      console.log("  " + paint.dim((0, import_code_core7.summarizeEvent)(ev)));
     console.log(paint.dim(`
-  Raw JSONL: ${(0, import_code_core6.eventsPath)(hit.id)}`));
+  Raw JSONL: ${(0, import_code_core7.eventsPath)(hit.id)}`));
     console.log();
     return;
   }
@@ -114684,8 +114914,17 @@ program2.option("-y, --yolo", "Auto-approve all tool calls (no permission prompt
   "Settings (permissions, hooks\u2026) for this run only: a JSON file or an inline JSON object; merged over the user/project settings"
 ).option("--debug-file <path>", "Write the --debug diagnostics log to this file (implies --debug)").argument("[prompt...]", "One-shot prompt \u2014 if omitted, starts interactive mode").action(async (promptParts, options) => {
   if (!(0, import_code_core78.isAuthenticated)()) {
-    console.error("Not logged in. Run: nex auth");
-    process.exit(1);
+    if (!shouldOfferLogin({
+      isTTY: !!process.stdin.isTTY,
+      headless: !!(options.print || options.outputFormat)
+    })) {
+      console.error("Not logged in. Run: nex auth (or set NEXRALL_TOKEN for CI)");
+      process.exit(1);
+    }
+    console.log(paint.dim("  Not signed in yet \u2014 signing in first (Ctrl+C cancels)."));
+    await authCommand();
+    if (!(0, import_code_core78.isAuthenticated)())
+      process.exit(process.exitCode || 1);
   }
   const model = options.model ?? "deepseek-flash";
   const workDir = options.dir ? path35.resolve(options.dir) : process.cwd();