orizu 0.5.24 → 0.5.25

package/README.md

@@ -87,9 +87,29 @@ Install the CLI globally with your package manager:
 | Bun | `bun add -g orizu` |
 
 Then run the guided setup — it signs you in, asks you to choose or create a
-team and project, initializes the local workspace contract, installs the shared
-`~/.agents/skills/orizu` skill plus selected native targets, and optionally
-launches Claude, Codex, or Pi:
+team and project, initializes the local workspace contract, and optionally
+hands off to Claude, Codex, Pi, OpenCode, and Cursor when their commands are
+installed. Available commands appear in that order, with the first available
+command selected by default. Other is always last. Enter launches the highlighted
+agent; Esc skips agent launch and completes setup. Selecting Other prints the
+complete prompt without launching anything. Explicit
+`--launch claude|codex|pi|opencode|cursor` still requires an interactive terminal
+and asks for confirmation unless `--yes` is supplied; non-interactive setup never
+launches. Cursor uses the `agent` executable, not the Cursor editor `cursor` command.
+The official [Cursor CLI overview](https://cursor.com/docs/cli/overview) and
+[parameter reference](https://cursor.com/docs/cli/reference/parameters), retrieved
+2026-08-30, document direct `agent "prompt"` and `agent -p "prompt"` initial prompts;
+setup uses the direct positional form without a shell.
+
+If you accept skill installation, the picker starts with
+`Universal (.agents — Codex and others) — ~/.agents/skills/orizu` and shows each
+detected native target with its `~/.../orizu` destination on the same line before
+any write. All visible choices start selected, and any choice—including Universal—
+can be deselected. In non-interactive setup, `--agent` opts into skill installation.
+Every accepted `--agent` always includes Universal, plus that agent's native
+destination where needed. Duplicate destinations are removed. With no `--agent` flags, setup writes no skills.
+
+For example:
 
 ```bash
 orizu setup

package/dist/credentials.d.ts

@@ -1,8 +1,22 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+/**
+ * Runs a synchronous credentials transaction under the one process-wide and
+ * cross-process lock. Exported so real-process fixtures can hold the production
+ * lock; CLI credential mutations use this same helper.
+ */
+export declare function withCredentialsTransactionLock<T>(operation: () => T): T;
+/**
+ * Holds the credentials lock until an awaited transaction settles. Nested
+ * synchronous credential writes are admitted only from this transaction's
+ * async execution context; unrelated same-process work must wait or fail.
+ */
+export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>): Promise<T>;
 export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
 export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
 export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
 export declare function updateServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function credentialsEqual(left: ServerCredentials, right: ServerCredentials): boolean;
+export declare function updateServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials, replacement: ServerCredentials): boolean;
 export declare function getActiveBaseUrl(): string | null;
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
@@ -41,6 +55,7 @@ export declare function resolveAuthTokenForBaseUrl(baseUrl: string): string;
  */
 export declare function hasResolvableAuth(baseUrl: string): boolean;
 export declare function setActiveBaseUrl(baseUrl: string | null): void;
+export declare function clearServerCredentialsIfCurrent(baseUrl: string, expected: ServerCredentials): boolean;
 export declare function clearServerCredentials(baseUrl: string): boolean;
 export declare function clearCredentialsFile(): void;
 //# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAkHnB,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAapF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAWtF;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAItD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY/D;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAqInB;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAO3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/credentials.js

@@ -1,7 +1,8 @@
-import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'fs';
+import { chmodSync, closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'fs';
 import { join } from 'path';
-import { homedir } from 'os';
+import { homedir, hostname } from 'os';
 import { randomBytes } from 'crypto';
+import { AsyncLocalStorage } from 'async_hooks';
 function isNodeError(error) {
     return error instanceof Error;
 }
@@ -14,6 +15,186 @@ function getConfigDir() {
 function getCredentialsPath() {
     return join(getConfigDir(), 'credentials.json');
 }
+const DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS = 2_000;
+const MAX_CREDENTIALS_LOCK_TIMEOUT_MS = 10_000;
+const CREDENTIALS_LOCK_RETRY_MS = 20;
+let heldCredentialsLock = null;
+const credentialsTransactionOwner = new AsyncLocalStorage();
+function getCredentialsLockPath() {
+    return `${getCredentialsPath()}.lock`;
+}
+function readLockDuration(name, fallback, maximum = Number.MAX_SAFE_INTEGER) {
+    const raw = process.env[name];
+    if (!raw)
+        return fallback;
+    const parsed = Number(raw);
+    return Number.isSafeInteger(parsed) && parsed > 0
+        ? Math.min(parsed, maximum)
+        : fallback;
+}
+function sleepSync(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+function acquireCredentialsLock() {
+    const dir = getConfigDir();
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const lockPath = getCredentialsLockPath();
+    const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+    const deadline = Date.now() + timeoutMs;
+    while (true) {
+        const metadata = JSON.stringify({
+            version: 1,
+            pid: process.pid,
+            hostname: hostname(),
+            createdAt: Date.now(),
+            instanceId: randomBytes(16).toString('hex'),
+        });
+        const tempPath = join(dir, `.credentials.json.lock.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+        try {
+            const fd = openSync(tempPath, 'wx', 0o600);
+            try {
+                writeFileSync(fd, metadata, 'utf8');
+                fsyncSync(fd);
+                chmodSync(tempPath, 0o600);
+            }
+            finally {
+                closeSync(fd);
+            }
+            try {
+                // link(2) publishes the already-complete inode without replacing an
+                // existing owner. No contender ever unlinks the canonical lock.
+                linkSync(tempPath, lockPath);
+            }
+            catch (error) {
+                if (!(isNodeError(error) && error.code === 'EEXIST'))
+                    throw error;
+                if (Date.now() >= deadline) {
+                    throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+                }
+                sleepSync(Math.min(CREDENTIALS_LOCK_RETRY_MS, Math.max(1, deadline - Date.now())));
+                continue;
+            }
+            let resolveReleased = () => { };
+            const released = new Promise(resolve => { resolveReleased = resolve; });
+            return { path: lockPath, metadata, depth: 1, released, resolveReleased };
+        }
+        finally {
+            // The unique owner-only preparation link is never retained, whether
+            // publication succeeds, loses to an owner, or fails unexpectedly.
+            rmSync(tempPath, { force: true });
+        }
+    }
+}
+function releaseCredentialsLock(lock) {
+    let currentMetadata;
+    try {
+        currentMetadata = readFileSync(lock.path, 'utf8');
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    // Preserve a changed/replaced lock rather than risking removal of another owner.
+    if (currentMetadata !== lock.metadata)
+        return;
+    rmSync(lock.path);
+}
+/**
+ * Runs a synchronous credentials transaction under the one process-wide and
+ * cross-process lock. Exported so real-process fixtures can hold the production
+ * lock; CLI credential mutations use this same helper.
+ */
+export function withCredentialsTransactionLock(operation) {
+    const lockPath = getCredentialsLockPath();
+    if (heldCredentialsLock) {
+        if (heldCredentialsLock.path !== lockPath) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_NESTED_CONFIG: credentials config changed during a mutation.');
+        }
+        if (heldCredentialsLock.asyncOwner
+            && credentialsTransactionOwner.getStore() !== heldCredentialsLock.asyncOwner) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_REQUIRED: an asynchronous credentials transaction already owns the lock.');
+        }
+        heldCredentialsLock.depth += 1;
+        try {
+            return operation();
+        }
+        finally {
+            heldCredentialsLock.depth -= 1;
+        }
+    }
+    const lock = acquireCredentialsLock();
+    heldCredentialsLock = lock;
+    try {
+        return operation();
+    }
+    finally {
+        heldCredentialsLock = null;
+        try {
+            releaseCredentialsLock(lock);
+        }
+        finally {
+            lock.resolveReleased();
+        }
+    }
+}
+/**
+ * Holds the credentials lock until an awaited transaction settles. Nested
+ * synchronous credential writes are admitted only from this transaction's
+ * async execution context; unrelated same-process work must wait or fail.
+ */
+export async function withCredentialsTransactionLockAsync(operation) {
+    const lockPath = getCredentialsLockPath();
+    const currentOwner = credentialsTransactionOwner.getStore();
+    if (heldCredentialsLock) {
+        if (heldCredentialsLock.path !== lockPath) {
+            throw new Error('ORIZU_CREDENTIALS_LOCK_NESTED_CONFIG: credentials config changed during a mutation.');
+        }
+        if (heldCredentialsLock.asyncOwner === currentOwner && currentOwner) {
+            heldCredentialsLock.depth += 1;
+            try {
+                return await operation();
+            }
+            finally {
+                heldCredentialsLock.depth -= 1;
+            }
+        }
+        const timeoutMs = readLockDuration('ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS', DEFAULT_CREDENTIALS_LOCK_TIMEOUT_MS, MAX_CREDENTIALS_LOCK_TIMEOUT_MS);
+        let timer;
+        const didRelease = await Promise.race([
+            heldCredentialsLock.released.then(() => true),
+            new Promise(resolve => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+        ]);
+        if (timer)
+            clearTimeout(timer);
+        if (!didRelease) {
+            throw new Error(`ORIZU_CREDENTIALS_LOCK_TIMEOUT: credentials mutation did not acquire the lock within ${timeoutMs}ms. Verify no Orizu process is running, then remove credentials.json.lock manually.`);
+        }
+        return await withCredentialsTransactionLockAsync(operation);
+    }
+    const lock = acquireCredentialsLock();
+    const owner = Symbol('credentials-transaction-owner');
+    lock.asyncOwner = owner;
+    heldCredentialsLock = lock;
+    try {
+        return await credentialsTransactionOwner.run(owner, operation);
+    }
+    finally {
+        heldCredentialsLock = null;
+        try {
+            releaseCredentialsLock(lock);
+        }
+        finally {
+            lock.resolveReleased();
+        }
+    }
+}
+function assertCredentialsLockHeld() {
+    if (!heldCredentialsLock || heldCredentialsLock.path !== getCredentialsLockPath()) {
+        throw new Error('ORIZU_CREDENTIALS_LOCK_REQUIRED: credentials writes require a transaction lock.');
+    }
+}
 function isStoredCredentialsV2(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -52,35 +233,33 @@ function migrateToV2(stored) {
     };
 }
 function writeCredentials(config) {
+    assertCredentialsLockHeld();
     const dir = getConfigDir();
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     chmodSync(dir, 0o700);
     const path = getCredentialsPath();
     const tempPath = join(dir, `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
     const payload = JSON.stringify(config, null, 2) + '\n';
-    const fd = openSync(tempPath, 'wx', 0o600);
     try {
-        writeFileSync(fd, payload, 'utf-8');
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-    chmodSync(tempPath, 0o600);
-    try {
-        renameSync(tempPath, path);
-    }
-    catch (error) {
-        if (process.platform === 'win32' && isNodeError(error) && error.code === 'EEXIST') {
-            rmSync(path, { force: true });
-            renameSync(tempPath, path);
+        const fd = openSync(tempPath, 'wx', 0o600);
+        try {
+            writeFileSync(fd, payload, 'utf-8');
+            fsyncSync(fd);
         }
-        else {
-            rmSync(tempPath, { force: true });
-            throw error;
+        finally {
+            closeSync(fd);
         }
+        chmodSync(tempPath, 0o600);
+        // Never delete the destination to emulate replacement. If this platform
+        // cannot atomically replace it, preserve the old file and surface the error.
+        renameSync(tempPath, path);
+        chmodSync(path, 0o600);
+    }
+    finally {
+        // On success rename has already removed this path; on every error this
+        // removes the owner-only temporary file containing credential material.
+        rmSync(tempPath, { force: true });
     }
-    chmodSync(path, 0o600);
 }
 function createEmptyCredentialsConfig() {
     return {
@@ -134,29 +313,52 @@ export function getServerCredentials(baseUrl) {
     return config.servers[baseUrl] || null;
 }
 export function saveServerCredentials(baseUrl, credentials) {
-    const loaded = loadCredentialsConfigForWrite();
-    const config = loaded.version === 3
-        ? loaded
-        : {
-            version: 3,
-            activeBaseUrl: loaded.activeBaseUrl,
-            servers: loaded.servers,
-        };
-    config.servers[baseUrl] = credentials;
-    config.activeBaseUrl = baseUrl;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const loaded = loadCredentialsConfigForWrite();
+        const config = loaded.version === 3
+            ? loaded
+            : {
+                version: 3,
+                activeBaseUrl: loaded.activeBaseUrl,
+                servers: loaded.servers,
+            };
+        config.servers[baseUrl] = credentials;
+        config.activeBaseUrl = baseUrl;
+        writeCredentials(config);
+    });
 }
 export function updateServerCredentials(baseUrl, credentials) {
-    const loaded = loadCredentialsConfigForWrite();
-    const config = loaded.version === 3
-        ? loaded
-        : {
-            version: 3,
-            activeBaseUrl: loaded.activeBaseUrl,
-            servers: loaded.servers,
-        };
-    config.servers[baseUrl] = credentials;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const loaded = loadCredentialsConfigForWrite();
+        const config = loaded.version === 3
+            ? loaded
+            : {
+                version: 3,
+                activeBaseUrl: loaded.activeBaseUrl,
+                servers: loaded.servers,
+            };
+        config.servers[baseUrl] = credentials;
+        writeCredentials(config);
+    });
+}
+export function credentialsEqual(left, right) {
+    if ('apiKey' in left || 'apiKey' in right) {
+        return 'apiKey' in left && 'apiKey' in right && left.apiKey === right.apiKey;
+    }
+    return left.accessToken === right.accessToken
+        && left.refreshToken === right.refreshToken
+        && left.expiresAt === right.expiresAt;
+}
+export function updateServerCredentialsIfCurrent(baseUrl, expected, replacement) {
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        const current = config?.servers[baseUrl];
+        if (!config || !current || !credentialsEqual(current, expected))
+            return false;
+        config.servers[baseUrl] = replacement;
+        writeCredentials(config);
+        return true;
+    });
 }
 export function getActiveBaseUrl() {
     const config = loadCredentialsConfig();
@@ -244,25 +446,43 @@ export function hasResolvableAuth(baseUrl) {
     return getServerCredentials(baseUrl) !== null;
 }
 export function setActiveBaseUrl(baseUrl) {
-    const config = loadCredentialsConfigForWrite();
-    config.activeBaseUrl = baseUrl;
-    writeCredentials(config);
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfigForWrite();
+        config.activeBaseUrl = baseUrl;
+        writeCredentials(config);
+    });
+}
+export function clearServerCredentialsIfCurrent(baseUrl, expected) {
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        const current = config?.servers[baseUrl];
+        if (!config || !current || !credentialsEqual(current, expected))
+            return false;
+        delete config.servers[baseUrl];
+        if (config.activeBaseUrl === baseUrl)
+            config.activeBaseUrl = null;
+        writeCredentials(config);
+        return true;
+    });
 }
 export function clearServerCredentials(baseUrl) {
-    const config = loadCredentialsConfig();
-    if (!config || !Object.hasOwn(config.servers, baseUrl)) {
-        return false;
-    }
-    delete config.servers[baseUrl];
-    if (config.activeBaseUrl === baseUrl) {
-        config.activeBaseUrl = null;
-    }
-    writeCredentials(config);
-    return true;
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        if (!config || !Object.hasOwn(config.servers, baseUrl)) {
+            return false;
+        }
+        delete config.servers[baseUrl];
+        if (config.activeBaseUrl === baseUrl) {
+            config.activeBaseUrl = null;
+        }
+        writeCredentials(config);
+        return true;
+    });
 }
 export function clearCredentialsFile() {
-    const path = getCredentialsPath();
-    if (existsSync(path)) {
-        rmSync(path);
-    }
+    return withCredentialsTransactionLock(() => {
+        const path = getCredentialsPath();
+        if (existsSync(path))
+            rmSync(path);
+    });
 }

package/dist/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAoCD,eAAO,MAAM,YAAY,EAAE,aAAa,EAqoCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAuCD,eAAO,MAAM,YAAY,EAAE,aAAa,EAqoCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}

package/dist/help.js

@@ -1,3 +1,6 @@
+import { AGENT_LAUNCH_SPECS } from './setup-onboarding.js';
+const SETUP_LAUNCH_AGENT_NAMES = Object.keys(AGENT_LAUNCH_SPECS);
+const SETUP_LAUNCH_AGENT_USAGE = SETUP_LAUNCH_AGENT_NAMES.join('|');
 const GLOBAL_OPTIONS = [
     ['--json', 'Emit machine-readable JSON instead of human text. Available on every command, as a prefix (orizu --json <command>) or trailing flag.'],
     ['--local', 'Use http://localhost:3000.'],
@@ -219,7 +222,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['setup'],
-        usage: 'orizu setup [--team <slug>|--create-team <name>] [--project <slug>|--create-project <name>] [--agent <agent>]... [--workspace [path]|--no-workspace] [--validate] [--fix] [--no-symlinks] [--verbose] [--no-install] [--handoff|--no-handoff] [--launch <claude|codex|pi>] [--skip-login] [--dry-run] [--no-input|--non-interactive] [--json]',
+        usage: `orizu setup [--team <slug>|--create-team <name>] [--project <slug>|--create-project <name>] [--agent <agent>]... [--workspace [path]|--no-workspace] [--validate] [--fix] [--no-symlinks] [--verbose] [--no-install] [--handoff|--no-handoff] [--launch <${SETUP_LAUNCH_AGENT_USAGE}>] [--skip-login] [--dry-run] [--no-input|--non-interactive] [--json]`,
         summary: 'Guided onboarding: sign in, initialize the workbench contract, and install agent skills.',
         group: 'Agent setup',
         options: [
@@ -239,7 +242,7 @@ export const COMMAND_DOCS = [
             { name: '--no-install', help: 'Skip the coding-agent skill install step.' },
             { name: '--handoff', help: 'Print the llms.txt and selected-project handoff prompt after setup.' },
             { name: '--no-handoff', help: 'Compatibility flag; suppresses the final launch picker and explicit handoff/launch.' },
-            { name: '--launch <agent>', help: 'Launch a detected coding agent with the selected project and llms.txt prompt (interactive terminals only).', choices: ['claude', 'codex', 'pi'] },
+            { name: '--launch <agent>', help: 'Launch a detected coding agent with the selected project and llms.txt prompt (interactive terminals only). The cursor selector uses the Cursor Agent `agent` executable, not the editor `cursor` command.', choices: SETUP_LAUNCH_AGENT_NAMES },
             { name: '--skip-login', help: 'Skip the authentication phase.' },
             { name: '--dry-run', help: 'Preview every planned change without writing.' },
             { name: '--no-input', help: 'Never prompt; behave as in a non-interactive terminal.' },

package/dist/http.d.ts

@@ -5,5 +5,25 @@ export declare function resolveLoginBaseUrl(flags?: GlobalFlags): string;
 export declare function getBaseUrl(): string;
 export declare function assertSecureTokenTransport(baseUrl: string): void;
 export declare function credentialRequestRedirectPolicy(): Pick<RequestInit, 'redirect'>;
+export type AuthenticatedRequestSource = 'ORIZU_TOKEN' | 'ORIZU_TOKEN_FILE' | 'stored';
+export interface AuthenticatedRequestContext {
+    readonly baseUrl: string;
+    readonly source: AuthenticatedRequestSource;
+    fetch(path: string, init?: RequestInit): Promise<Response>;
+    logout(signal?: AbortSignal | null): Promise<LogoutResult>;
+}
+export interface LogoutResult {
+    remoteError: string | null;
+    localCredentialCleared: boolean;
+}
+/**
+ * Captures one authenticated server context for a multi-step operation. The
+ * returned interface intentionally exposes no credential material: its closure
+ * pins the selected origin and bearer/session so later global config changes
+ * cannot move an in-flight operation to another account.
+ */
+export declare function captureAuthenticatedRequestContext(options?: {
+    allowRefresh?: boolean;
+}): AuthenticatedRequestContext;
 export declare function authedFetch(path: string, init?: RequestInit): Promise<Response>;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAMA,OAAO,EAAkB,WAAW,EAAoB,MAAM,mBAAmB,CAAA;AAKjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,QAEhD;AAED,wBAAgB,cAAc,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAiBxE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAY7E;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAWD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,QAmBzD;AAeD,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAE/E;AAkCD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,qBAqDrE"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,WAAW,EAAoB,MAAM,mBAAmB,CAAA;AASjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,QAEhD;AAED,wBAAgB,cAAc,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAiBxE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,WAA0B,GAAG,MAAM,CAY7E;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAWD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,QAmBzD;AAqFD,wBAAgB,+BAA+B,IAAI,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAE/E;AAkGD,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,kBAAkB,GAAG,QAAQ,CAAA;AAEtF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;IAC3C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1D,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC3D;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,sBAAsB,EAAE,OAAO,CAAA;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,2BAA2B,CAgI7B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,qBAiErE"}