orizu 0.5.24 → 0.5.26

package/dist/index.js

@@ -4,9 +4,9 @@ import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, rel
 import { fileURLToPath } from 'url';
 import { createServer } from 'http';
 import { gunzipSync, gzipSync } from 'zlib';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'fs';
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync, } from 'fs';
 import { spawn, spawnSync } from 'child_process';
-import { homedir, tmpdir } from 'os';
+import { tmpdir } from 'os';
 import { createInterface } from 'readline/promises';
 import { emitKeypressEvents } from 'readline';
 import { stdin as input, stdout as output } from 'process';
@@ -18,17 +18,21 @@ import { parseDatasetReference } from './dataset-download.js';
 import { editDatasetRows as runEditDatasetRows } from './dataset-edit-rows.js';
 import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js';
 import { extractErrorMessage } from './error-response.js';
+import { describeLogoutHttpFailure, describeLogoutTransportFailure, } from './logout-diagnostic.js';
 import { parseGlobalFlags } from './global-flags.js';
 import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js';
 import { getCapabilities, renderHelpForArgs, renderRootHelp } from './help.js';
 import { runLocalAppPreview } from './preview-runtime.js';
 import { readAssignmentManifestJsonlFile } from './task-assignment-manifest.js';
-import { assertSecureTokenTransport, authedFetch, credentialRequestRedirectPolicy, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags, } from './http.js';
+import { assertSecureTokenTransport, authedFetch, captureAuthenticatedRequestContext, credentialRequestRedirectPolicy, getBaseUrl, resolveLoginBaseUrl, setGlobalFlags, } from './http.js';
 import { computeSkillContentHash, getSkillInstallPath, getSkillTargetStatus, getTargetForAgent, installSkillTarget, isSkillInstallAgent, isSkillInstallTarget, resolveSkillSource, SKILL_INSTALL_AGENTS, SKILL_INSTALL_TARGETS, targetNeedsOverwrite, } from './skill-installer.js';
 import { renderBanner } from './banner.js';
 import { formatTaskCreateError } from './task-create-error.js';
 import { renderAgentSetupPrompt } from './setup-prompt.js';
-import { findExecutable, LAUNCHABLE_AGENTS, setupLaunchPrompt, validateSetupAgentArgs, validateSetupFlagValues, validateSetupSelectionArgs } from './setup-onboarding.js';
+import { AGENT_LAUNCH_SPECS, detectedSetupSkillChoices, findExecutable, resolveSetupSkillHome, setupLaunchPrompt, setupNativeTargetForAgent, validateSetupAgentArgs, validateSetupFlagValues, validateSetupSelectionArgs, } from './setup-onboarding.js';
+import { promptKeyboardSelect } from './keyboard-select.js';
+import { confirmExistingSetupAccount, describeSetupAuthState } from './setup-account.js';
+import { renderSetupSkillSummary, sanitizeSetupHumanInlineText } from './setup-summary.js';
 import { getWorkspaceRoot, inspectExistingWorkspaceTeam, initOrizuWorkspace, workspaceExists, } from './workspace.js';
 import { connectorsCommand } from './connectors-cli.js';
 import { modelConfigsCommand } from './model-configs-cli.js';
@@ -332,18 +336,18 @@ async function promptSelect(title, items, label, options) {
         rl.close();
     }
 }
-async function fetchTeams() {
-    const response = await authedFetch('/api/cli/teams');
+async function fetchTeams(request = authedFetch) {
+    const response = await request('/api/cli/teams');
     if (!response.ok) {
         throw new Error(`Failed to fetch teams: ${await response.text()}`);
     }
     const data = await parseJsonResponse(response, 'Teams list');
     return data.teams;
 }
-async function fetchProjects(teamSlug) {
+async function fetchProjects(teamSlug, request = authedFetch) {
     const normalizedTeamSlug = teamSlug ? normalizeSlugInput(teamSlug) : undefined;
     const query = normalizedTeamSlug ? `?teamSlug=${encodeURIComponent(normalizedTeamSlug)}` : '';
-    const response = await authedFetch(`/api/cli/projects${query}`);
+    const response = await request(`/api/cli/projects${query}`);
     if (!response.ok) {
         throw new Error(`Failed to fetch projects: ${await response.text()}`);
     }
@@ -394,8 +398,8 @@ async function fetchTeamMembers(teamSlug) {
     const data = await parseJsonResponse(response, 'Team members list');
     return data.members;
 }
-async function createTeamOnServer(name) {
-    const response = await authedFetch('/api/cli/teams', {
+async function createTeamOnServer(name, request = authedFetch) {
+    const response = await request('/api/cli/teams', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ name }),
@@ -406,8 +410,8 @@ async function createTeamOnServer(name) {
     const data = await parseJsonResponse(response, 'Team create');
     return data.team;
 }
-async function createProjectOnServer(teamSlug, name) {
-    const response = await authedFetch('/api/cli/projects', {
+async function createProjectOnServer(teamSlug, name, request = authedFetch) {
+    const response = await request('/api/cli/projects', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ teamSlug, name }),
@@ -582,8 +586,9 @@ function resolveAuthCallbackPort() {
     }
     return parsed;
 }
-async function login() {
-    const baseUrl = hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl();
+async function login(baseUrlOverride) {
+    const baseUrl = baseUrlOverride
+        ?? (hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl());
     assertSecureTokenTransport(baseUrl);
     // hasResolvableAuth (ALI-1090): an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
     // counts as logged in — a pre-authenticated hosted sandbox must not fall into
@@ -701,8 +706,8 @@ async function whoami() {
     }
     printLine(sanitizeTerminalText(data.user.email ?? data.user.id));
 }
-async function logout() {
-    const baseUrl = getBaseUrl();
+async function logout(baseUrlOverride) {
+    const baseUrl = baseUrlOverride || getBaseUrl();
     const credentials = getServerCredentials(baseUrl);
     if (!credentials) {
         if (hasJsonFlag()) {
@@ -712,6 +717,13 @@ async function logout() {
         printLine(`Already logged out for ${sanitizeTerminalText(baseUrl)}.`);
         return;
     }
+    const authorizationToken = 'accessToken' in credentials
+        ? credentials.accessToken
+        : credentials.apiKey;
+    const logoutSecrets = [
+        authorizationToken,
+        ...('refreshToken' in credentials ? [credentials.refreshToken] : []),
+    ];
     let remoteLogoutError = null;
     try {
         assertSecureTokenTransport(baseUrl);
@@ -719,7 +731,7 @@ async function logout() {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Authorization: `Bearer ${'accessToken' in credentials ? credentials.accessToken : credentials.apiKey}`,
+                Authorization: `Bearer ${authorizationToken}`,
             },
             body: 'refreshToken' in credentials
                 ? JSON.stringify({ refreshToken: credentials.refreshToken })
@@ -727,12 +739,11 @@ async function logout() {
             ...credentialRequestRedirectPolicy(),
         });
         if (!response.ok) {
-            remoteLogoutError = sanitizeTerminalText(await response.text()).slice(0, 180);
+            remoteLogoutError = await describeLogoutHttpFailure(response, logoutSecrets);
         }
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        remoteLogoutError = sanitizeTerminalText(message).slice(0, 180);
+        remoteLogoutError = describeLogoutTransportFailure(error, logoutSecrets);
     }
     clearServerCredentials(baseUrl);
     if (hasJsonFlag()) {
@@ -1965,75 +1976,6 @@ async function waitForAnyKeyOrEscape(message) {
         rawInput.setRawMode?.(true);
     });
 }
-async function promptKeyboardSelect(title, items, label) {
-    if (items.length === 0) {
-        throw new Error(`No options available for ${title.toLowerCase()}`);
-    }
-    if (!isInteractiveTerminal()) {
-        throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`);
-    }
-    printLine(`\n${sanitizeTerminalText(title)}`);
-    printLine('Use ↑/↓ to choose, Enter to confirm, or Esc to cancel.');
-    let selected = 0;
-    let rendered = false;
-    const rawInput = input;
-    const wasRaw = Boolean(rawInput.isRaw);
-    emitKeypressEvents(input);
-    function render() {
-        if (rendered) {
-            output.write(`\x1b[${items.length}A`);
-        }
-        items.forEach((item, index) => {
-            output.write('\x1b[2K');
-            const marker = index === selected ? '●' : '○';
-            output.write(`  ${marker} ${sanitizeTerminalText(label(item, index))}\n`);
-        });
-        rendered = true;
-    }
-    render();
-    output.write('\x1b[?25l');
-    return new Promise((resolvePromise, rejectPromise) => {
-        function cleanup() {
-            input.off('keypress', onKeypress);
-            if (rawInput.setRawMode && !wasRaw) {
-                rawInput.setRawMode(false);
-            }
-            input.pause();
-            output.write('\x1b[?25h');
-            printLine('');
-        }
-        function onKeypress(_chunk, key) {
-            if (key.ctrl && key.name === 'c') {
-                cleanup();
-                rejectPromise(new Error('Setup cancelled.'));
-                return;
-            }
-            if (key.name === 'escape') {
-                cleanup();
-                rejectPromise(new Error('Setup cancelled.'));
-                return;
-            }
-            if (key.name === 'up') {
-                selected = (selected - 1 + items.length) % items.length;
-                render();
-                return;
-            }
-            if (key.name === 'down') {
-                selected = (selected + 1) % items.length;
-                render();
-                return;
-            }
-            if (key.name === 'return' || key.name === 'enter') {
-                const item = items[selected];
-                cleanup();
-                resolvePromise(item);
-            }
-        }
-        input.on('keypress', onKeypress);
-        input.resume();
-        rawInput.setRawMode?.(true);
-    });
-}
 async function promptKeyboardMultiSelect(title, items, label, defaultSelected) {
     if (items.length === 0) {
         return [];
@@ -2162,13 +2104,13 @@ function writeWorkspaceValidationLog(workspaceRoot, findings, dryRun) {
 }
 function printWorkspaceFindings(findings) {
     if (findings.length === 0) {
-        printLine('   Validation passed.');
+        printLine('Validation passed.');
         return;
     }
-    printLine('   Validation findings:');
+    printLine('Validation findings:');
     for (const finding of findings) {
         const path = finding.path ? ` ${finding.path}` : '';
-        printLine(`   - ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`);
+        printLine(`- ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`);
     }
 }
 const SKILL_INSTALL_USAGE = `Usage: orizu install-skill [--agent <${SKILL_INSTALL_AGENTS.join('|')}>]... [--scope global|project] [--mode auto|link|copy] [--target <${SKILL_INSTALL_TARGETS.join('|')}>]... [--yes] [--dry-run]`;
@@ -2495,15 +2437,7 @@ function skillsPathCommand() {
     }
     printLine(hasArg('--skill-md') ? source.skillMd : source.root);
 }
-function describeSetupAuthState() {
-    const baseUrl = getBaseUrl();
-    return {
-        // ALI-1090: an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE) is signed-in too.
-        state: hasResolvableAuth(baseUrl) ? 'signed-in' : 'signed-out',
-        baseUrl,
-    };
-}
-async function resolveSetupTeam(teamSlugArg, createTeamName, noInput, dryRun, workspaceTeamSlug) {
+async function resolveSetupTeam(teamSlugArg, createTeamName, noInput, dryRun, workspaceTeamSlug, request = authedFetch) {
     if (teamSlugArg && createTeamName) {
         throw new Error('Use either --team <slug> or --create-team <name>, not both.');
     }
@@ -2516,11 +2450,11 @@ async function resolveSetupTeam(teamSlugArg, createTeamName, noInput, dryRun, wo
         const name = createTeamName.trim();
         if (!name)
             throw new Error('--create-team requires a non-empty team name.');
-        const team = await createTeamOnServer(name);
-        printLine(`   Created team ${sanitizeTerminalText(team.slug)}`);
+        const team = await createTeamOnServer(name, request);
+        printLine(`Created team ${sanitizeTerminalText(team.slug)}`);
         return team;
     }
-    const teams = await fetchTeams();
+    const teams = await fetchTeams(request);
     const normalizedTeamSlug = teamSlugArg ? normalizeSlugInput(teamSlugArg) : null;
     if (normalizedTeamSlug) {
         const team = teams.find(candidate => candidate.slug === normalizedTeamSlug);
@@ -2542,17 +2476,17 @@ async function resolveSetupTeam(teamSlugArg, createTeamName, noInput, dryRun, wo
     if (choice.kind === 'team') {
         return choice.team;
     }
-    const name = await askText('   Team name?', '');
+    const name = await askText('Team name?', '');
     if (!name) {
         throw new Error('Team name is required to create a team.');
     }
     if (workspaceTeamSlug)
         throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Create the new team from another directory.`);
-    const team = await createTeamOnServer(name);
-    printLine(`   Created team ${sanitizeTerminalText(team.slug)}`);
+    const team = await createTeamOnServer(name, request);
+    printLine(`Created team ${sanitizeTerminalText(team.slug)}`);
     return team;
 }
-async function resolveSetupProjects(team, projectSlugArg, createProjectName, noInput, dryRun) {
+async function resolveSetupProjects(team, projectSlugArg, createProjectName, noInput, dryRun, request) {
     if (projectSlugArg && createProjectName) {
         throw new Error('Use either --project <slug> or --create-project <name>, not both.');
     }
@@ -2563,7 +2497,7 @@ async function resolveSetupProjects(team, projectSlugArg, createProjectName, noI
     if (createProjectName && !canCreateProject) {
         throw new Error(`Only team admins can create projects in '${team.slug}'. Choose an existing project or ask a team admin to create one.`);
     }
-    const projects = await fetchProjects(team.slug);
+    const projects = await fetchProjects(team.slug, request);
     if (createProjectName) {
         if (dryRun) {
             throw new Error('--create-project cannot be used with --dry-run because setup cannot preview a server-generated project slug.');
@@ -2571,8 +2505,8 @@ async function resolveSetupProjects(team, projectSlugArg, createProjectName, noI
         const name = createProjectName.trim();
         if (!name)
             throw new Error('--create-project requires a non-empty project name.');
-        const selected = await createProjectOnServer(team.slug, name);
-        printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
+        const selected = await createProjectOnServer(team.slug, name, request);
+        printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
         return { selected, projects: [...projects, selected] };
     }
     const normalizedProjectSlug = projectSlugArg ? normalizeSlugInput(projectSlugArg) : null;
@@ -2586,12 +2520,12 @@ async function resolveSetupProjects(team, projectSlugArg, createProjectName, noI
     if (projects.length === 0) {
         if (!canCreateProject)
             throw new Error(`Team '${team.slug}' has no accessible projects, and only team admins can create one.`);
-        printLine(`   Team '${sanitizeTerminalText(team.slug)}' has no projects yet. Let's create the first one.`);
-        const name = await askText('   Project name?', '');
+        printLine(`Team '${sanitizeTerminalText(team.slug)}' has no projects yet. Let's create the first one.`);
+        const name = await askText('Project name?', '');
         if (!name)
             throw new Error('Project name is required to create a project.');
-        const selected = await createProjectOnServer(team.slug, name);
-        printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
+        const selected = await createProjectOnServer(team.slug, name, request);
+        printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
         return { selected, projects: [selected] };
     }
     const choices = [
@@ -2604,11 +2538,11 @@ async function resolveSetupProjects(team, projectSlugArg, createProjectName, noI
     if (choice.kind === 'project') {
         return { selected: choice.project, projects };
     }
-    const name = await askText('   Project name?', '');
+    const name = await askText('Project name?', '');
     if (!name)
         throw new Error('Project name is required to create a project.');
-    const selected = await createProjectOnServer(team.slug, name);
-    printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
+    const selected = await createProjectOnServer(team.slug, name, request);
+    printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`);
     return { selected, projects: [...projects, selected] };
 }
 function projectSeedsFromProjects(projects) {
@@ -2621,32 +2555,6 @@ function projectSeedsFromProjects(projects) {
 function formatProjectSetupProgress(count) {
     return `${count} project${count === 1 ? '' : 's'} being set up in workspace...`;
 }
-const SETUP_NATIVE_SKILL_CHOICES = [
-    { agent: 'claude', label: 'Claude Code', directory: ['.claude'], binary: 'claude' },
-    { agent: 'devin', label: 'Devin', directory: ['.devin', 'skills'] },
-    { agent: 'droid', label: 'Droid', directory: ['.factory', 'skills'] },
-    { agent: 'grok', label: 'Grok Build', directory: ['.grok', 'skills'] },
-    { agent: 'windsurf', label: 'Windsurf', directory: ['.windsurf', 'skills'] },
-    { agent: 'opencode', label: 'OpenCode', directory: ['.config', 'opencode', 'skills'], binary: 'opencode' },
-];
-function setupNativeTargetForAgent(agent) {
-    if (agent === 'codex' || agent === 'pi')
-        return null;
-    return getTargetForAgent(agent, 'global');
-}
-function resolveSetupSkillHome() {
-    return resolve(process.env.HOME || homedir());
-}
-function detectedSetupSkillChoices(homeDir) {
-    return SETUP_NATIVE_SKILL_CHOICES
-        .filter(choice => existsSync(join(homeDir, ...choice.directory))
-        || Boolean(choice.binary && findExecutable(choice.binary)))
-        .map(choice => ({
-        agent: choice.agent,
-        label: choice.label,
-        target: getTargetForAgent(choice.agent, 'global'),
-    }));
-}
 function setupSkillTargetsFromArgs() {
     const targets = [];
     for (const agent of getArgs('--agent')) {
@@ -2706,22 +2614,58 @@ async function setupCommand() {
     // Step 1: login
     printLine('Step 1: Login');
     let auth = describeSetupAuthState();
+    let setupAuthContext = null;
     if (hasArg('--skip-login')) {
-        printLine('   Skipped (--skip-login).');
+        printLine('Skipped (--skip-login).');
     }
     else if (auth.state === 'signed-in') {
-        printLine(`   Already authenticated with ${sanitizeTerminalText(auth.baseUrl)}.`);
+        if (!validateOnly) {
+            setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun });
+        }
+        if (!noInput && !validateOnly) {
+            const confirmation = await confirmExistingSetupAccount(setupAuthContext, email => promptKeyboardSelect('Confirm the account to use for setup', ['continue', 'switch'], item => item === 'continue'
+                ? `Continue as ${email}`
+                : 'Log in with a different account'), async () => {
+                const context = setupAuthContext;
+                const logoutResult = await context.logout();
+                if (logoutResult.remoteError) {
+                    const localOutcome = logoutResult.localCredentialCleared
+                        ? 'Local credentials were cleared.'
+                        : 'Local credentials were not cleared because a newer login is active.';
+                    console.warn(`Warning: remote logout failed: ${logoutResult.remoteError} ${localOutcome}`);
+                }
+                else if (!logoutResult.localCredentialCleared) {
+                    console.warn('Warning: local credentials were not cleared because a newer login is active.');
+                }
+                printLine(logoutResult.localCredentialCleared
+                    ? `Logged out from ${sanitizeTerminalText(context.baseUrl)}.`
+                    : `Kept the newer login for ${sanitizeTerminalText(context.baseUrl)}.`);
+                await login(context.baseUrl);
+            }, { dryRun });
+            if (confirmation === 'switched') {
+                setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun });
+            }
+            auth = { state: 'signed-in', baseUrl: setupAuthContext.baseUrl };
+        }
+        else {
+            printLine(`Already authenticated with ${sanitizeTerminalText(auth.baseUrl)}.`);
+        }
     }
     else if (noInput || dryRun) {
-        printLine('   Not signed in. Run `orizu login` to authenticate.');
+        printLine('Not signed in. Run `orizu login` to authenticate.');
     }
-    else if (await waitForAnyKeyOrEscape('   Press any key to connect your account, or Esc to cancel.')) {
+    else if (await waitForAnyKeyOrEscape('Press any key to connect your account, or Esc to cancel.')) {
         await login();
         auth = describeSetupAuthState();
     }
     else {
         throw new Error('Setup cancelled.');
     }
+    if (auth.state === 'signed-in' && !validateOnly && !setupAuthContext) {
+        setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun });
+    }
+    if (setupAuthContext)
+        auth = { state: 'signed-in', baseUrl: setupAuthContext.baseUrl };
     const serverCreateRequested = createTeamArg !== null || createProjectArg !== null;
     if ((noInput || serverCreateRequested) && auth.state === 'signed-out' && !dryRun && !validateOnly && !fix) {
         throw new Error('Non-interactive setup requires authentication. Run `orizu login --headless`, then retry `orizu setup`.');
@@ -2731,17 +2675,18 @@ async function setupCommand() {
     let selectedProject = null;
     let setupProjects = [];
     if (auth.state === 'signed-in' && !validateOnly) {
-        setupTeam = await resolveSetupTeam(teamArg, createTeamArg, noInput, dryRun, workspaceTeamSlug);
+        const setupRequest = setupAuthContext.fetch.bind(setupAuthContext);
+        setupTeam = await resolveSetupTeam(teamArg, createTeamArg, noInput, dryRun, workspaceTeamSlug, setupRequest);
         if (workspaceTeamSlug && setupTeam.slug !== workspaceTeamSlug) {
             throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Run setup in another directory to set up team '${setupTeam.slug}'.`);
         }
         if (fix) {
-            setupProjects = await fetchProjects(setupTeam.slug);
+            setupProjects = await fetchProjects(setupTeam.slug, setupRequest);
             if (setupProjects.length === 0)
                 throw new Error(`Team '${setupTeam.slug}' has no projects to restore.`);
         }
         else {
-            const selection = await resolveSetupProjects(setupTeam, projectArg, createProjectArg, noInput, dryRun);
+            const selection = await resolveSetupProjects(setupTeam, projectArg, createProjectArg, noInput, dryRun, setupRequest);
             selectedProject = selection.selected;
             setupProjects = selection.projects;
             printLine(`Selected project ${sanitizeTerminalText(`${setupTeam.slug}/${selectedProject.slug}`)}`);
@@ -2754,7 +2699,7 @@ async function setupCommand() {
     let workspaceResult = null;
     let validationLogPath = null;
     if (hasArg('--no-workspace') && !validateOnly && !fix) {
-        printLine('   Skipped (--no-workspace).');
+        printLine('Skipped (--no-workspace).');
     }
     else {
         const wantsWorkspace = validateOnly
@@ -2772,20 +2717,20 @@ async function setupCommand() {
                 teamSlug = setupTeam.slug;
                 teamId = setupTeam.id;
                 projects = projectSeedsFromProjects(setupProjects);
-                printLine(`   ${formatProjectSetupProgress(projects.length)}`);
+                printLine(formatProjectSetupProgress(projects.length));
             }
             else if (!teamSlug && !noInput && !validateOnly) {
-                teamSlug = await askText('   Team slug?', 'local-team');
+                teamSlug = await askText('Team slug?', 'local-team');
             }
             if (auth.state !== 'signed-in' && (!teamSlug || !projectSlug) && noInput && hasArg('--workspace')) {
-                printLine('   Using starter local-only team/project. Pass --team with authentication to materialize server projects.');
+                printLine('Using starter local-only team/project. Pass --team with authentication to materialize server projects.');
             }
             if (projectSlug && auth.state !== 'signed-in') {
                 projects = [{ slug: projectSlug }];
             }
             if (auth.state !== 'signed-in' && !validateOnly) {
                 const localProjectCount = projects?.length || 1;
-                printLine(`   ${formatProjectSetupProgress(localProjectCount)}`);
+                printLine(formatProjectSetupProgress(localProjectCount));
             }
             const result = initOrizuWorkspace({
                 workspaceRoot,
@@ -2806,14 +2751,14 @@ async function setupCommand() {
             workspaceState = result.state;
             if (dryRun || verbose) {
                 for (const action of result.actions) {
-                    printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`);
+                    printLine(`${dryRun ? 'Would ' : 'Did '}${action}`);
                 }
             }
             else if (result.actions.length > 0) {
-                printLine(validateOnly ? '   Workspace validation complete' : '   Workspace setup complete');
+                printLine(validateOnly ? 'Workspace validation complete' : 'Workspace setup complete');
             }
             else if (!validateOnly) {
-                printLine('   Workspace setup complete');
+                printLine('Workspace setup complete');
             }
             validationLogPath = writeWorkspaceValidationLog(result.root, result.findings, dryRun);
             if (verbose) {
@@ -2824,7 +2769,7 @@ async function setupCommand() {
             }
         }
         else {
-            printLine(`   Skipped. Rerun with --workspace to initialize the workspace contract.`);
+            printLine('Skipped. Rerun with --workspace to initialize the workspace contract.');
         }
     }
     printLine('');
@@ -2832,28 +2777,21 @@ async function setupCommand() {
     let installOutcomes = [];
     printLine('Step 3: Install coding agent skills');
     if (hasArg('--no-install') || validateOnly || fix) {
-        printLine(hasArg('--no-install') ? '   Skipped (--no-install).' : '   Skipped for validation/repair.');
+        printLine(hasArg('--no-install') ? 'Skipped (--no-install).' : 'Skipped for validation/repair.');
     }
     else {
         let targets = setupSkillTargetsFromArgs();
         if (targets.length === 0 && !noInput && !dryRun) {
-            if (await askYesNo('   Install the Orizu skill for your coding agents?', true)) {
-                targets = ['agent-user'];
-                const choices = detectedSetupSkillChoices(setupSkillHome);
-                if (choices.length > 0) {
-                    const selectedChoices = await promptKeyboardMultiSelect('Choose additional native agent installs', choices, choice => choice.label, () => true);
-                    for (const choice of selectedChoices) {
-                        if (!targets.includes(choice.target))
-                            targets.push(choice.target);
-                    }
-                }
+            if (await askYesNo('Install the Orizu skill for your coding agents?', true)) {
+                const selectedChoices = await promptKeyboardMultiSelect('Choose skill installation destinations', detectedSetupSkillChoices(setupSkillHome), choice => choice.label, () => true);
+                targets = selectedChoices.map(choice => choice.target);
             }
         }
         if (targets.length === 0) {
-            printLine('   Skipped skill install.');
+            printLine('Skipped skill install.');
         }
         else {
-            printLine('   Installing skills...');
+            printLine('Installing skills...');
             installOutcomes = await applySkillInstallTargets(targets, {
                 mode: installMode,
                 skipConfirm: true,
@@ -2864,18 +2802,18 @@ async function setupCommand() {
                 printResults: false,
             });
             if (dryRun) {
-                printLine('   Dry run: no skill files were changed.');
+                printLine('Dry run: no skill files were changed.');
             }
             for (const outcome of installOutcomes) {
                 const label = setupSkillLabel(outcome.target);
                 if (outcome.action === 'failed') {
-                    printLine(`   ${label} failed: ${outcome.error}`);
+                    printLine(`${label} failed: ${sanitizeSetupHumanInlineText(outcome.error)}`);
                 }
                 else if (outcome.action === 'skipped') {
-                    printLine(`   ${label} skipped`);
+                    printLine(`${label} skipped`);
                 }
                 else {
-                    printLine(`   ${label} installed`);
+                    printLine(`${label} installed`);
                 }
             }
         }
@@ -2894,51 +2832,64 @@ async function setupCommand() {
             printLine('--- prompt end ---');
             printLine('');
         }
-        const detected = Object.keys(LAUNCHABLE_AGENTS)
-            .filter(agent => findExecutable(LAUNCHABLE_AGENTS[agent]));
+        const detected = Object.entries(AGENT_LAUNCH_SPECS)
+            .filter(([, spec]) => findExecutable(spec.command))
+            .map(([agent]) => agent);
         let launchAgent = getArg('--launch');
-        if (launchAgent && !(launchAgent in LAUNCHABLE_AGENTS)) {
-            throw new Error(`Unknown --launch agent '${launchAgent}'. Choices: ${Object.keys(LAUNCHABLE_AGENTS).join(', ')}.`);
+        let completedInteractiveHandoff = false;
+        if (launchAgent && !(launchAgent in AGENT_LAUNCH_SPECS)) {
+            throw new Error(`Unknown --launch agent '${launchAgent}'. Choices: ${Object.keys(AGENT_LAUNCH_SPECS).join(', ')}.`);
         }
-        if (!launchAgent && !noInput && isInteractiveTerminal() && detected.length > 0 && !dryRun) {
-            const launchChoice = await promptKeyboardSelect('Choose an agent to launch', [null, ...detected], agent => agent === null ? "Don't launch an agent" : LAUNCHABLE_AGENTS[agent]);
-            launchAgent = launchChoice;
+        if (!launchAgent && !noInput && isInteractiveTerminal() && !dryRun) {
+            const launchChoice = await promptKeyboardSelect('Choose an agent to launch', [...detected, 'other'], agent => agent === 'other' ? 'Other' : AGENT_LAUNCH_SPECS[agent].displayLabel, { onEscape: () => 'escape', escapeLabel: 'skip' });
+            completedInteractiveHandoff = true;
+            if (launchChoice === 'other') {
+                if (!handoffRequested) {
+                    printLine('--- prompt start ---');
+                    printLine(handoffPrompt);
+                    printLine('--- prompt end ---');
+                    printLine('');
+                }
+            }
+            else if (launchChoice !== 'escape') {
+                launchAgent = launchChoice;
+            }
         }
         if (launchAgent) {
-            const binary = findExecutable(LAUNCHABLE_AGENTS[launchAgent]);
+            const launchSpec = AGENT_LAUNCH_SPECS[launchAgent];
+            const binary = findExecutable(launchSpec.command);
             if (inputDisabled) {
-                printLine('   Not launching: setup is non-interactive.');
+                printLine('Not launching: setup is non-interactive.');
             }
             else if (!isInteractiveTerminal()) {
-                printLine('   Not launching: --launch requires an interactive terminal.');
+                printLine('Not launching: --launch requires an interactive terminal.');
             }
             else if (!binary) {
-                printLine(`   Not launching: '${LAUNCHABLE_AGENTS[launchAgent]}' was not found on PATH.`);
+                printLine(`Not launching: '${launchSpec.command}' was not found on PATH.`);
             }
             else if (dryRun) {
-                printLine(`   Would launch ${binary} with the setup prompt.`);
+                printLine(`Would launch ${binary} with the setup prompt.`);
             }
-            else if (!getArg('--launch') || skipConfirm || await askYesNo(`   Launch ${LAUNCHABLE_AGENTS[launchAgent]} with the setup prompt now?`, true)) {
-                printLine(`   Launching ${binary}…`);
-                const launched = spawnSync(binary, [handoffPrompt], { cwd: workspaceRoot, stdio: 'inherit' });
+            else if (!getArg('--launch') || skipConfirm || await askYesNo(`Launch ${launchSpec.displayLabel} with the setup prompt now?`, true)) {
+                printLine(`Launching ${binary}…`);
+                const launched = spawnSync(binary, launchSpec.buildPromptArgs(handoffPrompt), {
+                    cwd: workspaceRoot,
+                    stdio: 'inherit',
+                    shell: false,
+                });
                 if (!launched.error)
                     launchedAgent = launchAgent;
                 if (launched.error || (launched.status !== null && launched.status !== 0)) {
-                    printLine(`   ${LAUNCHABLE_AGENTS[launchAgent]} exited without completing successfully.`);
+                    printLine(`${launchSpec.displayLabel} exited without completing successfully.`);
                 }
             }
         }
-        else if (detected.length === 0) {
-            printLine(`   No launchable coding agent was found. Read https://orizu.ai/llms.txt to get started.`);
+        else if (detected.length === 0 && !completedInteractiveHandoff) {
+            printLine('No launchable coding agent was found. Read https://orizu.ai/llms.txt to get started.');
         }
         printLine('');
     }
     // Setup summary (success criteria checklist)
-    const summaryTargets = installOutcomes.length > 0
-        ? installOutcomes
-            .filter(outcome => outcome.action !== 'failed')
-            .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target, { cwd: workspaceRoot, homeDir: setupSkillHome }) }))
-        : [];
     const source = resolveSkillSource();
     if (hasJsonFlag()) {
         printJson({
@@ -2984,19 +2935,8 @@ async function setupCommand() {
     }
     printLine('Setup summary');
     printLine(`  Auth:         ${auth.state === 'signed-in' ? `signed in (${sanitizeTerminalText(auth.baseUrl)})` : 'not signed in — run `orizu login`'}`);
-    if (summaryTargets.length > 0) {
-        printLine('  Skills:');
-        for (const { outcome, status } of summaryTargets) {
-            const modeLabel = status.mode ? `, ${status.mode}` : '';
-            printLine(`    ${outcome.target.padEnd(16)} ${status.state}${modeLabel}  ${outcome.path}`);
-        }
-    }
-    else {
-        printLine('  Skills:       none installed this run');
-    }
-    const failed = installOutcomes.filter(outcome => outcome.action === 'failed');
-    for (const failure of failed) {
-        printLine(`    ${failure.target.padEnd(16)} failed: ${failure.error}`);
+    for (const line of renderSetupSkillSummary(installOutcomes, setupSkillHome)) {
+        printLine(line);
     }
     printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : getWorkspaceRoot(workspaceRoot)}`);
     if (workspaceResult) {