orizu 0.5.24 → 0.5.26

package/src/index.ts

@@ -5,7 +5,6 @@ import { fileURLToPath } from 'url'
 import { createServer } from 'http'
 import { gunzipSync, gzipSync } from 'zlib'
 import {
-  existsSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -15,7 +14,7 @@ import {
   writeFileSync,
 } from 'fs'
 import { spawn, spawnSync } from 'child_process'
-import { homedir, tmpdir } from 'os'
+import { tmpdir } from 'os'
 import { createInterface } from 'readline/promises'
 import { emitKeypressEvents } from 'readline'
 import { stdin as input, stdout as output } from 'process'
@@ -33,6 +32,10 @@ import { parseDatasetReference } from './dataset-download.js'
 import { editDatasetRows as runEditDatasetRows } from './dataset-edit-rows.js'
 import { ensureDatasetUploadSnapshot } from './dataset-upload-snapshot.js'
 import { extractErrorMessage } from './error-response.js'
+import {
+  describeLogoutHttpFailure,
+  describeLogoutTransportFailure,
+} from './logout-diagnostic.js'
 import { parseGlobalFlags } from './global-flags.js'
 import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js'
 import { getCapabilities, renderHelpForArgs, renderRootHelp } from './help.js'
@@ -41,10 +44,12 @@ import { readAssignmentManifestJsonlFile } from './task-assignment-manifest.js'
 import {
   assertSecureTokenTransport,
   authedFetch,
+  captureAuthenticatedRequestContext,
   credentialRequestRedirectPolicy,
   getBaseUrl,
   resolveLoginBaseUrl,
   setGlobalFlags,
+  type AuthenticatedRequestContext,
 } from './http.js'
 import {
   computeSkillContentHash,
@@ -57,7 +62,6 @@ import {
   resolveSkillSource,
   SKILL_INSTALL_AGENTS,
   SKILL_INSTALL_TARGETS,
-  SkillInstallAgent,
   SkillInstallMode,
   SkillInstallScope,
   SkillInstallTarget,
@@ -67,7 +71,20 @@ import {
 import { renderBanner } from './banner.js'
 import { formatTaskCreateError } from './task-create-error.js'
 import { renderAgentSetupPrompt } from './setup-prompt.js'
-import { findExecutable, LAUNCHABLE_AGENTS, setupLaunchPrompt, validateSetupAgentArgs, validateSetupFlagValues, validateSetupSelectionArgs } from './setup-onboarding.js'
+import {
+  AGENT_LAUNCH_SPECS,
+  detectedSetupSkillChoices,
+  findExecutable,
+  resolveSetupSkillHome,
+  setupLaunchPrompt,
+  setupNativeTargetForAgent,
+  validateSetupAgentArgs,
+  validateSetupFlagValues,
+  validateSetupSelectionArgs,
+} from './setup-onboarding.js'
+import { promptKeyboardSelect } from './keyboard-select.js'
+import { confirmExistingSetupAccount, describeSetupAuthState } from './setup-account.js'
+import { renderSetupSkillSummary, sanitizeSetupHumanInlineText } from './setup-summary.js'
 import { LoginResponse } from './types.js'
 import {
   getWorkspaceRoot,
@@ -666,24 +683,26 @@ async function promptSelect<T>(
   }
 }
 
-async function fetchTeams(): Promise<Team[]> {
-  const response = await authedFetch('/api/cli/teams')
+type AuthenticatedRequest = AuthenticatedRequestContext['fetch']
+async function fetchTeams(request: AuthenticatedRequest = authedFetch): Promise<Team[]> {
+  const response = await request('/api/cli/teams')
   if (!response.ok) {
     throw new Error(`Failed to fetch teams: ${await response.text()}`)
   }
-
   const data = await parseJsonResponse<{ teams: Team[] }>(response, 'Teams list')
   return data.teams
 }
 
-async function fetchProjects(teamSlug?: string): Promise<Project[]> {
+async function fetchProjects(
+  teamSlug?: string,
+  request: AuthenticatedRequest = authedFetch
+): Promise<Project[]> {
   const normalizedTeamSlug = teamSlug ? normalizeSlugInput(teamSlug) : undefined
   const query = normalizedTeamSlug ? `?teamSlug=${encodeURIComponent(normalizedTeamSlug)}` : ''
-  const response = await authedFetch(`/api/cli/projects${query}`)
+  const response = await request(`/api/cli/projects${query}`)
   if (!response.ok) {
     throw new Error(`Failed to fetch projects: ${await response.text()}`)
   }
-
   const data = await parseJsonResponse<{ projects: Project[] }>(response, 'Projects list')
   return data.projects
 }
@@ -736,32 +755,35 @@ async function fetchTeamMembers(teamSlug: string): Promise<TeamMember[]> {
   return data.members
 }
 
-async function createTeamOnServer(name: string): Promise<Team> {
-  const response = await authedFetch('/api/cli/teams', {
+async function createTeamOnServer(
+  name: string,
+  request: AuthenticatedRequest = authedFetch
+): Promise<Team> {
+  const response = await request('/api/cli/teams', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ name }),
   })
-
   if (!response.ok) {
     throw new Error(`Failed to create team: ${await response.text()}`)
   }
-
   const data = await parseJsonResponse<{ team: Team }>(response, 'Team create')
   return data.team
 }
 
-async function createProjectOnServer(teamSlug: string, name: string): Promise<Project> {
-  const response = await authedFetch('/api/cli/projects', {
+async function createProjectOnServer(
+  teamSlug: string,
+  name: string,
+  request: AuthenticatedRequest = authedFetch
+): Promise<Project> {
+  const response = await request('/api/cli/projects', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ teamSlug, name }),
   })
-
   if (!response.ok) {
     throw new Error(`Failed to create project: ${await response.text()}`)
   }
-
   const data = await parseJsonResponse<{
     project: {
       id: string
@@ -773,7 +795,6 @@ async function createProjectOnServer(teamSlug: string, name: string): Promise<Pr
       role?: string
     }
   }>(response, 'Project create')
-
   return {
     id: data.project.id,
     name: data.project.name,
@@ -1052,8 +1073,9 @@ function resolveAuthCallbackPort(): number {
   return parsed
 }
 
-async function login() {
-  const baseUrl = hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl()
+async function login(baseUrlOverride?: string) {
+  const baseUrl = baseUrlOverride
+    ?? (hasArg('--no-prompt-if-logged-in') ? getBaseUrl() : resolveLoginBaseUrl())
   assertSecureTokenTransport(baseUrl)
 
   // hasResolvableAuth (ALI-1090): an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE)
@@ -1184,7 +1206,6 @@ async function whoami() {
   if (!response.ok) {
     throw new Error(`whoami failed: ${await response.text()}`)
   }
-
   const data = await response.json() as { user: { id: string; email: string | null } }
   if (hasJsonFlag()) {
     printJson({ user: data.user, server: getBaseUrl() })
@@ -1193,8 +1214,8 @@ async function whoami() {
   printLine(sanitizeTerminalText(data.user.email ?? data.user.id))
 }
 
-async function logout() {
-  const baseUrl = getBaseUrl()
+async function logout(baseUrlOverride?: string) {
+  const baseUrl = baseUrlOverride || getBaseUrl()
   const credentials = getServerCredentials(baseUrl)
   if (!credentials) {
     if (hasJsonFlag()) {
@@ -1204,7 +1225,13 @@ async function logout() {
     printLine(`Already logged out for ${sanitizeTerminalText(baseUrl)}.`)
     return
   }
-
+  const authorizationToken = 'accessToken' in credentials
+    ? credentials.accessToken
+    : credentials.apiKey
+  const logoutSecrets = [
+    authorizationToken,
+    ...('refreshToken' in credentials ? [credentials.refreshToken] : []),
+  ]
   let remoteLogoutError: string | null = null
   try {
     assertSecureTokenTransport(baseUrl)
@@ -1212,22 +1239,19 @@ async function logout() {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${'accessToken' in credentials ? credentials.accessToken : credentials.apiKey}`,
+        Authorization: `Bearer ${authorizationToken}`,
       },
       body: 'refreshToken' in credentials
         ? JSON.stringify({ refreshToken: credentials.refreshToken })
         : undefined,
       ...credentialRequestRedirectPolicy(),
     })
-
     if (!response.ok) {
-      remoteLogoutError = sanitizeTerminalText(await response.text()).slice(0, 180)
+      remoteLogoutError = await describeLogoutHttpFailure(response, logoutSecrets)
     }
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
-    remoteLogoutError = sanitizeTerminalText(message).slice(0, 180)
+    remoteLogoutError = describeLogoutTransportFailure(error, logoutSecrets)
   }
-
   clearServerCredentials(baseUrl)
   if (hasJsonFlag()) {
     printJson({ status: 'logged-out', server: baseUrl, remoteLogoutError })
@@ -2754,87 +2778,6 @@ async function waitForAnyKeyOrEscape(message: string): Promise<boolean> {
   })
 }
 
-async function promptKeyboardSelect<T>(
-  title: string,
-  items: T[],
-  label: (item: T, index: number) => string
-): Promise<T> {
-  if (items.length === 0) {
-    throw new Error(`No options available for ${title.toLowerCase()}`)
-  }
-  if (!isInteractiveTerminal()) {
-    throw new Error(`${title} selection requires interactive terminal. Provide flags explicitly instead.`)
-  }
-
-  printLine(`\n${sanitizeTerminalText(title)}`)
-  printLine('Use ↑/↓ to choose, Enter to confirm, or Esc to cancel.')
-
-  let selected = 0
-  let rendered = false
-  const rawInput = input as RawInput
-  const wasRaw = Boolean(rawInput.isRaw)
-  emitKeypressEvents(input)
-
-  function render() {
-    if (rendered) {
-      output.write(`\x1b[${items.length}A`)
-    }
-    items.forEach((item, index) => {
-      output.write('\x1b[2K')
-      const marker = index === selected ? '●' : '○'
-      output.write(`  ${marker} ${sanitizeTerminalText(label(item, index))}\n`)
-    })
-    rendered = true
-  }
-
-  render()
-  output.write('\x1b[?25l')
-
-  return new Promise((resolvePromise, rejectPromise) => {
-    function cleanup() {
-      input.off('keypress', onKeypress)
-      if (rawInput.setRawMode && !wasRaw) {
-        rawInput.setRawMode(false)
-      }
-      input.pause()
-      output.write('\x1b[?25h')
-      printLine('')
-    }
-
-    function onKeypress(_chunk: string, key: KeypressInfo) {
-      if (key.ctrl && key.name === 'c') {
-        cleanup()
-        rejectPromise(new Error('Setup cancelled.'))
-        return
-      }
-      if (key.name === 'escape') {
-        cleanup()
-        rejectPromise(new Error('Setup cancelled.'))
-        return
-      }
-      if (key.name === 'up') {
-        selected = (selected - 1 + items.length) % items.length
-        render()
-        return
-      }
-      if (key.name === 'down') {
-        selected = (selected + 1) % items.length
-        render()
-        return
-      }
-      if (key.name === 'return' || key.name === 'enter') {
-        const item = items[selected]
-        cleanup()
-        resolvePromise(item)
-      }
-    }
-
-    input.on('keypress', onKeypress)
-    input.resume()
-    rawInput.setRawMode?.(true)
-  })
-}
-
 async function promptKeyboardMultiSelect<T>(
   title: string,
   items: T[],
@@ -2984,14 +2927,14 @@ function writeWorkspaceValidationLog(
 
 function printWorkspaceFindings(findings: { severity: string, code: string, path?: string, message: string }[]) {
   if (findings.length === 0) {
-    printLine('   Validation passed.')
+    printLine('Validation passed.')
     return
   }
 
-  printLine('   Validation findings:')
+  printLine('Validation findings:')
   for (const finding of findings) {
     const path = finding.path ? ` ${finding.path}` : ''
-    printLine(`   - ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`)
+    printLine(`- ${finding.severity.toUpperCase()} ${finding.code}:${path} ${finding.message}`)
   }
 }
 
@@ -3367,15 +3310,6 @@ function skillsPathCommand() {
   printLine(hasArg('--skill-md') ? source.skillMd : source.root)
 }
 
-function describeSetupAuthState(): { state: 'signed-in' | 'signed-out', baseUrl: string } {
-  const baseUrl = getBaseUrl()
-  return {
-    // ALI-1090: an env bearer (ORIZU_TOKEN / ORIZU_TOKEN_FILE) is signed-in too.
-    state: hasResolvableAuth(baseUrl) ? 'signed-in' : 'signed-out',
-    baseUrl,
-  }
-}
-
 type SetupTeamChoice =
   | { kind: 'team', team: Team }
   | { kind: 'create' }
@@ -3385,7 +3319,8 @@ async function resolveSetupTeam(
   createTeamName: string | null,
   noInput: boolean,
   dryRun: boolean,
-  workspaceTeamSlug: string | null
+  workspaceTeamSlug: string | null,
+  request: AuthenticatedRequest = authedFetch
 ): Promise<Team> {
   if (teamSlugArg && createTeamName) {
     throw new Error('Use either --team <slug> or --create-team <name>, not both.')
@@ -3397,14 +3332,12 @@ async function resolveSetupTeam(
     if (workspaceTeamSlug) throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Create the new team from another directory.`)
     const name = createTeamName.trim()
     if (!name) throw new Error('--create-team requires a non-empty team name.')
-    const team = await createTeamOnServer(name)
-    printLine(`   Created team ${sanitizeTerminalText(team.slug)}`)
+    const team = await createTeamOnServer(name, request)
+    printLine(`Created team ${sanitizeTerminalText(team.slug)}`)
     return team
   }
-
-  const teams = await fetchTeams()
+  const teams = await fetchTeams(request)
   const normalizedTeamSlug = teamSlugArg ? normalizeSlugInput(teamSlugArg) : null
-
   if (normalizedTeamSlug) {
     const team = teams.find(candidate => candidate.slug === normalizedTeamSlug)
     if (!team) {
@@ -3412,11 +3345,9 @@ async function resolveSetupTeam(
     }
     return team
   }
-
   if (noInput || dryRun) {
     throw new Error('Non-interactive setup requires --team <slug> or --create-team <name>.')
   }
-
   const choices: SetupTeamChoice[] = [
     ...teams.map(team => ({ kind: 'team' as const, team })),
     ...(teams.some(team => team.role === 'agent') ? [] : [{ kind: 'create' as const }]),
@@ -3428,18 +3359,16 @@ async function resolveSetupTeam(
       ? 'Create a new team'
       : `${item.team.name} (${item.team.slug})`
   )
-
   if (choice.kind === 'team') {
     return choice.team
   }
-
-  const name = await askText('   Team name?', '')
+  const name = await askText('Team name?', '')
   if (!name) {
     throw new Error('Team name is required to create a team.')
   }
   if (workspaceTeamSlug) throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Create the new team from another directory.`)
-  const team = await createTeamOnServer(name)
-  printLine(`   Created team ${sanitizeTerminalText(team.slug)}`)
+  const team = await createTeamOnServer(name, request)
+  printLine(`Created team ${sanitizeTerminalText(team.slug)}`)
   return team
 }
 
@@ -3456,7 +3385,8 @@ async function resolveSetupProjects(
   projectSlugArg: string | null,
   createProjectName: string | null,
   noInput: boolean,
-  dryRun: boolean
+  dryRun: boolean,
+  request: AuthenticatedRequest
 ): Promise<SetupProjectSelection> {
   if (projectSlugArg && createProjectName) {
     throw new Error('Use either --project <slug> or --create-project <name>, not both.')
@@ -3464,23 +3394,21 @@ async function resolveSetupProjects(
   if ((noInput || dryRun) && !projectSlugArg && !createProjectName) {
     throw new Error('Non-interactive setup requires --project <slug> or --create-project <name>.')
   }
-
   const canCreateProject = team.role === 'admin' || team.role === 'agent'
   if (createProjectName && !canCreateProject) {
     throw new Error(`Only team admins can create projects in '${team.slug}'. Choose an existing project or ask a team admin to create one.`)
   }
-  const projects = await fetchProjects(team.slug)
+  const projects = await fetchProjects(team.slug, request)
   if (createProjectName) {
     if (dryRun) {
       throw new Error('--create-project cannot be used with --dry-run because setup cannot preview a server-generated project slug.')
     }
     const name = createProjectName.trim()
     if (!name) throw new Error('--create-project requires a non-empty project name.')
-    const selected = await createProjectOnServer(team.slug, name)
-    printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
+    const selected = await createProjectOnServer(team.slug, name, request)
+    printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
     return { selected, projects: [...projects, selected] }
   }
-
   const normalizedProjectSlug = projectSlugArg ? normalizeSlugInput(projectSlugArg) : null
   if (normalizedProjectSlug) {
     const selected = projects.find(project => project.slug === normalizedProjectSlug)
@@ -3489,17 +3417,15 @@ async function resolveSetupProjects(
     }
     return { selected, projects }
   }
-
   if (projects.length === 0) {
     if (!canCreateProject) throw new Error(`Team '${team.slug}' has no accessible projects, and only team admins can create one.`)
-    printLine(`   Team '${sanitizeTerminalText(team.slug)}' has no projects yet. Let's create the first one.`)
-    const name = await askText('   Project name?', '')
+    printLine(`Team '${sanitizeTerminalText(team.slug)}' has no projects yet. Let's create the first one.`)
+    const name = await askText('Project name?', '')
     if (!name) throw new Error('Project name is required to create a project.')
-    const selected = await createProjectOnServer(team.slug, name)
-    printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
+    const selected = await createProjectOnServer(team.slug, name, request)
+    printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
     return { selected, projects: [selected] }
   }
-
   const choices: SetupProjectChoice[] = [
     ...projects.map(project => ({ kind: 'project' as const, project })),
     ...(canCreateProject ? [{ kind: 'create' as const }] : []),
@@ -3514,11 +3440,10 @@ async function resolveSetupProjects(
   if (choice.kind === 'project') {
     return { selected: choice.project, projects }
   }
-
-  const name = await askText('   Project name?', '')
+  const name = await askText('Project name?', '')
   if (!name) throw new Error('Project name is required to create a project.')
-  const selected = await createProjectOnServer(team.slug, name)
-  printLine(`   Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
+  const selected = await createProjectOnServer(team.slug, name, request)
+  printLine(`Created project ${sanitizeTerminalText(`${selected.teamSlug}/${selected.slug}`)}`)
   return { selected, projects: [...projects, selected] }
 }
 
@@ -3534,47 +3459,6 @@ function formatProjectSetupProgress(count: number): string {
   return `${count} project${count === 1 ? '' : 's'} being set up in workspace...`
 }
 
-interface SetupSkillChoice {
-  agent: SkillInstallAgent
-  label: string
-  target: SkillInstallTarget
-}
-
-const SETUP_NATIVE_SKILL_CHOICES: ReadonlyArray<{
-  agent: SkillInstallAgent
-  label: string
-  directory: string[]
-  binary?: string
-}> = [
-  { agent: 'claude', label: 'Claude Code', directory: ['.claude'], binary: 'claude' },
-  { agent: 'devin', label: 'Devin', directory: ['.devin', 'skills'] },
-  { agent: 'droid', label: 'Droid', directory: ['.factory', 'skills'] },
-  { agent: 'grok', label: 'Grok Build', directory: ['.grok', 'skills'] },
-  { agent: 'windsurf', label: 'Windsurf', directory: ['.windsurf', 'skills'] },
-  { agent: 'opencode', label: 'OpenCode', directory: ['.config', 'opencode', 'skills'], binary: 'opencode' },
-]
-
-function setupNativeTargetForAgent(agent: SkillInstallAgent): SkillInstallTarget | null {
-  if (agent === 'codex' || agent === 'pi') return null
-  return getTargetForAgent(agent, 'global')
-}
-function resolveSetupSkillHome(): string {
-  return resolve(process.env.HOME || homedir())
-}
-
-function detectedSetupSkillChoices(homeDir: string): SetupSkillChoice[] {
-  return SETUP_NATIVE_SKILL_CHOICES
-    .filter(choice =>
-      existsSync(join(homeDir, ...choice.directory))
-      || Boolean(choice.binary && findExecutable(choice.binary))
-    )
-    .map(choice => ({
-      agent: choice.agent,
-      label: choice.label,
-      target: getTargetForAgent(choice.agent, 'global'),
-    }))
-}
-
 function setupSkillTargetsFromArgs(): SkillInstallTarget[] {
   const targets: SkillInstallTarget[] = []
   for (const agent of getArgs('--agent')) {
@@ -3626,26 +3510,68 @@ async function setupCommand() {
   if (workspaceManifest.state === 'invalid' && !validateOnly && !fix) throw new Error('The existing orizu.team.json is invalid or unreadable. Repair it before creating remote resources.')
   const workspaceTeamSlug = workspaceManifest.state === 'valid' ? workspaceManifest.slug : null
   if (createTeamArg !== null && workspaceTeamSlug) throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Create the new team from another directory.`)
-
   printBannerIfInteractive()
   printLine('Orizu setup')
   printLine('')
-
   // Step 1: login
   printLine('Step 1: Login')
   let auth = describeSetupAuthState()
+  let setupAuthContext: AuthenticatedRequestContext | null = null
   if (hasArg('--skip-login')) {
-    printLine('   Skipped (--skip-login).')
+    printLine('Skipped (--skip-login).')
   } else if (auth.state === 'signed-in') {
-    printLine(`   Already authenticated with ${sanitizeTerminalText(auth.baseUrl)}.`)
+    if (!validateOnly) {
+      setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun })
+    }
+    if (!noInput && !validateOnly) {
+      const confirmation = await confirmExistingSetupAccount(
+        setupAuthContext!,
+        email => promptKeyboardSelect(
+          'Confirm the account to use for setup',
+          ['continue', 'switch'] as const,
+          item => item === 'continue'
+            ? `Continue as ${email}`
+            : 'Log in with a different account'
+        ),
+        async () => {
+          const context = setupAuthContext!
+          const logoutResult = await context.logout()
+          if (logoutResult.remoteError) {
+            const localOutcome = logoutResult.localCredentialCleared
+              ? 'Local credentials were cleared.'
+              : 'Local credentials were not cleared because a newer login is active.'
+            console.warn(
+              `Warning: remote logout failed: ${logoutResult.remoteError} ${localOutcome}`
+            )
+          } else if (!logoutResult.localCredentialCleared) {
+            console.warn('Warning: local credentials were not cleared because a newer login is active.')
+          }
+          printLine(logoutResult.localCredentialCleared
+            ? `Logged out from ${sanitizeTerminalText(context.baseUrl)}.`
+            : `Kept the newer login for ${sanitizeTerminalText(context.baseUrl)}.`)
+          await login(context.baseUrl)
+        },
+        { dryRun }
+      )
+      if (confirmation === 'switched') {
+        setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun })
+      }
+      auth = { state: 'signed-in', baseUrl: setupAuthContext!.baseUrl }
+    } else {
+      printLine(`Already authenticated with ${sanitizeTerminalText(auth.baseUrl)}.`)
+    }
   } else if (noInput || dryRun) {
-    printLine('   Not signed in. Run `orizu login` to authenticate.')
-  } else if (await waitForAnyKeyOrEscape('   Press any key to connect your account, or Esc to cancel.')) {
+    printLine('Not signed in. Run `orizu login` to authenticate.')
+  } else if (await waitForAnyKeyOrEscape('Press any key to connect your account, or Esc to cancel.')) {
     await login()
     auth = describeSetupAuthState()
   } else {
     throw new Error('Setup cancelled.')
   }
+  if (auth.state === 'signed-in' && !validateOnly && !setupAuthContext) {
+    setupAuthContext = captureAuthenticatedRequestContext({ allowRefresh: !dryRun })
+  }
+  if (setupAuthContext) auth = { state: 'signed-in', baseUrl: setupAuthContext.baseUrl }
   const serverCreateRequested = createTeamArg !== null || createProjectArg !== null
   if ((noInput || serverCreateRequested) && auth.state === 'signed-out' && !dryRun && !validateOnly && !fix) {
     throw new Error(
@@ -3653,20 +3579,20 @@ async function setupCommand() {
     )
   }
   printLine('')
-
   let setupTeam: Team | null = null
   let selectedProject: Project | null = null
   let setupProjects: Project[] = []
   if (auth.state === 'signed-in' && !validateOnly) {
-    setupTeam = await resolveSetupTeam(teamArg, createTeamArg, noInput, dryRun, workspaceTeamSlug)
+    const setupRequest = setupAuthContext!.fetch.bind(setupAuthContext)
+    setupTeam = await resolveSetupTeam(teamArg, createTeamArg, noInput, dryRun, workspaceTeamSlug, setupRequest)
     if (workspaceTeamSlug && setupTeam.slug !== workspaceTeamSlug) {
       throw new Error(`This directory is already an Orizu workspace for team '${workspaceTeamSlug}'. Run setup in another directory to set up team '${setupTeam.slug}'.`)
     }
     if (fix) {
-      setupProjects = await fetchProjects(setupTeam.slug)
+      setupProjects = await fetchProjects(setupTeam.slug, setupRequest)
       if (setupProjects.length === 0) throw new Error(`Team '${setupTeam.slug}' has no projects to restore.`)
     } else {
-      const selection = await resolveSetupProjects(setupTeam, projectArg, createProjectArg, noInput, dryRun)
+      const selection = await resolveSetupProjects(setupTeam, projectArg, createProjectArg, noInput, dryRun, setupRequest)
       selectedProject = selection.selected
       setupProjects = selection.projects
       printLine(`Selected project ${sanitizeTerminalText(`${setupTeam.slug}/${selectedProject.slug}`)}`)
@@ -3680,7 +3606,7 @@ async function setupCommand() {
   let workspaceResult: ReturnType<typeof initOrizuWorkspace> | null = null
   let validationLogPath: string | null = null
   if (hasArg('--no-workspace') && !validateOnly && !fix) {
-    printLine('   Skipped (--no-workspace).')
+    printLine('Skipped (--no-workspace).')
   } else {
     const wantsWorkspace = validateOnly
       || fix
@@ -3693,26 +3619,24 @@ async function setupCommand() {
       const projectSlug = projectArg
       let teamId: string | null = null
       let projects: WorkspaceProjectSeed[] | undefined
-
       if (setupTeam && !validateOnly) {
         teamSlug = setupTeam.slug
         teamId = setupTeam.id
         projects = projectSeedsFromProjects(setupProjects)
-        printLine(`   ${formatProjectSetupProgress(projects.length)}`)
+        printLine(formatProjectSetupProgress(projects.length))
       } else if (!teamSlug && !noInput && !validateOnly) {
-        teamSlug = await askText('   Team slug?', 'local-team')
+        teamSlug = await askText('Team slug?', 'local-team')
       }
       if (auth.state !== 'signed-in' && (!teamSlug || !projectSlug) && noInput && hasArg('--workspace')) {
-        printLine('   Using starter local-only team/project. Pass --team with authentication to materialize server projects.')
+        printLine('Using starter local-only team/project. Pass --team with authentication to materialize server projects.')
       }
       if (projectSlug && auth.state !== 'signed-in') {
         projects = [{ slug: projectSlug }]
       }
       if (auth.state !== 'signed-in' && !validateOnly) {
         const localProjectCount = projects?.length || 1
-        printLine(`   ${formatProjectSetupProgress(localProjectCount)}`)
+        printLine(formatProjectSetupProgress(localProjectCount))
       }
-
       const result = initOrizuWorkspace({
         workspaceRoot,
         teamSlug,
@@ -3732,12 +3656,12 @@ async function setupCommand() {
       workspaceState = result.state
       if (dryRun || verbose) {
         for (const action of result.actions) {
-          printLine(`   ${dryRun ? 'Would ' : 'Did '}${action}`)
+          printLine(`${dryRun ? 'Would ' : 'Did '}${action}`)
         }
       } else if (result.actions.length > 0) {
-        printLine(validateOnly ? '   Workspace validation complete' : '   Workspace setup complete')
+        printLine(validateOnly ? 'Workspace validation complete' : 'Workspace setup complete')
       } else if (!validateOnly) {
-        printLine('   Workspace setup complete')
+        printLine('Workspace setup complete')
       }
       validationLogPath = writeWorkspaceValidationLog(result.root, result.findings, dryRun)
       if (verbose) {
@@ -3747,40 +3671,32 @@ async function setupCommand() {
         process.exitCode = 1
       }
     } else {
-      printLine(`   Skipped. Rerun with --workspace to initialize the workspace contract.`)
+      printLine('Skipped. Rerun with --workspace to initialize the workspace contract.')
     }
   }
   printLine('')
-
   // Step 3: global coding-agent skills
   let installOutcomes: SkillInstallOutcome[] = []
   printLine('Step 3: Install coding agent skills')
   if (hasArg('--no-install') || validateOnly || fix) {
-    printLine(hasArg('--no-install') ? '   Skipped (--no-install).' : '   Skipped for validation/repair.')
+    printLine(hasArg('--no-install') ? 'Skipped (--no-install).' : 'Skipped for validation/repair.')
   } else {
     let targets = setupSkillTargetsFromArgs()
     if (targets.length === 0 && !noInput && !dryRun) {
-      if (await askYesNo('   Install the Orizu skill for your coding agents?', true)) {
-        targets = ['agent-user']
-        const choices = detectedSetupSkillChoices(setupSkillHome)
-        if (choices.length > 0) {
-          const selectedChoices = await promptKeyboardMultiSelect(
-            'Choose additional native agent installs',
-            choices,
-            choice => choice.label,
-            () => true
-          )
-          for (const choice of selectedChoices) {
-            if (!targets.includes(choice.target)) targets.push(choice.target)
-          }
-        }
+      if (await askYesNo('Install the Orizu skill for your coding agents?', true)) {
+        const selectedChoices = await promptKeyboardMultiSelect(
+          'Choose skill installation destinations',
+          detectedSetupSkillChoices(setupSkillHome),
+          choice => choice.label,
+          () => true
+        )
+        targets = selectedChoices.map(choice => choice.target)
       }
     }
-
     if (targets.length === 0) {
-      printLine('   Skipped skill install.')
+      printLine('Skipped skill install.')
     } else {
-      printLine('   Installing skills...')
+      printLine('Installing skills...')
       installOutcomes = await applySkillInstallTargets(targets, {
         mode: installMode,
         skipConfirm: true,
@@ -3791,22 +3707,21 @@ async function setupCommand() {
         printResults: false,
       })
       if (dryRun) {
-        printLine('   Dry run: no skill files were changed.')
+        printLine('Dry run: no skill files were changed.')
       }
       for (const outcome of installOutcomes) {
         const label = setupSkillLabel(outcome.target)
         if (outcome.action === 'failed') {
-          printLine(`   ${label} failed: ${outcome.error}`)
+          printLine(`${label} failed: ${sanitizeSetupHumanInlineText(outcome.error)}`)
         } else if (outcome.action === 'skipped') {
-          printLine(`   ${label} skipped`)
+          printLine(`${label} skipped`)
         } else {
-          printLine(`   ${label} installed`)
+          printLine(`${label} installed`)
         }
       }
     }
   }
   printLine('')
-
   // Phase 4: coding-agent handoff
   const handoffTeamSlug = setupTeam?.slug || workspaceResult?.teamSlug || null
   const handoffProjectSlug = selectedProject?.slug || (workspaceResult?.projectSlugs.length === 1 ? workspaceResult.projectSlugs[0] : null)
@@ -3820,55 +3735,65 @@ async function setupCommand() {
       printLine('--- prompt end ---')
       printLine('')
     }
-
-    const detected = Object.keys(LAUNCHABLE_AGENTS)
-      .filter(agent => findExecutable(LAUNCHABLE_AGENTS[agent]))
+    const detected = Object.entries(AGENT_LAUNCH_SPECS)
+      .filter(([, spec]) => findExecutable(spec.command))
+      .map(([agent]) => agent)
     let launchAgent = getArg('--launch')
-    if (launchAgent && !(launchAgent in LAUNCHABLE_AGENTS)) {
-      throw new Error(`Unknown --launch agent '${launchAgent}'. Choices: ${Object.keys(LAUNCHABLE_AGENTS).join(', ')}.`)
+    let completedInteractiveHandoff = false
+    if (launchAgent && !(launchAgent in AGENT_LAUNCH_SPECS)) {
+      throw new Error(`Unknown --launch agent '${launchAgent}'. Choices: ${Object.keys(AGENT_LAUNCH_SPECS).join(', ')}.`)
     }
 
-    if (!launchAgent && !noInput && isInteractiveTerminal() && detected.length > 0 && !dryRun) {
+    if (!launchAgent && !noInput && isInteractiveTerminal() && !dryRun) {
       const launchChoice = await promptKeyboardSelect(
         'Choose an agent to launch',
-        [null, ...detected],
-        agent => agent === null ? "Don't launch an agent" : LAUNCHABLE_AGENTS[agent]
+        [...detected, 'other'],
+        agent => agent === 'other' ? 'Other' : AGENT_LAUNCH_SPECS[agent].displayLabel,
+        { onEscape: () => 'escape', escapeLabel: 'skip' }
       )
-      launchAgent = launchChoice
+      completedInteractiveHandoff = true
+      if (launchChoice === 'other') {
+        if (!handoffRequested) {
+          printLine('--- prompt start ---')
+          printLine(handoffPrompt)
+          printLine('--- prompt end ---')
+          printLine('')
+        }
+      } else if (launchChoice !== 'escape') {
+        launchAgent = launchChoice
+      }
     }
-
     if (launchAgent) {
-      const binary = findExecutable(LAUNCHABLE_AGENTS[launchAgent])
+      const launchSpec = AGENT_LAUNCH_SPECS[launchAgent]
+      const binary = findExecutable(launchSpec.command)
       if (inputDisabled) {
-        printLine('   Not launching: setup is non-interactive.')
+        printLine('Not launching: setup is non-interactive.')
       } else if (!isInteractiveTerminal()) {
-        printLine('   Not launching: --launch requires an interactive terminal.')
+        printLine('Not launching: --launch requires an interactive terminal.')
       } else if (!binary) {
-        printLine(`   Not launching: '${LAUNCHABLE_AGENTS[launchAgent]}' was not found on PATH.`)
+        printLine(`Not launching: '${launchSpec.command}' was not found on PATH.`)
       } else if (dryRun) {
-        printLine(`   Would launch ${binary} with the setup prompt.`)
-      } else if (!getArg('--launch') || skipConfirm || await askYesNo(`   Launch ${LAUNCHABLE_AGENTS[launchAgent]} with the setup prompt now?`, true)) {
-        printLine(`   Launching ${binary}…`)
-        const launched = spawnSync(binary, [handoffPrompt], { cwd: workspaceRoot, stdio: 'inherit' })
+        printLine(`Would launch ${binary} with the setup prompt.`)
+      } else if (!getArg('--launch') || skipConfirm || await askYesNo(`Launch ${launchSpec.displayLabel} with the setup prompt now?`, true)) {
+        printLine(`Launching ${binary}…`)
+        const launched = spawnSync(binary, launchSpec.buildPromptArgs(handoffPrompt), {
+          cwd: workspaceRoot,
+          stdio: 'inherit',
+          shell: false,
+        })
         if (!launched.error) launchedAgent = launchAgent
         if (launched.error || (launched.status !== null && launched.status !== 0)) {
-          printLine(`   ${LAUNCHABLE_AGENTS[launchAgent]} exited without completing successfully.`)
+          printLine(`${launchSpec.displayLabel} exited without completing successfully.`)
         }
       }
-    } else if (detected.length === 0) {
-      printLine(`   No launchable coding agent was found. Read https://orizu.ai/llms.txt to get started.`)
+    } else if (detected.length === 0 && !completedInteractiveHandoff) {
+      printLine('No launchable coding agent was found. Read https://orizu.ai/llms.txt to get started.')
     }
     printLine('')
   }
 
   // Setup summary (success criteria checklist)
-  const summaryTargets = installOutcomes.length > 0
-    ? installOutcomes
-      .filter(outcome => outcome.action !== 'failed')
-      .map(outcome => ({ outcome, status: getSkillTargetStatus(outcome.target, { cwd: workspaceRoot, homeDir: setupSkillHome }) }))
-    : []
   const source = resolveSkillSource()
-
   if (hasJsonFlag()) {
     printJson({
       auth: { state: auth.state, server: auth.baseUrl },
@@ -3911,21 +3836,10 @@ async function setupCommand() {
     })
     return
   }
-
   printLine('Setup summary')
   printLine(`  Auth:         ${auth.state === 'signed-in' ? `signed in (${sanitizeTerminalText(auth.baseUrl)})` : 'not signed in — run `orizu login`'}`)
-  if (summaryTargets.length > 0) {
-    printLine('  Skills:')
-    for (const { outcome, status } of summaryTargets) {
-      const modeLabel = status.mode ? `, ${status.mode}` : ''
-      printLine(`    ${outcome.target.padEnd(16)} ${status.state}${modeLabel}  ${outcome.path}`)
-    }
-  } else {
-    printLine('  Skills:       none installed this run')
-  }
-  const failed = installOutcomes.filter(outcome => outcome.action === 'failed')
-  for (const failure of failed) {
-    printLine(`    ${failure.target.padEnd(16)} failed: ${failure.error}`)
+  for (const line of renderSetupSkillSummary(installOutcomes, setupSkillHome)) {
+    printLine(line)
   }
   printLine(`  Workspace:    ${workspaceState === 'skipped' ? 'skipped' : getWorkspaceRoot(workspaceRoot)}`)
   if (workspaceResult) {