sentinelayer-cli 0.46.4 → 0.48.0

package/src/commands/ai/identity-lifecycle.js

@@ -22,7 +22,7 @@ import {
   recordProvisionedIdentity,
   updateIdentityStatus,
 } from "../../ai/identity-store.js";
-import { resolveOutputRoot } from "../../config/service.js";
+import { resolveOutputRoot, resolveOutputContext } from "../../config/service.js";
 import {
   delay,
   hasExtractionSignal,
@@ -145,7 +145,7 @@ legalHold
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -172,7 +172,7 @@ legalHold
       status,
       underHold,
       identity: identityRecord,
-    });
+    }, outputFs);
 
     const payload = {
       command: "ai identity legal-hold status",
@@ -204,7 +204,7 @@ identity
   .action(async (options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -223,7 +223,7 @@ identity
       staleCount: staleScan.stale.length,
       totalCount: staleScan.identities.length,
       identities,
-    });
+    }, outputFs);
 
     const payload = {
       command: "ai identity audit",
@@ -269,7 +269,7 @@ identity
       throw new Error("At least one tag is required via --tags.");
     }
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -293,7 +293,7 @@ identity
       candidateIdentityIds: candidates.map((item) => item.identityId),
       blockedIdentityIds: blocked.map((item) => item.identityId),
       eligibleIdentityIds: eligible.map((item) => item.identityId),
-    });
+    }, outputFs);
 
     if (!options.execute) {
       const payload = {
@@ -345,6 +345,7 @@ identity
         revokeResponse = revokeExecution.response || null;
       }
       const updated = await updateIdentityStatus({
+        outputFs,
         outputRoot,
         identityId: identityRecord.identityId,
         status: "SQUASHED",
@@ -379,7 +380,7 @@ identity
       updated: updates,
       apiCalled: canCallApi,
       credentialsMissing: resolvedCredentials.missing,
-    });
+    }, outputFs);
 
     const payload = {
       command: "ai identity kill-all",
@@ -426,7 +427,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -441,7 +442,7 @@ identity
       apiUrl,
       idempotencyKey,
       identityId,
-    });
+    }, outputFs);
 
     const { registryPath, identity: trackedIdentity } = await getIdentityById({
       outputRoot,
@@ -472,7 +473,7 @@ identity
         credentialsMissing: resolvedCredentials.missing,
         trackedIdentity,
         curlPreview: [
-          `curl -X POST ${apiUrl}/v1/identities/${urlPathSegment(identityId, { label: "identityId" })}/revoke \\`,
+          `curl -X POST ${apiUrl}/v1/identities/${urlPathSegment(identityId, { label: "identityId" })}/squash \\`,
           `  -H \"Authorization: Bearer $AIDENID_API_KEY\" \\`,
           `  -H \"X-Org-Id: $AIDENID_ORG_ID\" \\`,
           `  -H \"X-Project-Id: $AIDENID_PROJECT_ID\" \\`,
@@ -517,10 +518,11 @@ identity
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const revokedAt = String(execution.response?.revokedAt || "").trim() || new Date().toISOString();
     const updated = await updateIdentityStatus({
+      outputFs,
       outputRoot,
       identityId,
       status: String(execution.response?.status || "REVOKED"),
@@ -576,7 +578,7 @@ identity
   .action(async (parentIdentityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -617,7 +619,7 @@ identity
       idempotencyKey,
       parentIdentityId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -695,9 +697,10 @@ identity
       idempotencyKey,
       parentIdentityId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordProvisionedIdentity({
+      outputFs,
       outputRoot,
       response: execution.response || {},
       context: {
@@ -758,7 +761,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -796,7 +799,7 @@ identity
       generatedAt: new Date().toISOString(),
       identityId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const rows = renderLineageRows({
       nodes: execution.nodes,
@@ -843,7 +846,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -865,7 +868,7 @@ identity
       apiUrl,
       idempotencyKey,
       identityId,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -937,12 +940,13 @@ identity
       idempotencyKey,
       identityId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const updateResults = await Promise.all(
       execution.revokedIdentityIds.map(async (revokedIdentityId) => {
         try {
           const updated = await updateIdentityStatus({
+            outputFs,
             outputRoot,
             identityId: revokedIdentityId,
             status: "SQUASHED",
@@ -1003,7 +1007,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1048,7 +1052,7 @@ identity
       cursor: String(options.cursor || "").trim() || null,
       limit,
       response: execution.response,
-    });
+    }, outputFs);
 
     const payload = {
       command: "ai identity events",
@@ -1096,7 +1100,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1149,7 +1153,7 @@ identity
       latestEvent,
       extraction: latestExtraction.extraction,
       extractionResponse: latestExtraction.response,
-    });
+    }, outputFs);
 
     const payload = {
       command: "ai identity latest",
@@ -1207,7 +1211,7 @@ identity
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1309,7 +1313,7 @@ identity
             extraction: lastExtraction,
           },
     };
-    await writeArtifact(outputPath, artifactPayload);
+    await writeArtifact(outputPath, artifactPayload, outputFs);
 
     if (!success) {
       throw new Error(

package/src/commands/ai/provision-governance.js

@@ -24,7 +24,7 @@ import {
 } from "../../ai/domain-target-store.js";
 import { listSites, recordTemporarySite } from "../../ai/site-store.js";
 import { getIdentityById, recordProvisionedIdentity } from "../../ai/identity-store.js";
-import { resolveOutputRoot } from "../../config/service.js";
+import { resolveOutputRoot, resolveOutputContext } from "../../config/service.js";
 import { fetchAidenIdCredentials, resolveActiveAuthSession } from "../../auth/service.js";
 import {
   buildCurlPreview,
@@ -76,7 +76,7 @@ async function provisionEmailAction(options, command) {
       extractionTypes: options.extractionTypes,
     });
 
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -90,7 +90,7 @@ async function provisionEmailAction(options, command) {
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const session = await resolveActiveAuthSession({ cwd: process.cwd(), env: process.env, autoRotate: false }).catch(
       () => null,
@@ -170,10 +170,11 @@ async function provisionEmailAction(options, command) {
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const responseIdentity = execution.response || {};
     const registryUpdate = await recordProvisionedIdentity({
+      outputFs,
       outputRoot,
       response: execution.response || {},
       context: {
@@ -259,7 +260,7 @@ domain
   .action(async (domainName, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -287,7 +288,7 @@ domain
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -355,10 +356,11 @@ domain
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: proofResponse.domain || {},
       proof: proofResponse,
@@ -416,7 +418,7 @@ domain
   .action(async (domainId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -451,7 +453,7 @@ domain
       idempotencyKey,
       domainId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -511,10 +513,11 @@ domain
       idempotencyKey,
       domainId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: proofResponse.domain || {},
       proof: proofResponse,
@@ -571,7 +574,7 @@ domain
   .action(async (domainId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -593,7 +596,7 @@ domain
       idempotencyKey,
       domainId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -653,9 +656,10 @@ domain
       idempotencyKey,
       domainId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordDomainProofResponse({
+      outputFs,
       outputRoot,
       domain: execution.response || {},
       proof: {},
@@ -712,7 +716,7 @@ target
   .action(async (host, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -745,7 +749,7 @@ target
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -802,10 +806,11 @@ target
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: proofResponse.target || {},
       proof: proofResponse,
@@ -862,7 +867,7 @@ target
   .action(async (targetId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -897,7 +902,7 @@ target
       idempotencyKey,
       targetId,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -957,10 +962,11 @@ target
       idempotencyKey,
       targetId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const proofResponse = execution.response || {};
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: proofResponse.target || {},
       proof: proofResponse,
@@ -1012,7 +1018,7 @@ target
   .action(async (targetId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1041,9 +1047,10 @@ target
       generatedAt: new Date().toISOString(),
       targetId,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordTargetProofResponse({
+      outputFs,
       outputRoot,
       target: execution.response || {},
       proof: {},
@@ -1098,7 +1105,7 @@ site
   .action(async (identityId, options, command) => {
     const emitJson = shouldEmitJson(options, command);
     const targetPath = path.resolve(process.cwd(), String(options.path || "."));
-    const outputRoot = await resolveOutputRoot({
+    const { outputRoot, outputFs } = await resolveOutputContext({
       cwd: targetPath,
       outputDirOverride: options.outputDir,
       env: process.env,
@@ -1132,7 +1139,7 @@ site
       apiUrl,
       idempotencyKey,
       payload,
-    });
+    }, outputFs);
 
     const resolvedCredentials = await resolveAidenIdCredentials({
       apiKey: options.apiKey,
@@ -1190,9 +1197,10 @@ site
       apiUrl,
       idempotencyKey,
       response: execution.response,
-    });
+    }, outputFs);
 
     const registryUpdate = await recordTemporarySite({
+      outputFs,
       outputRoot,
       site: execution.response || {},
       context: {

package/src/commands/ai/shared.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import fsp from "node:fs/promises";
+
 import path from "node:path";
+import { requireOutputFileSystem } from "../../config/output-filesystem.js";
 
 // Shared helper utilities for ai command modules.
 
@@ -128,9 +129,10 @@ export function renderLineageRows(lineage = {}) {
     });
 }
 
-export async function writeArtifact(filePath, payload) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+export async function writeArtifact(filePath, payload, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
 }
 
 export function buildCurlPreview({ apiUrl, idempotencyKey, requestPath }) {

package/src/commands/audit.js

@@ -7,7 +7,7 @@ import { runAuditOrchestrator } from "../audit/orchestrator.js";
 import { loadAuditRunReport, resolveAuditRunDirectory, writeDdPackage } from "../audit/package.js";
 import { writeAuditComparisonArtifact } from "../audit/replay.js";
 import { loadAuditRegistry, selectAuditAgents } from "../audit/registry.js";
-import { resolveOutputRoot } from "../config/service.js";
+import { resolveOutputContext } from "../config/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { createAuditSessionReporter, resolveAuditSessionId } from "../session/audit-reporter.js";
 import { resolveActionOptions } from "./action-options.js";
@@ -217,7 +217,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot, outputFs } = await resolveOutputContext({
         cwd: targetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -228,6 +228,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       });
       const { report } = await loadAuditRunReport(runDirectory);
       const ddPackage = await writeDdPackage({
+        outputFs,
         report,
         runDirectory,
       });
@@ -269,7 +270,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const initialTargetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot } = await resolveOutputContext({
         cwd: initialTargetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -306,6 +307,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         baseReport,
         candidateReport: replayResult,
         outputDirectory: replayResult.runDirectory,
+        outputFs: replayResult.outputFs,
       });
 
       const payload = {
@@ -347,7 +349,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       const actionOptions = resolveActionOptions(options, command);
       const emitJson = shouldEmitJson(actionOptions, command);
       const targetPath = path.resolve(process.cwd(), String(actionOptions.path || "."));
-      const outputRoot = await resolveOutputRoot({
+      const { outputRoot, outputFs } = await resolveOutputContext({
         cwd: targetPath,
         outputDirOverride: actionOptions.outputDir,
         env: process.env,
@@ -366,6 +368,7 @@ export function registerAuditCommand(program, invokeLegacy) {
         baseReport,
         candidateReport,
         outputDirectory: candidateRunDirectory,
+        outputFs,
       });
 
       const payload = {
@@ -869,14 +872,12 @@ export function registerAuditCommand(program, invokeLegacy) {
       const { julesAuditLoop } = await import("../agents/jules/loop.js");
       const { JULES_DEFINITION } = await import("../agents/jules/config/definition.js");
       const { collectCodebaseIngest, generateCodebaseIngest } = await import("../ingest/engine.js");
-      const { resolveOutputRoot: resolveOut } = await import("../config/service.js");
       const { createBlackboard } = await import("../memory/blackboard.js");
       const { runDeterministicReviewPipeline } = await import("../review/local-review.js");
-      const fsp = await import("node:fs/promises");
 
-      const outputRoot = await resolveOut({ targetPath, outputDir: actionOptions.outputDir });
+      const { outputRoot, outputFs } = await resolveOutputContext({ cwd: targetPath, outputDirOverride: actionOptions.outputDir });
       const artifactDir = path.join(outputRoot, "reports", "jules-" + Date.now());
-      await fsp.mkdir(artifactDir, { recursive: true });
+      await outputFs.mkdir(artifactDir, { recursive: true });
 
       // Build event handler
       const onEvent = buildEventHandler(emitStream, emitJson, JULES_DEFINITION);
@@ -888,7 +889,7 @@ export function registerAuditCommand(program, invokeLegacy) {
       let ingest;
       try {
         ingest = await generateCodebaseIngest({
-          rootPath: targetPath, outputDir: outputRoot,
+          rootPath: targetPath, outputDir: actionOptions.outputDir,
           refresh: Boolean(actionOptions.refresh),
         });
       } catch {
@@ -907,6 +908,7 @@ export function registerAuditCommand(program, invokeLegacy) {
             targetPath,
             mode: "full",
             outputDir: artifactDir,
+            outputFs,
           });
           emitProgress(onEvent, JULES_DEFINITION,
             "Baseline complete: P0=" + (omarBaseline?.summary?.P0 || 0) +
@@ -1085,21 +1087,21 @@ export function registerAuditCommand(program, invokeLegacy) {
         signature: JULES_DEFINITION.signature,
       };
 
-      await fsp.writeFile(
+      await outputFs.writeFile(
         path.join(artifactDir, "JULES_AUDIT.json"),
         JSON.stringify(reportPayload, null, 2),
       );
 
       // Write baseline artifact if it exists
       if (omarBaseline) {
-        await fsp.writeFile(
+        await outputFs.writeFile(
           path.join(artifactDir, "OMAR_BASELINE.json"),
           JSON.stringify(omarBaseline, null, 2),
         );
       }
 
       // Write reconciliation artifact
-      await fsp.writeFile(
+      await outputFs.writeFile(
         path.join(artifactDir, "RECONCILIATION.json"),
         JSON.stringify(reconciliation, null, 2),
       );

package/src/commands/auth.js

@@ -133,6 +133,14 @@ export function registerAuthCommand(program) {
           tokenLabel: options.tokenLabel,
           tokenTtlDays,
           cliVersion: CLI_VERSION,
+          onAuthorize: ({ authorizeUrl }) => {
+            // A spawned opener does not prove a browser exists on a headless host.
+            if (!authorizeUrl) return;
+            const safeUrl = String(authorizeUrl).replace(/[\u0000-\u001f\u007f-\u009f]/g, "").slice(0, 4096);
+            const line = `Open this URL to approve sign-in:\n${safeUrl}\n`;
+            if (shouldEmitJson(options, command)) process.stderr.write(line);
+            else console.log(line.trimEnd());
+          },
         });
       } catch (error) {
         throw new Error(formatApiError(error));
@@ -159,10 +167,6 @@ export function registerAuthCommand(program) {
       if (result.filePath) {
         console.log(pc.gray(`Session metadata: ${result.filePath}`));
       }
-      if (!result.browserOpened && result.authorizeUrl) {
-        console.log(pc.yellow("Open this URL to approve sign-in:"));
-        console.log(result.authorizeUrl);
-      }
     });
 
   auth
@@ -199,6 +203,13 @@ export function registerAuthCommand(program) {
 
       console.log(pc.bold("Authentication status"));
       console.log(pc.gray(`API: ${status.apiUrl}`));
+      if (status.validation === "storage_unavailable") {
+        console.log(pc.yellow("Stored sign-in metadata exists, but its credential cannot be read. Authentication is unknown."));
+        if (status.filePath) console.log(pc.gray(`Session metadata: ${status.filePath}`));
+        console.log(pc.gray("Check the current user/home, keyring availability, encryption key and file permissions."));
+        console.log(pc.gray("Credentials were not cleared. Repair storage instead of logging out or signing in again for this error."));
+        return;
+      }
       if (!status.source) {
         console.log(pc.yellow("No active session token found."));
         printAuthHint();
@@ -254,6 +265,15 @@ export function registerAuthCommand(program) {
             }`
           )
         );
+        if (status.validation === "unavailable") {
+          console.log(pc.yellow("Remote validation is temporarily unavailable; your existing credentials were not cleared."));
+          console.log(pc.gray("Retry auth status when the API is reachable. Do not sign in again solely for this validation error."));
+          return;
+        }
+        if (["CREDENTIAL_DESTINATION_REFUSED", "CREDENTIAL_PATH_REFUSED"].includes(status.remoteError.code)) {
+          console.log(pc.yellow("Credential destination was refused. Check the configured API; signing in again does not change this boundary."));
+          return;
+        }
       } else {
         console.log(pc.yellow("Remote validation was skipped (`--offline`)."));
       }