cinna-cli 0.2.0__tar.gz → 0.2.2__tar.gz

{cinna_cli-0.2.0 → cinna_cli-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cinna-cli
-Version: 0.2.0
+Version: 0.2.2
 Summary: Local development CLI for Cinna Core agents
 Project-URL: Homepage, https://github.com/opencinna/cinna-cli
 Project-URL: Repository, https://github.com/opencinna/cinna-cli
@@ -112,6 +112,31 @@ cd hr-manager-agent/
 cinna set-token yWo36tbkdAOzrALxOEKq31_OA2iMelEg
 ```
 
+### `cinna login [domain]`
+
+Sign in to an account workspace in the browser — **no setup token to paste**. One command serves two cases:
+
+- **Resume** — run it from inside an existing account workspace and it refreshes the stored account CLI token **in place** (reusing the platform URL + machine name; other settings like the active user workspace are preserved).
+- **Connect new** — run it anywhere else and it bootstraps a fresh account workspace. It asks for the platform **domain** (or pass it as an argument — protocol optional, `localhost` recognized), then creates the workspace **in the current folder if it's empty**, or **in a subfolder you name** if it isn't. So you can `mkdir my-cinna && cd my-cinna && cinna login`, or just `cinna login app.example.com` straight into the current directory.
+
+Either way it opens a browser authorization URL (OAuth 2.0 device flow); once you click **Authorize** (already signed in to the platform) the CLI receives a fresh token and writes `.cinna/account.json`.
+
+```bash
+# Resume the account workspace you're in:
+cd my-cinna/ && cinna login
+
+# Connect a new account from a fresh folder:
+mkdir my-cinna && cd my-cinna && cinna login          # prompts for the domain
+cinna login app.example.com                            # or pass it directly
+cinna login app.example.com --dir my-cinna             # always into a named subfolder
+#   Your verification code: WX7K-9Q2P
+#   Open this URL and click Authorize:
+#     https://app.example.com/device?code=WX7K-9Q2P
+#   ✓ Account workspace ready.
+```
+
+Use it when `cinna account status` or `cinna doctor` reports the account token has expired. Because the per-agent tokens minted from an account (`cinna agent sync`) can only be re-minted while the account token is valid, the flow is: `cinna login` (refresh the account), then `cinna doctor` (re-mint the dependent sub-agent tokens). If the platform doesn't expose the device-login endpoints yet, `cinna login` says so and points you at the `cinna account setup` paste fallback.
+
 ### `cinna account setup <token_or_url>`
 
 Initialize an **account workspace** — a multi-agent root from which you can discover your agents and attach per-agent workspaces without going back to the UI. Setup is initiated from **Settings → Channels → Local Development** on the platform, which emits a `curl | python3` one-liner (same pattern as the per-agent flow):
@@ -285,6 +310,27 @@ List every agent registered on this machine (from `~/.cinna/agents.json`). Three
 2. **Location** — workspace path on top, platform UI link below. Missing directories are flagged in red.
 3. **Sync** — Mutagen session state on top (`active` / `paused` / `connecting` / `error`), plus a per-agent backend probe (`valid token` / `expired token` / `no connection`) on the bottom. The probes run in parallel with a short timeout so the view stays snappy even with many registered agents.
 
+### `cinna doctor`
+
+Diagnose and repair stale sync state across the whole machine. Over time the per-user registry (`~/.cinna/agents.json`) and the Mutagen daemon drift out of sync as agents are deleted, environments are spun down, and tokens expire — `cinna doctor` reconciles the two and heals the leftovers in one pass. Run it from anywhere; it is not workspace-scoped.
+
+It detects and fixes:
+
+- **Deleted workspaces** — registry entries whose workspace folder (or its `.cinna/config.json`) is gone. The entry is removed, along with any leftover Mutagen session.
+- **Halted sessions** — sessions stopped on `halted-on-root-deletion` (the local `workspace/` root was deleted) while the agent dir is otherwise intact. Terminated; `cinna dev` recreates a clean one.
+- **Dead-remote sessions** — sessions stuck retrying a remote env that no longer exists (`connecting-beta` / beta polling error). Mutagen has **no** "give up after N failures" option — a session retries forever until paused or terminated — so `doctor` is the cleanup path for these. Terminated.
+- **Orphaned sessions** — `cinna-*` sessions with no registry entry at all. Terminated.
+- **Expired tokens** — for **account-managed** workspaces (those under an account root), the CLI token is re-minted automatically through the parent account token, no pasting required. **Standalone** workspaces (set up via `cinna setup`) can only be refreshed with a pasted setup token, so they are reported with a `cinna set-token` hint rather than changed.
+- **Expired account token** — a sub-agent token can only be re-minted while the **account** token that mints it is still valid. When the account token has itself expired, doctor probes it once and surfaces a single _"renew the account token — run `cinna login`"_ finding (listing the blocked sub-agents) instead of a pile of re-mints that would all fail with 401. Run `cinna login`, then re-run `cinna doctor` to re-mint the dependents.
+
+```bash
+cinna doctor              # diagnose, then apply all fixes behind one confirmation
+cinna doctor --dry-run    # report problems only; change nothing
+cinna doctor --yes        # apply every fix non-interactively
+```
+
+The diagnosis is split into two tables: **Will fix** (everything doctor can repair — deleted-workspace cleanup, halted/dead/orphaned session termination, account token re-mints) and **No automatic fix — manual action needed** (standalone expired tokens, which need a pasted setup token and are never touched). Everything actionable is applied together behind a single `Apply N fix(es)?` confirmation, so the count always matches the "Will fix" table.
+
 ### `cinna disconnect`
 
 Stop sync, remove `.cinna/` config and generated files (`CLAUDE.md`, `BUILDING_AGENT.md`, `.mcp.json`, `opencode.json`, `mutagen.yml`). Workspace files are preserved.

{cinna_cli-0.2.0 → cinna_cli-0.2.2}/README.md

@@ -75,6 +75,31 @@ cd hr-manager-agent/
 cinna set-token yWo36tbkdAOzrALxOEKq31_OA2iMelEg
 ```
 
+### `cinna login [domain]`
+
+Sign in to an account workspace in the browser — **no setup token to paste**. One command serves two cases:
+
+- **Resume** — run it from inside an existing account workspace and it refreshes the stored account CLI token **in place** (reusing the platform URL + machine name; other settings like the active user workspace are preserved).
+- **Connect new** — run it anywhere else and it bootstraps a fresh account workspace. It asks for the platform **domain** (or pass it as an argument — protocol optional, `localhost` recognized), then creates the workspace **in the current folder if it's empty**, or **in a subfolder you name** if it isn't. So you can `mkdir my-cinna && cd my-cinna && cinna login`, or just `cinna login app.example.com` straight into the current directory.
+
+Either way it opens a browser authorization URL (OAuth 2.0 device flow); once you click **Authorize** (already signed in to the platform) the CLI receives a fresh token and writes `.cinna/account.json`.
+
+```bash
+# Resume the account workspace you're in:
+cd my-cinna/ && cinna login
+
+# Connect a new account from a fresh folder:
+mkdir my-cinna && cd my-cinna && cinna login          # prompts for the domain
+cinna login app.example.com                            # or pass it directly
+cinna login app.example.com --dir my-cinna             # always into a named subfolder
+#   Your verification code: WX7K-9Q2P
+#   Open this URL and click Authorize:
+#     https://app.example.com/device?code=WX7K-9Q2P
+#   ✓ Account workspace ready.
+```
+
+Use it when `cinna account status` or `cinna doctor` reports the account token has expired. Because the per-agent tokens minted from an account (`cinna agent sync`) can only be re-minted while the account token is valid, the flow is: `cinna login` (refresh the account), then `cinna doctor` (re-mint the dependent sub-agent tokens). If the platform doesn't expose the device-login endpoints yet, `cinna login` says so and points you at the `cinna account setup` paste fallback.
+
 ### `cinna account setup <token_or_url>`
 
 Initialize an **account workspace** — a multi-agent root from which you can discover your agents and attach per-agent workspaces without going back to the UI. Setup is initiated from **Settings → Channels → Local Development** on the platform, which emits a `curl | python3` one-liner (same pattern as the per-agent flow):
@@ -248,6 +273,27 @@ List every agent registered on this machine (from `~/.cinna/agents.json`). Three
 2. **Location** — workspace path on top, platform UI link below. Missing directories are flagged in red.
 3. **Sync** — Mutagen session state on top (`active` / `paused` / `connecting` / `error`), plus a per-agent backend probe (`valid token` / `expired token` / `no connection`) on the bottom. The probes run in parallel with a short timeout so the view stays snappy even with many registered agents.
 
+### `cinna doctor`
+
+Diagnose and repair stale sync state across the whole machine. Over time the per-user registry (`~/.cinna/agents.json`) and the Mutagen daemon drift out of sync as agents are deleted, environments are spun down, and tokens expire — `cinna doctor` reconciles the two and heals the leftovers in one pass. Run it from anywhere; it is not workspace-scoped.
+
+It detects and fixes:
+
+- **Deleted workspaces** — registry entries whose workspace folder (or its `.cinna/config.json`) is gone. The entry is removed, along with any leftover Mutagen session.
+- **Halted sessions** — sessions stopped on `halted-on-root-deletion` (the local `workspace/` root was deleted) while the agent dir is otherwise intact. Terminated; `cinna dev` recreates a clean one.
+- **Dead-remote sessions** — sessions stuck retrying a remote env that no longer exists (`connecting-beta` / beta polling error). Mutagen has **no** "give up after N failures" option — a session retries forever until paused or terminated — so `doctor` is the cleanup path for these. Terminated.
+- **Orphaned sessions** — `cinna-*` sessions with no registry entry at all. Terminated.
+- **Expired tokens** — for **account-managed** workspaces (those under an account root), the CLI token is re-minted automatically through the parent account token, no pasting required. **Standalone** workspaces (set up via `cinna setup`) can only be refreshed with a pasted setup token, so they are reported with a `cinna set-token` hint rather than changed.
+- **Expired account token** — a sub-agent token can only be re-minted while the **account** token that mints it is still valid. When the account token has itself expired, doctor probes it once and surfaces a single _"renew the account token — run `cinna login`"_ finding (listing the blocked sub-agents) instead of a pile of re-mints that would all fail with 401. Run `cinna login`, then re-run `cinna doctor` to re-mint the dependents.
+
+```bash
+cinna doctor              # diagnose, then apply all fixes behind one confirmation
+cinna doctor --dry-run    # report problems only; change nothing
+cinna doctor --yes        # apply every fix non-interactively
+```
+
+The diagnosis is split into two tables: **Will fix** (everything doctor can repair — deleted-workspace cleanup, halted/dead/orphaned session termination, account token re-mints) and **No automatic fix — manual action needed** (standalone expired tokens, which need a pasted setup token and are never touched). Everything actionable is applied together behind a single `Apply N fix(es)?` confirmation, so the count always matches the "Will fix" table.
+
 ### `cinna disconnect`
 
 Stop sync, remove `.cinna/` config and generated files (`CLAUDE.md`, `BUILDING_AGENT.md`, `.mcp.json`, `opencode.json`, `mutagen.yml`). Workspace files are preserved.

{cinna_cli-0.2.0 → cinna_cli-0.2.2}/docs/README.md

@@ -132,6 +132,13 @@ Key properties:
 - **Probeable** — `cinna list` and `cinna status` call `GET /sync-runtime` as a cheap authenticated probe and label the token `valid` / `expired` / `no connection`.
 - **Refreshable in place** — `cinna set-token <token_or_url>` re-exchanges a fresh setup token through `POST /api/cli-setup/{token}` and rewrites both stores without re-cloning the workspace. The refresh is bound to the agent already in the workspace: if the exchanged token belongs to a different agent, the command aborts.
 
+### Account CLI Token
+
+A second token type (`token_type="cli-account"`) issued to an **account workspace** (`.cinna/account.json`). Scoped only to the `/account/*` routes — it discovers agents and mints per-agent CLI tokens (`cinna agent sync`), but cannot itself sync or exec. Same 7-day rolling expiry as a CLI token.
+
+- **Refreshable without a paste** — `cinna login` runs an RFC 8628 device-authorization flow: the CLI prints a short code + URL, the user clicks **Authorize** in the browser (already signed in), and the CLI swaps the fresh token into `.cinna/account.json` in place. Run from an empty/new folder, the same command instead bootstraps a brand-new account workspace.
+- **Mints child tokens** — per-agent tokens minted from it carry its id as provenance and are re-mintable via `POST /account/agents/{id}/mint` (used by `cinna agent sync` and `cinna doctor`).
+
 ### Knowledge Source
 
 A documentation/data source attached to an agent. Queried via the MCP proxy's `knowledge_query` tool, backed by the platform's vector search.
@@ -190,6 +197,8 @@ An open protocol for connecting AI tools to external data/capabilities. The CLI
 main.py  (CLI commands — Click)
   │
   ├── bootstrap.py       — setup orchestration
+  ├── account.py         — account workspace; `cinna login` (device auth), `cinna account`, `cinna agent`
+  ├── doctor.py          — `cinna doctor`: reconcile registry ↔ Mutagen, repair stale state, refresh tokens
   ├── config.py          — .cinna/config.json: load/save/find
   ├── auth.py            — JWT storage, Authorization headers
   ├── client.py          — PlatformClient: HTTP + SSE stream_exec
@@ -393,6 +402,10 @@ Backend validates on every request:
 
 When a CLI token expires (or is revoked) the normal remedy is `cinna set-token <token_or_url>` from inside the agent directory. Internally it reuses `_exchange_setup_token()` from `bootstrap.py` — the same helper that backs `cinna setup` — so the server side is a plain re-run of `POST /api/cli-setup/{token}`. The workspace's existing `platform_url` is used as the fallback when a bare token is pasted, which lets agents registered against different platforms each refresh from their own directory without extra flags. The workspace tarball is **not** re-downloaded, and `CLAUDE.md` / `BUILDING_AGENT.md` / `.mcp.json` / `opencode.json` are left in place — only the stored CLI token changes.
 
+**Account tokens** refresh without a paste. `cinna login` (run inside an account workspace) drives the platform's RFC 8628 device-authorization flow: `POST /account/login/start` returns a short code + verification URL, the user clicks **Authorize** in the browser (already signed in), and the CLI polls `POST /account/login/poll` until it receives the fresh token, which it writes back into `.cinna/account.json` in place. The poll endpoint always returns HTTP 200 with a `status` field (`authorization_pending` / `slow_down` / `authorized` / `access_denied` / `expired_token`) — a deliberate divergence from RFC 8628's 400+`error` shape. Run from a fresh folder, the same command bootstraps a new account workspace instead of resuming one.
+
+**Bulk repair** is `cinna doctor`. It reconciles the `~/.cinna/agents.json` registry against the Mutagen daemon and heals the state that drifts as agents come and go — registry entries whose workspace was deleted, sessions halted on a deleted local root or stuck retrying a dead remote env, and orphaned sessions (Mutagen has no "stop after N failures" knob, so these retry forever until terminated). Expired **per-agent** tokens under an account workspace are re-minted automatically through the parent account token; when the **account** token has itself expired, doctor groups the blocked agents into a single "run `cinna login`" finding instead of attempting re-mints that would 401. Standalone agents are reported for a manual `cinna set-token`.
+
 ### Authorization
 
 | Resource | Rule |
@@ -423,6 +436,11 @@ When a CLI token expires (or is revoked) the normal remedy is `cinna set-token <
 | GET  | `/api/v1/cli/agents/{id}/sync-runtime` | CLI JWT | Required Mutagen version + hash (also used by `cinna list` / `cinna status` as a cheap token-validity probe) |
 | POST | `/api/v1/cli/agents/{id}/exec` | CLI JWT | Streaming SSE command execution |
 | WSS  | `/api/v1/cli/agents/{id}/sync-stream` | CLI JWT | Mutagen transport tunnel |
+| POST | `/api/v1/cli/account/login/start` | None | Begin a `cinna login` device-authorization request |
+| POST | `/api/v1/cli/account/login/poll` | None | Poll a `cinna login` request — always HTTP 200 + `status` |
+| POST | `/api/v1/cli/account/agents/{id}/mint` | Account token | Mint a per-agent CLI token (`cinna agent sync`, `cinna doctor` re-mint) |
+
+The account-workspace surface adds the broader `/api/v1/cli/account/*` route group (login, agents, credentials, connect, schedules, status, api-proxy); only the routes the sync / login / doctor paths use are listed here.
 
 Endpoints that were part of the old Docker-replica model (`build-context`, `workspace` POST, `workspace/manifest`, `credentials`) have been removed from the backend and from this CLI.
 

{cinna_cli-0.2.0 → cinna_cli-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cinna-cli"
-version = "0.2.0"
+version = "0.2.2"
 description = "Local development CLI for Cinna Core agents"
 readme = "README.md"
 requires-python = ">=3.10"

{cinna_cli-0.2.0 → cinna_cli-0.2.2}/src/cinna/account.py

@@ -23,6 +23,8 @@ import os
 import platform
 import re
 import sys
+import time
+import webbrowser
 from dataclasses import asdict, dataclass
 from pathlib import Path
 from urllib.parse import urlparse
@@ -161,6 +163,44 @@ def parse_account_setup_input(raw_input: str) -> tuple[str, str]:
     return platform_url, text
 
 
+def default_account_dir_name(platform_url: str) -> str:
+    """Derive a default workspace folder name from the platform domain.
+
+    e.g. ``https://demo-core.opencinna.io`` → ``demo-core_opencinna_io``.
+    Hostname only (creds/port stripped); every run of non
+    ``[A-Za-z0-9-]`` characters collapses to a single underscore. Falls back to
+    ``DEFAULT_ACCOUNT_DIR`` when the URL has no usable host.
+    """
+    host = urlparse(platform_url).netloc or platform_url.strip()
+    host = host.split("@")[-1].split(":")[0]  # strip user:pass@ and :port
+    slug = re.sub(r"[^A-Za-z0-9-]+", "_", host).strip("_")
+    return slug or DEFAULT_ACCOUNT_DIR
+
+
+def _prompt_account_dir(default: str) -> str:
+    """Ask for the workspace folder name, offering ``default``.
+
+    Works in the ``curl ... | python3 -`` bootstrap too: there stdin carries the
+    installer script (not keystrokes), so when stdin is not a TTY we talk to the
+    controlling terminal via ``/dev/tty`` as long as stdout is a TTY. With no
+    terminal attached (CI, captured output) we return ``default`` unchanged so
+    non-interactive runs stay non-interactive.
+    """
+    if sys.stdin.isatty():
+        return click.prompt("Workspace folder name", default=default)
+
+    if not sys.stdout.isatty():
+        return default
+    try:
+        with open("/dev/tty", "r+") as tty:
+            tty.write(f"Workspace folder name [{default}]: ")
+            tty.flush()
+            line = tty.readline()
+    except OSError:
+        return default
+    return line.strip() or default
+
+
 def _exchange_account_setup_token(
     platform_url: str, token: str, machine_name: str
 ) -> dict:
@@ -286,6 +326,311 @@ def probe_account_token(config: AccountConfig) -> str:
     return "unreachable"
 
 
+# ── Browser re-auth (device authorization flow) ─────────────────────────────
+#
+# `cinna login` refreshes the account token in place without a pasted setup
+# token. It is an OAuth 2.0 Device Authorization Grant (RFC 8628): the CLL
+# starts a request, the user authorizes it in a browser already signed in to the
+# platform, and the CLI polls until the backend hands back a fresh account token.
+#
+# Backend contract (both unauthenticated — the point is the old token is dead):
+#   POST {platform}/api/v1/cli/account/login/start
+#        body: {machine_name, machine_info}
+#        200 : {device_code, user_code, verification_uri,
+#               verification_uri_complete?, interval?, expires_in?}
+#   POST {platform}/api/v1/cli/account/login/poll
+#        body: {device_code}
+#        200 : {status: "authorization_pending"|"slow_down"|"authorized"
+#                       |"access_denied"|"expired_token",
+#               account_token?, platform_url?, frontend_url?, machine_name?}
+
+_LOGIN_DEFAULT_INTERVAL = 5  # seconds between polls when the server omits one
+_LOGIN_DEFAULT_EXPIRY = 900  # safety cap when the server omits expires_in
+_LOGIN_START_PATH = "/api/v1/cli/account/login/start"
+_LOGIN_POLL_PATH = "/api/v1/cli/account/login/poll"
+
+
+def _login_start(platform_url: str, machine_name: str) -> dict:
+    """Begin a device-login request; returns the authorize URL + device code."""
+    url = f"{platform_url.rstrip('/')}{_LOGIN_START_PATH}"
+    machine_info = f"{platform.system()}/{platform.machine()}"
+    logger.info("Starting device login at %s", url)
+    try:
+        response = httpx.post(
+            url,
+            json={"machine_name": machine_name, "machine_info": machine_info},
+            timeout=30.0,
+        )
+    except httpx.HTTPError as exc:
+        raise click.ClickException(f"Could not reach {platform_url}: {exc}")
+    if response.status_code == 404:
+        raise click.ClickException(
+            "This platform does not support 'cinna login' yet.\n"
+            "Refresh from the UI instead: open Settings → Local Development to "
+            "mint a new account setup token, then run\n"
+            "  cinna account setup <token>   (in the parent directory)."
+        )
+    if response.status_code != 200:
+        try:
+            detail = response.json().get("detail", response.text)
+        except Exception:
+            detail = response.text
+        raise click.ClickException(f"Login could not be started: {detail}")
+    return response.json()
+
+
+def _login_poll(platform_url: str, device_code: str) -> dict:
+    """Poll a pending device-login request once."""
+    url = f"{platform_url.rstrip('/')}{_LOGIN_POLL_PATH}"
+    response = httpx.post(url, json={"device_code": device_code}, timeout=30.0)
+    if response.status_code != 200:
+        try:
+            detail = response.json().get("detail", response.text)
+        except Exception:
+            detail = response.text
+        raise click.ClickException(f"Login polling failed: {detail}")
+    return response.json()
+
+
+def _poll_until_authorized(
+    platform_url: str, device_code: str, interval: int, expires_in: int
+) -> dict:
+    """Block until the user authorizes (or the request is denied / expires).
+
+    Honors the RFC 8628 ``slow_down`` backoff and the ``expires_in`` deadline.
+    Returns the authorized payload (carrying ``account_token``).
+    """
+    deadline = time.monotonic() + expires_in
+    while time.monotonic() < deadline:
+        time.sleep(max(1, interval))
+        data = _login_poll(platform_url, device_code)
+        status = (data.get("status") or "").lower()
+        if status in ("authorized", "complete", "success"):
+            if not data.get("account_token"):
+                raise click.ClickException(
+                    "Authorization succeeded but the server returned no token."
+                )
+            return data
+        if status in ("authorization_pending", "pending", ""):
+            continue
+        if status == "slow_down":
+            interval += 5
+            continue
+        if status in ("access_denied", "denied"):
+            raise click.ClickException("Authorization was denied in the browser.")
+        if status in ("expired_token", "expired"):
+            raise click.ClickException(
+                "The login request expired before you authorized it. "
+                "Run 'cinna login' again."
+            )
+        raise click.ClickException(f"Unexpected login status: {status!r}")
+    raise click.ClickException(
+        "Timed out waiting for authorization. Run 'cinna login' again."
+    )
+
+
+def _device_login(platform_url: str, machine_name: str, frontend_url: str | None = None) -> dict:
+    """Drive the full device-authorization handshake; return the authorized
+    payload.
+
+    Starts the request, surfaces the verification URL + user code (and opens a
+    browser), then polls until the user authorizes. The returned dict carries
+    ``account_token`` plus any server-refreshed ``platform_url`` /
+    ``frontend_url`` / ``machine_name``.
+    """
+    console.status(f"Signing in to {frontend_url or platform_url} as {machine_name}…")
+    start = _login_start(platform_url, machine_name)
+
+    device_code = start.get("device_code")
+    if not device_code:
+        raise click.ClickException("Server did not return a device code.")
+    user_code = start.get("user_code") or ""
+    verify_url = (
+        start.get("verification_uri_complete")
+        or start.get("verification_url_complete")
+        or start.get("verification_uri")
+        or start.get("verification_url")
+        or start.get("verify_url")
+    )
+    if not verify_url:
+        raise click.ClickException("Server did not return an authorization URL.")
+    interval = int(start.get("interval") or _LOGIN_DEFAULT_INTERVAL)
+    expires_in = int(start.get("expires_in") or _LOGIN_DEFAULT_EXPIRY)
+
+    console.console.print()
+    if user_code:
+        console.console.print(f"  Your verification code: [bold]{user_code}[/bold]")
+    console.console.print("  Open this URL and click Authorize:")
+    console.console.print(f"    [bold]{verify_url}[/bold]")
+    console.console.print()
+    try:
+        webbrowser.open(verify_url)
+    except Exception:
+        pass  # headless / no browser — the printed URL is the fallback.
+
+    with console.spinner("Waiting for authorization…"):
+        return _poll_until_authorized(platform_url, device_code, interval, expires_in)
+
+
+def _is_local_host(host: str) -> bool:
+    h = host.split(":")[0].lower()
+    return h in ("localhost", "127.0.0.1", "0.0.0.0", "::1") or h.endswith(".local")
+
+
+def _normalize_platform_url(raw: str) -> str:
+    """Turn a user-typed domain into a ``scheme://netloc`` platform URL.
+
+    Accepts ``app.example.com``, ``https://app.example.com/``,
+    ``http://localhost:8000``, etc. A missing scheme defaults to ``https`` —
+    except for local hosts (``localhost`` / loopback / ``.local``), which get
+    ``http``. Any path/query the user pasted is dropped.
+    """
+    text = (raw or "").strip().strip("'\"").strip()
+    if not text:
+        raise click.ClickException("No domain provided.")
+    if "://" not in text:
+        host_part = text.split("/")[0]
+        scheme = "http" if _is_local_host(host_part) else "https"
+        text = f"{scheme}://{text}"
+    parsed = urlparse(text)
+    if not parsed.netloc:
+        raise click.ClickException(f"Could not parse a domain from {raw!r}.")
+    return f"{parsed.scheme}://{parsed.netloc}"
+
+
+# ``cinna.log`` is written into cwd by the CLI's own logging setup before this
+# check runs, so a genuinely fresh folder still "contains" it — treat it (and
+# OS cruft) as not counting toward emptiness.
+_IGNORABLE_DIR_ENTRIES = {".DS_Store", "cinna.log"}
+
+
+def _dir_is_empty(path: Path) -> bool:
+    """True if ``path`` doesn't exist or holds nothing but ignorable cruft."""
+    if not path.exists():
+        return True
+    return all(child.name in _IGNORABLE_DIR_ENTRIES for child in path.iterdir())
+
+
+def _refresh_account_token_in_place(account_root: Path) -> None:
+    """Resume path: swap a fresh token into an existing account workspace."""
+    account_cfg = load_account_config(account_root)
+    result = _device_login(
+        account_cfg.platform_url, account_cfg.machine_name, account_cfg.frontend_url
+    )
+
+    account_cfg.account_token = result["account_token"]
+    if result.get("platform_url"):
+        account_cfg.platform_url = result["platform_url"]
+    if result.get("frontend_url"):
+        account_cfg.frontend_url = result["frontend_url"]
+    if result.get("machine_name"):
+        account_cfg.machine_name = result["machine_name"]
+    save_account_config(account_cfg, account_root)
+
+    console.status(
+        f"Signed in — account token refreshed for {account_cfg.machine_name}."
+    )
+    console.console.print(
+        "  Re-mint expired sub-agent tokens with [bold]cinna doctor[/bold]."
+    )
+
+
+def _login_new_account(
+    domain: str | None, machine_name: str, dir_name: str | None
+) -> None:
+    """Bootstrap path: connect a brand-new account workspace via the browser.
+
+    Prompts for the platform domain when not given, picks where to create the
+    workspace (the current folder when it's empty, otherwise a subfolder the
+    user names), runs the device-login flow against that domain, and
+    materializes a standard account workspace with the returned token.
+    """
+    console.status("No cinna account workspace here — let's connect a new one.")
+    if not domain:
+        domain = click.prompt("Platform domain to log in to (e.g. app.example.com)")
+    platform_url = _normalize_platform_url(domain)
+
+    cwd = Path.cwd()
+    if dir_name:
+        account_root = cwd / dir_name
+    elif _dir_is_empty(cwd):
+        account_root = cwd
+    else:
+        default_sub = default_account_dir_name(platform_url)
+        sub = click.prompt(
+            "This folder isn't empty — name a subfolder to create the account "
+            "workspace in",
+            default=default_sub,
+        )
+        account_root = cwd / sub
+
+    if account_config_path(account_root).exists():
+        raise click.ClickException(
+            f"'{account_root}' already contains an account workspace.\n"
+            f"Run 'cinna login' from inside it to refresh its token."
+        )
+
+    result = _device_login(platform_url, machine_name)
+
+    config = AccountConfig(
+        platform_url=result.get("platform_url") or platform_url,
+        frontend_url=result.get("frontend_url") or platform_url,
+        account_token=result["account_token"],
+        machine_name=result.get("machine_name") or machine_name,
+    )
+    _write_account_files(config, account_root)
+    with console.spinner("Downloading context package…"):
+        _install_context_package(config, account_root)
+
+    rel = account_root if account_root == cwd else account_root.relative_to(cwd)
+    console.status(f"Account workspace ready at {account_root}")
+    console.console.print()
+    if account_root != cwd:
+        console.console.print(f"  cd {rel}/")
+    console.console.print(
+        "  cinna account agents              # list agents you can build"
+    )
+    console.console.print(
+        "  cinna agent sync <agent>          # attach an agent workspace under agents/"
+    )
+    console.console.print()
+
+
+def run_login(
+    domain: str | None = None,
+    machine_name: str | None = None,
+    dir_name: str | None = None,
+) -> None:
+    """`cinna login` — resume an account workspace, or connect a new one.
+
+    Inside an existing account workspace it refreshes the stored token in place
+    (the ``domain`` / ``dir_name`` hints are ignored). Otherwise it bootstraps a
+    new account workspace: it asks for the platform domain (unless given),
+    creates the workspace in the current folder when empty — or in a named
+    subfolder when not — and signs in via the browser device flow. Either way no
+    setup token is pasted.
+    """
+    try:
+        account_root = find_account_root()
+    except AccountConfigNotFoundError:
+        account_root = None
+
+    if account_root is not None:
+        if domain or dir_name:
+            console.warn(
+                "Already inside an account workspace — refreshing it in place "
+                "(domain / --dir ignored)."
+            )
+        _refresh_account_token_in_place(account_root)
+        return
+
+    _login_new_account(domain, machine_name or _fallback_machine_name(), dir_name)
+
+
+def _fallback_machine_name() -> str:
+    return f"{os.environ.get('USER', 'dev')}'s {platform.node()}"
+
+
 # ── Command bodies ──────────────────────────────────────────────────────────
 
 
@@ -335,8 +680,13 @@ def _write_account_mcp_config(account_root: Path) -> None:
     ``POST /account/knowledge/search`` — the account analogue of the per-agent
     workspace's knowledge tool. Auto-generated infra: overwritten on every
     ``cinna account setup`` / ``cinna account refresh-context``.
+
+    The config path is written **relative** to the account root (anchored at the
+    launch cwd, which MCP clients set to the workspace folder) so the folder can
+    be moved without breaking the proxy. ``run_mcp_proxy`` additionally walks up
+    from cwd, which self-heals older configs that stored an absolute path.
     """
-    account_config = str(account_config_path(account_root))
+    account_config = f"{CONFIG_DIR}/{ACCOUNT_CONFIG_FILE}"
 
     mcp_json = {
         "mcpServers": {
@@ -433,12 +783,40 @@ def _install_context_package(
     return True
 
 
+def _write_account_files(config: AccountConfig, account_root: Path) -> None:
+    """Create the account workspace dir + config + generated files (no context).
+
+    The filesystem half of materializing an account workspace, shared by
+    ``cinna account setup`` (paste a setup token) and ``cinna login`` (browser
+    device flow). The caller downloads the context package separately so each
+    can frame that slow, best-effort step in its own UI.
+    """
+    account_root.mkdir(parents=True, exist_ok=True)
+    save_account_config(config, account_root)
+    agents_dir(account_root).mkdir(exist_ok=True)
+    _write_account_claude_md(account_root, config)
+    _write_account_claude_settings(account_root)
+    _write_account_mcp_config(account_root)
+
+
 def run_account_setup(
-    setup_input: str, machine_name: str, dir_name: str = DEFAULT_ACCOUNT_DIR
+    setup_input: str, machine_name: str, dir_name: str | None = None
 ) -> None:
-    """Full account setup flow — called by `cinna account setup <token_or_url>`."""
+    """Full account setup flow — called by `cinna account setup <token_or_url>`.
+
+    When ``dir_name`` is not given (no ``--dir``), the folder name defaults to
+    the platform domain normalized (e.g. ``demo-core_opencinna_io``); the user
+    can accept it or type their own at the prompt.
+    """
     total = 3
 
+    # Parse before touching the filesystem / network so we can derive the
+    # default folder name from the platform domain (and fail fast on bad input).
+    platform_url, token = parse_account_setup_input(setup_input)
+
+    if not dir_name:
+        dir_name = _prompt_account_dir(default_account_dir_name(platform_url))
+
     # Guard the target directory before burning the single-use setup token.
     account_root = Path.cwd() / dir_name
     if account_config_path(account_root).exists():
@@ -449,25 +827,17 @@ def run_account_setup(
 
     # Step 1: Exchange the account setup token
     console.step(1, total, "Authenticating...")
-    platform_url, token = parse_account_setup_input(setup_input)
     payload = _exchange_account_setup_token(platform_url, token, machine_name)
 
     # Step 2: Materialize the account workspace
     console.step(2, total, "Creating account workspace...")
-    account_root.mkdir(exist_ok=True)
-
     config = AccountConfig(
         platform_url=payload["platform_url"],
         frontend_url=payload.get("frontend_url") or payload["platform_url"],
         account_token=payload["account_token"],
         machine_name=payload.get("machine_name") or machine_name,
     )
-    save_account_config(config, account_root)
-    agents_dir(account_root).mkdir(exist_ok=True)
-
-    _write_account_claude_md(account_root, config)
-    _write_account_claude_settings(account_root)
-    _write_account_mcp_config(account_root)
+    _write_account_files(config, account_root)
 
     # Step 3: Context package (best-effort — setup succeeds without it)
     console.step(3, total, "Downloading context package...")