pulse-coding-agent 0.1.0__tar.gz → 0.1.1__tar.gz

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/.gitignore

@@ -1,7 +1,6 @@
 # Secrets and machine-specific configuration
 .env
 .env.*
-!.env.example
 *.pem
 *.key
 *.p12

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/CHANGELOG.md

@@ -5,8 +5,15 @@ pre-1.0 APIs may change with release notes and migration guidance.
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-09-04
+
 ### Added
 
+- Product-owned Google Desktop OAuth configuration is embedded in official
+  builds, so installed users can sign in without creating a `.env` file.
+- Release verification now rejects missing/placeholder OAuth configuration,
+  confidential client secrets, developer-only source content, and local home
+  directory paths in published artifacts.
 - Post-login BYOK onboarding now guides provider and model selection before
   collecting the selected provider key through hidden terminal input.
 - Provider keys are stored in workspace-scoped native OS credential-vault
@@ -14,6 +21,10 @@ pre-1.0 APIs may change with release notes and migration guidance.
 
 ### Changed
 
+- Google login uses PKCE with a dynamically allocated `127.0.0.1` callback port
+  and no confidential client secret in the distributed application.
+- Source distributions contain only the files needed to build and understand
+  the product, rather than repository tests, scripts, evals, and local templates.
 - Successful key set or rotation migrates that provider away from a legacy
   plaintext workspace `.env` entry without ever displaying the secret.
 

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pulse-coding-agent
-Version: 0.1.0
+Version: 0.1.1
 Summary: Permissioned coding-agent CLI with durable planning and isolated execution.
 Project-URL: Homepage, https://github.com/Roastedpotato21/pulse
 Project-URL: Repository, https://github.com/Roastedpotato21/pulse
@@ -23,7 +23,6 @@ Requires-Dist: httpx==0.28.1
 Requires-Dist: keyring==25.7.0
 Requires-Dist: openai==2.44.0
 Requires-Dist: prompt-toolkit==3.0.52
-Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: rich==15.0.0
 Requires-Dist: typer==0.26.8
 Requires-Dist: websockets==16.1
@@ -36,7 +35,7 @@ It combines repository-aware planning, durable task state, explicit mutation
 controls, sandboxed command execution, provider routing, audit trails, and cost
 tracking in one Python package.
 
-> **Public beta — 0.1.0:** Pulse is supported for controlled, local,
+> **Public beta — 0.1.1:** Pulse is supported for controlled, local,
 > single-user use. The remote worker and VS Code extension are included for
 > evaluation and development, but they are not supported as multi-tenant or
 > unattended production services.
@@ -50,14 +49,23 @@ tracking in one Python package.
 
 ## Install
 
-Install the first beta from PyPI:
+Install the first beta from PyPI with `pip`:
 
 ```bash
-uv tool install pulse-coding-agent==0.1.0
+python -m pip install pulse-coding-agent==0.1.1
 ```
 
-Alternatively, use `pipx install pulse-coding-agent==0.1.0` or install it in a
-dedicated virtual environment with `pip`.
+The PyPI distribution name is `pulse-coding-agent`; the Python import and
+installed command are both `pulse`. Do not run `pip install pulse`: that name
+belongs to an unrelated WSGI package published in 2009.
+
+For an isolated command-line installation, use `uv` or `pipx`:
+
+```bash
+uv tool install pulse-coding-agent==0.1.1
+```
+
+Alternatively, use `pipx install pulse-coding-agent==0.1.1`.
 
 ## Quick start
 
@@ -71,9 +79,10 @@ pulse ask "Explain this repository and identify the highest-risk missing test"
 
 After Google login, Pulse guides provider selection, model selection, and hidden
 BYOK entry. New provider keys are stored in the native OS credential vault.
-Credentials can also be supplied through environment variables such as `OPENAI_API_KEY`,
-`ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, or `OPENROUTER_API_KEY`. Do not commit a
-populated `.env` file.
+The official distribution already contains Pulse's public Google Desktop OAuth
+identity; installed users do not create a `.env` file or provide OAuth client
+credentials. Provider API keys are collected through hidden terminal input and
+are not written to the project.
 
 To run commands without installing Docker on the client workstation, configure
 a remote worker:
@@ -153,12 +162,13 @@ prompt with hidden input; provider keys are never accepted as command-line
 arguments or printed back to the terminal. New keys are stored in a
 workspace-scoped entry in the native OS credential vault. Existing `.env` keys
 remain readable for compatibility and are removed for that provider after a
-successful vault-backed set or rotation. Environment variables and external
-secret managers remain supported as fallback sources.
+successful vault-backed set or rotation. Pulse never creates a `.env` file.
+Process environment variables and external secret managers remain supported as
+operator-managed fallback sources.
 
 ## Supported boundary
 
-The 0.1.0 beta supports the local CLI and loopback RPC server for one trusted
+The 0.1.1 beta supports the local CLI and loopback RPC server for one trusted
 user on one workstation. Pulse does not claim a security boundary between
 mutually untrusted tenants. Do not expose `pulse-rpc` or `pulse-remote` directly
 to the public internet.
@@ -190,7 +200,7 @@ uv run ruff check src tests scripts
 uv run mypy
 uv run pytest tests/ -k "not sandbox" --cov=pulse --cov-report=term-missing --cov-fail-under=54
 uv build
-uv run python scripts/verify_release_artifacts.py dist --expected-version 0.1.0
+uv run python scripts/verify_release_artifacts.py dist --expected-version 0.1.1
 ```
 
 Docker security tests require a working Docker daemon and are enforced by the

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/README.md

@@ -5,7 +5,7 @@ It combines repository-aware planning, durable task state, explicit mutation
 controls, sandboxed command execution, provider routing, audit trails, and cost
 tracking in one Python package.
 
-> **Public beta — 0.1.0:** Pulse is supported for controlled, local,
+> **Public beta — 0.1.1:** Pulse is supported for controlled, local,
 > single-user use. The remote worker and VS Code extension are included for
 > evaluation and development, but they are not supported as multi-tenant or
 > unattended production services.
@@ -19,14 +19,23 @@ tracking in one Python package.
 
 ## Install
 
-Install the first beta from PyPI:
+Install the first beta from PyPI with `pip`:
 
 ```bash
-uv tool install pulse-coding-agent==0.1.0
+python -m pip install pulse-coding-agent==0.1.1
 ```
 
-Alternatively, use `pipx install pulse-coding-agent==0.1.0` or install it in a
-dedicated virtual environment with `pip`.
+The PyPI distribution name is `pulse-coding-agent`; the Python import and
+installed command are both `pulse`. Do not run `pip install pulse`: that name
+belongs to an unrelated WSGI package published in 2009.
+
+For an isolated command-line installation, use `uv` or `pipx`:
+
+```bash
+uv tool install pulse-coding-agent==0.1.1
+```
+
+Alternatively, use `pipx install pulse-coding-agent==0.1.1`.
 
 ## Quick start
 
@@ -40,9 +49,10 @@ pulse ask "Explain this repository and identify the highest-risk missing test"
 
 After Google login, Pulse guides provider selection, model selection, and hidden
 BYOK entry. New provider keys are stored in the native OS credential vault.
-Credentials can also be supplied through environment variables such as `OPENAI_API_KEY`,
-`ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, or `OPENROUTER_API_KEY`. Do not commit a
-populated `.env` file.
+The official distribution already contains Pulse's public Google Desktop OAuth
+identity; installed users do not create a `.env` file or provide OAuth client
+credentials. Provider API keys are collected through hidden terminal input and
+are not written to the project.
 
 To run commands without installing Docker on the client workstation, configure
 a remote worker:
@@ -122,12 +132,13 @@ prompt with hidden input; provider keys are never accepted as command-line
 arguments or printed back to the terminal. New keys are stored in a
 workspace-scoped entry in the native OS credential vault. Existing `.env` keys
 remain readable for compatibility and are removed for that provider after a
-successful vault-backed set or rotation. Environment variables and external
-secret managers remain supported as fallback sources.
+successful vault-backed set or rotation. Pulse never creates a `.env` file.
+Process environment variables and external secret managers remain supported as
+operator-managed fallback sources.
 
 ## Supported boundary
 
-The 0.1.0 beta supports the local CLI and loopback RPC server for one trusted
+The 0.1.1 beta supports the local CLI and loopback RPC server for one trusted
 user on one workstation. Pulse does not claim a security boundary between
 mutually untrusted tenants. Do not expose `pulse-rpc` or `pulse-remote` directly
 to the public internet.
@@ -159,7 +170,7 @@ uv run ruff check src tests scripts
 uv run mypy
 uv run pytest tests/ -k "not sandbox" --cov=pulse --cov-report=term-missing --cov-fail-under=54
 uv build
-uv run python scripts/verify_release_artifacts.py dist --expected-version 0.1.0
+uv run python scripts/verify_release_artifacts.py dist --expected-version 0.1.1
 ```
 
 Docker security tests require a working Docker daemon and are enforced by the

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pulse-coding-agent"
-version = "0.1.0"
+version = "0.1.1"
 description = "Permissioned coding-agent CLI with durable planning and isolated execution."
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.11,<3.14"
@@ -26,7 +26,6 @@ dependencies = [
     "keyring==25.7.0",
     "openai==2.44.0",
     "prompt-toolkit==3.0.52",
-    "python-dotenv==1.2.2",
     "rich==15.0.0",
     "typer==0.26.8",
     "websockets==16.1",
@@ -53,19 +52,11 @@ packages = ["src/pulse"]
 [tool.hatch.build.targets.sdist]
 include = [
     "/src",
-    "/scripts",
-    "/tests",
-    "/evals",
     "/README.md",
-    "/ARCHITECTURE.md",
-    "/OPERATIONS.md",
     "/SECURITY.md",
     "/PRIVACY.md",
     "/CHANGELOG.md",
-    "/agent.config.json",
-    "/.env.example",
     "/pyproject.toml",
-    "/uv.lock",
 ]
 
 [tool.pytest.ini_options]

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/src/pulse/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"

pulse_coding_agent-0.1.1/src/pulse/_product_oauth.json

@@ -0,0 +1,4 @@
+{
+  "client_id": "not-configured",
+  "redirect_uri": "http://127.0.0.1"
+}

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/src/pulse/auth.py

@@ -11,9 +11,11 @@ import base64
 import hashlib
 import hmac
 import http.server
+import importlib.resources
 import json
 import logging
 import os
+import re
 import secrets
 import socketserver
 import time
@@ -34,6 +36,14 @@ logger = logging.getLogger(__name__)
 
 KEYRING_SERVICE_NAME = "pulse-cli"
 KEYRING_ACCOUNT_NAME = "current_session"
+PRODUCT_OAUTH_RESOURCE = "_product_oauth.json"
+PRODUCT_CLIENT_ID_ENV = "PULSE_GOOGLE_CLIENT_ID"
+PRODUCT_REDIRECT_URI_ENV = "PULSE_GOOGLE_REDIRECT_URI"
+DEFAULT_REDIRECT_URI = "http://127.0.0.1"
+_GOOGLE_CLIENT_ID = re.compile(
+    r"^[0-9]+-[A-Za-z0-9_-]+\.apps\.googleusercontent\.com$"
+)
+_UNCONFIGURED_CLIENT_IDS = {"", "not-configured", "placeholder", "replace_me"}
 
 
 # --- Exceptions ---
@@ -42,6 +52,10 @@ class AuthError(Exception):
     """Base exception for authentication errors."""
 
 
+class AuthConfigurationError(AuthError):
+    """Raised when an installation has no valid product OAuth identity."""
+
+
 class AuthTimeoutError(AuthError):
     """Raised when authentication times out waiting for browser callback."""
 
@@ -264,7 +278,7 @@ class OAuthCallbackHandler(http.server.BaseHTTPRequestHandler):
             self._send_response_page(
                 status=200,
                 title="Authentication Successful",
-                message="✓ Successfully authenticated with Pulse! You can close this window and return to your terminal.",
+                message="Successfully authenticated with Pulse. You can close this window and return to your terminal.",
                 is_success=True,
             )
             return
@@ -329,44 +343,82 @@ class SingleRequestHTTPServer(socketserver.TCPServer):
 
 # --- OAuth Client Helper ---
 
-def get_google_config() -> dict[str, str]:
-    """Retrieve only the OAuth values Pulse recognizes, without mutating the process."""
-    from pulse.config import load_env_file
+def _packaged_google_config() -> dict[str, str]:
+    """Load the public OAuth identity embedded in the installed distribution."""
+    try:
+        resource = importlib.resources.files("pulse").joinpath(PRODUCT_OAUTH_RESOURCE)
+        raw = resource.read_text(encoding="utf-8")
+        if len(raw.encode("utf-8")) > 4096:
+            raise AuthConfigurationError("The packaged Google sign-in configuration is invalid.")
+        parsed = json.loads(raw)
+    except AuthConfigurationError:
+        raise
+    except (FileNotFoundError, ModuleNotFoundError, OSError, TypeError, json.JSONDecodeError):
+        return {}
 
+    if not isinstance(parsed, dict):
+        raise AuthConfigurationError("The packaged Google sign-in configuration is invalid.")
+    return {
+        "client_id": str(parsed.get("client_id", "")).strip(),
+        "redirect_uri": str(parsed.get("redirect_uri", DEFAULT_REDIRECT_URI)).strip(),
+    }
+
+
+def _validated_redirect_uri(value: str) -> str:
     try:
-        file_values = load_env_file(Path.cwd() / ".env")
-    except (OSError, UnicodeError, ValueError):
-        file_values = {}
-    client_id = os.environ.get("GOOGLE_CLIENT_ID") or file_values.get("GOOGLE_CLIENT_ID", "")
-    client_secret = os.environ.get("GOOGLE_CLIENT_SECRET") or file_values.get(
-        "GOOGLE_CLIENT_SECRET", ""
-    )
-    redirect_uri = os.environ.get("GOOGLE_REDIRECT_URI") or file_values.get(
-        "GOOGLE_REDIRECT_URI", "http://localhost:8080"
-    )
-    parsed = urllib.parse.urlparse(redirect_uri)
+        parsed = urllib.parse.urlparse(value)
+        port = parsed.port
+    except ValueError as error:
+        raise AuthConfigurationError(
+            "The Google sign-in callback configuration in this installation is invalid."
+        ) from error
     if (
         parsed.scheme != "http"
-        or parsed.hostname not in {"localhost", "127.0.0.1", "::1"}
+        or parsed.hostname != "127.0.0.1"
         or parsed.username is not None
         or parsed.password is not None
         or parsed.query
         or parsed.fragment
+        or (port is not None and not 1 <= port <= 65535)
+    ):
+        raise AuthConfigurationError(
+            "The Google sign-in callback configuration in this installation is invalid."
+        )
+    return value
+
+
+def get_google_config() -> dict[str, str]:
+    """Resolve the product-owned public OAuth identity without reading workspace files."""
+    packaged = _packaged_google_config()
+    client_id = os.environ.get(PRODUCT_CLIENT_ID_ENV, "").strip() or packaged.get(
+        "client_id", ""
+    )
+    redirect_uri = os.environ.get(PRODUCT_REDIRECT_URI_ENV, "").strip() or packaged.get(
+        "redirect_uri", DEFAULT_REDIRECT_URI
+    )
+
+    if (
+        client_id.lower() in _UNCONFIGURED_CLIENT_IDS
+        or not _GOOGLE_CLIENT_ID.fullmatch(client_id)
     ):
-        raise ValueError("GOOGLE_REDIRECT_URI must be an HTTP loopback URL without credentials or query data.")
+        raise AuthConfigurationError(
+            "This Pulse installation does not include a valid Google sign-in client."
+        )
 
     return {
-        "client_id": client_id or "",
-        "client_secret": client_secret or "",
-        "redirect_uri": redirect_uri or "http://localhost:8080",
+        "client_id": client_id,
+        "redirect_uri": _validated_redirect_uri(redirect_uri or DEFAULT_REDIRECT_URI),
     }
 
 
-def build_authorization_url(state: str, code_challenge: str) -> str:
-    config = get_google_config()
+def build_authorization_url(
+    state: str,
+    code_challenge: str,
+    *,
+    config: dict[str, str] | None = None,
+) -> str:
+    config = config or get_google_config()
     client_id = config["client_id"]
-    if not client_id or client_id == "replace_me":
-        raise ValueError("GOOGLE_CLIENT_ID environment variable is not set or contains default 'replace_me'")
 
     params = {
         "client_id": client_id,
@@ -382,12 +434,16 @@ def build_authorization_url(state: str, code_challenge: str) -> str:
     return f"https://accounts.google.com/o/oauth2/v2/auth?{urllib.parse.urlencode(params)}"
 
 
-def exchange_code_for_tokens(code: str, code_verifier: str) -> tuple[TokenSet, UserProfile]:
-    config = get_google_config()
+def exchange_code_for_tokens(
+    code: str,
+    code_verifier: str,
+    *,
+    config: dict[str, str] | None = None,
+) -> tuple[TokenSet, UserProfile]:
+    config = config or get_google_config()
     data = urllib.parse.urlencode({
         "code": code,
         "client_id": config["client_id"],
-        "client_secret": config["client_secret"],
         "redirect_uri": config["redirect_uri"],
         "grant_type": "authorization_code",
         "code_verifier": code_verifier,
@@ -404,14 +460,28 @@ def exchange_code_for_tokens(code: str, code_verifier: str) -> tuple[TokenSet, U
             token_res = json.loads(resp.read().decode("utf-8"))
     except urllib.error.URLError as error:
         raise AuthError("Failed to exchange the authorization code with Google.") from error
+    except (json.JSONDecodeError, OSError, UnicodeError) as error:
+        raise AuthError("Google returned an invalid token response.") from error
+
+    if not isinstance(token_res, dict):
+        raise AuthError("Google returned an invalid token response.")
 
     access_token = token_res.get("access_token")
-    if not access_token:
+    if not isinstance(access_token, str) or not access_token:
         raise AuthError("Token endpoint returned no access_token.")
 
     refresh_token = token_res.get("refresh_token")
     id_token = token_res.get("id_token")
-    expires_in = int(token_res.get("expires_in", 3600))
+    if refresh_token is not None and not isinstance(refresh_token, str):
+        raise AuthError("Google returned an invalid refresh token.")
+    if id_token is not None and not isinstance(id_token, str):
+        raise AuthError("Google returned an invalid identity token.")
+    try:
+        expires_in = int(token_res.get("expires_in", 3600))
+    except (TypeError, ValueError) as error:
+        raise AuthError("Google returned an invalid token lifetime.") from error
+    if expires_in <= 0:
+        raise AuthError("Google returned an invalid token lifetime.")
     expires_at = time.time() + expires_in
 
     token_set = TokenSet(
@@ -534,7 +604,6 @@ class AuthenticationManager:
         config = get_google_config()
         data = urllib.parse.urlencode({
             "client_id": config["client_id"],
-            "client_secret": config["client_secret"],
             "refresh_token": tokens.refresh_token,
             "grant_type": "refresh_token",
         }).encode("utf-8")
@@ -548,17 +617,28 @@ class AuthenticationManager:
         try:
             with urllib.request.urlopen(req, timeout=15) as resp:
                 token_res = json.loads(resp.read().decode("utf-8"))
-        except (urllib.error.URLError, json.JSONDecodeError, OSError):
+        except (urllib.error.URLError, json.JSONDecodeError, OSError, UnicodeError):
+            return False
+        if not isinstance(token_res, dict):
             return False
 
         new_access_token = token_res.get("access_token")
-        if not new_access_token:
+        if not isinstance(new_access_token, str) or not new_access_token:
             return False
 
-        expires_in = int(token_res.get("expires_in", 3600))
+        try:
+            expires_in = int(token_res.get("expires_in", 3600))
+        except (TypeError, ValueError):
+            return False
+        if expires_in <= 0:
+            return False
         expires_at = time.time() + expires_in
         new_refresh_token = token_res.get("refresh_token") or tokens.refresh_token
         new_id_token = token_res.get("id_token") or tokens.id_token
+        if not isinstance(new_refresh_token, (str, type(None))) or not isinstance(
+            new_id_token, (str, type(None))
+        ):
+            return False
 
         updated_tokens = TokenSet(
             access_token=new_access_token,
@@ -622,20 +702,26 @@ def login(timeout_seconds: int = 120) -> UserProfile | None:
 
     state = generate_state()
     code_verifier, code_challenge = generate_pkce_pair()
-    auth_url = build_authorization_url(state, code_challenge)
-
     config = get_google_config()
-    parsed_redirect = urllib.parse.urlparse(config.get("redirect_uri", "http://localhost:8080"))
-    port = parsed_redirect.port or 8080
+    parsed_redirect = urllib.parse.urlparse(config["redirect_uri"])
+    requested_port = parsed_redirect.port or 0
 
     OAuthCallbackHandler.received_code = None
     OAuthCallbackHandler.received_state = None
     OAuthCallbackHandler.received_error = None
 
     try:
-        server = SingleRequestHTTPServer(("localhost", port), OAuthCallbackHandler)
+        server = SingleRequestHTTPServer(("127.0.0.1", requested_port), OAuthCallbackHandler)
     except OSError as e:
-        raise AuthError(f"Could not start local HTTP server on port {port}: {e}") from e
+        port_label = str(requested_port) if requested_port else "an available port"
+        raise AuthError(f"Could not start the local sign-in listener on {port_label}.") from e
+
+    bound_port = int(server.server_address[1])
+    redirect_uri = urllib.parse.urlunparse(
+        parsed_redirect._replace(netloc=f"127.0.0.1:{bound_port}")
+    )
+    flow_config = {**config, "redirect_uri": redirect_uri}
+    auth_url = build_authorization_url(state, code_challenge, config=flow_config)
 
     server.timeout = timeout_seconds
 
@@ -650,8 +736,10 @@ def login(timeout_seconds: int = 120) -> UserProfile | None:
     except (webbrowser.Error, OSError) as err:
         logger.debug(f"Webbrowser open failed: {err}")
 
-    server.handle_request()
-    server.server_close()
+    try:
+        server.handle_request()
+    finally:
+        server.server_close()
 
     if OAuthCallbackHandler.received_error:
         raise UserCancelledError("Authentication was cancelled in browser.")
@@ -665,6 +753,10 @@ def login(timeout_seconds: int = 120) -> UserProfile | None:
     if cb_state != state:
         raise StateMismatchError("OAuth state verification failed. Possible CSRF attack.")
 
-    tokens, user_profile = exchange_code_for_tokens(code, code_verifier)
+    tokens, user_profile = exchange_code_for_tokens(
+        code,
+        code_verifier,
+        config=flow_config,
+    )
     _token_store.store_session(user_profile, tokens)
     return user_profile

{pulse_coding_agent-0.1.0 → pulse_coding_agent-0.1.1}/src/pulse/cli.py

@@ -4,16 +4,17 @@ import argparse
 import asyncio
 import getpass
 import io
-import json
-import shutil
-import sys
-import warnings
+import json
+import shutil
+import sys
+import warnings
 from pathlib import Path
 
 from rich.table import Table
 
 from pulse import __version__
 from pulse.auth import (
+    AuthConfigurationError,
     AuthenticationManager,
     AuthError,
     AuthTimeoutError,
@@ -534,19 +535,19 @@ def _handle_login_command() -> bool:
     except AuthTimeoutError:
         print_error("Authentication timed out waiting for browser callback.")
         sys.exit(1)
-    except StateMismatchError:
-        print_error("Authentication state mismatch. Possible security issue.")
-        sys.exit(1)
-    except AuthError as e:
-        print_error(f"Authentication failed: {e}")
-        sys.exit(1)
-    except ValueError as e:
-        print_error(f"Configuration error: {e}")
-        print_info(
-            "Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in your .env file.\n"
-            "See .env.example and the README for setup instructions."
+    except StateMismatchError:
+        print_error("Authentication state mismatch. Possible security issue.")
+        sys.exit(1)
+    except AuthConfigurationError:
+        print_error("Google sign-in is unavailable in this installation.")
+        print_info(
+            "Install the latest official pulse-coding-agent release. "
+            "Product authentication never requires a workspace .env file."
         )
         sys.exit(1)
+    except AuthError as e:
+        print_error(f"Authentication failed: {e}")
+        sys.exit(1)
 
 
 def _run_provider_onboarding(workspace: Path) -> bool:

pulse_coding_agent-0.1.0/.env.example

@@ -1,39 +0,0 @@
-OPENROUTER_API_KEY=replace_me
-GEMINI_API_KEY=replace_me
-OPENAI_API_KEY=replace_me
-
-AGENT_PROVIDER=openrouter
-AGENT_FALLBACK_PROVIDER=gemini
-AGENT_MODEL=qwen/qwen3-coder
-AGENT_MAX_TOKENS=8192
-
-PULSE_MAX_SESSION_TOKENS=100000
-PULSE_MAX_SESSION_COST=1.00
-
-# Google OAuth 2.0 ("Continue with Google")
-# Create credentials at: https://console.cloud.google.com/apis/credentials
-# Application type: Web application
-# Authorized redirect URIs: http://localhost:8080
-GOOGLE_CLIENT_ID=replace_me
-GOOGLE_CLIENT_SECRET=replace_me
-GOOGLE_REDIRECT_URI=http://localhost:8080
-
-# Remote-sandbox client. Uncomment both values to prefer remote execution;
-# local Docker/Podman is the secure fallback when the endpoint is unavailable.
-# PULSE_REMOTE_URL=wss://sandbox.example.com
-# PULSE_REMOTE_TOKEN=replace_with_a_random_32_character_token
-# PULSE_TLS_CERT=/absolute/path/to/client.crt
-# PULSE_TLS_KEY=/absolute/path/to/client.key
-# PULSE_TLS_CA=/absolute/path/to/ca.crt
-
-# Dedicated remote-worker server. Use a random token with at least 32 characters.
-# Non-loopback workers also require all three mTLS paths.
-# PULSE_REMOTE_HOST=127.0.0.1
-# PULSE_REMOTE_PORT=8080
-# PULSE_REMOTE_TOKEN=replace_with_a_random_32_character_token
-# PULSE_REMOTE_WORKSPACE_ROOT=/var/lib/pulse/workspaces
-# PULSE_REMOTE_DB=/var/lib/pulse/executions.sqlite3
-# PULSE_REMOTE_MAX_CONCURRENCY=10
-# PULSE_REMOTE_RETENTION_HOURS=24
-# The worker process uses the same TLS variable names with its server
-# certificate, key, and trusted client CA.