diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9d8a418
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,28 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck and test
+        run: npm run typecheck && npm test
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 839f9fa..768007b 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -26,7 +26,7 @@ jobs:
         run: node -e "const {version}=require('./package.json'); const tag=process.env.GITHUB_REF_NAME.replace(/^v/,''); if(version!==tag){console.error(\`Tag \${tag} does not match package.json version \${version}\`); process.exit(1);}"
 
       - name: Upgrade npm
-        run: npm install -g npm@latest
+        run: npm install -g npm@11
 
       - name: Install dependencies
         run: npm ci
diff --git a/AGENTS.md b/AGENTS.md
index 8bd0d36..9baed4a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -57,7 +57,7 @@ node --import @mariozechner/jiti/register --input-type=module -e "import('./src/
 - Auth tries macOS app token first via `defaults read ai.perplexity.mac authToken`, unless `PI_AUTH_NO_BORROW=1`.
 - Email OTP fallback uses `ctx.ui.input()`.
 - Tokens are stored at `~/.config/pi-perplexity/auth.json` with mode `0600`.
-- JWT expiry is `decoded.exp * 1000` with a 5 minute buffer; decode failures fall back to 1 hour.
+- Stored tokens have no expiry tracking; `loadToken()` returns any cached token and expiry surfaces as 401/403 at request time.
 - AUTH errors preserve the cached token; users explicitly clear/re-auth with `/perplexity-login --force`.
 
 ## Boundaries
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c255292..93ac77a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,29 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Browser credential paste now runs exclusively through `/perplexity-login --browser`; `authenticate()` no longer prompts inline on Cloudflare challenges.
+- URL deduplication of sources now lowercases only the scheme and host, keeping case-sensitive paths and queries distinct.
+
+### Fixed
+
+- Stop clearing the cached auth token automatically when Perplexity rejects authentication (transient 401/403); use `/perplexity-login --force` to re-auth explicitly.
+- Import `randomUUID` from `node:crypto` instead of relying on the global WebCrypto object, restoring the documented Node 18.14.1 support.
+- Report `sourceCount` consistently with the rendered source list when `limit` is fractional or out of range.
+
+### CI
+
+- Run typecheck and tests on push/PR and before npm publish.
+
+## [0.2.4] - 2026-06-24
+
+### Added
+
+- Browser cookie login fallback: paste a Copy-as-cURL command or Cookie header via `/perplexity-login` when desktop/OTP auth is unavailable.
+
+## [0.2.3] - 2026-06-24
+
+### Changed
+
 - Removed the Bun runtime dependency; Perplexity requests now use pi's Node runtime and development uses npm scripts.
 
 ### Fixed