parseBrowserAuthInput returns an access-only credential for a bare
__Secure-next-auth.session-token value, which /perplexity-login
--browser accepts but credentialsFromEnvironment rejected because it
required .cookies. Only reject when parsing fails entirely.
The perplexity_search tool no longer prompts for pasted browser
credentials mid-search; /perplexity-login --browser is the single
entry point for that flow. Drop the now-unused promptForBrowserAuth
option and its Cloudflare-challenge fallback from authenticate().
Run Perplexity search and auth requests through pi's Node runtime instead of
shelling out to Bun. Move development and CI commands to npm, add a Node test
build path, and keep OTP auth fail-fast when Set-Cookie headers are not
available.
The REAL_JWE_TOKEN constant in otp-flow.test.ts contained an actual
token captured from a live Perplexity auth response. Replace with a
structurally valid but non-functional placeholder.
Enforce 0600 permissions after every auth token write so existing files
with broader modes are corrected.
Add a regression test for the permission hardening path and document the
Bun runtime dependency used by the Node/jiti search subprocess path.
Also declare bun in package dependencies and engines.
Ivan Pereira