canceledAtEmailPrompt and canceledAtOtpPrompt were closure booleans
set inside prompt callbacks to detect user cancellation after the
fact. Fragile if authenticate ever retries prompts or changes order.
In the command context both prompt functions are always provided, so
AuthError(NO_TOKEN) unambiguously means the user declined to enter
required input. Check the error code directly instead.
renderPerplexityResult was pattern-matching content text prefixes
to decide whether to render in error style. This was tightly coupled
to exact message strings in index.ts — a wording change would
silently break the error styling.
Set isError: true in details on every error return path in execute,
and check details.isError in the renderer instead.
PERPLEXITY_USER_AGENT and PERPLEXITY_API_VERSION were duplicated
in auth/login.ts and search/client.ts. Centralise both so updates
only need to happen in one place.
Enforce 0600 permissions after every auth token write so existing files
with broader modes are corrected.
Add a regression test for the permission hardening path and document the
Bun runtime dependency used by the Node/jiti search subprocess path.
Also declare bun in package dependencies and engines.
Ivan Pereira