Fix pc login for agentic workflows (#75)

## Problem
`pc login` was unusable in agentic contexts:

- The OAuth URL was printed as ANSI-styled prose on `stdout` (`Visit
https://... to authorize the CLI.`), making it impossible for agents to
reliably extract the URL from the output.
- In non-interactive contexts, the command attempted to read from
`stdin` unnecessarily.
- There was no structured output mode — no `--json` flag, no
machine-readable URL emission.
- When already authenticated, the command returned nothing to `stdout`,
giving agents no way to detect the existing session.
- All human-readable output (prompts, status messages, hints) were going
to `stdout`, mixing with any data output that would be relevant for
agent / machine interaction.

## Solution
### Auto-detected JSON output

When `stdout` is not a TTY (machine / agent capturing output), JSON mode
is enabled automatically — no flag
required. `--json` is also available as an explicit override for users
who want structured output in a terminal. The format decision is
resolved once at the top of `Run()` and passed down;
`GetAndSetAccessToken` and other helpers use it directly without
re-running TTY detection.

### Structured output at each stage

Immediately before blocking on the OAuth callback:
```
{
    "status": "pending",
    "url": "https://login.pinecone.io/..."
}
```

After successful authentication:
```
{
    "status": "authenticated",
    "email": "user@example.com",
    "org_id": "...",
    "project_id": "..."
}
```

When already logged in:
```
{
    "status": "already_authenticated",
    "email": "user@example.com",
    "org_id": "..."
}
```

### TTY-gated interactivity

The "Press [Enter]" prompt and `stdin`-reading goroutine are gated on
`term.IsTerminal(int(os.Stdin.Fd()))`. Non-interactive runs skip `stdin`
entirely and block cleanly on the OAuth callback. The prompt is
preserved for TTY sessions regardless of JSON mode — a user passing
--json in a terminal is still at a keyboard and benefits from
browser-open.

### All human-readable output routed to stderr

The prose URL line, Enter prompt, success messages, info messages, and
hints all go to `stderr`. In JSON mode, `stdout` carries only the
structured objects above. In prose mode, TTY users see everything in
their terminal as before.

### Fixed HTML escaping in JSON output

`text.IndentJSON` and `text.InlineJSON` now use `json.Encoder` with
`SetEscapeHTML(false)`. The default Go JSON marshaler escapes & as
`\u0026` — correct for embedding JSON in HTML, wrong for CLI output.
This was causing OAuth URLs in the pending JSON object to be
un-pasteable. Unit tests added to prevent regression.

### Removed dead code

- `IO` struct and parameter removed from `Run()` — was accepted but
never used; all writes go directly to `os.Stdout/os.Stderr/os.Stdin`.
- Dead `--quiet/io.Discard` branches removed from both login command
files.
- `msg.Blank()` added to the msg package for consistent stderr
blank-line spacing

## Type of Change
- [X] Bug fix (non-breaking change which fixes an issue)
- [X] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] Infrastructure change (CI configs, etc)
- [ ] Non-code change (docs, etc)
- [ ] None of the above: (explain here)

## Test Plan
You can test locally by piping stdin / stdout, or passing the `--json`
flag manually.

```bash
# force redirecting stdout to trigger JSON output automatically
./dist/pc_darwin_all/pc login | cat

{
    "status": "pending",
    "url": "https://login.pinecone.io/oauth/authorize?audience=https%3A%2F%2Fus-central1-production-console.cloudfunctions.net%2Fapi%2Fv1&client_id=A4ONXSaOGstwwir0zUztoI6zjyt9zsRH&code_challenge=9LpXGYNRqvQRgd4NWSCIyBGAiZClfzkM_SeFI3_280I&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A59049%2Fauth-callback&response_type=code&scope=openid+profile+email+offline_access&sourceTag=pinecone_cli&state=l_CIfL4pkyhj7N7DmCI1qd0OD72_nCyi1ikGvYvCGdw"
}
Press [Enter] to open the browser, or manually paste the URL above.

{
    "status": "authenticated",
    "email": "austin.d@pinecone.io",
    "org_id": "-NF9kuQiPWth9QLPg5NS",
    "project_id": "504ef178-3aac-49ce-93cd-86dc262e6e43"
}

# login with explicit --json flagged, make sure the browser prompt works when it's displayed
./dist/pc_darwin_all/pc login --json
{
    "status": "pending",
    "url": "https://login.pinecone.io/oauth/authorize?audience=https%3A%2F%2Fus-central1-production-console.cloudfunctions.net%2Fapi%2Fv1&client_id=A4ONXSaOGstwwir0zUztoI6zjyt9zsRH&code_challenge=YoI6PnfYkLeSKzoOzfSQIKxlHduoawCij2LWu2XFg7w&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A59049%2Fauth-callback&response_type=code&scope=openid+profile+email+offline_access&sourceTag=pinecone_cli&state=qEVw2RwQnHX32iQ5wtK7yzxalAZE8wDWtFDH8eTqN6Y"
}

Press [Enter] to open the browser, or manually paste the URL above.

{
    "status": "authenticated",
    "email": "austin.d@pinecone.io",
    "org_id": "-NF9kuQiPWth9QLPg5NS",
    "project_id": "504ef178-3aac-49ce-93cd-86dc262e6e43"
}

# pipe stderr explicitly and trigger --json or stdout explicitly to check that stdout output is clean
./dist/pc_darwin_all/pc login --json 2>/dev/null
./dist/pc_darwin_all/pc login 2>/dev/null | cat
./dist/pc_darwin_all/pc login < /dev/null | cat
{
    "status": "pending",
    "url": "https://login.pinecone.io/oauth/authorize?audience=https%3A%2F%2Fus-central1-production-console.cloudfunctions.net%2Fapi%2Fv1&client_id=A4ONXSaOGstwwir0zUztoI6zjyt9zsRH&code_challenge=BSh06S5jkmTH8lucj8CAVwy5AhGKITxjX7V4knal0Mw&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A59049%2Fauth-callback&response_type=code&scope=openid+profile+email+offline_access&sourceTag=pinecone_cli&state=7y-Jygv-RPLGY4X-kMPJHfd4PeMxphll3x8xA-0MRKY"
}
{
    "status": "authenticated",
    "email": "austin.d@pinecone.io",
    "org_id": "-NF9kuQiPWth9QLPg5NS",
    "project_id": "504ef178-3aac-49ce-93cd-86dc262e6e43"
}
```

Make sure the traditional login experience works as expected:
```bash
./dist/pc_darwin_all/pc login
Visit https://login.pinecone.io/oauth/authorize?audience=https%3A%2F%2Fus-central1-production-console.cloudfunctions.net%2Fapi%2Fv1&client_id=A4ONXSaOGstwwir0zUztoI6zjyt9zsRH&code_challenge=2seMya2Pxhr_ug_shJZkhMxVnVdVT0gD3H8zKACJzYk&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A59049%2Fauth-callback&response_type=code&scope=openid+profile+email+offline_access&sourceTag=pinecone_cli&state=Hm31H8dOMNjGtTdMr4n0Erfa42JqsZo7DEs5vZZ9gfY to authorize the CLI.

Press [Enter] to open the browser, or manually paste the URL above.


[SUCCESS] Logged in as austin.d@pinecone.io. Defaulted to organization ID: -NF9kuQiPWth9QLPg5NS
[INFO] Target org set to pinecone-official.
[INFO] Target project set cmek-integration-tests.

Hint: Run pc target to change the target context.
Hint: Now try pc index -h to learn about index operations.
```


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes `pc login`/`pc auth login` output behavior and login helper
signatures, which could affect existing scripts and interactive UX,
though core OAuth exchange remains the same.
> 
> **Overview**
> Improves `pc login` and `pc auth login` for non-interactive/agentic
use by adding `--json` and *auto-emitting JSON when stdout is not a
TTY*, while keeping human-readable messaging on interactive terminals.
> 
> The login flow now prints structured JSON status objects (e.g.
`pending` with the OAuth URL, `authenticated` / `already_authenticated`
with claims) to stdout, moves prompts and prose to stderr, and gates the
"Press [Enter]" stdin reader on interactive stdin to avoid hanging in
piped runs.
> 
> Updates shared helpers (`login.Run`, `GetAndSetAccessToken`) to take
`login.Options{Json: ...}`, adds `msg.Blank()` for consistent spacing,
and adjusts JSON encoding (`text.InlineJSON`/`IndentJSON`) to disable
HTML escaping (with new tests).
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
64aea12. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: austin-denoble

internal/pkg/cli/command/auth/login.go

@@ -2,7 +2,6 @@ package auth
 
 import (
 	_ "embed"
-	"io"
 
 	"github.com/pinecone-io/cli/internal/pkg/utils/help"
 	"github.com/pinecone-io/cli/internal/pkg/utils/login"
@@ -28,6 +27,8 @@ var (
 )
 
 func NewLoginCmd() *cobra.Command {
+	var jsonOutput bool
+
 	cmd := &cobra.Command{
 		Use:   "login",
 		Short: "Authenticate with Pinecone via user login in a web browser",
@@ -37,21 +38,11 @@ func NewLoginCmd() *cobra.Command {
 		`),
 		GroupID: help.GROUP_AUTH.ID,
 		Run: func(cmd *cobra.Command, args []string) {
-			out := cmd.OutOrStdout()
-			if quiet, _ := cmd.Flags().GetBool("quiet"); quiet {
-				out = io.Discard
-			}
-
-			login.Run(cmd.Context(),
-				login.IO{
-					In:  cmd.InOrStdin(),
-					Out: out,
-					Err: cmd.ErrOrStderr(),
-				},
-				login.Options{},
-			)
+			login.Run(cmd.Context(), login.Options{Json: jsonOutput})
 		},
 	}
 
+	cmd.Flags().BoolVar(&jsonOutput, "json", false, "emit JSON output")
+
 	return cmd
 }

internal/pkg/cli/command/login/login.go

@@ -2,7 +2,6 @@ package login
 
 import (
 	_ "embed"
-	"io"
 
 	"github.com/pinecone-io/cli/internal/pkg/utils/help"
 	"github.com/pinecone-io/cli/internal/pkg/utils/login"
@@ -20,6 +19,8 @@ var (
 )
 
 func NewLoginCmd() *cobra.Command {
+	var jsonOutput bool
+
 	cmd := &cobra.Command{
 		Use:   "login",
 		Short: "Authenticate with Pinecone via user login in a web browser",
@@ -29,21 +30,11 @@ func NewLoginCmd() *cobra.Command {
 		`),
 		GroupID: help.GROUP_AUTH.ID,
 		Run: func(cmd *cobra.Command, args []string) {
-			out := cmd.OutOrStdout()
-			if quiet, _ := cmd.Flags().GetBool("quiet"); quiet {
-				out = io.Discard
-			}
-
-			login.Run(cmd.Context(),
-				login.IO{
-					In:  cmd.InOrStdin(),
-					Out: out,
-					Err: cmd.ErrOrStderr(),
-				},
-				login.Options{},
-			)
+			login.Run(cmd.Context(), login.Options{Json: jsonOutput})
 		},
 	}
 
+	cmd.Flags().BoolVar(&jsonOutput, "json", false, "emit JSON output")
+
 	return cmd
 }

internal/pkg/cli/command/target/target.go

@@ -158,7 +158,7 @@ func NewTargetCmd() *cobra.Command {
 					// If the org chosen differs from the current orgId in the token, we need to login again
 					if currentTokenOrgId != "" && currentTokenOrgId != targetOrg.Id {
 						oauth.Logout()
-						err = login.GetAndSetAccessToken(ctx, &targetOrg.Id)
+						err = login.GetAndSetAccessToken(ctx, &targetOrg.Id, login.Options{})
 						if err != nil {
 							msg.FailMsg("Failed to get access token: %s", err)
 							exit.Error(err, "Error getting access token")
@@ -204,7 +204,7 @@ func NewTargetCmd() *cobra.Command {
 				// If the org chosen differs from the current orgId in the token, we need to login again
 				if currentTokenOrgId != org.Id {
 					oauth.Logout()
-					err = login.GetAndSetAccessToken(ctx, &org.Id)
+					err = login.GetAndSetAccessToken(ctx, &org.Id, login.Options{})
 					if err != nil {
 						msg.FailMsg("Failed to get access token: %s", err)
 						exit.Error(err, "Error getting access token")

internal/pkg/utils/login/login.go

@@ -9,11 +9,12 @@ import (
 	"errors"
 	"fmt"
 	"html/template"
-	"io"
 	"net/http"
 	"os"
 	"time"
 
+	"golang.org/x/term"
+
 	"github.com/pinecone-io/cli/internal/pkg/utils/browser"
 	"github.com/pinecone-io/cli/internal/pkg/utils/configuration/secrets"
 	"github.com/pinecone-io/cli/internal/pkg/utils/configuration/state"
@@ -23,6 +24,7 @@ import (
 	"github.com/pinecone-io/cli/internal/pkg/utils/oauth"
 	"github.com/pinecone-io/cli/internal/pkg/utils/sdk"
 	"github.com/pinecone-io/cli/internal/pkg/utils/style"
+	"github.com/pinecone-io/cli/internal/pkg/utils/text"
 	"github.com/pinecone-io/go-pinecone/v5/pinecone"
 )
 
@@ -35,15 +37,15 @@ var errorHTML string
 //go:embed assets/pinecone_logo.svg
 var logoSVG string
 
-type IO struct {
-	In  io.Reader
-	Out io.Writer
-	Err io.Writer
+type Options struct {
+	Json bool
 }
 
-type Options struct{}
+func Run(ctx context.Context, opts Options) {
+	// Resolve output format once at the top level: explicit --json flag or auto-detected non-TTY stdout.
+	// Normalizing opts.Json here means GetAndSetAccessToken and other helpers use opts.Json directly.
+	opts.Json = opts.Json || !term.IsTerminal(int(os.Stdout.Fd()))
 
-func Run(ctx context.Context, io IO, opts Options) {
 	// Check if the user is currently logged in
 	token, err := oauth.Token(ctx)
 
@@ -55,12 +57,27 @@ func Run(ctx context.Context, io IO, opts Options) {
 	}
 
 	if !expired && token != nil && token.AccessToken != "" {
-		msg.WarnMsg("You are already logged in. Please log out first using %s.", style.Code("pc auth logout"))
+		if opts.Json {
+			claims, err := oauth.ParseClaimsUnverified(token)
+			if err == nil {
+				fmt.Fprintln(os.Stdout, text.IndentJSON(struct {
+					Status string `json:"status"`
+					Email  string `json:"email"`
+					OrgId  string `json:"org_id"`
+				}{Status: "already_authenticated", Email: claims.Email, OrgId: claims.OrgId}))
+			} else {
+				fmt.Fprintln(os.Stdout, text.IndentJSON(struct {
+					Status string `json:"status"`
+				}{Status: "already_authenticated"}))
+			}
+		} else {
+			msg.WarnMsg("You are already logged in. Please log out first using %s.", style.Code("pc auth logout"))
+		}
 		return
 	}
 
 	// Initiate login flow
-	err = GetAndSetAccessToken(ctx, nil)
+	err = GetAndSetAccessToken(ctx, nil, opts)
 	if err != nil {
 		msg.FailMsg("Error acquiring access token while logging in: %s", err)
 		exit.Error(err, "Error acquiring access token while logging in")
@@ -77,7 +94,10 @@ func Run(ctx context.Context, io IO, opts Options) {
 		msg.FailMsg("An auth token was fetched but an error occurred while parsing the token's claims: %s", err)
 		exit.Error(err, "Error parsing claims from access token")
 	}
-	msg.SuccessMsg("Logged in as " + style.Emphasis(claims.Email) + ". Defaulted to organization ID: " + style.Emphasis(claims.OrgId))
+	if !opts.Json {
+		msg.Blank()
+		msg.SuccessMsg("Logged in as " + style.Emphasis(claims.Email) + ". Defaulted to organization ID: " + style.Emphasis(claims.OrgId))
+	}
 
 	ac := sdk.NewPineconeAdminClient(ctx)
 	if err != nil {
@@ -111,34 +131,50 @@ func Run(ctx context.Context, io IO, opts Options) {
 		Name: targetOrg.Name,
 		Id:   targetOrg.Id,
 	})
-	fmt.Println()
-	fmt.Printf(style.InfoMsg("Target org set to %s.\n"), style.Emphasis(targetOrg.Name))
 
-	if projects != nil {
-		if len(projects) == 0 {
-			fmt.Printf(style.InfoMsg("No projects found for organization %s.\n"), style.Emphasis(targetOrg.Name))
-			fmt.Println(style.InfoMsg("Please create a project for this organization to work with project resources."))
-		} else {
+	if opts.Json {
+		projectId := ""
+		if len(projects) > 0 {
 			targetProj := projects[0]
 			state.TargetProj.Set(state.TargetProject{
 				Name: targetProj.Name,
 				Id:   targetProj.Id,
 			})
-
-			fmt.Printf(style.InfoMsg("Target project set %s.\n"), style.Emphasis(targetProj.Name))
+			projectId = targetProj.Id
+		}
+		fmt.Fprintln(os.Stdout, text.IndentJSON(struct {
+			Status    string `json:"status"`
+			Email     string `json:"email"`
+			OrgId     string `json:"org_id"`
+			ProjectId string `json:"project_id"`
+		}{Status: "authenticated", Email: claims.Email, OrgId: targetOrg.Id, ProjectId: projectId}))
+	} else {
+		msg.InfoMsg("Target org set to %s.", style.Emphasis(targetOrg.Name))
+
+		if projects != nil {
+			if len(projects) == 0 {
+				msg.InfoMsg("No projects found for organization %s.", style.Emphasis(targetOrg.Name))
+				msg.InfoMsg("Please create a project for this organization to work with project resources.")
+			} else {
+				targetProj := projects[0]
+				state.TargetProj.Set(state.TargetProject{
+					Name: targetProj.Name,
+					Id:   targetProj.Id,
+				})
+
+				msg.InfoMsg("Target project set %s.", style.Emphasis(targetProj.Name))
+			}
 		}
-	}
-
-	fmt.Println()
-	fmt.Println(style.CodeHint("Run %s to change the target context.", style.Code("pc target")))
 
-	fmt.Println()
-	fmt.Printf("Now try %s to learn about index operations.\n", style.Code("pc index -h"))
+		msg.Blank()
+		msg.HintMsg("Run %s to change the target context.", style.Code("pc target"))
+		msg.HintMsg("Now try %s to learn about index operations.", style.Code("pc index -h"))
+	}
 }
 
 // Takes an optional orgId, and attempts to acquire an access token scoped to the orgId if provided.
 // If a token is successfully acquired it's set in the secrets store, and the user is considered logged in with state.AuthUserToken.
-func GetAndSetAccessToken(ctx context.Context, orgId *string) error {
+func GetAndSetAccessToken(ctx context.Context, orgId *string, opts Options) error {
 	a := oauth.Auth{}
 
 	// CSRF state
@@ -170,40 +206,51 @@ func GetAndSetAccessToken(ctx context.Context, orgId *string) error {
 		codeCh <- code
 	}()
 
-	fmt.Printf("Visit %s to authorize the CLI.\n", style.Underline(authURL))
-	fmt.Println()
-	fmt.Printf("Press %s to open the browser, or manually paste the URL above.\n", style.Code("[Enter]"))
-
-	// spawn a goroutine to optionally wait for [Enter] as input
-	go func(ctx context.Context) {
-		// inner channel to signal that [Enter] was pressed
-		inputCh := make(chan struct{}, 1)
+	if opts.Json {
+		fmt.Fprintln(os.Stdout, text.IndentJSON(struct {
+			Status string `json:"status"`
+			URL    string `json:"url"`
+		}{Status: "pending", URL: authURL}))
+	} else {
+		fmt.Fprintf(os.Stderr, "Visit %s to authorize the CLI.\n", style.Underline(authURL))
+	}
 
-		// spawn inner goroutine to read stdin (blocking)
-		go func() {
-			_, err := bufio.NewReader(os.Stdin).ReadBytes('\n')
-			if err != nil {
-				log.Error().Err(err).Msg("stdin error: unable to open browser")
+	// Prompt for [Enter] and spawn stdin reader whenever stdin is an interactive TTY,
+	// regardless of output format. JSON mode only affects what goes to stdout — a user
+	// running --json in a terminal is still at a keyboard and benefits from browser-open.
+	// The prompt goes to stderr so it never corrupts the stdout JSON stream.
+	if term.IsTerminal(int(os.Stdin.Fd())) {
+		msg.Blank()
+		fmt.Fprintf(os.Stderr, "Press %s to open the browser, or manually paste the URL above.\n", style.Code("[Enter]"))
+
+		go func(ctx context.Context) {
+			// inner channel to signal that [Enter] was pressed
+			inputCh := make(chan struct{}, 1)
+
+			// spawn inner goroutine to read stdin (blocking)
+			go func() {
+				_, err := bufio.NewReader(os.Stdin).ReadBytes('\n')
+				if err != nil {
+					log.Error().Err(err).Msg("stdin error: unable to open browser")
+					return
+				}
+				close(inputCh)
+			}()
+
+			// wait for [Enter], auth code, or timeout
+			select {
+			case <-ctx.Done():
 				return
-			}
-			close(inputCh)
-		}()
-
-		// wait for [Enter], auth code, or timeout
-		select {
-		case <-ctx.Done():
-			return
-		case <-inputCh:
-			err = browser.OpenBrowser(authURL)
-			if err != nil {
-				log.Error().Err(err).Msg("error opening browser")
+			case <-inputCh:
+				if err := browser.OpenBrowser(authURL); err != nil {
+					log.Error().Err(err).Msg("error opening browser")
+				}
+			case <-time.After(5 * time.Minute):
+				// extra precaution to prevent hanging indefinitely on stdin
 				return
 			}
-		case <-time.After(5 * time.Minute):
-			// extra precaution to prevent hanging indefinitely on stdin
-			return
-		}
-	}(serverCtx)
+		}(serverCtx)
+	}
 
 	// Wait for auth code and exchange for access token
 	code := <-codeCh

internal/pkg/utils/msg/message.go

@@ -31,3 +31,7 @@ func HintMsg(format string, a ...any) {
 	formatted := fmt.Sprintf(format, a...)
 	fmt.Fprintln(os.Stderr, style.Hint(formatted))
 }
+
+func Blank() {
+	fmt.Fprintln(os.Stderr, "")
+}

internal/pkg/utils/text/json.go

@@ -1,21 +1,33 @@
 package text
 
 import (
+	"bytes"
 	"encoding/json"
+	"strings"
 )
 
-func InlineJSON(data any) string {
-	jsonData, err := json.Marshal(data)
-	if err != nil {
+// encode marshals data to JSON with HTML escaping disabled.
+// json.Marshal and json.MarshalIndent escape &, <, > as \uXXXX by default —
+// a safety measure for embedding JSON in HTML that is incorrect for CLI output.
+func encode(data any, indent bool) string {
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	if indent {
+		enc.SetIndent("", "    ")
+	}
+	if err := enc.Encode(data); err != nil {
 		return ""
 	}
-	return string(jsonData)
+	// json.Encoder.Encode appends a trailing newline; trim it so callers
+	// control their own newlines (consistent with the old MarshalIndent behavior).
+	return strings.TrimRight(buf.String(), "\n")
+}
+
+func InlineJSON(data any) string {
+	return encode(data, false)
 }
 
 func IndentJSON(data any) string {
-	jsonData, err := json.MarshalIndent(data, "", "    ")
-	if err != nil {
-		return ""
-	}
-	return string(jsonData)
+	return encode(data, true)
 }