The sign-in asked for the agent's token only when the CLI had no login for the server on file, so a computer with an old, refused login got the app's token alone, and the agent stayed refused. It now asks unless the CLI says the link works, and hands the token over (the CLI's --token-stdin login replaces the one it had) or gives it up when the link came up meanwhile. Link this computer is a device login for the agent's scopes alone, handed to the CLI the same way, with a cancel: `lembas login <server>` only refreshed a login the CLI already had. A service that ends for want of a login is "not linked"; another reason is "stopped"; only the server's refusal, with its reason, is "refused". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>