feat(wip): push to leaflet!

cmd/commands.go

···
 		Short: "Manage movie watch queue",
 		Long: `Track movies you want to watch.
 
-Search TMDB for movies and add them to your queue. Mark movies as watched when
-completed. Maintains a history of your movie watching activity.`,
+Search for movies and add them to your queue. Mark movies as watched
+when completed. Maintains a history of your movie watching activity.`,
 	}
 
+	// TODO: add colors
+	// TODO: fix critic score parsing
 	addCmd := &cobra.Command{
 		Use:   "add [search query...]",
 		Short: "Search and add movie to watch queue",
···
 	addCmd.Flags().BoolP("interactive", "i", false, "Use interactive interface for movie selection")
 	root.AddCommand(addCmd)
 
+	// TODO: add interactive list view
 	root.AddCommand(&cobra.Command{
 		Use:   "list [--all|--watched|--queued]",
 		Short: "List movies in queue with status filtering",
···
 		Short: "Manage TV show watch queue",
 		Long: `Track TV shows and episodes.
 
-Search TMDB for TV shows and add them to your queue. Track which shows you're
-currently watching, mark episodes as watched, and maintain a complete history
-of your viewing activity.`,
+Search for TV shows and add them to your queue. Track which shows you're currently
+watching, mark episodes as watched, and maintain a complete history of your viewing
+activity.`,
 	}
 
 	addCmd := &cobra.Command{

cmd/publication_commands.go

···
 				handle = args[0]
 			}
 
+			// Auto-fill with last authenticated handle if available
+			if handle == "" {
+				lastHandle := c.handler.GetLastAuthenticatedHandle()
+				if lastHandle != "" {
+					handle = lastHandle
+				}
+			}
+
 			password, _ := cmd.Flags().GetString("password")
 
 			if handle != "" && password != "" {

internal/handlers/publication.go

···
 	"strings"
 	"time"
 
+	"github.com/charmbracelet/log"
 	"github.com/stormlightlabs/noteleaf/internal/models"
 	"github.com/stormlightlabs/noteleaf/internal/public"
 	"github.com/stormlightlabs/noteleaf/internal/repo"
 	"github.com/stormlightlabs/noteleaf/internal/services"
+	"github.com/stormlightlabs/noteleaf/internal/shared"
 	"github.com/stormlightlabs/noteleaf/internal/store"
 	"github.com/stormlightlabs/noteleaf/internal/ui"
 )
···
 	config  *store.Config
 	repos   *repo.Repositories
 	atproto services.ATProtoClient
+	debug   *log.Logger
 }
 
 // NewPublicationHandler creates a new publication handler
···
 	repos := repo.NewRepositories(db.DB)
 	atproto := services.NewATProtoService()
 
+	d, _ := store.GetConfigDir()
+	debug := shared.NewDebugLoggerWithFile(d)
+
 	if config.ATProtoDID != "" && config.ATProtoAccessJWT != "" && config.ATProtoRefreshJWT != "" {
 		session, err := sessionFromConfig(config)
 		if err == nil {
-			_ = atproto.RestoreSession(session)
+			if err := atproto.RestoreSession(session); err == nil {
+				updatedSession, _ := atproto.GetSession()
+				if updatedSession != nil {
+					config.ATProtoAccessJWT = updatedSession.AccessJWT
+					config.ATProtoRefreshJWT = updatedSession.RefreshJWT
+					config.ATProtoExpiresAt = updatedSession.ExpiresAt.Format("2006-01-02T15:04:05Z07:00")
+					_ = store.SaveConfig(config)
+				}
+			}
 		}
 	}
 
···
 		config:  config,
 		repos:   repos,
 		atproto: atproto,
+		debug:   debug,
 	}, nil
 }
 
···
 	if err != nil {
 		return err
 	}
-
 	ui.Infoln("Creating document '%s' on leaflet...", note.Title)
 
 	result, err := h.atproto.PostDocument(ctx, *doc, isDraft)
···
 		return nil, nil, fmt.Errorf("failed to convert markdown to leaflet format: %w", err)
 	}
 
+	publicationURI, err := h.atproto.GetDefaultPublication(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to get publication: %w", err)
+	}
+
+	docType := public.TypeDocument
+	if isDraft {
+		docType = public.TypeDocumentDraft
+	}
+
 	doc := &public.Document{
+		Type:        docType,
 		Author:      session.DID,
 		Title:       note.Title,
 		Description: "",
+		Publication: publicationURI,
 		Pages: []public.LinearDocument{
 			{
 				Type:   public.TypeLinearDocument,
···
 		return "Authenticated (session details unavailable)"
 	}
 	return "Not authenticated"
+}
+
+// GetLastAuthenticatedHandle returns the last authenticated handle from config
+func (h *PublicationHandler) GetLastAuthenticatedHandle() string {
+	if h.config != nil && h.config.ATProtoHandle != "" {
+		return h.config.ATProtoHandle
+	}
+	return ""
 }
 
 // extractNoteDirectory extracts the directory path from a note's FilePath

internal/handlers/publication_test.go

···
 		})
 	})
 
+	t.Run("GetLastAuthenticatedHandle", func(t *testing.T) {
+		t.Run("returns empty string when no config", func(t *testing.T) {
+			handler := &PublicationHandler{
+				config: nil,
+			}
+
+			handle := handler.GetLastAuthenticatedHandle()
+			if handle != "" {
+				t.Errorf("Expected empty string, got '%s'", handle)
+			}
+		})
+
+		t.Run("returns empty string when handle not set", func(t *testing.T) {
+			handler := &PublicationHandler{
+				config: &store.Config{},
+			}
+
+			handle := handler.GetLastAuthenticatedHandle()
+			if handle != "" {
+				t.Errorf("Expected empty string, got '%s'", handle)
+			}
+		})
+
+		t.Run("returns handle from config", func(t *testing.T) {
+			expectedHandle := "test.bsky.social"
+			handler := &PublicationHandler{
+				config: &store.Config{
+					ATProtoHandle: expectedHandle,
+				},
+			}
+
+			handle := handler.GetLastAuthenticatedHandle()
+			if handle != expectedHandle {
+				t.Errorf("Expected '%s', got '%s'", expectedHandle, handle)
+			}
+		})
+
+		t.Run("returns handle after successful authentication", func(t *testing.T) {
+			suite := NewHandlerTestSuite(t)
+			defer suite.Cleanup()
+
+			handler := CreateHandler(t, NewPublicationHandler)
+			ctx := context.Background()
+
+			mock := services.SetupSuccessfulAuthMocks()
+			handler.atproto = mock
+
+			err := handler.Auth(ctx, "user.bsky.social", "password123")
+			suite.AssertNoError(err, "authentication should succeed")
+
+			handle := handler.GetLastAuthenticatedHandle()
+			if handle != "user.bsky.social" {
+				t.Errorf("Expected 'user.bsky.social', got '%s'", handle)
+			}
+		})
+	})
+
 	t.Run("NewPublicationHandler", func(t *testing.T) {
 		t.Run("creates handler successfully", func(t *testing.T) {
 			suite := NewHandlerTestSuite(t)
···
 			id, err := handler.repos.Notes.Create(ctx, note)
 			suite.AssertNoError(err, "create note")
 
-			session := &services.Session{
+			mock := services.NewMockATProtoService()
+			mock.IsAuthenticatedVal = true
+			mock.Session = &services.Session{
 				DID:           "did:plc:test123",
 				Handle:        "test.bsky.social",
 				AccessJWT:     "access_token",
···
 				ExpiresAt:     time.Now().Add(2 * time.Hour),
 				Authenticated: true,
 			}
-
-			err = handler.atproto.RestoreSession(session)
-			if err != nil {
-				t.Fatalf("Failed to restore session: %v", err)
-			}
+			handler.atproto = mock
 
 			err = handler.PostPreview(ctx, id, false, "", false)
 			suite.AssertNoError(err, "preview should succeed")
···
 			id, err := handler.repos.Notes.Create(ctx, note)
 			suite.AssertNoError(err, "create note")
 
-			session := &services.Session{
+			mock := services.NewMockATProtoService()
+			mock.IsAuthenticatedVal = true
+			mock.Session = &services.Session{
 				DID:           "did:plc:test123",
 				Handle:        "test.bsky.social",
 				AccessJWT:     "access_token",
···
 				ExpiresAt:     time.Now().Add(2 * time.Hour),
 				Authenticated: true,
 			}
-
-			err = handler.atproto.RestoreSession(session)
-			if err != nil {
-				t.Fatalf("Failed to restore session: %v", err)
-			}
+			handler.atproto = mock
 
 			err = handler.PostPreview(ctx, id, true, "", false)
 			suite.AssertNoError(err, "preview draft should succeed")
···
 			id, err := handler.repos.Notes.Create(ctx, note)
 			suite.AssertNoError(err, "create note")
 
-			session := &services.Session{
+			mock := services.NewMockATProtoService()
+			mock.IsAuthenticatedVal = true
+			mock.Session = &services.Session{
 				DID:           "did:plc:test123",
 				Handle:        "test.bsky.social",
 				AccessJWT:     "access_token",
···
 				ExpiresAt:     time.Now().Add(2 * time.Hour),
 				Authenticated: true,
 			}
-
-			err = handler.atproto.RestoreSession(session)
-			if err != nil {
-				t.Fatalf("Failed to restore session: %v", err)
-			}
+			handler.atproto = mock
 
 			err = handler.PostValidate(ctx, id, false, "", false)
 			suite.AssertNoError(err, "validation should succeed")
···
 			id, err := handler.repos.Notes.Create(ctx, note)
 			suite.AssertNoError(err, "create note")
 
-			session := &services.Session{
+			mock := services.NewMockATProtoService()
+			mock.IsAuthenticatedVal = true
+			mock.Session = &services.Session{
 				DID:           "did:plc:test123",
 				Handle:        "test.bsky.social",
 				AccessJWT:     "access_token",
···
 				ExpiresAt:     time.Now().Add(2 * time.Hour),
 				Authenticated: true,
 			}
-
-			err = handler.atproto.RestoreSession(session)
-			if err != nil {
-				t.Fatalf("Failed to restore session: %v", err)
-			}
+			handler.atproto = mock
 
 			err = handler.PatchPreview(ctx, id, "", false)
 			suite.AssertNoError(err, "preview should succeed")
···
 			id, err := handler.repos.Notes.Create(ctx, note)
 			suite.AssertNoError(err, "create note")
 
-			session := &services.Session{
+			mock := services.NewMockATProtoService()
+			mock.IsAuthenticatedVal = true
+			mock.Session = &services.Session{
 				DID:           "did:plc:test123",
 				Handle:        "test.bsky.social",
 				AccessJWT:     "access_token",
···
 				ExpiresAt:     time.Now().Add(2 * time.Hour),
 				Authenticated: true,
 			}
-
-			err = handler.atproto.RestoreSession(session)
-			if err != nil {
-				t.Fatalf("Failed to restore session: %v", err)
-			}
+			handler.atproto = mock
 
 			err = handler.PatchValidate(ctx, id, "", false)
 			suite.AssertNoError(err, "validation should succeed")

internal/services/atproto.go

···
 	PatchDocument(ctx context.Context, rkey string, doc public.Document, isDraft bool) (*DocumentWithMeta, error)
 	DeleteDocument(ctx context.Context, rkey string, isDraft bool) error
 	UploadBlob(ctx context.Context, data []byte, mimeType string) (public.Blob, error)
+	GetDefaultPublication(ctx context.Context) (string, error)
 	Close() error
 }
 
···
 	session  *Session
 	pdsURL   string // Personal Data Server URL
 	client   *xrpc.Client
+
+	// TODO: Future enhancement - integrate OS keychain for secure password storage
+	// Consider using keyring libraries like:
+	//   - github.com/zalando/go-keyring (cross-platform)
+	//   - keychain access on macOS (Security.framework)
+	//   - Windows Credential Manager (credman)
+	//   - Linux Secret Service API (libsecret)
+	// This would allow storing app passwords securely in the system keychain
+	// instead of requiring re-authentication every time JWTs expire.
 }
 
 // NewATProtoService creates a new AT Protocol service
···
 }
 
 // RestoreSession restores a previously authenticated session from stored credentials
+// and automatically refreshes the token if expired
 func (s *ATProtoService) RestoreSession(session *Session) error {
 	if session == nil {
 		return fmt.Errorf("session cannot be nil")
···
 		s.client.Host = session.PDSURL
 	}
 
+	// Check if token is expired or about to expire (within 5 minutes)
+	if time.Now().Add(5 * time.Minute).After(session.ExpiresAt) {
+		ctx := context.Background()
+		if err := s.RefreshToken(ctx); err != nil {
+			// Token refresh failed - session may be invalid
+			// User will need to re-authenticate
+			return fmt.Errorf("session expired and refresh failed: %w", err)
+		}
+	}
+
 	return nil
 }
 
 // RefreshToken refreshes the access token using the refresh token
+// This extends the session without requiring the user to re-authenticate
 func (s *ATProtoService) RefreshToken(ctx context.Context) error {
 	if s.session == nil || s.session.RefreshJWT == "" {
 		return fmt.Errorf("no session available to refresh")
···
 		return fmt.Errorf("failed to refresh session: %w", err)
 	}
 
+	// TODO: Consider increasing token lifetime for better UX
+	// Current: 2 hours - requires frequent re-authentication
+	// Consider: Store in OS keychain to enable longer sessions without security risk
 	expiresAt := time.Now().Add(2 * time.Hour)
 	s.session.AccessJWT = output.AccessJwt
 	s.session.RefreshJWT = output.RefreshJwt
···
 			return fmt.Errorf("failed to get record bytes for %s: %w", k, err)
 		}
 
-		var pub public.Publication
-		if err := json.Unmarshal(*recordBytes, &pub); err != nil {
-			return fmt.Errorf("failed to unmarshal publication %s: %w", k, err)
+		var cborData any
+		if err := cbor.Unmarshal(*recordBytes, &cborData); err != nil {
+			return fmt.Errorf("failed to decode CBOR for document %s: %w", k, err)
+		}
+
+		jsonCompatible := convertCBORToJSONCompatible(cborData)
+
+		jsonBytes, err := json.MarshalIndent(jsonCompatible, "", "  ")
+		if err != nil {
+			return fmt.Errorf("failed to convert CBOR to JSON for document %s: %w", k, err)
 		}
 
 		parts := strings.Split(k, "/")
 		rkey := ""
 		if len(parts) > 0 {
 			rkey = parts[len(parts)-1]
+		}
+
+		var pub public.Publication
+		if err := json.Unmarshal(jsonBytes, &pub); err != nil {
+			return fmt.Errorf("failed to unmarshal publication %s: %w", k, err)
 		}
 
 		uri := fmt.Sprintf("at://%s/%s", s.session.DID, k)
···
 	return publications, nil
 }
 
+// GetDefaultPublication returns the URI of the first available publication for the authenticated user
+//
+// Returns an error if no publications exist
+func (s *ATProtoService) GetDefaultPublication(ctx context.Context) (string, error) {
+	publications, err := s.ListPublications(ctx)
+	if err != nil {
+		return "", err
+	}
+
+	if len(publications) == 0 {
+		return "", fmt.Errorf("no publications found - create a publication on leaflet.pub first")
+	}
+
+	return publications[0].URI, nil
+}
+
 // PostDocument creates a new document in the user's repository
 func (s *ATProtoService) PostDocument(ctx context.Context, doc public.Document, isDraft bool) (*DocumentWithMeta, error) {
 	if !s.IsAuthenticated() {
···
 	}
 
 	doc.Type = collection
-
 	jsonBytes, err := json.Marshal(doc)
 	if err != nil {
-		return nil, fmt.Errorf("failed to marshal document to JSON: %w", err)
+		return nil, fmt.Errorf("marshal: %w", err)
 	}
 
-	var jsonData map[string]any
-	if err := json.Unmarshal(jsonBytes, &jsonData); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal JSON to map: %w", err)
+	var m map[string]any
+	if err := json.Unmarshal(jsonBytes, &m); err != nil {
+		return nil, fmt.Errorf("unmarshal: %w", err)
 	}
+	m["$type"] = collection
 
-	cborCompatible := convertJSONToCBORCompatible(jsonData)
-
-	cborBytes, err := cbor.Marshal(cborCompatible)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal to CBOR: %w", err)
-	}
-
-	record := &lexutil.LexiconTypeDecoder{}
-	if err := cbor.Unmarshal(cborBytes, record); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal CBOR to lexicon type: %w", err)
-	}
-
-	input := &atproto.RepoCreateRecord_Input{
-		Repo:       s.session.DID,
-		Collection: collection,
-		Record:     record,
-	}
-
-	output, err := atproto.RepoCreateRecord(ctx, s.client, input)
+	output, err := repoCreateRecord(ctx, s.client, s.session.DID, collection, m)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create record: %w", err)
 	}
 
 	parts := strings.Split(output.Uri, "/")
-	rkey := ""
-	if len(parts) > 0 {
-		rkey = parts[len(parts)-1]
-	}
+	rkey := parts[len(parts)-1]
 
 	meta := public.DocumentMeta{
 		RKey:      rkey,
···
 	s.session = nil
 	return nil
 }
+
+type RepoCreateRecordOutput struct {
+	Cid string `json:"cid"`
+	Uri string `json:"uri"`
+}
+
+func repoCreateRecord(ctx context.Context, client *xrpc.Client, repo, collection string, record map[string]any) (*RepoCreateRecordOutput, error) {
+	body := map[string]any{
+		"repo":       repo,
+		"collection": collection,
+		"record":     record,
+	}
+
+	var out RepoCreateRecordOutput
+	if err := client.LexDo(
+		ctx,
+		lexutil.Procedure,
+		"application/json",
+		"com.atproto.repo.createRecord",
+		nil,
+		body,
+		&out,
+	); err != nil {
+		return nil, fmt.Errorf("repoCreateRecord failed: %w", err)
+	}
+	return &out, nil
+}

internal/services/atproto_test.go

···
 		})
 	})
 
+	t.Run("GetDefaultPublication", func(t *testing.T) {
+		t.Run("returns error when not authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+			ctx := context.Background()
+
+			uri, err := svc.GetDefaultPublication(ctx)
+			if err == nil {
+				t.Error("Expected error when getting default publication without authentication")
+			}
+			if uri != "" {
+				t.Errorf("Expected empty URI, got %s", uri)
+			}
+			if !strings.Contains(err.Error(), "not authenticated") {
+				t.Errorf("Expected 'not authenticated' error, got '%v'", err)
+			}
+		})
+
+		t.Run("returns error when session not authenticated", func(t *testing.T) {
+			svc := NewATProtoService()
+			ctx := context.Background()
+			svc.session = &Session{
+				Handle:        "test.bsky.social",
+				Authenticated: false,
+			}
+
+			uri, err := svc.GetDefaultPublication(ctx)
+			if err == nil {
+				t.Error("Expected error when getting default publication with unauthenticated session")
+			}
+			if uri != "" {
+				t.Errorf("Expected empty URI, got %s", uri)
+			}
+		})
+
+		t.Run("returns error when no publications exist", func(t *testing.T) {
+			svc := NewATProtoService()
+			svc.session = &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				Authenticated: true,
+			}
+			ctx := context.Background()
+
+			_, err := svc.GetDefaultPublication(ctx)
+			if err == nil {
+				t.Error("Expected error when getting default publication")
+			}
+			// With invalid credentials, we expect either auth error or no publications error
+			if !strings.Contains(err.Error(), "no publications found") &&
+				!strings.Contains(err.Error(), "Authentication") &&
+				!strings.Contains(err.Error(), "AuthMissing") &&
+				!strings.Contains(err.Error(), "failed to fetch repository") {
+				t.Errorf("Expected authentication or 'no publications found' error, got '%v'", err)
+			}
+		})
+
+		t.Run("returns error when context cancelled", func(t *testing.T) {
+			svc := NewATProtoService()
+			svc.session = &Session{
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				Authenticated: true,
+			}
+
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+
+			uri, err := svc.GetDefaultPublication(ctx)
+			if err == nil {
+				t.Error("Expected error when context is cancelled")
+			}
+			if uri != "" {
+				t.Errorf("Expected empty URI when error occurs, got %s", uri)
+			}
+		})
+	})
+
 	t.Run("Authentication Error Scenarios", func(t *testing.T) {
 		t.Run("returns error with context timeout", func(t *testing.T) {
 			svc := NewATProtoService()
···
 			defaultPDSURL := svc.pdsURL
 
 			session := &Session{
-				DID:        "did:plc:test123",
-				Handle:     "test.bsky.social",
-				AccessJWT:  "access_token",
-				RefreshJWT: "refresh_token",
-				PDSURL:     "",
+				DID:           "did:plc:test123",
+				Handle:        "test.bsky.social",
+				AccessJWT:     "access_token",
+				RefreshJWT:    "refresh_token",
+				PDSURL:        "",
+				ExpiresAt:     time.Now().Add(2 * time.Hour),
+				Authenticated: true,
 			}
 
 			err := svc.RestoreSession(session)

internal/services/test_utilities.go

···
 
 // MockATProtoService is a mock implementation of ATProtoService for testing
 type MockATProtoService struct {
-	AuthenticateFunc   func(ctx context.Context, handle, password string) error
-	GetSessionFunc     func() (*Session, error)
-	IsAuthenticatedVal bool
-	RestoreSessionFunc func(session *Session) error
-	PullDocumentsFunc  func(ctx context.Context) ([]DocumentWithMeta, error)
-	PostDocumentFunc   func(ctx context.Context, doc public.Document, isDraft bool) (*DocumentWithMeta, error)
-	PatchDocumentFunc  func(ctx context.Context, rkey string, doc public.Document, isDraft bool) (*DocumentWithMeta, error)
-	DeleteDocumentFunc func(ctx context.Context, rkey string, isDraft bool) error
-	UploadBlobFunc     func(ctx context.Context, data []byte, mimeType string) (public.Blob, error)
-	CloseFunc          func() error
-	Session            *Session // Exported for test access
+	AuthenticateFunc          func(ctx context.Context, handle, password string) error
+	GetSessionFunc            func() (*Session, error)
+	IsAuthenticatedVal        bool
+	RestoreSessionFunc        func(session *Session) error
+	PullDocumentsFunc         func(ctx context.Context) ([]DocumentWithMeta, error)
+	PostDocumentFunc          func(ctx context.Context, doc public.Document, isDraft bool) (*DocumentWithMeta, error)
+	PatchDocumentFunc         func(ctx context.Context, rkey string, doc public.Document, isDraft bool) (*DocumentWithMeta, error)
+	DeleteDocumentFunc        func(ctx context.Context, rkey string, isDraft bool) error
+	UploadBlobFunc            func(ctx context.Context, data []byte, mimeType string) (public.Blob, error)
+	GetDefaultPublicationFunc func(ctx context.Context) (string, error)
+	CloseFunc                 func() error
+	Session                   *Session // Exported for test access
 }
 
 // NewMockATProtoService creates a new mock AT Proto service
···
 		MimeType: mimeType,
 		Size:     len(data),
 	}, nil
+}
+
+// GetDefaultPublication mocks getting the default publication
+func (m *MockATProtoService) GetDefaultPublication(ctx context.Context) (string, error) {
+	if m.GetDefaultPublicationFunc != nil {
+		return m.GetDefaultPublicationFunc(ctx)
+	}
+
+	// Default returns a mock publication URI
+	if !m.IsAuthenticatedVal {
+		return "", errors.New("not authenticated")
+	}
+	return "at://did:plc:test123/pub.leaflet.publication/mock_pub_rkey", nil
 }
 
 // Close mocks cleanup

internal/shared/shared.go

···
 import (
 	"errors"
 	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/charmbracelet/log"
 )
 
 var (
···
 func IsConfigError(err error) bool {
 	return errors.Is(err, ErrConfig)
 }
+
+// CompoundWriter writes every payload to two sinks:
+//  1. a primary sink (typically [os.Stdout] or [os.Stderr])
+//  2. a secondary sink (typically [*os.File])
+//
+// It satisfies io.Writer.
+type CompoundWriter struct {
+	primary   io.Writer
+	secondary io.Writer
+}
+
+// New creates a new [CompoundWriter]
+func New(primary io.Writer, secondary io.Writer) *CompoundWriter {
+	return &CompoundWriter{
+		primary:   primary,
+		secondary: secondary,
+	}
+}
+
+func LogWithStdErr(w io.WriteCloser) *CompoundWriter {
+	return New(os.Stderr, w)
+}
+
+func LogWithStdOut(w io.WriteCloser) *CompoundWriter {
+	return New(os.Stdout, w)
+}
+
+// Write writes p to both instances of [io.Writer]
+func (cw *CompoundWriter) Write(p []byte) (int, error) {
+	var err error
+	var n1, n2 int
+
+	if n1, err = cw.primary.Write(p); err != nil {
+		return n1, err
+	}
+	if n2, err = cw.secondary.Write(p); err != nil {
+		return n2, err
+	}
+	return len(p), nil
+}
+
+func FallbackLogger() *log.Logger {
+	return log.NewWithOptions(os.Stderr, log.Options{
+		Prefix:          "[DEBUG]",
+		ReportTimestamp: true,
+		ReportCaller:    true,
+		TimeFormat:      time.Kitchen,
+		Level:           log.DebugLevel,
+	})
+}
+
+// NewDebugLoggerWithFile creates a new debug logger that writes to both stderr and a log file
+func NewDebugLoggerWithFile(configDir string) *log.Logger {
+	logger := FallbackLogger()
+	logsDir := filepath.Join(configDir, "logs")
+	if err := os.MkdirAll(logsDir, 0755); err != nil {
+		return logger
+	}
+
+	logFile := filepath.Join(logsDir, fmt.Sprintf("publication_%s.log", time.Now().Format("2006-01-02")))
+	file, err := os.OpenFile(logFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+	if err != nil {
+		return logger
+	}
+
+	w := LogWithStdErr(file)
+	logger.SetOutput(w)
+	return logger
+}

internal/shared/shared_test.go

···
 package shared
 
 import (
+	"bytes"
 	"errors"
+	"io"
 	"testing"
 )
 
-func TestErrors(t *testing.T) {
-	t.Run("ConfigError", func(t *testing.T) {
-		t.Run("creates joined error with message", func(t *testing.T) {
-			baseErr := errors.New("invalid format")
-			err := ConfigError("database connection failed", baseErr)
+func TestCompoundWriter(t *testing.T) {
+	t.Run("New", func(t *testing.T) {
+		t.Run("creates writer with primary and secondary", func(t *testing.T) {
+			var primary bytes.Buffer
+			var secondary bytes.Buffer
+
+			cw := New(&primary, &secondary)
 
-			AssertError(t, err, "ConfigError should create an error")
-			AssertContains(t, err.Error(), "configuration error", "error should contain config error marker")
-			AssertContains(t, err.Error(), "database connection failed", "error should contain custom message")
-			AssertContains(t, err.Error(), "invalid format", "error should contain base error")
+			if cw == nil {
+				t.Fatal("Expected CompoundWriter to be created")
+			}
+			if cw.primary == nil {
+				t.Error("Expected primary writer to be set")
+			}
+			if cw.secondary == nil {
+				t.Error("Expected secondary writer to be set")
+			}
 		})
+	})
+
+	t.Run("Write", func(t *testing.T) {
+		t.Run("writes to both primary and secondary", func(t *testing.T) {
+			var primary bytes.Buffer
+			var secondary bytes.Buffer
+
+			cw := New(&primary, &secondary)
+
+			testData := []byte("test message")
+			n, err := cw.Write(testData)
 
-		t.Run("preserves both error chains", func(t *testing.T) {
-			baseErr := errors.New("connection timeout")
-			err := ConfigError("failed to connect", baseErr)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+			if n != len(testData) {
+				t.Errorf("Expected to write %d bytes, got %d", len(testData), n)
+			}
 
-			AssertTrue(t, errors.Is(err, ErrConfig), "should identify as config error")
-			AssertTrue(t, errors.Is(err, baseErr), "should preserve original error in chain")
+			if primary.String() != "test message" {
+				t.Errorf("Expected primary to contain 'test message', got '%s'", primary.String())
+			}
+			if secondary.String() != "test message" {
+				t.Errorf("Expected secondary to contain 'test message', got '%s'", secondary.String())
+			}
 		})
 
-		t.Run("wraps multiple errors with Join", func(t *testing.T) {
-			baseErr := errors.New("parse error")
-			err := ConfigError("invalid config file", baseErr)
+		t.Run("writes multiple times to both sinks", func(t *testing.T) {
+			var primary bytes.Buffer
+			var secondary bytes.Buffer
+
+			cw := New(&primary, &secondary)
 
-			AssertTrue(t, errors.Is(err, ErrConfig), "joined error should contain ErrConfig")
-			AssertTrue(t, errors.Is(err, baseErr), "joined error should contain base error")
+			messages := []string{"first", "second", "third"}
+			for _, msg := range messages {
+				_, err := cw.Write([]byte(msg))
+				if err != nil {
+					t.Errorf("Expected no error writing '%s', got %v", msg, err)
+				}
+			}
+
+			expected := "firstsecondthird"
+			if primary.String() != expected {
+				t.Errorf("Expected primary to contain '%s', got '%s'", expected, primary.String())
+			}
+			if secondary.String() != expected {
+				t.Errorf("Expected secondary to contain '%s', got '%s'", expected, secondary.String())
+			}
 		})
-	})
+
+		t.Run("returns error from primary writer", func(t *testing.T) {
+			var secondary bytes.Buffer
+			expectedErr := errors.New("primary write failed")
+			primary := &errorWriter{err: expectedErr}
+
+			cw := New(primary, &secondary)
+
+			_, err := cw.Write([]byte("test"))
+
+			if err == nil {
+				t.Error("Expected error from primary writer")
+			}
+			if !errors.Is(err, expectedErr) {
+				t.Errorf("Expected error '%v', got '%v'", expectedErr, err)
+			}
+		})
+
+		t.Run("returns error from secondary writer", func(t *testing.T) {
+			var primary bytes.Buffer
+			expectedErr := errors.New("secondary write failed")
+			secondary := &errorWriter{err: expectedErr}
+
+			cw := New(&primary, secondary)
+
+			_, err := cw.Write([]byte("test"))
+
+			if err == nil {
+				t.Error("Expected error from secondary writer")
+			}
+			if !errors.Is(err, expectedErr) {
+				t.Errorf("Expected error '%v', got '%v'", expectedErr, err)
+			}
+		})
 
-	t.Run("IsConfigError", func(t *testing.T) {
-		t.Run("identifies config errors", func(t *testing.T) {
-			baseErr := errors.New("test error")
-			err := ConfigError("test message", baseErr)
+		t.Run("writes to primary even if secondary fails", func(t *testing.T) {
+			var primary bytes.Buffer
+			expectedErr := errors.New("secondary write failed")
+			secondary := &errorWriter{err: expectedErr}
+
+			cw := New(&primary, secondary)
+
+			testData := []byte("test message")
+			_, _ = cw.Write(testData)
 
-			AssertTrue(t, IsConfigError(err), "should identify config error")
+			if primary.String() != "test message" {
+				t.Errorf("Expected primary to contain 'test message' even with secondary error, got '%s'", primary.String())
+			}
 		})
 
-		t.Run("returns false for regular errors", func(t *testing.T) {
-			err := errors.New("regular error")
+		t.Run("handles empty write", func(t *testing.T) {
+			var primary bytes.Buffer
+			var secondary bytes.Buffer
+
+			cw := New(&primary, &secondary)
 
-			AssertFalse(t, IsConfigError(err), "should not identify regular error as config error")
+			n, err := cw.Write([]byte{})
+
+			if err != nil {
+				t.Errorf("Expected no error on empty write, got %v", err)
+			}
+			if n != 0 {
+				t.Errorf("Expected to write 0 bytes, got %d", n)
+			}
 		})
 
-		t.Run("returns false for nil error", func(t *testing.T) {
-			AssertFalse(t, IsConfigError(nil), "should return false for nil error")
+		t.Run("handles large write", func(t *testing.T) {
+			var primary bytes.Buffer
+			var secondary bytes.Buffer
+
+			cw := New(&primary, &secondary)
+
+			largeData := make([]byte, 1024*1024) // 1MB
+			for i := range largeData {
+				largeData[i] = byte(i % 256)
+			}
+
+			n, err := cw.Write(largeData)
+
+			if err != nil {
+				t.Errorf("Expected no error on large write, got %v", err)
+			}
+			if n != len(largeData) {
+				t.Errorf("Expected to write %d bytes, got %d", len(largeData), n)
+			}
+
+			if !bytes.Equal(primary.Bytes(), largeData) {
+				t.Error("Primary writer didn't receive correct data")
+			}
+			if !bytes.Equal(secondary.Bytes(), largeData) {
+				t.Error("Secondary writer didn't receive correct data")
+			}
 		})
+	})
+
+	t.Run("WithStdErr", func(t *testing.T) {
+		t.Run("creates writer with stderr as primary", func(t *testing.T) {
+			var buf bytes.Buffer
+			closer := &nopCloser{Writer: &buf}
+
+			cw := LogWithStdErr(closer)
+
+			if cw == nil {
+				t.Fatal("Expected CompoundWriter to be created")
+			}
 
-		t.Run("returns false for wrapped non-config errors", func(t *testing.T) {
-			baseErr := errors.New("base error")
-			wrappedErr := errors.New("wrapped: " + baseErr.Error())
+			testData := []byte("test")
+			_, err := cw.Write(testData)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
 
-			AssertFalse(t, IsConfigError(wrappedErr), "should not identify wrapped non-config error")
+			if buf.String() != "test" {
+				t.Errorf("Expected secondary to contain 'test', got '%s'", buf.String())
+			}
 		})
+	})
 
-		t.Run("identifies wrapped config errors", func(t *testing.T) {
-			baseErr := errors.New("original error")
-			configErr := ConfigError("config issue", baseErr)
-			wrappedAgain := errors.Join(errors.New("outer error"), configErr)
+	t.Run("WithStdOut", func(t *testing.T) {
+		t.Run("creates writer with stdout as primary", func(t *testing.T) {
+			var buf bytes.Buffer
+			closer := &nopCloser{Writer: &buf}
+
+			cw := LogWithStdOut(closer)
+
+			if cw == nil {
+				t.Fatal("Expected CompoundWriter to be created")
+			}
 
-			AssertTrue(t, IsConfigError(wrappedAgain), "should identify config error in join chain")
+			testData := []byte("test")
+			_, err := cw.Write(testData)
+			if err != nil {
+				t.Errorf("Expected no error, got %v", err)
+			}
+
+			if buf.String() != "test" {
+				t.Errorf("Expected secondary to contain 'test', got '%s'", buf.String())
+			}
 		})
 	})
 }
+
+func TestConfigError(t *testing.T) {
+	t.Run("wraps error with message", func(t *testing.T) {
+		originalErr := errors.New("original error")
+		configErr := ConfigError("test message", originalErr)
+
+		if configErr == nil {
+			t.Fatal("Expected error to be returned")
+		}
+
+		errMsg := configErr.Error()
+		if errMsg != "configuration error\ntest message: original error" {
+			t.Errorf("Expected specific error format, got '%s'", errMsg)
+		}
+	})
+
+	t.Run("is detectable with IsConfigError", func(t *testing.T) {
+		originalErr := errors.New("original error")
+		configErr := ConfigError("test message", originalErr)
+
+		if !IsConfigError(configErr) {
+			t.Error("Expected IsConfigError to return true")
+		}
+	})
+
+	t.Run("wraps original error", func(t *testing.T) {
+		originalErr := errors.New("original error")
+		configErr := ConfigError("test message", originalErr)
+
+		if !errors.Is(configErr, originalErr) {
+			t.Error("Expected config error to wrap original error")
+		}
+	})
+}
+
+func TestIsConfigError(t *testing.T) {
+	t.Run("returns true for config error", func(t *testing.T) {
+		configErr := ConfigError("test", errors.New("inner"))
+
+		if !IsConfigError(configErr) {
+			t.Error("Expected IsConfigError to return true for config error")
+		}
+	})
+
+	t.Run("returns false for non-config error", func(t *testing.T) {
+		regularErr := errors.New("regular error")
+
+		if IsConfigError(regularErr) {
+			t.Error("Expected IsConfigError to return false for regular error")
+		}
+	})
+
+	t.Run("returns false for nil error", func(t *testing.T) {
+		if IsConfigError(nil) {
+			t.Error("Expected IsConfigError to return false for nil error")
+		}
+	})
+}
+
+type errorWriter struct {
+	err error
+}
+
+func (w *errorWriter) Write(p []byte) (int, error) {
+	return 0, w.err
+}
+
+type nopCloser struct {
+	io.Writer
+}
+
+func (nc *nopCloser) Close() error {
+	return nil
+}

internal/ui/auth_form.go

···
 	"github.com/charmbracelet/bubbles/key"
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/lipgloss"
 )
 
 // AuthFormOptions configures the auth form display
···
 func (m authFormModel) View() string {
 	var b strings.Builder
 
-	titleStyle := lipgloss.NewStyle().
-		Bold(true).
-		Foreground(lipgloss.Color("6")).
-		MarginBottom(1)
-
-	labelStyle := lipgloss.NewStyle().
-		Foreground(lipgloss.Color("7"))
-
-	helpStyle := lipgloss.NewStyle().
-		Foreground(lipgloss.Color("8")).
-		MarginTop(1)
-
-	errorStyle := lipgloss.NewStyle().
-		Foreground(lipgloss.Color("9"))
-
-	b.WriteString(titleStyle.Render("AT Protocol Authentication"))
+	b.WriteString(TitleStyle.Render("AT Protocol Authentication"))
 	b.WriteString("\n\n")
 
-	b.WriteString(labelStyle.Render("BlueSky Handle:"))
+	b.WriteString(TextStyle.Render("BlueSky Handle:"))
 	b.WriteString("\n")
 	if m.handleLocked {
-		lockedStyle := lipgloss.NewStyle().
-			Foreground(lipgloss.Color("8"))
-		b.WriteString(lockedStyle.Render(m.handleInput.Value()))
-		b.WriteString(lockedStyle.Render(" (locked)"))
+		b.WriteString(MutedStyle.Render(m.handleInput.Value()))
+		b.WriteString(MutedStyle.Render(" (locked)"))
 	} else {
 		b.WriteString(m.handleInput.View())
 	}
 	b.WriteString("\n\n")
 
-	b.WriteString(labelStyle.Render("App Password:"))
+	b.WriteString(TextStyle.Render("App Password:"))
 	b.WriteString("\n")
 	b.WriteString(m.passwordInput.View())
 	b.WriteString("\n\n")
 
 	if m.handleInput.Value() == "" {
-		b.WriteString(errorStyle.Render("Handle is required"))
+		b.WriteString(ErrorStyle.Render("Handle is required"))
 		b.WriteString("\n")
 	}
 	if m.passwordInput.Value() == "" {
-		b.WriteString(errorStyle.Render("Password is required"))
+		b.WriteString(ErrorStyle.Render("Password is required"))
 		b.WriteString("\n")
 	}
 
 	b.WriteString("\n")
 	helpText := "tab/shift+tab: navigate • enter/ctrl+s: submit • esc/ctrl+c: cancel"
-	b.WriteString(helpStyle.Render(helpText))
+	b.WriteString(MutedStyle.MarginTop(1).Render(helpText))
 
 	return b.String()
 }