@agentteams/cli 0.1.94 → 0.1.96

package/README.md

@@ -28,7 +28,67 @@ The `init` command:
 - Saves the convention template to `.agentteams/convention.md`
 - Syncs convention files into `.agentteams/<category>/*.md`
 
-In SSH/remote environments, open the URL printed in the terminal manually.
+### Choosing a login method
+
+The browser callback is always the default. Nothing is auto-detected — you pick a
+method by what you type.
+
+| Situation                                                    | What to run                                                             | How it authenticates                                                          |
+| ------------------------------------------------------------ | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
+| Local machine with a browser (default)                       | `agentteams init` / `agentteams auth login`                             | The browser calls back to a temporary port on **this** machine                |
+| Remote or headless shell (SSH, container, WSL, no `DISPLAY`) | `agentteams init --device-auth` / `agentteams auth login --device-auth` | A short code you approve in a browser on **any other** device — no local port |
+| CI and unattended automation                                 | `AGENTTEAMS_API_KEY`, or a project service token                        | No human approval step at all                                                 |
+
+> The default path opens a local port and waits for the browser to call back. Over
+> SSH the browser runs on your laptop, so the callback reaches your laptop's
+> `localhost` and never the remote shell — that is the case `--device-auth` exists
+> for. Device authorization is **not** a CI mechanism: it always requires a person
+> to approve the request.
+
+#### `--device-auth`
+
+```bash
+# Log in only
+agentteams auth login --device-auth
+
+# Initialize a project (team/project/agent are chosen on the approval screen)
+agentteams init --device-auth
+```
+
+The terminal prints a verification URL and an 8-character code. Open the URL on any
+device, sign in, check that the code on screen matches the one in your terminal, and
+approve. The CLI stores the login and continues.
+
+To avoid typing the flag on every command on a remote machine, declare it once for
+that machine:
+
+```bash
+# Persist it in ~/.agentteams/config.json (never in a project config)
+agentteams auth login --device-auth --set-default
+
+# Or per shell / per service unit
+export AGENTTEAMS_DEVICE_AUTH=1
+```
+
+`agentteams auth status` reports whether this machine defaults to device
+authorization. To turn it back off, remove `"deviceAuth"` from
+`~/.agentteams/config.json` and unset `AGENTTEAMS_DEVICE_AUTH`.
+
+Before starting, the CLI checks that this machine has a usable OS credential store
+(macOS Keychain, Windows Credential Manager, or libsecret on Linux). On a minimal
+Linux server install `libsecret` and unlock a keyring, e.g.
+`sudo apt install libsecret-tools` — otherwise use `AGENTTEAMS_API_KEY` instead.
+
+#### Troubleshooting
+
+| Message                                                             | Cause                                                                  | What to do                                                        |
+| ------------------------------------------------------------------- | ---------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| `OAuth callback timed out after 60 seconds.`                        | The default flow was used from a shell the browser cannot call back to | Re-run with `--device-auth`                                       |
+| `does not support device authorization`                             | The server is an older AgentTeams API                                  | Re-run **without** `--device-auth`, or upgrade the server         |
+| `device authorization turned off because the server has no APP_URL` | Server configuration                                                   | Ask the operator to set `APP_URL`; use the default flow meanwhile |
+| `The device code expired before it was approved`                    | The code is valid for 15 minutes                                       | Run the command again for a new code                              |
+| `The sign-in request was denied in the browser`                     | Deny was clicked                                                       | Run the command again if that was a mistake                       |
+| `Cannot start device authorization: ... credential store`           | No usable OS credential store                                          | Install/unlock libsecret, or use `AGENTTEAMS_API_KEY`             |
 
 ### Service URLs (Defaults and Overrides)
 

package/dist/api/linear.d.ts

@@ -1,6 +1,6 @@
 export declare function getLinearIssue(apiUrl: string, headers: any, issueId: string, projectId?: string): Promise<any>;
-export declare function createLinearIssue(apiUrl: string, headers: any, title: string, description?: string, state?: string, teamId?: string, parentId?: string): Promise<any>;
-export declare function updateLinearIssue(apiUrl: string, headers: any, issueId: string, state: string): Promise<any>;
-export declare function listLinearComments(apiUrl: string, headers: any, issueId: string): Promise<any>;
-export declare function createLinearComment(apiUrl: string, headers: any, issueId: string, body: string): Promise<any>;
+export declare function createLinearIssue(apiUrl: string, headers: any, title: string, description?: string, state?: string, teamId?: string, parentId?: string, projectId?: string): Promise<any>;
+export declare function updateLinearIssue(apiUrl: string, headers: any, issueId: string, state: string, projectId?: string): Promise<any>;
+export declare function listLinearComments(apiUrl: string, headers: any, issueId: string, projectId?: string): Promise<any>;
+export declare function createLinearComment(apiUrl: string, headers: any, issueId: string, body: string, projectId?: string): Promise<any>;
 //# sourceMappingURL=linear.d.ts.map

package/dist/api/linear.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"linear.d.ts","sourceRoot":"","sources":["../../src/api/linear.ts"],"names":[],"mappings":"AAEA,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAYpH;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,GAAG,CAAC,CASd;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIlH;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIpG;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAInH"}
+{"version":3,"file":"linear.d.ts","sourceRoot":"","sources":["../../src/api/linear.ts"],"names":[],"mappings":"AAmBA,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAIpH;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CASd;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAId;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,GAAG,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAId"}

package/dist/api/linear.js

@@ -1,18 +1,23 @@
 import httpClient from '../utils/httpClient.js';
+// The routes pick the project from `request.user.projectId` first and the
+// `projectId` query second. Only an agent API key carries the former, so a
+// personal-token or JWT session that omits the query has no project to look
+// the Linear token up against and comes back 401 — which reads as "expired
+// credential" rather than "missing scope". Send it whenever the caller knows it.
+// The query stays harmless for agent API keys because the route prefers the
+// credential's own project.
+const withProjectId = (headers, projectId) => projectId ? { headers, params: { projectId } } : { headers };
+// A LINEAR_ISSUE reference locator is not an AgentTeams id, so it is not
+// UUID-validated upstream — encode it so it stays a single path segment.
+// Every issue-scoped helper builds its URL here so the encoding cannot drift
+// back into being asymmetric as helpers are added.
+const issueUrl = (apiUrl, issueId, suffix = '') => `${apiUrl}/api/linear/issues/${encodeURIComponent(issueId)}${suffix}`;
 export async function getLinearIssue(apiUrl, headers, issueId, projectId) {
-    // A LINEAR_ISSUE reference locator is not an AgentTeams id, so it is not
-    // UUID-validated upstream — encode it so it stays a single path segment.
-    const baseUrl = `${apiUrl}/api/linear/issues/${encodeURIComponent(issueId)}`;
-    // The route picks the project from `request.user.projectId` first and the
-    // `projectId` query second. Only an agent API key carries the former, so a
-    // personal-token or JWT session that omits the query has no project to look
-    // the Linear token up against and comes back 401 — which reads as "expired
-    // credential" rather than "missing scope". Send it whenever the caller knows it.
-    const requestConfig = projectId ? { headers, params: { projectId } } : { headers };
-    const response = await httpClient.get(baseUrl, requestConfig);
+    const baseUrl = issueUrl(apiUrl, issueId);
+    const response = await httpClient.get(baseUrl, withProjectId(headers, projectId));
     return response.data;
 }
-export async function createLinearIssue(apiUrl, headers, title, description, state, teamId, parentId) {
+export async function createLinearIssue(apiUrl, headers, title, description, state, teamId, parentId, projectId) {
     const baseUrl = `${apiUrl}/api/linear/issues`;
     const body = { title };
     if (teamId)
@@ -23,22 +28,22 @@ export async function createLinearIssue(apiUrl, headers, title, description, sta
         body.state = state;
     if (parentId)
         body.parentId = parentId;
-    const response = await httpClient.post(baseUrl, body, { headers });
+    const response = await httpClient.post(baseUrl, body, withProjectId(headers, projectId));
     return response.data;
 }
-export async function updateLinearIssue(apiUrl, headers, issueId, state) {
-    const baseUrl = `${apiUrl}/api/linear/issues/${issueId}`;
-    const response = await httpClient.patch(baseUrl, { state }, { headers });
+export async function updateLinearIssue(apiUrl, headers, issueId, state, projectId) {
+    const baseUrl = issueUrl(apiUrl, issueId);
+    const response = await httpClient.patch(baseUrl, { state }, withProjectId(headers, projectId));
     return response.data;
 }
-export async function listLinearComments(apiUrl, headers, issueId) {
-    const baseUrl = `${apiUrl}/api/linear/issues/${issueId}/comments`;
-    const response = await httpClient.get(baseUrl, { headers });
+export async function listLinearComments(apiUrl, headers, issueId, projectId) {
+    const baseUrl = issueUrl(apiUrl, issueId, '/comments');
+    const response = await httpClient.get(baseUrl, withProjectId(headers, projectId));
     return response.data;
 }
-export async function createLinearComment(apiUrl, headers, issueId, body) {
-    const baseUrl = `${apiUrl}/api/linear/issues/${issueId}/comments`;
-    const response = await httpClient.post(baseUrl, { body }, { headers });
+export async function createLinearComment(apiUrl, headers, issueId, body, projectId) {
+    const baseUrl = issueUrl(apiUrl, issueId, '/comments');
+    const response = await httpClient.post(baseUrl, { body }, withProjectId(headers, projectId));
     return response.data;
 }
 //# sourceMappingURL=linear.js.map

package/dist/api/linear.js.map

@@ -1 +1 @@
-{"version":3,"file":"linear.js","sourceRoot":"","sources":["../../src/api/linear.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAAY,EAAE,OAAe,EAAE,SAAkB;IACpG,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9D,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAY,EACZ,KAAa,EACb,WAAoB,EACpB,KAAc,EACd,MAAe,EACf,QAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,MAAM,oBAAoB,CAAC;IAC9C,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAC;IAC/C,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACjC,IAAI,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChD,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,IAAI,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAY,EAAE,OAAe,EAAE,KAAa;IAClG,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAY,EAAE,OAAe;IACpF,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,WAAW,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,OAAY,EAAE,OAAe,EAAE,IAAY;IACnG,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,WAAW,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}
+{"version":3,"file":"linear.js","sourceRoot":"","sources":["../../src/api/linear.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAEhD,0EAA0E;AAC1E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,4EAA4E;AAC5E,4BAA4B;AAC5B,MAAM,aAAa,GAAG,CAAC,OAAY,EAAE,SAAkB,EAAE,EAAE,CACzD,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAE/D,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,mDAAmD;AACnD,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAChE,GAAG,MAAM,sBAAsB,kBAAkB,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAAY,EAAE,OAAe,EAAE,SAAkB;IACpG,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAY,EACZ,KAAa,EACb,WAAoB,EACpB,KAAc,EACd,MAAe,EACf,QAAiB,EACjB,SAAkB;IAElB,MAAM,OAAO,GAAG,GAAG,MAAM,oBAAoB,CAAC;IAC9C,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,CAAC;IAC/C,IAAI,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACjC,IAAI,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAChD,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,IAAI,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAY,EACZ,OAAe,EACf,KAAa,EACb,SAAkB;IAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/F,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,OAAY,EACZ,OAAe,EACf,SAAkB;IAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAY,EACZ,OAAe,EACf,IAAY,EACZ,SAAkB;IAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/auth/deviceAuthClient.d.ts

@@ -0,0 +1,63 @@
+/**
+ * RFC 8628 device authorization for the CLI.
+ *
+ * The point of this flow is that **no local port is opened**. The terminal shows a
+ * short code, the user approves it in a browser on any other machine, and this
+ * module polls the server until that happens. It is only ever entered through the
+ * explicit `--device-auth` flag (or the machine-wide default the user declared);
+ * nothing here inspects SSH/container/WSL state to choose a flow.
+ */
+import { type DeviceSetupResult, type PersonalTokenIdentity } from './personalTokenClient.js';
+export type DeviceAuthFlow = 'login' | 'setup';
+export interface DeviceAuthorizationStart {
+    deviceCode: string;
+    /** Display form (`XXXX-XXXX`). Shown to the user; never used as a credential. */
+    userCode: string;
+    /** Server-owned. Never rebuilt from the CLI's own web URL — dev/prod must not cross. */
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+}
+export interface DeviceAuthStartInput {
+    apiUrl: string;
+    flow: DeviceAuthFlow;
+    projectName?: string;
+    osType?: string;
+    machineId?: string;
+    /** Encrypted working directory; `init` sends it so path-based runner binding matches loopback. */
+    authPathEnc?: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Ask the server to open a device session.
+ *
+ * The two failure shapes are kept distinct on purpose. A 404 means the server is
+ * too old to know this endpoint — the fix is to re-run *without* the flag. A 503
+ * means the server knows it but is not configured for it — re-running without the
+ * flag also works, but the operator has something to fix. Collapsing them into one
+ * message sends half the users after the wrong problem.
+ */
+export declare function startDeviceAuthorization(input: DeviceAuthStartInput): Promise<DeviceAuthorizationStart>;
+export interface DeviceAuthPollInput {
+    apiUrl: string;
+    start: DeviceAuthorizationStart;
+    /** Ctrl+C. Aborting stops the loop immediately rather than after the current sleep. */
+    signal?: AbortSignal;
+    /** Injected in tests so fake timers drive the interval instead of real waiting. */
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+}
+export interface DeviceAuthResult {
+    identity: PersonalTokenIdentity;
+    setup: DeviceSetupResult | null;
+}
+/**
+ * Poll until the session is approved, denied, or expires.
+ *
+ * Interval discipline is the whole job: the server's `interval` is honoured as
+ * given, `slow_down` raises it, and the loop also stops locally at `expiresIn` so
+ * a server that never answers cannot turn into an unbounded poll.
+ */
+export declare function pollDeviceAuthorization(input: DeviceAuthPollInput): Promise<DeviceAuthResult>;
+//# sourceMappingURL=deviceAuthClient.d.ts.map

package/dist/auth/deviceAuthClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceAuthClient.d.ts","sourceRoot":"","sources":["../../src/auth/deviceAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAalC,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC;AAE/C,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsE7G;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,wBAAwB,CAAC;IAChC,uFAAuF;IACvF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mFAAmF;IACnF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACjC;AAID;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgEnG"}

package/dist/auth/deviceAuthClient.js

@@ -0,0 +1,131 @@
+/**
+ * RFC 8628 device authorization for the CLI.
+ *
+ * The point of this flow is that **no local port is opened**. The terminal shows a
+ * short code, the user approves it in a browser on any other machine, and this
+ * module polls the server until that happens. It is only ever entered through the
+ * explicit `--device-auth` flag (or the machine-wide default the user declared);
+ * nothing here inspects SSH/container/WSL state to choose a flow.
+ */
+import { CLI_OAUTH_CLIENT_ID, getPersonalTokenClient, PersonalTokenError, } from './personalTokenClient.js';
+/** Fallback poll interval when the server does not send one. The server value always wins. */
+const FALLBACK_INTERVAL_SECONDS = 5;
+/** RFC 8628 `slow_down` step, used only when the server does not name the new interval. */
+const SLOW_DOWN_STEP_SECONDS = 5;
+/** Consecutive network failures tolerated before giving up. */
+const MAX_TRANSIENT_FAILURES = 5;
+const START_REQUEST_TIMEOUT_MS = 15_000;
+/**
+ * Ask the server to open a device session.
+ *
+ * The two failure shapes are kept distinct on purpose. A 404 means the server is
+ * too old to know this endpoint — the fix is to re-run *without* the flag. A 503
+ * means the server knows it but is not configured for it — re-running without the
+ * flag also works, but the operator has something to fix. Collapsing them into one
+ * message sends half the users after the wrong problem.
+ */
+export async function startDeviceAuthorization(input) {
+    const doFetch = input.fetchImpl ?? globalThis.fetch;
+    const baseUrl = input.apiUrl.replace(/\/+$/, '');
+    let response;
+    try {
+        response = await doFetch(`${baseUrl}/api/auth/desktop/device/start`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                clientId: CLI_OAUTH_CLIENT_ID,
+                flow: input.flow,
+                ...(input.projectName ? { projectName: input.projectName } : {}),
+                ...(input.osType ? { osType: input.osType } : {}),
+                ...(input.machineId ? { machineId: input.machineId } : {}),
+                ...(input.authPathEnc ? { authPathEnc: input.authPathEnc } : {}),
+            }),
+            signal: AbortSignal.timeout(START_REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new PersonalTokenError('TRANSIENT', `Could not reach ${baseUrl} to start device authorization: ${error instanceof Error ? error.message : String(error)}.`);
+    }
+    if (response.status === 404) {
+        throw new PersonalTokenError('TRANSIENT', `${baseUrl} does not support device authorization (it is running an older AgentTeams API). ` +
+            'Run the same command without --device-auth to use the browser callback login.');
+    }
+    if (response.status === 503) {
+        throw new PersonalTokenError('TRANSIENT', `${baseUrl} has device authorization turned off because the server has no APP_URL configured. ` +
+            'Ask the server operator to set APP_URL, or run the same command without --device-auth for now.');
+    }
+    if (!response.ok) {
+        throw new PersonalTokenError('TRANSIENT', `Device authorization could not be started (HTTP ${response.status}).`);
+    }
+    const body = (await response.json().catch(() => null));
+    const data = body?.data;
+    if (!data ||
+        typeof data.deviceCode !== 'string' ||
+        typeof data.userCode !== 'string' ||
+        typeof data.verificationUri !== 'string') {
+        throw new PersonalTokenError('MALFORMED_RESPONSE', 'The server returned an unexpected device authorization payload.');
+    }
+    return {
+        deviceCode: data.deviceCode,
+        userCode: data.userCode,
+        verificationUri: data.verificationUri,
+        verificationUriComplete: typeof data.verificationUriComplete === 'string' ? data.verificationUriComplete : data.verificationUri,
+        expiresIn: typeof data.expiresIn === 'number' ? data.expiresIn : 900,
+        interval: typeof data.interval === 'number' && data.interval > 0 ? data.interval : FALLBACK_INTERVAL_SECONDS,
+    };
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Poll until the session is approved, denied, or expires.
+ *
+ * Interval discipline is the whole job: the server's `interval` is honoured as
+ * given, `slow_down` raises it, and the loop also stops locally at `expiresIn` so
+ * a server that never answers cannot turn into an unbounded poll.
+ */
+export async function pollDeviceAuthorization(input) {
+    const client = getPersonalTokenClient(input.apiUrl);
+    const sleep = input.sleep ?? defaultSleep;
+    const now = input.now ?? Date.now;
+    const deadline = now() + input.start.expiresIn * 1000;
+    let intervalSeconds = input.start.interval;
+    let transientFailures = 0;
+    while (true) {
+        if (input.signal?.aborted) {
+            throw new PersonalTokenError('TRANSIENT', 'Device authorization was cancelled.');
+        }
+        await sleep(intervalSeconds * 1000);
+        if (input.signal?.aborted) {
+            throw new PersonalTokenError('TRANSIENT', 'Device authorization was cancelled.');
+        }
+        if (now() >= deadline) {
+            throw new PersonalTokenError('INVALID_GRANT', 'The device code expired before it was approved. Run the command again to get a new code.');
+        }
+        const outcome = await client.pollDeviceToken(input.start.deviceCode);
+        switch (outcome.kind) {
+            case 'approved':
+                return { identity: outcome.session.identity, setup: outcome.setup };
+            case 'pending':
+                transientFailures = 0;
+                break;
+            case 'slowDown':
+                transientFailures = 0;
+                intervalSeconds = outcome.intervalSeconds ?? intervalSeconds + SLOW_DOWN_STEP_SECONDS;
+                break;
+            case 'denied':
+                throw new PersonalTokenError('INVALID_GRANT', 'The sign-in request was denied in the browser.');
+            case 'expired':
+                throw new PersonalTokenError('INVALID_GRANT', 'The device code expired before it was approved. Run the command again to get a new code.');
+            case 'invalid':
+                throw new PersonalTokenError('INVALID_GRANT', 'The device code is no longer valid. Run the command again to get a new code.');
+            case 'transient':
+                // Back off but keep going: the user may still be finishing the approval.
+                transientFailures += 1;
+                if (transientFailures >= MAX_TRANSIENT_FAILURES) {
+                    throw new PersonalTokenError('TRANSIENT', `Lost contact with ${input.apiUrl} while waiting for approval: ${outcome.detail}.`);
+                }
+                intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+                break;
+        }
+    }
+}
+//# sourceMappingURL=deviceAuthClient.js.map

package/dist/auth/deviceAuthClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deviceAuthClient.js","sourceRoot":"","sources":["../../src/auth/deviceAuthClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,GAInB,MAAM,0BAA0B,CAAC;AAElC,8FAA8F;AAC9F,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,2FAA2F;AAC3F,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAEjC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AA0BxC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA2B;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,gCAAgC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,mBAAmB;gBAC7B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,mBAAmB,OAAO,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CACvH,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,GAAG,OAAO,kFAAkF;YAC1F,+EAA+E,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,GAAG,OAAO,qFAAqF;YAC7F,gGAAgG,CACnG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,mDAAmD,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACpH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8C,CAAC;IACpG,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IAExB,IACE,CAAC,IAAI;QACL,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;QACnC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,EACxC,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,uBAAuB,EACrB,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe;QACxG,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;QACpE,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB;KAC7G,CAAC;AACJ,CAAC;AAiBD,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEtG;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAA0B;IACtE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAElC,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACtD,IAAI,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC3C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAEpC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAsB,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAExF,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU;gBACb,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YACtE,KAAK,SAAS;gBACZ,iBAAiB,GAAG,CAAC,CAAC;gBACtB,MAAM;YACR,KAAK,UAAU;gBACb,iBAAiB,GAAG,CAAC,CAAC;gBACtB,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,GAAG,sBAAsB,CAAC;gBACtF,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAI,kBAAkB,CAAC,eAAe,EAAE,gDAAgD,CAAC,CAAC;YAClG,KAAK,SAAS;gBACZ,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,0FAA0F,CAC3F,CAAC;YACJ,KAAK,SAAS;gBACZ,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,8EAA8E,CAC/E,CAAC;YACJ,KAAK,WAAW;gBACd,yEAAyE;gBACzE,iBAAiB,IAAI,CAAC,CAAC;gBACvB,IAAI,iBAAiB,IAAI,sBAAsB,EAAE,CAAC;oBAChD,MAAM,IAAI,kBAAkB,CAC1B,WAAW,EACX,qBAAqB,KAAK,CAAC,MAAM,gCAAgC,OAAO,CAAC,MAAM,GAAG,CACnF,CAAC;gBACJ,CAAC;gBACD,eAAe,IAAI,sBAAsB,CAAC;gBAC1C,MAAM;QACV,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/personalTokenClient.d.ts

@@ -115,6 +115,40 @@ type ParsedTokenResponse = {
  * a truncated body). Only the first justifies destroying local credentials.
  */
 export declare function parseTokenResponse(response: Response): Promise<ParsedTokenResponse>;
+/** `flow: 'setup'` result the approval screen chose; `init` writes these into the project config. */
+export interface DeviceSetupResult {
+    teamId: string;
+    projectId: string;
+    agentConfigId: string;
+    agentName: string;
+    seedPlanId: string | null;
+}
+/**
+ * One poll's outcome, in the server's own vocabulary (RFC 8628 error codes).
+ *
+ * `transient` is deliberately separate from `denied`/`expired`: only the latter
+ * two are decisions, and treating a dropped connection as a decision would end a
+ * login the user is still completing.
+ */
+export type DevicePollOutcome = {
+    kind: 'approved';
+    session: PersonalTokenSession;
+    setup: DeviceSetupResult | null;
+} | {
+    kind: 'pending';
+} | {
+    kind: 'slowDown';
+    intervalSeconds: number | null;
+} | {
+    kind: 'denied';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'invalid';
+} | {
+    kind: 'transient';
+    detail: string;
+};
 export declare class PersonalTokenClient {
     private readonly deps;
     private accessToken;
@@ -126,6 +160,16 @@ export declare class PersonalTokenClient {
     constructor(deps: PersonalTokenClientDeps);
     state(): PersonalTokenState;
     hasCredential(): boolean;
+    /**
+     * One poll of the RFC 8628 device token endpoint.
+     *
+     * Lives here rather than in the polling loop because the *storage* invariants
+     * are the same as a PKCE exchange: a credential the next process cannot find
+     * is not a login, so an unstorable token pair is revoked instead of orphaned.
+     * The loop only decides *when* to call this; the outcome vocabulary below is
+     * the server's error contract verbatim.
+     */
+    pollDeviceToken(deviceCode: string): Promise<DevicePollOutcome>;
     /**
      * Trade a PKCE authorization code for the first token pair.
      *

package/dist/auth/personalTokenClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAc3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}
+{"version":3,"file":"personalTokenClient.d.ts","sourceRoot":"","sources":["../../src/auth/personalTokenClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAyB,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9G,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC/G,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAE/E,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,WAAW,GACX,eAAe,GACf,oBAAoB,GACpB,eAAe;AACjB,qFAAqF;GACnF,mBAAmB,CAAC;AAExB,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB;gBAA5B,IAAI,EAAE,sBAAsB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,2BAA2B,GAAG,SAAS,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;AAE7F,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;IACnB,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,YAAY,EAAE,mBAAmB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kFAAkF;IAClF,cAAc,EAAE,2BAA2B,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,qBAAqB,CAAC;CACjC;AAED,KAAK,mBAAmB,GACpB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+CzF;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwB1C,qBAAa,mBAAmB;IAQlB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,eAAe,CAAuC;gBAEjC,IAAI,EAAE,uBAAuB;IAE1D,KAAK,IAAI,kBAAkB;IAc3B,aAAa,IAAI,OAAO;IAIxB;;;;;;;;OAQG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoGrE;;;;;;;;;OASG;IACG,yBAAyB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyC7F;;;;;;OAMG;YACW,uBAAuB;IAwBrC;;;;OAIG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAc9C,6FAA6F;IAC7F,qBAAqB,IAAI,IAAI;IAK7B;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAuC7B;;;;;OAKG;IACH,qBAAqB,IAAI,IAAI;YAIf,OAAO;IA0BrB,kEAAkE;YACpD,MAAM;YAmCN,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,KAAK;IASb,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;CAGhB;AAWD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAc1E;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,IAAI,IAAI,CAExD"}

package/dist/auth/personalTokenClient.js

@@ -88,6 +88,24 @@ export async function parseTokenResponse(response) {
         },
     };
 }
+const parseDeviceSetupResult = (value) => {
+    if (!value || typeof value !== 'object')
+        return null;
+    const setup = value;
+    if (typeof setup.teamId !== 'string' ||
+        typeof setup.projectId !== 'string' ||
+        typeof setup.agentConfigId !== 'string' ||
+        typeof setup.agentName !== 'string') {
+        return null;
+    }
+    return {
+        teamId: setup.teamId,
+        projectId: setup.projectId,
+        agentConfigId: setup.agentConfigId,
+        agentName: setup.agentName,
+        seedPlanId: typeof setup.seedPlanId === 'string' ? setup.seedPlanId : null,
+    };
+};
 export class PersonalTokenClient {
     deps;
     accessToken = null;
@@ -115,6 +133,104 @@ export class PersonalTokenClient {
     hasCredential() {
         return this.deps.store.read() !== null;
     }
+    /**
+     * One poll of the RFC 8628 device token endpoint.
+     *
+     * Lives here rather than in the polling loop because the *storage* invariants
+     * are the same as a PKCE exchange: a credential the next process cannot find
+     * is not a login, so an unstorable token pair is revoked instead of orphaned.
+     * The loop only decides *when* to call this; the outcome vocabulary below is
+     * the server's error contract verbatim.
+     */
+    async pollDeviceToken(deviceCode) {
+        const doFetch = this.deps.fetch ?? globalThis.fetch;
+        let response;
+        try {
+            response = await doFetch(`${this.baseUrl()}/api/auth/desktop/device/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ clientId: CLI_OAUTH_CLIENT_ID, deviceCode }),
+                signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            // A flaky network is not a denial. Reporting it as one would abort a login
+            // the user is still in the middle of completing in their browser.
+            return { kind: 'transient', detail: error instanceof Error ? error.message : String(error) };
+        }
+        if (!response.ok) {
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch {
+                return { kind: 'transient', detail: `HTTP ${response.status} with an unreadable body` };
+            }
+            const payload = (body ?? {});
+            switch (payload.error) {
+                case 'authorization_pending':
+                    return { kind: 'pending' };
+                case 'slow_down':
+                    return {
+                        kind: 'slowDown',
+                        intervalSeconds: typeof payload.interval === 'number' ? payload.interval : null,
+                    };
+                case 'access_denied':
+                    return { kind: 'denied' };
+                case 'expired_token':
+                    return { kind: 'expired' };
+                case 'invalid_grant':
+                case 'invalid_client':
+                    return { kind: 'invalid' };
+                default:
+                    return { kind: 'transient', detail: `HTTP ${response.status}` };
+            }
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            return { kind: 'transient', detail: 'the server returned an unreadable token payload' };
+        }
+        const data = body && typeof body === 'object' && 'data' in body
+            ? body.data
+            : undefined;
+        const identity = data?.identity && typeof data.identity === 'object' ? data.identity : undefined;
+        if (typeof data?.accessToken !== 'string' ||
+            typeof data.refreshToken !== 'string' ||
+            typeof data.expiresIn !== 'number' ||
+            !identity ||
+            typeof identity.memberId !== 'string' ||
+            typeof identity.email !== 'string' ||
+            typeof identity.nickname !== 'string') {
+            return { kind: 'transient', detail: 'the server returned an unexpected token payload' };
+        }
+        const tokens = {
+            accessToken: data.accessToken,
+            refreshToken: data.refreshToken,
+            expiresIn: data.expiresIn,
+            identity: {
+                memberId: identity.memberId,
+                email: identity.email,
+                nickname: identity.nickname,
+            },
+        };
+        const stored = this.acceptTokens(tokens);
+        this.reconnectRequired = false;
+        if (!stored.persisted) {
+            await this.discardUnstorableTokens(stored);
+        }
+        return {
+            kind: 'approved',
+            session: {
+                accessToken: tokens.accessToken,
+                expiresAt: this.accessExpiresAt,
+                identity: tokens.identity,
+            },
+            setup: parseDeviceSetupResult(data.setup),
+        };
+    }
     /**
      * Trade a PKCE authorization code for the first token pair.
      *