@armoriq/sdk-dev 0.6.10 → 0.8.0

package/dist/cli/commands/auth.js

@@ -44,12 +44,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadOrCreateDeviceId = loadOrCreateDeviceId;
 exports.cmdLogin = cmdLogin;
 exports.cmdLogout = cmdLogout;
 exports.cmdWhoami = cmdWhoami;
 const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
 const http = __importStar(require("http"));
 const net = __importStar(require("net"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const url_1 = require("url");
 const child_process_1 = require("child_process");
 const axios_1 = __importDefault(require("axios"));
@@ -64,15 +68,214 @@ const PRODUCT_LABELS = {
     platform: 'ArmorIQ Platform',
     sdk: 'ArmorIQ SDK',
 };
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function getDeviceIdentityPath() {
+    return (process.env.ARMORIQ_DEVICE_ID_PATH ?? path.join(path.dirname((0, credentials_1.getCredentialsPath)()), 'device-id'));
+}
+/**
+ * A device identity was written but could not be durably persisted.
+ *
+ * Distinct from a collision or a corrupt file: callers may read a concurrent
+ * winner, while corrupt files require manual recovery. This invocation must
+ * report no identity rather than vouch for bytes whose write or fsync failed.
+ */
+class DurabilityError extends Error {
+}
+/** One reusable cell for Atomics.wait; the value is never read. */
+const IDLE_CELL = new Int32Array(new SharedArrayBuffer(4));
+const WAIT_ATTEMPTS = 20;
+const WAIT_INTERVAL_MS = 10;
+function readDeviceId(identityPath, identityFs) {
+    try {
+        const existing = identityFs.readFileSync(identityPath, 'utf8').trim();
+        return UUID_RE.test(existing) ? existing.toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isAlreadyExists(error) {
+    return error?.code === 'EEXIST';
+}
+function deviceIdentityPathExists(identityPath, identityFs) {
+    try {
+        identityFs.statSync(identityPath);
+        return true;
+    }
+    catch (error) {
+        // Treat an inaccessible path as occupied. Attempting publication cannot
+        // repair permissions and must never replace something we could not read.
+        return error?.code !== 'ENOENT';
+    }
+}
+/**
+ * Wait briefly for a valid identity to appear. Reached whenever the path holds
+ * something unparseable, which is either a creator caught between publishing
+ * the path and writing its UUID (a create race, or an in-progress write another
+ * process started before this one looked) or a file that really is corrupt.
+ */
+function awaitIdentity(identityPath, identityFs) {
+    for (let attempt = 0; attempt < WAIT_ATTEMPTS; attempt += 1) {
+        const value = readDeviceId(identityPath, identityFs);
+        if (value)
+            return value;
+        Atomics.wait(IDLE_CELL, 0, 0, WAIT_INTERVAL_MS);
+    }
+    return null;
+}
+/**
+ * Install `tempPath` at `identityPath` only if nothing is there, and report the
+ * winner.
+ *
+ * link() is create-if-absent and publishes the path already fully written, so
+ * exactly one caller can ever install and no reader can observe a half-written
+ * file. With `flag: 'wx'` the file exists and is empty for an instant, and a
+ * concurrent login reading it in that window sees a corrupt identity.
+ */
+function publishIdentity(identityPath, tempPath, candidate, identityFs) {
+    try {
+        identityFs.linkSync(tempPath, identityPath);
+        return candidate;
+    }
+    catch (error) {
+        if (isAlreadyExists(error)) {
+            return readDeviceId(identityPath, identityFs) ?? awaitIdentity(identityPath, identityFs);
+        }
+    }
+    // Filesystems without hard links (some network and Windows mounts).
+    // Exclusive create is the next best thing; it carries the brief empty-file
+    // window that link() avoids.
+    //
+    // Opened by descriptor rather than writeFileSync so the create and the write
+    // are separable: exclusive create publishes the path before it is written,
+    // and the failure branch has to know that it did.
+    let fd;
+    try {
+        fd = identityFs.openSync(identityPath, 'wx', 0o600);
+    }
+    catch (error) {
+        if (!isAlreadyExists(error))
+            return null;
+        return readDeviceId(identityPath, identityFs) ?? awaitIdentity(identityPath, identityFs);
+    }
+    try {
+        identityFs.writeSync(fd, `${candidate}\n`);
+        identityFs.fsyncSync(fd);
+        return candidate;
+    }
+    catch {
+        // Whatever this created is deliberately left in place. Removing it cannot
+        // be done safely: verifying the inode and unlinking the pathname are
+        // separate operations, so a concurrent publisher could install a real
+        // identity in between and have its winner deleted. A later login reports
+        // the incomplete file and asks the operator to recover it manually.
+        //
+        // Thrown rather than returned: the bytes may well have landed before the
+        // fsync failed, and re-reading them would report an identity whose
+        // durability just failed as a stable one.
+        throw new DurabilityError('device identity could not be persisted');
+    }
+    finally {
+        try {
+            identityFs.closeSync(fd);
+        }
+        catch {
+            // Already closed.
+        }
+    }
+}
+/**
+ * The installation's stable, opaque device id, or null when it could not be
+ * persisted.
+ *
+ * Null rather than an unpersisted UUID: a value that is not on disk differs on
+ * every login, and the backend keys per-device key rotation on it, so returning
+ * one would provision a new key each time for what is one installation.
+ */
+function loadOrCreateDeviceId(identityFs = fs) {
+    const identityPath = getDeviceIdentityPath();
+    const existing = readDeviceId(identityPath, identityFs);
+    if (existing)
+        return existing;
+    // Existing but invalid identity files belong to the operator. Do not rename,
+    // truncate, or replace them automatically; recovery must be an explicit
+    // manual action after the contents have been inspected. But an unparseable
+    // file may also be a creator caught between publishing the path and writing
+    // its UUID before this process ever looked, so wait briefly first: giving up
+    // here would report no identity for a file that is simply not written yet.
+    // Only a file that stays unparseable through the wait is the operator's, and
+    // awaitIdentity returns null for it, leaving it untouched.
+    if (deviceIdentityPathExists(identityPath, identityFs)) {
+        return awaitIdentity(identityPath, identityFs);
+    }
+    const candidate = crypto.randomUUID();
+    const tempPath = `${identityPath}.${process.pid}.${crypto.randomBytes(6).toString('hex')}`;
+    try {
+        identityFs.mkdirSync(path.dirname(identityPath), { recursive: true });
+        identityFs.writeFileSync(tempPath, `${candidate}\n`, { mode: 0o600 });
+    }
+    catch {
+        return null;
+    }
+    try {
+        try {
+            const published = publishIdentity(identityPath, tempPath, candidate, identityFs);
+            return published;
+        }
+        catch (error) {
+            if (error instanceof DurabilityError)
+                return null;
+            throw error;
+        }
+    }
+    finally {
+        try {
+            identityFs.unlinkSync(tempPath);
+        }
+        catch {
+            // Already consumed by rename(), or never created.
+        }
+    }
+}
+const DEFAULT_DASHBOARD_URL = 'https://tools.armoriq.ai';
+const TOOL_CATALOG_PRODUCTS = new Set(['armorclaude', 'armorcodex']);
+const CALLBACK_SETTLED_GRACE_MS = 1000;
+const PROOF_SERVER_DEADLINE_MS = 15_000;
+function configuredDashboardUrl() {
+    let dashboardUrl;
+    try {
+        dashboardUrl = new url_1.URL(process.env.ARMORIQ_DASHBOARD_URL ?? DEFAULT_DASHBOARD_URL);
+        if (dashboardUrl.protocol !== 'https:' && dashboardUrl.protocol !== 'http:') {
+            dashboardUrl = new url_1.URL(DEFAULT_DASHBOARD_URL);
+        }
+    }
+    catch {
+        dashboardUrl = new url_1.URL(DEFAULT_DASHBOARD_URL);
+    }
+    dashboardUrl.username = '';
+    dashboardUrl.password = '';
+    return dashboardUrl;
+}
+function buildDashboardRedirect(product) {
+    const dashboardUrl = configuredDashboardUrl();
+    // Treat the configured value as an origin only. This prevents stale query,
+    // fragment, or user-info data from being carried into the callback redirect.
+    dashboardUrl.pathname = '/tools';
+    dashboardUrl.search = '';
+    dashboardUrl.hash = '';
+    const productKey = (product ?? '').toLowerCase().trim();
+    if (TOOL_CATALOG_PRODUCTS.has(productKey)) {
+        dashboardUrl.searchParams.set('product', productKey);
+    }
+    return dashboardUrl.toString();
+}
 function escapeHtml(s) {
     return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c);
 }
 function renderSuccessHtml(opts) {
     const productKey = (opts.product ?? '').toLowerCase().trim();
     const productLabel = PRODUCT_LABELS[productKey] ?? null;
-    const emailHtml = opts.email
-        ? `<div class="email">${escapeHtml(opts.email)}</div>`
-        : '';
+    const emailHtml = opts.email ? `<div class="email">${escapeHtml(opts.email)}</div>` : '';
     const productHtml = productLabel
         ? `<div class="chip">Connected to ${escapeHtml(productLabel)}</div>`
         : '';
@@ -166,7 +369,7 @@ function renderSuccessHtml(opts) {
   <div>© ${year} ArmorIQ Inc.</div>
   <nav>
     <a href="https://docs.armoriq.ai" target="_blank" rel="noreferrer">Docs</a>
-    <a href="https://dev.armoriq.ai" target="_blank" rel="noreferrer">Dashboard</a>
+    <a href="https://tools.armoriq.ai/tools" target="_blank" rel="noreferrer">Tools</a>
     <a href="https://armoriq.ai/privacy" target="_blank" rel="noreferrer">Privacy</a>
     <a href="https://armoriq.ai/terms" target="_blank" rel="noreferrer">Terms</a>
   </nav>
@@ -191,57 +394,189 @@ function findFreePort() {
     });
 }
 function startCallbackServer(port, expectedState, product) {
+    let lifecycleState = 'accepting';
+    let acceptedResult;
     let resolveResult;
     const once = new Promise((resolve) => {
         resolveResult = resolve;
     });
+    let resolveProofConsumed;
+    const proofConsumed = new Promise((resolve) => {
+        resolveProofConsumed = resolve;
+    });
+    let proofWasConsumed = false;
+    const markProofConsumed = () => {
+        if (proofWasConsumed)
+            return;
+        proofWasConsumed = true;
+        resolveProofConsumed();
+    };
+    const endResponse = (res, statusCode, body, headers = {}, onFinished) => {
+        if (res.writableEnded || res.destroyed)
+            return;
+        res.writeHead(statusCode, {
+            'Content-Type': 'text/plain; charset=utf-8',
+            'Cache-Control': 'no-store',
+            Connection: 'close',
+            ...headers,
+        });
+        res.end(body, onFinished);
+    };
+    const settle = () => {
+        lifecycleState = 'settled';
+        if (acceptedResult?.response && !acceptedResult.response.headersSent) {
+            endResponse(acceptedResult.response, 409, 'Authorization completed before this callback could be applied.');
+        }
+    };
+    const dashboardOrigin = configuredDashboardUrl().origin;
     const server = http.createServer((req, res) => {
         const url = new url_1.URL(req.url ?? '/', `http://localhost:${port}`);
+        if (url.pathname === '/.well-known/armoriq-device-proof') {
+            const requestOrigin = req.headers.origin;
+            if (requestOrigin !== dashboardOrigin) {
+                endResponse(res, 403, 'Origin is not allowed.');
+                return;
+            }
+            const candidateState = url.searchParams.get('state');
+            const candidateBytes = Buffer.from(candidateState ?? '');
+            const expectedBytes = Buffer.from(expectedState);
+            const stateMatches = candidateBytes.length === expectedBytes.length &&
+                crypto.timingSafeEqual(candidateBytes, expectedBytes);
+            if (!stateMatches) {
+                endResponse(res, 400, 'Invalid or missing state parameter.');
+                return;
+            }
+            const corsHeaders = {
+                'Access-Control-Allow-Origin': dashboardOrigin,
+                Vary: 'Origin',
+            };
+            if (req.method === 'OPTIONS') {
+                endResponse(res, 204, '', {
+                    ...corsHeaders,
+                    'Access-Control-Allow-Methods': 'GET, OPTIONS',
+                });
+                return;
+            }
+            if (req.method !== 'GET') {
+                endResponse(res, 404, 'Not found.', corsHeaders);
+                return;
+            }
+            endResponse(res, 200, JSON.stringify({ ok: true }), {
+                ...corsHeaders,
+                'Content-Type': 'application/json; charset=utf-8',
+            }, markProofConsumed);
+            return;
+        }
         if (url.pathname === '/callback') {
             const params = Object.fromEntries(url.searchParams.entries());
             // Reject any callback that doesn't carry the state nonce we generated.
             // Without this, any local process or web page could hit the loopback
             // port with ?key=<attacker> during the login window (key fixation).
             if (!params.state || params.state !== expectedState) {
-                res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
-                res.end('Invalid or missing state parameter.');
+                endResponse(res, 400, 'Invalid or missing state parameter.');
                 return;
             }
-            const callbackProduct = params.product || product;
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(renderSuccessHtml({
-                email: params.email,
-                product: callbackProduct,
-                orgId: params.org_id,
-            }));
+            // Product routing is established by the local command invocation. Do
+            // not allow callback query data to upgrade or change that decision.
+            const callbackProduct = product;
             const result = {
                 api_key: params.key,
                 email: params.email,
                 user_id: params.user_id,
                 org_id: params.org_id,
+                product: callbackProduct,
             };
-            if (result.api_key)
+            if (result.api_key) {
+                if (lifecycleState === 'pending') {
+                    endResponse(res, 409, 'Authorization callback already received.');
+                    return;
+                }
+                if (lifecycleState === 'settled') {
+                    endResponse(res, 410, 'Authorization flow is no longer accepting callbacks.');
+                    return;
+                }
+                // Keep the loopback response pending until cmdLogin has persisted the
+                // credentials. The remote redirect is produced only from bounded,
+                // non-secret local context.
+                result.response = res;
+                acceptedResult = result;
+                lifecycleState = 'pending';
                 resolveResult(result);
+            }
+            else {
+                // Preserve the existing response for callbacks without a key. Polling
+                // remains active and may still complete the device flow.
+                res.writeHead(200, {
+                    'Content-Type': 'text/html; charset=utf-8',
+                    'Cache-Control': 'no-store',
+                    Connection: 'close',
+                });
+                res.end(renderSuccessHtml({
+                    email: params.email,
+                    product: callbackProduct,
+                    orgId: params.org_id,
+                }));
+            }
         }
         else {
-            res.writeHead(404);
-            res.end();
+            endResponse(res, 404, 'Not found.');
         }
     });
+    const sockets = new Set();
+    server.on('connection', (socket) => {
+        sockets.add(socket);
+        socket.once('close', () => sockets.delete(socket));
+    });
     server.listen(port, '127.0.0.1');
-    return { server, once };
+    return { server, sockets, once, proofConsumed, settle };
 }
 /**
  * close() does nothing while the socket is still binding, so a device-code
  * request that fails before 'listening' fires would leave the callback server
  * holding the loopback port for the rest of the process.
  */
-function closeCallbackServer(server) {
-    if (server.listening) {
-        server.close();
+function closeCallbackServer(server, sockets, graceMs = 0) {
+    const close = () => {
+        const destroyConnections = () => {
+            // Node 18's server.close() does not reliably reap idle keep-alive or
+            // incomplete HTTP connections. Use the supported helpers when present,
+            // then enforce the bound with the sockets observed by this server.
+            server.closeIdleConnections?.();
+            server.closeAllConnections?.();
+            for (const socket of sockets)
+                socket.destroy();
+        };
+        if (server.listening) {
+            server.close();
+            destroyConnections();
+            return;
+        }
+        server.once('listening', () => {
+            server.close();
+            destroyConnections();
+        });
+    };
+    if (graceMs > 0) {
+        setTimeout(close, graceMs);
         return;
     }
-    server.once('listening', () => server.close());
+    close();
+}
+function closeCallbackServerAfterProof(server, sockets, proofConsumed, deadlineMs) {
+    let closed = false;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        closeCallbackServer(server, sockets);
+    };
+    const deadline = setTimeout(close, deadlineMs);
+    void proofConsumed.then(() => {
+        if (closed)
+            return;
+        clearTimeout(deadline);
+        close();
+    });
 }
 function openBrowser(url) {
     const cmd = process.platform === 'darwin'
@@ -253,24 +588,90 @@ function openBrowser(url) {
         /* best-effort */
     });
 }
-function sleep(ms) {
-    return new Promise((r) => setTimeout(r, ms));
+function cancellableDelay(ms) {
+    let settled = false;
+    let resolveDelay;
+    const promise = new Promise((resolve) => {
+        resolveDelay = resolve;
+    });
+    const timer = setTimeout(() => {
+        settled = true;
+        resolveDelay('tick');
+    }, ms);
+    return {
+        promise,
+        cancel: () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolveDelay('cancelled');
+        },
+    };
+}
+/**
+ * Ask the backend whether the cached API key is still usable.
+ *
+ * Returns the validation result, or `null` when the backend could not be
+ * reached (network error, timeout, or a 5xx). A `null` means "unknown": the
+ * caller keeps the existing session rather than forcing a re-auth while
+ * offline. A definitive 401/403 (revoked, expired, or issued by a different
+ * backend — e.g. a stale prod key against staging) comes back as
+ * `{ active: false }` so login re-mints instead of short-circuiting.
+ */
+async function checkStoredKey(backend, apiKey) {
+    try {
+        const r = await axios_1.default.post(`${backend}/api-keys/validate`, { apiKey }, { timeout: 10000, validateStatus: () => true });
+        if (r.status === 401 || r.status === 403)
+            return { active: false };
+        if (r.status >= 200 && r.status < 300) {
+            const data = r.data ?? {};
+            // `product` is only present on backends that surface it; when absent the
+            // product check is skipped and validity alone decides.
+            return {
+                active: data.success !== false && data.isActive !== false,
+                product: typeof data.product === 'string' ? data.product : undefined,
+            };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
 }
 async function cmdLogin(args) {
     const backend = (args.backend ?? process.env.ARMORIQ_BACKEND_URL ?? (0, util_1.backendBase)()).replace(/\/+$/, '');
     const requestedOrg = (args.org ?? '').trim();
     const product = (args.product ?? process.env.ARMORIQ_PRODUCT ?? '').trim();
     // Already authenticated? Skip the browser flow unless re-auth is forced or
-    // the user is switching org. Re-running `login` otherwise just re-opens the
-    // browser for no reason.
+    // the user is switching org. But only skip when the cached key is actually
+    // still usable: a fresh install can leave a stale key (revoked, expired, or
+    // minted against a different backend/product), and the old behavior of
+    // trusting the file's mere existence meant that key was reused forever and a
+    // new one was never created. So validate it first and re-mint when it no
+    // longer checks out.
     if (!args.force && !requestedOrg) {
         const existing = (0, credentials_1.loadCredentials)();
-        if (existing) {
-            (0, util_1.out)('');
-            (0, util_1.out)(`  ${util_1.CHECK} Already logged in as \x1b[1m${existing.email || 'unknown'}\x1b[0m (org: ${existing.orgId || 'unknown'})`);
-            (0, util_1.out)('  \x1b[2mRun \x1b[0m\x1b[1marmoriq login --force\x1b[0m\x1b[2m to re-authenticate, or \x1b[0m\x1b[1marmoriq logout\x1b[0m\x1b[2m first.\x1b[0m');
+        if (existing?.apiKey) {
+            const check = await checkStoredKey(backend, existing.apiKey);
+            const productMismatch = !!product && !!check?.product && check.product !== product;
+            // Unreachable backend (check === null): keep the existing session rather
+            // than forcing a re-auth we cannot complete offline anyway.
+            if (!check || (check.active && !productMismatch)) {
+                (0, util_1.out)('');
+                (0, util_1.out)(`  ${util_1.CHECK} Already logged in as \x1b[1m${existing.email || 'unknown'}\x1b[0m (org: ${existing.orgId || 'unknown'})`);
+                (0, util_1.out)('  \x1b[2mRun \x1b[0m\x1b[1marmoriq login --force\x1b[0m\x1b[2m to re-authenticate, or \x1b[0m\x1b[1marmoriq logout\x1b[0m\x1b[2m first.\x1b[0m');
+                (0, util_1.out)('');
+                return 0;
+            }
+            // Stale or wrong-product key: drop it and fall through to mint a fresh
+            // one. A known-bad key is worth nothing, so clearing it first is safe.
+            const reason = productMismatch
+                ? `the saved key is for a different product (${check.product})`
+                : 'the saved key is no longer valid';
             (0, util_1.out)('');
-            return 0;
+            (0, util_1.out)(`  ${util_1.WARN} Reconnecting: ${reason}. Creating a new API key...`);
+            (0, credentials_1.clearCredentials)();
         }
     }
     (0, util_1.out)('');
@@ -279,17 +680,32 @@ async function cmdLogin(args) {
     const port = await findFreePort();
     const state = crypto.randomBytes(16).toString('hex');
     const callbackUrl = `http://localhost:${port}/callback?state=${state}`;
-    const { server, once: callbackOnce } = startCallbackServer(port, state, product);
+    const { server, sockets: callbackSockets, once: callbackOnce, proofConsumed, settle: settleCallbackServer, } = startCallbackServer(port, state, product);
     let dc;
     try {
-        const deviceCodeRequest = product
-            ? { callback_url: callbackUrl, product }
-            : { callback_url: callbackUrl };
-        const r = await axios_1.default.post(`${backend}/auth/device/code`, deviceCodeRequest, { timeout: 10000 });
+        const deviceId = loadOrCreateDeviceId();
+        if (!deviceId) {
+            const identityPath = getDeviceIdentityPath();
+            if (!readDeviceId(identityPath, fs) && deviceIdentityPathExists(identityPath, fs)) {
+                (0, util_1.out)(`  ${util_1.WARN} Device identity at ${identityPath} is invalid or unreadable; ` +
+                    'move or remove it manually, then run `armoriq login --force` again.');
+            }
+        }
+        const deviceCodeRequest = {
+            callback_url: callbackUrl,
+            ...(product ? { product } : {}),
+            // Both fields or neither: deviceName exists only to label deviceId, so
+            // sending it alone would attach a hostname to no device.
+            ...(deviceId ? { deviceId, deviceName: os.hostname().trim().slice(0, 200) } : {}),
+        };
+        const r = await axios_1.default.post(`${backend}/auth/device/code`, deviceCodeRequest, {
+            timeout: 10000,
+        });
         dc = r.data;
     }
     catch (e) {
-        closeCallbackServer(server);
+        settleCallbackServer();
+        closeCallbackServer(server, callbackSockets);
         (0, util_1.out)(`  ${util_1.CROSS} Failed to request device code: ${e.message}`);
         return 1;
     }
@@ -304,7 +720,7 @@ async function cmdLogin(args) {
         browserUrl += `&product=${encodeURIComponent(product)}`;
     (0, util_1.out)('  Opening browser...\n');
     openBrowser(browserUrl);
-    (0, util_1.out)('  If the browser didn\'t open, visit:');
+    (0, util_1.out)("  If the browser didn't open, visit:");
     (0, util_1.out)(`    \x1b[36m\x1b[1m${browserUrl}\x1b[0m\n`);
     (0, util_1.out)(`  Confirm this code in your browser: \x1b[1m${user_code}\x1b[0m\n`);
     process.stdout.write('  Waiting for authorization...');
@@ -312,19 +728,43 @@ async function cmdLogin(args) {
     let result;
     let lastErr;
     while (Date.now() < deadline && !result) {
-        // Race callback vs poll; whichever resolves first wins.
+        // Wait for a callback until the next polling interval.
+        const delay = cancellableDelay(interval * 1000);
         const callbackOrTimeout = Promise.race([
             callbackOnce.then((r) => ({ kind: 'cb', value: r })),
-            sleep(interval * 1000).then(() => ({ kind: 'tick' })),
+            delay.promise.then((value) => ({ kind: value })),
         ]);
         const tick = await callbackOrTimeout;
         if (tick.kind === 'cb' && tick.value.api_key) {
+            delay.cancel();
             result = tick.value;
             break;
         }
         try {
-            const pr = await axios_1.default.post(`${backend}/auth/device/token`, { deviceCode: device_code }, { timeout: 10000, validateStatus: () => true });
-            const data = pr.data ?? {};
+            // Keep observing the callback while the token request is in flight. A
+            // callback accepted during polling owns an open browser response and
+            // must be persisted and redirected instead of being discarded when a
+            // concurrent poll also succeeds.
+            const pollController = new AbortController();
+            const pollOutcome = axios_1.default
+                .post(`${backend}/auth/device/token`, { deviceCode: device_code }, { timeout: 10000, validateStatus: () => true, signal: pollController.signal })
+                .then((r) => ({ kind: 'poll', value: r }), () => ({ kind: 'poll-error' }));
+            const pollOrCallback = await Promise.race([
+                callbackOnce.then((r) => ({ kind: 'cb', value: r })),
+                pollOutcome,
+            ]);
+            if (pollOrCallback.kind === 'cb') {
+                pollController.abort();
+                await pollOutcome;
+                if (pollOrCallback.value.api_key) {
+                    result = pollOrCallback.value;
+                    break;
+                }
+                continue;
+            }
+            if (pollOrCallback.kind === 'poll-error')
+                continue;
+            const data = pollOrCallback.value.data ?? {};
             const err = data.error;
             if (err === 'authorization_pending' || err === 'slow_down')
                 continue;
@@ -346,19 +786,52 @@ async function cmdLogin(args) {
             // network blip; keep polling
         }
     }
-    closeCallbackServer(server);
     if (!result || !result.api_key) {
+        settleCallbackServer();
+        closeCallbackServer(server, callbackSockets, CALLBACK_SETTLED_GRACE_MS);
         (0, util_1.out)(` ${util_1.CROSS}`);
         (0, util_1.out)(`  ${util_1.CROSS} ${lastErr ?? 'Timed out waiting for authorization. Run `armoriq login` again.'}`);
         return 1;
     }
-    (0, credentials_1.saveCredentials)({
-        apiKey: result.api_key,
-        email: result.email ?? '',
-        userId: result.user_id ?? '',
-        orgId: result.org_id ?? '',
-        savedAt: new Date().toISOString(),
-    });
+    if (!result.response)
+        settleCallbackServer();
+    try {
+        (0, credentials_1.saveCredentials)({
+            apiKey: result.api_key,
+            email: result.email ?? '',
+            userId: result.user_id ?? '',
+            orgId: result.org_id ?? '',
+            savedAt: new Date().toISOString(),
+        });
+    }
+    catch (error) {
+        if (result.response && !result.response.headersSent) {
+            result.response.writeHead(500, {
+                'Content-Type': 'text/plain; charset=utf-8',
+                'Cache-Control': 'no-store',
+                Connection: 'close',
+            });
+            result.response.end('Authorization succeeded, but credentials could not be saved locally.');
+        }
+        settleCallbackServer();
+        closeCallbackServer(server, callbackSockets, CALLBACK_SETTLED_GRACE_MS);
+        throw error;
+    }
+    if (result.response && !result.response.headersSent) {
+        result.response.writeHead(302, {
+            Location: buildDashboardRedirect(result.product),
+            'Cache-Control': 'no-store',
+            Connection: 'close',
+        });
+        result.response.end();
+    }
+    settleCallbackServer();
+    if (result.response) {
+        closeCallbackServerAfterProof(server, callbackSockets, proofConsumed, PROOF_SERVER_DEADLINE_MS);
+    }
+    else {
+        closeCallbackServer(server, callbackSockets, CALLBACK_SETTLED_GRACE_MS);
+    }
     (0, util_1.out)(` ${util_1.CHECK}`);
     (0, util_1.out)('');
     (0, util_1.out)(`  ${util_1.CHECK} Logged in as \x1b[1m${result.email ?? 'unknown'}\x1b[0m (org: ${result.org_id ?? 'unknown'})`);