driggsby 0.6.2 → 0.7.0

package/README.md

@@ -22,11 +22,9 @@ npx driggsby@latest mcp setup other
 After setup, authenticate Driggsby through your client — run `/mcp` in
 Claude Code, or sign in through the browser window Codex opens.
 
-So your Driggsby MCP page can tell your connections apart, `login` sends
+So your Driggsby MCP page can tell your CLI sign-ins apart, `login` sends
 Driggsby this computer's name and operating system version (for example
-`mbp-studio` and `macOS 15.6`) with its sign-in, and
-`mcp setup claude-code` saves them as headers on the Driggsby entry it
-adds to Claude Code, which sends them with each request.
+`mbp-studio` and `macOS 15.6`) with its sign-in.
 
 For another MCP client, choose Other. Driggsby currently supports only
 OAuth-based remote MCP at:
@@ -37,7 +35,9 @@ https://app.driggsby.com/mcp
 
 Some driggsby commands work with your Driggsby account directly and need
 an app token saved on your machine: run
-`npx driggsby@latest login` and approve the page it opens. The token is
+`npx driggsby@latest login` and approve the page it opens (approving in a
+browser on another computer shows a code to paste, or to finish with
+`npx driggsby@latest login --code <CODE>`). The token is
 stored in your platform keychain when one is available, otherwise in
 `~/.driggsby/credentials.json`, and is never printed.
 `npx driggsby@latest logout` removes it.
@@ -69,6 +69,8 @@ can't reach it, but anything running locally can, so stop it when you're
 done: press Ctrl+C, or run `npx driggsby@latest dev --stop` in the app's
 folder. It also stops on its own after 30 minutes with no page open.
 Previews for several apps can run at once; each prints its own addresses.
+Each data call the page makes prints one line in the terminal, after any
+retries: a check and how long it took, or a cross and the reason.
 
 ## Deploying an app
 

package/dist/args-login.js

@@ -0,0 +1,41 @@
+// Argv parsing for driggsby login: help, and --code to finish a sign-in that
+// is waiting on this computer with the code its approval page showed. Same
+// contract as the rest of the tree: usage errors exit 2, echoed argv is
+// sanitized.
+import { helpCommand, unexpectedArgument } from "./args-shared.js";
+import { CliError } from "./cli-error.js";
+import { LOGIN_HELP } from "./help.js";
+const LOGIN_USAGE = "Usage: npx driggsby@latest login [--code <CODE>]";
+export function parseLogin(argv) {
+    let code = null;
+    let optionsEnded = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const token = argv[index] ?? "";
+        if (!optionsEnded && token === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        if (!optionsEnded && (token === "-h" || token === "--help")) {
+            return helpCommand(LOGIN_HELP);
+        }
+        if (!optionsEnded && code === null && token === "--code") {
+            code = requireCode(argv[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (!optionsEnded && code === null && token.startsWith("--code=")) {
+            code = requireCode(token.slice("--code=".length));
+            continue;
+        }
+        throw unexpectedArgument(token, LOGIN_USAGE);
+    }
+    return { kind: "login", code };
+}
+// A code is never empty or flag-like; a pasted one may carry spaces, which
+// Driggsby reads past.
+function requireCode(value) {
+    if (value === undefined || value.trim() === "" || value.startsWith("-")) {
+        throw new CliError(`error: a value is required for '--code <CODE>' but none was supplied\n\n${LOGIN_USAGE}\n\nFor more information, try '--help'.`, 2);
+    }
+    return value;
+}

package/dist/args.js

@@ -10,13 +10,14 @@ import { parseDeploy, parseRollback, parseVersions } from "./args-deploy.js";
 import { parseDev } from "./args-dev.js";
 import { parseDelete } from "./args-delete.js";
 import { parseInit } from "./args-init.js";
+import { parseLogin } from "./args-login.js";
 import { parseMcpSetup } from "./args-mcp-setup.js";
 import { parseQuery } from "./args-query.js";
 import { parseRules } from "./args-rules.js";
 import { removeDashesTip, similarArgumentTip, unexpectedArgument, unexpectedFlagValue, } from "./args-shared.js";
 import { didYouMean } from "./clap-suggestions.js";
 import { CliError } from "./cli-error.js";
-import { LOGIN_HELP, LOGOUT_HELP, MCP_HELP, ROOT_HELP } from "./help.js";
+import { LOGOUT_HELP, MCP_HELP, ROOT_HELP } from "./help.js";
 import { sanitizeForTerminal } from "./terminal-text.js";
 export {} from "./args-shared.js";
 const ROOT_USAGE = "Usage: npx driggsby@latest <COMMAND>";
@@ -90,7 +91,7 @@ function dispatchSubcommand(name, rest) {
         case "mcp":
             return parseLevel(MCP_LEVEL, rest);
         case "login":
-            return parseBareCommand({ kind: "login" }, LOGIN_HELP, "Usage: npx driggsby@latest login", rest);
+            return parseLogin(rest);
         case "logout":
             return parseBareCommand({ kind: "logout" }, LOGOUT_HELP, "Usage: npx driggsby@latest logout", rest);
         case "init":
@@ -117,7 +118,7 @@ function dispatchSubcommand(name, rest) {
             throw new Error(`unhandled subcommand dispatch: ${name}`);
     }
 }
-// Parsing for commands that take no arguments beyond help: login and logout.
+// Parsing for commands that take no arguments beyond help: logout.
 // Same exit codes and error shape as the rest of the tree, no clap quirks.
 function parseBareCommand(command, helpText, usage, argv) {
     let optionsEnded = false;

package/dist/device.js

@@ -1,10 +1,8 @@
 import { readFileSync, statSync } from "node:fs";
 import { isIP } from "node:net";
 import { hostname, platform, release, version } from "node:os";
-// Load-bearing: these allowlists are what make the values safe as command
-// arguments (spawn-plan.ts quotes them for cmd.exe) and as "Name: value"
-// headers. They must never admit % ! ^ & | < > " \ : or a control
-// character; device.test.ts checks each.
+// These allowlists keep what leaves the CLI plain text: they never admit
+// % ! ^ & | < > " \ : or a control character (device.test.ts checks each).
 const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,62}$/;
 const SYSTEM_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 ._/-]{0,63}$/;
 const MAC_VERSION_FILE = "/System/Library/CoreServices/SystemVersion.plist";
@@ -38,17 +36,6 @@ export function knownDevice(device) {
     };
     return Object.keys(known).length === 0 ? null : known;
 }
-// The Driggsby headers `mcp setup` gives Claude Code, one per known value.
-export function deviceHeaders(device) {
-    const headers = [];
-    if (device.name !== null) {
-        headers.push(`X-Driggsby-Device-Name: ${device.name}`);
-    }
-    if (device.system !== null) {
-        headers.push(`X-Driggsby-Device-System: ${device.system}`);
-    }
-    return headers;
-}
 // "mbp-studio.local" and "devbox-02.corp.example.test" are mbp-studio and
 // devbox-02: the first label is the name people give their computer. An
 // address or localhost names no computer.

package/dist/help.js

@@ -64,10 +64,15 @@ app token that lets this machine read your Driggsby data, deploy Driggsby
 apps, and manage your transaction rules. The token is saved locally for
 other driggsby commands and is never printed.
 
-Usage: npx driggsby@latest login
+If you approve in a browser on another computer, the page shows a code
+instead. Paste it where login is waiting, or finish with --code.
+
+Usage: npx driggsby@latest login [--code <CODE>]
 
 Options:
-  -h, --help  Print help
+      --code <CODE>  Finish the sign-in waiting on this machine with the
+                     code its approval page showed
+  -h, --help         Print help
 `;
 export const LOGOUT_HELP = `Remove the saved Driggsby app token.
 

package/dist/login/await-token.js

@@ -0,0 +1,260 @@
+// The wait inside driggsby login, once the approval page is in front of the
+// person: the first of the loopback's code, a pasted code, or the claim
+// going away (declined or expired) ends it. Every code is traded with the
+// verifier; only that trade returns the token.
+import { CliError } from "../cli-error.js";
+import { pollClaimRequest, tradeCode } from "./claim-client.js";
+import {} from "./loopback.js";
+export const LOGIN_RETRY_COMMAND = "npx driggsby@latest login";
+export const CODE_COMMAND = "npx driggsby@latest login --code <CODE>";
+// Approving leaves at least this long to trade the code, even past the
+// link's own lifetime, so a late approval can still finish.
+export const CODE_WINDOW_MS = 300_000;
+// Driggsby's codes are four groups of five; a paste longer than this is
+// not one (the approval link, say), and is refused here without a trade.
+const MAX_CODE_CHARS = 64;
+// A trade that hits a momentary hiccup is tried again this many times.
+const TRADE_ATTEMPTS = 3;
+const TRADE_RETRY_MS = 2_000;
+// A code from the loopback is the only copy there is: when Driggsby can't
+// be reached, the wait keeps trying it this often until the wait ends.
+const LOOPBACK_RETRY_MS = 5_000;
+const CODE_SHAPE_REFUSED = "That doesn't look like a sign-in code. Copy the code the approval page\nshows.";
+const UNREACHABLE = "We couldn't reach Driggsby to finish signing in just now.";
+// The claim went away: declined, expired, or already spent. Distinct, so
+// login can tell it from other failures (another command may have spent it).
+export class ClaimGone extends CliError {
+}
+// The trades in flight. The trade that spends the claim makes the poll
+// read gone before the trade's own answer arrives; the poll waits for any
+// trade in flight so that answer speaks first.
+class Trades {
+    #inFlight = 0;
+    #started = 0;
+    #idle = [];
+    get started() {
+        return this.#started;
+    }
+    busy() {
+        return this.#inFlight > 0;
+    }
+    async run(work) {
+        this.#inFlight += 1;
+        this.#started += 1;
+        try {
+            return await work();
+        }
+        finally {
+            this.#inFlight -= 1;
+            if (this.#inFlight === 0) {
+                for (const resolve of this.#idle.splice(0)) {
+                    resolve();
+                }
+            }
+        }
+    }
+    idle() {
+        return this.#inFlight === 0 ? Promise.resolve() : new Promise((resolve) => this.#idle.push(resolve));
+    }
+}
+export async function awaitToken(sign, clock) {
+    const stop = new AbortController();
+    const trades = new Trades();
+    try {
+        const outcome = await Promise.race([
+            fromLoopback(sign, clock, trades, stop.signal),
+            fromPaste(sign, clock, trades, stop.signal),
+            fromPoll(sign, clock, trades, stop.signal),
+        ]);
+        if (outcome.kind === "error") {
+            throw outcome.error;
+        }
+        return outcome.appToken;
+    }
+    finally {
+        stop.abort();
+    }
+}
+// A browser on this computer handed over a code, or Driggsby's denial. Its
+// request waits on the loopback until the trade is done, so it lands on a
+// page that already says how it went. Any page on this computer can reach
+// the loopback, so a callback proves nothing by itself: a code that doesn't
+// trade is refused without saying where the approval page is, and a denial
+// counts only once Driggsby confirms the claim is gone.
+async function fromLoopback(sign, clock, trades, signal) {
+    if (sign.loopback === null) {
+        return never();
+    }
+    for (;;) {
+        const callback = await sign.loopback.next();
+        if (stopped(signal)) {
+            // The sign-in already ended; the page says how.
+            callback.answer(sign.landingUrl);
+            return never();
+        }
+        if (callback.kind === "denied") {
+            const mark = trades.started;
+            const poll = await pollLettingTradesSpeak(sign, trades, mark);
+            if (poll.kind === "approved") {
+                // A server older than PKCE handed this poll the token; it counts,
+                // as it does in fromPoll.
+                callback.answer(sign.landingUrl);
+                return { kind: "token", appToken: poll.appToken };
+            }
+            if (poll.kind === "gone") {
+                // A trade in flight may be what spent the claim; it speaks first.
+                await settleTrades(trades, mark);
+                callback.answer(sign.landingUrl);
+                return stopped(signal) ? never() : { kind: "error", error: declined() };
+            }
+            callback.refuse();
+            continue;
+        }
+        for (;;) {
+            const result = await trades.run(() => tradeWithRetries(sign, callback.code, clock, signal));
+            if (stopped(signal)) {
+                callback.refuse();
+                return never();
+            }
+            if (result.kind === "approved") {
+                callback.answer(sign.landingUrl);
+                return { kind: "token", appToken: result.appToken };
+            }
+            if (result.kind === "rejected") {
+                callback.refuse();
+                break;
+            }
+            // Unreachable: the code may still work, and it's the only copy.
+            await clock.sleep(LOOPBACK_RETRY_MS, signal);
+            if (stopped(signal)) {
+                return never();
+            }
+        }
+    }
+}
+// A code pasted at the prompt. A refused code asks again, so a typo costs
+// nothing; the claim's own expiry still ends the wait.
+async function fromPaste(sign, clock, trades, signal) {
+    if (sign.prompt === null) {
+        return never();
+    }
+    let question = sign.promptQuestion;
+    for (;;) {
+        const line = await sign.prompt.ask(question);
+        if (stopped(signal) || line === null) {
+            return never();
+        }
+        const code = line.trim();
+        if (code === "") {
+            continue;
+        }
+        const result = await trades.run(() => tradeWithRetries(sign, code, clock, signal));
+        if (stopped(signal)) {
+            return never();
+        }
+        if (result.kind === "approved") {
+            return { kind: "token", appToken: result.appToken };
+        }
+        question =
+            result.kind === "unreachable"
+                ? `${result.message}\nPaste the code again to retry: `
+                : `${result.message}\nCheck the code and paste it again: `;
+    }
+}
+// The claim's own state: declined or expired ends the wait. An approval
+// waiting for its code still polls as pending, so the wait runs past the
+// link's lifetime by up to the code window, until Driggsby says it's gone.
+// Driggsby never hands a PKCE claim's token to the poll; a server that did
+// (one older than PKCE) is still handing it to the CLI that made the claim,
+// so it counts.
+async function fromPoll(sign, clock, trades, signal) {
+    const ceiling = sign.deadline + CODE_WINDOW_MS;
+    while (clock.now() < ceiling) {
+        await clock.sleep(clock.pollIntervalMs, signal);
+        if (stopped(signal)) {
+            return never();
+        }
+        const mark = trades.started;
+        const result = await pollLettingTradesSpeak(sign, trades, mark);
+        if (stopped(signal)) {
+            return never();
+        }
+        if (result.kind === "approved") {
+            return { kind: "token", appToken: result.appToken };
+        }
+        if (result.kind === "gone") {
+            await settleTrades(trades, mark);
+            if (stopped(signal)) {
+                return never();
+            }
+            return {
+                kind: "error",
+                error: new ClaimGone("This sign-in link is no longer active — it may have been declined or timed out.\n\n" +
+                    `Start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1),
+            };
+        }
+    }
+    // A trade still in flight at the ceiling may be the one that spends it.
+    await settleTrades(trades, trades.started);
+    if (stopped(signal)) {
+        return never();
+    }
+    return {
+        kind: "error",
+        error: new CliError(`The sign-in link expired before it was approved.\n\nStart a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1),
+    };
+}
+// The claim's state. A poll that fails outright (an answer Driggsby never
+// gives) ends the wait, but only after any trade in flight speaks: that
+// trade may be what spent the claim, and its token must not be dropped.
+function pollLettingTradesSpeak(sign, trades, mark) {
+    return pollClaimRequest(sign.baseUrl, { claimRequestId: sign.claimRequestId, pollSecret: sign.pollSecret }).catch(async (error) => {
+        await settleTrades(trades, mark);
+        throw error;
+    });
+}
+// Waits out any trade that is in flight, or that started since mark, and
+// then one more turn, so a trade that spent the claim settles the race
+// before a "gone" or "expired" does.
+async function settleTrades(trades, mark) {
+    if (!trades.busy() && trades.started === mark) {
+        return;
+    }
+    await trades.idle();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+}
+export async function tradeWithRetries(sign, code, clock, signal) {
+    if (code === "" || code.length > MAX_CODE_CHARS) {
+        return { kind: "rejected", message: CODE_SHAPE_REFUSED };
+    }
+    for (let attempt = 1;; attempt += 1) {
+        if (attempt > 1 && signal !== undefined && stopped(signal)) {
+            return { kind: "unreachable", message: UNREACHABLE };
+        }
+        const result = await tradeCode(sign.baseUrl, {
+            claimRequestId: sign.claimRequestId,
+            code,
+            codeVerifier: sign.codeVerifier,
+        });
+        if (result.kind !== "transient") {
+            return result;
+        }
+        if (attempt >= TRADE_ATTEMPTS || (signal !== undefined && stopped(signal))) {
+            return { kind: "unreachable", message: UNREACHABLE };
+        }
+        await clock.sleep(TRADE_RETRY_MS, signal);
+    }
+}
+// A confirmed denial is the claim gone too, so a login whose sign-in
+// another command finished still tells that apart.
+function declined() {
+    return new ClaimGone(`This sign-in was declined.\n\nStart a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+}
+// Read through a call: the signal flips while this code awaits, which a
+// property check narrowed before the await would not see.
+function stopped(signal) {
+    return signal.aborted;
+}
+function never() {
+    return new Promise(() => undefined);
+}

package/dist/login/claim-client.js

@@ -1,8 +1,9 @@
 // The app-token claim flow's HTTP client, against Driggsby's public
-// app-token claim API: create a pending claim, send the user to claim_url,
-// poll with the claim id + poll secret until the user approves. The app
-// token is returned by exactly one poll; callers must never poll again after
-// an approval.
+// app-token claim API: create a pending claim carrying a PKCE challenge,
+// send the user to claim_url, and trade the one-time code the approval
+// produced, with the verifier, for the app token. The poll only tells a
+// waiting sign-in that its claim is gone (denied or expired); Driggsby
+// hands a PKCE claim's token only to the code trade.
 import { CliError } from "../cli-error.js";
 import { knownDevice } from "../device.js";
 import { sanitizeForTerminal } from "../terminal-text.js";
@@ -26,11 +27,18 @@ export const SIGN_IN_START_FAILURE = "We weren't able to start a Driggsby sign-i
 const SIGN_IN_FINISH_FAILURE = "We weren't able to finish your Driggsby sign-in just now. Please try again\nin a minute.";
 // device: this computer's name and system (device.ts), so the sign-in shows
 // up on Driggsby's MCP page as the computer it is; only known values go.
-export async function createClaimRequest(baseUrl, device = { name: null, system: null }) {
+export async function createClaimRequest(baseUrl, pkce, device = { name: null, system: null }) {
     const response = await fetch(`${baseUrl}/app-tokens/claim-requests`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ app_name: CLAIM_APP_NAME, scope: CLAIM_SCOPE, ...deviceField(device) }),
+        body: JSON.stringify({
+            app_name: CLAIM_APP_NAME,
+            scope: CLAIM_SCOPE,
+            code_challenge: pkce.challenge,
+            code_challenge_method: "S256",
+            ...(pkce.redirectUri === null ? {} : { redirect_uri: pkce.redirectUri }),
+            ...deviceField(device),
+        }),
         signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
         // Never follow a redirect: a 307/308 would replay this claim flow —
         // and, on the poll below, the poll secret — to whatever origin a
@@ -119,6 +127,47 @@ export async function pollClaimRequest(baseUrl, credentials) {
             return { kind: "transient" };
     }
 }
+const CODE_REJECTED = "That sign-in code didn't work. It may have been mistyped, used\nalready, or expired.";
+export async function tradeCode(baseUrl, trade) {
+    let response;
+    try {
+        response = await fetch(`${baseUrl}/app-tokens/claim-requests/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                claim_request_id: trade.claimRequestId,
+                code: trade.code,
+                code_verifier: trade.codeVerifier,
+            }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            // The verifier and code must never follow a redirect to another origin.
+            redirect: "error",
+        });
+    }
+    catch {
+        return { kind: "transient" };
+    }
+    const body = await readJsonBody(response);
+    if (response.status === 200) {
+        const appToken = stringField(asRecord(body), "app_token");
+        if (appToken === null) {
+            throw new CliError(SIGN_IN_FINISH_FAILURE, 1);
+        }
+        return { kind: "approved", appToken };
+    }
+    // The CLI says what to do next itself (paste again, or start over), so a
+    // refused code reads in its own words.
+    // 422 too: a paste Driggsby reads as blank (a Unicode space the CLI
+    // doesn't trim) is a wrong code, never the end of the sign-in.
+    if (response.status === 400 || response.status === 422) {
+        return { kind: "rejected", message: CODE_REJECTED };
+    }
+    if (response.status === 429 || response.status >= 500) {
+        return { kind: "transient" };
+    }
+    // Any other answer means our request is wrong, which a retry can't fix.
+    throw new CliError(errorDescription(body) ?? SIGN_IN_FINISH_FAILURE, 1);
+}
 async function readJsonBody(response) {
     let text;
     try {

package/dist/login/login.js

@@ -1,42 +1,151 @@
-// driggsby login: create an app-token claim, send the user to the approval
-// page, poll until they approve, and store the token. The token is shown to
-// no one — it goes straight from the poll response into the credential
-// store.
+// driggsby login: sign in with PKCE. The CLI keeps a verifier, listens on
+// its loopback when it can, and opens Driggsby's approval page itself.
+// Approving there hands the one-time code to this CLI's loopback;
+// approving from any other browser shows the code, to paste here or to
+// finish with `driggsby login --code <CODE>`. Only the code and the
+// verifier together mint the token, which goes straight into the
+// credential store and is shown to no one.
 import { apiBaseUrl, apiHost, baseUrlMayReceiveSavedSignIn } from "../api/base-url.js";
 import { blockedNetworkError } from "../api/network-error.js";
 import { CliError } from "../cli-error.js";
 import { describeDevice } from "../device.js";
 import { defaultCredentialEnvironment, describeStorageLocation, environmentToken, saveToken, } from "../credentials/store.js";
 import { sanitizeForTerminal, wrapProse } from "../terminal-text.js";
-import { createClaimRequest, pollClaimRequest, SIGN_IN_START_FAILURE, } from "./claim-client.js";
+import { awaitToken, ClaimGone, CODE_COMMAND, CODE_WINDOW_MS, LOGIN_RETRY_COMMAND, tradeWithRetries, } from "./await-token.js";
+import { createClaimRequest, SIGN_IN_START_FAILURE } from "./claim-client.js";
+import { startLoopback } from "./loopback.js";
 import { tryOpenUrl } from "./open-url.js";
-const LOGIN_RETRY_COMMAND = "npx driggsby@latest login";
+import { clearPendingLogin, markPendingLoginFinished, readPendingLogin, savePendingLogin, } from "./pending.js";
+import { createPkcePair } from "./pkce.js";
+import { abortableSleep } from "./sleep.js";
+import { terminalCodePrompt } from "./terminal-prompt.js";
 const DEFAULT_POLL_INTERVAL_MS = 4_000;
+// How long a waiting login gives `login --code` to mark a spent claim.
+export const FINISH_MARK_WAIT_MS = 3_000;
+// Where a browser opened "here" may really run on another computer (an SSH
+// session, a cloud dev box forwarding its opener), so its approval could
+// never reach this loopback: the page shows the code to paste instead.
+const REMOTE_SESSION_VARIABLES = ["SSH_CONNECTION", "SSH_TTY", "CODESPACES", "GITPOD_WORKSPACE_ID"];
 function defaultLoginIo() {
     return {
         out: (text) => {
             process.stdout.write(text);
         },
         openUrl: tryOpenUrl,
-        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+        sleep: abortableSleep,
         now: () => Date.now(),
         pollIntervalMs: DEFAULT_POLL_INTERVAL_MS,
+        startLoopback,
+        codePrompt: terminalCodePrompt,
     };
 }
 export async function runLogin(environment = defaultCredentialEnvironment(), io = defaultLoginIo()) {
     const baseUrl = apiBaseUrl(environment.env);
     io.out("Sign in to Driggsby\n\n");
-    const claim = await createClaim(baseUrl);
-    const claimUrl = approvedClaimUrl(claim.claimUrl, baseUrl);
-    const browserOpened = await io.openUrl(claimUrl);
-    io.out(browserOpened
-        ? "Your browser should open a Driggsby approval page. If it doesn't, open\nthis link:\n\n"
-        : "Open this link in your browser to approve access for this machine:\n\n");
-    io.out(`  ${claimUrl}\n\n`);
-    const minutes = approximateMinutes(claim.expiresInSeconds);
-    const minutesWord = minutes === 1 ? "minute" : "minutes";
-    io.out(`Waiting for your approval (the link is good for about ${minutes} ${minutesWord})...\n`);
-    const appToken = await pollUntilApproved(baseUrl, claim, io);
+    const pkce = createPkcePair();
+    const remoteSession = REMOTE_SESSION_VARIABLES.some((name) => (environment.env[name] ?? "") !== "");
+    const loopback = remoteSession ? null : await io.startLoopback();
+    let prompt = null;
+    try {
+        const claim = await createClaim(baseUrl, { challenge: pkce.challenge, redirectUri: loopback?.redirectUri ?? null });
+        const claimUrl = approvedClaimUrl(claim.claimUrl, baseUrl);
+        const expiresAt = io.now() + claim.expiresInSeconds * 1_000;
+        const pending = {
+            baseUrl,
+            claimRequestId: claim.claimRequestId,
+            codeVerifier: pkce.verifier,
+            expiresAt: expiresAt + CODE_WINDOW_MS,
+            finished: false,
+        };
+        const remembered = await rememberPendingLogin(environment, pending);
+        prompt = io.codePrompt();
+        // With no one at a prompt and no loopback, only `login --code` can
+        // finish, and it needs the record: refuse before a page opens that
+        // nothing could finish.
+        if (prompt === null && loopback === null && !remembered) {
+            throw cantFinishHere();
+        }
+        // Only a page this CLI opened itself may hand its code to the
+        // loopback; the printed link, opened anywhere, shows the code instead.
+        const browserOpened = await io.openUrl(loopback === null ? claimUrl : handoffUrl(claimUrl));
+        const minutes = approximateMinutes(claim.expiresInSeconds);
+        const minutesWord = minutes === 1 ? "minute" : "minutes";
+        // No one at a prompt, and no page this CLI opened can hand the code to
+        // the loopback: an agent, or a remote session. Nothing in this process
+        // could ever receive the code, so it doesn't wait: the page shows the
+        // code, and `login --code` finishes with the record.
+        const finishesElsewhere = prompt === null && (loopback === null || !browserOpened);
+        if (finishesElsewhere && !remembered) {
+            throw cantFinishHere();
+        }
+        io.out(browserOpened
+            ? "Your browser should open a Driggsby approval page. If it doesn't, open\nthis link:\n\n"
+            : "Open this link in your browser to approve access for this machine:\n\n");
+        io.out(`  ${claimUrl}\n\n`);
+        if (finishesElsewhere) {
+            io.out(`After you approve, the page shows a code. Finish signing in with:\n  ${CODE_COMMAND}\n\n`);
+            io.out(`The link is good for about ${minutes} ${minutesWord}.\n`);
+            return;
+        }
+        io.out(`Waiting for your approval (the link is good for about ${minutes} ${minutesWord})...\n`);
+        if (prompt === null && remembered) {
+            io.out(`If the page shows a code instead, finish with:\n  ${CODE_COMMAND}\n`);
+        }
+        const finish = await awaitTokenOrElsewhere(pending, awaitToken({
+            baseUrl,
+            claimRequestId: claim.claimRequestId,
+            pollSecret: claim.pollSecret,
+            codeVerifier: pkce.verifier,
+            deadline: expiresAt,
+            landingUrl: claimUrl,
+            loopback,
+            prompt,
+            promptQuestion: "If the page shows a code instead, paste it here: ",
+        }, io), remembered, environment, io);
+        prompt?.close();
+        prompt = null;
+        // The claim is spent either way; only this sign-in's own record goes.
+        await forgetPendingLogin(environment, pending, io);
+        if (finish.kind === "elsewhere") {
+            io.out("\nThis sign-in was finished by npx driggsby@latest login --code in\n" +
+                "another command; its output says where the token was saved.\n");
+            return;
+        }
+        await finishSignIn(finish.appToken, environment, io);
+    }
+    finally {
+        prompt?.close();
+        loopback?.close();
+    }
+}
+// driggsby login --code <CODE>: finish the sign-in waiting on this computer
+// with the code its approval page showed.
+export async function runLoginWithCode(code, environment = defaultCredentialEnvironment(), io = defaultLoginIo()) {
+    const baseUrl = apiBaseUrl(environment.env);
+    const pending = await readPendingLogin(environment.homeDirectory, io.now());
+    if (pending?.baseUrl !== baseUrl) {
+        throw new CliError("No sign-in is waiting for a code on this computer. It may have expired.\n\n" +
+            `Start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+    }
+    if (pending.finished) {
+        throw new CliError(`This sign-in already finished.\n\nTo sign in again:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+    }
+    const result = await tradeWithRetries(pending, code.trim(), io);
+    if (result.kind === "unreachable") {
+        throw new CliError(`${result.message}\n\nYour code may still work: run the same command again in a minute.\n` +
+            `Or start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+    }
+    if (result.kind === "rejected") {
+        // One record per computer: a newer `login` replaced an older one's.
+        throw new CliError(`${result.message}\n\nCheck the code and run the command again. Only the code from the latest\n` +
+            `sign-in started on this computer works here. Or start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+    }
+    // Marked once the claim is spent, before the token is saved: a login
+    // still waiting on this claim sees it finished here, not failed.
+    await markFinished(environment, pending, io);
+    await finishSignIn(result.appToken, environment, io);
+}
+async function finishSignIn(appToken, environment, io) {
     // Warnings are held back and printed after the "Approved." line — and when
     // one fires, it replaces the all-clear closer: the last thing the user
     // reads must never contradict a warning they were just shown.
@@ -53,6 +162,81 @@ export async function runLogin(environment = defaultCredentialEnvironment(), io
     }
     io.out("\nNext:\n  You're all set — driggsby commands will use this saved token\n  automatically. Deploy an app with npx driggsby@latest deploy.\n");
 }
+// The record `login --code` finishes from. Best effort: without it, the
+// loopback and the prompt still work. True once it is saved.
+async function rememberPendingLogin(environment, pending) {
+    try {
+        await savePendingLogin(environment.homeDirectory, pending);
+        return true;
+    }
+    catch {
+        // The credential save reports an unwritable home directory itself.
+        return false;
+    }
+}
+// The wait's token, or "elsewhere" when `login --code` in another command
+// finished this very sign-in meanwhile: the claim reads gone, and this
+// claim's record says finished. Any other failure also ends this sign-in
+// for good, so its record goes with it.
+async function awaitTokenOrElsewhere(pending, wait, remembered, environment, io) {
+    try {
+        return { kind: "token", appToken: await wait };
+    }
+    catch (error) {
+        if (remembered && error instanceof ClaimGone && (await finishedElsewhere(environment, pending, io))) {
+            return { kind: "elsewhere" };
+        }
+        await forgetPendingLogin(environment, pending, io);
+        throw error;
+    }
+}
+// `login --code` marks the record just after its trade spends the claim,
+// so a poll can read gone a moment before the mark lands: a record still
+// this claim's but not yet finished is read once more after a pause.
+async function finishedElsewhere(environment, pending, io) {
+    for (let look = 1;; look += 1) {
+        let current;
+        try {
+            current = await readPendingLogin(environment.homeDirectory, io.now());
+        }
+        catch {
+            return false;
+        }
+        if (current?.claimRequestId !== pending.claimRequestId) {
+            return false;
+        }
+        if (current.finished || look >= 2) {
+            return current.finished;
+        }
+        await io.sleep(FINISH_MARK_WAIT_MS);
+    }
+}
+async function forgetPendingLogin(environment, pending, io) {
+    try {
+        await clearPendingLogin(environment.homeDirectory, pending.claimRequestId, io.now());
+    }
+    catch {
+        // It expires on its own.
+    }
+}
+async function markFinished(environment, pending, io) {
+    try {
+        await markPendingLoginFinished(environment.homeDirectory, pending.claimRequestId, io.now());
+    }
+    catch {
+        // Only a login still waiting on this claim reads it, and it then
+        // reports the claim gone: the token below is saved all the same.
+    }
+}
+function cantFinishHere() {
+    return new CliError("We couldn't save this sign-in on this machine to finish it later, so it\n" +
+        `can't finish here. Run it in a terminal instead:\n  ${LOGIN_RETRY_COMMAND}`, 1);
+}
+function handoffUrl(claimUrl) {
+    const url = new URL(claimUrl);
+    url.searchParams.set("handoff", "loopback");
+    return url.href;
+}
 // The one-time token is already consumed by the time saving starts, so a
 // storage failure must say clearly that a fresh sign-in is needed — never
 // the generic "something went wrong".
@@ -68,12 +252,12 @@ async function storeApprovedToken(appToken, environment, warn) {
             `on this machine. Please sign in again:\n  ${LOGIN_RETRY_COMMAND}`, 1);
     }
 }
-async function createClaim(baseUrl) {
+async function createClaim(baseUrl, pkce) {
     try {
         // This computer's name goes only to Driggsby (or a local run), never
         // to another host a base-URL override names.
         const device = baseUrlMayReceiveSavedSignIn(baseUrl) ? describeDevice() : { name: null, system: null };
-        return await createClaimRequest(baseUrl, device);
+        return await createClaimRequest(baseUrl, pkce, device);
     }
     catch (error) {
         const blocked = blockedNetworkError(error, {
@@ -112,27 +296,6 @@ function approvedClaimUrl(rawClaimUrl, baseUrl) {
     }
     return sanitizeForTerminal(parsed.href);
 }
-async function pollUntilApproved(baseUrl, claim, io) {
-    const deadline = io.now() + claim.expiresInSeconds * 1_000;
-    const credentials = { claimRequestId: claim.claimRequestId, pollSecret: claim.pollSecret };
-    while (io.now() < deadline) {
-        await io.sleep(io.pollIntervalMs);
-        const result = await pollClaimRequest(baseUrl, credentials);
-        switch (result.kind) {
-            case "approved":
-                // The token is delivered exactly once; from here on, never poll again.
-                return result.appToken;
-            case "gone":
-                throw new CliError("This sign-in link is no longer active — it may have been declined or timed out.\n\n" +
-                    `Start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
-            case "pending":
-            case "transient":
-                break;
-        }
-    }
-    throw new CliError("The sign-in link expired before it was approved.\n\n" +
-        `Start a fresh sign-in:\n  ${LOGIN_RETRY_COMMAND}`, 1);
-}
 // DRIGGSBY_TOKEN outranks every saved token, so a login that saved one has
 // not actually changed which token commands use. The warning joins the same
 // held-back channel as storage warnings: after the "Approved." line, in

package/dist/login/loopback.js

@@ -0,0 +1,153 @@
+// The loopback listener for driggsby login (RFC 8252). When this CLI opens
+// Driggsby's approval page itself, approving there sends the browser to
+// http://127.0.0.1:<port>/callback with the one-time code (or
+// error=access_denied). A browser on any other computer lands on its own
+// loopback, where nothing listens, so the code reaches only this machine.
+//
+// Any page in any browser on this computer can also reach the loopback, so
+// a callback proves nothing by itself: the caller trades each code (only
+// the approval's real code works with this CLI's verifier) and confirms a
+// denial with Driggsby before believing it. Each callback's browser waits
+// until the caller answers it: a real one goes back to the Driggsby page
+// that says how the sign-in went, and a refused one learns nothing, not
+// even where that page is. Once the sign-in has ended, a callback taken
+// before the listener closes goes back to that page, which by then can only
+// say it is over; one still held when it closes is told it can close the
+// tab.
+import { createServer } from "node:http";
+const HOST = "127.0.0.1";
+const CALLBACK_PATH = "/callback";
+// Driggsby's codes are four groups of five; anything else is not one.
+const CODE_PATTERN = /^[A-Za-z0-9-]{1,64}$/;
+// A browser is never left hanging if a callback goes unanswered.
+const HELD_RESPONSE_MS = 30_000;
+// Callbacks waiting for the caller; more than this is someone knocking.
+const MAX_QUEUED = 32;
+const HEADERS = { "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" };
+// null when this environment can't listen on the loopback (a sandbox that
+// forbids it): the approval page then shows the code to paste instead.
+export function startLoopback() {
+    return new Promise((resolve) => {
+        const queued = [];
+        const waiting = [];
+        // Each waiting browser, with the timer that answers it if no one does.
+        const held = new Map();
+        let port = 0;
+        const server = createServer((request, response) => {
+            const parsed = readCallback(request, port);
+            if (parsed === null || queued.length >= MAX_QUEUED) {
+                response.writeHead(404, { ...HEADERS, "Content-Type": "text/plain; charset=utf-8" });
+                response.end("Not found\n");
+                return;
+            }
+            const settle = (landingUrl, refused) => {
+                clearTimeout(held.get(response));
+                held.delete(response);
+                answer(response, landingUrl, refused);
+            };
+            held.set(response, setTimeout(() => {
+                settle(null, false);
+            }, HELD_RESPONSE_MS));
+            const reply = {
+                answer: (landingUrl) => {
+                    settle(landingUrl, false);
+                },
+                refuse: () => {
+                    settle(null, true);
+                },
+            };
+            const callback = parsed.kind === "code" ? { kind: "code", code: parsed.code, ...reply } : { kind: "denied", ...reply };
+            const taker = waiting.shift();
+            if (taker === undefined) {
+                queued.push(callback);
+            }
+            else {
+                taker(callback);
+            }
+        });
+        let stopped = false;
+        const stop = () => {
+            if (stopped) {
+                return;
+            }
+            stopped = true;
+            for (const [response, timer] of held) {
+                clearTimeout(timer);
+                answer(response, null, false);
+            }
+            held.clear();
+            server.close();
+            server.closeAllConnections();
+        };
+        // Before listening, an error means this CLI can't listen here; after,
+        // any error (an accept failure, say) stops the listener rather than
+        // the command.
+        let listening = false;
+        server.on("error", () => {
+            if (listening) {
+                stop();
+            }
+            else {
+                resolve(null);
+            }
+        });
+        server.listen(0, HOST, () => {
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                stop();
+                resolve(null);
+                return;
+            }
+            port = address.port;
+            listening = true;
+            resolve({
+                redirectUri: `http://${HOST}:${port}${CALLBACK_PATH}`,
+                next: () => {
+                    const ready = queued.shift();
+                    return ready === undefined ? new Promise((take) => waiting.push(take)) : Promise.resolve(ready);
+                },
+                close: stop,
+            });
+        });
+    });
+}
+// Only a GET for /callback, addressed to this very listener (a Host header
+// naming anything else is a DNS-rebinding page, not Driggsby's redirect),
+// carrying a code or Driggsby's denial. Everything else is ignored.
+function readCallback(request, port) {
+    if (request.method !== "GET" || request.headers.host !== `${HOST}:${port}`) {
+        return null;
+    }
+    let url;
+    try {
+        url = new URL(request.url ?? "", `http://${HOST}:${port}`);
+    }
+    catch {
+        return null;
+    }
+    if (url.pathname !== CALLBACK_PATH) {
+        return null;
+    }
+    const code = url.searchParams.get("code");
+    if (code !== null && CODE_PATTERN.test(code)) {
+        return { kind: "code", code };
+    }
+    return url.searchParams.get("error") === "access_denied" ? { kind: "denied" } : null;
+}
+function answer(response, landingUrl, refused) {
+    if (response.writableEnded) {
+        return;
+    }
+    if (refused) {
+        response.writeHead(400, { ...HEADERS, "Content-Type": "text/plain; charset=utf-8" });
+        response.end("This sign-in callback wasn't accepted.\n");
+        return;
+    }
+    if (landingUrl === null) {
+        response.writeHead(200, { ...HEADERS, "Content-Type": "text/plain; charset=utf-8" });
+        response.end("You can close this tab and go back to your terminal.\n");
+        return;
+    }
+    response.writeHead(303, { ...HEADERS, Location: landingUrl });
+    response.end();
+}

package/dist/login/pending.js

@@ -0,0 +1,68 @@
+// The sign-in waiting for its code, kept at ~/.driggsby/pending-login.json
+// (owner-only, like the saved token) so `driggsby login --code <CODE>` can
+// finish it from another command: an agent without a terminal prompt runs
+// login, the person approves in a browser elsewhere, and the agent finishes
+// with the code the page showed. The verifier alone mints nothing, and a
+// record is ignored once it expires.
+//
+// Only the command that started a sign-in removes its record. `login
+// --code` marks it finished instead, so a login still waiting on the same
+// claim can tell the sign-in finished there rather than failed.
+import { readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { driggsbyDirectory, writeOwnerOnlyFile } from "../owner-only-file.js";
+const PENDING_FILE_NAME = "pending-login.json";
+export async function savePendingLogin(homeDirectory, pending) {
+    const body = {
+        base_url: pending.baseUrl,
+        claim_request_id: pending.claimRequestId,
+        code_verifier: pending.codeVerifier,
+        expires_at: pending.expiresAt,
+        finished: pending.finished,
+    };
+    await writeOwnerOnlyFile(homeDirectory, PENDING_FILE_NAME, `${JSON.stringify(body, null, 2)}\n`);
+}
+// null when nothing is waiting, the record is unreadable, or it expired.
+export async function readPendingLogin(homeDirectory, now) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(pendingPath(homeDirectory), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        return null;
+    }
+    const record = parsed;
+    const { base_url: baseUrl, claim_request_id: claimRequestId, code_verifier: codeVerifier } = record;
+    const expiresAt = record.expires_at;
+    if (typeof baseUrl !== "string" ||
+        typeof claimRequestId !== "string" ||
+        typeof codeVerifier !== "string" ||
+        typeof expiresAt !== "number" ||
+        expiresAt <= now) {
+        return null;
+    }
+    return { baseUrl, claimRequestId, codeVerifier, expiresAt, finished: record.finished === true };
+}
+// Removes the record only while it is still this claim's: a newer sign-in
+// may have replaced it.
+export async function clearPendingLogin(homeDirectory, claimRequestId, now) {
+    const current = await readPendingLogin(homeDirectory, now);
+    if (current === null || current.claimRequestId === claimRequestId) {
+        await rm(pendingPath(homeDirectory), { force: true });
+    }
+}
+// Marks the record finished only while it is still this claim's (a newer
+// sign-in may have replaced it), and drops the spent verifier with it.
+export async function markPendingLoginFinished(homeDirectory, claimRequestId, now) {
+    const current = await readPendingLogin(homeDirectory, now);
+    if (current?.claimRequestId !== claimRequestId) {
+        return;
+    }
+    await savePendingLogin(homeDirectory, { ...current, codeVerifier: "", finished: true });
+}
+function pendingPath(homeDirectory) {
+    return join(driggsbyDirectory(homeDirectory), PENDING_FILE_NAME);
+}

package/dist/login/pkce.js

@@ -0,0 +1,14 @@
+// PKCE for driggsby login (RFC 7636, S256). The verifier never leaves this
+// process except to trade the one-time code the approval page produced;
+// Driggsby mints the token only for the code and the verifier together, so
+// whoever else holds the approval link gets nothing from someone's approval.
+import { createHash, randomBytes } from "node:crypto";
+export function createPkcePair() {
+    // 32 random bytes are 43 base64url characters: the RFC's minimum length
+    // and 256 bits of entropy.
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: challengeFor(verifier) };
+}
+export function challengeFor(verifier) {
+    return createHash("sha256").update(verifier, "ascii").digest("base64url");
+}

package/dist/login/sleep.js

@@ -0,0 +1,21 @@
+// A sleep that ends early, quietly, once its signal aborts, so a finished
+// wait never holds the process open. Its abort listener goes when the
+// timer fires too: a wait that sleeps every few seconds on one signal
+// must not pile listeners onto it (Node warns past ten).
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted === true) {
+            resolve();
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            resolve();
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}

package/dist/login/terminal-prompt.js

@@ -0,0 +1,51 @@
+// The code prompt for driggsby login on a real terminal: null when stdin or
+// stdout isn't one (an agent running the command). One close listener
+// settles whichever question is open, and closing mid-question ends its
+// line, so what prints next starts on a fresh one. Ctrl-C at the prompt
+// ends the command, as it does everywhere else.
+import { createInterface } from "node:readline";
+import {} from "./await-token.js";
+export function terminalCodePrompt() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        return null;
+    }
+    const lines = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    let closed = false;
+    let open = null;
+    lines.on("close", () => {
+        closed = true;
+        const settle = open;
+        open = null;
+        settle?.(null);
+    });
+    lines.on("SIGINT", () => {
+        if (open !== null) {
+            process.stdout.write("\n");
+        }
+        lines.close();
+        process.kill(process.pid, "SIGINT");
+    });
+    return {
+        ask: (question) => {
+            if (closed) {
+                return Promise.resolve(null);
+            }
+            return new Promise((resolve) => {
+                open = resolve;
+                lines.question(question, (answer) => {
+                    open = null;
+                    resolve(answer);
+                });
+            });
+        },
+        close: () => {
+            if (closed) {
+                return;
+            }
+            if (open !== null) {
+                process.stdout.write("\n");
+            }
+            lines.close();
+        },
+    };
+}

package/dist/main.js

@@ -12,7 +12,7 @@ import { runRollback } from "./deploy/rollback-command.js";
 import { runVersions } from "./deploy/versions-command.js";
 import { runQuery } from "./query/query-command.js";
 import { runRules } from "./rules/rules-command.js";
-import { runLogin } from "./login/login.js";
+import { runLogin, runLoginWithCode } from "./login/login.js";
 import { runLogout } from "./login/logout.js";
 import { runMcpSetup } from "./mcp-setup/setup.js";
 import { VERSION } from "./version.js";
@@ -31,7 +31,7 @@ async function run(argv) {
             await runMcpSetup({ client: command.client, print: command.print, scope: command.scope });
             return 0;
         case "login":
-            await runLogin();
+            await (command.code === null ? runLogin() : runLoginWithCode(command.code));
             return 0;
         case "logout":
             return await runLogout();

package/dist/mcp-setup/classify.js

@@ -19,9 +19,12 @@ function reportsMissingConfig(text) {
 function matchesExpectedConfig(client, scope, text) {
     switch (client) {
         case "claude-code":
+            // An entry an earlier version gave device headers doesn't match:
+            // Claude Code doesn't send its sign-in on requests to it.
             return (hasLine(text, "Type: http") &&
                 hasLine(text, `URL: ${DRIGGSBY_MCP_URL}`) &&
-                hasClaudeScope(text, scope ?? "user"));
+                hasClaudeScope(text, scope ?? "user") &&
+                !text.includes("X-Driggsby-Device-"));
         case "codex":
             return (text.includes('"enabled": true') &&
                 text.includes('"type": "streamable_http"') &&

package/dist/mcp-setup/commands.js

@@ -1,11 +1,8 @@
 import {} from "./known-client.js";
 export const DRIGGSBY_MCP_URL = "https://app.driggsby.com/mcp";
-// headers: this computer's name and system for Driggsby's MCP page
-// (device.ts builds them from allowlisted values only). Claude Code takes
-// them after the URL (--header is variadic, so before the name it would
-// swallow it); Codex has no header option, so it never gets any. The
-// commands printed for a person to run carry none.
-export function buildInstallerCommand(client, scope, headers = []) {
+// The plain entry, with no custom headers: Claude Code doesn't send its
+// sign-in on requests to an entry that carries them.
+export function buildInstallerCommand(client, scope) {
     switch (client) {
         case "claude-code":
             return {
@@ -19,7 +16,6 @@ export function buildInstallerCommand(client, scope, headers = []) {
                     scope ?? "user",
                     "driggsby",
                     DRIGGSBY_MCP_URL,
-                    ...headers.flatMap((header) => ["--header", header]),
                 ],
             };
         case "codex":

package/dist/mcp-setup/setup.js

@@ -1,6 +1,5 @@
 import { createInterface } from "node:readline/promises";
 import { CliError } from "../cli-error.js";
-import { describeDevice, deviceHeaders } from "../device.js";
 import { trimLikeRust } from "../terminal-text.js";
 import { runClientCommand } from "./client-command.js";
 import { classifyExistingMcpConfig } from "./classify.js";
@@ -25,11 +24,7 @@ export async function runMcpSetup(options) {
         return;
     }
     write(`Adding Driggsby to ${displayName(client)} MCP config...\n`);
-    // The command it runs also names this computer (Claude Code only); the
-    // commands it prints for a person stay the plain, portable ones.
-    const headers = installClient === "claude-code" ? deviceHeaders(describeDevice()) : [];
-    const runInstaller = buildInstallerCommand(installClient, options.scope, headers);
-    const result = await runClientCommand(runInstaller, streamConfigOutput(client));
+    const result = await runClientCommand(installer, streamConfigOutput(client));
     switch (result.kind) {
         case "output":
             if (result.output.succeeded) {

package/dist/mcp-setup/spawn-plan.js

@@ -5,9 +5,8 @@
 // PATH + PATHEXT (never the current directory, which Windows shells would
 // search first) and run shims through an explicit, absolute cmd.exe
 // invocation with our own quoting. Real commands only ever carry fixed
-// constant arguments (see commands.ts) or this computer's name and system,
-// allowlisted by device.ts to characters cmd.exe treats as plain; nothing
-// user-controlled may ever flow into a spawn plan.
+// constant arguments (see commands.ts); nothing user-controlled may ever
+// flow into a spawn plan.
 import { existsSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import {} from "./commands.js";
@@ -81,9 +80,8 @@ export function resolveWindowsProgram(program, lookup = defaultLookup()) {
 // (the cmd convention) and trailing backslashes doubled (so a path ending
 // in \ cannot escape the closing quote for the child's own parser). The
 // safe set covers every constant argument the CLI actually runs, including
-// the MCP URL; only fixed constants, PATH-resolved program paths, and the
-// device values device.ts allowlists (no % ! ^ & | < > " \ or control
-// characters) may reach this function.
+// the MCP URL; only fixed constants and PATH-resolved program paths may
+// reach this function.
 export function quoteForCmd(value) {
     if (/^[A-Za-z0-9_\-.:\\/=]+$/.test(value)) {
         return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driggsby",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Set up and build on Driggsby, the MCP server for personal finance.",
   "license": "Apache-2.0",
   "repository": {
@@ -28,7 +28,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@driggsby/deploy": "0.6.2",
-    "@driggsby/sdk": "0.6.2"
+    "@driggsby/deploy": "0.7.0",
+    "@driggsby/sdk": "0.7.0"
   }
 }