neoagent 3.2.1-beta.1 → 3.2.1-beta.3

package/flutter_app/windows/runner/flutter_window.cpp

@@ -6,6 +6,7 @@
 #include <shellapi.h>
 #include <windows.h>
 
+#include <algorithm>
 #include <cctype>
 #include <cstring>
 #include <cwchar>
@@ -162,6 +163,24 @@ DisplayInfo ResolveDisplay(const std::string& requested_id) {
              : displays.front();
 }
 
+POINT CapturedPixelToDesktopPoint(const DisplayInfo& display, int x, int y) {
+  const int width = std::max(
+      1, static_cast<int>(display.rect.right - display.rect.left));
+  const int height = std::max(
+      1, static_cast<int>(display.rect.bottom - display.rect.top));
+  return POINT{
+      display.rect.left + std::clamp(x, 0, width - 1),
+      display.rect.top + std::clamp(y, 0, height - 1),
+  };
+}
+
+POINT DisplayCenterPoint(const DisplayInfo& display) {
+  return POINT{
+      display.rect.left + ((display.rect.right - display.rect.left) / 2),
+      display.rect.top + ((display.rect.bottom - display.rect.top) / 2),
+  };
+}
+
 CLSID PngEncoderClsid() {
   UINT count = 0;
   UINT size = 0;
@@ -219,6 +238,10 @@ EncodableList DisplaysToEncodable() {
     EncodableMap item;
     item[EncodableValue("id")] = EncodableValue(WideToUtf8(display.id));
     item[EncodableValue("label")] = EncodableValue(WideToUtf8(display.label));
+    item[EncodableValue("x")] =
+        EncodableValue(static_cast<int>(display.rect.left));
+    item[EncodableValue("y")] =
+        EncodableValue(static_cast<int>(display.rect.top));
     item[EncodableValue("width")] = EncodableValue(width);
     item[EncodableValue("height")] = EncodableValue(height);
     item[EncodableValue("scaleFactor")] = EncodableValue(1.0);
@@ -305,18 +328,19 @@ bool IsWorkstationLocked() {
   return _wcsicmp(name, L"Default") != 0;
 }
 
-void SendMouseButton(DWORD flag) {
+bool SendMouseButton(DWORD flag) {
   INPUT input{};
   input.type = INPUT_MOUSE;
   input.mi.dwFlags = flag;
-  SendInput(1, &input, sizeof(INPUT));
+  return SendInput(1, &input, sizeof(INPUT)) == 1;
 }
 
 WORD VirtualKeyForString(const std::string& key) {
   const std::string lowered = [&]() {
     std::string value = key;
     for (auto& ch : value) {
-      ch = static_cast<char>(tolower(ch));
+      ch = static_cast<char>(
+          std::tolower(static_cast<unsigned char>(ch)));
     }
     return value;
   }();
@@ -332,17 +356,21 @@ WORD VirtualKeyForString(const std::string& key) {
   return 0;
 }
 
-void SendVirtualKey(WORD key_code) {
+bool SendVirtualKey(WORD key_code) {
   INPUT inputs[2]{};
   inputs[0].type = INPUT_KEYBOARD;
   inputs[0].ki.wVk = key_code;
   inputs[1].type = INPUT_KEYBOARD;
   inputs[1].ki.wVk = key_code;
   inputs[1].ki.dwFlags = KEYEVENTF_KEYUP;
-  SendInput(2, inputs, sizeof(INPUT));
+  const UINT sent = SendInput(2, inputs, sizeof(INPUT));
+  if (sent == 1) {
+    SendInput(1, &inputs[1], sizeof(INPUT));
+  }
+  return sent == 2;
 }
 
-void SendUnicodeText(const std::wstring& text) {
+bool SendUnicodeText(const std::wstring& text) {
   for (const wchar_t ch : text) {
     INPUT inputs[2]{};
     inputs[0].type = INPUT_KEYBOARD;
@@ -351,8 +379,13 @@ void SendUnicodeText(const std::wstring& text) {
     inputs[1].type = INPUT_KEYBOARD;
     inputs[1].ki.dwFlags = KEYEVENTF_UNICODE | KEYEVENTF_KEYUP;
     inputs[1].ki.wScan = ch;
-    SendInput(2, inputs, sizeof(INPUT));
+    const UINT sent = SendInput(2, inputs, sizeof(INPUT));
+    if (sent == 1) {
+      SendInput(1, &inputs[1], sizeof(INPUT));
+    }
+    if (sent != 2) return false;
   }
+  return true;
 }
 
 }  // namespace
@@ -462,19 +495,59 @@ bool FlutterWindow::OnCreate() {
           }
           int x = 0;
           int y = 0;
-          GetInt(*arguments, "x", &x);
-          GetInt(*arguments, "y", &y);
+          if (!GetInt(*arguments, "x", &x) ||
+              !GetInt(*arguments, "y", &y)) {
+            result->Error("invalid_arguments", "Missing click coordinates.");
+            return;
+          }
           const std::string button = GetString(*arguments, "button", "left");
-          SetCursorPos(x, y);
+          const DisplayInfo display =
+              ResolveDisplay(GetString(*arguments, "displayId"));
+          const POINT point = CapturedPixelToDesktopPoint(display, x, y);
+          if (!SetCursorPos(point.x, point.y)) {
+            result->Error("input_failed", "Unable to move the desktop cursor.");
+            return;
+          }
+          bool sent = false;
           if (button == "right") {
-            SendMouseButton(MOUSEEVENTF_RIGHTDOWN);
-            SendMouseButton(MOUSEEVENTF_RIGHTUP);
+            const bool down = SendMouseButton(MOUSEEVENTF_RIGHTDOWN);
+            const bool up = SendMouseButton(MOUSEEVENTF_RIGHTUP);
+            sent = down && up;
           } else if (button == "middle") {
-            SendMouseButton(MOUSEEVENTF_MIDDLEDOWN);
-            SendMouseButton(MOUSEEVENTF_MIDDLEUP);
+            const bool down = SendMouseButton(MOUSEEVENTF_MIDDLEDOWN);
+            const bool up = SendMouseButton(MOUSEEVENTF_MIDDLEUP);
+            sent = down && up;
           } else {
-            SendMouseButton(MOUSEEVENTF_LEFTDOWN);
-            SendMouseButton(MOUSEEVENTF_LEFTUP);
+            const bool down = SendMouseButton(MOUSEEVENTF_LEFTDOWN);
+            const bool up = SendMouseButton(MOUSEEVENTF_LEFTUP);
+            sent = down && up;
+          }
+          if (!sent) {
+            result->Error("input_failed", "Unable to send the desktop click.");
+            return;
+          }
+          result->Success(EncodableValue());
+          return;
+        }
+
+        if (call.method_name() == "mouseMove") {
+          if (arguments == nullptr) {
+            result->Error("invalid_arguments", "Missing mouseMove payload.");
+            return;
+          }
+          int x = 0;
+          int y = 0;
+          if (!GetInt(*arguments, "x", &x) ||
+              !GetInt(*arguments, "y", &y)) {
+            result->Error("invalid_arguments", "Missing mouseMove coordinates.");
+            return;
+          }
+          const DisplayInfo display =
+              ResolveDisplay(GetString(*arguments, "displayId"));
+          const POINT point = CapturedPixelToDesktopPoint(display, x, y);
+          if (!SetCursorPos(point.x, point.y)) {
+            result->Error("input_failed", "Unable to move the desktop cursor.");
+            return;
           }
           result->Success(EncodableValue());
           return;
@@ -486,22 +559,40 @@ bool FlutterWindow::OnCreate() {
             return;
           }
           int x1 = 0, y1 = 0, x2 = 0, y2 = 0, duration_ms = 280;
-          GetInt(*arguments, "x1", &x1);
-          GetInt(*arguments, "y1", &y1);
-          GetInt(*arguments, "x2", &x2);
-          GetInt(*arguments, "y2", &y2);
+          if (!GetInt(*arguments, "x1", &x1) ||
+              !GetInt(*arguments, "y1", &y1) ||
+              !GetInt(*arguments, "x2", &x2) ||
+              !GetInt(*arguments, "y2", &y2)) {
+            result->Error("invalid_arguments", "Missing drag coordinates.");
+            return;
+          }
           GetInt(*arguments, "durationMs", &duration_ms);
+          duration_ms = std::clamp(duration_ms, 40, 2000);
+          const DisplayInfo display =
+              ResolveDisplay(GetString(*arguments, "displayId"));
+          const POINT start = CapturedPixelToDesktopPoint(display, x1, y1);
+          const POINT end = CapturedPixelToDesktopPoint(display, x2, y2);
           const int steps = std::max(4, std::min(90, duration_ms / 16));
-          SetCursorPos(x1, y1);
-          SendMouseButton(MOUSEEVENTF_LEFTDOWN);
+          if (!SetCursorPos(start.x, start.y) ||
+              !SendMouseButton(MOUSEEVENTF_LEFTDOWN)) {
+            result->Error("input_failed", "Unable to begin the desktop drag.");
+            return;
+          }
+          bool moved = true;
           for (int step = 1; step <= steps; ++step) {
             const double t = static_cast<double>(step) / steps;
-            const int nx = static_cast<int>(std::lround(x1 + ((x2 - x1) * t)));
-            const int ny = static_cast<int>(std::lround(y1 + ((y2 - y1) * t)));
-            SetCursorPos(nx, ny);
+            const int nx = static_cast<int>(
+                std::lround(start.x + ((end.x - start.x) * t)));
+            const int ny = static_cast<int>(
+                std::lround(start.y + ((end.y - start.y) * t)));
+            moved = SetCursorPos(nx, ny) && moved;
             Sleep(std::max(1, duration_ms / std::max(1, steps)));
           }
-          SendMouseButton(MOUSEEVENTF_LEFTUP);
+          const bool released = SendMouseButton(MOUSEEVENTF_LEFTUP);
+          if (!moved || !released) {
+            result->Error("input_failed", "Unable to complete the desktop drag.");
+            return;
+          }
           result->Success(EncodableValue());
           return;
         }
@@ -515,19 +606,31 @@ bool FlutterWindow::OnCreate() {
           int delta_y = 0;
           GetInt(*arguments, "deltaX", &delta_x);
           GetInt(*arguments, "deltaY", &delta_y);
+          const DisplayInfo display =
+              ResolveDisplay(GetString(*arguments, "displayId"));
+          const POINT anchor = DisplayCenterPoint(display);
+          if (!SetCursorPos(anchor.x, anchor.y)) {
+            result->Error("input_failed", "Unable to position the desktop scroll.");
+            return;
+          }
+          bool sent = true;
           if (delta_y != 0) {
             INPUT input{};
             input.type = INPUT_MOUSE;
             input.mi.dwFlags = MOUSEEVENTF_WHEEL;
             input.mi.mouseData = static_cast<DWORD>(delta_y);
-            SendInput(1, &input, sizeof(INPUT));
+            sent = SendInput(1, &input, sizeof(INPUT)) == 1 && sent;
           }
           if (delta_x != 0) {
             INPUT input{};
             input.type = INPUT_MOUSE;
             input.mi.dwFlags = MOUSEEVENTF_HWHEEL;
             input.mi.mouseData = static_cast<DWORD>(delta_x);
-            SendInput(1, &input, sizeof(INPUT));
+            sent = SendInput(1, &input, sizeof(INPUT)) == 1 && sent;
+          }
+          if (!sent) {
+            result->Error("input_failed", "Unable to send the desktop scroll.");
+            return;
           }
           result->Success(EncodableValue());
           return;
@@ -540,11 +643,16 @@ bool FlutterWindow::OnCreate() {
           }
           const std::wstring text = Utf8ToWide(GetString(*arguments, "text", ""));
           const bool press_enter = GetBool(*arguments, "pressEnter", false);
+          bool sent = true;
           if (!text.empty()) {
-            SendUnicodeText(text);
+            sent = SendUnicodeText(text);
+          }
+          if (press_enter && sent) {
+            sent = SendVirtualKey(VK_RETURN);
           }
-          if (press_enter) {
-            SendVirtualKey(VK_RETURN);
+          if (!sent) {
+            result->Error("input_failed", "Unable to send desktop text input.");
+            return;
           }
           result->Success(EncodableValue());
           return;
@@ -561,7 +669,10 @@ bool FlutterWindow::OnCreate() {
             result->Error("unsupported_key", "Key is not supported.");
             return;
           }
-          SendVirtualKey(virtual_key);
+          if (!SendVirtualKey(virtual_key)) {
+            result->Error("input_failed", "Unable to send the desktop key.");
+            return;
+          }
           result->Success(EncodableValue());
           return;
         }

package/lib/manager.js

@@ -1,3 +1,5 @@
+'use strict';
+
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -22,7 +24,9 @@ const {
   PID_FILE,
   getDefaultVmBaseImageUrl,
   ensureRuntimeDirs,
-  migrateLegacyRuntime
+  migrateLegacyRuntime,
+  removeEnvValue: removeRuntimeEnvValue,
+  upsertEnvValue: upsertRuntimeEnvValue,
 } = require('../runtime/paths');
 const {
   parseReleaseChannel,
@@ -44,6 +48,8 @@ const {
   cmdMigrateDryRun,
   cmdMigrateRun
 } = require('./migrations');
+const { fetchResponseText } = require('../server/services/network/http');
+const { abortableDelay } = require('../server/utils/retry');
 
 const APP_NAME = 'NeoAgent';
 const SERVICE_LABEL = 'com.neoagent';
@@ -71,6 +77,38 @@ const COLORS = process.stdout.isTTY
 const CLI_INTERACTIVE = process.stdout.isTTY;
 const installActionItems = [];
 
+async function fetchBoundedJsonResponse(url, init = {}, label = 'Authentication request') {
+  const { response, text } = await fetchResponseText(url, {
+    ...init,
+    redirect: init.redirect || 'error',
+    timeoutMs: 20000,
+    maxResponseBytes: 1024 * 1024,
+    serviceName: label,
+    timeoutCode: 'AUTH_HTTP_TIMEOUT',
+    tooLargeCode: 'AUTH_RESPONSE_TOO_LARGE',
+  });
+  let data = null;
+  try {
+    data = JSON.parse(text || '{}');
+  } catch {
+    data = null;
+  }
+  return { response, text, data };
+}
+
+async function fetchAuthJson(url, init = {}, label = 'Authentication request') {
+  const result = await fetchBoundedJsonResponse(url, init, label);
+  if (!result.response.ok) {
+    throw new Error(
+      `${label} failed: HTTP ${result.response.status} — ${result.text.slice(0, 500) || 'empty response'}`,
+    );
+  }
+  if (!result.data || typeof result.data !== 'object') {
+    throw new Error(`${label} returned malformed JSON.`);
+  }
+  return result.data;
+}
+
 function logInfo(msg) {
   const mark = CLI_INTERACTIVE ? `${COLORS.blue}◇${COLORS.reset}` : '->';
   console.log(`  ${mark} ${msg}`);
@@ -182,10 +220,6 @@ function sanitizeEnvKey(key) {
   return String(key).replace(/[\r\n]/g, '');
 }
 
-function sanitizeEnvValue(value) {
-  return String(value).replace(/[\r\n]/g, '');
-}
-
 function validateEnvKey(key) {
   if (!/^[A-Z][A-Z0-9_]*$/.test(key)) {
     throw new Error(`Invalid env key "${key}". Keys must be uppercase letters, digits, and underscores (e.g. PORT, ANTHROPIC_API_KEY).`);
@@ -193,33 +227,11 @@ function validateEnvKey(key) {
 }
 
 function upsertEnvValue(key, value) {
-  const safeKey = sanitizeEnvKey(key);
-  const safeValue = sanitizeEnvValue(value);
-  const raw = readEnvFileRaw();
-  const lines = raw ? raw.split('\n') : [];
-  let replaced = false;
-
-  for (let i = 0; i < lines.length; i++) {
-    if (lines[i].startsWith(`${safeKey}=`)) {
-      lines[i] = `${safeKey}=${safeValue}`;
-      replaced = true;
-      break;
-    }
-  }
-
-  if (!replaced) lines.push(`${safeKey}=${safeValue}`);
-  const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-  fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
+  upsertRuntimeEnvValue(ENV_FILE, key, value);
 }
 
 function removeEnvValue(key) {
-  const safeKey = sanitizeEnvKey(key);
-  const raw = readEnvFileRaw();
-  if (!raw) return false;
-  const lines = raw.split('\n').filter((line) => !line.startsWith(`${safeKey}=`));
-  const output = lines.filter((_, idx, arr) => idx !== arr.length - 1 || arr[idx] !== '').join('\n') + '\n';
-  fs.writeFileSync(ENV_FILE, output, { mode: 0o600 });
-  return true;
+  return removeRuntimeEnvValue(ENV_FILE, sanitizeEnvKey(key));
 }
 
 function readAdminCredentials() {
@@ -870,29 +882,52 @@ async function cmdMigrate(args = []) {
   });
 }
 
-async function pollDeviceCode({ pollUrl, pollBody, pollHeaders = {}, intervalMs, timeoutMs, onToken }) {
+async function pollDeviceCode({
+  pollUrl,
+  pollBody,
+  pollHeaders = {},
+  intervalMs,
+  timeoutMs,
+  onToken,
+  signal = null,
+}) {
   const start = Date.now();
-  let currentInterval = intervalMs;
+  let currentInterval = Math.max(1000, Number(intervalMs) || 5000);
   while (Date.now() - start < timeoutMs) {
-    await new Promise((r) => setTimeout(r, currentInterval));
-    const res = await fetch(pollUrl, {
-      method: 'POST',
-      headers: { 'Accept': 'application/json', 'Content-Type': 'application/json', ...pollHeaders },
-      body: JSON.stringify(pollBody()),
-    });
-    if (res.status === 403 || res.status === 404) continue;
-    if (!res.ok) {
-      const text = await res.text().catch(() => 'Unknown error');
-      throw new Error(`Token poll failed: HTTP ${res.status} — ${text}`);
+    await abortableDelay(currentInterval, signal);
+    let result;
+    try {
+      result = await fetchBoundedJsonResponse(pollUrl, {
+        method: 'POST',
+        headers: { 'Accept': 'application/json', 'Content-Type': 'application/json', ...pollHeaders },
+        body: JSON.stringify(pollBody()),
+        signal,
+      }, 'Device authorization poll');
+    } catch (error) {
+      if (signal?.aborted) throw signal.reason || error;
+      if (/timed out|fetch failed|ECONNRESET|ECONNREFUSED|socket/i.test(String(error?.message || error))) {
+        continue;
+      }
+      throw error;
+    }
+    const { response, text, data } = result;
+    if (response.status === 403 || response.status === 404) continue;
+    if (!response.ok) {
+      throw new Error(`Token poll failed: HTTP ${response.status} — ${text.slice(0, 500)}`);
+    }
+    if (!data || typeof data !== 'object') {
+      throw new Error('Device authorization poll returned malformed JSON.');
     }
-    const data = await res.json();
     const done = await onToken(data);
     if (done) return;
     if (data.error === 'authorization_pending') continue;
-    if (data.error === 'slow_down') { currentInterval += 5000; continue; }
+    if (data.error === 'slow_down') {
+      currentInterval = Math.min(currentInterval + 5000, 30000);
+      continue;
+    }
     if (data.error) throw new Error(`Authentication failed: ${data.error_description || data.error}`);
   }
-  throw new Error('Authentication timed out after 15 minutes.');
+  throw new Error(`Authentication timed out after ${Math.ceil(timeoutMs / 60000)} minutes.`);
 }
 
 async function cmdLoginClaudeCode() {
@@ -958,8 +993,6 @@ async function cmdLoginClaudeCode() {
   const openCmd = process.platform === 'darwin' ? 'open'
     : process.platform === 'win32' ? 'start'
     : 'xdg-open';
-  spawnSync(openCmd, [authUrl.toString()], { stdio: 'ignore' });
-
   // Start local redirect server to capture authorization code
   const authCode = await new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
@@ -983,7 +1016,7 @@ async function cmdLoginClaudeCode() {
           return;
         }
 
-        if (returnedState && returnedState !== state) {
+        if (returnedState !== state) {
           res.writeHead(200, { 'Content-Type': 'text/html' });
           res.end('<html><body><h2>Authorization failed.</h2><p>State mismatch. You can close this tab.</p></body></html>');
           clearTimeout(timeout);
@@ -998,7 +1031,10 @@ async function cmdLoginClaudeCode() {
           clearTimeout(timeout);
           server.close();
           resolve(code);
+          return;
         }
+        res.writeHead(400, { 'Content-Type': 'text/html' });
+        res.end('<html><body><h2>Authorization failed.</h2><p>Missing authorization code.</p></body></html>');
       } catch (err) {
         res.writeHead(500);
         res.end('Internal error');
@@ -1007,6 +1043,7 @@ async function cmdLoginClaudeCode() {
 
     server.listen(redirectPort, 'localhost', () => {
       logInfo(`Waiting for OAuth callback on ${redirectUri} ...`);
+      spawnSync(openCmd, [authUrl.toString()], { stdio: 'ignore' });
     });
     server.on('error', (err) => {
       clearTimeout(timeout);
@@ -1015,7 +1052,7 @@ async function cmdLoginClaudeCode() {
   });
 
   logInfo('Exchanging authorization code for access token...');
-  const tokenRes = await fetch('https://platform.claude.com/v1/oauth/token', {
+  const tokenData = await fetchAuthJson('https://platform.claude.com/v1/oauth/token', {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
@@ -1031,14 +1068,7 @@ async function cmdLoginClaudeCode() {
       scope: SCOPES,
       state,
     }),
-  });
-
-  if (!tokenRes.ok) {
-    const text = await tokenRes.text().catch(() => 'Unknown error');
-    throw new Error(`Token exchange failed: HTTP ${tokenRes.status} — ${text}`);
-  }
-
-  const tokenData = await tokenRes.json();
+  }, 'Claude Code token exchange');
   const accessToken = tokenData.access_token;
   if (!accessToken) {
     throw new Error('Token exchange succeeded but no access_token was returned.');
@@ -1087,8 +1117,6 @@ async function cmdLoginGrokOAuth() {
   const openCmd = process.platform === 'darwin' ? 'open'
     : process.platform === 'win32' ? 'start'
     : 'xdg-open';
-  spawnSync(openCmd, [authUrl.toString()], { stdio: 'ignore' });
-
   const authCode = await new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
       server.close();
@@ -1111,7 +1139,7 @@ async function cmdLoginGrokOAuth() {
           return;
         }
 
-        if (returnedState && returnedState !== state) {
+        if (returnedState !== state) {
           res.writeHead(200, { 'Content-Type': 'text/html' });
           res.end('<html><body><h2>Authorization failed.</h2><p>State mismatch. You can close this tab.</p></body></html>');
           clearTimeout(timeout);
@@ -1126,7 +1154,10 @@ async function cmdLoginGrokOAuth() {
           clearTimeout(timeout);
           server.close();
           resolve(code);
+          return;
         }
+        res.writeHead(400, { 'Content-Type': 'text/html' });
+        res.end('<html><body><h2>Authorization failed.</h2><p>Missing authorization code.</p></body></html>');
       } catch (err) {
         res.writeHead(500);
         res.end('Internal error');
@@ -1135,6 +1166,7 @@ async function cmdLoginGrokOAuth() {
 
     server.listen(redirectPort, '127.0.0.1', () => {
       logInfo(`Waiting for OAuth callback on ${redirectUri} ...`);
+      spawnSync(openCmd, [authUrl.toString()], { stdio: 'ignore' });
     });
     server.on('error', (err) => {
       clearTimeout(timeout);
@@ -1143,7 +1175,7 @@ async function cmdLoginGrokOAuth() {
   });
 
   logInfo('Exchanging authorization code for access token...');
-  const tokenRes = await fetch('https://auth.x.ai/oauth2/token', {
+  const tokenData = await fetchAuthJson('https://auth.x.ai/oauth2/token', {
     method: 'POST',
     headers: {
       'Content-Type': 'application/x-www-form-urlencoded',
@@ -1156,14 +1188,7 @@ async function cmdLoginGrokOAuth() {
       client_id: clientId,
       code_verifier: codeVerifier,
     }),
-  });
-
-  if (!tokenRes.ok) {
-    const text = await tokenRes.text().catch(() => 'Unknown error');
-    throw new Error(`Token exchange failed: HTTP ${tokenRes.status} — ${text}`);
-  }
-
-  const tokenData = await tokenRes.json();
+  }, 'Grok OAuth token exchange');
   const accessToken = tokenData.access_token;
   if (!accessToken) {
     throw new Error('Token exchange succeeded but no access_token was returned.');
@@ -1189,14 +1214,16 @@ async function cmdLogin(args = []) {
     const clientId = '01ab8ac9400c4e429b23';
     logInfo('Requesting device code from GitHub...');
 
-    const reqRes = await fetch('https://github.com/login/device/code', {
+    const deviceData = await fetchAuthJson('https://github.com/login/device/code', {
       method: 'POST',
       headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
       body: JSON.stringify({ client_id: clientId, scope: 'user:email' })
-    });
-    if (!reqRes.ok) throw new Error(`Failed to request device code: HTTP ${reqRes.status}`);
+    }, 'GitHub device-code request');
 
-    const { device_code, user_code, verification_uri, interval } = await reqRes.json();
+    const { device_code, user_code, verification_uri, interval } = deviceData;
+    if (!device_code || !user_code || !verification_uri) {
+      throw new Error('GitHub device-code response was missing required fields.');
+    }
     console.log(`\n  ${COLORS.cyan}Please visit:${COLORS.reset} ${verification_uri}`);
     console.log(`  ${COLORS.cyan}Enter code:${COLORS.reset}   ${COLORS.bold}${user_code}${COLORS.reset}\n`);
     logInfo('Waiting for authorization (timeout in 15m)...');
@@ -1221,20 +1248,17 @@ async function cmdLogin(args = []) {
     const clientId = 'app_EMoamEEZ73f0CkXaXp7hrann';
     logInfo('Requesting device code from OpenAI...');
 
-    const reqRes = await fetch('https://auth.openai.com/api/accounts/deviceauth/usercode', {
+    const data = await fetchAuthJson('https://auth.openai.com/api/accounts/deviceauth/usercode', {
       method: 'POST',
       headers: { 'Accept': 'application/json', 'Content-Type': 'application/json' },
       body: JSON.stringify({ client_id: clientId, scope: 'openid profile email offline_access model.request model.read model.create' })
-    });
-
-    if (!reqRes.ok) {
-      throw new Error(`Failed to request device code: HTTP ${reqRes.status}`);
-    }
-
-    const data = await reqRes.json();
+    }, 'OpenAI device-code request');
     const { device_auth_id, interval } = data;
     const user_code = data.user_code || data.usercode;
     const verification_uri = 'https://auth.openai.com/codex/device';
+    if (!device_auth_id || !user_code) {
+      throw new Error('OpenAI device-code response was missing required fields.');
+    }
 
     console.log(`\n  ${COLORS.cyan}Please visit:${COLORS.reset} ${verification_uri}`);
     console.log(`  ${COLORS.cyan}Enter code:${COLORS.reset}   ${COLORS.bold}${user_code}${COLORS.reset}\n`);
@@ -1257,7 +1281,7 @@ async function cmdLogin(args = []) {
     });
 
     logInfo('Exchanging authorization code for access token...');
-    const exchangeRes = await fetch('https://auth.openai.com/oauth/token', {
+    const exchangeData = await fetchAuthJson('https://auth.openai.com/oauth/token', {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
       body: new URLSearchParams({
@@ -1267,14 +1291,7 @@ async function cmdLogin(args = []) {
         client_id: clientId,
         code_verifier: codeVerifier,
       }),
-    });
-
-    if (!exchangeRes.ok) {
-      const errorText = await exchangeRes.text().catch(() => 'Unknown error');
-      throw new Error(`OpenAI token exchange failed: HTTP ${exchangeRes.status} — ${errorText}`);
-    }
-
-    const exchangeData = await exchangeRes.json();
+    }, 'OpenAI token exchange');
     if (!exchangeData.access_token) {
       throw new Error('OpenAI token exchange succeeded but did not return an access token.');
     }