theclawbay 0.3.40 → 0.3.42

package/dist/commands/link.js

@@ -16,7 +16,8 @@ class LinkCommand extends base_command_1.BaseCommand {
             const backendUrl = backendUrlFlag ?? inferredBackendUrl ?? DEFAULT_BACKEND_URL;
             await (0, config_1.writeManagedConfig)({
                 backendUrl,
-                apiKey,
+                authType: "api-key",
+                credential: apiKey,
             });
             this.log(`Linked. Managed config written to ${paths_1.managedConfigPath}`);
             this.log(`Backend: ${backendUrl}`);

package/dist/commands/logout.js

@@ -12,6 +12,8 @@ const base_command_1 = require("../lib/base-command");
 const codex_auth_seeding_1 = require("../lib/codex-auth-seeding");
 const codex_history_migration_1 = require("../lib/codex-history-migration");
 const codex_model_cache_migration_1 = require("../lib/codex-model-cache-migration");
+const config_1 = require("../lib/managed/config");
+const errors_1 = require("../lib/managed/errors");
 const supported_models_1 = require("../lib/supported-models");
 const codex_vscode_patch_1 = require("../lib/codex-vscode-patch");
 const paths_1 = require("../lib/config/paths");
@@ -58,7 +60,7 @@ function logLogoutCompactSummary(params) {
         params.log("Reverted: no local tool changes were found.");
     }
     if (params.sharedConfigChanged) {
-        params.log("Shared config: removed your API key env and managed machine setup.");
+        params.log("Shared config: removed your local credential env and managed machine setup.");
     }
     else {
         params.log("Shared config: nothing managed needed cleanup.");
@@ -710,6 +712,14 @@ class LogoutCommand extends base_command_1.BaseCommand {
         await this.runSafe(async () => {
             const { flags } = await this.parse(LogoutCommand);
             const debugOutput = flags["debug-output"];
+            let managed = null;
+            try {
+                managed = await (0, config_1.readManagedConfig)();
+            }
+            catch (error) {
+                if (!(error instanceof errors_1.ManagedConfigMissingError))
+                    throw error;
+            }
             const progress = this.createProgressHandle(!debugOutput);
             let deletedManagedPaths = 0;
             let removedEnvFile = false;
@@ -729,7 +739,31 @@ class LogoutCommand extends base_command_1.BaseCommand {
             let authSeedCleanup;
             let modelCacheCleanup;
             let codexVsCodePatchCleanup;
+            let remoteRevokeWarning = null;
             try {
+                if (managed?.authType === "device-session" && managed.credential.trim()) {
+                    progress.update("Revoking linked device");
+                    try {
+                        const response = await fetch(`${managed.backendUrl}/api/setup/device-session/revoke`, {
+                            method: "POST",
+                            headers: {
+                                Authorization: `Bearer ${managed.credential}`,
+                                Accept: "application/json",
+                            },
+                            signal: AbortSignal.timeout(10000),
+                        });
+                        if (!response.ok && response.status !== 401) {
+                            const body = (await response.json().catch(() => ({})));
+                            remoteRevokeWarning =
+                                body.error ??
+                                    `remote device revoke failed with HTTP ${response.status}`;
+                        }
+                    }
+                    catch (error) {
+                        remoteRevokeWarning =
+                            error.message || "failed to revoke linked device";
+                    }
+                }
                 progress.update("Removing shared machine config");
                 deletedManagedPaths = (await Promise.all([
                     removeFileIfExists(paths_1.managedConfigPath),
@@ -826,6 +860,9 @@ class LogoutCommand extends base_command_1.BaseCommand {
                 summaryNotes.add(codexVsCodePatchCleanup.warning);
             if (modelCacheCleanup.warning)
                 summaryNotes.add(modelCacheCleanup.warning);
+            if (remoteRevokeWarning) {
+                summaryNotes.add(`Device revoke warning: ${remoteRevokeWarning}`);
+            }
             if (!debugOutput) {
                 logLogoutCompactSummary({
                     log: (message) => this.log(message),
@@ -836,7 +873,13 @@ class LogoutCommand extends base_command_1.BaseCommand {
                 return;
             }
             this.log(`- Managed configs removed: ${deletedManagedPaths}`);
-            this.log(`- API key env file removed: ${removedEnvFile ? "yes" : "no"}`);
+            this.log(`- Local credential env file removed: ${removedEnvFile ? "yes" : "no"}`);
+            if (remoteRevokeWarning) {
+                this.log(`- Remote device revoke: ${remoteRevokeWarning}`);
+            }
+            else if (managed?.authType === "device-session") {
+                this.log("- Remote device revoke: completed.");
+            }
             this.log(`- Shell profiles updated: ${updatedShellFiles.length ? updatedShellFiles.join(", ") : "none"}`);
             this.log(`- VS Code env hooks updated: ${updatedVsCodeHooks.length ? updatedVsCodeHooks.join(", ") : "none"}`);
             this.log(`- Codex config cleaned: ${updatedCodexConfig ? "yes" : "no"}`);
@@ -909,7 +952,7 @@ class LogoutCommand extends base_command_1.BaseCommand {
         });
     }
 }
-LogoutCommand.description = "Log out from local The Claw Bay API-key auth on this machine";
+LogoutCommand.description = "Log out from local The Claw Bay auth on this machine";
 LogoutCommand.flags = {
     "debug-output": core_1.Flags.boolean({
         required: false,

package/dist/commands/setup.d.ts

@@ -4,6 +4,7 @@ export default class SetupCommand extends BaseCommand {
     static flags: {
         backend: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         "api-key": import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        "device-name": import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         clients: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         "codex-usage-ui": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/setup.js

@@ -22,6 +22,7 @@ const api_key_1 = require("../lib/managed/api-key");
 const config_1 = require("../lib/managed/config");
 const errors_1 = require("../lib/managed/errors");
 const supported_models_1 = require("../lib/supported-models");
+const device_session_auth_1 = require("../lib/device-session-auth");
 const DEFAULT_BACKEND_URL = "https://theclawbay.com";
 const DEFAULT_PROVIDER_ID = "theclawbay";
 const CLI_HTTP_USER_AGENT = "theclawbay-cli";
@@ -163,7 +164,7 @@ function logSetupCompactSummary(params) {
     else {
         params.log("Configured: no local tools selected.");
     }
-    params.log("Shared config: saved your API key and managed machine setup.");
+    params.log("Shared config: saved your The Claw Bay credential and managed machine setup.");
     if (restartTargets.length > 0) {
         params.log(`Restart if already open: ${formatSummaryList(restartTargets)}`);
     }
@@ -687,7 +688,7 @@ async function promptForSetupClients(clients) {
         let settled = false;
         let hint = clients.some((client) => client.detected)
             ? "Choose the tools you want to configure."
-            : "No supported local clients are detected yet. Apply setup will just save your managed config and API key env.";
+            : "No supported local clients are detected yet. Apply setup will just save your managed config and local credential env.";
         const stdin = process.stdin;
         const stdout = process.stdout;
         const wasRaw = stdin.isRaw;
@@ -751,7 +752,6 @@ async function promptForSetupClients(clients) {
             stdin.off("keypress", onKeypress);
             if (stdin.isTTY)
                 stdin.setRawMode(Boolean(wasRaw));
-            stdin.pause();
             stdout.write("\x1b[?25h");
             clearScreen();
             const finalSelection = new Set(options.filter((option) => option.checked).map((option) => option.id));
@@ -852,19 +852,38 @@ function resolveSetupClientSelection(params) {
 async function promptForCodexUsageUiPatch() {
     if (!process.stdin.isTTY || !process.stdout.isTTY)
         return false;
-    const rl = (0, promises_2.createInterface)({
-        input: process.stdin,
-        output: process.stdout,
+    const stdin = process.stdin;
+    const stdout = process.stdout;
+    const wasRaw = stdin.isRaw;
+    stdin.resume();
+    return new Promise((resolve) => {
+        const finish = (enabled) => {
+            stdin.off("data", onData);
+            if (stdin.isTTY)
+                stdin.setRawMode(Boolean(wasRaw));
+            stdout.write("\n");
+            resolve(enabled);
+        };
+        const onData = (chunk) => {
+            const key = chunk.toString("utf8");
+            if (key === "\u0003") {
+                stdout.write("\x1b[?25h");
+                process.exit(130);
+            }
+            const normalized = key.trim().toLowerCase();
+            if (normalized === "y" || normalized === "yes") {
+                finish(true);
+                return;
+            }
+            if (!normalized || normalized === "n" || normalized === "no") {
+                finish(false);
+            }
+        };
+        process.stdout.write("\nPatch Codex to show The Claw Bay usage remaining? [y/N] ");
+        if (stdin.isTTY)
+            stdin.setRawMode(true);
+        stdin.on("data", onData);
     });
-    try {
-        process.stdout.write("\n");
-        process.stdout.write("Patch Codex to show The Claw Bay usage remaining? [y/N] ");
-        const answer = (await rl.question("")).trim().toLowerCase();
-        return answer === "y" || answer === "yes";
-    }
-    finally {
-        rl.close();
-    }
 }
 async function resolveCodexUsageUiSelection(params) {
     if (!params.codexSelected)
@@ -875,6 +894,26 @@ async function resolveCodexUsageUiSelection(params) {
         return false;
     return promptForCodexUsageUiPatch();
 }
+async function resolveDeviceLabel(params) {
+    const fallback = node_os_1.default.hostname().trim() || "This device";
+    const preferred = (params.flagValue ?? params.managedValue ?? "").trim() || fallback;
+    if (params.flagValue?.trim())
+        return preferred;
+    if (params.skipPrompt || !process.stdin.isTTY || !process.stdout.isTTY) {
+        return preferred;
+    }
+    const rl = (0, promises_2.createInterface)({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        const answer = await rl.question(`\nName this device [${preferred}] `);
+        return answer.trim() || preferred;
+    }
+    finally {
+        rl.close();
+    }
+}
 async function fetchBackendModelIds(backendUrl, apiKey) {
     const url = `${trimTrailingSlash(backendUrl)}/api/codex-auth/v1/proxy/v1/models`;
     try {
@@ -1700,10 +1739,27 @@ class SetupCommand extends base_command_1.BaseCommand {
                 if (!(error instanceof errors_1.ManagedConfigMissingError))
                     throw error;
             }
-            const apiKey = (flags["api-key"] ?? managed?.apiKey ?? "").trim();
-            if (!apiKey)
-                throw new Error('API key is required. Run "theclawbay setup --api-key <key>".');
-            const backendRaw = flags.backend ?? (0, api_key_1.tryInferBackendUrlFromApiKey)(apiKey) ?? managed?.backendUrl ?? DEFAULT_BACKEND_URL;
+            const explicitApiKey = (flags["api-key"] ?? "").trim();
+            const managedCredential = (managed?.credential ?? "").trim();
+            const managedAuthType = managed?.authType ?? null;
+            let authType = explicitApiKey
+                ? "api-key"
+                : managedAuthType === "api-key"
+                    ? "api-key"
+                    : "device-session";
+            let authCredential = explicitApiKey || managedCredential;
+            let deviceSessionId = managedAuthType === "device-session"
+                ? managed?.deviceSessionId ?? null
+                : null;
+            let deviceLabel = managedAuthType === "device-session"
+                ? managed?.deviceLabel ?? null
+                : null;
+            const backendRaw = flags.backend ??
+                (explicitApiKey || managedAuthType === "api-key"
+                    ? (0, api_key_1.tryInferBackendUrlFromApiKey)(explicitApiKey || managedCredential)
+                    : null) ??
+                managed?.backendUrl ??
+                DEFAULT_BACKEND_URL;
             const backendUrl = normalizeUrl(backendRaw, "--backend");
             const [codexDetected, continueDetected, clineDetected, kiloDetected, rooDetected, traeDetected, aiderDetected, zoDetected] = await Promise.all([
                 detectCodexClient(),
@@ -1820,6 +1876,24 @@ class SetupCommand extends base_command_1.BaseCommand {
             if (flags["codex-usage-ui"] && !selectedSetupClients.has("codex")) {
                 throw new Error("--codex-usage-ui requires Codex to be selected for setup.");
             }
+            if (!authCredential) {
+                deviceLabel = await resolveDeviceLabel({
+                    flagValue: flags["device-name"],
+                    managedValue: managed?.deviceLabel,
+                    skipPrompt: flags.yes,
+                });
+                const browserAuth = await (0, device_session_auth_1.createBrowserLinkedDeviceSession)({
+                    backendUrl,
+                    deviceLabel,
+                    selectedClients: Array.from(selectedSetupClients),
+                    usagePatchRequested: codexUsageUiEnabled,
+                    log: (message) => this.log(message),
+                });
+                authType = browserAuth.authType;
+                authCredential = browserAuth.credential;
+                deviceSessionId = browserAuth.deviceSessionId;
+                deviceLabel = browserAuth.deviceLabel;
+            }
             const progress = this.createProgressHandle(!debugOutput);
             let resolved = null;
             let updatedShellFiles = [];
@@ -1845,17 +1919,23 @@ class SetupCommand extends base_command_1.BaseCommand {
             try {
                 if (selectedSetupClients.size > 0) {
                     progress.update("Resolving supported models");
-                    resolved = await resolveModels(backendUrl, apiKey);
+                    resolved = await resolveModels(backendUrl, authCredential);
                 }
                 progress.update("Saving shared machine config");
-                await (0, config_1.writeManagedConfig)({ backendUrl, apiKey });
-                updatedShellFiles = await persistApiKeyEnv(apiKey);
+                await (0, config_1.writeManagedConfig)({
+                    backendUrl,
+                    authType,
+                    credential: authCredential,
+                    deviceSessionId,
+                    deviceLabel,
+                });
+                updatedShellFiles = await persistApiKeyEnv(authCredential);
                 if (selectedSetupClients.has("codex")) {
                     progress.update("Configuring Codex");
                     codexConfigPath = await writeCodexConfig({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CODEX_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                         enableUsageUiPatch: codexUsageUiEnabled,
                     });
                     updatedVsCodeEnvFiles = await persistVsCodeServerEnvSource();
@@ -1867,7 +1947,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     if (codexUsageUiEnabled) {
                         authSeed = await (0, codex_auth_seeding_1.ensureCodexUsageLimitAuth)({
                             codexHome: paths_1.codexDir,
-                            apiKey,
+                            apiKey: authCredential,
                         });
                         codexVsCodePatch = await (0, codex_vscode_patch_1.patchCodexVsCodeExtensions)({
                             logoutCommandPath: resolveCommandPath("theclawbay"),
@@ -1879,7 +1959,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                         });
                         authSeed = await (0, codex_auth_seeding_1.ensureCodexApiKeyAuth)({
                             codexHome: paths_1.codexDir,
-                            apiKey,
+                            apiKey: authCredential,
                         });
                         codexVsCodeCleanup = await (0, codex_vscode_patch_1.cleanupCodexVsCodeExtensions)();
                     }
@@ -1897,7 +1977,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     continueConfigPath = await writeContinueConfig({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CONTINUE_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("cline")) {
@@ -1905,7 +1985,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     clineConfigPaths = await writeClineConfig({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CLINE_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("openclaw")) {
@@ -1914,7 +1994,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CODEX_MODEL,
                         models: resolved?.models ?? [{ id: DEFAULT_CODEX_MODEL, name: modelDisplayName(DEFAULT_CODEX_MODEL) }],
-                        apiKey,
+                        apiKey: authCredential,
                     });
                     openClawConfigPath = openClawResult.configPath;
                     openClawCliWarning = openClawResult.cliWarning ?? null;
@@ -1925,7 +2005,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CODEX_MODEL,
                         models: resolved?.models ?? [{ id: DEFAULT_CODEX_MODEL, name: modelDisplayName(DEFAULT_CODEX_MODEL) }],
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("kilo")) {
@@ -1934,7 +2014,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CODEX_MODEL,
                         models: resolved?.models ?? [{ id: DEFAULT_CODEX_MODEL, name: modelDisplayName(DEFAULT_CODEX_MODEL) }],
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("roo")) {
@@ -1942,7 +2022,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     rooConfigPaths = await writeRooConfig({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_ROO_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("trae")) {
@@ -1950,7 +2030,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     traeBundlePathPatched = await patchTraeBundle({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_CODEX_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                         models: resolved?.models ?? [{ id: DEFAULT_CODEX_MODEL, name: modelDisplayName(DEFAULT_CODEX_MODEL) }],
                     });
                 }
@@ -1959,7 +2039,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     aiderConfigPath = await writeAiderConfig({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_AIDER_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
                 if (selectedSetupClients.has("zo")) {
@@ -1967,7 +2047,7 @@ class SetupCommand extends base_command_1.BaseCommand {
                     zoConfigName = await configureZoByok({
                         backendUrl,
                         model: resolved?.model ?? DEFAULT_ZO_MODEL,
-                        apiKey,
+                        apiKey: authCredential,
                     });
                 }
             }
@@ -2016,6 +2096,9 @@ class SetupCommand extends base_command_1.BaseCommand {
             else if (codexUsageUiEnabled && codexVsCodePatch?.action === "none" && !codexVsCodePatch.warning) {
                 summaryNotes.add("No installed Codex VS Code extension build was found to patch locally.");
             }
+            if (authType === "device-session" && deviceLabel) {
+                summaryNotes.add(`This machine is linked as "${deviceLabel}". You can revoke it from the dashboard Devices section or with \`theclawbay logout\`.`);
+            }
             if (!debugOutput) {
                 logSetupCompactSummary({
                     log: (message) => this.log(message),
@@ -2027,12 +2110,17 @@ class SetupCommand extends base_command_1.BaseCommand {
             }
             this.log(`- Managed config: ${paths_1.managedConfigPath}`);
             this.log(`- Backend: ${backendUrl}`);
+            this.log(`- Auth mode: ${authType}`);
+            if (authType === "device-session") {
+                this.log(`- Device session id: ${deviceSessionId ?? "n/a"}`);
+                this.log(`- Device label: ${deviceLabel ?? "n/a"}`);
+            }
             if (selectedSetupClients.size === 0) {
-                this.log("- Local clients: none selected; saved managed config and API key env only.");
+                this.log("- Local clients: none selected; saved managed config and local credential env only.");
             }
             if (resolved?.note)
                 this.log(resolved.note);
-            this.log(`- API key env: ${ENV_FILE}`);
+            this.log(`- Local credential env: ${ENV_FILE}`);
             this.log(`- Shell profiles updated: ${updatedShellFiles.join(", ")}`);
             if (selectedSetupClients.has("codex")) {
                 this.log(`- Codex: configured (${codexConfigPath})`);
@@ -2250,6 +2338,11 @@ SetupCommand.flags = {
         aliases: ["apiKey"],
         description: "API key issued by your The Claw Bay dashboard",
     }),
+    "device-name": core_1.Flags.string({
+        required: false,
+        aliases: ["deviceName"],
+        description: "Device name to save when browser login links this machine",
+    }),
     clients: core_1.Flags.string({
         required: false,
         description: "Detected local clients to configure: codex, continue, cline, openclaw, opencode, kilo, roo, trae, aider, zo",

package/dist/index.js

@@ -29,8 +29,8 @@ async function maybePrintBareInvocationHint() {
         currentVersion,
         log: (message) => console.log(message),
     }).catch(() => { });
-    console.log("Get your API key at: https://theclawbay.com/dashboard");
-    console.log("Then run: theclawbay setup --api-key <apiKey>");
+    console.log("Run: theclawbay setup");
+    console.log("Optional manual path: theclawbay setup --api-key <apiKey>");
     console.log("");
 }
 async function main() {

package/dist/lib/device-session-auth.d.ts

@@ -0,0 +1,12 @@
+export declare function createBrowserLinkedDeviceSession(params: {
+    backendUrl: string;
+    deviceLabel?: string | null;
+    selectedClients: string[];
+    usagePatchRequested: boolean;
+    log: (message: string) => void;
+}): Promise<{
+    credential: string;
+    authType: "device-session";
+    deviceSessionId: string;
+    deviceLabel: string;
+}>;

package/dist/lib/device-session-auth.js

@@ -0,0 +1,186 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBrowserLinkedDeviceSession = createBrowserLinkedDeviceSession;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+function preferredBrowserCallbackPort() {
+    const parsed = Number(process.env.THECLAWBAY_CALLBACK_PORT?.trim() || "");
+    if (Number.isFinite(parsed) && parsed > 0 && parsed < 65536) {
+        return Math.round(parsed);
+    }
+    return 4589;
+}
+function openUrlInBrowser(url) {
+    try {
+        if (process.platform === "darwin") {
+            const child = (0, node_child_process_1.spawn)("open", [url], {
+                detached: true,
+                stdio: "ignore",
+            });
+            child.unref();
+            return true;
+        }
+        if (process.platform === "win32") {
+            const child = (0, node_child_process_1.spawn)("cmd", ["/c", "start", "", url], {
+                detached: true,
+                stdio: "ignore",
+            });
+            child.unref();
+            return true;
+        }
+        const child = (0, node_child_process_1.spawn)("xdg-open", [url], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function htmlPage(title, message) {
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>${title}</title>
+    <style>
+      body { font-family: ui-sans-serif, system-ui, sans-serif; background: #09111f; color: #f5f7fb; margin: 0; padding: 40px 20px; }
+      .card { max-width: 620px; margin: 0 auto; padding: 28px; border-radius: 24px; background: linear-gradient(180deg, rgba(18,24,38,0.94), rgba(11,16,28,0.92)); border: 1px solid rgba(255,255,255,0.08); }
+      h1 { font-size: 28px; margin: 0 0 12px; }
+      p { color: rgba(255,255,255,0.75); line-height: 1.7; margin: 0; }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h1>${title}</h1>
+      <p>${message}</p>
+    </div>
+  </body>
+</html>`;
+}
+async function createLocalCallbackServer(expectedState) {
+    const preferredPort = preferredBrowserCallbackPort();
+    let resolveCallback;
+    let rejectCallback;
+    const callbackPromise = new Promise((resolve, reject) => {
+        resolveCallback = resolve;
+        rejectCallback = reject;
+    });
+    const server = node_http_1.default.createServer((req, res) => {
+        const url = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (url.pathname !== "/auth/callback") {
+            res.writeHead(404, { "content-type": "text/html; charset=utf-8" });
+            res.end(htmlPage("Not found", "This local setup callback path is invalid."));
+            return;
+        }
+        const state = url.searchParams.get("state")?.trim() ?? "";
+        const sessionId = url.searchParams.get("sessionId")?.trim() ?? "";
+        const code = url.searchParams.get("code")?.trim() ?? "";
+        if (!sessionId || !code || state !== expectedState) {
+            res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+            res.end(htmlPage("Connection failed", "The local setup callback did not match the expected state. Return to your terminal and run setup again."));
+            rejectCallback(new Error("browser callback state mismatch"));
+            return;
+        }
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(htmlPage("Device linked", "This device is now connected to The Claw Bay. You can return to your terminal."));
+        resolveCallback({ sessionId, state, code });
+    });
+    const actualPort = await new Promise((resolve, reject) => {
+        const listen = (port) => {
+            server.once("error", (error) => {
+                const err = error;
+                if (port !== 0 && err.code === "EADDRINUSE") {
+                    listen(0);
+                    return;
+                }
+                reject(error);
+            });
+            server.listen(port, "127.0.0.1", () => {
+                const address = server.address();
+                if (!address || typeof address === "string") {
+                    reject(new Error("failed to determine local callback port"));
+                    return;
+                }
+                resolve(address.port);
+            });
+        };
+        listen(preferredPort);
+    });
+    const callbackUrl = `http://127.0.0.1:${actualPort}/auth/callback`;
+    return {
+        callbackUrl,
+        waitForCallback: async () => callbackPromise,
+        close: async () => await new Promise((resolve) => {
+            server.close(() => resolve());
+        }),
+    };
+}
+async function createBrowserLinkedDeviceSession(params) {
+    const label = (params.deviceLabel ?? "").trim() || node_os_1.default.hostname() || "This device";
+    const state = node_crypto_1.default.randomUUID();
+    const callbackServer = await createLocalCallbackServer(state);
+    try {
+        const startResponse = await fetch(`${params.backendUrl}/api/setup/device-session/start`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                callbackUrl: callbackServer.callbackUrl,
+                state,
+                deviceLabel: label,
+                selectedClients: params.selectedClients,
+                usagePatchRequested: params.usagePatchRequested,
+            }),
+            signal: AbortSignal.timeout(20000),
+        });
+        const startBody = (await startResponse.json().catch(() => ({})));
+        if (!startResponse.ok || !startBody.authUrl || !startBody.sessionId) {
+            throw new Error(startBody.error ?? `failed to start browser auth (HTTP ${startResponse.status})`);
+        }
+        const opened = openUrlInBrowser(startBody.authUrl);
+        params.log(opened
+            ? `Open browser auth if it did not appear automatically: ${startBody.authUrl}`
+            : `Open this URL to continue setup: ${startBody.authUrl}`);
+        const callback = await Promise.race([
+            callbackServer.waitForCallback(),
+            new Promise((_, reject) => {
+                setTimeout(() => reject(new Error("browser setup timed out")), 15 * 60000);
+            }),
+        ]);
+        const exchangeResponse = await fetch(`${params.backendUrl}/api/setup/device-session/exchange`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                sessionId: callback.sessionId,
+                state: callback.state,
+                code: callback.code,
+            }),
+            signal: AbortSignal.timeout(20000),
+        });
+        const exchangeBody = (await exchangeResponse.json().catch(() => ({})));
+        if (!exchangeResponse.ok ||
+            exchangeBody.authType !== "device-session" ||
+            !exchangeBody.credential ||
+            !exchangeBody.deviceSessionId) {
+            throw new Error(exchangeBody.error ??
+                `failed to exchange browser setup session (HTTP ${exchangeResponse.status})`);
+        }
+        return {
+            credential: exchangeBody.credential,
+            authType: "device-session",
+            deviceSessionId: exchangeBody.deviceSessionId,
+            deviceLabel: exchangeBody.deviceLabel?.trim() || label,
+        };
+    }
+    finally {
+        await callbackServer.close().catch(() => { });
+    }
+}

package/dist/lib/managed/config.d.ts

@@ -1,6 +1,10 @@
+export type ManagedAuthType = "api-key" | "device-session";
 export type ManagedConfig = {
     backendUrl: string;
-    apiKey: string;
+    authType: ManagedAuthType;
+    credential: string;
+    deviceSessionId?: string | null;
+    deviceLabel?: string | null;
 };
 export declare function readManagedConfig(): Promise<ManagedConfig>;
 export declare function writeManagedConfig(config: ManagedConfig): Promise<void>;

package/dist/lib/managed/config.js

@@ -72,31 +72,66 @@ async function readManagedConfig() {
         throw new errors_1.ManagedConfigInvalidError("backendUrl is required");
     }
     const backendUrl = normalizeAndValidateBackendUrl(obj.backendUrl);
-    if (obj.authType === "seat") {
+    const rawAuthType = obj.authType;
+    if (typeof rawAuthType === "string" && rawAuthType === "seat") {
         throw new errors_1.ManagedConfigInvalidError('legacy seat-mode config is no longer supported; run "theclawbay link --api-key <key>" to relink');
     }
-    if (typeof obj.apiKey !== "string" || !obj.apiKey.trim()) {
-        throw new errors_1.ManagedConfigInvalidError("apiKey is required");
+    const authType = rawAuthType === "device-session" ? "device-session" : "api-key";
+    const rawCredential = typeof obj.credential === "string" && obj.credential.trim()
+        ? obj.credential.trim()
+        : typeof obj.apiKey === "string" && obj.apiKey.trim()
+            ? obj.apiKey.trim()
+            : "";
+    if (!rawCredential) {
+        throw new errors_1.ManagedConfigInvalidError("credential is required");
     }
+    const deviceSessionId = typeof obj.deviceSessionId === "string" && obj.deviceSessionId.trim()
+        ? obj.deviceSessionId.trim()
+        : null;
+    const deviceLabel = typeof obj.deviceLabel === "string" && obj.deviceLabel.trim()
+        ? obj.deviceLabel.trim()
+        : null;
     if (loadedFromPath !== paths_1.managedConfigPath) {
         // Best-effort migration to the new config filename.
         await promises_1.default.mkdir(paths_1.codexDir, { recursive: true });
         await promises_1.default.writeFile(paths_1.managedConfigPath, raw, "utf8").catch(() => { });
     }
-    return { backendUrl, apiKey: obj.apiKey.trim() };
+    return {
+        backendUrl,
+        authType,
+        credential: rawCredential,
+        deviceSessionId,
+        deviceLabel,
+    };
 }
 async function writeManagedConfig(config) {
     if (typeof config.backendUrl !== "string" || !config.backendUrl.trim()) {
         throw new errors_1.ManagedConfigInvalidError("backendUrl is required");
     }
     const backendUrl = normalizeAndValidateBackendUrl(config.backendUrl);
-    if (typeof config.apiKey !== "string" || !config.apiKey.trim()) {
-        throw new errors_1.ManagedConfigInvalidError("apiKey is required");
+    if (config.authType !== "api-key" &&
+        config.authType !== "device-session") {
+        throw new errors_1.ManagedConfigInvalidError("authType must be api-key or device-session");
+    }
+    if (typeof config.credential !== "string" || !config.credential.trim()) {
+        throw new errors_1.ManagedConfigInvalidError("credential is required");
     }
     await promises_1.default.mkdir(paths_1.codexDir, { recursive: true });
+    const deviceSessionId = typeof config.deviceSessionId === "string" && config.deviceSessionId.trim()
+        ? config.deviceSessionId.trim()
+        : null;
+    const deviceLabel = typeof config.deviceLabel === "string" && config.deviceLabel.trim()
+        ? config.deviceLabel.trim()
+        : null;
     const contents = JSON.stringify({
         backendUrl,
-        apiKey: config.apiKey.trim(),
+        authType: config.authType,
+        credential: config.credential.trim(),
+        ...(config.authType === "api-key"
+            ? { apiKey: config.credential.trim() }
+            : {}),
+        ...(deviceSessionId ? { deviceSessionId } : {}),
+        ...(deviceLabel ? { deviceLabel } : {}),
     }, null, 2);
     await promises_1.default.writeFile(paths_1.managedConfigPath, `${contents}\n`, "utf8");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theclawbay",
-  "version": "0.3.40",
+  "version": "0.3.42",
   "description": "CLI for connecting Codex, Continue, Cline, OpenClaw, OpenCode, Kilo, Roo Code, Aider, experimental Trae, and experimental Zo to The Claw Bay.",
   "license": "MIT",
   "bin": {