Function performAuthLogin

src/cli/handlers/auth.ts:179–291

(
  {
    email,
    sso,
    console: useConsole,
    managed,
  }: {
    email?: string
    sso?: boolean
    console?: boolean
    managed?: boolean
  },
  uiOptions: AuthLoginUiOptions = {},
)

}

export async function performAuthLogin(
  {
    email,
    sso,
    console: useConsole,
    managed,
  }: {
    email?: string
    sso?: boolean
    console?: boolean
    managed?: boolean
  },
  uiOptions: AuthLoginUiOptions = {},
): Promise<void> {
  const {
    openingMessage = 'Opening browser to sign in…',
    urlMessagePrefix = `If the browser didn't open, visit: `,
    successMessage = 'Login successful.',
  } = uiOptions

  if (useConsole && managed) {
    throw new Error('--console and --managed cannot be used together.')
  }

  const settings = getInitialSettings()
  // forceLoginMethod is a hard constraint (enterprise setting) — matches ConsoleOAuthFlow behavior.
  // Without it, --console selects Console; --managed (or no flag) selects
  // managed OAuth.
  const loginWithClaudeAi = settings.forceLoginMethod
    ? settings.forceLoginMethod === 'claudeai'
    : !useConsole
  const installMode: OAuthInstallMode = loginWithClaudeAi
    ? 'managed'
    : 'console'
  const orgUUID = settings.forceLoginOrgUUID

  // Fast path: if a refresh token is provided via env var, skip the browser
  // OAuth flow and exchange it directly for tokens.
  const envRefreshToken = process.env.CLAUDE_CODE_OAUTH_REFRESH_TOKEN
  if (envRefreshToken) {
    const envScopes = process.env.CLAUDE_CODE_OAUTH_SCOPES
    if (!envScopes) {
      throw new Error(
        'CLAUDE_CODE_OAUTH_SCOPES is required when using CLAUDE_CODE_OAUTH_REFRESH_TOKEN.\n' +
          'Set it to the space-separated scopes the refresh token was issued with\n' +
          '(e.g. "user:inference" or "user:profile user:inference user:sessions:claude_code user:mcp_servers").',
      )
    }

    const scopes = envScopes.split(/\s+/).filter(Boolean)

    logEvent('ncode_login_from_refresh_token', {})

    const tokens = await refreshOAuthToken(envRefreshToken, { scopes })
    await installOAuthTokens(tokens, { mode: installMode })

    const orgResult = await validateForceLoginOrgForCurrentSession()
    if (!orgResult.valid) {