Function loginWithDeviceAuth

src/cli/auth-session.ts:197–274

(options: {
  stateDir: string;
  flags: CliFlags;
  env?: EnvMap;
  io?: AuthIo;
  commandLabel?: string;
})

}

export async function loginWithDeviceAuth(options: {
  stateDir: string;
  flags: CliFlags;
  env?: EnvMap;
  io?: AuthIo;
  commandLabel?: string;
}): Promise<{
  accessToken: string;
  expiresAt?: string;
  session: CliSessionRecord;
}> {
  const env = options.env ?? options.io?.env ?? process.env;
  const authMode = detectAuthMode(env, options.io);
  if (authMode === 'non-interactive') {
    throw buildNonInteractiveLoginError(options.commandLabel ?? 'agent-device connect', env);
  }
  const cloudBaseUrl = resolveCloudBaseUrl(env);
  const start = await postJson<DeviceAuthStartResponse>({
    baseUrl: cloudBaseUrl,
    pathName: DEVICE_AUTH_START_PATH,
    body: {
      client: 'agent-device',
      tenant: options.flags.tenant,
      runId: options.flags.runId,
      daemonBaseUrl: options.flags.daemonBaseUrl,
      session: options.flags.session,
    },
    fetchImpl: options.io?.fetch,
  });
  assertDeviceAuthStart(start);

  const verificationUrl = start.verificationUriComplete ?? start.verificationUri;
  const printableUrl =
    authMode === 'local-browser'
      ? start.verificationUri
      : appendUserCode(start.verificationUri, start.userCode);
  if (authMode === 'local-browser') {
    writeStderr(options.io, `Opening ${start.verificationUri}...\n`);
    await openBrowser(verificationUrl, options.io);
  } else {
    writeStderr(
      options.io,
      `Open this URL on your machine:\n${printableUrl}\n\nWaiting for approval for 10 minutes...\n`,
    );
  }

  const approved = await pollDeviceAuth({
    cloudBaseUrl,
    deviceCode: start.deviceCode,
    expiresIn: start.expiresIn,
    interval: start.interval,
    fetchImpl: options.io?.fetch,
    now: options.io?.now,
  });
  const refreshCredential =
    approved.cliSession?.refreshCredential ?? approved.cliSession?.refreshToken;
  if (!hasToken(approved.accessToken) || !hasToken(refreshCredential)) {
    throw new AppError('UNAUTHORIZED', 'Device authorization did not return CLI credentials.');