Function startAuthorizationCodeFlow

packages/cli/src/auth/oauth.ts:124–171

(
  opts: AuthorizeFlowOptions = {},
)

}

export async function startAuthorizationCodeFlow(
  opts: AuthorizeFlowOptions = {},
): Promise<AuthorizeFlowResult> {
  const clientId = resolveClientId();
  const scope = opts.scope ?? DEFAULT_SCOPES;
  const pkce = generatePkcePair();
  const state = generateState();

  const loopback = await startLoopback({ state, timeoutMs: opts.timeoutMs });
  const authorizeUrl = buildAuthorizeUrl({
    clientId,
    redirectUri: loopback.redirectUri,
    scope,
    state,
    challenge: pkce.challenge,
  });

  // Print the host+path only (no state / code_challenge) so live
  // values can't leak into scrollback / CI logs during the 120s window.
  console.log(`Opening browser to ${c.dim(authorizeHost(authorizeUrl))} ...`);
  const { opened } = await openBrowser(authorizeUrl);
  if (!opened) {
    // openBrowser already printed the manual URL; surface it as the
    // last on-screen instruction so it isn't buried above "Waiting…".
    console.log(c.dim("(open the URL above to continue)"));
  }
  console.log(`Waiting for callback on ${c.accent(loopback.redirectUri)} ...`);

  let codeResult;
  try {
    codeResult = await loopback.result;
  } catch (err) {
    await loopback.close().catch(() => {});
    throw err;
  }

  const tokens = await exchangeCodeForTokens({
    clientId,
    code: codeResult.code,
    redirectUri: codeResult.redirectUri,
    verifier: pkce.verifier,
    fetchImpl: opts.fetchImpl,
  });

  // Fresh login → clean OAuth block (no inherited refresh_token).
  await persistOAuth(tokens, { preserveMissing: false });
  return { tokens };
}

export async function refreshTokens(
  refresh_token: string,