Fix CLI browser auth flow

[AyushRajSinghParihar]

Summary

• harden agentclash auth login from the terminal/user perspective: existing-token preflight, --force, env-token handling, browser URL fallback, strict polling, and clear denied/expired/error exits
• add backend support for cancelling pending CLI browser auth through POST /v1/cli-auth/device/deny, while keeping CLI auth under /v1/cli-auth/* and returning absolute verification URLs
• update the web device verification page so users confirm the terminal code and can approve or cancel the login request
• update OpenAPI/frontend docs and add the review-checkpoint test contract at testing/codex-fix-cli-auth-flow.md

Review Checkpoint

• Contract: testing/codex-fix-cli-auth-flow.md
• Checkpoint workflow used across three implementation commits:
  • checkpoint 1: CLI login UX and polling
  • checkpoint 2: backend deny flow and repository coverage
  • checkpoint 3: web cancel flow and docs

Tests

• cd cli && go test ./...
• cd backend && go test ./internal/api ./internal/repository
• cd web && npm test
• cd web && npm run build

Notes

• npm run build passes with an existing unrelated warning for unused ScorecardDimension in eval-spec-builder.tsx.
• npm ci reported existing audit findings: 2 moderate and 2 high.
• Manual live-stack browser smoke tests are documented in the contract but not run here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agentclash	Ready	Preview, Comment	Apr 17, 2026 5:35pm