Commit graph

2 commits

Author SHA1 Message Date
Deivid Soto
b00e7fbf0e feat(init): add 60s countdown, skip key, and cancel detection to browser auth 2026-03-30 14:07:57 +02:00
Deivid Soto
20d4d34dfc feat(auth): browser-based CLI authentication (like Claude Code)
- New browser auth flow: CLI opens localhost server, browser redirects
  token back via callback — zero copy/paste needed
- Automatic fallback to manual API key entry if browser flow fails
- Server-side state validation with TTL to prevent phishing
- sync.Once guard on callback to prevent goroutine leaks
- Localhost-only redirect validation (regex + url.Parse)
- URL-escaped state parameter for safety
2026-03-29 17:53:18 +02:00