feat(daemon): agentconnect auth logs a runtime in, and the console hands over the command

[spacedragon]

A runtime that needs a login is currently a dead end: the daemon probes it, gets
authentication required back, and the console shows an amber "Login required — sign in on
the daemon host" strip that says nothing about how. There was no command to run either.

This adds both halves.

agentconnect auth (daemon)

agentconnect auth [--runtime <id>] [--method <id>] [--skip-probe] — auth is not
CLI-owned, so the unified CLI delegates it verbatim to the active daemon with the terminal
attached (cli-daemon-split.md §4.2).

Why it is an operator command and not something the daemon does for itself: the credential
lands in the runtime's own state directory on the host — the one RUNTIME_STATE_LOCATIONS
seeds sessions FROM — and every login flow a runtime offers wants a human at a terminal (a
browser consent URL, a pasted API key, its own interactive CLI). The login therefore runs
UNSANDBOXED against the operator's own HOME, exactly as if they had run the runtime's CLI by
hand; a private-HOME launch would write the login into a directory thrown away with the
process.

• Runtime list with real login verdicts. Every installed runtime is listed at once in a
  fixed order, then annotated as the probe sweep answers (logged in — 5 model(s), 0.75.1 /
  not logged in). Nothing persists this — authRequired lives in the daemon process, and
  every on-disk heuristic misreads a runtime that authenticates from an env var — so the
  status is a real probe, run the same way the login will be. A selection made before the
  first verdict is honoured immediately, and choosing aborts the sweep.
• Both ACP method kinds. A terminal method is completed by the CLIENT re-launching the
  agent program on the operator's terminal, which agents only offer when the client
  advertises auth.terminal — so this command does, and a daemon session never does. An
  agent method goes through authenticate, answering the request-scoped URL/form
  elicitations of the auth phase via a new onAuthElicit hook (previously declined, since
  they map to no live turn).
• Loopback paste fallback. Google retired the OOB flow in 2023, so a runtime like
  Antigravity binds its OAuth listener to 127.0.0.1 on the daemon host, which a browser on
  another machine cannot reach. The redirect still happens though, so the command offers to
  replay the pasted ?code=… URL from the host itself. Only loopback http(s) URLs are
  accepted.
• EOF grace on stop. Some runtimes (Antigravity's ACP server) dump a stack trace on
  SIGTERM, which reads like a crash right after a login that in fact succeeded. stop() now
  gives the child a window to exit on stdin EOF before signalling.

The console hands the command over (web)

The amber warning on a runtime row is now a button that opens a dialog with the exact
command (agentconnect auth --runtime <id>, with copy), why it belongs on that host, what it
will ask, the npx / --instance variants, and the fact that sessions pick the credential up
on their next start with no daemon restart.

Both runtime lists carry it: the daemon detail view's own rows (mobile) and the shared
FleetRuntimesCard (desktop daemon detail, cluster, group). The card takes an optional
daemonName, so one machine's dialog names its host while a cluster/group — which aggregates
hosts — stays generic. RuntimeSelect's per-option warning is deliberately untouched: that
row is a button role="option" meaning "pick this runtime", and nesting a button inside it
is invalid markup with confused keyboard semantics.

Verification

• pnpm -r typecheck clean; eslint clean (pre-push hook ran it).
• daemon: new auth-cli (17) and auth-picker (13) suites, plus spawn-driver (11),
  runtime-prober, render, daemon-transcript — 267 tests green.
• web: full suite green (214 files / 2401 tests), including a new ClusterDetailView case
  that clicks the warning and asserts the command lands in the dialog.
• Ran for real on this host. auth --runtime antigravity-acp handshakes and lists its
  four Google/Gemini login methods; the bare list sweeps 14 installed runtimes and annotates
  each with its live verdict, redrawing in place on a real pty.

Follow-up (not in this PR)

The sweep's status line reports a probe failure (ACP connection closed, a timeout, a
binary that won't start) as not logged in — <error>, which claims more than the probe
established. That wants its own split into a check failed state.

🤖 Generated with Claude Code

[agentconnect-md-test]

Three reproducible issues need fixing in the new auth command:

• Browser login completion remains blocked on the paste prompt until the operator presses Enter.
• Form elicitation returns fixed type/text fields instead of the runtime's requested fields.
• Cancelling the runtime picker can leave unfinished probe processes running after the CLI exits.

Focused verification passed: 41 daemon auth/picker/spawn tests and 23 ClusterDetailView tests. Separate small harnesses reproduced all three findings. No repository changes were made.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P2] Unblock the paste prompt when authentication settles

A normal browser login commonly takes longer than the three-second delay. Once this ask() starts, resolving or rejecting login only changes settled; it cannot release the pending readline question. I reproduced a successful login remaining stuck here until Enter was pressed, so the command never reports success or exits on its own. Race the outstanding prompt against login completion and close/cancel its readline interface when the login settles.

[spacedragon]

Fixed in 75e6016. You are right that settled could not release a question already waiting on stdin. offerLoopbackPaste now owns an AbortController that the login aborts on settle (either outcome), and readLine takes that signal: it resolves the pending question empty and closes the readline interface, so the loop exits and the command reports success on its own. The readLine test seam carries the signal too, and a new case drives exactly your repro — the prompt is answered by nobody, the login resolves 10ms later, and the command finishes with the success line without a keypress.

[agentconnect-md-test]

Confirmed in 75e60163: login completed after the paste prompt appeared, and the command exited successfully without any terminal input. This finding is resolved.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P2] Return the fields requested by the auth form

ACP form responses must put an object matching requestedSchema in content. This handler ignores that schema and always sends {type: 'text', text: answer}. A request for a required projectId therefore receives no projectId, even after the operator supplies it; I reproduced that through onAuthElicit. Read the requested properties and return their named, typed values, declining unsupported forms instead of accepting an unusable response.

[spacedragon]

Fixed in 75e6016, and thanks — a fixed {type,text} payload answered no schema at all. The handler now reduces the form through the shared projection instead of inventing a shape: elicitForm(params, CLI_ELICIT_SURFACE) (a new surface next to the Slack and webchat ones, claiming every kind, since a terminal can pick or type any of them), one control per field — enum/boolean picked from the options the agent itself offered, text/number/multi-select typed and re-asked while fieldAccepts refuses them — then elicitFormAccepts + elicitFormContent so the accept is keyed on the schema property names with the schema types. Your projectId case is a test: it comes back as {projectId, region, sandbox}. A form whose required field this terminal cannot render is declined whole rather than half-answered, and nothing typed at all is a decline, not an empty accept.

[agentconnect-md-test]

Confirmed in 75e60163: form responses now use the requested property names and types, and missing or unsupported required fields cause a decline. The tests and separate form-entry check passed. This finding is resolved.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

[P2] Finish probe teardown before the auth process exits

Aborting this signal only stops workers from starting subsequent probes; it does not stop or await children already running. When the operator cancels the picker, runAuth returns and the new CLI action calls process.exit(0), so those probes' deadlines and finally cleanup never run. LocalDriver launches detached process groups, and I reproduced a stalled runtime remaining alive after cancellation. Cancel active probes and await their teardown before exiting; selection can still proceed immediately while cleanup runs alongside the chosen login.

[spacedragon]

Fixed in 75e6016. Two halves, since awaiting the old sweep would have meant waiting out per-runtime deadlines: probeRuntime now races opts.signal (and refuses to launch under an already-aborted one), so an abort ends each in-flight probe immediately and its existing finally stops the host — that is what makes waiting cheap. chooseRuntime then aborts AND awaits the sweep before returning, so no probe outlives the CLI actions process.exit. Covered by two prober cases (abort mid-flight tears the child down; a pre-aborted sweep launches nothing) and one CLI case asserting runAuth` does not resolve until the cancelled sweep has finished.

[agentconnect-md-test]

Confirmed in 75e60163: rerunning the stalled-runtime reproduction showed that cancelling the picker stopped the probe before the CLI exited, with no surviving process. This finding is resolved.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Approved at 75e60163. All three previous findings are fixed: completed login releases the paste prompt, auth forms return the requested field names and types, and picker cancellation waits for probe teardown.

Validation: 245 focused daemon tests passed. Separate process checks confirmed exit without terminal input, correct form responses, and no surviving probe after cancellation.

Non-blocking follow-up: suppress the timed paste prompt while an auth form is collecting input. Both readers currently receive the same input, so valid form answers also produce misleading “not a loopback redirect URL” messages. The form still submits successfully.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

Approved at f957e20a. This revision only refactors the deferred teardown callback in an auth CLI test; production behavior is unchanged from the previously approved revision. All 24 auth CLI tests pass, and the diff check is clean. No new findings; the previously noted form/paste prompt overlap remains a non-blocking follow-up.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}

[agentconnect-md-test]

f957e20a is already approved with no blocking findings.

_{sent by review-bot (Codex · gpt-6-astra) · open in session}