app/cli/commands/login.ts

 // `zz login`: opens a browser to the same OAuth flow the web app

 // itself uses, then polls a single-use nonce until the callback mints

 // a token and hands it back -- the same shape `gh auth login`/

 // `wrangler login` use, built on our own OAuth flow instead of

 // embedding a Google/Cloudflare client secret in a distributed CLI

 // (which shouldn't happen -- those secrets belong server-side only).

 import { exec } from "node:child_process";

 import { apiBase, writeCredentials } from "../lib/credentials.js";

 interface LoginStartResponse {

  nonce: string;

  url: string;

 }

 interface LoginPollResponse {

  status: "pending" | "ready";

  token?: string;

  agent?: { username: string };

 }

 function tryOpenBrowser(url: string): void {

  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";

  exec(`${cmd} "${url}"`, () => {

  // Best-effort only -- the URL is printed either way, nothing fails if this doesn't work.

  });

 }

 function sleep(ms: number): Promise<void> {

  return new Promise((resolve) => setTimeout(resolve, ms));

 }

 export async function login(opts: { apiBase?: string; timeoutMs?: number; quiet?: boolean } = {}): Promise<string> {

  const base = opts.apiBase ?? apiBase();

  const startResp = await fetch(`${base}/api/login/start`, { method: "POST" });

  if (!startResp.ok) throw new Error(`could not start login: ${startResp.status} ${await startResp.text()}`);

  const { nonce, url } = (await startResp.json()) as LoginStartResponse;

  // Suppressed for a caller rendering an alt-screen TUI (zz top's own

  // login hotkey) -- a stray console.log writes into the alt-screen

  // buffer at whatever the cursor's own position happens to be,

  // visually corrupting the rest of the frame instead of appearing as

  // a normal terminal line the way it does for `zz login` on its own.

  if (!opts.quiet) {

  console.log(`Opening ${url}`);

  console.log("(if it doesn't open automatically, paste that URL into a browser)");

  }

  tryOpenBrowser(url);

  const deadline = Date.now() + (opts.timeoutMs ?? 5 * 60 * 1000);

  while (Date.now() < deadline) {

  await sleep(1500);

  const pollResp = await fetch(`${base}/api/login/poll?nonce=${encodeURIComponent(nonce)}`);

  if (!pollResp.ok) continue;

  const poll = (await pollResp.json()) as LoginPollResponse;

  if (poll.status === "ready" && poll.token && poll.agent) {

  writeCredentials({ apiBase: base, token: poll.token, username: poll.agent.username });

  if (!opts.quiet) console.log(`Logged in as ${poll.agent.username}.`);

  return poll.agent.username;

  }

  }

  throw new Error("timed out waiting for login to complete -- run `zz login` again");

 }