fix(login): device-flow link re-anchored onto the environment console; prompt names the deployment (#134)

TO
2mo ago
+120-6

Fixes #134.

Root cause

The CLI never builds the device-approval URL — the platform does, from its own INSTA_CONSOLE_URL (Better Auth deviceAuthorization({ verificationUri: ${cfg.consoleUrl}/device }) in insta-platform). The staging deployment's INSTA_CONSOLE_URL points at the staging landing host instead of the staging console, so staging mints approval links onto a host that serves no /device page.

Probe evidence (2026-08-24):

  • POST https://api.staging.instacloud.com/api/auth/device/code → "verification_uri": "https://staging.instacloud.com/device" — the landing host.
  • POST https://api.instacloud.com/api/auth/device/code → "verification_uri": "https://console.instacloud.com/device" — the console host.
  • https://console.instacloud.com/device?user_code=TEST → 307 /signin?next=%2Fdevice%3Fuser_code%3DTEST — the route exists on the prod console.
  • https://instacloud.com/device?user_code=TEST → 308 → www.instacloud.com → 404 — the landing site serves no /device anywhere, so staging's link can only 404 (behind Vercel SSO, exactly as reported).
  • The /device approval page lives in insta-frontend (src/app/device/page.tsx), which is present on its staging branch (deployed to console.staging.instacloud.com per that repo's README) — so the staging console does serve the route; the platform just points at the wrong host.

The lasting fix is one env var on the staging platform deployment: INSTA_CONSOLE_URL=https://console.staging.instacloud.com (currently the landing origin). This PR makes the CLI robust to that class of misconfiguration and closes the UX nit.

What this PR does

  1. Re-anchors the approval link onto the environment's console host (deviceVerificationUrl). Each env in ENVS now carries its console origin (probed above). For a known env, only the URL's origin is replaced — path and user_code query stay exactly what the server minted, so a correctly configured platform is a no-op (prod already is). Custom/self-hosted --api-url targets (env === null) are the user's deliberate choice and are never rewritten; an unparseable server string is shown as-is.
  2. Labels the deployment in the prompt (the issue's UX nit): to log in to STAGING, open this link… for named envs, to log in to https://insta.local:7130, … for custom hosts.

Tests

  • deviceVerificationUrl: wrong-host staging link re-anchored with user_code preserved; already-correct prod link untouched; custom host (env null) untouched; unparseable string passed through.
  • deviceGrant output: staging run prints to log in to STAGING + the console-staging link and never the 404 landing link; custom-host run prints the apiUrl label and the server's link verbatim.
  • env table: prod/staging console hosts pinned to the probed working values.

Ran npm run typecheck and the full vitest suite against this branch: the two touched files pass 63/63; the suite's only failures (5, in setup-agent/ensure-skills) are identical on pristine main on the same machine (ambient local agent config), i.e. pre-existing and unrelated.

Not in this PR

  • The staging platform's INSTA_CONSOLE_URL should still be corrected to https://console.staging.instacloud.com (deployment env, not in any repo I can PR). Until then, this CLI fix alone makes insta login --device --env staging print a working link.

🤖 Generated with Claude Code

Summary by cubic

Fixes device login by re-anchoring the device-approval link to the environment’s console and naming the target deployment in the prompt. Previously, staging links pointed at the landing host (no /device) and 404’d; now known environments rewrite only the link origin while preserving the server-provided path and user_code.

  • Known envs: origin is replaced with the env console host; prod is unchanged; custom/self-hosted targets are never rewritten.
  • Prompt now labels the target (“to log in to STAGING …” or the apiUrl for custom hosts) to reduce wrong-environment approvals.
  • Adds console hosts to the env table and introduces a small helper to compute the approval URL; tests cover rewriting, prompting, and env table.
  • No migration required. Recommended follow-up: set INSTA_CONSOLE_URL=https://console.staging.instacloud.com on the staging platform.