[ENG-3568] Stop login hanging when an assistant runs it

[mariojgt]

Reported from Lovable: login appears to hang. It does — and the cause is structural, not a quirk of that tool.

🥞 Merge after #153 and #154 (both merged).

Why

An assistant runs a command, waits for it to exit, then reads stdout. login printed the link at second zero and blocked for ten minutes. So the agent saw nothing until the process exited, by which point the code had already expired. Every assistant hits this; Lovable just reported it.

The fix — the second step is the same command

1.  npx @patchstack/connect login   → prints the link, exits (~1s)
2.  user approves in the browser
3.  npx @patchstack/connect login   → resumes the same request and finishes

Re-running resumes the pending request rather than issuing a new one:

• Approved → redeems, writes the credential, done
• Not yet → reports the code and the seconds remaining, exits
• Expired → starts a fresh request

The CLI picks the shape by whether anyone is watching:

Caller	Behaviour
Interactive terminal	Unchanged — print the link, then wait
Output captured (assistant, pipe)	Print the link and exit; re-run to finish

A person at a shell still gets the one-command flow they had. --wait remains as the explicit blocking variant.

Why not leave step 3 as --wait

Splitting start from wait fixed the hang but opened a gap: nothing writes the credential unless someone comes back and runs the second command. An assistant that forgets leaves the user having approved for nothing.

Making step 3 the same command as step 1 removes the flag an assistant has to remember, and re-running can no longer invalidate the link the user is looking at — which the previous docs had to warn against. The obvious action is now the correct one.

Verified against production

RUN 1:  Approve at: …/device?code=ZBYN-7ELY   (valid for another 308s)
RUN 2:  Still waiting for approval of code ZBYN-7ELY
        (valid for another 307s)

Same code, countdown decrementing — resuming, not restarting.

An abandoned flow is harmless

RunPulseDeviceFlow::approve() only marks the request server-side; the rotation happens on redeem. So if step 3 never runs, nothing changed, the request expires in ten minutes, and the site keeps working on its existing credential. No orphaned state to clean up.

The pending request

Held in os.tmpdir(), keyed by a hash of the site UUID, mode 0600. Not the project directory — the device code is a ten-minute secret and nothing that short-lived belongs somewhere it could be committed. The device code is never printed; only the user code and link are.

Closes ENG-3568

🤖 Generated with Claude Code

[coderbuds]

Clear splitting of interactive and automated login flows solves hanging issue.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

📈 This month: Your 59th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review