PR #4 Auth Hardening Review Findings

Initial Debt

Codex PR review found two follow-up auth robustness issues:

• Empty --auth-url or DP_AUTH_URL values were treated as configured and produced relative device endpoints such as /device/code.
• Malformed stored auth.json credentials threw during reads, making punks auth status and baseline credential lookup fail instead of returning an unauthenticated state.

Resolution

• Normalize --auth-url and DP_AUTH_URL by trimming whitespace and treating empty values as missing.
• Return null from readAuthCredential when the stored file cannot be parsed or decoded.
• Added direct tests for empty auth URL values and malformed stored credentials.

Validation

• bun run test --filter=@punks/cli: passed 77 tests.
• bun run check-types --filter=@punks/cli: passed 3 tasks.
• bun run check: passed.
• git diff --check: passed.
• bun run build --filter=@punks/cli: passed.
• Built CLI auth login --help: passed.