PR #4 Auth Login Review Findings

Initial Debt

Codex PR review found two auth-login regressions after M3 delivery:

• punks auth login used DP_CONTROL_PLANE_URL as a fallback Better Auth base URL, even though device authorization is mounted under /api/auth/* and the control-plane URL is the typed Harness API base.
• Browser auto-open failures aborted device login in headless or remote environments, even though the verification URL had already been printed for manual use.

Resolution

• Removed DP_CONTROL_PLANE_URL from device-login auth URL resolution.
• Kept --auth-url and DP_AUTH_URL as the only Better Auth device-login sources.
• Made browser auto-open best-effort so polling continues after open/xdg-open failure.
• Updated docs to separate DP_AUTH_URL from DP_CONTROL_PLANE_URL and to require explicit DP_API_CLI_TOKEN for local static token auth.

Validation

• bun run test --filter=@punks/cli: passed 75 tests.
• bun run check-types --filter=@punks/cli: passed 3 tasks.
• bun run check: passed.
• git diff --check: passed.
• bun run build --filter=@punks/cli: passed.
• Built CLI auth login --help: passed and shows --auth-url defaults only to DP_AUTH_URL.