PR 4 Device Flow Review Findings

• Status: resolved
• Domain: cli
• Originating spec: apps/wiki/specs/cli/M3-authenticated-distribution
• Backlog mirror: https://github.com/wearedevpunks/harness-intelligence/pull/4
• Created: 2026-05-14
• Resolved: 2026-05-14

Initial Debt

Codex review found two device-authorization blockers after the M3 authenticated distribution work:

• Better Auth advertised the device verification page as /device, but the API only serves Better Auth below /api/auth/*.
• CLI device-token polling used a fixed five-minute timeout instead of the server-issued expires_in lifetime from /device/code.

Resolution

• Added a shared deviceVerificationUri auth constant set to /api/auth/device and wired the Better Auth device plugin to advertise that mounted route.
• Updated CLI device polling to derive its deadline from the issued device-code lifetime when expires_in is present.
• Added focused API and CLI tests for the advertised route constant and server-issued polling lifetime.

Validation

• bun run test --filter=@punks/cli --filter=@punks/api: passed @punks/cli 79 tests and @punks/api 10 tests.
• bun run check-types --filter=@punks/cli --filter=@punks/api --filter=@punks/auth: passed 6 tasks.
• bun run check: passed.
• git diff --check: passed.
• bun run build --filter=@punks/cli: passed.
• Built CLI auth login --help: passed.
• bun run test: passed 4 tasks.
• bun run check-types: passed 8 tasks.

Implementation Notes

• apps/wiki/specs/cli/M3-authenticated-distribution/IMPLEMENTATION-NOTES.md