Repository navigation
[TW-7617] Add device-code sign-in for remote CLI login and signup - #125
Open
radenkovic wants to merge 3 commits into
Open
radenkovic wants to merge 3 commits into
radenkovic wants to merge 3 commits into
Conversation
…er, and keep invalid_target Device sign-in always sends the configured region's MCP server as the RFC 8707 resource, and those were hardcoded to production. Staging names mcp-staging.us.nylas.com, so every US device login against it was refused with invalid_target. NYLAS_MCP_US_URL / NYLAS_MCP_EU_URL now replace that region's server for the resource, the accepted audience, and so the host a token is sent to. They replace rather than add, so the CLI still trusts exactly one server per region. An override must be an https origin (http only for loopback); a bad one fails closed instead of falling back to production. safeDeviceError also collapsed invalid_target into server_error, so the reader saw `oauth error "server_error"` with no cause. invalid_target is kept, still without the server's description, and the device flow says which variable to set. Verified against staging: without the override the CLI explains the refusal; with NYLAS_MCP_US_URL=https://mcp-staging.us.nylas.com staging issues a device code for region us. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
radenkovic
marked this pull request as ready for review
October 14, 2026 15:42
This was referenced Oct 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remote CLI sign-in and signup now use the authorization server's RFC 8628 device endpoint with
nylas oauth login --deviceor--no-browser. SSH sessions select device sign-in automatically; local browser/loopback remains the default on macOS and Windows even without DISPLAY. A region fixes the device request's audience and signup region.The polling service follows the advertised interval, adds five seconds for every slow_down, backs off on network failure, and stops on denial, expiry or cancellation without automatic restart. Tokens use the existing session lock/storage/renewal path. Verification links are checked against the discovered issuer; only the user code and verification URLs are printed. Device errors never echo server response bodies or bearer codes.
Validation: focused OAuth packages pass; affected packages pass under the race detector; golangci-lint reports 0 issues. A real-binary fake-server integration test verifies pending-to-success polling, isolated encrypted session storage, status, and absence of device code/tokens in terminal output. Invalid metadata, cumulative slowing, expiry, cancellation, terminal errors, disabled device flow, non-first-party clients and region constraints have regression coverage.
make ci-fullwith Go 1.26.9 passed formatting, vet, lint, unit tests, race tests, repository security scan, govulncheck, build and CLI regression checks, then stopped because NYLAS_API_KEY is unavailable for provider agent integration. The older local Go 1.26.5 failed govulncheck on standard-library vulnerabilities; no dependency or module changes were made. Live staging SSH/signup validation remains outstanding, along with deployment/enablement of dashboard-account device flow and a supported CLI release.Principal MCP-only login and multiple-authorization credential isolation are TW-7622, separate from this remote-login track. No deployment or release is performed by this PR.