[itssimon]

Replaces the loopback callback in apitally auth with a device authorization flow (modeled on RFC 8628).

The browser only approves a login session, and the CLI fetches the API key by polling the public API. This works the same in every browser, over SSH, and in containers or cloud sandboxes.

Flow

1. POST /v1/cli-auth/sessions (unauthenticated) returns a device_code, a user_code like WDJB-MJHT, a verification_url, expires_in and interval
2. The CLI prints the URL and code, then opens the URL in the browser
3. The user confirms the code, picks a team and a scope, and clicks "Authorize CLI"
4. The CLI polls POST /v1/cli-auth/token with the device_code:
   • 200: saves the returned API key
   • 202, 429, 5xx or a transport error: keeps polling
   • Any other 4xx: fails with "authentication expired"
   • After expires_in: fails with "authentication timed out"

Changes

• Rewrite browser_auth in src/auth.rs, and remove the local callback server
• Add api_post_without_key to src/utils.rs for the unauthenticated session request
• Remove the hidden --app-url option (APITALLY_APP_URL), because the server builds the verification URL
• Remove the "paste your API key" prompt. --api-key and APITALLY_API_KEY still cover existing keys
• Replace the callback test with a polling test
• Update README, AGENTS.md and the skill's command reference

Verification

• cargo fmt --check, cargo clippy and cargo test pass
• Ran the full flow against the local cloud stack, approving in the browser with "Read & write". The CLI saved a personal key with write scope, and whoami succeeded with it
• Deleting the session while the CLI was polling ended with "authentication expired" and exit code 3

[codecov]

Codecov Report

❌ Patch coverage is 90.36145% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.88%. Comparing base (806a4ed) to head (5047f0b).

Files with missing lines	Patch %	Lines
src/auth.rs	90.00%	7 Missing ⚠️
src/main.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #90      +/-   ##
==========================================
+ Coverage   91.67%   91.88%   +0.20%     
==========================================
  Files          13       13              
  Lines        2523     2477      -46     
==========================================
- Hits         2313     2276      -37     
+ Misses        210      201       -9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Fix all with cubic | Re-trigger cubic</sub>