[emaarco]

Why

Most pulse-cli commands are run by AI agents, and an agent cannot click through a browser login: without a stored login it stopped with LOGIN_REQUIRED. The CLI already had a way that works for people and agents alike, PULSE_CLI_TOKEN_COMMAND, so the CLI's own OAuth login (about 3,800 lines of code and 8,000 lines of tests) goes.

What

• Remove pulse-cli auth login, auth logout, --auth oauth, the PULSE_CLI_OAUTH_* variables, the --oauth-* options of config set, the OAuth token store and the LOGIN_REQUIRED error. auth status stays and shows the bearer token.
• Remove the login sharing across profiles, config files, git repositories and worktrees (login keys, profile origins, the worktree detection) and the runtime parts only the login used: loopback server, browser opener, lock file, random bytes, file ownership checks.
• A profile with "type": "oauth" and --auth oauth fail with CONFIG (exit 3) and a hint pointing to PULSE_CLI_TOKEN_COMMAND.
• The token command learns the engine it serves: pulse-cli sets PULSE_CLI_TOKEN_URL and, with a profile, PULSE_CLI_TOKEN_PROFILE. Its token is cached per engine URL, so engines with different logins never share a cached token. A command for a single login ignores the variables and behaves as before.
• docs/cli/authentication.md: a "Single sign-on" section with ready-to-copy token commands for Keycloak, Entra ID and Auth0, a "Several logins" section with a dispatcher script, and a migration note. The other docs/cli pages, the CLI README, SKILL.md, guide and help texts and apps/cli/CLAUDE.md follow.
• Engine suites: Keycloak stays only as the token issuer of the bearer suite; the OAuth suites and their support code are gone. The dependency-cruiser rule that kept the interactive login in the auth command is removed with its gate cases.
• Nothing outside apps/cli, docs/cli and the dependency-cruiser config changes; the MCP server and the VS Code extension are untouched.

Verification

• In apps/cli: tsc --noEmit, ESLint and vitest run (3,133 tests, coverage floors) pass.
• New tests: two profiles with different URLs each get their own token from one dispatcher command, and the command runs once per engine; the Node runtime passes the variables to the shell and keeps the inherited environment.
• pnpm lint:architecture, lint:architecture:cli, lint:deadcode:cli, lint:ratchets, format:check, node --test scripts/*.test.mjs and the docs-refs and old-names tests pass.
• Manually, with the built CLI on a copy of a real project file: profiles with "type": "oauth" fail with the documented CONFIG error; without the auth block and with a token command, config show and ping --dry-run resolve as expected.
• Not run: the Docker engine suites (test:engines), the full pnpm build and the repo-wide pnpm typecheck.

Breaking changes

pulse-cli auth login, auth logout, --auth oauth, the PULSE_CLI_OAUTH_* variables, the --oauth-* options of config set and the LOGIN_REQUIRED error are removed. To migrate, remove the auth object of an OAuth profile and set PULSE_CLI_TOKEN_COMMAND to a command that prints a token (e.g. az account get-access-token --resource <api> --query accessToken -o tsv), see docs/cli/authentication.md#single-sign-on. The issue suggested one release in which the login still works but warns; this PR removes it directly.

Out of scope / Follow-ups

• Token helpers keyed by URL in the user's config file (as git and Docker credential helpers do), as a configured alternative to a dispatcher script.

Closes #489

[netlify]

✅ Deploy Preview for spectacular-cobbler-f6c85b ready!

Name	Link
🔨 Latest commit	7456ac1
🔍 Latest deploy log	https://app.netlify.com/projects/spectacular-cobbler-f6c85b/deploys/6ae1d8d8bab77d6548e648d7
😎 Deploy Preview	https://deploy-preview-496--spectacular-cobbler-f6c85b.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[emaarco]

Closing for now: the OAuth browser login is still needed, e.g. for logins against identity providers that only offer the authorization code flow. The work stays on this branch for reference; #489 stays open.