${detail}
+logicsrc login again.";
+ return res.status(code ? 400 : 200).type("html").send(devicePage(req, `Enter the code shown in your terminal.
+ ${problem ? `${problem}
` : ""} + +Grant ${esc(row.name || "logicsrc cli")} access to manage teams & encrypted credentials as ${esc(req.user.email || req.user.display_name)}.
+${esc(row.user_code)}
+Only approve this if the code matches the one in your terminal.
+ +logicsrc login again for a fresh code.");
+
+ await run(`UPDATE cli_device_codes SET status = ?, user_id = ? WHERE user_code = ?`, [deny ? "denied" : "approved", req.user.id, code]);
+ return deny
+ ? deviceResult(req, res, 200, "Denied", "Nothing was granted. You can close this tab.")
+ : deviceResult(req, res, 200, `You're in.`, "Return to your terminal — you can close this tab.");
+});
+
+cliRouter.post("/cli/device/token", async (req, res) => {
+ const deviceCode = req.body?.device_code;
+ if (!deviceCode) return res.status(400).json({ error: "invalid_request" });
+ const row = await get(`SELECT * FROM cli_device_codes WHERE device_code_hash = ?`, [sha256(String(deviceCode))]);
+ if (!row) return res.status(400).json({ error: "invalid_grant" });
+
+ const now = Date.now();
+ // Rate-limit impatient pollers, per the device-flow convention.
+ const tooSoon = row.last_polled_at && now - row.last_polled_at < (DEVICE_POLL_SECONDS - 1) * 1000;
+ await run(`UPDATE cli_device_codes SET last_polled_at = ? WHERE device_code_hash = ?`, [now, row.device_code_hash]);
+ if (tooSoon) return res.status(400).json({ error: "slow_down", interval: DEVICE_POLL_SECONDS });
+ if (row.status === "used") return res.status(400).json({ error: "invalid_grant" });
+ if (row.status === "denied") return res.status(400).json({ error: "access_denied" });
+ if (row.expires_at < now) return res.status(400).json({ error: "expired_token" });
+ if (row.status !== "approved") return res.status(400).json({ error: "authorization_pending", interval: DEVICE_POLL_SECONDS });
+
+ await run(`UPDATE cli_device_codes SET status = 'used' WHERE device_code_hash = ?`, [row.device_code_hash]);
+ const user = await get(`SELECT * FROM users WHERE id = ?`, [row.user_id]);
+ if (!user) return res.status(400).json({ error: "invalid_grant" });
+ const { plaintext } = await createApiKey(user.id, row.name || "logicsrc cli");
+ res.json({ access_token: plaintext, token_type: "bearer", user: { id: user.id, email: user.email || null, name: user.display_name } });
+});
+
cliRouter.get("/api/me", async (req, res) => {
const user = await userForApiKey(bearer(req));
if (!user) return res.status(401).json({ error: "invalid or missing API key" });
diff --git a/docs/credential-sharing.md b/docs/credential-sharing.md
index 4fc9051..64a48bf 100644
--- a/docs/credential-sharing.md
+++ b/docs/credential-sharing.md
@@ -179,8 +179,8 @@ re-wraps (seals) it to the new member's public key. The private key lives only i
### CLI
```bash
-# One-time: log in by email (registers this device's identity key).
-logicsrc login --email you@example.com
+# One-time: log in through your browser (registers this device's identity key).
+logicsrc login
# Owner: create a team, push a local .env into an encrypted vault, invite people.
logicsrc teams create acme --name "Acme Inc"
@@ -188,7 +188,7 @@ logicsrc teams push acme prod --env .env # encrypt + upload
logicsrc teams invite acme teammate@example.com # emails an accept link
# Teammate: accept, then get granted, then pull + decrypt locally.
-logicsrc login --email teammate@example.com
+logicsrc login
logicsrc teams accept