feat(cli): browser device login for shelve login

[HugoRCD]

Summary

• Add RFC 8628 device authorization flow: shelve login opens the browser, user signs in and approves, CLI receives a revocable API token (90-day, read/write).
• Backend: cli_device_auth table, /api/auth/device/* routes, auto token creation with audit source: cli-device-flow.
• Web: /cli/authorize page plus CLI-aware copy on /login when redirect targets the device flow (no redundant alert banners).
• CLI: DeviceAuthService, flags --no-browser and --with-token; SHELVE_TOKEN / --token unchanged for CI.
• Docs, agent skill, changesets (@shelve/cli + @shelve/app minor), unit tests for redirect parsing and device code hashing.

Test plan

• pnpm db:migrate on a fresh/local app DB
• pnpm dev + unset SHELVE_TOKEN + SHELVE_URL=http://localhost:3000 pnpm cli login
• Complete browser flow → terminal shows logged-in user; token appears in /user/tokens as CLI — {hostname}
• pnpm cli login --with-token and SHELVE_TOKEN=… pnpm cli login --token still work
• pnpm exec vitest run test/unit/cli-authorize-redirect.test.ts test/unit/cli-device-auth.test.ts in apps/shelve

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shelve-app	Ready	Preview, Comment, Open in v0	May 31, 2026 1:52pm
shelve-lp	Error		May 31, 2026 1:52pm
shelve-vault	Error		May 31, 2026 1:52pm

[coderabbitai]

Warning

Review limit reached

@HugoRCD, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 minutes and 48 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3c41e143-18ab-4379-bcd9-ad8928a44618

📥 Commits

Reviewing files that changed from the base of the PR and between f247f0c and 7647aee.

📒 Files selected for processing (27)

• .changeset/cli-device-login.md
• apps/lp/content/docs/1.getting-started/2.quickstart.md
• apps/lp/content/docs/3.cli/4.login-logout.md
• apps/lp/skills/shelve/SKILL.md
• apps/lp/skills/shelve/cli-commands.md
• apps/shelve/app/middleware/guest.ts
• apps/shelve/app/pages/cli/authorize.vue
• apps/shelve/app/pages/login.vue
• apps/shelve/server/api/auth/device/approve.post.ts
• apps/shelve/server/api/auth/device/deny.post.ts
• apps/shelve/server/api/auth/device/index.get.ts
• apps/shelve/server/api/auth/device/index.post.ts
• apps/shelve/server/api/auth/device/token.post.ts
• apps/shelve/server/db/migrations/postgresql/0008_cli_device_auth.sql
• apps/shelve/server/db/migrations/postgresql/meta/_journal.json
• apps/shelve/server/db/schema.ts
• apps/shelve/server/middleware/auth-redirect.ts
• apps/shelve/server/services/cli-device-auth.ts
• apps/shelve/shared/cli-authorize.ts
• apps/shelve/test/unit/cli-authorize-redirect.test.ts
• apps/shelve/test/unit/cli-device-auth.test.ts
• docs/agents/cli.md
• packages/cli/src/commands/login.ts
• packages/cli/src/services/base.ts
• packages/cli/src/services/device-auth.ts
• packages/cli/src/utils/error-codes.ts
• packages/cli/test/error-codes.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/cli-device-login

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Thank you for following the naming conventions! 🙏

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@shelve/cli@756

commit: 7647aee