[mkherlakian]

What

hookdeck login and the MCP login tool now show a confirmation code next to the sign-in link. The browser page asks for that code before it connects the CLI (RFC 8628 user_code).

To authenticate with Hookdeck, please go to: https://dashboard.hookdeck.com/cli-auth/...
When the page asks for a code, enter: WDJB-MJHT

How

• StartLogin sends with_user_code: true to POST /cli-auth and reads user_code from the response into LoginSession.UserCode.
• printLoginLink prints the code under the URL on both paths: SSH or no browser, and the Enter-to-open path.
• The MCP login tool adds the code to the text it returns, both when it starts the login and in its "already in progress" reminder.

Compatibility

• An API that doesn't issue codes drops the unknown field and returns no user_code. The CLI then prints only the link, as it does today, so this can ship before or after the API change.
• Older CLIs that don't send the flag are unaffected.

Tests

• pkg/hookdeck/auth_test.go: the request carries with_user_code, a returned code is read, and a missing one leaves UserCode empty.
• pkg/login/login_link_test.go: the printed output with and without a code.
• pkg/gateway/mcp/server_test.go: the code appears in the first and in-progress results, and no code line appears without one.
• I reverted each change in turn (request flag, response parsing, printing, both MCP messages) and watched the matching test fail, then restored it.
• go vet ./... passes. go test ./... passes except TestLogin_rejectedKeyHeadlessFailsFast and TestCheckServerHealth_DefaultPorts. Both fail the same way on unmodified main in the Docker golang:1.26 container I ran them in (no DNS, and TTY detection behaves differently there).

🤖 Generated with Claude Code