feat: adopt wata device-code transport for cli auth by jxom · Pull Request #750 · tempoxyz/accounts

jxom · 2026-08-01T05:44:41Z

Rewrites accounts/cli onto the Wata device-code transport (RFC 8628 with PKCE), adds an accounts/deviceCode adapter with a tempoWallet preset, and removes CliAuth and Handler.codeAuth from accounts/server, aligning CLI auth with the wallet's other uRPC transports.

Wallet counterpart: https://github.com/tempoxyz/wallet/pull/651

vercel · 2026-08-01T05:44:46Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
accounts-site	Ready	Preview	Aug 2, 2026 5:02am

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c872eacf4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

# Conflicts: # pnpm-lock.yaml # ref-impls/cli-auth/cli.ts # ref-impls/cli-auth/package.json # ref-impls/cli-auth/src/App.tsx # ref-impls/cli-auth/worker/approve.ts # ref-impls/cli-auth/worker/deps.ts # ref-impls/cli-auth/worker/index.ts # src/cli/Provider.localnet.test.ts # src/cli/adapter.ts # src/server/CliAuth.test-d.ts # src/server/CliAuth.test.ts # src/server/CliAuth.ts # src/server/internal/handlers/codeAuth.ts

jxom · 2026-08-01T07:58:08Z

Merged main. The CLI limit-update feature from #748 is ported onto the new transport: cli() now runs wallet_updateAccessKey as its own device-code exchange (the request carries the current pending authorization; the wallet returns a verified replacement, or nothing after an on-chain update), applied via store.accessKeys.updateAuthorization.

pkg-pr-new · 2026-08-01T07:59:06Z

Open in StackBlitz

npm i https://pkg.pr.new/tempoxyz/accounts@750

commit: cc9af34

github-actions · 2026-08-01T07:59:35Z

Worker	Preview
Wagmi	https://c457635e-accounts-wagmi.porto.workers.dev

github-actions · 2026-08-01T07:59:38Z

Worker	Preview
Playground	https://ca3443e4-accounts-playground.porto.workers.dev

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 420553c843

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc76f4f464

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-02T04:18:37Z

+      if (!prompt.verificationUriFull)
+        process.stdout.write(`Enter code ${prompt.userCode} at ${prompt.verificationUri}\n`)


Format the raw code in the fallback prompt

When the CLI uses the new Handler.deviceCode host, whose registration response intentionally exposes the raw eight-character protocol value, and verificationUriFull is absent, this renders ABCDEFGH instead of the required human-facing ABCD-EFGH. Apply hyphen formatting only to the text written to stdout while preserving the raw value in the protocol request.

AGENTS.md reference: AGENTS.md:L55-L58

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-02T04:18:37Z

+              const validation = await validate?.({
+                record,
+                request: pending,
+                result: submittedResult,
+                userCode,
+              })
+              if (validation) return validation


Require validation before approving submitted results

When a host uses the documented Handler.deviceCode configuration without the optional validate callback, POST /verify accepts a browser-supplied RPC result and marks the device code approved without authenticating the submitter or verifying that the result is valid for the pending request. Since Handler.from also enables wildcard CORS by default, anyone who obtains the displayed user code can submit a fabricated connect or signing result; make validation mandatory or provide a safe authentication and method-validation default before calling actions.approve.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-02T04:18:37Z

+  results: z.optional(
+    z.array(z.object({ id: z.union([z.string(), z.number()]), result: z.unknown() })),
+  ),


Relay RPC errors from the approval page

When executing an approved wallet request fails for a reason other than explicit denial, the approval page has no valid response shape it can submit: every entry is required to contain result, and an RPC error entry fails this schema. The verify request therefore returns 400 while the device record remains pending, so the client eventually reports a timeout instead of the actual wallet error; accept result-or-error envelopes and call event.reject for submitted errors.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc9af34ab7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-02T05:01:17Z

+              if ('result' in response) {
+                const validation = await validate({
+                  record,


Run approval policy for error and denial responses

When the host relies on the required validate callback to protect POST /auth/device/verify, an approval containing an RPC error bypasses it because validation runs only for entries with result; the earlier action === 'deny' branch bypasses it as well. With the default wildcard CORS behavior, anyone who obtains a pending user code can therefore settle the request as rejected without satisfying the host's authentication or method policy. Although validate is now required, this new conditional is fresh evidence that non-success settlements remain unvalidated; invoke a policy/authentication hook before both actions.approve and actions.deny, expanding its input to support error envelopes.

Useful? React with 👍 / 👎.

feat: adopt wata device-code transport for cli auth

c872eac

vercel Bot deployed to Preview August 1, 2026 05:52 View deployment

jxom marked this pull request as ready for review August 1, 2026 06:54

chatgpt-codex-connector Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread ref-impls/cli-auth/package.json

Comment thread src/core/adapters/deviceCode/deviceCode.ts Outdated

jxom added 2 commits August 1, 2026 17:29

feat: support access key limit updates over device code

420553c

vercel Bot deployed to Preview August 1, 2026 08:06 View deployment

chatgpt-codex-connector Bot reviewed Aug 1, 2026

View reviewed changes

Comment thread src/cli/adapter.ts

Comment thread src/core/adapters/internal/fromRequest.ts

Comment thread src/cli/adapter.ts

Comment thread package.json

feat: add device code handler

5f31724

vercel Bot deployed to Preview August 2, 2026 02:28 View deployment

deprecate legacy CLI auth

a3c6a68

vercel Bot deployed to Preview August 2, 2026 03:04 View deployment

jxom added 2 commits August 2, 2026 14:02

fix device code compatibility

7fe83b0

add device code approval validation

dc76f4f

vercel Bot deployed to Preview August 2, 2026 04:17 View deployment

chatgpt-codex-connector Bot reviewed Aug 2, 2026

View reviewed changes

jxom added 2 commits August 2, 2026 14:49

fix: harden device code approvals

dc502fa

preserve device code limit periods

cc9af34

chatgpt-codex-connector Bot reviewed Aug 2, 2026

View reviewed changes

vercel Bot deployed to Preview August 2, 2026 05:02 View deployment

		if (!prompt.verificationUriFull)
		process.stdout.write(`Enter code ${prompt.userCode} at ${prompt.verificationUri}\n`)

Uh oh!

Conversation

jxom commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

jxom commented Aug 1, 2026

Uh oh!

pkg-pr-new Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jxom commented Aug 1, 2026 •

edited

Loading

vercel Bot commented Aug 1, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 1, 2026 •

edited

Loading

github-actions Bot commented Aug 1, 2026 •

edited

Loading

github-actions Bot commented Aug 1, 2026 •

edited

Loading