Function spawn_auth_cli 

pub(crate) fn spawn_auth_cli(
    mgr: Arc<AuthSessionManager>,
    mstore: Arc<Store>,
    identity_store: Arc<Store>,
    broker: Arc<Broker>,
    session_id: String,
    provider_id: String,
    into_bundle_id: Option<String>,
    bundle_dir: Option<String>,
    direct_account: bool,
    account_id: String,
    cli_path: String,
    auth_login_args: Vec<String>,
    auth_check_args: Vec<String>,
    auth_env: HashMap<String, String>,
    requires_tty: bool,
)

Spawn the provider’s auth-login CLI and drive the session through to a terminal state. Background-only — returns immediately. The drain task feeds stdout+stderr lines into AuthSessionManager::record_line; on a login-success pattern OR child exit, runs the provider’s authCheckCommand to confirm and transitions to Success or Failed.

On the success path (CLI exited cleanly + authCheckCommand passed), persists a standalone IdentityAccount (persist_oauth_direct_account) with SecretRef::OAuthConfigDir pointing at bundle_dir (the account’s own isolation dir — see compute_and_ensure_account_dir), status valid. account_id is the id minted/reused for that account. After this point, future launches of any agent linked to the account resolve through inject_identity_env’s oauth-class dispatch and reuse the same CLI-managed tokens.

into_bundle_id/direct_account are vestigial parameters kept only so the wire request shape and call sites don’t need touching — bundle mode (binding into db_identity_bundles) was retired in Phase 4c of SPEC_PRESET_TO_BUNDLE_REFACTOR_2026_07_02.md; persist_oauth_success always takes the direct-account path now.