Function spawn_auth_cli_pty 

fn spawn_auth_cli_pty(
    mgr: Arc<AuthSessionManager>,
    mstore: Arc<Store>,
    identity_store: Arc<Store>,
    broker: Arc<Broker>,
    session_id: String,
    provider_id: String,
    into_bundle_id: Option<String>,
    bundle_dir: Option<String>,
    direct_account: bool,
    account_id: String,
    cli_path: String,
    auth_login_args: Vec<String>,
    auth_check_args: Vec<String>,
    auth_env: HashMap<String, String>,
    stdin_tx: Sender<String>,
    stdin_rx: Receiver<String>,
)

PTY-backed variant of spawn_auth_cli. Used for providers whose auth subcommand bails on isatty()==0 (currently OpenClaw). Mirrors the pipes path’s lifecycle: spawn → drain → confirm → finish_success or finish_failure → detach. Stdout+stderr are merged on the PTY side; record_line doesn’t care which stream a line came from.

Same OAuth-success invariant as the pipes path — once bundle_dir (the account’s own isolation dir) resolves and confirm_authenticated returns true, persists a standalone SecretRef::OAuthConfigDir account before finish_success — see spawn_auth_cli’s doc comment.