Module identity_auth_spawn 

Subprocess spawn/drain engine for the pre-launch OAuth flow.

Split out of identity_handlers.rs (module-organization pass, see docs/specs/PLAN_LOGIN_SINGLE_PATH_CONSOLIDATION_2026_07_20.md) — owns spawn_auth_cli (plain piped-stdio spawn), spawn_auth_cli_pty (PTY-backed spawn for providers whose auth subcommand requires an interactive TTY), and confirm_authenticated (the shared authCheckCommand probe both spawn paths use). Both spawn paths call into identity_auth_persist::persist_oauth_success on the OAuth- success path.

Constants

AUTH_CHECK_TIMEOUT_SECS 🔒

How long a provider’s auth-status check may take (confirm_authenticated).

Functions

confirm_authenticated 🔒

Run the provider’s auth-check subcommand and return true if it exits 0. Failure modes (binary missing, network error, etc.) are all treated as “not authenticated” — the caller will then either keep waiting (drain task loop) or transition to Failed (exit fallback).

spawn_auth_cli 🔒

Spawn the provider’s auth-login CLI and drive the session through to a terminal state. Background-only — returns immediately. The drain task feeds stdout+stderr lines into AuthSessionManager::record_line; on a login-success pattern OR child exit, runs the provider’s authCheckCommand to confirm and transitions to Success or Failed.

spawn_auth_cli_pty 🔒

PTY-backed variant of spawn_auth_cli. Used for providers whose auth subcommand bails on isatty()==0 (currently OpenClaw). Mirrors the pipes path’s lifecycle: spawn → drain → confirm → finish_success or finish_failure → detach. Stdout+stderr are merged on the PTY side; record_line doesn’t care which stream a line came from.