Module identity_handlers 

Pre-launch OAuth flow RPC handlers.

Five commands per docs/specs/SPEC_PRE_LAUNCH_OAUTH_FLOW_2026_05_14.md §7:

• auth.start — StartProviderAuth
• auth.poll — PollProviderAuth
• auth.submitcallback — SubmitAuthCallback
• auth.cancel — CancelProviderAuth
• auth.submitapikey — SubmitProviderApiKey

This module owns the RPC surface and dispatches into crate::identity::auth_session::AuthSessionManager. The actual provider-CLI spawn (which feeds stdout lines into the session via record_line) lands in a follow-up commit on this branch — these handlers ship the lifecycle plumbing and return clear “spawn not yet wired” errors for the callback/api-key paths so frontend (PR B) can integrate against the real shape.

Structs

AckResp 🔒

CancelProviderAuthReq 🔒

PollProviderAuthReq 🔒

StartProviderAuthReq 🔒

SubmitAuthCallbackReq 🔒

SubmitProviderApiKeyReq 🔒

Constants

COMMAND_AUTH_CANCEL

COMMAND_AUTH_POLL

COMMAND_AUTH_START

COMMAND_AUTH_SUBMIT_API_KEY

COMMAND_AUTH_SUBMIT_CALLBACK

Functions

compute_and_ensure_bundle_dir 🔒

Compute the per-bundle OAuth config dir + ensure it exists + override the provider’s auth_config_dir_env_var entry in auth_env.

confirm_authenticated 🔒

Run the provider’s auth-check subcommand and return true if it exits 0. Failure modes (binary missing, network error, etc.) are all treated as “not authenticated” — the caller will then either keep waiting (drain task loop) or transition to Failed (exit fallback).

persist_oauth_binding_or_synthetic 🔒

On a successful OAuth handshake (CLI exited 0 + authCheckCommand confirmed), persist the OAuth binding into the bundle and return the real bundle id to use in the Success wire status.

register_identity_handlers

spawn_auth_cli 🔒

Spawn the provider’s auth-login CLI and drive the session through to a terminal state. Background-only — returns immediately. The drain task feeds stdout+stderr lines into AuthSessionManager::record_line; on a login-success pattern OR child exit, runs the provider’s authCheckCommand to confirm and transitions to Success or Failed.

spawn_auth_cli_pty 🔒

PTY-backed variant of spawn_auth_cli. Used for providers whose auth subcommand bails on isatty()==0 (currently OpenClaw). Mirrors the pipes path’s lifecycle: spawn → drain → confirm → finish_success or finish_failure → detach. Stdout+stderr are merged on the PTY side; record_line doesn’t care which stream a line came from.