feat: add browser-approved CLI login

Author: OTime-Coder

DREAMNUM.md

@@ -23,7 +23,8 @@
   collaboration entry points, and background recovery processes. Contract: [Workspace README](apps/workspace/README.md)
   and [OpenAPI source](apps/workspace/contracts/http/openapi.yaml).
 - **Univer Workspace CLI** — the internally packaged `univer-workspace-cli` application for agent-driven remote
-  Workspace authoring, inspection, rendering, exchange, Worktree, and review workflows. Contract:
+  Workspace authoring, inspection, rendering, exchange, Worktree, and review workflows, with browser-approved
+  passwordless CLI session handoff for password and external-identity users. Contract:
   [CLI README](apps/cli/README.md) and [release workflow](.github/workflows/release-cli.yml).
 
 ## Depends on
@@ -63,6 +64,8 @@
   retain their identities, metadata, and recovery state.
 - Login sessions, password hashes, stable GitHub and Discord user identifiers, ACLs, sharing state, and user-authored
   content are protected application data. OAuth access tokens are used only during sign-in and are not persisted.
+- Short-lived pending CLI browser authorizations are bounded process-local state; approval issues a separate normal
+  persisted login session and does not pass a browser cookie, password, or OAuth access token through the agent.
 - OAuth secrets, trusted Bot credentials, registry credentials, production licenses, and deployment credentials are
   environment or build configuration and must not be committed to the repository.
 - Stable `vX.Y.Z` tags are immutable source coordinates shared by the stable CLI release and manually selected

apps/cli/README.md

@@ -77,6 +77,38 @@ Workspace deployment, run `univer-workspace-cli config set workspace.origin <ori
 agent access to the executable and the intended Workspace; the bundled guidance supplies the
 version-correct workflow.
 
+## Login
+
+The default login does not ask the agent for a Workspace password:
+
+```bash
+univer-workspace-cli login
+```
+
+The command prints a short-lived Workspace URL and verification code, saves the pending request
+locally, and exits immediately. The agent must send the URL and code to the user, then stop and wait
+for the user's reply—it must not poll while approval is pending. Open that URL in your own browser,
+sign in if necessary, and confirm the matching code. Existing browser sessions and all browser
+sign-in methods—including GitHub and Discord—work with this flow.
+
+Only after the user confirms approval, complete the one-time exchange:
+
+```bash
+univer-workspace-cli login --complete
+```
+
+`--complete` checks once and exits; it does not wait or poll. Approval creates a separate CLI session
+without copying the browser cookie or an OAuth access token through the agent.
+
+For compatibility, a user at an interactive terminal can still sign in directly with a Workspace
+username and password:
+
+```bash
+univer-workspace-cli login --username <name>
+```
+
+`--password-stdin` remains available for controlled automation that already owns a password secret.
+
 ## License policy
 
 The CLI bundles the same application-owned runtime development license as the

apps/cli/skill-data/core/SKILL.md

@@ -175,23 +175,37 @@ is uncertain, start a new Worktree rather than guessing.
 
 ## Connect
 
-The origin defaults to `https://workspace.univer.plus/`. Override it only when needed, then login
-without putting a password in shell history:
+The origin defaults to `https://workspace.univer.plus/`. Override it only when needed, then use the
+two-command browser approval protocol below. Never ask the user for a password.
 
 ```bash
 # Optional override:
 univer-workspace-cli config set workspace.origin https://workspace.example.com
 
-# Human at an interactive terminal:
-univer-workspace-cli login --username <name>
+# Step 1: create an approval request. This command exits immediately.
+univer-workspace-cli login --json
 
-# Agent or CI when a secret is already available:
+# Step 2: relay verificationUrl and userCode to the user, then STOP.
+# Do not poll, do not run --complete, and do not continue the Workspace task.
+# Wait until the user explicitly says that they approved the request.
+
+# Step 3: only after that user confirmation, exchange the approval once.
+univer-workspace-cli login --complete --json
+
+# Compatibility only, when the caller already owns a password secret:
 printf '%s\n' "$WORKSPACE_PASSWORD" | univer-workspace-cli login --username <name> --password-stdin
 
 univer-workspace-cli whoami --json
 univer-workspace-cli space list --json
 ```
 
+The first command returns `status: "authorization_required"`, `verificationUrl`, `userCode`,
+`expiresAt`, and `nextCommand`. The completion command also exits immediately: it returns
+`status: "authenticated"` on success or `status: "authorization_pending"` if the browser approval
+has not finished. If it is still pending, show the same URL/code to the user and wait for their
+reply; do not create a polling loop. Password, GitHub, and Discord browser accounts all use this
+same handoff.
+
 ## Start a new task
 
 ### Modify an existing file

apps/cli/src/command.ts

@@ -19,7 +19,7 @@ export async function executeCommand<Result>(
           : "";
       const hint =
         error.code === "workspace-authentication-required"
-          ? "\nHint: run univer-workspace-cli login --username <name>"
+          ? "\nHint: run univer-workspace-cli login"
           : "";
       command.error(`${error.code}: ${error.message}${detail}${hint}`, {
         code: "workspace.command.failed",

apps/cli/src/features/auth/command.ts

@@ -6,27 +6,136 @@ import { workspaceError } from "../../errors.js";
 import type { WorkspaceAuth } from "./session.js";
 
 interface LoginOptions extends JsonOption {
+  readonly complete?: boolean;
   readonly passwordStdin?: boolean;
-  readonly username: string;
+  readonly username?: string;
 }
 
 export function createAuthCommands(auth: WorkspaceAuth): readonly Command[] {
   const login = new Command("login")
-    .description("Log in to the configured Workspace")
-    .requiredOption("--username <name>", "Workspace username")
-    .option("--password-stdin", "read the password from stdin")
+    .description("Start or complete a user-approved Workspace browser login")
+    .option(
+      "--complete",
+      "complete the pending browser login after the user confirms approval",
+    )
+    .option(
+      "--username <name>",
+      "use Workspace username and password instead of browser approval",
+    )
+    .option("--password-stdin", "read the password from stdin (requires --username)")
     .option("--json", "write structured JSON")
+    .addHelpText(
+      "after",
+      [
+        "",
+        "Agent browser-login workflow:",
+        "  1. Run `univer-workspace-cli login`; it prints an approval URL and exits.",
+        "  2. Send the URL and verification code to the user, then wait for their reply.",
+        "  3. Only after the user confirms approval, run `univer-workspace-cli login --complete`.",
+        "  Do not ask the user for a password and do not poll --complete while waiting.",
+        "",
+      ].join("\n"),
+    )
     .action(async (options: LoginOptions) => {
-      const result = await executeCommand(login, async () => {
-        const password = (
-          await readPassword(options.passwordStdin === true ? "stdin" : "interactive")
-        ).replace(/\r?\n$/u, "");
-        if (password === "") {
-          throw workspaceError("workspace-argument-invalid", "Password is empty.");
+      if (options.username !== undefined) {
+        const username = options.username;
+        const result = await executeCommand(login, async () => {
+          if (options.complete === true) {
+            throw workspaceError(
+              "workspace-argument-invalid",
+              "--complete cannot be combined with --username.",
+            );
+          }
+          const password = (
+            await readPassword(options.passwordStdin === true ? "stdin" : "interactive")
+          ).replace(/\r?\n$/u, "");
+          if (password === "") {
+            throw workspaceError("workspace-argument-invalid", "Password is empty.");
+          }
+          return await auth.login({ password, username });
+        });
+        present(login, options, result, `Logged in to ${result.origin} as ${result.subject.name}`);
+        return;
+      }
+
+      if (options.passwordStdin === true) {
+        await executeCommand(login, async () => {
+          throw workspaceError(
+            "workspace-argument-invalid",
+            "--password-stdin requires --username.",
+          );
+        });
+        return;
+      }
+
+      if (options.complete === true) {
+        const result = await executeCommand(login, async () => {
+          const pending = await auth.pendingCliLogin();
+          if (pending === undefined) {
+            throw workspaceError(
+              "workspace-cli-authorization-missing",
+              "No pending browser login exists. Run login first.",
+            );
+          }
+          const completion = await auth.completeCliLogin(pending);
+          if (completion.status === "pending") {
+            return {
+              status: "authorization_pending" as const,
+              origin: pending.origin,
+              userCode: pending.userCode,
+              verificationUrl: pending.verificationUrl,
+            };
+          }
+          return completion;
+        });
+        if (result.status === "authorization_pending") {
+          present(
+            login,
+            options,
+            result,
+            [
+              "Browser approval has not completed.",
+              "This command has exited and is not waiting.",
+              "Ask the user to finish the approval, then run login --complete once more.",
+            ].join("\n"),
+          );
+          return;
         }
-        return await auth.login({ password, username: options.username });
-      });
-      present(login, options, result, `Logged in to ${result.origin} as ${result.subject.name}`);
+        present(
+          login,
+          options,
+          result,
+          `Logged in to ${result.origin} as ${result.subject.name}`,
+        );
+        return;
+      }
+
+      const pending = await executeCommand(login, async () => await auth.startCliLogin());
+      const result = {
+        status: "authorization_required" as const,
+        origin: pending.origin,
+        userCode: pending.userCode,
+        verificationUrl: pending.verificationUrl,
+        expiresAt: new Date(pending.expiresAt).toISOString(),
+        nextCommand: "univer-workspace-cli login --complete",
+      };
+      present(
+        login,
+        options,
+        result,
+        [
+          "Browser approval required.",
+          "",
+          "Send this URL and verification code to the user:",
+          pending.verificationUrl,
+          `Verification code: ${pending.userCode}`,
+          "",
+          "This command has exited and is not waiting.",
+          "Wait for the user to confirm approval. Do not poll in the meantime.",
+          "After the user confirms, run:",
+          "  univer-workspace-cli login --complete",
+        ].join("\n"),
+      );
     });
 
   const whoami = new Command("whoami")