feat(auth): share provider sign-in flows across clients

[juliusmarminge]

Provider setup has separate account flows for each driver, which makes new authentication methods hard to support consistently across environments and clients.

Add shared authentication contracts and interactions, a provider credential store, and account controls for web, desktop, and mobile. Coordinate credential changes with provider session admission and cleanup. Provider adapters retain ownership of token exchange and native credential formats. Account actions reflect verified sign-in state, dedicated API keys live under Setup using the shared settings row, and empty Runtime sections are hidden. The provider sidebar keeps Codex and Claude visible and only shows other default providers after configuration; configured instances remain visible when disabled. Account emails use the existing masking control.

Validation: focused authentication, credential storage, session admission, RPC authorization, Antigravity, and settings tests passed. Scoped contracts, client runtime, server, web, and mobile typechecks passed. The integrated stack passed 231 focused tests.

Shared auth review fixes from #12983 are now included on V2: response callbacks run outside the flow lock and drain before cancellation, credential responses are bounded, admitted shared-account startup is interrupted during sign-out, and peer account replacements preserve unrelated sessions. The unavailable provider icons were removed to fix the unused-export CI failure.

Latest validation: 48 focused auth, credential, routing, and admission tests plus the bounded-credentials contract regression pass. Scoped server and web typechecks pass.

The unchanged V2 selection-restart regression is fixed separately by #13113. Before/after UI evidence and provider sign-in verification are pending; this PR remains a draft.

Implemented with GPT-6 in the Codex harness.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.1 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.4 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	4.9 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.7 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	20.8 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: 9922edc · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

🟡 Medium settings/ProviderInstanceCard.tsx:758

Multiple instances of the same driver now render with the same name and status, so the sidebar no longer identifies which account users will open or toggle. The removed instanceId badge distinguished IDs such as codex and codex_work; please restore it for instances whose ID differs from instance.driver.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @apps/web/src/components/settings/ProviderInstanceCard.tsx around line 758:

Multiple instances of the same driver now render with the same name and status, so the sidebar no longer identifies which account users will open or toggle. The removed `instanceId` badge distinguished IDs such as `codex` and `codex_work`; please restore it for instances whose ID differs from `instance.driver`.

[juliusmarminge]

Not changing. The badge was removed on purpose in 9862712 ("omit instance IDs from provider sidebar"): raw instance IDs were noise in the sidebar. Instances of the same driver are meant to be told apart by the display name the user gives them.

[macroscopeapp]

I understand the intent, but the concern remains: display names are optional and fall back to the driver label, so same-driver instances without custom names are indistinguishable. The ID badge only appeared when it differed from the driver, providing that fallback.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces substantial cross-client provider authentication behavior, including shared credential storage, new RPCs, session lifecycle coordination, and new web/mobile flows. It also changes default provider presentation and leaves a concrete account-identification concern unresolved.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}