fix(login): use the device-code flow on SSH/headless shells

The loopback flow listens on 127.0.0.1 on the machine running the CLI,
then asks a browser to redirect there. Over SSH that browser is on a
different machine, so its 127.0.0.1 is the laptop's — the auth code is
minted fine but lands nowhere, and login always times out.

Pick the flow that can actually finish: `loginAuto()` routes to the
existing device-code flow when SSH_CONNECTION/SSH_TTY is set or Linux
has no DISPLAY/WAYLAND_DISPLAY. `--browser` / MOSHCODE_LOGIN=browser
forces loopback back on; `--device` still forces the code.

Also list /login and /whoami in the TUI help, which never mentioned them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

bin/moshcode.mjs

@@ -18,7 +18,7 @@ import { runUpgrade } from "../src/upgrade.mjs";
 import { mcpCommand, skillCommand } from "../src/integrations.mjs";
 import { locate, tilde } from "../src/pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "../src/prd.mjs";
-import { login, loginDevice, whoami, logout } from "../src/auth.mjs";
+import { loginAuto, whoami, logout } from "../src/auth.mjs";
 import { tui } from "../src/tui.mjs";
 import { moshcodeVersion } from "../src/ui.mjs";
 
@@ -144,7 +144,8 @@ usage:
   moshcode prd [idea]                  publish the next numbered PRD (OpenPRD) to
                                        prd/NNNN-slug.md and hand it to an engine to
                                        author; no arg lists existing PRDs
-  moshcode login [--device]            authenticate this machine with app.moshcode.sh
+  moshcode login [--device|--browser]  authenticate this machine with app.moshcode.sh
+                                       (device code over SSH/headless; --browser forces loopback)
                                        (browser OAuth+PKCE; --device = headless/CI
                                        code flow) so notify()/ask() reach you
   moshcode whoami | logout             show / clear the logged-in account
@@ -284,8 +285,9 @@ async function main() {
   }
   if (cmd === "login") {
     const device = rest.includes("--device") || rest.includes("-d") || !process.stdin.isTTY;
+    const browser = rest.includes("--browser") || rest.includes("-b");
     try {
-      const { email } = device ? await loginDevice() : await login();
+      const { email } = await loginAuto({ device, browser });
       console.log(`✓ logged in${email ? ` as ${email}` : ""} 🤘 — notify()/ask() will reach you now.`);
     } catch (e) { console.error(String(e.message || e)); process.exitCode = 1; }
     return;

src/auth.mjs

@@ -26,6 +26,23 @@ export function saveCreds(creds) {
   fs.chmodSync(credsPath, 0o600);
 }
 
+/**
+ * True when the loopback flow can't work: the browser that opens the authorize
+ * URL is on a *different* machine than this process, so the callback to
+ * 127.0.0.1 lands on that machine and never reaches our listener. SSH sessions
+ * and headless boxes (a droplet, a container, CI) are exactly that case — there
+ * the device-code flow is the only one that can finish.
+ */
+export function isRemoteShell() {
+  const forced = String(process.env.MOSHCODE_LOGIN || "").toLowerCase();
+  if (forced === "browser") return false;
+  if (forced === "device") return true;
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT) return true;
+  // No display server on Linux → nothing here can open a browser for us.
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return true;
+  return false;
+}
+
 function openBrowser(url) {
   const [cmd, args] =
     process.platform === "darwin" ? ["open", [url]]
@@ -133,6 +150,22 @@ export async function loginDevice({ open = true } = {}) {
   }
 }
 
+/**
+ * Pick the login flow that can actually finish here. Over SSH or on a headless
+ * box the loopback callback is undeliverable (it hits the *browser's* machine),
+ * so fall back to the device code instead of stranding you on a dead
+ * 127.0.0.1 URL. `device: true` / `browser: true` force one either way.
+ */
+export async function loginAuto({ device = false, browser = false } = {}) {
+  const remote = !browser && (device || isRemoteShell());
+  if (!remote) return login();
+  if (!device) {
+    console.log(`\n🖥  remote/headless shell — using the device-code flow.`);
+    console.log(`   (a loopback callback would open on the browser's machine, not this one.)`);
+  }
+  return loginDevice({ open: !isRemoteShell() });
+}
+
 /** Print who is logged in (verified against the app). */
 export async function whoami() {
   const creds = loadCreds();

src/tui.mjs

@@ -12,7 +12,7 @@ import { TOOLS, resolveTool, toolStatus, openTool } from "./tools.mjs";
 import { runUpgrade } from "./upgrade.mjs";
 import { locate, tilde } from "./pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "./prd.mjs";
-import { login, loginDevice, whoami, logout } from "./auth.mjs";
+import { loginAuto, whoami, logout } from "./auth.mjs";
 import { runScript } from "./runtime.mjs";
 import { moshVocabulary } from "./commands.mjs";
 import { mcpCommand, skillCommand } from "./integrations.mjs";
@@ -156,6 +156,8 @@ function printHelp() {
     `   ${acid("/shell [cmd]")}        drop into $SHELL (exit → back to the pit); also ${acid("!cmd")}`,
     `   ${acid("/prd [idea]")}        publish a numbered PRD (OpenPRD), or list them with no arg`,
     `   ${acid("/run <file.mosh>")}   run a moshscript [--max N] [--dry-run]`,
+    `   ${acid("/login [--device]")}  connect this machine to app.moshcode.sh (device code over SSH)`,
+    `   ${acid("/whoami")}            who this machine is logged in as`,
     `   ${acid("/help")}              this`,
     `   ${acid("/quit")}              leave the pit  (or Ctrl-D)`,
     "",
@@ -368,7 +370,8 @@ export async function tui() {
     if (cmd === "pwd" || cmd === "where") { printPwd(); continue; }
     if (cmd === "login") {
       const device = rest.includes("--device") || rest.includes("device") || rest.includes("-d");
-      try { const { email } = device ? await loginDevice() : await login(); console.log(ok(`logged in${email ? ` as ${email}` : ""} 🤘`)); }
+      const browser = rest.includes("--browser") || rest.includes("browser") || rest.includes("-b");
+      try { const { email } = await loginAuto({ device, browser }); console.log(ok(`logged in${email ? ` as ${email}` : ""} 🤘`)); }
       catch (e) { console.log(err(String(e.message || e))); }
       continue;
     }