From 90d5cf78462f4f2895d2b88f84a488de89bc442f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Hou=C5=A1ka?= Date: Fri, 9 Oct 2026 00:38:00 +0200 Subject: [PATCH] docs(coding-agent): shorten device-code login guidance --- packages/coding-agent/docs/custom-provider.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/coding-agent/docs/custom-provider.md b/packages/coding-agent/docs/custom-provider.md index a3b0ee807..ec8ea52da 100644 --- a/packages/coding-agent/docs/custom-provider.md +++ b/packages/coding-agent/docs/custom-provider.md @@ -138,7 +138,7 @@ An OAuth provider supplies a display name, login flow, token refresh, and access OAuth callbacks are UI-neutral. They can open an authorization URL, show a device code, report progress, request input, or ask the user to choose a login method. Honor cancellation and the supplied abort signal during network requests. -Device-code login offers browser opening and code copying on Enter (`tui.select.confirm`) by default. Confirmation is optional; users can complete login manually without opening a browser or changing the clipboard. Set `openBrowserOnConfirm` or `copyCodeOnConfirm` to `false` in the `onDeviceCode` payload to disable either action. Native `AuthEvent` device-code notifications support the same flags. +Press Enter (`tui.select.confirm`) to open the device-login URL and copy the code, or log in manually. Providers can disable either action with `openBrowserOnConfirm: false` or `copyCodeOnConfirm: false` in `onDeviceCode` or native `AuthEvent` notifications. Never write access tokens, refresh tokens, authorization headers, or complete provider responses to ordinary logs.