feat(login): guest profile always opens browser claim; drop auth_intent

When guest_url is set, a valid API key no longer short-circuits login.
Preserve stale guest key on validate 401 and send guest credentials on
POST /cli-auth. Remove auth_intent from StartLogin payload.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

pkg/gateway/mcp/tool_login.go

@@ -117,11 +117,8 @@ func handleLogin(srv *Server) mcpsdk.ToolHandler {
 			saved_guest_api_key = cfg.Profile.APIKey
 		}
 
-		auth_intent := login.ResolveLoginIntent(cfg)
-
-		// Initiate browser-based device auth flow.
 		authClient := &hookdeck.Client{BaseURL: parsedBaseURL, TelemetryDisabled: cfg.TelemetryDisabled}
-		session, err := authClient.StartLogin(login.BuildStartLoginInput(cfg, auth_intent, saved_guest_api_key))
+		session, err := authClient.StartLogin(login.BuildStartLoginInput(cfg, saved_guest_api_key))
 		if err != nil {
 			return ErrorResult(fmt.Sprintf("Failed to start login: %s", err)), nil
 		}

pkg/hookdeck/auth.go

@@ -50,19 +50,10 @@ type UpdateClientInput struct {
 }
 
 // StartLoginInput configures POST /cli-auth for browser login.
-type CLIAuthIntent string
-
-const (
-	CLIAuthIntentClaimGuest CLIAuthIntent = "claim_guest"
-	CLIAuthIntentLogin      CLIAuthIntent = "login"
-	CLIAuthIntentCreateNew  CLIAuthIntent = "create_new"
-)
-
 type StartLoginInput struct {
-	DeviceName  string        `json:"device_name"`
-	AuthIntent  CLIAuthIntent `json:"auth_intent,omitempty"`
-	GuestUserID string        `json:"guest_user_id,omitempty"`
-	GuestAPIKey string        `json:"guest_api_key,omitempty"`
+	DeviceName  string `json:"device_name"`
+	GuestUserID string `json:"guest_user_id,omitempty"`
+	GuestAPIKey string `json:"guest_api_key,omitempty"`
 }
 
 // LoginSession represents an in-progress login flow

pkg/login/client_login.go

@@ -24,6 +24,8 @@ var canOpenBrowser = open.CanOpenBrowser
 func Login(config *configpkg.Config, input io.Reader) error {
 	var s *spinner.Spinner
 
+	saved_guest_api_key := ""
+
 	if config.Profile.APIKey != "" {
 		log.WithFields(log.Fields{
 			"prefix": "login.Login",
@@ -40,31 +42,11 @@ func Login(config *configpkg.Config, input io.Reader) error {
 			// Rejected key: continue into browser login below (must clear key first
 			// or we would re-enter this branch only).
 			fmt.Fprintln(os.Stdout, "Your saved API key is no longer valid. Starting browser sign-in...")
-			saved_guest_api_key := ""
 			if config.Profile.GuestURL != "" {
 				saved_guest_api_key = config.Profile.APIKey
 			}
 			config.Profile.APIKey = ""
-
-			parsedBaseURL, parseErr := url.Parse(config.APIBaseURL)
-			if parseErr != nil {
-				return parseErr
-			}
-
-			client := &hookdeck.Client{
-				BaseURL:           parsedBaseURL,
-				TelemetryDisabled: config.TelemetryDisabled,
-			}
-
-			auth_intent := resolveLoginIntent(config)
-
-			session, startErr := client.StartLogin(buildStartLoginInput(config, auth_intent, saved_guest_api_key))
-			if startErr != nil {
-				return startErr
-			}
-
-			return waitForLoginSession(config, input, session)
-		} else {
+		} else if config.Profile.GuestURL == "" {
 			message := SuccessMessage(response.UserName, response.UserEmail, response.OrganizationName, response.ProjectName, response.ProjectMode == "console")
 			ansi.StopSpinner(s, message, os.Stdout)
 
@@ -78,6 +60,9 @@ func Login(config *configpkg.Config, input io.Reader) error {
 			}
 
 			return nil
+		} else {
+			// Guest Console profile: valid key still needs browser signup to claim sandbox.
+			ansi.StopSpinner(s, "", os.Stdout)
 		}
 	}
 
@@ -91,9 +76,7 @@ func Login(config *configpkg.Config, input io.Reader) error {
 		TelemetryDisabled: config.TelemetryDisabled,
 	}
 
-	auth_intent := resolveLoginIntent(config)
-
-	session, err := client.StartLogin(buildStartLoginInput(config, auth_intent, ""))
+	session, err := client.StartLogin(buildStartLoginInput(config, saved_guest_api_key))
 	if err != nil {
 		return err
 	}

pkg/login/login_intent.go

@@ -5,37 +5,22 @@ import (
 	"github.com/hookdeck/hookdeck-cli/pkg/hookdeck"
 )
 
-func resolveLoginIntent(config *configpkg.Config) hookdeck.CLIAuthIntent {
-	has_guest_profile := config != nil && config.Profile.GuestURL != ""
-	if !has_guest_profile {
-		return hookdeck.CLIAuthIntentLogin
-	}
-	return hookdeck.CLIAuthIntentClaimGuest
-}
-
-func ResolveLoginIntent(config *configpkg.Config) hookdeck.CLIAuthIntent {
-	return resolveLoginIntent(config)
-}
-
 func BuildStartLoginInput(
 	config *configpkg.Config,
-	intent hookdeck.CLIAuthIntent,
 	saved_guest_api_key string,
 ) hookdeck.StartLoginInput {
-	return buildStartLoginInput(config, intent, saved_guest_api_key)
+	return buildStartLoginInput(config, saved_guest_api_key)
 }
 
 func buildStartLoginInput(
 	config *configpkg.Config,
-	intent hookdeck.CLIAuthIntent,
 	saved_guest_api_key string,
 ) hookdeck.StartLoginInput {
 	input := hookdeck.StartLoginInput{
 		DeviceName: config.DeviceName,
-		AuthIntent: intent,
 	}
 
-	if intent == hookdeck.CLIAuthIntentClaimGuest {
+	if config != nil && config.Profile.GuestURL != "" {
 		input.GuestUserID = guestCredentialsUserID(config)
 		input.GuestAPIKey = guestCredentialsAPIKey(config, saved_guest_api_key)
 	}