[BYK]

Summary

• Add browser email and GitHub sign-in and improve CLI code/link verification.
• Fence login, cancellation, account changes and workspace disposal; bound optional work and prevent credential-bearing redirects.
• Remove legacy gateway-token authentication under the network-controlled operator model. Preserve native recall, provider-credential isolation and the established expiring local GitHub authorization cache.
• Integrate current main and route browser profile enrichment through coordinated, revision-bound authentication.

Validation

Candidate: 0cf9b41a5d7a2aa1b4eff91e3d440768e46c74ec, based on bebcddbb26ac1ab52b35201946c26c4d6140dd91.

• Full pnpm test passed: root 14,332 tests passed, 278 skipped; 633 files passed, 22 skipped; 2,493.45s. Chained UI suite: 1,302 tests and 66 files passed; 136.57s. No failures or unhandled errors.
• Scripted shard 2/4 with V8 coverage passed: 3,970 tests passed, 152 skipped; 158 files passed, 6 skipped; 603.91s.
• All five property-test files passed ten consecutive runs: 22 tests per run.
• Workspace typechecks, type-aware lint, formatting, core builds and gateway production bundle passed.
• Failing-first regressions cover cold-loader startup, private CLI diagnostics, UI lifecycle retirement, coordinated browser refresh and account-switch dispatch fencing.
• Known non-failing output: Vite native-config __dirname warning, expected CLI validation diagnostics, and jsdom scroll/navigation warnings. Focused, shard and property runs use --printConsoleTrace; the root test script does not forward this flag to its first Vitest command.

Remaining gates

• Fresh complete independent correctness and security source reviews and exact-head CI/coverage are pending.
• Hosted Supabase version and live redirects have not been verified.
• This PR remains draft. Do not merge without explicit authorization.

[github-actions]

PR Preview Action v1.8.2
🚀 View preview at https://withlore.ai/_preview/pr-2118/
Built to branch gh-pages at 2026-10-31 01:44 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Coverage Results 📊

✅ Patch coverage is 92.84% (337 of 363 changed executable lines covered; target 80%).
Project statement coverage is 86.59%.

Changed files with executable lines (11)

File	Patch coverage	Changed executable lines
packages/gateway/src/web-login.ts	93.47%	229/245 covered; missed: 99, 128, 129, 183, 394, 417, 426, 430, 451, 452, 478, 487, 491, 521, 522, 585; partial branches: 55, 61, 74, 80, 93, 101, 127, 135, 148, 182, 189, 211, 228, 293, 317, 411, 412, 429, 444, 450, 474, 490, 514, 520, 538, 539, 540
packages/gateway/src/cli/login.ts	86.36%	38/44 covered; missed: 226, 227, 228, 272, 376, 735; partial branches: 205, 220, 224, 543, 734
packages/gateway/src/cli/commands/auth.ts	60.00%	3/5 covered; missed: 67, 68; partial branches: 66
packages/gateway/src/cli/login-optional-worker.ts	97.06%	33/34 covered; missed: 97; partial branches: 47, 53
packages/gateway/src/api.ts	100.00%	6/6 covered; partial branches: 940
packages/gateway/src/cli/run.ts	100.00%	3/3 covered; partial branches: 232
packages/gateway/src/cli/start.ts	0.00%	0/1 covered; missed: 1504
packages/gateway/src/supabase.ts	100.00%	13/13 covered; partial branches: 363
packages/gateway/src/app.ts	100.00%	9/9 covered
packages/gateway/src/supabase-settings.ts	100.00%	2/2 covered
packages/opencode/src/index.ts	100.00%	1/1 covered

---

Generated by Coverage Action