Agent-run CLI login: detached waiter keeps the OAuth loopback alive

A browser OAuth flow for a CLI usually needs the process to stay alive listening on 127.0.0.1 until the person approves, but coding agents (Claude Code, Codex) kill shell commands after roughly a minute. Pattern that keeps the security model intact: the foreground spawns a detached child (spawn with detached:true, stdio:'ignore', unref) that owns the loopback listener, starts the login, writes the link and status to an owner-only pending file, and polls to completion; the foreground opens the browser, waits ~25 s for the file to flip to complete, and otherwise exits with a distinct code (4) plus the exact command to run next. The re-run reads the file. Guard the writer so it never overwrites a 'complete' written by a manual-code path, and delete the file as soon as the key is consumed. When the browser already trusts the OAuth app, consent is skipped and the whole thing finishes in the first run.