Make github-oauth device auth code always visible and non-duplicative from helper paths

[TyceHerrman]

goal: fnox manages mise's GitHub token with an 8-hour github-oauth lease:

[leases.github]
type = "github-oauth"
client_id = "<client-id>"
env_var = "MISE_GITHUB_TOKEN"
scope = "repo read:org workflow"
duration = "8h"
open_browser = true

The problem I hit locally: when this lease needed first-time auth from my startup path, fnox opened the GitHub device page, but the 8-digit code was not visible in the terminal. Can also trigger multiple device flow browser opens

fish shell startup
mise activation / GitHub credential lookup
github.credential_command
fnox exec --config ~/.config/fnox/config.toml -- sh -c 'printf %s "$MISE_GITHUB_TOKEN"'

Result:

browser opens
device code is not displayed
auth cannot be completed

Requested behavior:

• the GitHub verification URL and 8-digit code are visible to the user before the browser opens
• stdout stays reserved for the wrapped command or credential value
• captured stderr is not the only place the actual device code is written
• if the code cannot be shown somewhere visible, fnox does not silently open the browser
• failure should be clear, e.g. interactive auth required
• stderr can still show non-sensitive status, such as fnox: waiting for GitHub OAuth device authorization
• if another process is already starting device auth for the same lease/cache key, do not start a second device flow
• instead wait for the active flow to complete and then reuse the lease, or fail clearly with auth already in progress

Possible implementation:

• write the device code to the OS controlling terminal/console when available
• on Unix this could be /dev/tty; on Windows this could use the active console, such as CONOUT$ or the appropriate console API
• do not rely only on isatty(stderr), because stderr may be redirected while a controlling terminal is still available
• flush the terminal/console write before opening the browser
• if the terminal/console write succeeds, avoid also writing the actual device code to captured stderr

researched and drafted with Codex but reviewed and finalized by me

[TyceHerrman]

quick update on the state of things now that mise has it's own oauth:

fnox still has the same helper-path issue that github-oauth prints the device URL/code to stderr and then opens the browser, which can make code hidden. so the request for fnox github-oauth to safely run from captured-output helper paths without hiding the user code or starting duplicate device flows is still relevant I think, but mise no longer needs fnox for its own GitHub token flow as described above

[jdx]

Opened PR #565 for the non-interactive-mode version of this: #565

The PR adds global --non-interactive / FNOX_NON_INTERACTIVE handling, propagates it through daemon-backed resolution, and makes github-oauth stop before starting device authorization when there is no cached/refreshable token. Cached leases still work in non-interactive mode, so helper/scheduled paths can fail clearly instead of opening a browser with no usable prompt path.

This does not try to solve duplicate concurrent device flows yet; it focuses on the “don’t start interactive auth from a non-interactive helper path” behavior we discussed here.

This comment was generated by Codex.