[jridey-nullify]

Browser login failed against the hardened auth API because the CLI discarded the callback's redemption secret.

• Validate the callback session and a single 64-character hexadecimal secret before accepting it.
• Send the secret with the session ID when redeeming tokens; reject malformed callbacks without consuming a valid retry.
• Deliver concurrent callbacks once and prevent callback-response caching.
• Replace premature browser success with an acknowledgement directing users to the terminal.

flowchart LR
    B["Browser completes login"] --> C["Localhost callback validates session and secret"]
    C --> R["Changed: CLI sends both values to token endpoint"]
    R --> S["Store credentials after successful redemption"]

Loading

Companion backend: https://github.com/Nullify-Platform/nullify/pull/13493.

Live radiant verification: the installed 0.25.3 client failed with missing redemption_secret; this build completed browser login and an authenticated repos read against the updated backend.