* fix: keep CLI device codes out of the OAuth code handler
The global AuthCodeHandler consumed any ?code= query param as a GitHub
OAuth completion code. CLI device login links (/cli/device?code=XXXX-XXXX)
hit that path: the device code was stripped before the page could read it,
the failed code exchange erased the active session, and the retry logic
bounced users through a surprise GitHub redirect.
Device verification links now use user_code, the OAuth handler ignores
device-shaped codes as defense in depth, and the device page accepts the
legacy param only when it matches the device code format.
* chore: refresh stale convex generated api for skillTags
Complete CLI device login with Convex-backed device-code endpoints, the web approval page, API URL discovery, endpoint rate limiting, and approval state hardening.\n\nTests:\n- bunx vitest run convex/httpApi.handlers.test.ts packages/clawhub/src/deviceAuth.test.ts\n- bun run --cwd packages/clawhub test:src -- src/deviceAuth.test.ts\n- bunx tsc --noEmit\n- bunx tsc -p packages/schema/tsconfig.json --noEmit\n- bunx tsc -p packages/clawhub/tsconfig.json --noEmit\n- bun run ci:static\n- bun run ci:types-build\n- bunx convex codegen\n\nCo-authored-by: Lumen <openclaw@openclaw-secure.local>
Patrick Erichsen