feat(auth): add Scalar-safe CLI authentication

[Stephanie (stephanieatdedalus)]

Summary

Adds the complete CLI authentication integration for ENG-743, including Clerk OAuth with PKCE, secure credential persistence, session refresh and logout, authenticated generated commands, safe output and errors, and HTTP/WebSocket transport coverage.

The published CLI now uses a Dedalus-owned entry point under src/custom. Scalar-owned SDK, runtime, command assembly, and generated entry points remain untouched. A CI boundary check prevents future custom commits from modifying those implementation files.

Scalar workflow

• Base branch: scalar-next
• Custom implementation: src/custom and new handwritten integration files
• No custom commits to scalar-generated
• Scalar-owned implementation files protected by npm run scalar:check

Test plan

• npm run scalar:check
• npm run typecheck
• npm test — 118 passing
• npm run pack:check

Linear issue

Ref ENG-743

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​ws@​8.18.1
	npm/​proper-lockfile@​4.1.2
	npm/​@​napi-rs/​keyring@​1.3.0
	npm/​@​types/​proper-lockfile@​4.1.4
	npm/​open@​11.0.1
	npm/​ws@​8.21.3

View full report

[Shengming Liang (LiangShengming)]

blocking: the published CLI replaces Scalar’s generated runtime with a 771-line copied runtime, so the new boundary check proves only that certain paths are untouched—not that Scalar runtime updates reach the executable.

package.json:6-17 points the published binary and package entry point at src/custom; src/custom/program.ts:4 imports ./runtime.js; and src/custom/runtime.ts:1-771 is a derived copy of src/cli/runtime.ts with a relatively small patch. A future Scalar build will update src/cli/runtime.ts, but the published CLI will continue executing the copied runtime without a merge conflict or drift signal.

That is contrary to the maintenance model Scalar documents: customization belongs on scalar-next, where its three-way merge carries edits to generated files across regeneration. Scalar recommends separate helpers where possible, but copying and bypassing the complete generated runtime turns visible merge maintenance into silent divergence: https://scalar.com/products/sdk-generator/custom-code

Please keep the Dedalus-owned entry point and src/custom/auth/**, but delete the copied runtime and have the custom program use Scalar’s createProgram and runtime types from src/cli/runtime.ts. If formatError, stdin/WebSocket handling, or another missing extension requires a runtime change, make the smallest reviewed patch to the generated runtime on scalar-next—or upstream a narrow extension hook—and add a regeneration test proving the patch survives fresh Scalar output. The thin custom entry point is a sound seam; owning a second full runtime is not.

[Shengming Liang (LiangShengming)]

Published CLI
→ src/custom/program.ts
→ src/custom/runtime.ts ← 771-line copy
✕ src/cli/runtime.ts ← future Scalar updates unused

That means scalar:check passes, but future Scalar runtime fixes will update a runtime the published CLI no longer uses.

Proposal:
Published CLI
→ thin Dedalus custom entry point
→ Scalar src/cli/runtime.ts
→ Dedalus auth hooks/helpers under src/custom
→ Scalar SDK

[Stephanie (stephanieatdedalus)]

Addressed in 49852e2.

• Deleted the 771-line src/custom/runtime.ts copy.
• Reconnected src/custom/program.ts and runtime regression coverage directly to Scalar’s src/cli/runtime.ts.
• Kept only the narrow reviewed runtime patch on scalar-next (36 additions / 27 deletions versus the Scalar base).
• Updated the boundary guard so the SDK client and generated entry points remain protected while the runtime is the explicit integration seam.
• Added scalar-regeneration-boundary.test.mjs to prove the published CLI imports Scalar’s runtime, required hooks remain present, and no custom runtime copy can return.
• Updated the README to document the three-way-merge maintenance model.

Verification: 119 tests passing, typecheck passing, package check passing, and all PR checks green. Ready for re-review.