fix: route cross-device OAuth through device flow

test/distribution.test.ts

@@ -13,8 +13,13 @@ test("customer distribution prefers remote MCP OAuth and keeps a generic compati
   assert.match(installer, /URL：`\{\{GATEWAY_URL\}\}`/);
   assert.match(installer, /认证：OAuth/);
   assert.match(installer, /动态客户端注册/);
+  assert.match(installer, /127\.0\.0\.1.*localhost.*同一台设备/s);
+  assert.match(installer, /SSH.*无头终端.*Messenger.*手机或另一台电脑/s);
+  assert.match(installer, /无法确定.*只问用户一个问题/s);
   assert.match(installer, /不要安装 Node\.js、npm、本地 Bridge/);
-  assert.match(installer, /只有.*不支持远程 Streamable HTTP MCP.*标准 OAuth.*兼容/s);
+  assert.match(installer, /只有.*不支持远程 Streamable HTTP MCP.*标准 OAuth.*无法.*本机回调.*兼容/s);
+  assert.match(installer, /device-code.*手机或另一台电脑/s);
+  assert.match(installer, /跨设备交互.*直接进入兼容路径.*不必先制造.*失败/s);
   assert.match(installer, /COMPAT_INSTALL_URL/);
   assert.match(installer, /approval_list_todos.*source="all".*limit=1/s);
   assert.match(installer, /钉钉 OA 与薪福通来源都为 `ok`/);
@@ -22,7 +27,8 @@ test("customer distribution prefers remote MCP OAuth and keeps a generic compati
   assert.doesNotMatch(installer, /--host|WorkBuddy|Codex|Claude/);
 
   const compatibilityInstaller = readFileSync("distribution/agent-compat-install.template.md", "utf8");
-  assert.match(compatibilityInstaller, /仅当.*不支持远程 Streamable HTTP MCP.*标准 OAuth/s);
+  assert.match(compatibilityInstaller, /仅当.*不支持远程 Streamable HTTP MCP.*标准 OAuth.*无法.*本机 OAuth 回调/s);
+  assert.match(compatibilityInstaller, /127\.0\.0\.1.*localhost.*SSH.*无头环境.*Messenger.*device-code/s);
   assert.match(compatibilityInstaller, /Ed25519/);
   assert.match(compatibilityInstaller, /使用 `mcpConfig`/);
   assert.match(compatibilityInstaller, /Windows（PowerShell）/);
@@ -72,9 +78,10 @@ test("customer distribution prefers remote MCP OAuth and keeps a generic compati
   assert.match(skill, /read `references\/create-approval\.md` completely/);
   assert.doesNotMatch(skill, /XFT recall is experimental/);
   assert.match(createApproval, /XFT recall is experimental.*XFTSYS9999/s);
-  assert.match(skill, /host's native remote-MCP OAuth flow by default/);
+  assert.match(skill, /native remote-MCP OAuth flow when the user can complete its registered callback/);
+  assert.match(skill, /127\.0\.0\.1.*localhost.*same device.*SSH.*headless.*Messenger.*cross-device.*STDIO Bridge device-code/s);
   assert.match(skill, /both DingTalk OA and XFT must be available/);
-  assert.match(skill, /Only hosts that cannot use remote Streamable HTTP MCP or standard OAuth.*local STDIO Bridge/s);
+  assert.match(skill, /cannot use remote Streamable HTTP MCP or standard OAuth.*cross-device users.*loopback callback.*local STDIO Bridge/s);
   assert.match(skill, /authChallenge\.directUrl.*current reply/s);
   assert.match(skill, /onboarding\.firstRun=true.*Do not execute an example automatically/s);
   assert.match(skill, /link expires.*approval_login.*Never reinstall/s);