tempo wallet login: CLI never receives auth callback

[MajorTal]

Summary

tempo wallet login opens the browser and the user can authenticate successfully (passkey + email), but the CLI never receives the session token. The wallet shows as logged in on the browser, but tempo wallet whoami returns ready: false and logged_in: false.

Steps to Reproduce

1. Install tempo v1.4.3 on macOS (arm64)
2. Run tempo wallet login
3. Complete authentication in the browser (passkey via phone)
4. Browser shows wallet dashboard / "Add funds" page — auth succeeded
5. CLI remains stuck waiting indefinitely
6. tempo wallet whoami returns {"ready":false}
7. tempo wallet debug returns {"logged_in":false}

Investigation

Running with -vvvv shows the CLI opens the browser and then waits, but no further trace output appears after auth completes in the browser:

Auth URL: https://wallet.tempo.xyz/cli-auth?auth=eng:...&code=XXXXXXXX
TRACE default browser is file:///Applications/Google%20Chrome.app/
TRACE about to start browser: Default for https://wallet.tempo.xyz/cli-auth?auth=eng:...&code=XXXXXXXX
TRACE received status: 0
(nothing further — CLI hangs here)

Curling the status endpoint that the CLI appears to poll:

curl -sv "https://wallet.tempo.xyz/api/cli-auth/status?auth=eng:...&code=XXXXXXXX"

Returns a 302 redirect to /api/cli-auth/status?code=XXXXXXXX (stripping the auth param and setting an rpc_auth cookie), and the redirected URL returns a 404 page.

Environment

• tempo v1.4.3 (a35c7d1bc)
• wallet extension v0.1.4 (eee9ae7)
• macOS Darwin 25.2.0 (arm64 / Apple Silicon)
• Browsers tested: Chrome, Safari — same result
• Passkey created on iPhone, used cross-device via WebAuthn

[MajorTal]

Additional Investigation

Extracted the auth flow from the tempo-wallet binary debug symbols:

Actual CLI Auth Flow (Device Code / PKCE)

1. CLI POSTs to /cli-auth/device-code with a PKCE code_challenge
2. Opens browser to wallet.tempo.xyz/cli-auth?auth=eng:{code}&code={display_code}
3. CLI repeatedly POSTs to /cli-auth/poll/{code} waiting for PollResponse.status == "authorized"
4. On success, response includes account_address + key_authorization, written to keys.toml

Observed Behavior

• Browser auth completes successfully (passkey via phone, wallet dashboard loads)
• CLI poll never transitions from "pending" to "authorized" — hangs indefinitely
• No additional TRACE output after the browser opens, even with -vvvv
• Multiple attempts, fresh installs, different browsers — same result

Possible Causes

• The browser-side passkey callback may not be posting the auth result to the backend path that /cli-auth/poll/{code} reads from
• PKCE code_verifier/code_challenge validation may be silently failing
• The "Add funds" page (shown after auth) may be intercepting the flow before the completion callback fires
• The auth=eng:{identifier} stayed constant across all attempts (eng:acard-melody-fashion-finish), suggesting it's machine-derived — if this is used for correlation, it may be colliding across sessions

Source Locations (from debug symbols)

• crates/tempo-wallet/src/commands/login.rs
• crates/tempo-common/src/keys/keystore.rs
• crates/tempo-common/src/config.rs

[Slokh]

Is this 100% reproducible or does it work sometimes?

[MajorTal]

For me it is every time