auth: turn-time resolution in the TUI (inline login + 401 retry)

Resolve the active provider's auth before each turn via the AuthManager,
rendering an inline device-code prompt when login is needed, and force a
single refresh/exchange retry on a provider auth failure. Wire the manager
through RunOptions from main.zig.

1 files changed, 15 insertions, 0 deletions

diff --git a/src/main.zig b/src/main.zig
index dc611b4..58502ad 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -569,6 +569,20 @@ pub fn main(init: std.process.Init) !void {
     // loop so the final frame and teardown sequences reach the terminal.
     defer tui_file.interface.flush() catch {};
 
+    // Turn-time auth resolution. The manager resolves the active provider's
+    // named auth session (api_key: no-op; oauth_device: refresh/exchange or an
+    // interactive device login) into the live config before each turn.
+    var home_layout = try panto_home.resolve(alloc, init.environ_map);
+    defer home_layout.deinit();
+    var auth_mgr = auth_manager.AuthManager.init(
+        alloc,
+        io,
+        panto.httpClient(),
+        home_layout.auth_dir,
+        &app_config,
+    );
+    defer auth_mgr.deinit();
+
     tui_app.runLoop(&app, &term, .{
         .agent = agent,
         .cmd_registry = &cmd_registry,
@@ -578,6 +592,7 @@ pub fn main(init: std.process.Init) !void {
         .cwd = cwd,
         .io = io,
         .environ = init.environ_map,
+        .auth_mgr = &auth_mgr,
     }) catch |err| switch (err) {
         // Clean user-initiated exit (Ctrl+C / Ctrl+D). Not an error.
         error.UserExit => {},