fix(cli): make login tests hermetic (kill the 10-min network-flake)

[ZacxDev]

Root cause

TestLoginEmptyTokenViaStdinFails (in internal/cmd/cmd_test.go) was flaky and could time out at Go's 10-min test ceiling in CI.

civitai login now defaults to the OAuth device flow: with no --token, RunE calls loginWithDevice → oc.StartDevice(ctx), a real network call to base_url. The old test set stdin to "\n" expecting the old personal-key token-prompt error ("no token provided"), but the default path no longer reads stdin. The test only set XDG_CONFIG_HOME (not CIVITAI_BASE_URL), so base_url defaulted to the real https://civitai.com — the test made an actual production device-login attempt.

• Egress open → StartDevice succeeds → PollToken loops until the device-code expiry (~10 min) waiting for an approval that never comes → Go's 10-min timeout fires.
• Egress blocked → StartDevice fails in ~30s → test passes.

Hence flaky (network-dependent), and a real production device-login attempt from CI.

The fix

Replaced the obsolete test with TestLoginDeviceStartFailureReturnsError (hermetic, deterministic):

• Stands up an httptest.NewServer whose device-init endpoint (/api/auth/oauth/device) returns 403 {"error":"invalid_client"}.
• Pins the CLI at it via t.Setenv("CIVITAI_BASE_URL", srv.URL) so it never touches civitai.com.
• Runs login --no-browser and asserts: an error is returned, it reports the device-init failure, the poll endpoint is never reached (proves it fails at init, no ~10-min poll), nothing is persisted, and it completes sub-second (asserts < 5s).

The old test's intent ("empty token via stdin fails") is obsolete: loginWithToken's empty-prompt branch is only reachable when --token is passed, and RunE only calls loginWithToken when the trimmed --token is non-empty — so that branch is unreachable from the CLI. No point asserting a path that can't be triggered; the new test asserts the real, reachable default behavior (device login fails cleanly).

Other network-touching tests

Audited all of internal/cmd/*_test.go and internal/api/*_test.go. Every other HTTP-exercising test already stands up an httptest server and overrides CIVITAI_BASE_URL (whoami, app submit upload paths, all oauth/api tests). The no-token app submit path falls back to writing a local zip — no network. This was the only test that could reach the real network. go test ./... no longer depends on outbound network.

Proof — fast & deterministic, no real network

• go build ./... green; go vet ./internal/cmd/... green.
• go test ./internal/cmd/... ./internal/api/... passes in ~2s (was a 10-min timeout when the flake tripped). The new test itself runs in 0.00s. The residual ~2s is TestLoginDeviceFlowHappyPath's two 1s device-flow interval sleeps against its local httptest server — not the network.
• Hermeticity proven by re-running both packages inside an unshare -rn network namespace with an empty route table (external TCP to a public IP returns connect: network is unreachable). Tests still pass in ~2s, proving no real egress is required.

Product code

None changed — test-only. (The HTTP client already has a 30s timeout and PollToken is deadline-bounded by ExpiresIn; the perceived "hang" was the device-code lifetime, which the user Ctrl-Cs. Not over-engineered here — test hermeticity is the actual fix.)

🤖 Generated with Claude Code