[DX-547] Add OAuth Device Authorization Grant login flow

package.json

@@ -132,6 +132,7 @@
     "ora": "^9.3.0",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
+    "slugify": "^1.6.9",
     "smol-toml": "^1.6.1",
     "ws": "^8.20.0",
     "zod": "^3.25.76"

src/base-command.ts

@@ -166,7 +166,9 @@ export abstract class AblyBaseCommand extends InteractiveBaseCommand {
   constructor(argv: string[], config: CommandConfig) {
     super(argv, config);
     this.configManager = createConfigManager();
-    this.interactiveHelper = new InteractiveHelper(this.configManager);
+    this.interactiveHelper = new InteractiveHelper(this.configManager, {
+      log: this.log.bind(this),
+    });
     // Check if we're running in web CLI mode
     this.isWebCliMode = isWebCliMode();
   }
@@ -614,15 +616,24 @@ export abstract class AblyBaseCommand extends InteractiveBaseCommand {
         if (!appName) {
           try {
             // Get access token for control API
-            const currentAccount = this.configManager.getCurrentAccount();
             const accessToken =
-              process.env.ABLY_ACCESS_TOKEN || currentAccount?.accessToken;
+              process.env.ABLY_ACCESS_TOKEN ||
+              this.configManager.getAccessToken();
 
             if (accessToken) {
+              // Mirror createControlApi's host precedence (flag → env → stored
+              // account host) so the banner's app-name lookup honours the host
+              // the user picked at login. Without the account fallback this
+              // call silently targets control.ably.net even when the user
+              // logged in against a review/staging deployment, the lookup
+              // 404s, and the banner downgrades to "Unknown App".
+              const account = this.configManager.getCurrentAccount();
               const controlApi = new ControlApi({
                 accessToken,
                 controlHost:
-                  flags["control-host"] || process.env.ABLY_CONTROL_HOST,
+                  flags["control-host"] ??
+                  process.env.ABLY_CONTROL_HOST ??
+                  account?.controlHost,
               });
               const app = await controlApi.getApp(appId);
               appName = app.name;

src/commands/accounts/current.ts

@@ -6,7 +6,6 @@ import {
   extractKeyNameFromApiKey,
 } from "../../utils/api-key.js";
 import { errorMessage } from "../../utils/errors.js";
-import { ControlApi } from "../../services/control-api.js";
 import { formatLabel } from "../../utils/output.js";
 
 export default class AccountsCurrent extends ControlBaseCommand {
@@ -42,14 +41,11 @@ export default class AccountsCurrent extends ControlBaseCommand {
       );
     }
 
-    // Verify the account by making an API call to get up-to-date information
+    // Verify the account by making an API call to get up-to-date information.
+    // Route through createControlApi so OAuth accounts get the same
+    // TokenRefreshMiddleware used by every other control command.
     try {
-      const { accessToken } = currentAccount;
-
-      const controlApi = new ControlApi({
-        accessToken,
-        controlHost: flags["control-host"],
-      });
+      const controlApi = this.createControlApi(flags);
 
       const { account, user } = await controlApi.getMe();