From a8aa1fe0dcef40a96b660064c7b6dbccf533fa37 Mon Sep 17 00:00:00 2001
From: James Grugett <jahooma@gmail.com>
Date: Wed, 20 May 2026 11:11:01 -0700
Subject: [PATCH] Handle missing CLI auth code tokens

---
 freebuff/web/src/app/onboard/page.tsx | 21 +++++++++++++++++++++
 web/src/app/onboard/page.tsx          | 10 ++++++++++
 2 files changed, 31 insertions(+)

diff --git a/freebuff/web/src/app/onboard/page.tsx b/freebuff/web/src/app/onboard/page.tsx
index 36efd07c85..76a3257286 100644
--- a/freebuff/web/src/app/onboard/page.tsx
+++ b/freebuff/web/src/app/onboard/page.tsx
@@ -126,6 +126,27 @@ const Onboard = async ({ searchParams }: PageProps) => {
     )
   }
 
+  if (authCodeResolution.status === 'missing') {
+    logger.info(
+      {
+        authCodeLength: authCode.length,
+        authCodeTrimmedLength: authCode.trim().length,
+        authCodeHashPrefix: getCliAuthCodeHashPrefix(authCode),
+        isOpaqueAuthCodeToken: isOpaqueCliAuthCodeToken(authCode),
+        userId: user.id,
+      },
+      'Missing Freebuff CLI auth code token',
+    )
+
+    return (
+      <StatusCard
+        title="Login link expired"
+        description="This browser login link is no longer active."
+        message="Return to your terminal and restart Freebuff to generate a new login link."
+      />
+    )
+  }
+
   const {
     authCode: resolvedAuthCode,
     resolvedOpaqueToken,
diff --git a/web/src/app/onboard/page.tsx b/web/src/app/onboard/page.tsx
index d89ff79435..1edd11c12e 100644
--- a/web/src/app/onboard/page.tsx
+++ b/web/src/app/onboard/page.tsx
@@ -69,6 +69,16 @@ const Onboard = async ({ searchParams }: PageProps) => {
     )
   }
 
+  if (authCodeResolution.status === 'missing') {
+    return (
+      <CardWithBeams
+        title="This login link has expired"
+        description="Return to your terminal and restart Codebuff to generate a new login link."
+        content={<p>You can close this browser window.</p>}
+      />
+    )
+  }
+
   const { authCode: resolvedAuthCode } = authCodeResolution
   const { fingerprintId, expiresAt, receivedHash } =
     parseAuthCode(resolvedAuthCode)