Support side-effect-free device sign-in and token-free auth status/reload #5358

Request

Please provide supported interfaces for two integration needs:

1. A device-code sign-in mode that does not launch a browser or modify the clipboard, while retaining the CLI's normal organization-policy and secure-persistence checks. A documented, non-debug logging mode should prevent authentication instructions or credentials from appearing in application logs.
2. A token-free authentication status/reload command suitable for an already-running session: report only a coarse status and refresh/reload the CLI's own stored authentication without printing credentials, reading them on the integrator's behalf, or initiating a new device flow. A successful status/reload acknowledgement should not be presented as proof that the model answered.

Motivation

A person may approve the CLI's own device flow from another device while the CLI runs on an unattended personal machine. Browser/clipboard side effects are undesirable in that setting. Integrators need a supported agent-owned path rather than package patches, environment tricks, credential-file inspection, or implementing OAuth themselves.

Suggested contract

• Explicit no-browser/no-clipboard controls, documented alongside device-code login.
• Private machine-readable instructions with native expiry metadata and constant terminal outcomes, with secrets excluded from ordinary logs/transcripts.
• Coarse status/reload results with no tokens or credential contents and no automatic sign-in.

This is a feature request, not a credential report. No sign-in codes, tokens, account names, private paths or internal endpoints are included.