feat(cli): support OIDC device authorization grant for headless login

architecture/gateway.md

@@ -174,7 +174,7 @@ Supported auth modes:
 | Plaintext | Local development or a trusted reverse proxy boundary. |
 | Unauthenticated local users | Trusted Kubernetes dev or fully trusted proxy deployments only. |
 | Cloudflare JWT | Edge-authenticated deployments where Cloudflare Access supplies identity. |
-| OIDC | Bearer-token auth for users, with browser PKCE or client credentials login. |
+| OIDC | Bearer-token auth for users, with browser or device-code PKCE and client credentials login. |
 
 The CLI persists the scopes requested during OIDC login in gateway metadata and
 reuses them when refreshing an access token. This preserves the intended API

crates/openshell-cli/src/commands/gateway.rs

@@ -905,6 +905,26 @@ pub async fn gateway_add(
                     false
                 }
             }
+        } else if is_browser_suppressed() {
+            match crate::oidc_auth::oidc_device_code_flow(
+                issuer,
+                oidc_client_id,
+                oidc_audience,
+                oidc_scopes,
+                gateway_insecure,
+            )
+            .await
+            {
+                Ok(bundle) => {
+                    openshell_bootstrap::oidc_token::store_oidc_token(name, &bundle)?;
+                    eprintln!("{} Authenticated via device code", "✓".green().bold());
+                    true
+                }
+                Err(e) => {
+                    eprintln!("{} Authentication failed: {e}", "!".yellow());
+                    false
+                }
+            }
         } else {
             match crate::oidc_auth::oidc_browser_auth_flow(
                 issuer,
@@ -1129,6 +1149,15 @@ pub async fn gateway_login(name: &str, gateway_insecure: bool) -> Result<()> {
                     gateway_insecure,
                 )
                 .await?
+            } else if is_browser_suppressed() {
+                crate::oidc_auth::oidc_device_code_flow(
+                    issuer,
+                    client_id,
+                    audience,
+                    scopes,
+                    gateway_insecure,
+                )
+                .await?
             } else {
                 crate::oidc_auth::oidc_browser_auth_flow(
                     issuer,