[FIX] Make local auth the default one

internal/cli/runtime.go

@@ -192,7 +192,8 @@ Values:
     user, then run auth complete after browser approval.
 
 If end-user proximity is not configured, the CLI attempts to determine it
-automatically.
+automatically. When no saved preference exists, it defaults to local (redirect
+browser consent).
 
 Guidance:
   Prefer runtime set when the agent environment is known. Persisting end-user

internal/cliruntime/runtime.go

@@ -85,7 +85,7 @@ func (r *Runtime) EndUserProximity(ctx context.Context) (EndUserProximity, error
 		if exists {
 			return st.EndUserProximity, nil
 		}
-		return EndUserProximityRemote, nil
+		return EndUserProximityLocal, nil
 	default:
 		return "", fmt.Errorf("runtime.end_user_proximity must be %q, %q, or %q", configuration.RuntimeEndUserProximityAutoDetect, configuration.RuntimeEndUserProximityLocal, configuration.RuntimeEndUserProximityRemote)
 	}
@@ -131,7 +131,7 @@ func (r *Runtime) Status(ctx context.Context) (Status, error) {
 			proximity = st.EndUserProximity
 			source = EndUserProximitySourceSavedRuntimeState
 		} else {
-			proximity = EndUserProximityRemote
+			proximity = EndUserProximityLocal
 			source = EndUserProximitySourceAutoDetect
 		}
 	default:

internal/cliruntime/runtime_test.go

@@ -47,7 +47,7 @@ func TestAutoDetectReadsRuntimeState(t *testing.T) {
 	}
 }
 
-func TestAutoDetectDefaultsRemoteWithoutRuntimeState(t *testing.T) {
+func TestAutoDetectDefaultsLocalWithoutRuntimeState(t *testing.T) {
 	rt, err := New(Config{ConfiguredEndUserProximity: configuration.RuntimeEndUserProximityAutoDetect, StateDir: t.TempDir()})
 	if err != nil {
 		t.Fatal(err)
@@ -57,8 +57,8 @@ func TestAutoDetectDefaultsRemoteWithoutRuntimeState(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got != EndUserProximityRemote {
-		t.Fatalf("expected remote fallback, got %q", got)
+	if got != EndUserProximityLocal {
+		t.Fatalf("expected local fallback, got %q", got)
 	}
 }
 
@@ -98,9 +98,9 @@ func TestStatusReportsEndUserProximitySource(t *testing.T) {
 			wantStateExists: true,
 		},
 		{
-			name:            "auto detect defaults remote without saved state",
+			name:            "auto detect defaults local without saved state",
 			configured:      configuration.RuntimeEndUserProximityAutoDetect,
-			wantProximity:   EndUserProximityRemote,
+			wantProximity:   EndUserProximityLocal,
 			wantSource:      EndUserProximitySourceAutoDetect,
 			wantStateExists: false,
 		},

internal/configuration/config.go

@@ -160,12 +160,12 @@ func validate(config Config) error {
 
 func ResolveConsentStrategy(config Config) string {
 	switch config.Runtime.EndUserProximity {
-	case RuntimeEndUserProximityLocal:
+	case RuntimeEndUserProximityLocal, RuntimeEndUserProximityAutoDetect:
 		return config.Auth.Consent.Strategy.Local
-	case RuntimeEndUserProximityAutoDetect, RuntimeEndUserProximityRemote:
+	case RuntimeEndUserProximityRemote:
 		return config.Auth.Consent.Strategy.Remote
 	default:
-		return config.Auth.Consent.Strategy.Remote
+		return config.Auth.Consent.Strategy.Local
 	}
 }
 

internal/configuration/config_test.go

@@ -30,8 +30,8 @@ func TestAssembleConfigurationUsesEmbeddedDefaults(t *testing.T) {
 	if config.Auth.Consent.Strategy.Local != ConsentStrategyRedirect || config.Auth.Consent.Strategy.Remote != ConsentStrategyBrowserSelectIcon {
 		t.Fatalf("expected default consent strategy mapping, got %#v", config.Auth.Consent)
 	}
-	if got := ResolveConsentStrategy(config); got != ConsentStrategyBrowserSelectIcon {
-		t.Fatalf("expected auto-detect consent strategy %q, got %q", ConsentStrategyBrowserSelectIcon, got)
+	if got := ResolveConsentStrategy(config); got != ConsentStrategyRedirect {
+		t.Fatalf("expected auto-detect consent strategy %q, got %q", ConsentStrategyRedirect, got)
 	}
 	if config.Credentials.StorageDir == "" || config.Credentials.StorageDir == "__default__" {
 		t.Fatalf("expected resolved credentials storage dir, got %q", config.Credentials.StorageDir)