fix: share in-flight auth attempt across ssh sessions and kill abandoned flows

An abandoned OIDC browser flow (browser closed without completing) held
the auth mutex for the plugin's full 5-minute timeout, silently blocking
every subsequent ssh session behind it.

* Coalesce concurrent Auth.Run calls into a shared flight: joiners get
  the pending user output (auth URL) replayed and share the result, so
  one browser flow serves all waiting sessions
* Kill the auth command (whole process group) when every waiting caller
  has canceled; thread the gRPC match stream context through so a dead
  ssh session abandons its auth and CA work
* Hold broker lock only around agents-map access, never across auth or
  CA calls, so concurrent matches can actually share the flight
* Always emit the auth URL on fd 4 from the OIDC plugin so joining
  sessions see where to authenticate

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: brianm

.tasks/in-progress/yv12wc30.md

@@ -0,0 +1,49 @@
+---
+yatl_version: 1
+title: Fix abandoned OIDC auth flow blocking subsequent ssh sessions
+id: yv12wc30
+created: 2026-07-13T16:37:06.749142730Z
+updated: 2026-07-13T17:37:00.803717631Z
+author: Brian McCallister
+priority: high
+tags:
+- bug
+- broker
+- auth
+---
+
+When an OIDC browser auth flow is abandoned (browser closed without completing), Auth.Run in pkg/broker/auth.go holds the mutex for the full auth subprocess lifetime (up to the 5-minute timeout in cmd/epithet/auth_oidc.go). Subsequent ssh sessions block on the mutex at broker.go Match -> auth.Run and never pop the browser or show the auth URL.
+
+Fix:
+1. Singleflight: second concurrent caller joins the in-flight auth attempt instead of queueing a second subprocess; re-emit pending fd-4 user output (auth URL) to each joined caller's userOutput.
+2. Cancelation: thread context from the match request through Auth.Run -> exec.CommandContext so a dead ssh session kills its auth subprocess and releases the flow — but only when ALL attached waiters have gone away.
+
+---
+# Log: 2026-07-13T16:37:06Z Brian McCallister
+
+Created task.
+
+---
+# Log: 2026-07-13T16:37:15Z Brian McCallister
+
+Started working.
+
+---
+# Log: 2026-07-13T16:37:20Z Brian McCallister
+
+Started working.
+
+---
+# Log: 2026-07-13T16:37:40Z Brian McCallister
+
+Started working.
+
+---
+# Log: 2026-07-13T16:47:15Z Brian McCallister
+
+COMPLETED: Singleflight + cancelation implemented. Auth.Run(ctx, attrs, userOutput) now coalesces concurrent callers into one authFlight: joiners get fd-4 output replayed (pending auth URL), share the result; subprocess killed (whole process group, SIGKILL) only when all waiters cancel; abandoned flights are not joinable - new callers wait for wind-down then start fresh. Context threaded from gRPC stream.Context() through MatchWithUserOutput -> auth.Run/GetCert. b.lock narrowed to agents-map ops; ensureAgent now takes b.lock itself. Tests: auth_singleflight_test.go (share-one-command, cancel-kills-process, joiner-survives-leader-cancel), all pass with -race. NEXT: manual verification of real browser flow, then commit.
+
+---
+# Log: 2026-07-13T17:37:00Z Brian McCallister
+
+COMPLETED: fd-4 fix in pkg/auth/oidc - plugin previously wrote the auth URL only to stderr and only on browser-open failure, so joiners of a shared flight saw nothing. Now always writes 'To authenticate, visit: URL' to fd 4 (user-visible progress) when the callback server is ready; broker replays it to joining sessions. Best-effort write when no fd 4 (standalone runs). DECISION: kept singleflight over concurrent-flights/last-writer-wins because IdP behavior is unknown - refresh-token rotation with reuse detection makes concurrent refreshes unsafe, plus browser popup storms on parallel ssh. NEXT: manual verification of real browser flow, then commit.

pkg/auth/oidc/oidc.go

@@ -14,6 +14,19 @@ import (
 	"golang.org/x/oauth2"
 )
 
+// userOutput is fd 4 per the epithet auth plugin protocol: user-visible
+// progress. The broker streams it to the requesting ssh session and replays
+// it to any session that joins an in-flight authentication attempt.
+var userOutput io.Writer = os.NewFile(4, "user-output")
+
+// notifyUser writes a user-visible progress message to fd 4. Best effort:
+// when running outside the broker (no fd 4), the write fails silently.
+func notifyUser(format string, args ...any) {
+	if userOutput != nil {
+		_, _ = fmt.Fprintf(userOutput, format, args...)
+	}
+}
+
 // Config holds OIDC authentication configuration.
 type Config struct {
 	IssuerURL    string
@@ -170,9 +183,14 @@ func performFullAuth(ctx context.Context, oauth2Config oauth2.Config) (*oauth2.T
 	// Wait for the local server to be ready, then open browser
 	select {
 	case url := <-readyChan:
+		// Always surface the URL as user-visible progress, so a session
+		// waiting on this flow (including one that joined it after the
+		// browser was closed) can complete authentication manually.
+		notifyUser("To authenticate, visit: %s\n", url)
 		// Attempt to open the browser
 		if err := browser.OpenURL(url); err != nil {
 			// Browser failed to open - user needs the URL to authenticate manually
+			notifyUser("Could not open browser automatically: %v\n", err)
 			fmt.Fprintf(os.Stderr, "Could not open browser automatically: %v\n", err)
 			fmt.Fprintf(os.Stderr, "Please visit: %s\n", url)
 		}

pkg/auth/oidc/oidc_test.go

@@ -1,6 +1,7 @@
 package oidc
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"testing"
@@ -9,6 +10,23 @@ import (
 	"golang.org/x/oauth2"
 )
 
+// TestNotifyUser tests that user-visible progress goes to the fd 4 writer
+// and that a missing fd 4 does not panic.
+func TestNotifyUser(t *testing.T) {
+	orig := userOutput
+	defer func() { userOutput = orig }()
+
+	var buf bytes.Buffer
+	userOutput = &buf
+	notifyUser("To authenticate, visit: %s\n", "https://example.com/auth")
+	if got := buf.String(); got != "To authenticate, visit: https://example.com/auth\n" {
+		t.Errorf("unexpected user output: %q", got)
+	}
+
+	userOutput = nil
+	notifyUser("should not panic")
+}
+
 // TestTokenStateMarshaling tests that oauth2.Token can be marshaled/unmarshaled as expected.
 func TestTokenStateMarshaling(t *testing.T) {
 	original := &oauth2.Token{