TUI: Restore authentication after /logout (#14568)

## Description

Restores a complete authentication path after `/logout` in the headless
TUI.

- Shows an explicit signed-out welcome state and starts device
authorization only after user input.
- Starts fresh device authorization after local logout, then opens a
validated `/logout?continue=…` browser URL so the prior web session is
cleared first.
- Keeps the exact browser URL visible as a manual fallback and returns
to the authenticated TUI without requiring a restart.
- Validates the device continuation as same-origin, exact-path, and
CLI-sourced before passing it to the browser.

This is the client half of the auth-return handshake; the browser
implementation is in warpdotdev/warp-server#13620.

## Linked Issue

None.

- [ ] The linked issue is labeled `ready-to-spec` or
`ready-to-implement`.
- [x] Manual end-to-end verification is documented below.

## Testing

https://www.loom.com/share/2c6d09cb0d0c41658e5a97514f8f347b

- [x] `./script/format --check`
- [x] `./script/check_no_inline_test_modules`
- [x] Presubmit workspace Clippy, default `warp` Clippy, and
`warp_completer` Clippy with warnings denied
- [x] `cargo nextest run -p warp_tui` (906/906 tests passed)
- [x] Full terminal verification: signed-out welcome, unrelated input
ignored, Enter starts device auth, wrapped logout continuation opens,
browser completion returns to the authenticated TUI
- [ ] I have manually tested my changes locally with `./script/run`

The changed surface is the headless TUI, so manual verification used the
real TUI in a full terminal rather than the GUI `./script/run` path.

## Agent Mode

- [x] Warp Agent Mode - This PR was created via Warp's AI Agent Mode

Co-Authored-By: Oz [oz-agent@warp.dev](mailto:oz-agent@warp.dev)

---------

Co-authored-by: Oz <oz-agent@warp.dev>

Author: moirahuang

app/src/auth/mod.rs

@@ -20,6 +20,8 @@ pub use auth_manager::AuthManager;
 pub use auth_state::AuthStateProvider;
 use itertools::Itertools;
 pub use login_failure_notification::LoginFailureReason;
+#[cfg(feature = "tui")]
+use url::Url;
 pub use user_uid::UserUid;
 use warp_core::channel::ChannelState;
 use warp_core::user_preferences::GetUserPreferences as _;
@@ -76,6 +78,37 @@ pub fn web_logout_url() -> String {
     )
 }
 
+/// Returns the configured Warp web logout URL with a validated browser continuation.
+///
+/// TUI logout only continues to the same Warp web origin's device page. This
+/// keeps the logout endpoint from becoming an open redirect if an unexpected
+/// device-authorization response reaches the client.
+#[cfg(feature = "tui")]
+pub fn web_logout_url_with_continue(continue_url: &str) -> Option<String> {
+    let mut logout_url =
+        Url::parse(&web_logout_url()).expect("configured Warp web logout URL must be valid");
+    let continue_url = Url::parse(continue_url).ok()?;
+    let has_required_query = continue_url
+        .query_pairs()
+        .any(|(key, value)| key == "user_code" && !value.is_empty())
+        && continue_url
+            .query_pairs()
+            .any(|(key, value)| key == "source" && value == "warp-agent-cli");
+    if continue_url.origin() != logout_url.origin()
+        || continue_url.path() != "/device"
+        || !continue_url.username().is_empty()
+        || continue_url.password().is_some()
+        || continue_url.fragment().is_some()
+        || !has_required_query
+    {
+        return None;
+    }
+    logout_url
+        .query_pairs_mut()
+        .append_pair("continue", continue_url.as_str());
+    Some(logout_url.into())
+}
+
 /// If the app has running processes or dirty objects, we'll show a confirmation modal before logging out.
 /// If the user aborts, the user will not be logged out.
 pub fn maybe_log_out(app: &mut AppContext) {

app/src/auth/mod_tests.rs

@@ -1,6 +1,8 @@
 use warp_core::channel::ChannelState;
 
 use super::web_logout_url;
+#[cfg(feature = "tui")]
+use super::web_logout_url_with_continue;
 
 #[test]
 fn web_logout_url_uses_configured_server_root() {
@@ -10,3 +12,46 @@ fn web_logout_url_uses_configured_server_root() {
         format!("{}/logout", server_root_url.trim_end_matches('/'))
     );
 }
+
+#[test]
+#[cfg(feature = "tui")]
+fn web_logout_url_rejects_unsafe_device_auth_continuations() {
+    let server_root_url = ChannelState::server_root_url();
+    for continue_url in [
+        "https://example.com/device?user_code=ABCD-EFGH&source=warp-agent-cli".to_owned(),
+        format!(
+            "{}/login?user_code=ABCD-EFGH&source=warp-agent-cli",
+            server_root_url.trim_end_matches('/')
+        ),
+        format!(
+            "{}/device?source=warp-agent-cli",
+            server_root_url.trim_end_matches('/')
+        ),
+        format!(
+            "{}/device?user_code=ABCD-EFGH",
+            server_root_url.trim_end_matches('/')
+        ),
+    ] {
+        assert_eq!(web_logout_url_with_continue(&continue_url), None);
+    }
+}
+
+#[test]
+#[cfg(feature = "tui")]
+fn web_logout_url_encodes_device_auth_continuation() {
+    let continue_url = format!(
+        "{}/device?user_code=ABCD-EFGH&source=warp-agent-cli",
+        ChannelState::server_root_url().trim_end_matches('/')
+    );
+    let logout_url =
+        url::Url::parse(&web_logout_url_with_continue(&continue_url).unwrap()).unwrap();
+
+    assert_eq!(logout_url.path(), "/logout");
+    assert_eq!(
+        logout_url
+            .query_pairs()
+            .find(|(key, _)| key == "continue")
+            .map(|(_, value)| value.into_owned()),
+        Some(continue_url)
+    );
+}