Rename setups and add provider reauthentication

app/ui-sandbox.sh

@@ -110,7 +110,7 @@ api) # ./ui-sandbox.sh api /path [curl args...]
     ;;
 spawn) # ./ui-sandbox.sh spawn [title]  -- an echo session; prints its id
     api /sessions -X POST -H 'content-type: application/json' \
-        -d "{\"setup\":\"local\",\"provider\":\"echo\",\"title\":\"${2:-test}\"}" |
+        -d "{\"machine\":\"local\",\"provider\":\"echo\",\"title\":\"${2:-test}\"}" |
         python3 -c 'import json,sys; print(json.load(sys.stdin)["id"])'
     exit 0
     ;;
@@ -150,7 +150,7 @@ if [ -f "$ROOT/config.ron" ]; then
         /^tokens: \[/ { in_tokens = 1; next }
         # The server writes the list back compactly, with the last entry
         # and the close on one line: "    ),],". Reading the close only
-        # at a line start ran past it into `setups`, and the salvage then
+        # at a line start ran past it into `machines`, and the salvage then
         # carried a second copy of that block into the new config.
         in_tokens && /\],/ {
             sub(/\],.*/, "")
@@ -213,13 +213,24 @@ while [ "$i" -le 8 ]; do
     i=$((i + 1))
 done
 
-# A CLI that does nothing, so importing one of these is free and safe.
-# Everything the spawn path cares about is here: it holds the fifo open,
-# records a real pid, writes nothing, and dies on a signal. A real
+# A CLI that does nothing during a session and offers one deterministic login
+# during `auth login`, so both paths are free and safe. Everything the spawn
+# path cares about is here: it holds the fifo open, records a real pid, writes
+# nothing, and dies on a signal. A real
 # `claude --resume` against an invented session id would either fail in a
 # way that tests nothing or start a turn on somebody's account.
 cat >"$ROOT/fake-claude" <<FAKE
 #!/bin/sh
+if [ "\${1:-}" = auth ] && [ "\${2:-}" = login ]; then
+    echo 'https://claude.com/cai/oauth/authorize?state=ai-app-sandbox'
+    while IFS= read -r code; do
+        if [ "\$code" = sandbox-code ]; then
+            exit 0
+        fi
+        echo 'Invalid code' >&2
+    done
+    exit 1
+fi
 # Slow to start, on purpose. An import against this finishes in
 # milliseconds otherwise, so every state on the way -- the row marked
 # "importing", the queue behind it, the event that clears them -- is over
@@ -346,7 +357,7 @@ tokens: [
         sha256: "$hash",
     ),
 $salvaged],
-setups: [
+machines: [
     (
         id: "local",
         name: "sandbox",