Phase 268 (builds on 267): real interactive auth for CLIs that use a browser/device OAuth flow + CLI uninstall.
- Paste-back auth: the CLI prints a sign-in URL, you authorize in the browser and paste the code BACK into the login (stdin write-back via a live-process registry + cliInstaller.sendAuthInput). claude-code now defaults to this bare headless login, with an 'Use an API key instead' fallback.
- CLI uninstall: per-install-method removal (npm/binary/pip/source) + config/api-key cleanup, two-step confirm, Uninstall button on installed rows; aion-cli is not uninstallable; snow-cli removes only its known paths (Snowflake collision guard). The removed agent disappears from /api/agents via the debounced liv-assistant restart.
- New tRPC mutations (sendAuthInput, uninstall) are admin-gated, whitelist-guarded (D-239-07), and in httpOnlyPaths. The pasted code is written only to stdin, never logged.
- 5 code-review fixes incl. WR-04 (made the paste-back flow reachable), stdin broken-pipe crash-safety, and uninstall config-dir cleanup.
Full Changelog: v44.2...v44.3