Add 'ucloud auth login' / 'ucloud auth logout' implementing OAuth 2.0
authorization-code flow with RFC 8252 loopback auto-capture of the
callback (--no-browser prints the URL and falls back to manual paste).
auth_mode on the profile picks exactly one credential mechanism per
request: oauth profiles send Authorization: Bearer only (stored AK/SK
stay inert for logout restore), AK/SK and CloudShell signing paths are
byte-identical to before.

Token lifecycle is fully automatic: proactive refresh before expiry
(5-minute clock-skew margin), reactive refresh-and-replay-once when the
gateway rejects a token mid-command (RetCode 174), refresh rotation
serialized across processes with a file lock plus reread-after-lock,
and credential/config files written atomically (temp+fsync+rename).
Token values are redacted across all log sinks and the panic path.

Also fixes: config update --base-url validated against the old gateway
(chicken-and-egg), login kept a stale project_id from another account,
init on an oauth profile did not persist the switch back to AK/SK,
/dev/null was misdetected as an interactive terminal, and
AggConfigManager held process-lifetime file handles that break
os.Rename on Windows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…arning; redact oauth error desc

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… base/endpoints.go

Move the API gateway base URL, OAuth base URL, client credentials,
scope, /authorize and /token endpoint paths, and the loopback callback
constants into one file grouped by service domain. The callback path is
now a single exported constant (base.OAuthRedirectPath) shared by the
redirect_uri builder and the callback server's mux, removing a
cross-file duplicate that had to be kept in sync by hand. No behavior
change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…r defaults

DefaultBaseURL belongs with the other profile-default constants; a
dedicated file separated it from its peers. Keep the overridable default
URLs together (api gateway + oauth) and group the OAuth protocol/loopback
constants in config.go. No behavior change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…bal flag

Mirror --base-url: add --oauth-base-url to config add/update, a global
--oauth-base-url override, and the GlobalFlag/mergeConfigIns plumbing so
oauth_base_url can be configured without hand-editing config.json — needed
for environments whose OAuth domain differs from the default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-domain login

A new user targeting a non-default OAuth environment was stuck: the
global --oauth-base-url is not accepted on the auth command group,
config update needs an existing profile, and config add requires AK/SK.
auth login now takes its own --oauth-base-url, usable with no prior
config and persisted to the profile so later refreshes reuse it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… auth login only

The config add/update flags and the global --oauth-base-url override added
in dd60cef were over-built: config add targets AK/SK profiles where an
oauth domain is meaningless, and the global flag only affects the rare
refresh path. auth login --oauth-base-url is the one entry point that
solves the real case (first-time / custom-domain login) and is kept.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…s stay omitempty

On login, an oauth profile persists its effective OAuth base URL (the
--oauth-base-url value, or the built-in default) so it is visible in the
profile and reused by later refreshes. AK/SK profiles are untouched and
keep oauth_base_url omitted (omitempty); GetOAuthBaseURL's runtime
default still applies to old or hand-edited profiles.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat: OAuth browser login with automatic token lifecycle (0.3.1)

…m struct

- Remove memcacheCreateParams struct and createMemcache helper function
- Use SDK request object directly since memcache only has one create type
- Keep redis param structs as they are shared between master-replica and distributed types

Co-Authored-By: Claude <noreply@anthropic.com>

- Use bindRegionS/bindZoneS/bindProjectIDS helpers to reduce code duplication
- Add name validation with utf8.RuneCountInString for Chinese support
- Add password validation with len() (ASCII only)
- Add distributed redis validation: size must be divisible by block-cnt, proxy-size must be multiple of 2
- Update help text for name and password flags

Co-Authored-By: Claude <noreply@anthropic.com>

- Change size-gb default value from 1GB to 2GB
- Simplify size-gb help text
- Add support for 'uregionredis' prefix in redis delete command

Co-Authored-By: Claude <noreply@anthropic.com>

…n-update

Update the new architecture interface of the umem (#94)