feat(setup): Use new browser signup/signin and org/project selection flow

[Luca Forstner (lforst)]

Uses new sign-in flow introduced in

• https://github.com/braintrustdata/braintrust/pull/13858
• https://github.com/braintrustdata/braintrust/pull/13869

DO NOTE MERGE until those are merged.

Changes:

• Opens the users browser on the newly introduced wizard flow pages
• Polls the session endpoint until the user has completed it
• Picks up api key, org and project from poll result and prints selected org/project to the user

Tested locally by just running while braintrust dev server is running: cargo run -- setup --app-url http://localhost:3000 --no-skills

wizard-flow.mp4

[github-actions]

Latest downloadable build artifacts for this PR commit b5e942fb1879:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/25920444803
• Download all artifacts (GitHub CLI): gh run download 25920444803 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• ``artifacts-build-global
• ``artifacts-build-local-x86_64-apple-darwin
• ``artifacts-build-local-x86_64-pc-windows-msvc
• ``artifacts-build-local-aarch64-pc-windows-msvc
• ``artifacts-build-local-x86_64-unknown-linux-musl
• ``artifacts-build-local-x86_64-unknown-linux-gnu
• ``artifacts-build-local-aarch64-apple-darwin
• ``artifacts-build-local-aarch64-unknown-linux-gnu
• ``artifacts-plan-dist-manifest
• ``cargo-dist-cache

[Cedric / ViaDézo1er (viadezo1er)]

Edit: forgot --api-url when specifying --app-url, forget this issue.

I think this breaks login for all other bt commands:

bt auth login
✔ Select login method · OAuth (browser)
Opening browser for OAuth authorization...
If it does not open, visit:
https://api.braintrust.dev/oauth/authorize?response_type=code&client_id=bt_cli_default&state=...
Waiting for browser authorization...
Paste code=...&state=... if callback doesn't complete
error: request failed (401 Unauthorized): Failed to validate Clerk JWT: Error: Unable to find a signing key in JWKS that matches the kid='...' of the provided session token. Please make sure that the __session cookie or the HTTP authorization header contain a Clerk-generated session JWT. The following kid is available: ... [timestamp=1779140533.591]

[Luca Forstner (lforst)]

I think this breaks login for all other bt commands:

bt auth login
✔ Select login method · OAuth (browser)
Opening browser for OAuth authorization...
If it does not open, visit:
https://api.braintrust.dev/oauth/authorize?response_type=code&client_id=bt_cli_default&state=...
Waiting for browser authorization...
Paste code=...&state=... if callback doesn't complete
error: request failed (401 Unauthorized): Failed to validate Clerk JWT: Error: Unable to find a signing key in JWKS that matches the kid='...' of the provided session token. Please make sure that the __session cookie or the HTTP authorization header contain a Clerk-generated session JWT. The following kid is available: ... [timestamp=1779140533.591]

I don't think I changed the code path for bt auth login. This looks more like an error that came from the backend tbh. Could you point to one of my changes that you think would trigger this?

[Cedric / ViaDézo1er (viadezo1er)]

Classic PEBKAC case, no issue in the code. I forgot to login incognito mode and the --api-url flag.

[Cedric / ViaDézo1er (viadezo1er)]

Previously bt setup kept the user logged-in, so they could run other braintrust commands afterwards (including another bt setup).
This is no longer the case with this pr.
Is it voluntary?