dev-auth: add 'get' command; rewrite AGENTS.md dev-auth as quick start + gotchas

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/dev-auth.mjs

@@ -7,9 +7,12 @@
 //   node scripts/dev-auth.mjs token     print a fresh access token
 //   node scripts/dev-auth.mjs whoami    print the token claims
 //   node scripts/dev-auth.mjs forget    delete the stored refresh token
+//   node scripts/dev-auth.mjs get PATH  authenticated GET against the otel API
+//                                       (signs in first if needed), e.g. get /api/issues
 //
 // Env: AUTH_DEV_BASE (issuer, default https://users.k6n.net),
 //      AUTH_DEVICE_CLIENT_ID (default dev-console),
+//      OTEL_URL (API for `get`, default https://otel.k6n.net),
 //      GO_AUTH_TOKEN (explicit token escape hatch; `token` prints it as-is).
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -74,7 +77,30 @@ async function token() {
   return body.access_token;
 }
 
+const API = (process.env.OTEL_URL ?? "https://otel.k6n.net").replace(/\/$/, "");
+
+async function haveSession() {
+  try {
+    await token();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Authenticated GET. Signs in first when there is no working session, so an
+// agent can just run `get /api/issues` and ask the human to approve the link.
+async function get(path) {
+  if (!path?.startsWith("/")) throw new Error("usage: dev-auth.mjs get /api/...");
+  if (!(await haveSession())) await login();
+  const res = await fetch(`${API}${path}`, { headers: { Authorization: `Bearer ${await token()}` } });
+  const text = await res.text();
+  if (!res.ok) throw new Error(`HTTP ${res.status} ${text.slice(0, 300)}`);
+  console.log(text);
+}
+
 const cmds = {
+  get: () => get(process.argv[3]),
   login,
   token: async () => console.log(await token()),
   whoami: async () => {
@@ -85,7 +111,7 @@ const cmds = {
 };
 const cmd = cmds[process.argv[2]];
 if (!cmd) {
-  console.error("usage: dev-auth.mjs login|token|whoami|forget");
+  console.error("usage: dev-auth.mjs login|token|whoami|forget|get PATH");
   process.exit(2);
 }
 cmd().catch((e) => {