feat(dashboard): add dashboard auth, app management, and first-time setup wizard

[AaronDDM]

Summary

• Dashboard auth: Register and login via SSO (Google, Microsoft, GitHub) with device-code flow, MFA support, and DPoP-protected tokens
• Application management: List, create, and select active applications via the Dashboard GraphQL API
• API key management: Create API keys and activate them directly into the CLI keyring (keys are never printed to stdout)
• nylas init wizard: Guided first-time setup that takes a new user from zero to working CLI in one command — account creation, app setup, API key generation, and grant sync
• nylas config reset: Full CLI reset (credentials, dashboard session, grants, config) with confirmation prompt
• Redesigned first-run welcome screen: Branded, visually polished experience with box-drawing UI

First-Run Welcome Screen

When a new user runs nylas with no configuration, they see this:

  ╭──────────────────────────────────────────╮
  │                                          │
  │   ◈  N Y L A S   C L I                  │
  │                                          │
  │   Email, calendar, and contacts          │
  │   from your terminal.                    │
  │                                          │
  ╰──────────────────────────────────────────╯

  Get started in under a minute:

    ❯ nylas init                Guided setup
      nylas init --api-key      Quick setup with existing key

  ╭─ What you can do ────────────────────────╮
  │                                          │
  │  email       Send, search, and read      │
  │  calendar    Events and availability     │
  │  contacts    People and groups           │
  │  webhook     Real-time notifications     │
  │  ai          Chat with your data         │
  │                                          │
  ╰──────────────────────────────────────────╯

  nylas --help              All commands
  https://cli.nylas.com     Documentation

With terminal colors: ◈ N Y L A S C L I in bold cyan, box borders dim, capability names cyan, ❯ nylas init bold cyan, secondary options dim. No new dependencies — uses existing fatih/color + Unicode box-drawing characters.

To test: nylas config reset --force && nylas

nylas init — First-Time User Experience

The wizard walks through 4 steps:

1. Account — Register, login via SSO, or paste an existing API key
2. Application — Auto-create or select from existing apps
3. API Key — Generate and activate into the keyring
4. Grants — Sync existing email accounts from the Nylas API

Key design decisions:

• Re-entrant: running nylas init again skips completed steps
• Non-interactive: nylas init --api-key <key> for CI/scripts
• Graceful recovery: each step prints manual commands on failure
• Errors propagate: wizard no longer reports success when steps 2/3 fail

nylas config reset

Full CLI reset that clears all stored state:

• API credentials (API key, client ID, client secret)
• Dashboard session (login tokens, selected app)
• Grants (authenticated email accounts)
• Config file (reset to defaults)

Requires confirmation by default, --force to skip. Individual resets (nylas auth config --reset, nylas dashboard logout) remain scoped to their own domains.

Bug Fixes

• Wizard false success: Steps 2 (application) and 3 (API key) now return errors instead of swallowing them and printing "Setup complete"
• SSO ignores --org: orgPublicID is now threaded through the full SSO flow (poll + MFA) so multi-org users can target the correct organization
• Dashboard logout stale app: clearTokens() now also clears dashboard_app_id and dashboard_app_region to prevent reusing a previous account's app context
• Wizard grant sync: User's default grant selection from the multi-grant prompt is now persisted to config.yaml (was only written to keyring)
• DPoP redirect bug: HTTP clients for DPoP-protected requests no longer follow redirects, preventing htu mismatch errors when staging URLs redirect to production

New Files

File	Purpose
internal/cli/setup/setup.go	nylas init Cobra command
internal/cli/setup/wizard.go	4-step interactive wizard
internal/cli/setup/wizard_helpers.go	Menus, display, verification helpers
internal/cli/setup/detect.go	IsFirstRun() and GetSetupStatus()
internal/cli/setup/grants.go	Shared SyncGrants() (extracted from auth/config)
internal/cli/setup/setup_test.go	Table-driven unit tests
internal/cli/dashboard/exports.go	Exported wrappers for dashboard services
internal/cli/config/reset.go	nylas config reset command
internal/cli/config/reset_test.go	Tests for reset command
internal/app/auth/config_test.go	Tests for ResetConfig scope

Test plan

• go build ./... compiles
• go vet ./... passes
• Unit tests pass (go test ./internal/cli/setup/...)
• Config/reset tests pass (go test ./internal/cli/config/...)
• Auth config tests pass (go test ./internal/app/auth/...)
• Full unit test suite passes (make test-unit)
• Linter passes (golangci-lint run)
• Security scan passes (make security)
• Manual: nylas config reset --force && nylas shows new welcome
• Manual: nylas init interactive wizard with SSO
• Manual: nylas init --api-key <key> non-interactive
• Manual: nylas init re-run skips completed steps
• Manual: nylas dashboard login --google --org <org> targets correct org
• Manual: nylas dashboard logout clears app selection

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qasim-nylas]

LGTM 👍

[qasim-nylas]

LGTM 👍

[qasim-nylas]

LGTM 👍

[qasim-nylas]

LGTM 👍