fix(cli): keep no-wait reauth JSON parseable

docs-site/src/content/docs/fr/reference/cli/providers-accounts.md

@@ -321,6 +321,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+En cas de succès, `ocx account main reauth --device --no-wait --json` écrit un seul objet JSON sur stdout, sans la ligne destinée à la lecture humaine `follow up:`. Utilisez son `flowId` avec `ocx account main reauth status --flow <id> --json` pour suivre la progression.
+
 Chaque commande de mutation rapporte le `CODEX_HOME` effectif canonique renvoyé par le proxy en cours d'exécution.
 Ce chemin peut différer du `CODEX_HOME` de l'appelant ; les commandes qui prennent en charge JSON exposent le même
 valeur comme `effectiveCodexHome`.

docs-site/src/content/docs/ja/reference/cli/providers-accounts.md

@@ -250,6 +250,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json` は成功時に単一の JSON オブジェクトを stdout に出力し、人向けの `follow up:` 行は出力しません。進行状況は、返された `flowId` を `ocx account main reauth status --flow <id> --json` に指定して確認できます。
+
 各変更コマンドは、実行中のプロキシが返す正規化済みの有効な `CODEX_HOME` を表示します。このパスは
 呼び出し元の `CODEX_HOME` と異なる場合があり、JSON 対応コマンドは同じ値を
 `effectiveCodexHome` として返します。

docs-site/src/content/docs/ko/reference/cli/providers-accounts.md

@@ -315,6 +315,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json`은 성공 시 stdout에 JSON 객체 하나만 출력하며, 사람이 읽는 `follow up:` 안내 줄은 출력하지 않습니다. 반환된 `flowId`를 `ocx account main reauth status --flow <id> --json`에 지정하면 진행 상태를 확인할 수 있습니다.
+
 각 변경 명령은 실행 중인 프록시가 반환한 정규화된 유효 `CODEX_HOME`을 표시합니다. 이 경로는
 호출자의 `CODEX_HOME`과 다를 수 있으며, JSON을 지원하는 명령은 같은 값을
 `effectiveCodexHome`으로 반환합니다.

docs-site/src/content/docs/reference/cli/providers-accounts.md

@@ -497,6 +497,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json` writes one JSON object to stdout on success, without the human-readable `follow up:` line. Use its `flowId` with `ocx account main reauth status --flow <id> --json` to check progress.
+
 Each mutating command reports the canonical effective `CODEX_HOME` returned by the running proxy.
 This path can differ from the caller's `CODEX_HOME`; commands that support JSON expose the same
 value as `effectiveCodexHome`.

docs-site/src/content/docs/ru/reference/cli/providers-accounts.md

@@ -309,6 +309,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+При успехе `ocx account main reauth --device --no-wait --json` выводит в stdout один объект JSON без строки `follow up:`, предназначенной для чтения человеком. Чтобы проверить ход процесса, передайте полученный `flowId` в `ocx account main reauth status --flow <id> --json`.
+
 Каждая изменяющая команда показывает канонический эффективный `CODEX_HOME`, возвращенный
 работающим прокси. Этот путь может отличаться от `CODEX_HOME` вызывающего процесса; команды с
 поддержкой JSON возвращают то же значение в `effectiveCodexHome`.

docs-site/src/content/docs/tr/reference/cli/providers-accounts.md

@@ -370,6 +370,8 @@ ocx account main switch <profil-id-veya-etiket> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json` başarılı olduğunda stdout'a tek bir JSON nesnesi yazar; insan tarafından okunabilir `follow up:` satırını yazmaz. İlerlemeyi kontrol etmek için döndürülen `flowId` değerini `ocx account main reauth status --flow <id> --json` komutuna iletin.
+
 Değiştiren her komut çalışan proxy tarafından döndürülen kurallı etkin
 `CODEX_HOME`'u bildirir. Bu yol arayanın `CODEX_HOME`'undan farklı olabilir;
 JSON'ı destekleyen komutlar aynı değeri `effectiveCodexHome` olarak açığa

docs-site/src/content/docs/zh-cn/reference/cli/providers-accounts.md

@@ -280,6 +280,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json` 成功时只向 stdout 输出一个 JSON 对象，不输出供人阅读的 `follow up:` 提示行。将返回的 `flowId` 传给 `ocx account main reauth status --flow <id> --json` 即可查看进度。
+
 每个变更命令都会显示运行中代理返回的规范化有效 `CODEX_HOME`。该路径可能与调用进程的
 `CODEX_HOME` 不同；支持 JSON 的命令会在 `effectiveCodexHome` 中返回相同的值。
 

docs-site/src/content/docs/zh-tw/reference/cli/providers-accounts.md

@@ -228,6 +228,8 @@ ocx account main switch <profile-id-or-label> --yes [--json]
 ocx account main recover [--rollback --yes] [--json]
 ```
 
+`ocx account main reauth --device --no-wait --json` 成功時只會向 stdout 輸出一個 JSON 物件，不會輸出供人閱讀的 `follow up:` 提示行。將回傳的 `flowId` 傳給 `ocx account main reauth status --flow <id> --json` 即可查看進度。
+
 每個會變更狀態的命令都會回報執行中代理回傳的 canonical 有效 `CODEX_HOME`。這個路徑可能與
 呼叫端的 `CODEX_HOME` 不同；支援 JSON 的命令以 `effectiveCodexHome` 暴露同一個值。
 

src/cli/account-main.ts

@@ -245,7 +245,7 @@ export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): P
     }
     if (noWait) {
       printStatus({ flowId: startFlowId, ...pending });
-      console.log("follow up: ocx account main reauth status --flow " + startFlowId);
+      if (!wantsJson) console.log("follow up: ocx account main reauth status --flow " + startFlowId);
       return 0;
     }
     // Blocking wait bounded by the service flow expiry (15-minute grant + margin).

structure/clients/claude-desktop.md

@@ -12,6 +12,8 @@ Claude-only connections keep their existing non-failing readiness policy; displa
 
 The hub-side CLI dashboard uses the [management ingress address](../runtime.md#hub-management-dashboard-address); this does not change connected Desktop profile endpoints.
 
+Native main reauthentication follows the [CLI JSON output contract](../runtime.md#native-main-reauth-json-output).
+
 ## Connected Claude Desktop profiles
 
 The connection's local Codex readiness check follows the [selected-runtime probe contract](../runtime.md#remote-hub-hardening-ownership); general status hands its resolved command to this check instead of probing the version twice.

structure/config.md

@@ -7,6 +7,8 @@ Connected-client catalog diagnostics use the [terminal rendering contract](runti
 
 Hub management ingress also selects the [local dashboard address](runtime.md#hub-management-dashboard-address) using its configured port.
 
+Native main reauthentication follows the [CLI JSON output contract](runtime.md#native-main-reauth-json-output).
+
 ## Config surface
 
 ### OpenCodex home and live process state

structure/ops/docs-and-release.md

@@ -9,6 +9,8 @@ Human-readable connect and sync-refresh diagnostics follow the [terminal renderi
 
 The CLI default dashboard address follows the [management ingress bind](../runtime.md#hub-management-dashboard-address), covered by `tests/cli/cli-dispatch.test.ts`.
 
+Native main reauthentication follows the [CLI JSON output contract](../runtime.md#native-main-reauth-json-output).
+
 ## Public docs
 
 The public documentation site lives in `docs-site/` and is built with Astro + Starlight. English is

structure/runtime.md

@@ -13,6 +13,10 @@ Shared parsing and streaming follow the [request-copy](transports/byte-accountin
 
 Catalog-derived reasoning-level diagnostics are escaped only at the human-output boundary, which `src/cli/runtime-api.ts` owns alongside the human/JSON print split. Every CLI path that prints a hub-supplied catalog value renders it there: the first-time refusal in `src/cli/connect.ts` and the connected `ocx sync` refusal in `src/cli/dispatch.ts`. C0/C1 controls, DEL, and Unicode line/paragraph separators print as visible hexadecimal escapes; structured status retains the exact reason, and a rendered failure keeps the domain error as its `cause`. The ready/unverified/incompatible classification and exit policy are unchanged.
 
+## Native main reauth JSON output
+
+`src/cli/account-main.ts` emits one JSON object to stdout when `ocx account main reauth --device --no-wait --json` succeeds. The human-readable `follow up:` line is emitted only without `--json`; `flowId` remains available for status polling. `tests/cli/cli-native-profile.test.ts` parses the complete captured stdout and preserves coverage of the human follow-up.
+
 ## Hub management dashboard address
 
 When hub management ingress is enabled, `src/cli/dispatch.ts` opens the dashboard on the literal IPv4 loopback address and configured ingress port, matching the listener in `src/server/index.ts`. Other dashboard address selection is unchanged.

tests/cli/cli-native-profile.test.ts

@@ -195,6 +195,15 @@ describe("ocx account main", () => {
     expect(output.join(" ")).toContain("auth.openai.com/codex/device");
     expect(output.join(" ")).toContain("--flow flow-1");
 
+    output.length = 0;
+    expect(await cmdAccount(["main", "reauth", "--device", "--no-wait", "--json"], deps)).toBe(0);
+    expect(JSON.parse(output.join("\n"))).toEqual({
+      flowId: "flow-1",
+      status: "pending",
+      verificationUrl: "https://auth.openai.com/codex/device",
+      deviceCode: "ABCD-1234",
+    });
+
     expect(await cmdAccount(["main", "reauth", "status", "--flow", "flow-1"], deps)).toBe(0);
     expect(requests.at(-1)).toEqual({ method: "GET", path: "/api/codex-auth/main/reauth-device?flowId=flow-1" });
     expect(output.join(" ")).toContain("succeeded");