feat(stockbit): one browser sign-in in idx-core for the CLI and MCP

`stockbit::signin` is now the single sign-in flow. `idx stockbit login`
waits on it in the foreground; the `stockbit_login` MCP tool runs it on a
thread and `stockbit_status` reports `sign_in.state`, so an agent knows when
to stop polling. Auto uses a browser unless the shell is over SSH or has no
display, and falls back to the local page only when the browser cannot start.

The browser way opens Stockbit's sign-in page in a profile only idx uses and
reads the session cookie over DevTools. What a real sign-in showed:

- The cookie is host-only on stockbit.com, so deleting by the assumed
  .stockbit.com removed nothing and left live tokens in the profile. It is
  now deleted by its own domain and path, with every other tab closed first,
  and read back to confirm.
- A signed-out page writes the cookie without tokens; it no longer counts.
- A profile belongs to one browser, so it records the executable that made it.
- On macOS the config directory depends on XDG_CONFIG_HOME, so a shell and an
  app started from the Dock disagreed; both default locations are now checked.
- A thread does not outlive main, so idx-mcp closes a waiting browser when
  stdin closes or on SIGTERM or Ctrl-C.

Progress goes to stderr, which keeps `-o json` to one document on stdout.

Google refused its own sign-in in this window on 2026-10-31, most likely over
the debugging flag; password sign-in works, and the docs and roadmap say so.

Claude-Session: https://claude.ai/code/session_01RqPPVaoFxLToGAXXBEoCtH

crates/idx-mcp/Cargo.toml

@@ -23,7 +23,7 @@ rmcp = { version = "3.5", default-features = false, features = ["server", "macro
 schemars = "1"
 serde.workspace = true
 serde_json.workspace = true
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "io-std", "sync"] }
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "io-std", "signal", "sync"] }
 
 [dev-dependencies]
 # Tests drive the binary with the mock provider; release builds exclude it.

crates/idx-mcp/src/main.rs

@@ -6,6 +6,7 @@ mod server;
 use std::process::ExitCode;
 
 use clap::Parser;
+use idx_core::api::stockbit::signin;
 use idx_core::config::CoreConfig;
 use rmcp::ServiceExt;
 
@@ -41,11 +42,42 @@ async fn main() -> ExitCode {
             return ExitCode::FAILURE;
         }
     };
-    match running.waiting().await {
-        Ok(_) => ExitCode::SUCCESS,
-        Err(err) => {
-            eprintln!("error: {err}");
-            ExitCode::FAILURE
+    tokio::select! {
+        finished = running.waiting() => {
+            let _ = tokio::task::spawn_blocking(signin::shutdown).await;
+            match finished {
+                Ok(_) => ExitCode::SUCCESS,
+                Err(err) => {
+                    eprintln!("error: {err}");
+                    ExitCode::FAILURE
+                }
+            }
+        }
+        () = terminated() => {
+            let _ = tokio::task::spawn_blocking(signin::shutdown).await;
+            // The stdin reader is a blocking thread the runtime would wait for.
+            std::process::exit(0);
         }
     }
 }
+
+/// Resolves when the process is told to stop.
+async fn terminated() {
+    #[cfg(unix)]
+    {
+        use tokio::signal::unix::{SignalKind, signal};
+        match signal(SignalKind::terminate()) {
+            Ok(mut term) => tokio::select! {
+                _ = term.recv() => {}
+                _ = tokio::signal::ctrl_c() => {}
+            },
+            Err(_) => {
+                let _ = tokio::signal::ctrl_c().await;
+            }
+        }
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = tokio::signal::ctrl_c().await;
+    }
+}

crates/idx-mcp/src/params.rs

@@ -47,6 +47,35 @@ pub struct OrderBookParams {
     pub depth: Option<usize>,
 }
 
+/// How `stockbit_login` signs in.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum LoginMethod {
+    Auto,
+    Browser,
+    Page,
+}
+
+impl LoginMethod {
+    pub const ALL: [Self; 3] = [Self::Auto, Self::Browser, Self::Page];
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Auto => "auto",
+            Self::Browser => "browser",
+            Self::Page => "page",
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub struct LoginParams {
+    /// "auto" (default): a browser window when idx-mcp's machine has a display and no SSH, else the local page; "browser" or "page" picks one.
+    #[serde(default)]
+    #[schemars(schema_with = "login_method_schema")]
+    pub method: Option<LoginMethod>,
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct ScreenParams {
     /// Screen to run (default "top-performers").
@@ -276,6 +305,10 @@ fn flow_source_schema(_: &mut SchemaGenerator) -> Schema {
     string_enum(FlowSource::ALL.map(FlowSource::as_str).to_vec())
 }
 
+fn login_method_schema(_: &mut SchemaGenerator) -> Schema {
+    string_enum(LoginMethod::ALL.map(LoginMethod::as_str).to_vec())
+}
+
 fn top_schema(_: &mut SchemaGenerator) -> Schema {
     json_schema!({ "type": "integer", "enum": TIERS })
 }

crates/idx-mcp/src/server.rs

@@ -7,6 +7,7 @@ use std::collections::BTreeMap;
 use idx_core::analysis::BandarQuery;
 use idx_core::analysis::bandar::{BandarReport, DEFAULT_TOP};
 use idx_core::analysis::fundamental::FundamentalReport;
+use idx_core::api::stockbit::{self, signin};
 use idx_core::broker::types::BrokerRange;
 use idx_core::config::CoreConfig;
 use idx_core::error::IdxError;
@@ -26,8 +27,9 @@ use tokio::sync::Semaphore;
 
 use crate::params::{
     AnalysisKind, AnalyzeParams, BandarParams, BrokerParams, ChangesParams, CompanyParams,
-    CompanySection, EntityParams, FlowParams, HistoryParams, IntradayParams, OrderBookParams,
-    ScreenParams, SearchParams, ShareholdersParams, SymbolsParams, SyncParams,
+    CompanySection, EntityParams, FlowParams, HistoryParams, IntradayParams, LoginMethod,
+    LoginParams, OrderBookParams, ScreenParams, SearchParams, ShareholdersParams, SymbolsParams,
+    SyncParams,
 };
 
 const SYNC_TOOL: &str = "ownership_sync";
@@ -165,8 +167,8 @@ per-minute volume. Empty `points` means the stock did not trade this session (se
 `bids` and `offers` (best price first) of {price, shares, orders}, the session's OHLC, \
 volume (shares), value and frequency, and foreign buy/sell/net in IDR. `market_status` is \
 Stockbit's state, verbatim; outside STATE_NAME_MARKET_OPEN the book is as the market left \
-it. AUTHERROR means there is no session: call stockbit_status, and ask the user to run \
-`idx stockbit login` in a terminal."
+it. AUTHERROR means there is no session: call stockbit_status, then stockbit_login for a URL \
+the user can open."
     )]
     async fn get_orderbook(&self, params: Parameters<OrderBookParams>) -> ToolResult {
         let OrderBookParams { symbol, depth } = params.0;
@@ -183,9 +185,28 @@ it. AUTHERROR means there is no session: call stockbit_status, and ask the user
     #[tool(description = "Whether a Stockbit session is stored (or seeded by \
 IDX_STOCKBIT_REFRESH_TOKEN) and when its tokens expire; never the tokens. Without one, \
 get_orderbook fails and stockbit-provider quotes use Stockbit's delayed public page; the \
-user adds one with `idx stockbit login` in a terminal.")]
+user adds one with stockbit_login, or `idx stockbit login` in a terminal. After \
+stockbit_login, `sign_in.state` says whether that sign-in is waiting, signed_in or failed \
+(with `sign_in.error`).")]
     async fn stockbit_status(&self) -> ToolResult {
-        blocking(idx_core::api::stockbit::session_status).await
+        blocking(login_status).await
+    }
+
+    #[tool(
+        description = "Start a Stockbit sign-in and return at once; this call does not wait \
+for it. With method auto (the default), idx-mcp opens a browser window on Stockbit's own \
+sign-in page when its machine has a display and is not reached over SSH (`method: \
+\"browser\"` in the answer): the user signs in there and the window closes by itself. \
+Otherwise it serves a page on 127.0.0.1 (`method: \"page\"`, with `url` and an `ssh -L` \
+`forward` for a browser on another machine) that takes stockbit.com's session cookie from the \
+user's own browser. Never ask the user for their password, and never type it. Then poll \
+stockbit_status until `sign_in.state` is signed_in or failed. A session that already works \
+answers state signed_in without opening anything; a second call while one is waiting returns \
+it again (`already_open`)."
+    )]
+    async fn stockbit_login(&self, params: Parameters<LoginParams>) -> ToolResult {
+        let LoginParams { method } = params.0;
+        blocking(move || start_login(method)).await
     }
 
     #[tool(description = "OHLCV price history for one IDX ticker.")]
@@ -580,6 +601,49 @@ impl SectionReport {
     }
 }
 
+/// Starts idx-core's background sign-in and adds what the agent does next.
+fn start_login(method: Option<LoginMethod>) -> Result<Value, IdxError> {
+    let options = signin::Options {
+        method: match method {
+            None | Some(LoginMethod::Auto) => signin::Method::Auto,
+            Some(LoginMethod::Browser) => signin::Method::Browser,
+            Some(LoginMethod::Page) => signin::Method::Page,
+        },
+        port: None,
+        // The server cannot tell whether the user sits at this machine.
+        open_page: false,
+    };
+    let progress = signin::start_background(&options)?;
+    let next = match (&progress.state, &progress.started) {
+        (signin::State::SignedIn, _) => {
+            "A stored session already works: nothing to sign in to. Call get_orderbook."
+        }
+        (_, signin::Started::Browser { .. }) => {
+            "A browser window is open on Stockbit's sign-in page, on the machine running \
+             idx-mcp. Ask the user to sign in there; never ask for their password. Then poll \
+             stockbit_status until sign_in.state is signed_in or failed."
+        }
+        _ => {
+            "Give the user the URL (with `forward` when their browser is on another machine). \
+             With stockbit.com open and signed in, they click the page's bookmarklet; never ask \
+             for their password. Then poll stockbit_status until sign_in.state is signed_in or \
+             failed."
+        }
+    };
+    let mut value = to_json(progress)?;
+    value["next"] = json!(next);
+    Ok(value)
+}
+
+/// The session's state, plus this server's sign-in when one has run.
+fn login_status() -> Result<Value, IdxError> {
+    let mut value = to_json(stockbit::session_status()?)?;
+    if let Some(progress) = signin::progress() {
+        value["sign_in"] = to_json(progress)?;
+    }
+    Ok(value)
+}
+
 async fn blocking<T, F>(f: F) -> ToolResult
 where
     T: Serialize + Send + 'static,

crates/idx-mcp/tests/golden/tools.json

@@ -332,7 +332,7 @@
     "name": "get_investor_holdings"
   },
   {
-    "description": "Order book of one IDX stock from the user's own Stockbit session: `bids` and `offers` (best price first) of {price, shares, orders}, the session's OHLC, volume (shares), value and frequency, and foreign buy/sell/net in IDR. `market_status` is Stockbit's state, verbatim; outside STATE_NAME_MARKET_OPEN the book is as the market left it. AUTHERROR means there is no session: call stockbit_status, and ask the user to run `idx stockbit login` in a terminal.",
+    "description": "Order book of one IDX stock from the user's own Stockbit session: `bids` and `offers` (best price first) of {price, shares, orders}, the session's OHLC, volume (shares), value and frequency, and foreign buy/sell/net in IDR. `market_status` is Stockbit's state, verbatim; outside STATE_NAME_MARKET_OPEN the book is as the market left it. AUTHERROR means there is no session: call stockbit_status, then stockbit_login for a URL the user can open.",
     "inputSchema": {
       "$schema": "https://json-schema.org/draft/2020-12/schema",
       "properties": {
@@ -585,7 +585,26 @@
     "name": "search_investors"
   },
   {
-    "description": "Whether a Stockbit session is stored (or seeded by IDX_STOCKBIT_REFRESH_TOKEN) and when its tokens expire; never the tokens. Without one, get_orderbook fails and stockbit-provider quotes use Stockbit's delayed public page; the user adds one with `idx stockbit login` in a terminal.",
+    "description": "Start a Stockbit sign-in and return at once; this call does not wait for it. With method auto (the default), idx-mcp opens a browser window on Stockbit's own sign-in page when its machine has a display and is not reached over SSH (`method: \"browser\"` in the answer): the user signs in there and the window closes by itself. Otherwise it serves a page on 127.0.0.1 (`method: \"page\"`, with `url` and an `ssh -L` `forward` for a browser on another machine) that takes stockbit.com's session cookie from the user's own browser. Never ask the user for their password, and never type it. Then poll stockbit_status until `sign_in.state` is signed_in or failed. A session that already works answers state signed_in without opening anything; a second call while one is waiting returns it again (`already_open`).",
+    "inputSchema": {
+      "$schema": "https://json-schema.org/draft/2020-12/schema",
+      "properties": {
+        "method": {
+          "description": "\"auto\" (default): a browser window when idx-mcp's machine has a display and no SSH, else the local page; \"browser\" or \"page\" picks one.",
+          "enum": [
+            "auto",
+            "browser",
+            "page"
+          ],
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "name": "stockbit_login"
+  },
+  {
+    "description": "Whether a Stockbit session is stored (or seeded by IDX_STOCKBIT_REFRESH_TOKEN) and when its tokens expire; never the tokens. Without one, get_orderbook fails and stockbit-provider quotes use Stockbit's delayed public page; the user adds one with stockbit_login, or `idx stockbit login` in a terminal. After stockbit_login, `sign_in.state` says whether that sign-in is waiting, signed_in or failed (with `sign_in.error`).",
     "inputSchema": {
       "properties": {},
       "type": "object"

crates/idx-mcp/tests/mcp.rs

@@ -9,7 +9,7 @@ use idx_core::config::CoreConfig;
 use idx_core::investor::{ImportSource, Investor};
 use serde_json::{Value, json};
 
-const TOOLS: [&str; 17] = [
+const TOOLS: [&str; 18] = [
     "analyze_bandar",
     "analyze_stock",
     "compare_stocks",
@@ -26,6 +26,7 @@ const TOOLS: [&str; 17] = [
     "ownership_status",
     "screen_stocks",
     "search_investors",
+    "stockbit_login",
     "stockbit_status",
 ];
 
@@ -370,6 +371,104 @@ fn stockbit_provider_quotes_carry_market_status_and_blocks_surface_once() {
     );
 }
 
+/// The sign-in tool answers at once. With no browser to open (the mock
+/// provider never starts one), auto falls back to the page and says why; the
+/// page takes the cookie the way the browser would, and stockbit_status
+/// reports the sign-in finishing.
+#[test]
+fn stockbit_login_returns_a_page_that_takes_the_cookie() {
+    let mut client = Client::start(&[], false);
+    let login = client.ok("stockbit_login", json!({}));
+    assert_eq!(login["method"], "page", "{login}");
+    assert_eq!(login["state"], "waiting", "{login}");
+    assert!(login["reason"].is_string(), "auto says why: {login}");
+    let url = login["url"].as_str().expect("url").to_string();
+    assert!(url.starts_with("http://127.0.0.1:"), "{login}");
+    assert!(
+        login["forward"].as_str().unwrap().starts_with("ssh -L "),
+        "{login}"
+    );
+    assert_eq!(login["already_open"], false, "{login}");
+    assert!(login["next"].as_str().unwrap().contains("stockbit_status"));
+
+    // A second call hands back the page that is already up.
+    let again = client.ok("stockbit_login", json!({}));
+    assert_eq!(again["url"], login["url"]);
+    assert_eq!(again["already_open"], true, "{again}");
+
+    let waiting = client.ok("stockbit_status", json!({}));
+    assert_eq!(waiting["logged_in"], false, "{waiting}");
+    assert_eq!(waiting["sign_in"]["state"], "waiting", "{waiting}");
+
+    let cookie = std::fs::read_to_string(
+        core_dir().join("tests/fixtures/stockbit_exodus_credential_storage_cookie_constructed.txt"),
+    )
+    .expect("cookie fixture");
+    let (status, body) = post(&url, cookie.trim());
+    assert_eq!(status, 200, "{body}");
+    assert!(body.contains("\"ok\":true"), "{body}");
+
+    // The sign-in's thread records the outcome just after the page answers.
+    let mut status = client.ok("stockbit_status", json!({}));
+    for _ in 0..50 {
+        if status["sign_in"]["state"] != "waiting" {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(20));
+        status = client.ok("stockbit_status", json!({}));
+    }
+    assert_eq!(status["logged_in"], true, "{status}");
+    assert_eq!(status["sign_in"]["state"], "signed_in", "{status}");
+
+    // Now there is nothing to sign in to.
+    let done = client.ok("stockbit_login", json!({}));
+    assert_eq!(done["state"], "signed_in", "{done}");
+    assert_eq!(done["method"], "existing", "{done}");
+}
+
+/// Asking for the browser where there is none fails, instead of quietly
+/// serving the page.
+#[test]
+fn stockbit_login_with_the_browser_forced_fails_without_one() {
+    let mut client = Client::start(&[], false);
+    let (is_error, body) = client.call("stockbit_login", json!({"method": "browser"}));
+    assert!(is_error, "{body}");
+    assert_eq!(body["code"], "UNSUPPORTED", "{body}");
+    let status = client.ok("stockbit_status", json!({}));
+    assert!(status.get("sign_in").is_none(), "nothing started: {status}");
+}
+
+/// POSTs to the sign-in page the way its own script does.
+fn post(url: &str, body: &str) -> (u16, String) {
+    use std::io::Read;
+    use std::net::TcpStream;
+
+    let rest = url.trim_start_matches("http://");
+    let (authority, path) = rest.split_once('/').expect("path");
+    let mut stream = TcpStream::connect(authority).expect("connect to the page");
+    stream
+        .set_read_timeout(Some(std::time::Duration::from_secs(10)))
+        .unwrap();
+    write!(
+        stream,
+        "POST /{path} HTTP/1.1\r\nHost: {authority}\r\nContent-Type: text/plain\r\n\
+         Content-Length: {}\r\n\r\n{body}",
+        body.len()
+    )
+    .unwrap();
+    let mut raw = String::new();
+    stream.read_to_string(&mut raw).unwrap();
+    let status = raw
+        .split_whitespace()
+        .nth(1)
+        .and_then(|code| code.parse().ok())
+        .unwrap_or(0);
+    (
+        status,
+        raw.split("\r\n\r\n").nth(1).unwrap_or_default().to_string(),
+    )
+}
+
 #[test]
 fn the_order_book_needs_a_session_and_status_never_shows_tokens() {
     let mut client = Client::start(&[], false);