[Bug]: GUI OAuth login has no manual redirect URL / code paste fallback

[claudianus]

Summary

CLI OAuth login (ocx login xai) prompts for a redirect URL or authorization code when the browser cannot reach the loopback callback. The GUI/dashboard login path starts the same browser OAuth flow but never wires onManualCodeInput, so users have no way to finish login when localhost callback fails (remote GUI, SSH, blocked loopback, browser on another machine).

Expected: During GUI OAuth wait, user can paste the final redirect URL (or auth code) and complete login.

Actual: Only “waiting for browser…” / open-URL hint; paste fallback is missing for xAI (and other browser OAuth providers that use OAuthCallbackFlow).

Reproduction

1. Run ocx start (source tree with GUI built, or packaged install).
2. Open the dashboard → Providers → Login with xAI (or Add Provider → xAI OAuth).
3. Complete login in the browser in a situation where the callback cannot hit the proxy’s loopback server (e.g. browser cannot reach http://127.0.0.1:56121/callback?...).
4. Observe that there is no field to paste the failed callback URL / authorization code, so login hangs until timeout.

CLI contrast: ocx login xai shows Paste redirect URL or code (or wait for browser):.

Logs and screenshots

Instructions already tell the user to paste when prompted:

Complete xAI/Grok login in your browser. If the browser cannot reach this machine, paste the final redirect URL or authorization code when prompted.

GUI never prompts.

Area

GUI dashboard

Version

2.7.18 (main)

OS

macOS (also affects any remote/SSH dashboard use)

Config shape

{
  "providers": {
    "xai": { "authMode": "oauth" }
  }
}

Checks

• I searched existing issues and docs first.
• I removed secrets, tokens, and personal data from logs and screenshots.

[lidge-jun]

Fixed by #132 (plus stacked hardening) — released in v2.7.19. npm i -g @bitkyc08/opencodex and restart ocx; the Providers page and Add Provider modal now show a paste box for the final redirect URL (or authorization code) whenever a login is waiting.