fix(shared): accept a pasted ChatGPT callback URL that is missing http://

packages/shared/src/codexAuthHandoff.test.ts

@@ -4,6 +4,7 @@ import {
   codexAuthorizationRequest,
   codexAuthDeliveryUrl,
   codexAuthHandoffUrl,
+  codexCallbackUrl,
   readCodexAuthDelivery,
   readCodexAuthHandoff,
 } from "./codexAuthHandoff.ts";
@@ -77,3 +78,25 @@ describe("Codex desktop handoff", () => {
     expect(() => codexAuthDeliveryUrl(input, callbackUrl + "&state=another")).toThrow();
   });
 });
+
+describe("pasted Codex callback", () => {
+  const { redirectUri, state } = codexAuthorizationRequest(input.authorizationUrl);
+  const copied = callbackUrl.slice("http://".length);
+
+  it("accepts a callback copied without its scheme", () => {
+    expect(codexCallbackUrl(copied, redirectUri, state).toString()).toBe(callbackUrl);
+  });
+  it("accepts leading whitespace with or without a scheme", () => {
+    expect(codexCallbackUrl(` \t\n${callbackUrl}`, redirectUri, state).toString()).toBe(
+      callbackUrl,
+    );
+    expect(codexCallbackUrl(` \t\n${copied}`, redirectUri, state).toString()).toBe(callbackUrl);
+  });
+  it("still rejects a scheme-less callback for another address or sign-in", () => {
+    expect(() =>
+      codexCallbackUrl(copied.replace("127.0.0.1", "localhost"), redirectUri, state),
+    ).toThrow();
+    expect(() => codexCallbackUrl(copied.replace("54213", "54214"), redirectUri, state)).toThrow();
+    expect(() => codexCallbackUrl(`${copied}&state=another`, redirectUri, state)).toThrow();
+  });
+});

packages/shared/src/codexAuthHandoff.ts

@@ -56,8 +56,12 @@ export function codexAuthorizationRequest(value: string) {
 }
 
 export function codexCallbackUrl(value: string, redirectUri: string, state: string) {
-  const callback = new URL(value);
   const expected = new URL(redirectUri);
+  const pasted = value.trimStart();
+  // Browsers can hide `http://` in the address bar, so a pasted callback may lack it.
+  const callback = new URL(
+    /^[a-z][a-z\d+.-]*:\/\//iu.test(pasted) ? pasted : `${expected.protocol}//${pasted}`,
+  );
   const states = callback.searchParams.getAll("state");
   const codes = callback.searchParams.getAll("code");
   const errors = callback.searchParams.getAll("error");