fix(auth): always print sign-in URL, fire-and-forget browser open

`codebase auth login` would hang after "opening your browser…" on Macs
where `open` silently no-ops and on SSH boxes where xdg-open isn't
viable. The flow gated the URL print behind isHeadlessSession() and
awaited the open command, so a hung or absent browser deadlocked the
prompt. Always print the URL through onManualUrl regardless of session
shape, and don't await the browser-open — auto-open stays as
best-effort gravy on top of the printed URL. For SSH sessions the CLI
also prints the matching `ssh -L` forward command so a remote login
just works.

Author: halfaipg

package-lock.json

@@ -1,6 +1,6 @@
 {
 	"name": "codebase-cli",
-	"version": "2.0.0-pre.54",
+	"version": "2.0.0-pre.55",
 	"description": "Codebase CLI — a TypeScript coding agent on the pi-mono runtime. OAuth-aware, any LLM provider, single install.",
 	"keywords": [
 		"ai",

package.json

@@ -113,11 +113,30 @@ async function loginCmd(
 	out: (m: string) => void,
 	err: (m: string) => void,
 ): Promise<number> {
-	out("opening your browser to sign in…");
-	out("(if it doesn't open, the URL will be printed)");
 	try {
-		const creds = await runOAuthLogin(config);
+		const creds = await runOAuthLogin(config, {
+			onManualUrl: (url) => {
+				out("Open this URL to sign in:");
+				out("");
+				out(`  ${url}`);
+				out("");
+				// SSH callers need to reach the localhost callback on this box.
+				// Print the port-forward command preemptively so a remote login
+				// just works — they paste both commands and are done.
+				if (process.env.SSH_CONNECTION || process.env.SSH_TTY) {
+					const port = new URL(url).searchParams.get("redirect_uri")?.match(/:(\d+)\//)?.[1];
+					if (port) {
+						out("Detected SSH session. From your laptop, forward the callback port first:");
+						out("");
+						out(`  ssh -L ${port}:127.0.0.1:${port} <user>@<host>`);
+						out("");
+					}
+				}
+				out("Waiting for sign-in…");
+			},
+		});
 		store.save(creds);
+		out("");
 		out(`signed in${creds.email ? ` as ${creds.email}` : ""}.`);
 		return 0;
 	} catch (e) {

src/auth/cli.ts

@@ -386,17 +386,19 @@ export async function runOAuthLogin(
 
 	const callbackPromise = awaitCallback(server, state, config.timeoutMs ?? DEFAULT_TIMEOUT_MS);
 
-	if (isHeadlessSession()) {
-		opts.onManualUrl?.(authUrl, "headless session detected — open the URL manually in your browser");
-	} else {
-		try {
-			await openBrowserFn(authUrl);
-		} catch (err) {
-			// DON'T tear down the server: the user can still complete
-			// sign-in by opening the URL themselves. Surface the URL via
-			// onManualUrl and continue waiting for the callback.
-			opts.onManualUrl?.(authUrl, `auto-open failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
+	// Always surface the URL to the caller so it's visible even when
+	// auto-open succeeds. Browser-open auto-detection is unreliable
+	// (xdg-open hangs on some boxes, `open` on macOS silently no-ops in
+	// some shells, SSH forwarding makes localhost-callbacks tricky), so
+	// the printed URL is the primary UX — auto-open is best-effort gravy.
+	const reason = isHeadlessSession() ? "headless session — open the URL manually" : "open this URL in your browser";
+	opts.onManualUrl?.(authUrl, reason);
+
+	// Fire-and-forget the browser open. Don't await — xdg-open / `open`
+	// can hang indefinitely on some configurations, and we already gave
+	// the user the URL above.
+	if (!isHeadlessSession()) {
+		openBrowserFn(authUrl).catch(() => undefined);
 	}
 
 	const { code } = await callbackPromise;