fix(auth): complete anthropic oauth login

[omarluq]

Start the localhost callback listener before opening the browser and allow re-authentication when stored credential refresh fails.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 27814a9b-05a2-4740-9d75-d85a5a206cf3

📥 Commits

Reviewing files that changed from the base of the PR and between 9da8e7f and 576fd60.

📒 Files selected for processing (4)

• internal/auth/oauth_anthropic.go
• internal/auth/oauth_anthropic_internal_test.go
• internal/auth/oauth_codex.go
• internal/auth/oauth_errors_internal_test.go

🚧 Files skipped from review as they are similar to previous changes (3)

• internal/auth/oauth_anthropic_internal_test.go
• internal/auth/oauth_anthropic.go
• internal/auth/oauth_codex.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added browser-based OAuth sign-in for Anthropic Claude.
  • Added on-screen guidance during the Claude login process.
• Bug Fixes
  • Improved OAuth sign-in behavior when existing credentials are missing or expired.
  • Strengthened callback validation (including state mismatch handling) and improved cancellation/shutdown reliability.
• Refactor
  • Standardized OAuth callback handling across supported providers for more consistent behavior and error reporting.
• Tests
  • Added/expanded coverage for browser-flow instructions, callback handling, and forced shutdown after cancellation.

Walkthrough

Anthropic OAuth login now has an exported browser flow backed by shared callback-server infrastructure. Claude terminal login uses the common OAuth provider path, while credential readiness and callback behavior receive focused tests.

Changes

OAuth login flow

Layer / File(s)	Summary
Shared OAuth callback server internal/auth/oauth_codex.go, internal/auth/oauth_errors_internal_test.go	Codex callback handling uses a shared server with provider-specific error prefixes, callback routing, cancellation handling, and shutdown behavior.
Anthropic OAuth authentication internal/auth/oauth_anthropic.go, internal/auth/oauth_anthropic_internal_test.go	Adds LoginAnthropic, Anthropic callback-server setup, authorization-code exchange, and tests for successful callbacks, cancellation, and state mismatches.
Terminal OAuth provider integration internal/terminal/auth_commands.go, internal/terminal/auth_commands_internal_test.go	Claude login uses the shared OAuth flow, and credential readiness requires a found credential with no lookup error. Tests cover valid, missing, and expired credentials.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Poem

I’m a rabbit with a callback cue,
Hopping through OAuth paths anew.
Codes arrive, states align,
Claude’s login joins the line.
Shared servers keep the flow bright—
Credentials bloom by moonlit night.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately describes the main Anthropic OAuth login work.
Description check	✅ Passed	The description matches the PR's OAuth callback and re-authentication changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/anthropic-oauth-login

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/auth/oauth_codex.go`:
- Line 258: Update oauthCallbackServer.Close to return an error, propagate
Shutdown failures as a contextual oops error, and make all callers handle the
returned error. When graceful shutdown ends due to timeout or cancellation,
force-close any remaining connections before returning, while preserving normal
graceful shutdown behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f90c1dbc-420c-4f98-9427-eae4e8ecd59e

📥 Commits

Reviewing files that changed from the base of the PR and between 45a9f2d and 9da8e7f.

📒 Files selected for processing (6)

• internal/auth/oauth_anthropic.go
• internal/auth/oauth_anthropic_internal_test.go
• internal/auth/oauth_codex.go
• internal/auth/oauth_errors_internal_test.go
• internal/terminal/auth_commands.go
• internal/terminal/auth_commands_internal_test.go

[codecov]

Codecov Report

❌ Patch coverage is 80.28169% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.77%. Comparing base (45a9f2d) to head (576fd60).

Files with missing lines	Patch %	Lines
internal/auth/oauth_codex.go	82.05%	5 Missing and 2 partials ⚠️
internal/auth/oauth_anthropic.go	76.19%	3 Missing and 2 partials ⚠️
internal/terminal/auth_commands.go	81.81%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #218      +/-   ##
==========================================
+ Coverage   84.67%   84.77%   +0.09%     
==========================================
  Files         313      313              
  Lines       28701    28731      +30     
==========================================
+ Hits        24304    24357      +53     
+ Misses       3025     3005      -20     
+ Partials     1372     1369       -3     

Flag	Coverage Δ
unittests	84.77% <80.28%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud