codex - 💡(How to fix) Fix OAuth login URLs from CLI auth commands can be hidden in collapsed tool output

Summary

When Codex runs an interactive CLI authentication flow in the desktop harness, the command may print an OAuth URL inside collapsed shell/tool output. If the assistant does not manually copy that URL into the chat, the user has to expand the hidden command output, locate the login URL, and copy it themselves. This is a poor failure mode for non-technical users and makes authentication look blocked even though the CLI is waiting for user action.

What happened

A CLI auth command was started from Codex Desktop for a Google Workspace-style OAuth flow. The tool output contained:

• Open this URL in your browser to authenticate:
• A long https://accounts.google.com/o/oauth2/auth?... URL

But that output was hidden behind the expandable running-command UI. The assistant only said it was forcing explicit scopes, and did not surface the URL in the chat. The user had to manually expand the shell output, horizontally scroll/copy the URL, open it, and authenticate.

Expected behavior

Codex should make interactive authentication URLs obvious and actionable. Any of these would avoid the failure mode:

• Detect common OAuth/auth URLs in tool output and surface them in the conversation while the command is running.
• Render auth URLs from shell output as prominent clickable links outside the collapsed tool panel.
• Add harness guidance or a system reminder that agents must immediately echo login URLs to the user when a CLI prints one.
• Consider pausing or marking the command as requiring user action when an auth URL appears.

Actual behavior

The auth URL was available only inside collapsed shell output. A technical user could expand the command and retrieve it. A non-technical user likely would not know where to look, and the session would appear stuck or waste time.

Impact

This affects CLI auth flows launched from Codex Desktop, especially OAuth flows for tools such as Google Workspace CLIs, GitHub device/browser login, cloud CLIs, and similar integrations. It is particularly harmful because the assistant may continue reasoning or retry commands while the user action needed to unblock the flow is hidden.

Environment

• Codex Desktop on Windows
• Shell tool running PowerShell
• Observed after a harness update on 2026-05-21

Privacy note

This report intentionally omits the original project name, workspace path, account details, document URL, and OAuth URL values.