[BUG] Claude Code Sign In broken on remote environments -> hardcoded localhost redirectUri

[soundyogi]

Problem (one or two sentences)

The OAuth flow uses a hardcoded localhost redirect URI which breaks authentication in remote environments like GitHub Codespaces.

Cause: In src/integrations/claude-code/oauth.ts:12: redirectUri: "http://localhost:54545/callback",

Solution: Use VS Code's vscode.env.asExternalUri() API to dynamically generate the redirect URI.

Context (who is affected and when)

This happens when users in remote environments like github codespaces try to authenticate with claude code

Reproduction steps

create a github codespace, install roo and claude code cli - then try to sign in to claude code

Expected result

I am able to login by alternatively entering a code similar to claude code which has a workaround for this

Actual result

I am not able to authenticate and always alnd on a 404 webpage when trying to (the localhost return redirect)

Variations tried (optional)

No response

App Version

3.38.3

API Provider (optional)

Anthropic

Model Used (optional)

Claude Code

Roo Code Task Links (optional)

No response

Relevant logs or errors (optional)

[roomote]

I've analyzed this issue and here's my proposed implementation plan:

Problem Analysis

The OAuth flow in src/integrations/claude-code/oauth.ts uses a hardcoded localhost redirect URI (http://localhost:54545/callback) which doesn't work in remote development environments like GitHub Codespaces. When the OAuth callback is triggered, it redirects to localhost instead of the forwarded Codespaces URL.

Proposed Solution

Use VS Code's vscode.env.asExternalUri() API to dynamically map the local redirect URI to an externally-accessible URI. This is the standard VS Code approach for handling OAuth in remote environments.

Implementation Details

1. Modify startAuthorizationFlow() in ClaudeCodeOAuthManager:

   • Make it an async method that accepts the vscode module
   • Use vscode.env.asExternalUri() to convert http://localhost:54545/callback to the appropriate external URI
   • Store the resolved external redirect URI for use in token exchange

2. Update buildAuthorizationUrl():

   • Accept a dynamic redirectUri parameter instead of using the hardcoded constant

3. Update exchangeCodeForTokens():

   • Accept a dynamic redirectUri parameter for token exchange (must match what was used in the authorization URL)

4. Update the webview message handler (claudeCodeSignIn case):

   • Pass the vscode module to the OAuth manager's startAuthorizationFlow() method

How vscode.env.asExternalUri() Works

• In local VS Code: Returns the original URI unchanged
• In GitHub Codespaces: Returns a forwarded URL like https://<codespace-name>-54545.app.github.dev/callback
• In other remote environments: Returns the appropriate externally-accessible URL

This approach is backwards compatible - local users won't notice any change, while remote users will finally have a working OAuth flow.

Please mention @roomote in a comment saying that you approve this plan, and I'll proceed with the implementation.

[soundyogi]

So in Claude Code you can cancel/deny the first link you get (that is the one with the redirect pointing at localhost) - then they give you a link that redirects back to a console.anthropic.com webpage and there we can copy an auth-code and paste it into claude code - I imagine we need a similar system like that not just a different redirect uri @roomote - for instance when I use the vscode.dev app on my android phone to connect to a remote server tunnel - there is no uri to get back to AT ALL I assume

[roomote]

Thanks for the clarification @soundyogi! I understand now - you're suggesting implementing a fallback auth flow similar to Claude Code where users can:

1. Cancel/skip the localhost redirect flow
2. Get a link that redirects to a webpage (like console.anthropic.com)
3. Copy an auth code from that page
4. Paste it manually into Roo Code

This is a device authorization / out-of-band (OOB) flow pattern that works well in remote environments like Codespaces.

I'll explore implementing this fallback mechanism alongside the existing localhost callback. Will open a PR to share progress shortly!

[soundyogi]

My intuition is that "all" we would need is figuring out how to get this alternative link from claude code - and a input-field in the roo ui to paste the auth-code manually @roomote

[roomote]

I've seen your comment @soundyogi! Great insight about Claude Code's fallback flow. I'll explore implementing a similar mechanism where:

1. Users get an alternative auth link that redirects to console.anthropic.com
2. Copy the auth code from that page
3. Paste it manually into Roo Code via an input field

Will open a PR to share progress shortly!

[roomote]

Opened a PR with my attempt at addressing this: #10549

The implementation adds a manual authorization code entry flow where users can:

1. Click "Sign in manually" link
2. Authorize in the browser
3. Copy the code from the resulting page
4. Paste it into Roo Code

This uses the standard OOB (out-of-band) OAuth redirect URI pattern. However, whether Anthropic's endpoint supports urn:ietf:wg:oauth:2.0:oob specifically needs verification. If they use a different approach (like a custom callback page at console.anthropic.com), the redirect URI may need adjustment.

Feedback welcome!