feat(gui): add manual paste fallback for OAuth add-account

[dbc-hbin]

Summary

Minimal add-account fix split out of #1552. Keeps no pool rotation — only the failure that blocks adding a second Command Code account: the localhost callback can't be reached from a remote GUI, so we surface the existing /api/oauth/login/code path in the account panel.

• While a login is in progress the panel shows a paste box that accepts a redirect URL / authorization code / raw Command Code API key (user_… from ~/.commandcode/auth.json). Command Code uses type="password".
• Clicking Add account opens the provider's login link (same as before) and shows a small text input next to it — paste the redirect URL or API key there and hit Submit / Enter. No separate page needed.
• Uses the existing server route POST /api/oauth/login/code → submitManualLoginCode(provider, input) → OAuthController.onManualCodeInput; no new backend surface. Backed by the Command Code provider's parsePastedCommandCodeInput / validatePastedApiKey (already on dev).
• Feedback uses role="status" / role="alert" + aria-atomic, covered by gui/tests/provider-auth-manual-code.test.tsx.

Screenshot (dogfooding build 58be5e6e0 — feat/command-code-add-account-minimal on dev@c71c827, proxy 2.18.0 @ 127.0.0.1:10100)

docs/screenshots/command-code-add-account-paste.png — Providers → Command Code - Auth → Accounts → after Add account: the waiting state shows the auth link + link-copy + "didn't open?" and the paste hint + password input (Command Code API 키 또는 리다이렉트 URL 붙여넣기) + Submit button. This is the requested small text box next to the link.

What is dropped vs #1552

• Entire pool/rotation stack: oauth-pool-routing, command-code-routing, pool GET/PUT/PATCH + priority + clear-cooldown, quota fiveHourPercent/weeklyPercent probing, responses/core 429 failover, CLI auto-switch/priority/clear-cooldown. Those can return in a dedicated follow-up once the rotation design is approved; this PR does not touch src/server/management/oauth-account-routes.ts, src/oauth/*, src/providers/quota.ts, src/types.ts, src/codex/pool-rotation.ts.

Design (only what ships)

• gui/src/components/provider-workspace/* — new onSubmitManualCode handler, ProviderAuthPanel paste UI.
• gui/src/pages/use-providers-oauth.ts + gui/src/pages/Providers.tsx — hook wired through fetch(.../api/oauth/login/code) with error propagation.
• gui/src/styles/provider-workspace-settings.css — pwi-auth-paste layout.
• i18n en/de/ja/ko/ru/tr/zh/zh-TW — pasteCommandCodePlaceholder / pasteCommandCodeHint plus the refined pasteRedirectHint from feat: Command Code OAuth account pool with Codex-style rotation #1552.

Verification

• Dogfooding: rebuilt gui/dist (index-DjmiLvzJ.js) carries the paste strings, restarted proxy (PID 80594) serves it (index-DjmiLvzJ.js confirmed via curl /), Chrome dogfooding to / #providers → Command Code → Accounts → Add account verified: shows Waiting for browser… + link + paste box (password) simultaneously (screenshot above, ko locale).
• tsc --noEmit clean (root).
• gui/tests/provider-auth-manual-code.test.tsx — masks Command Code input as password and asserts rejection/success roles.

Relates to #1552 (closed, superseded).

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0dad231d-b5a4-47eb-912c-ffe4047ba9a8

📥 Commits

Reviewing files that changed from the base of the PR and between c71c827 and a8535a7.

📒 Files selected for processing (14)

• gui/src/components/provider-workspace/ProviderAuthPanel.tsx
• gui/src/components/provider-workspace/types.ts
• gui/src/i18n/de.ts
• gui/src/i18n/en.ts
• gui/src/i18n/ja.ts
• gui/src/i18n/ko.ts
• gui/src/i18n/ru.ts
• gui/src/i18n/tr.ts
• gui/src/i18n/zh-TW.ts
• gui/src/i18n/zh.ts
• gui/src/pages/Providers.tsx
• gui/src/pages/use-providers-oauth.ts
• gui/src/styles/provider-workspace-settings.css
• gui/tests/provider-auth-manual-code.test.tsx

---

📝 Walkthrough

Walkthrough

The provider workspace now accepts manual Command Code API keys, authorization codes, or redirect URLs. The OAuth hook submits these values to the provider login-code endpoint and reports success or errors. Localization, styling, and integration tests support the new flow.

Changes

Manual authentication flow

Layer / File(s)	Summary
Authentication input and submission UI gui/src/components/provider-workspace/ProviderAuthPanel.tsx, gui/src/components/provider-workspace/types.ts	ProviderAuthPanel manages manual input, submission state, validation, feedback, Enter-key submission, and masked Command Code values. ProviderAuthHandlers exposes the optional onSubmitManualCode handler.
OAuth submission endpoint and provider wiring gui/src/pages/use-providers-oauth.ts, gui/src/pages/Providers.tsx	useProvidersOAuth posts manual credentials to /api/oauth/login/code, handles response errors, suppresses errors after unmount, and exposes submitManualCode. Providers passes the handler to ProviderDetails.
Localized UI support and validation gui/src/i18n/*.ts, gui/src/styles/provider-workspace-settings.css, gui/tests/provider-auth-manual-code.test.tsx	Supported locales include manual-authentication labels and guidance. The paste area receives layout styling. Tests cover input behavior, successful submission, Error rejection, fallback errors, and cleanup.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a8535

This change adds a localized manual OAuth fallback for remote GUI account setup, with focused accessibility and behavior tests; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant ProviderAuthPanel
  participant useProvidersOAuth
  participant OAuthAPI
  User->>ProviderAuthPanel: Enter code or redirect URL
  User->>ProviderAuthPanel: Submit value
  ProviderAuthPanel->>useProvidersOAuth: submitManualCode(provider, input)
  useProvidersOAuth->>OAuthAPI: POST /api/oauth/login/code
  OAuthAPI-->>useProvidersOAuth: Success or error response
  useProvidersOAuth-->>ProviderAuthPanel: Completion or error
  ProviderAuthPanel-->>User: Display status feedback

Loading

Possibly related PRs

• lidge-jun/opencodex#1066: Introduces the Command Code OAuth provider extended by this GUI submission flow.
• lidge-jun/opencodex#1476: Adds the backend fallback flow that consumes manual OAuth code or redirect-URL submissions.
• lidge-jun/opencodex#544: Modifies ProviderAuthPanel.tsx and related provider authentication interactions.

Suggested reviewers: wibias, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding a manual paste fallback for OAuth account setup in the GUI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• hygiene: new_suppression.

What to do

• Fix new_suppression — A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain suppression-approved. Paths: gui/src/components/provider-workspace/ProviderAuthPanel.tsx.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[Wibias]

Requesting changes based on the current head (58be5e6).

[P2] The manual credential/code survives cancellation and a new login attempt for the same provider. ProviderAuthPanel keeps manualCode, manualCodeMsg, and manualCodeOk in local state. When the login hint disappears, the paste UI is only removed from the DOM; that state is not cleared. Starting Add account again on the same mounted provider panel can therefore re-render the previous raw user_… API key / OAuth code and stale feedback. Since Command Code intentionally uses a password input here, this is credential-bearing state and should not persist across login generations.

Please reset the manual input and feedback when the login flow is cancelled/ends and when a fresh login generation starts. Add a regression along the lines of: start Command Code Add account → enter a key → cancel/end the flow → start Add account again → input is empty and no prior success/error message is present.

Also refresh onto current dev. French localization was added after this branch point with strict locale-key parity; this PR adds prov.pasteCommandCodePlaceholder and prov.pasteCommandCodeHint to the existing locales but not the new French dictionary. Add the French strings so the updated branch satisfies the locale contracts, then rerun full CI.