fix: keep Codex OAuth callback alive

[realjoenguyen]

Problem

The OAuth authorization itself completed, but the browser callback could not reach the app. The app started a loopback listener on localhost:1455, then the Codex login progress window was closed or recreated while the system browser was still completing authentication. The view lifecycle called coordinator.cancel(), which stopped the listener before the browser requested /auth/callback. The browser then showed ERR_CONNECTION_REFUSED.

The original view also owned its own coordinator. If SwiftUI recreated the view, a new PKCE transaction and state could replace the transaction that was already open in the browser. Even if the browser callback arrived later, it could be ignored or fail state validation.

Fix

• Keep one app-owned CodexOAuthCoordinator.shared instance and observe it from the login view. The callback server and PKCE state now survive progress-window teardown and SwiftUI view recreation.
• Do not cancel OAuth from onDisappear or the login-window close observer. A new login explicitly stops the previous listener before starting a fresh transaction, so stale listeners and duplicate flows are not left behind.
• Reuse an active waiting or exchanging transaction when the login view reappears.
• Add a manual callback fallback. If a browser displays the localhost callback page but does not deliver the request, the user can paste the callback URL. The parser accepts a full URL or code#state, while the existing state check remains mandatory.
• Add codex_cli_simplified_flow=true to match the official Codex CLI authorization request.
• Enable incoming local network connections in the macOS target so the sandboxed app can accept the loopback callback.
• Increase the login window height so the fallback controls fit.

Security

The manual path never bypasses PKCE or state validation. OAuth codes and tokens are not logged or included in the UI or PR. The callback listener remains bound to the local machine and stops after success, failure, timeout, or cancellation.

Verification

• Xcode Debug build succeeds.
• 128 Swift package tests pass.
• Code-signing verification passes.
• git diff --check passes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.