OAuth callback listener starts on remote host instead of local in Remote-SSH mode, causing login hang

[ytcheng]

What version of Codex is running?

codex vs extension 0.4.14

Which model were you using?

No response

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

• Connect to a remote host via VS Code Remote-SSH.
• Trigger the Codex extension login process.
• The extension or CLI spawns a callback HTTP listener on port 1455, but on the remote host (127.0.0.1:1455).
• The browser on the local machine is redirected to http://localhost:1455/auth/callback?code=…
• The login flow never completes because the local side has no handler for that callback.
• On remote, curl -i http://127.0.0.1:1455/auth/callback?code=… succeeds.

What is the expected behavior?

• In Remote-SSH mode, the OAuth callback listener should be created on the local client machine, or be automatically forwarded from remote → local so that browser requests to localhost:1455 are routed correctly.
• The login flow should work transparently, without requiring manual port forwarding or special setup.

What do you see instead?

• The callback server is started on the remote host.
• The browser callback to localhost:1455 fails (no response).
• The login process hangs unless the user manually sets up port forwarding or triggers the callback on remote via curl.

Additional information

When using VS Code in Remote-SSH mode with the OpenAI Codex vs extension login flow, the OAuth callback server (on port 1455) is launched on the remote host, not on the local machine. As a result, the browser on the local machine attempting to access http://localhost:1455/auth/callback?code=… never reaches the intended handler, and the login process stalls indefinitely.

I verified this by SSHing into the remote machine and running:

curl -i "http://127.0.0.1:1455/auth/callback?code=…"

on the remote host, and that successfully completes the authentication. Meanwhile, the local browser callback never succeeds because the server is not listening locally.