OAuth login URL broken by TUI box/table formatting — unclickable, uncopyable, no workaround for Pro/Max subscribers

Summary

The TUI renders the OAuth login URL inside a decorative box/table with pipe characters, padding spaces, and 2-space indentation on wrapped lines. This makes the URL unclickable, uncopyable, and unusable — breaking the primary authentication method for Pro/Max subscribers.

Distinction from general URL wrapping

General URL wrapping in Claude Code responses (#609) was partially fixed — the original reporter confirmed this in January 2026. However, the OAuth login URL is rendered through a different code path (decorative box/table formatting) and remains broken. This is a distinct, still-unresolved bug that has been reported since March 2026.

Impact

• Pro/Max subscription users have no usable workaround. OAuth is the only authentication method that uses their subscription. ANTHROPIC_API_KEY exists but bills at separate API pay-as-you-go rates, defeating the purpose of a subscription.
• The official workaround is also broken. The docs say "press c to copy the login URL." But c copies the URL with padding spaces included, making it equally unusable (#32813).
• Headless/SSH users get auth failures. The wrapped URL splits OAuth scope parameters, producing Invalid OAuth Request: Unknown scope: us errors (#30821).

Reproduction

1. Run claude auth login in any normal-width terminal (< ~250 chars)
2. Observe the OAuth URL is displayed inside a decorative box with padding spaces
3. Try clicking — terminal URL detection only follows the first line fragment
4. Try pressing c — pasted URL contains spaces/newlines
5. Try manually selecting and copying — same result

Root cause

The OAuth URL is rendered through the TUI's box/table formatter which inserts decorative characters and padding. claude auth login only supports --email and --sso flags — no --url-only, --browser, or --no-tui option exists.

A fix already exists in the codebase

Claude Code already has OSC 8 hyperlink support — added in v2.1.2 per the CHANGELOG, used for file paths and documentation links. The minified bundle (v2.1.74) contains OSC 8 wrapping functions that are simply not applied to the OAuth URL.

Issue #23804 identified the relevant function:

function link(url) {
  if (enableANSIColors)
    return `\x1B[1m\x1B]8;;${url}\x1B\\${url}\x1B]8;;\x1B\\\x1B[22m`;
  return url;
}

Wrapping the OAuth URL with OSC 8 would make it clickable regardless of visual line wrapping, solving the problem for all modern terminal emulators.

Other low-effort fixes:

• Exempt the OAuth URL from box/table formatting entirely
• Add a --url-only flag to claude auth login that prints the raw URL
• Support RFC 8628 device-code flow like gh auth login does

Prior issues

The general URL wrapping problem has been reported since March 2025. The OAuth-specific formatting issue emerged in early 2026. All issues were closed by stale/duplicate bots with zero maintainer comments on any of them.

OAuth URL formatting (the current bug — still open):

| Issue | Date | Status | Notes |
|-------|------|--------|-------|
| #30411 | 2026-03-03 | Closed (duplicate) | Decorative formatting breaks auth URLs |
| #30821 | 2026-03-04 | Closed (duplicate) | Wrapped URL causes OAuth scope errors |
| #32813 | 2026-03-10 | Open | c shortcut copies spaces too |
| #33495 | 2026-03-12 | Open | Table formatting breaks terminal URL detection |

Related — general URL wrapping (partially fixed) and OSC 8 request:

| Issue | Date | Status | Notes |
|-------|------|--------|-------|
| #609 | 2025-03-24 | Closed (stale) | Original report — author confirmed fix in Jan 2026 |
| #9511 | 2025-10-14 | Closed (duplicate) | |
| #11012 | 2025-11-04 | Closed (stale) | |
| #20823 | 2026-01-25 | Closed (stale) | |
| #23804 | 2026-02-06 | Closed (stale) | OSC 8 feature request for OAuth URL |
| #31617 | 2026-03-06 | Closed (duplicate) | 2-space indent on continuation lines |

Expected behavior

• The OAuth login URL should be clickable in the terminal (via OSC 8 or by not wrapping it)
• c should copy a clean URL without padding spaces
• claude auth login should offer a way to get the raw URL
• Pro/Max subscription users should be able to complete login without manual text editing