[BUG] [macOS] OAuth login fatally errors instead of falling back to manual token entry when loopback callback can't bind (sandbox-runtime); does not repro on Linux

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When Claude Code is launched logged-out through the Anthropic sandbox-runtime (srt) on macOS, first-run OAuth login fails fatally if the loopback callback server cannot bind a port. Claude Code already supports a manual fallback (print a URL, accept a pasted token) and uses it successfully when the callback server can bind — so a bind failure should degrade to that same manual flow rather than aborting.

This does not reproduce on Linux (tested on both 2.1.123 and 2.1.173), which points to a macOS-specific gap in the fallback path.

Environment

• Claude Code: v2.1.123 (macOS — failing)
• Linux: 2.1.123 and 2.1.173 — NOT affected, login completes normally
• Launched via: @anthropic-ai/sandbox-runtime (srt) — version: <fill in>
• macOS: <fill in version> (Apple Silicon)
• Auth state: logged out (no valid credentials)
• Note: macOS not yet retested on 2.1.173 — <confirm before filing>

Relevant srt network config

"network": {
  "allowAllUnixSockets": true,
  "allowLocalBinding": false,
  "allowedDomains": ["*.anthropic.com", "platform.claude.com", "..."],
  "deniedDomains": []
}

Actual behavior (macOS, allowLocalBinding: false)

Login aborts:

 OAuth error: Failed to start OAuth callback server: Failed to start server. Is port 0 in use?

The OAuth flow requests an ephemeral loopback port (port 0 → OS-assigned); the sandbox denies the bind, and Claude Code treats this as fatal.

What works, and why this is a degradation gap

• Setting network.allowLocalBinding: true lets the callback server bind. Login then proceeds: Claude Code does not auto-open a browser (correct under sandbox), prints a URL to open manually, and accepts the returned token as manual input. This manual flow works end to end.
• Because that manual flow does not require the loopback server, the allowLocalBinding: false case should fall back to it — not error out. The capability already exists; it just isn't triggered on the bind-failure path on macOS.

What Should Happen?

When the OAuth callback server cannot bind a loopback port, Claude Code should fall back to the existing manual token-entry flow (print URL, accept pasted token) — the same flow it uses when it can't open a browser — rather than failing with a fatal "Is port 0 in use?" error. This is what effectively happens on Linux.

Suggested resolution

1. On loopback-bind failure during OAuth, fall back to the manual token-entry flow instead of erroring fatally (macOS parity with Linux).
2. Make the Path 1 error actionable: name the blocked host and indicate it's an allowlist/proxy block, not a network outage.
3. Document the domains and network capabilities (loopback binding) required for first-run auth inside the sandbox runtime.

Error Messages/Logs

If platform.claude.com is inaccessible 


Welcome to Claude Code v2.1.123
…………………………………………………………………………………………………………………………………………………………

     *                                       █████▓▓░
                                 *         ███▓░     ░░
            ░░░░░░                        ███▓░
    ░░░   ░░░░░░░░░░                      ███▓░
   ░░░░░░░░░░░░░░░░░░░    *                ██▓░░      ▓
                                             ░▓▓███▓▓░
 *                                 ░░░░
                                 ░░░░░░░░
                               ░░░░░░░░░░░░░░░░
       █████████                                        *
      ██▄█████▄██                        *
       █████████      *
…………………█ █   █ █………………………………………………………………………………………………………………

 Unable to connect to Anthropic services

 Failed to connect to platform.claude.com: ERR_BAD_REQUEST

 Please check your internet connection and network settings.


If is is accessible

…………………………………………………………………………………………………………………………………………………………

     *                                       █████▓▓░
                                 *         ███▓░     ░░
            ░░░░░░                        ███▓░
    ░░░   ░░░░░░░░░░                      ███▓░
   ░░░░░░░░░░░░░░░░░░░    *                ██▓░░      ▓
                                             ░▓▓███▓▓░
 *                                 ░░░░
                                 ░░░░░░░░
                               ░░░░░░░░░░░░░░░░
       █████████                                        *
      ██▄█████▄██                        *
       █████████      *
…………………█ █   █ █………………………………………………………………………………………………………………

 OAuth error: Failed to start OAuth callback server: Failed to start server. Is port 0 in use?

Steps to Reproduce

Steps to reproduce

1. Be logged out (no valid Claude Code credentials).
2. Ensure platform.claude.com is in network.allowedDomains and network.allowLocalBinding is false (its default).
3. Launch on macOS: srt --settings srt-settings.json claude.
4. Startup proceeds, then OAuth login is attempted

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.123

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_