macOS: `codex mcp login` can print OAuth URL without surfacing a browser window

Summary

On macOS, codex mcp login <server> can print the OAuth authorization URL and wait for the loopback callback, but no browser window/tab becomes visible. The command does not print the documented fallback (Browser launch failed; please copy the URL above manually.), so the client appears to believe browser launch succeeded.

This creates a high-friction MCP OAuth flow: users think the command is stuck until they manually copy the one-time URL into a browser.

Environment

• macOS 26.5.1 (arm64)
• codex-cli 0.148.0-alpha.9 from the Codex desktop bundle

Reproduction

1. Configure an OAuth-capable remote MCP server.
2. Run codex mcp login <server> --scopes <scopes>.
3. Observe that the terminal prints Authorize <server> by opening this URL in your browser: and waits.
4. No browser window/tab is brought forward.
5. Manually opening the printed URL completes OAuth and reaches the local callback successfully.

Expected

The authorization page should be visibly opened in the user's default browser, or the CLI should reliably report that opening it failed and make the manual next step explicit.

Notes

Current source calls webbrowser::open(auth_url) after printing the URL, but this observed path appears to return success without making a browser tab visible. No OAuth URL, code, state, or account data is included here.

Start by locating the macOS MCP login path that calls webbrowser::open(auth_url) after printing the authorization URL. Reproduce codex mcp login <server> --scopes <scopes> on macOS and compare the browser-launch result with the visible fallback message. Done means the authorization page is visibly opened, or a failed launch reliably reports the manual URL step.