No known OAuth callback port for '${provider}'. Use device-c

Error message

No known OAuth callback port for '${provider}'. Use device-code flow on the broker host directly.

What it means

`runRemoteLogin` sets up an SSH local port-forward for the OAuth callback and needs the provider's registered callback port from the `CALLBACK_PORTS` table. Providers without an entry cannot receive the OAuth redirect through the tunnel, so the function throws and suggests running the device-code flow on the broker host.

Source

Thrown at packages/coding-agent/src/cli/auth-broker-cli.ts:376

		for (let i = 0; i < providers.length; i++) {
			process.stdout.write(`  ${i + 1}. ${providers[i].name}\n`);
		}
		process.stdout.write("\n");
		const choice = await promptLine(rl, `Enter number (1-${providers.length}): `);
		const index = Number.parseInt(choice, 10) - 1;
		if (Number.isNaN(index) || index < 0 || index >= providers.length) {
			throw new Error(`Invalid selection: ${choice}`);
		}
		return providers[index].id;
	} finally {
		rl.close();
	}
}

async function runRemoteLogin(provider: string, via: string, dryRun: boolean): Promise<void> {
	const port = CALLBACK_PORTS[provider];
	if (port === undefined) {
		throw new Error(
			`No known OAuth callback port for '${provider}'. Use device-code flow on the broker host directly.`,
		);
	}
	const sshArgs = [
		"-L",
		`${port}:127.0.0.1:${port}`,
		"-o",
		"ExitOnForwardFailure=yes",
		via,
		`${APP_NAME} auth-broker login ${provider}`,
	];
	if (dryRun) {
		process.stdout.write(`ssh ${sshArgs.map(a => (a.includes(" ") ? `'${a}'` : a)).join(" ")}\n`);
		return;
	}
	const sshBin = $which("ssh");
	if (!sshBin) {
		throw new Error("ssh binary not found in PATH");

View on GitHub (pinned to 9690622007)

Solutions

Run the device-code login flow directly on the broker host (ssh in, then `omp auth-broker login` there).
Check the exact provider id spelling against `CALLBACK_PORTS` in auth-broker-cli.ts.
Add the provider's callback port to `CALLBACK_PORTS` if it supports the redirect flow and is missing.

Example fix

// before (auth-broker-cli.ts)
const CALLBACK_PORTS = { anthropic: 51145 };
// after
const CALLBACK_PORTS = { anthropic: 51145, github: 51146 };

Defensive patterns

Strategy: validation

Validate before calling

const CALLBACK_PORTS = { anthropic: 51145 } as Record<string, number>;
if (!(providerId in CALLBACK_PORTS)) {
  console.warn(`${providerId} has no callback port; use device-code flow on the broker host.`);
}
await runLogin({ provider: providerId, via: host });

Try / catch

try {
  await runLogin({ provider, via: host });
} catch (err) {
  if (err instanceof Error && err.message.startsWith("No known OAuth callback port")) {
    console.error(`Remote login unsupported for ${provider}; run device-code flow on the broker host.`);
  } else throw err;
}

Prevention

Copy provider ids exactly from the `CALLBACK_PORTS` table in auth-broker-cli.ts.
Add new providers' callback ports to `CALLBACK_PORTS` when registering them.
For providers without a port, use device-code login directly on the broker host.

When it happens

Trigger: `omp auth-broker login --via <host>` (remote login) with a provider id that is not a key in `CALLBACK_PORTS` — typo'd id, a newly added provider missing from the table, or a provider that only supports device-code flow.

Common situations: Typing the provider id by hand; adding a new OAuth provider without updating `CALLBACK_PORTS`; attempting remote login for device-code-only providers.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/fc9deba0807f6be3. Report an issue: GitHub.