PTY OAuth login (no SSH, no local terminal)

Interactive CLI logins (claude mcp login <name>, claude auth login, gh auth login, and similar) are usually raw-mode TUIs that refuse to run without a real terminal — they exit immediately with something like stdin isn't a terminal when driven from a plain subprocess/pipe. Naively, that means SSHing in with a real TTY. It usually doesn't.

Most of these tools have two completion paths once they have a real pty:

1. Auto-detect: they open a browser locally and poll the OAuth server until the user approves (no callback needed on your end at all — this is the easy case, just show the printed URL and wait).
2. Manual fallback: if there's no way to open a browser, they print an authorize URL and then wait for the user to paste the redirect URL back in. The redirect target is typically localhost:<port> on the machine running the CLI — the browser doing the approving can be on any device, since all that matters is that the code embedded in that dead redirect URL makes it back to the CLI's stdin somehow.