[codex] Handle missing CLI auth code tokens

freebuff/web/src/app/onboard/page.tsx

@@ -126,6 +126,27 @@ const Onboard = async ({ searchParams }: PageProps) => {
     )
   }
 
+  if (authCodeResolution.status === 'missing') {
+    logger.info(
+      {
+        authCodeLength: authCode.length,
+        authCodeTrimmedLength: authCode.trim().length,
+        authCodeHashPrefix: getCliAuthCodeHashPrefix(authCode),
+        isOpaqueAuthCodeToken: isOpaqueCliAuthCodeToken(authCode),
+        userId: user.id,
+      },
+      'Missing Freebuff CLI auth code token',
+    )
+
+    return (
+      <StatusCard
+        title="Login link expired"
+        description="This browser login link is no longer active."
+        message="Return to your terminal and restart Freebuff to generate a new login link."
+      />
+    )
+  }
+
   const {
     authCode: resolvedAuthCode,
     resolvedOpaqueToken,

web/src/app/onboard/page.tsx

@@ -69,6 +69,16 @@ const Onboard = async ({ searchParams }: PageProps) => {
     )
   }
 
+  if (authCodeResolution.status === 'missing') {
+    return (
+      <CardWithBeams
+        title="This login link has expired"
+        description="Return to your terminal and restart Codebuff to generate a new login link."
+        content={<p>You can close this browser window.</p>}
+      />
+    )
+  }
+
   const { authCode: resolvedAuthCode } = authCodeResolution
   const { fingerprintId, expiresAt, receivedHash } =
     parseAuthCode(resolvedAuthCode)