fix(chutes): accept manual OAuth code input

src/agents/chutes-oauth.ts

@@ -50,14 +50,19 @@ export function parseOAuthCallbackInput(
       return { error: "Missing 'code' parameter in URL" };
     }
     if (!state) {
-      return { error: "Missing 'state' parameter. Paste the full URL." };
+      return { error: "Missing 'state' parameter. Paste the full URL (or just the code)." };
     }
     if (state !== expectedState) {
       return { error: "OAuth state mismatch - possible CSRF attack. Please retry login." };
     }
     return { code, state };
   } catch {
-    return { error: "Paste the full redirect URL, not just the code." };
+    // Manual flow: users often paste only the authorization code.
+    // In that case we can't validate state, but the user is explicitly opting in by pasting it.
+    if (!/\s/.test(trimmed) && !trimmed.includes("://") && trimmed.length > 0) {
+      return { code: trimmed, state: expectedState };
+    }
+    return { error: "Paste the redirect URL (or authorization code)." };
   }
 }