feat(cli): auto-detect SSH sessions and fix fallback URL

- Detect SSH sessions via SSH_CLIENT/SSH_TTY/SSH_CONNECTION env vars
  and automatically use headless auth (no localhost callback)
- Strip callback param from the fallback URL shown in browser flow
  so users on a different machine get the token inline when navigating

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

app/cli/cmd/auth_login.go

@@ -23,6 +23,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"os"
 	"os/exec"
 	"runtime"
 	"time"
@@ -75,7 +76,7 @@ func interactiveAuth(forceHeadless bool) error {
 	q.Set(oauth.QueryParamLongLived, "true")
 	serverLoginURL.RawQuery = q.Encode()
 
-	if forceHeadless {
+	if forceHeadless || isRemoteSession() {
 		return headlessAuth(serverLoginURL)
 	}
 
@@ -87,10 +88,17 @@ func interactiveAuth(forceHeadless bool) error {
 
 	a.serverChan = make(chan error)
 
+	// Show the headless URL (no callback) as fallback so users on a different
+	// machine can navigate to it and get the token to paste back.
+	manualURL := *serverLoginURL
+	mq := manualURL.Query()
+	mq.Set(oauth.QueryParamCallback, "")
+	manualURL.RawQuery = mq.Encode()
+
 	fmt.Println()
 	fmt.Println("  Browser didn't open? Use the URL below to sign in:")
 	fmt.Println()
-	fmt.Printf("  %s\n", serverLoginURL.String())
+	fmt.Printf("  %s\n", manualURL.String())
 	fmt.Println()
 
 	// Start the local callback server
@@ -203,6 +211,17 @@ func openbrowser(url string) error {
 	return cmd.Wait()
 }
 
+// isRemoteSession returns true if the CLI is running inside an SSH session
+// where a local browser callback would not be reachable.
+func isRemoteSession() bool {
+	for _, key := range []string{"SSH_CLIENT", "SSH_TTY", "SSH_CONNECTION"} {
+		if os.Getenv(key) != "" {
+			return true
+		}
+	}
+	return false
+}
+
 // Retrieve loginURL from the control plane
 func retrieveLoginURL() (string, error) {
 	client := pb.NewStatusServiceClient(ActionOpts.CPConnection)