fix(wallet-bridge): CSS-hide textbox so it stays mounted in the DOM

Codex diagnosis: gr.Textbox(visible=False) pulls the element out of
the DOM in Gradio v6, so the popup OAuth bridge JS's
document.getElementById('wallet-bridge-key') returns null and the
deliver() function never writes the sk_... key. The .change handler
on the textbox is wired and would fire — but only if something
manages to set the input's value, which silently nothing does.

Swap visible=False for a dc-wallet-bridge-hidden CSS class that
keeps the element mounted at -9999px / 1×1 / opacity 0 / no pointer.
Gradio keeps the input in the DOM tree, the bridge JS finds it,
deliver() writes the key, .change fires save_key_from_fragment, and
the original tab adopts the wallet without a reload.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app.py

@@ -1907,13 +1907,24 @@ def build_ui() -> gr.Blocks:
             elem_classes=["dc-script-only"],
         )
         _fragment_key = gr.Textbox(visible=False, value="")
-        # Second wallet inbound — populated by the OAuth popup
-        # postMessage'ing the api_key back to its opener tab so the
-        # original tab (with all its analysis / variant state intact)
-        # can adopt the key without a reload. .change handler below
-        # routes to the same save_key_from_fragment as the fragment path.
-        _wallet_bridge_key = gr.Textbox(visible=False, value="",
-                                        elem_id="wallet-bridge-key")
+        # Wallet popup bridge — when the OAuth popup posts its api_key
+        # back to this opener tab, the message listener (installed in the
+        # fragment-capture demo.load below) drops the key here, which
+        # fires _wallet_bridge_key.change → save_key_from_fragment.
+        #
+        # Crucial: this textbox is CSS-hidden, NOT visible=False. Gradio
+        # treats visible=False as "do not mount in the DOM", which makes
+        # the JS document.getElementById('wallet-bridge-key') return null
+        # and silently no-ops the bridge (Codex diagnosis 2026-06-25).
+        # Off-screen positioning keeps the element present so the JS can
+        # find + write to it.
+        _wallet_bridge_key = gr.Textbox(
+            value="",
+            show_label=False,
+            container=False,
+            elem_id="wallet-bridge-key",
+            elem_classes=["dc-wallet-bridge-hidden"],
+        )
 
         # Per-visitor crate isolation — random opaque id used to scope every
         # crate read/write to /tmp/abv1-crate/{session_id}/. Initialized by

theme.py

@@ -478,6 +478,22 @@ h3 { font-size: 13px; color: var(--ink2); }
     display: none !important;
 }
 
+/* Off-screen hide for the wallet-bridge textbox. NOT display:none and
+   NOT visible=False on the gr.Textbox — both pull the element out of
+   the DOM, so the popup OAuth bridge JS can't find it to write the
+   sk_... key. Off-screen + 1px + opacity 0 keeps the input mounted,
+   focusable by JS, and addressable by getElementById('wallet-bridge-key'). */
+.dc-wallet-bridge-hidden {
+    position: fixed !important;
+    left: -9999px !important;
+    top: auto !important;
+    width: 1px !important;
+    height: 1px !important;
+    overflow: hidden !important;
+    opacity: 0 !important;
+    pointer-events: none !important;
+}
+
 /* ---- Pollen balance pill — doubles as wallet button */
 .dc-pollen-pill {
     display: inline-flex;