@akanjs/devkit 3.0.0-beta.16 → 3.0.0-beta.18

package/codeAgent/tools/AskToolPack.ts

@@ -0,0 +1,111 @@
+import type { ExtensionAPI, InlineExtension } from "@earendil-works/pi-coding-agent";
+import type { CodeAgentProfile, CodeAgentQuestion } from "akanjs/common";
+import { Type } from "typebox";
+
+export interface AskToolPackOptions {
+  profile: CodeAgentProfile;
+  /** Puts one question on the wire and resolves with the labels chosen, or nothing when it was skipped. */
+  ask: (question: Omit<CodeAgentQuestion, "questionId">) => Promise<string | undefined>;
+}
+
+/**
+ * The `ask_user` tool: put a decision back to the person instead of guessing at it.
+ *
+ * It exists only where somebody is watching. A pod and a sub-agent both set `ui.canPrompt` false, and on those
+ * the tool is never constructed — a model that cannot see it does not spend a turn calling something that can
+ * only answer "nobody is here", and it costs no prompt tokens either.
+ *
+ * **Questions are asked one at a time even when several are sent.** The host draws one question block at the
+ * bottom of the screen, and an answer is frequently what decides whether the next question is still the right
+ * one to ask; a batch drawn at once would also have nowhere to put the second prompt.
+ */
+export class AskToolPack {
+  static readonly toolName = "ask_user";
+  /** Four is what fits on a screen without the transcript disappearing behind the questions. */
+  static readonly maxQuestions = 4;
+
+  readonly #options: AskToolPackOptions;
+
+  constructor(options: AskToolPackOptions) {
+    this.#options = options;
+  }
+
+  names() {
+    return this.#options.profile.ui.canPrompt ? [AskToolPack.toolName] : [];
+  }
+
+  extension(): InlineExtension | undefined {
+    if (!this.#options.profile.ui.canPrompt) return undefined;
+    return { name: "akan-ask", factory: (pi: ExtensionAPI) => this.#register(pi) };
+  }
+
+  #register(pi: ExtensionAPI) {
+    pi.registerTool({
+      name: AskToolPack.toolName,
+      label: "Ask",
+      description:
+        "Ask the user to decide something you cannot decide from the code or the request. Use it when two readings of the task would lead to materially different work, not for choices with an obvious default — and never to ask permission for work you were already asked to do. Offer concrete options whenever you can name them; mark one recommended when you have a view.",
+      promptSnippet: "ask_user: put a decision the user owns back to them, with options",
+      parameters: Type.Object({
+        questions: Type.Array(
+          Type.Object({
+            question: Type.String({ description: "The whole question, as one sentence ending in a question mark." }),
+            header: Type.Optional(
+              Type.String({ description: "Two or three words naming what is being chosen, e.g. 'Auth method'." }),
+            ),
+            options: Type.Optional(
+              Type.Array(
+                Type.Object({
+                  label: Type.String({ description: "The choice, in one to five words." }),
+                  detail: Type.Optional(
+                    Type.String({ description: "What picking it means, or the trade-off it carries." }),
+                  ),
+                  recommended: Type.Optional(
+                    Type.Boolean({ description: "Mark at most one. It is offered first and labelled as such." }),
+                  ),
+                }),
+                { description: "Two to four distinct choices. Leave it out to ask for an answer in prose." },
+              ),
+            ),
+            multiSelect: Type.Optional(
+              Type.Boolean({ description: "Several options may be chosen together, rather than exactly one." }),
+            ),
+            freeText: Type.Optional(
+              Type.Boolean({
+                description: "Offer a further choice that lets the user type an answer of their own. Default true.",
+              }),
+            ),
+          }),
+          { description: `One to ${AskToolPack.maxQuestions} questions, asked in order.` },
+        ),
+      }),
+      execute: async (_id, params) => {
+        const questions = (params.questions ?? []).slice(0, AskToolPack.maxQuestions);
+        if (!questions.length)
+          return { content: [{ type: "text", text: "No question was asked." }], details: undefined, isError: true };
+        const answers: string[] = [];
+        for (const entry of questions) {
+          const options = (entry.options ?? []).map((option, at) => ({
+            key: `${at}`,
+            label: option.label,
+            ...(option.detail ? { detail: option.detail } : {}),
+            ...(option.recommended ? { recommended: true } : {}),
+          }));
+          const answer = await this.#options.ask({
+            prompt: entry.header ? `${entry.header} — ${entry.question}` : entry.question,
+            kind: options.length ? "select" : "text",
+            ...(options.length ? { options } : {}),
+            ...(entry.multiSelect ? { multiSelect: true } : {}),
+            // On by default: a list the model wrote is a guess at what the choices are, and the person is the
+            // one who knows when none of them is the answer.
+            freeText: entry.freeText ?? true,
+          });
+          // Said as a skip rather than left blank: an unanswered question read as an empty answer is how a
+          // model concludes the user wanted nothing, which is the one reading they did not choose.
+          answers.push(`${entry.question}\n→ ${answer ?? "(skipped — decide this yourself and say what you chose)"}`);
+        }
+        return { content: [{ type: "text", text: answers.join("\n\n") }], details: undefined };
+      },
+    });
+  }
+}

package/codeAgent/tools/McpClient.ts

@@ -8,12 +8,29 @@ export interface McpToolInfo {
 
 interface JsonRpcResponse {
   id?: number;
-  result?: { tools?: McpToolInfo[]; content?: unknown; isError?: boolean };
+  result?: { tools?: McpToolInfo[]; nextCursor?: string; content?: unknown; isError?: boolean };
   error?: { code: number; message: string };
 }
 
 const protocolVersion = "2025-06-18";
 
+/**
+ * A server that answered correctly and asked who is calling.
+ *
+ * Its own class because the caller has to tell it apart from every other connect failure: this one is fixed by
+ * signing in, and reporting it as "unavailable" sends someone to debug a server that is working.
+ */
+export class McpUnauthorized extends Error {
+  /** The `WWW-Authenticate` value, which names the resource metadata discovery starts from. */
+  readonly challenge: string;
+
+  constructor(name: string, challenge: string) {
+    super(`MCP server "${name}" requires authentication`);
+    this.name = "McpUnauthorized";
+    this.challenge = challenge;
+  }
+}
+
 /**
  * A client for one MCP server, over stdio or streamable HTTP.
  *
@@ -22,15 +39,20 @@ const protocolVersion = "2025-06-18";
  * worse than one with fewer tools.
  */
 export class McpClient {
+  /** A ceiling on a server that never stops paging; 50 pages is 5,000 tools at the usual page size. */
+  static readonly maxToolPages = 50;
+
   readonly ref: CodeAgentMcpServerRef;
   #proc: Bun.Subprocess<"pipe", "pipe", "ignore"> | undefined;
   #nextId = 0;
   #buffer = "";
   readonly #pending = new Map<number, (response: JsonRpcResponse) => void>();
   #sessionId: string | undefined;
+  readonly #token: string | undefined;
 
-  constructor(ref: CodeAgentMcpServerRef) {
+  constructor(ref: CodeAgentMcpServerRef, token?: string) {
     this.ref = ref;
+    this.#token = token;
   }
 
   async connect() {
@@ -45,10 +67,27 @@ export class McpClient {
     return this;
   }
 
+  /**
+   * Every page of the server's tool list, not the first one.
+   *
+   * `tools/list` is paginated: a server holding more tools than its page size answers a `nextCursor` and
+   * expects to be asked again. Reading one page looks like it worked — the tools are sorted, so what goes
+   * missing is the tail of the alphabet rather than anything a caller would notice as absent. An akan server
+   * pages at 100 by default (`option.setMcp({ pageSize })`), so any app past 100 endpoints hit this.
+   */
   async listTools(): Promise<McpToolInfo[]> {
-    const response = await this.#call("tools/list", {});
-    if (response.error) throw new Error(response.error.message);
-    return response.result?.tools ?? [];
+    const tools: McpToolInfo[] = [];
+    let cursor: string | undefined;
+    for (let page = 0; page < McpClient.maxToolPages; page += 1) {
+      const response = await this.#call("tools/list", cursor ? { cursor } : {});
+      if (response.error) throw new Error(response.error.message);
+      tools.push(...(response.result?.tools ?? []));
+      const next = response.result?.nextCursor;
+      // Handing back the cursor it was given is a server that would page forever; so is one that cycles.
+      if (!next || next === cursor) return tools;
+      cursor = next;
+    }
+    return tools;
   }
 
   async callTool(name: string, args: Record<string, unknown>) {
@@ -130,11 +169,18 @@ export class McpClient {
         "content-type": "application/json",
         // Streamable HTTP lets a server answer either way; a client that omits the SSE type gets a 406.
         accept: "application/json, text/event-stream",
+        "mcp-protocol-version": protocolVersion,
+        ...this.ref.headers,
+        ...(this.#token ? { authorization: `Bearer ${this.#token}` } : {}),
         ...(this.#sessionId ? { "mcp-session-id": this.#sessionId } : {}),
       },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(30_000),
     });
+    // Raised rather than returned as a JSON-RPC error: a 401 carries no body worth reading, and the whole of
+    // what the caller needs is in the header that came with it.
+    if (response.status === 401)
+      throw new McpUnauthorized(this.ref.name, response.headers.get("www-authenticate") ?? "");
     this.#sessionId = response.headers.get("mcp-session-id") ?? this.#sessionId;
     const text = await response.text();
     if (!text.trim()) return {};

package/codeAgent/tools/McpOAuth.ts

@@ -0,0 +1,268 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { CodeAgentMcpServerRef } from "akanjs/common";
+import type { McpStoredAuth } from "./McpTokenStore";
+
+export interface McpOAuthServer {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  registrationEndpoint?: string;
+  scopesSupported?: string[];
+  /** RFC 8707: what the token is minted for, which is the MCP endpoint and not the authorization server. */
+  resource: string;
+  /** Scopes the resource asked for in its own metadata, which are the ones to request. */
+  resourceScopes?: string[];
+}
+
+export interface McpOAuthTokens {
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number;
+  scope?: string;
+}
+
+interface TokenResponse {
+  access_token?: string;
+  refresh_token?: string;
+  expires_in?: number;
+  scope?: string;
+  error?: string;
+  error_description?: string;
+}
+
+/**
+ * The client half of the MCP authorization spec: discovery, registration, and the authorization code flow.
+ *
+ * Every step is discovered rather than configured. A `401` names the resource metadata, that names the
+ * authorization server, and its RFC 8414 document names the endpoints — so connecting to a server nobody has
+ * described here needs no entry beyond its url. `pkgs/akanjs/server/mcp/McpAuth.ts` is the other half of the
+ * same contract, and an akan app is therefore a server this can sign in to with nothing declared at all.
+ *
+ * **PKCE is mandatory and `S256` is the only method.** OAuth 2.1 drops `plain`, and the spec requires a client
+ * to refuse a server whose metadata does not offer `S256` rather than fall back — a downgrade a network
+ * attacker would otherwise choose on the client's behalf.
+ */
+export class McpOAuth {
+  /** RFC 9728. A client tries the path-inserted spelling first and the bare one second. */
+  static readonly resourceWellKnown = "/.well-known/oauth-protected-resource";
+  static readonly serverWellKnown = "/.well-known/oauth-authorization-server";
+  static readonly openidWellKnown = "/.well-known/openid-configuration";
+  /**
+   * Loopback ports tried in order, and why there is a fixed list rather than an ephemeral port.
+   *
+   * A registered client is bound to the exact `redirect_uri` it was registered with, so a port chosen afresh
+   * every time would invalidate the registration on every sign-in. The port that was used is stored with the
+   * client; this list is only what a first sign-in reaches for.
+   */
+  static readonly ports = [33418, 33419, 33420, 33421, 33422];
+  static readonly callbackPath = "/callback";
+  /** How long the browser half may take before the loopback server gives the port back. */
+  static readonly timeoutMs = 300_000;
+
+  static #json(response: Response) {
+    return response.json() as Promise<Record<string, unknown>>;
+  }
+
+  /**
+   * The `resource_metadata` a `WWW-Authenticate` challenge points at.
+   *
+   * Taken from the header when it is there rather than derived, because a resource served under a path has
+   * its path inserted into the well-known url and only the server knows which spelling it published.
+   */
+  static resourceMetadataUrls(serverUrl: string, challenge?: string | null) {
+    const named = challenge ? /resource_metadata="([^"]+)"/.exec(challenge)?.[1] : undefined;
+    if (named) return [named];
+    const url = new URL(serverUrl);
+    const withPath = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return [
+      new URL(`${McpOAuth.resourceWellKnown}${withPath}`, url.origin).href,
+      new URL(McpOAuth.resourceWellKnown, url.origin).href,
+    ];
+  }
+
+  /** RFC 8414 §3.1 inserts the issuer's path after the suffix; OpenID appends it. Both are tried. */
+  static serverMetadataUrls(issuer: string) {
+    const url = new URL(issuer);
+    const withPath = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return [
+      new URL(`${McpOAuth.serverWellKnown}${withPath}`, url.origin).href,
+      new URL(`${withPath}${McpOAuth.openidWellKnown}`, url.origin).href,
+      new URL(McpOAuth.serverWellKnown, url.origin).href,
+    ];
+  }
+
+  /**
+   * Everything needed to run the flow, from the server url and whatever its `401` said.
+   *
+   * A resource that publishes no metadata is not refused: plenty of servers implement the token half of the
+   * spec and not the discovery half, and for those the server's own origin is the issuer to try.
+   */
+  static async discover(serverUrl: string, challenge?: string | null): Promise<McpOAuthServer> {
+    const resourceDoc = await McpOAuth.#first(McpOAuth.resourceMetadataUrls(serverUrl, challenge));
+    const resource = typeof resourceDoc?.resource === "string" ? resourceDoc.resource : serverUrl;
+    const resourceScopes = McpOAuth.#strings(resourceDoc?.scopes_supported);
+    const issuers = McpOAuth.#strings(resourceDoc?.authorization_servers);
+    const candidates = issuers.length ? issuers : [new URL(serverUrl).origin];
+    for (const issuer of candidates) {
+      const doc = await McpOAuth.#first(McpOAuth.serverMetadataUrls(issuer));
+      if (!doc) continue;
+      const methods = McpOAuth.#strings(doc.code_challenge_methods_supported);
+      // The spec says refuse rather than downgrade: a metadata document that omits S256 is either a server
+      // too old for OAuth 2.1 or one a network attacker rewrote, and both answers are "do not send a code".
+      if (methods.length && !methods.includes("S256"))
+        throw new Error(`${issuer} does not offer PKCE S256, which is the only method this client will use.`);
+      const authorizationEndpoint = typeof doc.authorization_endpoint === "string" ? doc.authorization_endpoint : "";
+      const tokenEndpoint = typeof doc.token_endpoint === "string" ? doc.token_endpoint : "";
+      if (!authorizationEndpoint || !tokenEndpoint) continue;
+      return {
+        issuer: typeof doc.issuer === "string" ? doc.issuer : issuer,
+        authorizationEndpoint,
+        tokenEndpoint,
+        ...(typeof doc.registration_endpoint === "string" ? { registrationEndpoint: doc.registration_endpoint } : {}),
+        ...(McpOAuth.#strings(doc.scopes_supported).length
+          ? { scopesSupported: McpOAuth.#strings(doc.scopes_supported) }
+          : {}),
+        resource,
+        ...(resourceScopes.length ? { resourceScopes } : {}),
+      };
+    }
+    throw new Error(`No OAuth metadata was found for ${serverUrl}. Declare "oauth" for it in mcp.json.`);
+  }
+
+  /** RFC 7591. What lets a hosted server be reached with nothing declared but its url. */
+  static async register(server: McpOAuthServer, redirectUri: string, name: string) {
+    if (!server.registrationEndpoint)
+      throw new Error(
+        `${server.issuer} registers no clients on demand. Put its "oauth": { "clientId": "…" } in mcp.json.`,
+      );
+    const response = await fetch(server.registrationEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        client_name: `akan code (${name})`,
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        // A CLI cannot keep a secret, so it says so and the server issues a public client.
+        token_endpoint_auth_method: "none",
+        application_type: "native",
+      }),
+      signal: AbortSignal.timeout(30_000),
+    });
+    const body = (await McpOAuth.#json(response)) as { client_id?: string; client_secret?: string; error?: string };
+    if (!response.ok || !body.client_id)
+      throw new Error(`${server.issuer} refused the client registration: ${body.error ?? response.status}`);
+    return { clientId: body.client_id, ...(body.client_secret ? { clientSecret: body.client_secret } : {}) };
+  }
+
+  /**
+   * The authorization code flow, start to finish, against a loopback redirect.
+   *
+   * The browser is opened by the caller: this module has no opinion about how a host reaches one, and a pod
+   * has no browser at all. `state` is checked on the way back, and `iss` too whenever the server sends it —
+   * without that check a response from one authorization server can be replayed at another.
+   */
+  static async authorize(options: {
+    server: McpOAuthServer;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    scope?: string;
+    /** Receives the url to open. Nothing happens until somebody visits it. */
+    open: (url: string) => void;
+    /** The already-bound loopback that answers the redirect. */
+    wait: () => Promise<URLSearchParams>;
+  }): Promise<McpOAuthTokens> {
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(16).toString("base64url");
+    const scope =
+      options.scope ?? options.server.resourceScopes?.join(" ") ?? options.server.scopesSupported?.join(" ");
+    const authorize = new URL(options.server.authorizationEndpoint);
+    for (const [key, value] of Object.entries({
+      response_type: "code",
+      client_id: options.clientId,
+      redirect_uri: options.redirectUri,
+      code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+      code_challenge_method: "S256",
+      state,
+      resource: options.server.resource,
+      ...(scope ? { scope } : {}),
+    }))
+      authorize.searchParams.set(key, value);
+    options.open(authorize.href);
+    const params = await options.wait();
+    const error = params.get("error");
+    if (error) throw new Error(`${error}: ${params.get("error_description") ?? "the authorization was refused"}`);
+    if (params.get("state") !== state) throw new Error("The authorization response carried the wrong state.");
+    const iss = params.get("iss");
+    if (iss && iss !== options.server.issuer)
+      throw new Error(`The authorization response came from ${iss}, not ${options.server.issuer}.`);
+    const code = params.get("code");
+    if (!code) throw new Error("The authorization response carried no code.");
+    return await McpOAuth.#token(options.server, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: options.redirectUri,
+      client_id: options.clientId,
+      code_verifier: verifier,
+      resource: options.server.resource,
+      ...(options.clientSecret ? { client_secret: options.clientSecret } : {}),
+    });
+  }
+
+  static async refresh(server: McpOAuthServer, auth: McpStoredAuth) {
+    if (!auth.refreshToken) throw new Error("There is no refresh token for this server.");
+    return await McpOAuth.#token(server, {
+      grant_type: "refresh_token",
+      refresh_token: auth.refreshToken,
+      client_id: auth.clientId,
+      resource: server.resource,
+      ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
+      ...(auth.scope ? { scope: auth.scope } : {}),
+    });
+  }
+
+  /** The scope a server was signed in with, or what its metadata asks for, for a refresh that must restate it. */
+  static scopeOf(ref: CodeAgentMcpServerRef, server: McpOAuthServer) {
+    return ref.oauth?.scope ?? server.resourceScopes?.join(" ") ?? server.scopesSupported?.join(" ");
+  }
+
+  static async #token(server: McpOAuthServer, form: Record<string, string>): Promise<McpOAuthTokens> {
+    const response = await fetch(server.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body: new URLSearchParams(form).toString(),
+      signal: AbortSignal.timeout(30_000),
+    });
+    const body = (await McpOAuth.#json(response)) as TokenResponse;
+    if (!response.ok || !body.access_token)
+      throw new Error(`${server.tokenEndpoint} refused the token request: ${body.error ?? response.status}`);
+    return {
+      accessToken: body.access_token,
+      ...(body.refresh_token ? { refreshToken: body.refresh_token } : {}),
+      ...(body.expires_in ? { expiresAt: Date.now() + body.expires_in * 1_000 } : {}),
+      ...(body.scope ? { scope: body.scope } : {}),
+    };
+  }
+
+  /** The first url that answers a JSON document; a 404 on one spelling is the normal case, not a failure. */
+  static async #first(urls: string[]) {
+    for (const url of urls) {
+      try {
+        const response = await fetch(url, {
+          headers: { accept: "application/json", "mcp-protocol-version": "2025-06-18" },
+          signal: AbortSignal.timeout(15_000),
+        });
+        if (!response.ok) continue;
+        return await McpOAuth.#json(response);
+      } catch {
+        // A metadata url that does not resolve is one spelling out of several; the caller tries the next.
+      }
+    }
+    return undefined;
+  }
+
+  static #strings(value: unknown) {
+    return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === "string") : [];
+  }
+}

package/codeAgent/tools/McpOAuthLoopback.ts

@@ -0,0 +1,77 @@
+import { McpOAuth } from "./McpOAuth";
+
+/**
+ * The loopback address the authorization server redirects back to.
+ *
+ * A native client has no url of its own, so the redirect goes to a server this process runs for the length of
+ * one sign-in. It binds `127.0.0.1` rather than `0.0.0.0`: the code in that redirect is a credential, and a
+ * port open to the network is a port anything on the network can race the browser to.
+ */
+export class McpOAuthLoopback {
+  readonly #server: ReturnType<typeof Bun.serve>;
+  readonly #port: number;
+  #resolve: ((params: URLSearchParams) => void) | undefined;
+  readonly #answer: Promise<URLSearchParams>;
+
+  private constructor(port: number) {
+    this.#port = port;
+    this.#answer = new Promise<URLSearchParams>((resolve) => {
+      this.#resolve = resolve;
+    });
+    this.#server = Bun.serve({
+      port,
+      hostname: "127.0.0.1",
+      fetch: (request) => this.#handle(request),
+    });
+  }
+
+  /**
+   * Binds the port a client was registered against, or the first free one from the list.
+   *
+   * A registration names its `redirect_uri` exactly, so a second sign-in that landed on a different port would
+   * be refused by the server — which is why the port that worked is stored with the client rather than chosen
+   * afresh. When it cannot be had, the caller registers again against whatever this did bind.
+   */
+  static bind(preferred?: number) {
+    const ports = preferred ? [preferred, ...McpOAuth.ports.filter((port) => port !== preferred)] : McpOAuth.ports;
+    const failures: string[] = [];
+    for (const port of ports) {
+      try {
+        return new McpOAuthLoopback(port);
+      } catch (error) {
+        failures.push(`${port}: ${String(error)}`);
+      }
+    }
+    throw new Error(`No loopback port was free for the sign-in — ${failures.join(", ")}`);
+  }
+
+  get redirectUri() {
+    return `http://127.0.0.1:${this.#port}${McpOAuth.callbackPath}`;
+  }
+
+  /** The query the browser came back with, or a timeout — a sign-in nobody finishes must give the port back. */
+  async wait() {
+    const timeout = new Promise<never>((_, reject) =>
+      setTimeout(() => reject(new Error("The sign-in was not completed in time.")), McpOAuth.timeoutMs).unref?.(),
+    );
+    return await Promise.race([this.#answer, timeout]);
+  }
+
+  close() {
+    this.#server.stop(true);
+  }
+
+  #handle(request: Request) {
+    const url = new URL(request.url);
+    if (url.pathname !== McpOAuth.callbackPath) return new Response("Not found", { status: 404 });
+    this.#resolve?.(url.searchParams);
+    const failed = url.searchParams.get("error");
+    // The page is the only thing the person sees at the end of the flow, so it says which window to go back to.
+    return new Response(
+      `<!doctype html><meta charset="utf-8"><title>akan code</title><body style="font:16px system-ui;padding:3rem">
+<h1>${failed ? "Sign-in failed" : "Signed in"}</h1>
+<p>${failed ? `The authorization server said: ${Bun.escapeHTML(failed)}` : "You can close this tab and go back to the terminal."}</p>`,
+      { status: failed ? 400 : 200, headers: { "content-type": "text/html; charset=utf-8" } },
+    );
+  }
+}