@bubblebrain-ai/bubble 0.0.45 → 0.0.46

package/dist/oauth/grok.js

@@ -34,11 +34,28 @@ function openBrowser(url) {
 }
 /**
  * xAI's OAuth client allows dynamic loopback ports, so listen on an ephemeral
- * port and report the redirect URI back to the login flow once bound.
+ * port. Awaiting this returns only once the socket is actually bound, so the
+ * caller can never build an authorization URL around an empty redirect URI.
  */
-async function startCallbackServer(timeoutMs, onListening, onStatus) {
-    return new Promise((resolve, reject) => {
+async function startCallbackServer(timeoutMs, onStatus) {
+    let settle = () => { };
+    let fail = () => { };
+    const result = new Promise((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+    });
+    // Nothing awaits `result` until the caller has a redirect URI, and an early
+    // rejection (bind failure) would otherwise be an unhandled rejection.
+    result.catch(() => { });
+    return new Promise((resolveListening, rejectListening) => {
         let resolved = false;
+        const finish = (action) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timer);
+            server.close(action);
+        };
         const server = createServer((req, res) => {
             try {
                 const port = server.address().port;
@@ -51,19 +68,13 @@ async function startCallbackServer(timeoutMs, onListening, onStatus) {
                     if (error) {
                         res.writeHead(400, { "Content-Type": "text/html" });
                         res.end(`<html><body><h1>Authorization failed</h1><p>${errorDesc || error}</p></body></html>`);
-                        if (!resolved) {
-                            resolved = true;
-                            server.close(() => reject(new Error(`OAuth error: ${errorDesc || error}`)));
-                        }
+                        finish(() => fail(new Error(`OAuth error: ${errorDesc || error}`)));
                         return;
                     }
                     if (code) {
                         res.writeHead(200, { "Content-Type": "text/html" });
                         res.end("<html><body><h1>Authorization successful</h1><p>You can close this window and return to the terminal.</p></body></html>");
-                        if (!resolved) {
-                            resolved = true;
-                            server.close(() => resolve({ code, state: state || "" }));
-                        }
+                        finish(() => settle({ code, state: state || "" }));
                         return;
                     }
                 }
@@ -75,17 +86,32 @@ async function startCallbackServer(timeoutMs, onListening, onStatus) {
                 res.end("Error");
             }
         });
+        // Unref'd so a pending login never keeps the process alive on its own,
+        // and cleared on completion so a successful login does not leave the
+        // event loop holding a five-minute timer.
+        const timer = setTimeout(() => {
+            finish(() => fail(new Error(`OAuth login timed out after ${timeoutMs / 1000}s`)));
+        }, timeoutMs);
+        timer.unref?.();
+        // Without this, a failed bind (port exhausted, sandbox denies listening)
+        // never rejects anything — the login just hangs until the timeout.
+        server.on("error", (error) => {
+            clearTimeout(timer);
+            if (resolved)
+                return;
+            resolved = true;
+            rejectListening(error instanceof Error ? error : new Error(String(error)));
+            fail(error instanceof Error ? error : new Error(String(error)));
+        });
         server.listen(0, "127.0.0.1", () => {
             const port = server.address().port;
             onStatus?.(`Local server listening on http://127.0.0.1:${port}`);
-            onListening(`http://127.0.0.1:${port}/callback`);
+            // Resolve only once the socket is genuinely bound. The caller used to
+            // race this with a single setImmediate tick and declare failure if the
+            // listen callback had not fired yet — which it frequently has not, since
+            // binding is real async I/O.
+            resolveListening({ redirectUri: `http://127.0.0.1:${port}/callback`, result });
         });
-        setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                server.close(() => reject(new Error(`OAuth login timed out after ${timeoutMs / 1000}s`)));
-            }
-        }, timeoutMs);
     });
 }
 function parseTokenResponse(data, fallbackRefreshToken) {
@@ -109,15 +135,15 @@ export async function loginGrok(callbacks, options = {}) {
     const pkce = generatePKCE();
     const state = generateOpaqueId();
     const nonce = generateOpaqueId();
-    let redirectUri = "";
-    const serverPromise = startCallbackServer(5 * 60 * 1000, (uri) => {
-        redirectUri = uri;
-    }, callbacks?.onStatus);
-    // The listen callback fires before any request can arrive; give the event
-    // loop one tick so redirectUri is populated before building the URL.
-    await new Promise((resolve) => setImmediate(resolve));
-    if (!redirectUri) {
-        throw new Error("The local OAuth callback server did not start.");
+    let redirectUri;
+    let serverPromise;
+    try {
+        const server = await startCallbackServer(5 * 60 * 1000, callbacks?.onStatus);
+        redirectUri = server.redirectUri;
+        serverPromise = server.result;
+    }
+    catch (error) {
+        throw new Error(`The local OAuth callback server could not start: ${error instanceof Error ? error.message : String(error)}`);
     }
     const params = new URLSearchParams({
         response_type: "code",

package/dist/oauth/openai-codex.js

@@ -63,6 +63,19 @@ async function startCallbackServer(port, timeoutMs, onStatus) {
                 res.end("Error");
             }
         });
+        // This flow binds a FIXED port (the provider only whitelists one redirect
+        // URI), so EADDRINUSE is a realistic outcome — a stale login, or any other
+        // process on the port. Without this handler nothing rejects and the user
+        // stares at "waiting for authorization" for the full timeout.
+        server.on("error", (error) => {
+            if (resolved)
+                return;
+            resolved = true;
+            const detail = error?.code === "EADDRINUSE"
+                ? `port ${port} is already in use — close any other sign-in still running and retry`
+                : error instanceof Error ? error.message : String(error);
+            reject(new Error(`The local OAuth callback server could not start: ${detail}`));
+        });
         server.listen(port, "127.0.0.1", () => {
             onStatus?.(`Local server listening on http://127.0.0.1:${port}`);
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bubblebrain-ai/bubble",
-  "version": "0.0.45",
+  "version": "0.0.46",
   "description": "A terminal coding agent",
   "type": "module",
   "engines": {