@bubblebrain-ai/bubble 0.0.45 → 0.0.47

package/dist/oauth/grok.js

@@ -34,11 +34,28 @@ function openBrowser(url) {
 }
 /**
  * xAI's OAuth client allows dynamic loopback ports, so listen on an ephemeral
- * port and report the redirect URI back to the login flow once bound.
+ * port. Awaiting this returns only once the socket is actually bound, so the
+ * caller can never build an authorization URL around an empty redirect URI.
  */
-async function startCallbackServer(timeoutMs, onListening, onStatus) {
-    return new Promise((resolve, reject) => {
+async function startCallbackServer(timeoutMs, onStatus) {
+    let settle = () => { };
+    let fail = () => { };
+    const result = new Promise((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+    });
+    // Nothing awaits `result` until the caller has a redirect URI, and an early
+    // rejection (bind failure) would otherwise be an unhandled rejection.
+    result.catch(() => { });
+    return new Promise((resolveListening, rejectListening) => {
         let resolved = false;
+        const finish = (action) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timer);
+            server.close(action);
+        };
         const server = createServer((req, res) => {
             try {
                 const port = server.address().port;
@@ -51,19 +68,13 @@ async function startCallbackServer(timeoutMs, onListening, onStatus) {
                     if (error) {
                         res.writeHead(400, { "Content-Type": "text/html" });
                         res.end(`<html><body><h1>Authorization failed</h1><p>${errorDesc || error}</p></body></html>`);
-                        if (!resolved) {
-                            resolved = true;
-                            server.close(() => reject(new Error(`OAuth error: ${errorDesc || error}`)));
-                        }
+                        finish(() => fail(new Error(`OAuth error: ${errorDesc || error}`)));
                         return;
                     }
                     if (code) {
                         res.writeHead(200, { "Content-Type": "text/html" });
                         res.end("<html><body><h1>Authorization successful</h1><p>You can close this window and return to the terminal.</p></body></html>");
-                        if (!resolved) {
-                            resolved = true;
-                            server.close(() => resolve({ code, state: state || "" }));
-                        }
+                        finish(() => settle({ code, state: state || "" }));
                         return;
                     }
                 }
@@ -75,17 +86,32 @@ async function startCallbackServer(timeoutMs, onListening, onStatus) {
                 res.end("Error");
             }
         });
+        // Unref'd so a pending login never keeps the process alive on its own,
+        // and cleared on completion so a successful login does not leave the
+        // event loop holding a five-minute timer.
+        const timer = setTimeout(() => {
+            finish(() => fail(new Error(`OAuth login timed out after ${timeoutMs / 1000}s`)));
+        }, timeoutMs);
+        timer.unref?.();
+        // Without this, a failed bind (port exhausted, sandbox denies listening)
+        // never rejects anything — the login just hangs until the timeout.
+        server.on("error", (error) => {
+            clearTimeout(timer);
+            if (resolved)
+                return;
+            resolved = true;
+            rejectListening(error instanceof Error ? error : new Error(String(error)));
+            fail(error instanceof Error ? error : new Error(String(error)));
+        });
         server.listen(0, "127.0.0.1", () => {
             const port = server.address().port;
             onStatus?.(`Local server listening on http://127.0.0.1:${port}`);
-            onListening(`http://127.0.0.1:${port}/callback`);
+            // Resolve only once the socket is genuinely bound. The caller used to
+            // race this with a single setImmediate tick and declare failure if the
+            // listen callback had not fired yet — which it frequently has not, since
+            // binding is real async I/O.
+            resolveListening({ redirectUri: `http://127.0.0.1:${port}/callback`, result });
         });
-        setTimeout(() => {
-            if (!resolved) {
-                resolved = true;
-                server.close(() => reject(new Error(`OAuth login timed out after ${timeoutMs / 1000}s`)));
-            }
-        }, timeoutMs);
     });
 }
 function parseTokenResponse(data, fallbackRefreshToken) {
@@ -109,15 +135,15 @@ export async function loginGrok(callbacks, options = {}) {
     const pkce = generatePKCE();
     const state = generateOpaqueId();
     const nonce = generateOpaqueId();
-    let redirectUri = "";
-    const serverPromise = startCallbackServer(5 * 60 * 1000, (uri) => {
-        redirectUri = uri;
-    }, callbacks?.onStatus);
-    // The listen callback fires before any request can arrive; give the event
-    // loop one tick so redirectUri is populated before building the URL.
-    await new Promise((resolve) => setImmediate(resolve));
-    if (!redirectUri) {
-        throw new Error("The local OAuth callback server did not start.");
+    let redirectUri;
+    let serverPromise;
+    try {
+        const server = await startCallbackServer(5 * 60 * 1000, callbacks?.onStatus);
+        redirectUri = server.redirectUri;
+        serverPromise = server.result;
+    }
+    catch (error) {
+        throw new Error(`The local OAuth callback server could not start: ${error instanceof Error ? error.message : String(error)}`);
     }
     const params = new URLSearchParams({
         response_type: "code",
@@ -181,10 +207,13 @@ export async function refreshGrok(refreshToken, options = {}) {
  * Bubble's isolated runtime profile or the user's real ~/.grok). Users who
  * already completed `grok login` skip the browser round-trip entirely.
  */
-export function importGrokCliCredentials(bubbleHome = join(homedir(), ".bubble")) {
+export function importGrokCliCredentials(bubbleHome = join(homedir(), ".bubble"), 
+// Injectable so tests can isolate the ~/.grok fallback from the real home
+// directory; production callers rely on the default.
+homeDir = homedir()) {
     const candidates = [
         join(bubbleHome, "runtimes", "grok", "grok-home", "auth.json"),
-        join(homedir(), ".grok", "auth.json"),
+        join(homeDir, ".grok", "auth.json"),
     ];
     for (const path of candidates) {
         let parsed;

package/dist/oauth/openai-codex.js

@@ -63,6 +63,19 @@ async function startCallbackServer(port, timeoutMs, onStatus) {
                 res.end("Error");
             }
         });
+        // This flow binds a FIXED port (the provider only whitelists one redirect
+        // URI), so EADDRINUSE is a realistic outcome — a stale login, or any other
+        // process on the port. Without this handler nothing rejects and the user
+        // stares at "waiting for authorization" for the full timeout.
+        server.on("error", (error) => {
+            if (resolved)
+                return;
+            resolved = true;
+            const detail = error?.code === "EADDRINUSE"
+                ? `port ${port} is already in use — close any other sign-in still running and retry`
+                : error instanceof Error ? error.message : String(error);
+            reject(new Error(`The local OAuth callback server could not start: ${detail}`));
+        });
         server.listen(port, "127.0.0.1", () => {
             onStatus?.(`Local server listening on http://127.0.0.1:${port}`);
         });

package/dist/oauth/storage.d.ts

@@ -1,11 +1,18 @@
 /**
- * OAuth credential storage in ~/.bubble/auth.json
+ * OAuth credential storage in <bubble home>/auth.json.
+ *
+ * The path is resolved at CONSTRUCTION time through getBubbleHome(), never at
+ * module load: a module-level constant froze the real ~/.bubble at import,
+ * which no test could isolate (known-defects #7) and which ignored
+ * BUBBLE_HOME / dev mode while every other config file honored them
+ * (config.json, sessions, memory all derive from getBubbleHome).
  */
 import type { OAuthCredentials } from "./types.js";
 export declare class AuthStorage {
     private data;
     private mutationListeners;
-    constructor();
+    private readonly authPath;
+    constructor(authPath?: string);
     /**
      * Observe credential writes/removals. Callers across the codebase mutate
      * this storage directly (login/logout flows), so consumers that must react

package/dist/oauth/storage.js

@@ -1,14 +1,21 @@
 /**
- * OAuth credential storage in ~/.bubble/auth.json
+ * OAuth credential storage in <bubble home>/auth.json.
+ *
+ * The path is resolved at CONSTRUCTION time through getBubbleHome(), never at
+ * module load: a module-level constant froze the real ~/.bubble at import,
+ * which no test could isolate (known-defects #7) and which ignored
+ * BUBBLE_HOME / dev mode while every other config file honored them
+ * (config.json, sessions, memory all derive from getBubbleHome).
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-const AUTH_PATH = join(homedir(), ".bubble", "auth.json");
+import { getBubbleHome } from "../bubble-home.js";
 export class AuthStorage {
     data = {};
     mutationListeners = [];
-    constructor() {
+    authPath;
+    constructor(authPath = join(getBubbleHome(), "auth.json")) {
+        this.authPath = authPath;
         this.load();
     }
     /**
@@ -34,10 +41,10 @@ export class AuthStorage {
         }
     }
     load() {
-        if (!existsSync(AUTH_PATH))
+        if (!existsSync(this.authPath))
             return;
         try {
-            const raw = readFileSync(AUTH_PATH, "utf-8");
+            const raw = readFileSync(this.authPath, "utf-8");
             const parsed = JSON.parse(raw);
             this.data = parsed;
         }
@@ -46,13 +53,13 @@ export class AuthStorage {
         }
     }
     save() {
-        const dir = dirname(AUTH_PATH);
+        const dir = dirname(this.authPath);
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
-        writeFileSync(AUTH_PATH, JSON.stringify(this.data, null, 2) + "\n", { mode: 0o600 });
+        writeFileSync(this.authPath, JSON.stringify(this.data, null, 2) + "\n", { mode: 0o600 });
     }
     getPath() {
-        return AUTH_PATH;
+        return this.authPath;
     }
     get(providerId) {
         return this.data[providerId];

package/dist/orchestrator/default-hooks.d.ts

@@ -1,2 +1,22 @@
 import type { TurnHooks } from "./hooks.js";
+/**
+ * Default hooks: infrastructure and information only.
+ *
+ * The cognitive-governance layer that used to live here (task classifier,
+ * step-budget governor, discovery barrier, evidence tracker, bash-search
+ * arbitration, delegation nudge, completion self-check) was removed — see
+ * docs/harness-thinning.md. The TurnHooks mechanism itself stays, pi-style:
+ * hosts may install their own policies, the core ships none.
+ *
+ * What remains, and why it passes the ruler in that document:
+ * - resident-history compaction calls (infrastructure)
+ * - background-task and subagent-lifecycle reminders (facts the model
+ *   cannot otherwise see)
+ * - orchestrationRequestReminder (deliberately retained policy: amplifies
+ *   the user's EXPLICIT orchestration request at the decision turn)
+ * - userNamedModelReminder (deterministic catalog resolution of a model the
+ *   user named — information the model would otherwise retype from priors)
+ * - modified-existing-tests disclosure (git ground truth: bash writes and
+ *   subagent worktree merges do not appear in the model's own tool memory)
+ */
 export declare function createDefaultHooks(): TurnHooks[];