@mcp-abap-adt/auth-providers 1.0.5 → 1.2.0

package/dist/auth/browserAuth.js

@@ -39,13 +39,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractCode = extractCode;
 exports.exchangeCodeForToken = exchangeCodeForToken;
 exports.startBrowserAuth = startBrowserAuth;
 const child_process = __importStar(require("node:child_process"));
 const http = __importStar(require("node:http"));
 const net = __importStar(require("node:net"));
+const readline = __importStar(require("node:readline"));
 const axios_1 = __importDefault(require("axios"));
-const express_1 = __importDefault(require("express"));
+const callbackServer_1 = require("./callbackServer");
 const BROWSER_MAP = {
     chrome: 'chrome',
     edge: 'msedge',
@@ -55,6 +57,37 @@ const BROWSER_MAP = {
     headless: null, // no browser, log URL and wait for callback (SSH/remote)
     none: null, // no browser, log URL and wait for callback (same as headless)
 };
+/**
+ * Extract an OAuth2 authorization code from arbitrary pasted input.
+ *
+ * Accepts:
+ *  - a bare code: `abc123`
+ *  - `code=abc123`
+ *  - a full redirected URL: `http://localhost:7779/callback?code=abc123&state=...`
+ *
+ * Returns the decoded code, or null if nothing usable was found.
+ * @internal - Exported for testing and for manual-paste flows.
+ */
+function extractCode(input) {
+    if (!input)
+        return null;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return null;
+    // Anywhere a `code=` query parameter appears (full URL or query string)
+    const fromQuery = trimmed.match(/[?&]code=([^&\s]+)/);
+    if (fromQuery)
+        return decodeURIComponent(fromQuery[1]);
+    // Bare `code=XYZ`
+    const bareKv = trimmed.match(/^code=([^&\s]+)$/);
+    if (bareKv)
+        return decodeURIComponent(bareKv[1]);
+    // Otherwise treat the whole token as the code, but reject anything with
+    // whitespace (clearly not a single code).
+    if (/\s/.test(trimmed))
+        return null;
+    return trimmed;
+}
 /**
  * Get OAuth2 authorization URL
  */
@@ -135,482 +168,173 @@ function isPortAvailable(port) {
  * @param port Port for OAuth callback server (default: 3001)
  * @returns Promise that resolves to tokens
  * @internal - Internal function, not exported from package
- */
-async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3001) {
-    // Use logger if provided, otherwise null (no logging)
-    const log = logger || null;
-    // Check if requested port is available, throw error if not
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
+ */ /**
+* Open the authorization URL, or tell the user how to do it.
+*
+* Never awaited on the critical path by the caller: a launcher that hangs must
+* not delay the login timeout or the release of the port. A launcher that fails
+* is reported through the scope's `fail`, which is just another way for the
+* scope to end.
+*/
+async function launchBrowser(authorizationUrl, browser, port, announce, log) {
+    const browserApp = BROWSER_MAP[browser];
+    // 'none' / 'headless': show the URL and wait. For SSH and remote sessions.
+    if (browser === 'none' || browser === 'headless') {
+        announce('🔗 Open this URL in your browser to authenticate:');
+        announce(`   ${authorizationUrl}`);
+        announce(`   Waiting for callback on http://localhost:${port}/callback ...`);
+        announce('   If your browser is on another machine, after login copy the ' +
+            '`code` from the address bar and paste it at ' +
+            `http://<this-host>:${port}/ — or paste it here and press Enter.`);
+        return;
     }
-    return new Promise((originalResolve, originalReject) => {
-        let timeoutId = null;
-        let finishTimeoutId = null;
-        let cleanupDone = false;
-        let resolved = false;
-        const app = (0, express_1.default)();
-        const server = http.createServer(app);
-        // Disable keep-alive to ensure connections close immediately
-        server.keepAliveTimeout = 0;
-        server.headersTimeout = 0;
-        const PORT = port;
-        let serverInstance = null;
-        // Cleanup function to ensure server is closed on process termination
-        const cleanup = () => {
-            if (cleanupDone)
-                return;
-            cleanupDone = true;
-            log?.debug(`Cleaning up OAuth callback server on port ${PORT}`);
-            if (timeoutId) {
-                clearTimeout(timeoutId);
-                timeoutId = null;
-            }
-            if (finishTimeoutId) {
-                clearTimeout(finishTimeoutId);
-                finishTimeoutId = null;
-            }
-            if (server) {
-                try {
-                    if (typeof server.closeAllConnections === 'function') {
-                        server.closeAllConnections();
-                    }
-                    server.close(() => {
-                        log?.debug(`OAuth server closed during cleanup, port ${PORT} freed`);
-                    });
-                }
-                catch (_e) {
-                    // Ignore errors during cleanup
-                }
-            }
-        };
-        // Remove cleanup listeners to prevent memory leaks
-        const removeCleanupListeners = () => {
-            process.removeListener('exit', cleanup);
-            process.removeListener('SIGTERM', cleanup);
-            process.removeListener('SIGINT', cleanup);
-            process.removeListener('SIGHUP', cleanup);
-            if (process.platform === 'win32') {
-                process.removeListener('SIGBREAK', cleanup);
-            }
-        };
-        const resolve = (value) => {
-            if (resolved)
-                return; // Prevent double resolution
-            resolved = true;
-            if (timeoutId) {
-                clearTimeout(timeoutId);
-                timeoutId = null;
-            }
-            if (finishTimeoutId) {
-                clearTimeout(finishTimeoutId);
-                finishTimeoutId = null;
-            }
-            removeCleanupListeners();
-            originalResolve(value);
-        };
-        const reject = (reason) => {
-            if (timeoutId)
-                clearTimeout(timeoutId);
-            removeCleanupListeners();
-            originalReject(reason);
-        };
-        // Register cleanup handlers for process termination
-        // This ensures port is freed when Cline or other clients kill the process
-        process.once('exit', cleanup);
-        process.once('SIGTERM', cleanup);
-        process.once('SIGINT', cleanup);
-        process.once('SIGHUP', cleanup);
-        // SIGBREAK is Windows-specific (Ctrl+Break)
-        if (process.platform === 'win32') {
-            process.once('SIGBREAK', cleanup);
-        }
-        // Use provided authorization URL or build from authConfig
-        const authorizationUrl = authConfig.authorizationUrl ?? getJwtAuthorizationUrl(authConfig, PORT);
-        log?.info(`[browserAuth] Authorization URL: ${authorizationUrl}`);
-        log?.info(`[browserAuth] Server listening on port: ${PORT}`);
-        // Verify port in redirect_uri matches server port
-        const redirectUriMatch = authorizationUrl.match(/redirect_uri=([^&]+)/);
-        if (redirectUriMatch) {
-            const redirectUri = decodeURIComponent(redirectUriMatch[1]);
-            const urlPortMatch = redirectUri.match(/localhost:(\d+)/);
-            if (urlPortMatch) {
-                const urlPort = parseInt(urlPortMatch[1], 10);
-                if (urlPort !== PORT) {
-                    log?.warn(`[browserAuth] WARNING: Port mismatch! URL has port ${urlPort}, but server listens on ${PORT}`);
-                }
-                else {
-                    log?.info(`[browserAuth] Port match: URL and server both use port ${PORT}`);
-                }
-            }
+    if (browser === 'auto') {
+        log?.info('🌐 Attempting to open browser for authentication...');
+        try {
+            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
+            await openModule.default(authorizationUrl);
+            log?.info('✅ Browser opened successfully. Waiting for authentication...');
         }
-        // OAuth2 callback handler
-        app.get('/callback', async (req, res) => {
-            try {
-                log?.info(`[browserAuth] Callback received: ${req.url}`);
-                log?.debug(`Callback query: ${JSON.stringify(req.query)}`);
-                // Check for OAuth2 error parameters
-                const { error, error_description, error_uri } = req.query;
-                if (error) {
-                    log?.error(`Callback error: ${error}${error_description ? ` - ${error_description}` : ''}`);
-                    const errorMsg = error_description
-                        ? `${error}: ${error_description}`
-                        : String(error);
-                    const errorHtml = `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Authentication Error</title>
-    <style>
-        body {
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-            text-align: center;
-            margin: 0;
-            padding: 50px 20px;
-            background: linear-gradient(135deg, #dc2626 0%, #ef4444 100%);
-            color: white;
-            min-height: 100vh;
-            display: flex;
-            flex-direction: column;
-            justify-content: center;
-            align-items: center;
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            log?.warn(`⚠️  Could not open browser automatically: ${message}`);
+            announce('🔗 Please open this URL in your browser to authenticate:');
+            announce(`   ${authorizationUrl}`);
+            announce(`   Waiting for callback on http://localhost:${port}/callback ...`);
         }
-        .container {
-            background: rgba(255, 255, 255, 0.1);
-            border-radius: 20px;
-            padding: 40px;
-            backdrop-filter: blur(10px);
-            box-shadow: 0 8px 32px rgba(0, 0, 0, 0.1);
-            max-width: 500px;
-            width: 100%;
-        }
-        .error-icon {
-            font-size: 4rem;
-            margin-bottom: 20px;
-            color: #fbbf24;
-            text-shadow: 0 2px 4px rgba(0, 0, 0, 0.3);
-        }
-        h1 {
-            margin: 0 0 20px 0;
-            font-size: 2rem;
-            font-weight: 300;
-        }
-        p {
-            margin: 0;
-            font-size: 1.1rem;
-            opacity: 0.9;
-            line-height: 1.5;
-        }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <div class="error-icon">✗</div>
-        <h1>Authentication Failed</h1>
-        <p>${errorMsg}</p>
-        <p>Please check your service key configuration and try again.</p>
-    </div>
-</body>
-</html>`;
-                    res.status(400).send(errorHtml);
-                    if (typeof server.closeAllConnections === 'function') {
-                        server.closeAllConnections();
-                    }
-                    server.close(() => {
-                        // Server closed on error
-                    });
-                    return reject(new Error(`OAuth2 authentication failed: ${errorMsg}${error_uri ? ` (${error_uri})` : ''}`));
-                }
-                const { code } = req.query;
-                log?.info(`[browserAuth] Callback code received: ${code ? 'yes' : 'no'}`);
-                log?.debug(`Callback code received: ${code ? 'yes' : 'no'}`);
-                if (!code || typeof code !== 'string') {
-                    log?.error(`[browserAuth] Callback code missing`);
-                    res.status(400).send('Error: Authorization code missing');
-                    return reject(new Error('Authorization code missing'));
-                }
-                log?.info(`[browserAuth] Exchanging code for token...`);
-                // Send success page
-                const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>SAP BTP Authentication</title>
-    <style>
-        body {
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-            text-align: center;
-            margin: 0;
-            padding: 50px 20px;
-            background: linear-gradient(135deg, #0070f3 0%, #00d4ff 100%);
-            color: white;
-            min-height: 100vh;
-            display: flex;
-            flex-direction: column;
-            justify-content: center;
-            align-items: center;
-        }
-        .container {
-            background: rgba(255, 255, 255, 0.1);
-            border-radius: 20px;
-            padding: 40px;
-            backdrop-filter: blur(10px);
-            box-shadow: 0 8px 32px rgba(0, 0, 0, 0.1);
-            max-width: 500px;
-            width: 100%;
+        return;
+    }
+    if (browserApp === null)
+        return;
+    // On Linux, ensure DISPLAY is set for X11 applications.
+    if (process.platform === 'linux' &&
+        !process.env.DISPLAY &&
+        !process.env.WAYLAND_DISPLAY) {
+        process.env.DISPLAY = ':0';
+        log?.debug('DISPLAY not set, using fallback DISPLAY=:0');
+    }
+    let open = null;
+    try {
+        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
+        open = openModule.default;
+    }
+    catch {
+        open = null;
+    }
+    if (!open) {
+        // Fallback: shell out. Non-blocking by design.
+        const platform = process.platform;
+        let command;
+        if (browserApp === 'chrome') {
+            command =
+                platform === 'win32'
+                    ? 'cmd /c start "" "chrome"'
+                    : platform === 'darwin'
+                        ? 'open -a "Google Chrome"'
+                        : 'google-chrome || chromium || chromium-browser';
         }
-        .success-icon {
-            font-size: 4rem;
-            margin-bottom: 20px;
-            color: #4ade80;
-            text-shadow: 0 2px 4px rgba(0, 0, 0, 0.3);
+        else if (browserApp === 'msedge') {
+            command =
+                platform === 'win32'
+                    ? 'cmd /c start "" "msedge"'
+                    : platform === 'darwin'
+                        ? 'open -a "Microsoft Edge"'
+                        : 'microsoft-edge || microsoft-edge-stable';
         }
-        h1 {
-            margin: 0 0 20px 0;
-            font-size: 2rem;
-            font-weight: 300;
+        else if (browserApp === 'firefox') {
+            command =
+                platform === 'win32'
+                    ? 'cmd /c start "" "firefox"'
+                    : platform === 'darwin'
+                        ? 'open -a Firefox'
+                        : 'firefox || firefox-esr';
         }
-        p {
-            margin: 0;
-            font-size: 1.1rem;
-            opacity: 0.9;
-            line-height: 1.5;
+        else {
+            command =
+                platform === 'win32'
+                    ? 'cmd /c start ""'
+                    : platform === 'darwin'
+                        ? 'open'
+                        : 'xdg-open';
         }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <div class="success-icon">✓</div>
-        <h1>Authentication Successful!</h1>
-        <p>You have successfully authenticated with SAP BTP.</p>
-        <p>You can now close this browser window.</p>
-    </div>
-</body>
-</html>`;
-                // Exchange code for tokens first
-                try {
-                    log?.info(`[browserAuth] Starting token exchange...`);
-                    const tokens = await exchangeCodeForToken(authConfig, code, PORT, log);
-                    log?.info(`[browserAuth] Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
-                    // Send success page (non-blocking, doesn't affect promise)
-                    res.send(html);
-                    log?.info(`[browserAuth] Response sent, waiting for finish...`);
-                    // Close all connections and server after response is sent
-                    // Resolve promise AFTER server is closed to prevent Jest from hanging
-                    let serverClosing = false;
-                    const closeServerAndResolve = () => {
-                        if (serverClosing)
-                            return; // Prevent double execution
-                        serverClosing = true;
-                        if (finishTimeoutId) {
-                            clearTimeout(finishTimeoutId);
-                            finishTimeoutId = null;
-                        }
-                        log?.info(`[browserAuth] Response finished, closing server...`);
-                        if (typeof server.closeAllConnections === 'function') {
-                            server.closeAllConnections();
-                        }
-                        // Wait for server to close before resolving to prevent Jest from hanging
-                        server.close(() => {
-                            // Server closed - port should be freed
-                            log?.info(`[browserAuth] Server closed, port ${PORT} should be freed`);
-                            // Resolve after server is fully closed
-                            log?.info(`[browserAuth] Resolving promise with tokens...`);
-                            resolve({
-                                accessToken: tokens.accessToken,
-                                refreshToken: tokens.refreshToken,
-                            });
-                        });
-                    };
-                    // Wait for response to finish, but add timeout to prevent hanging
-                    res.once('finish', closeServerAndResolve);
-                    // Fallback: if finish event doesn't fire within 1 second, close anyway
-                    finishTimeoutId = setTimeout(closeServerAndResolve, 1000);
-                }
-                catch (error) {
-                    if (typeof server.closeAllConnections === 'function') {
-                        server.closeAllConnections();
-                    }
-                    // Use setTimeout to ensure connections are closed before server.close()
-                    setTimeout(() => {
-                        server.close(() => {
-                            // Server closed on error - port should be freed
-                            log?.debug(`Server closed on error, port ${PORT} should be freed`);
-                        });
-                    }, 100);
-                    reject(error);
-                }
-            }
-            catch (error) {
-                res.status(500).send('Error processing authentication');
-                if (typeof server.closeAllConnections === 'function') {
-                    server.closeAllConnections();
-                }
-                // Use setTimeout to ensure connections are closed before server.close()
-                setTimeout(() => {
-                    server.close(() => {
-                        // Server closed on error - port should be freed
-                        log?.debug(`Server closed on error, port ${PORT} should be freed`);
-                    });
-                }, 100);
-                reject(error);
+        child_process.exec(`${command} "${authorizationUrl}"`, (error) => {
+            if (error) {
+                log?.error(`❌ Failed to open browser: ${error.message}. Please open manually: ${authorizationUrl}`, { error: error.message, url: authorizationUrl });
             }
         });
-        // Handle server errors (e.g., EADDRINUSE)
-        server.on('error', (error) => {
-            if (error.code === 'EADDRINUSE') {
-                log?.error(`Port ${PORT} is already in use. This should not happen after port check.`);
-                reject(new Error(`Port ${PORT} is already in use. Please try again or specify a different port.`));
-            }
-            else {
-                log?.error(`Server error: ${error.message}`);
-                reject(error);
-            }
+        return;
+    }
+    if (browserApp)
+        await open(authorizationUrl, { app: { name: browserApp } });
+    else
+        await open(authorizationUrl);
+}
+/**
+ * Interactive browser login for the UAA authorization-code flow.
+ *
+ * The callback socket is owned by `withBrowserCallbackServer`: it is released
+ * when the scope ends, whatever ends it, and before the code is exchanged — so
+ * a slow UAA cannot hold the port, and a settled promise always means the port
+ * is free.
+ */
+async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3001, timeoutMs = 30 * 1000) {
+    const log = logger || null;
+    // Essential, user-facing prompts (the auth URL, paste instructions) must be
+    // visible even when no logger is supplied. Fall back to stderr — never stdout,
+    // so stdio-based RPC transports (MCP/LSP) are not corrupted.
+    const announce = (msg) => {
+        if (log)
+            log.info(msg);
+        else
+            process.stderr.write(`${msg}\n`);
+    };
+    // Pre-check kept for its message: AuthBroker matches /already in use/i to
+    // distinguish a busy port from other failures.
+    const portAvailable = await isPortAvailable(port);
+    if (!portAvailable) {
+        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
+    }
+    let stdinReader = null;
+    const code = await (0, callbackServer_1.withBrowserCallbackServer)({ port, timeoutMs }, async (server) => {
+        const authorizationUrl = authConfig.authorizationUrl ??
+            getJwtAuthorizationUrl(authConfig, server.port);
+        log?.info(`[browserAuth] Authorization URL: ${authorizationUrl}`);
+        log?.info(`[browserAuth] Server listening on port: ${server.port}`);
+        const waiting = server.waitForResult();
+        // Not awaited: a launcher that hangs must not delay the timeout or the
+        // release, and one that fails ends the scope through `fail`.
+        void launchBrowser(authorizationUrl, browser, server.port, announce, log).catch((error) => {
+            const message = error instanceof Error ? error.message : String(error);
+            log?.error(`❌ Failed to open browser: ${message}. Please open manually: ${authorizationUrl}`, { error: message, url: authorizationUrl });
+            server.fail(new Error(`Browser opening failed for destination authentication. Please open manually: ${authorizationUrl}`));
         });
-        serverInstance = server.listen(PORT, async () => {
-            log?.info(`[browserAuth] Server started on port ${PORT}`);
-            const browserApp = BROWSER_MAP[browser];
-            // Handle 'none' and 'headless' modes - log URL and wait for callback
-            // (for SSH/remote sessions or when browser should not be opened)
-            if (browser === 'none' || browser === 'headless') {
-                log?.info(`🔗 Open this URL in your browser to authenticate:`);
-                log?.info(`   ${authorizationUrl}`);
-                log?.info(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
-                // Don't open browser, don't reject - just wait for the callback
-                return;
-            }
-            // Handle 'auto' mode - try to open browser, fallback to showing URL
-            if (browser === 'auto') {
-                log?.info('🌐 Attempting to open browser for authentication...');
-                try {
-                    const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-                    const open = openModule.default;
-                    await open(authorizationUrl);
-                    log?.info('✅ Browser opened successfully. Waiting for authentication...');
-                    return;
-                }
-                catch (error) {
-                    // If browser cannot be opened, show URL and wait
-                    const errorMessage = error instanceof Error ? error.message : String(error);
-                    log?.warn(`⚠️  Could not open browser automatically: ${errorMessage}`);
-                    log?.info(`🔗 Please open this URL in your browser to authenticate:`);
-                    log?.info(`   ${authorizationUrl}`);
-                    log?.info(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
-                    // Don't reject - wait for callback
+        // Manual stdin paste — only when attached to an interactive terminal.
+        // Under a stdio RPC transport stdin carries the protocol, so we must never
+        // consume it; isTTY guards that. A pasted line is handed to the same
+        // `/submit` route the paste form uses, so there is one way in, not two.
+        if ((browser === 'none' || browser === 'headless') &&
+            process.stdin.isTTY) {
+            stdinReader = readline.createInterface({ input: process.stdin });
+            stdinReader.on('line', (line) => {
+                const pasted = extractCode(line);
+                if (!pasted) {
+                    process.stderr.write('Could not read an authorization code from that input. Try again.\n');
                     return;
                 }
-            }
-            // Handle browser opening (system, chrome, edge, firefox)
-            if (browser && browserApp !== null) {
-                log?.debug('🌐 Opening browser for authentication...');
-                // On Linux, ensure DISPLAY is set for X11 applications
-                // This helps when running from terminals that don't set DISPLAY automatically
-                if (process.platform === 'linux' &&
-                    !process.env.DISPLAY &&
-                    !process.env.WAYLAND_DISPLAY) {
-                    process.env.DISPLAY = ':0';
-                    log?.debug('DISPLAY not set, using fallback DISPLAY=:0');
-                }
-                try {
-                    // Try dynamic import first (for ES modules)
-                    let open;
-                    try {
-                        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-                        open = openModule.default;
-                    }
-                    catch (_importError) {
-                        // Fallback: use child_process to open browser if import fails
-                        // This works in both CommonJS and ES module environments (like Jest)
-                        const platform = process.platform;
-                        let command;
-                        if (browserApp === 'chrome') {
-                            command =
-                                platform === 'win32'
-                                    ? 'cmd /c start "" "chrome"'
-                                    : platform === 'darwin'
-                                        ? 'open -a "Google Chrome"'
-                                        : 'google-chrome || google-chrome-stable || chromium || chromium-browser';
-                        }
-                        else if (browserApp === 'edge') {
-                            command =
-                                platform === 'win32'
-                                    ? 'cmd /c start "" "msedge"'
-                                    : platform === 'darwin'
-                                        ? 'open -a "Microsoft Edge"'
-                                        : 'microsoft-edge || microsoft-edge-stable';
-                        }
-                        else if (browserApp === 'firefox') {
-                            command =
-                                platform === 'win32'
-                                    ? 'cmd /c start "" "firefox"'
-                                    : platform === 'darwin'
-                                        ? 'open -a Firefox'
-                                        : 'firefox || firefox-esr';
-                        }
-                        else {
-                            // System default
-                            command =
-                                platform === 'win32'
-                                    ? 'cmd /c start ""'
-                                    : platform === 'darwin'
-                                        ? 'open'
-                                        : 'xdg-open';
-                        }
-                        // Use child_process as fallback (non-blocking)
-                        child_process.exec(`${command} "${authorizationUrl}"`, (error) => {
-                            if (error) {
-                                log?.error(`❌ Failed to open browser: ${error.message}. Please open manually: ${authorizationUrl}`, { error: error.message, url: authorizationUrl });
-                            }
-                        });
-                        return; // Exit early since we're using child_process (non-blocking)
-                    }
-                    // Use open module if import succeeded
-                    if (browserApp) {
-                        await open(authorizationUrl, { app: { name: browserApp } });
-                    }
-                    else {
-                        await open(authorizationUrl);
-                    }
-                }
-                catch (error) {
-                    // If browser cannot be opened, close server and show URL
-                    if (typeof server.closeAllConnections === 'function') {
-                        server.closeAllConnections();
-                    }
-                    // Use setTimeout to ensure connections are closed before server.close()
-                    setTimeout(() => {
-                        server.close(() => {
-                            // Server closed on browser open error - port should be freed
-                            log?.debug(`Server closed on browser open error, port ${PORT} should be freed`);
-                        });
-                    }, 100);
-                    const errorMessage = error instanceof Error ? error.message : String(error);
-                    log?.error(`❌ Failed to open browser: ${errorMessage}. Please open manually: ${authorizationUrl}`, { error: errorMessage, url: authorizationUrl });
-                    log?.info(`🔗 Open in browser: ${authorizationUrl}`, {
-                        url: authorizationUrl,
-                    });
-                    // Throw error so consumer can distinguish this from "service key missing" error
-                    reject(new Error(`Browser opening failed for destination authentication. Please open manually: ${authorizationUrl}`));
-                }
-            }
-        });
-        // Timeout after 30 seconds to prevent blocking consumer
-        timeoutId = setTimeout(() => {
-            if (serverInstance) {
-                if (typeof server.closeAllConnections === 'function') {
-                    server.closeAllConnections();
-                }
-                // Use setTimeout to ensure connections are closed before server.close()
-                setTimeout(() => {
-                    server.close(() => {
-                        // Server closed on timeout - port should be freed
-                        log?.debug(`Server closed on timeout, port ${PORT} should be freed`);
-                    });
-                }, 100);
-                reject(new Error('Authentication timeout after 30 seconds. Please try again.'));
-            }
-        }, 30 * 1000);
+                const req = http.get({
+                    host: '127.0.0.1',
+                    port: server.port,
+                    path: `/submit?input=${encodeURIComponent(pasted)}`,
+                    agent: false,
+                });
+                req.on('error', () => undefined);
+            });
+        }
+        return await waiting;
+    }).finally(() => {
+        stdinReader?.close();
+        stdinReader = null;
     });
+    log?.info('[browserAuth] Exchanging code for token...');
+    return await exchangeCodeForToken(authConfig, code, port, log);
 }