@wirecat/cli-core 0.541.0 → 0.542.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ shape of this file.
 
 ## Unreleased
 
+## 0.542.0 — 02.11.2026
+
+### Added
+
+- **`redirect: { kind: "loopback", host: "localhost" }` signs in through `http://localhost:<port>/callback`.** Microsoft
+  Entra ignores the port only for `localhost` redirect URIs, so a public-client app registered as
+  `http://localhost/callback` needs it. The listener then takes `127.0.0.1` and, when the host has IPv6, `::1`, because
+  the browser may resolve `localhost` to either. Without `host` nothing changes: Google and the rest keep `127.0.0.1`.
+
 ## 0.541.0 — 02.11.2026
 
 ### Added

package/dist/oauth/authorize.js

@@ -46,7 +46,7 @@ export const authorize = async (options) => {
         else
             fail(new CliError("authentication_error", `${provider.name} sign-in was declined`, { reason: "oauth.declined" }));
     };
-    const server = createServer((request, response) => {
+    const handler = (request, response) => {
         let url;
         try {
             url = new URL(request.url ?? "/", "http://127.0.0.1");
@@ -69,7 +69,11 @@ export const authorize = async (options) => {
         }
         response.end("Sign-in received; you can close this tab");
         settle(url.searchParams);
-    });
+    };
+    const server = createServer(handler);
+    const localhost = provider.redirect.kind === "loopback" && provider.redirect.host === "localhost";
+    // `localhost` may resolve to ::1 in the browser; the IPv6 listener is best effort, as some hosts have no IPv6.
+    const server6 = localhost ? createServer(handler) : undefined;
     const onAbort = () => fail(cancelled());
     options.signal?.addEventListener("abort", onAbort, { once: true });
     const timer = setTimeout(() => fail(new CliError("timeout", `${provider.name} sign-in timed out`, { reason: "oauth.timeout" })), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
@@ -81,10 +85,19 @@ export const authorize = async (options) => {
         const address = server.address();
         if (!address || typeof address === "string")
             throw new CliError("configuration_error", "could not start the local sign-in listener");
+        if (server6) {
+            server6.on("error", () => { });
+            await new Promise((resolve) => {
+                server6.once("error", () => resolve());
+                server6.listen(address.port, "::1", () => resolve());
+            });
+        }
         const random = randomBytes(32).toString("base64url");
         const relay = provider.redirect.kind === "relay";
         state = relay ? `${address.port}.${random}` : random;
-        const redirectUri = provider.redirect.kind === "relay" ? provider.redirect.url : `http://127.0.0.1:${address.port}/callback`;
+        const redirectUri = provider.redirect.kind === "relay"
+            ? provider.redirect.url
+            : `http://${localhost ? "localhost" : "127.0.0.1"}:${address.port}/callback`;
         const url = new URL(provider.authorizeUrl);
         for (const [key, value] of Object.entries({
             ...provider.authorizeParams,
@@ -124,7 +137,10 @@ export const authorize = async (options) => {
         clearTimeout(timer);
         options.signal?.removeEventListener("abort", onAbort);
         paste.abort();
-        server.closeAllConnections();
-        await new Promise((resolve) => server.close(() => resolve()));
+        for (const each of server6 ? [server, server6] : [server]) {
+            each.closeAllConnections();
+            if (each.listening)
+                await new Promise((resolve) => each.close(() => resolve()));
+        }
     }
 };

package/dist/oauth/provider.d.ts

@@ -39,11 +39,13 @@ export interface OAuthProvider {
     revokeUrl?: string;
     client: OAuthClient;
     /**
-     * `loopback` sends the browser to `http://127.0.0.1:<port>/callback`. `relay` sends it to a fixed page that
+     * `loopback` sends the browser to `http://127.0.0.1:<port>/callback`, or to `http://localhost:<port>/callback` with
+     * `host: "localhost"` (the listener then takes `127.0.0.1` and `::1`). `relay` sends it to a fixed page that
      * forwards to the loopback port, which it reads from `state` (`<port>.<random>`).
      */
     redirect: {
         kind: "loopback";
+        host?: "localhost";
     } | {
         kind: "relay";
         url: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.541.0",
+  "version": "0.542.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",