chainlesschain 0.162.122 → 0.162.124

package/src/lib/git-integration.js

@@ -2,7 +2,7 @@
  * Git integration — wraps system git commands for knowledge base versioning.
  */
 
-import { execSync } from "child_process";
+import { execSync, spawnSync } from "child_process";
 import { existsSync, writeFileSync, chmodSync } from "fs";
 import { join } from "path";
 
@@ -41,6 +41,62 @@ export function assertSafeGitRef(ref, label = "git ref") {
   }
 }
 
+/**
+ * Validate a repo-relative file path before it is interpolated into a shell git
+ * command (e.g. `diff … -- "${filePath}"`). Double-quoting does NOT neutralize
+ * `$()` / backticks / a closing `"`, so an unsanitized path from a WS frame is a
+ * shell-injection vector. Allow only ordinary path characters (no shell
+ * metacharacters), reject absolute paths, a leading `-` (flag injection), and
+ * `..` (traversal). Exported for reuse + tests.
+ *
+ * @param {string} p
+ * @param {string} [label="file path"]
+ */
+export function assertSafeGitPath(p, label = "file path") {
+  if (typeof p !== "string" || p.length === 0) {
+    throw new Error(`Invalid ${label}: expected a non-empty string`);
+  }
+  if (
+    !/^[A-Za-z0-9._/+@=, -]+$/.test(p) || // safe path chars only — no shell metachars
+    p.startsWith("-") || // no flag injection (e.g. `-- --output=…`)
+    p.startsWith("/") || // no absolute path (posix)
+    /^[A-Za-z]:/.test(p) || // no absolute path (windows drive)
+    p.includes("..") // no traversal / range tricks
+  ) {
+    throw new Error(`Unsafe ${label}: ${JSON.stringify(p)}`);
+  }
+}
+
+/**
+ * Run git with an ARGV array (no shell) — for commands that carry free-text the
+ * caller can't allowlist (a commit / merge message). spawnSync passes each arg
+ * verbatim, so `$()`, backticks, quotes, and `;` in the message are inert
+ * instead of being interpreted by a shell as they would be through `gitExec`.
+ * Throws git's stderr on failure, mirroring `gitExec`'s contract.
+ *
+ * @param {string[]} args
+ * @param {string} cwd
+ * @param {object} [opts] { input }
+ * @returns {string} trimmed stdout
+ */
+export function gitExecArgs(args, cwd, opts = {}) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf-8",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024,
+    input: opts.input,
+  });
+  if (res.error) throw res.error;
+  if (res.status !== 0) {
+    const stderr = (res.stderr || res.stdout || "").toString().trim();
+    throw new Error(
+      stderr || `git ${args.join(" ")} failed (exit ${res.status})`,
+    );
+  }
+  return (res.stdout || "").toString().trim();
+}
+
 /**
  * Run a git command and return stdout.
  */

package/src/lib/hook-manager.js

@@ -208,7 +208,7 @@ export function getHook(db, hookId) {
  * Compile a matcher pattern into a test function.
  * Supports:
  *   - null/undefined → matches everything
- *   - Pipe-separated patterns: "Edit|Write" matches "Edit" or "Write"
+ *   - Pipe- OR comma-separated patterns: "Edit|Write" / "Bash,PowerShell"
  *   - Wildcards: "*" matches any chars, "?" matches one char
  *   - Regex strings starting with "/": "/^Pre/" matches "PreIPCCall"
  */
@@ -230,11 +230,20 @@ export function compileMatcher(pattern) {
     }
   }
 
-  // Pipe-separated patterns (e.g. "Edit|Write")
-  if (pattern.includes("|")) {
-    const parts = pattern.split("|").map((p) => p.trim());
-    const matchers = parts.map((p) => compileMatcher(p));
-    return (value) => matchers.some((m) => m(value));
+  // OR-separated alternatives: pipe "Edit|Write" AND comma "Bash,PowerShell"
+  // (Claude-Code 2.1.191: comma-separated matchers silently never fired). Empty
+  // segments (trailing "Bash," / "Edit|") are dropped so they cannot collapse
+  // into a match-everything matcher. Regex "/…/" matchers are handled above, so
+  // a comma inside "{1,3}" is never split here.
+  if (pattern.includes("|") || pattern.includes(",")) {
+    const matchers = pattern
+      .split(/[|,]/)
+      .map((p) => p.trim())
+      .filter(Boolean)
+      .map((p) => compileMatcher(p));
+    return matchers.length
+      ? (value) => matchers.some((m) => m(value))
+      : () => false;
   }
 
   // Wildcard pattern (* and ?)

package/src/lib/hook-runner.cjs

@@ -107,7 +107,17 @@ function tryParseDecision(stdout) {
  *            nonBlockingError?:boolean, error?:string }}
  */
 function runCommandHook(command, input = {}, opts = {}) {
-  const { timeout = 60000, cwd, event } = opts;
+  const { cwd, event } = opts;
+  // spawnSync is SYNCHRONOUS — it blocks the whole agent until the hook returns
+  // or its timeout fires. Node treats a 0/undefined timeout as UNLIMITED, so a
+  // missing, zero, NaN, or negative value (e.g. a malformed settings.json
+  // `timeout`) would let a hung hook freeze the agent forever. Guarantee a
+  // positive, bounded timeout regardless of the caller's value (already in ms).
+  const _rawTimeout = Number(opts.timeout);
+  const timeout =
+    Number.isFinite(_rawTimeout) && _rawTimeout > 0
+      ? Math.min(_rawTimeout, 600000)
+      : 60000;
   if (!command) {
     return { decision: HOOK_DECISIONS.CONTINUE, reason: null, exitCode: 0 };
   }

package/src/lib/interactive-planner.js

@@ -9,6 +9,7 @@
 
 import { EventEmitter } from "events";
 import { createHash } from "crypto";
+import { firstBalancedJson } from "./json-schema-output.js";
 
 /**
  * Plan session statuses
@@ -345,12 +346,12 @@ Keep plans concise (3-8 steps). Use appropriate tools for each step.`;
     ]);
 
     const content = response?.message?.content || response?.content || "";
-    const jsonMatch = content.match(/\{[\s\S]*\}/);
-    if (!jsonMatch) {
+    const jsonText = firstBalancedJson(content, "{");
+    if (!jsonText) {
       throw new Error("Failed to parse plan from LLM response");
     }
 
-    return JSON.parse(jsonMatch[0]);
+    return JSON.parse(jsonText);
   }
 
   /**

package/src/lib/json-schema-output.js

@@ -80,6 +80,48 @@ export function validateAgainstSchema(value, schema, path = "$") {
   return errors;
 }
 
+/**
+ * Return the first *balanced* JSON object/array substring in `text`, honoring
+ * string literals so braces inside strings don't throw off the depth count.
+ *
+ * Unlike a greedy `/\{[\s\S]*\}/` match (which spans to the LAST bracket and
+ * over-captures trailing prose or a second object — making JSON.parse throw),
+ * this stops at the first complete top-level value.
+ *
+ * @param {string} text
+ * @param {"{"|"["} [only] restrict to object- or array-openers when set
+ * @returns {string|null} the balanced substring, or null if none is found
+ */
+export function firstBalancedJson(text, only) {
+  const s = String(text || "");
+  for (let i = 0; i < s.length; i++) {
+    const open = s[i];
+    if (open !== "{" && open !== "[") continue;
+    if (only && open !== only) continue;
+    const close = open === "{" ? "}" : "]";
+    let depth = 0;
+    let inStr = false;
+    let esc = false;
+    for (let j = i; j < s.length; j++) {
+      const c = s[j];
+      if (inStr) {
+        if (esc) esc = false;
+        else if (c === "\\") esc = true;
+        else if (c === '"') inStr = false;
+        continue;
+      }
+      if (c === '"') inStr = true;
+      else if (c === open) depth++;
+      else if (c === close) {
+        depth--;
+        if (depth === 0) return s.slice(i, j + 1);
+      }
+    }
+    // opener at i never closed — try the next opener
+  }
+  return null;
+}
+
 /** Pull a JSON payload out of an LLM reply (bare, fenced, or embedded). */
 export function extractJsonPayload(text) {
   const raw = String(text || "").trim();
@@ -87,6 +129,11 @@ export function extractJsonPayload(text) {
   tries.push(raw);
   const fence = /```(?:json)?\s*([\s\S]*?)```/i.exec(raw);
   if (fence) tries.push(fence[1].trim());
+  // Prefer a balanced run (stops at the first complete value) over the greedy
+  // first-bracket..last-bracket slice below, which over-captures on trailing
+  // prose or a second object.
+  const balanced = firstBalancedJson(raw);
+  if (balanced) tries.push(balanced);
   const firstObj = raw.indexOf("{");
   const lastObj = raw.lastIndexOf("}");
   if (firstObj !== -1 && lastObj > firstObj)

package/src/lib/learning/reflection-engine.js

@@ -12,6 +12,7 @@
  */
 
 import { extractToolNames } from "./skill-synthesizer.js";
+import { firstBalancedJson } from "../json-schema-output.js";
 
 // ── _deps for test injection ────────────────────────
 const _deps = {
@@ -268,9 +269,9 @@ export class ReflectionEngine {
     try {
       const messages = buildReflectionPrompt(reportData);
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-improver.js

@@ -12,6 +12,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -374,9 +375,9 @@ export class SkillImprover {
     if (!this.llmChat) return null;
     try {
       const response = await this.llmChat(messages);
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/learning/skill-synthesizer.js

@@ -17,6 +17,7 @@
  */
 
 import fs from "fs";
+import { firstBalancedJson } from "../json-schema-output.js";
 import path from "path";
 
 // ── _deps for test injection ────────────────────────────
@@ -258,9 +259,9 @@ export class SkillSynthesizer {
 
     try {
       // Try to parse JSON from response
-      const jsonMatch = response.match(/\{[\s\S]*\}/);
-      if (!jsonMatch) return null;
-      return JSON.parse(jsonMatch[0]);
+      const jsonText = firstBalancedJson(response, "{");
+      if (!jsonText) return null;
+      return JSON.parse(jsonText);
     } catch {
       return null;
     }

package/src/lib/mcp-client.js

@@ -15,5 +15,6 @@ export {
   inferTransport,
   isHttpTransport,
   isLikelyConnectionError,
+  isTransientMcpError,
   _deps,
 } from "../harness/mcp-client.js";

package/src/lib/mcp-oauth.js

@@ -36,8 +36,13 @@ export const _deps = {
   createServer: (h) => http.createServer(h),
   openBrowser: defaultOpenBrowser,
   now: () => Date.now(),
+  // Backoff sleep seam (tests override with a no-op so the retry doesn't wait).
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
 };
 
+/** Discovery/token requests retry ONCE after a transient error (CC 2.1.191). */
+const MCP_OAUTH_RETRY_BACKOFF_MS = 300;
+
 const base64url = (buf) =>
   Buffer.from(buf)
     .toString("base64")
@@ -57,6 +62,43 @@ export function randomState(bytes = 16) {
   return base64url(_deps.randomBytes(bytes));
 }
 
+/**
+ * Is `hostname` a loopback address? Plain http is tolerated only for these (a
+ * self-hosted MCP server on the dev box). Handles the bracketed IPv6 form that
+ * `new URL().hostname` yields (e.g. "[::1]") and the whole 127.0.0.0/8 range.
+ */
+export function isLoopbackHost(hostname) {
+  const h = String(hostname || "")
+    .replace(/^\[|\]$/g, "")
+    .toLowerCase();
+  if (h === "localhost") return true;
+  if (h === "::1") return true;
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+
+/**
+ * Require an OAuth endpoint to be HTTPS (or plain http on loopback for local
+ * dev). Authorization codes, PKCE verifiers, client secrets, and bearer/refresh
+ * tokens flow through these endpoints, so a discovered (or stored) endpoint that
+ * downgrades to cleartext http on a remote host must be refused rather than
+ * leaking secrets over the wire (RFC 6749 §3.1.2.1 / RFC 8252). Returns the
+ * endpoint unchanged when allowed; throws otherwise.
+ */
+export function assertSecureEndpoint(endpoint, label = "endpoint") {
+  let u;
+  try {
+    u = new URL(endpoint);
+  } catch {
+    throw new Error(`OAuth ${label} is not a valid URL: ${endpoint}`);
+  }
+  if (u.protocol === "https:") return endpoint;
+  if (u.protocol === "http:" && isLoopbackHost(u.hostname)) return endpoint;
+  throw new Error(
+    `refusing to use insecure OAuth ${label} (${endpoint}); ` +
+      `HTTPS is required for non-loopback endpoints`,
+  );
+}
+
 /** Minimal HTML-escape for values reflected into the callback page. */
 function escapeHtml(s) {
   return String(s).replace(
@@ -103,10 +145,29 @@ export function renderCallbackPage(error) {
   );
 }
 
-async function fetchJson(url, opts) {
-  const res = await _deps.fetch(url, opts);
+async function fetchJson(url, opts, attempt = 0) {
+  let res;
+  try {
+    res = await _deps.fetch(url, opts);
+  } catch (netErr) {
+    // fetch rejected = transient network error → retry once after a short wait
+    // (CC 2.1.191: "discovery and token requests now retry once after transient
+    // network errors").
+    if (attempt < 1) {
+      await _deps.sleep(MCP_OAUTH_RETRY_BACKOFF_MS);
+      return fetchJson(url, opts, attempt + 1);
+    }
+    throw netErr;
+  }
   if (!res || !res.ok) {
     const status = res ? res.status : "no-response";
+    // 5xx is transient → retry once. 4xx is permanent — and discovery probes
+    // 404s on purpose (it falls through to the next metadata URL), so retrying
+    // those would only slow the expected fall-through.
+    if (attempt < 1 && typeof status === "number" && status >= 500) {
+      await _deps.sleep(MCP_OAUTH_RETRY_BACKOFF_MS);
+      return fetchJson(url, opts, attempt + 1);
+    }
     let body = "";
     try {
       body = res ? await res.text() : "";
@@ -185,6 +246,7 @@ export async function registerClient(
       "server has no registration_endpoint and no --client-id was given",
     );
   }
+  assertSecureEndpoint(metadata.registration_endpoint, "registration_endpoint");
   const reg = await fetchJson(metadata.registration_endpoint, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -206,6 +268,10 @@ export function buildAuthorizeUrl(
   metadata,
   { clientId, redirectUri, scope, codeChallenge, state, resource },
 ) {
+  assertSecureEndpoint(
+    metadata.authorization_endpoint,
+    "authorization_endpoint",
+  );
   const u = new URL(metadata.authorization_endpoint);
   u.searchParams.set("response_type", "code");
   u.searchParams.set("client_id", clientId);
@@ -237,6 +303,7 @@ export async function exchangeCodeForToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -263,6 +330,7 @@ export async function refreshAccessToken(
   });
   if (clientSecret) body.set("client_secret", clientSecret);
   if (resource) body.set("resource", resource);
+  assertSecureEndpoint(metadata.token_endpoint, "token_endpoint");
   const tok = await fetchJson(metadata.token_endpoint, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -310,7 +378,10 @@ export function getStoredToken(serverUrl) {
 // readable. writeFileSync's `mode` only applies when the file is created, so
 // also chmod (best-effort) to tighten a file an older version left at 0644.
 function _writeStoreSecure(file, store) {
-  _deps.fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
+  _deps.fs.mkdirSync(pathDefault.dirname(file), {
+    recursive: true,
+    mode: 0o700,
+  });
   const data = JSON.stringify(store, null, 2) + "\n";
   // Atomic temp+rename: the store holds live OAuth tokens, so a crash (or a
   // concurrent `cc mcp login`) mid-write must not truncate it and lose auth for
@@ -326,7 +397,11 @@ function _writeStoreSecure(file, store) {
       _deps.fs.renameSync(tmp, file);
     } catch (err) {
       try {
-        if (_deps.fs.existsSync && _deps.fs.existsSync(tmp) && _deps.fs.unlinkSync)
+        if (
+          _deps.fs.existsSync &&
+          _deps.fs.existsSync(tmp) &&
+          _deps.fs.unlinkSync
+        )
           _deps.fs.unlinkSync(tmp);
       } catch {
         /* best-effort temp cleanup */
@@ -341,26 +416,126 @@ function _writeStoreSecure(file, store) {
   }
 }
 
+/** Bounded synchronous sleep (the store lock is held only for a few file ops). */
+function _sleepSyncMs(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) {
+      /* spin — Atomics.wait unavailable (should not happen on modern Node) */
+    }
+  }
+}
+
+/**
+ * Run `fn` while holding a cross-process advisory lock on the token store.
+ *
+ * saveStoredToken / deleteStoredToken are read-modify-write (load → mutate →
+ * write). Two concurrent `cc mcp login` PROCESSES for different servers would
+ * each load the old store and the second writer would clobber the first's new
+ * entry (lost update) — the atomic temp+rename only prevents a torn file, not a
+ * lost update. An O_EXCL lockfile makes the whole RMW mutually exclusive across
+ * processes, so each writer re-reads the latest store inside the lock.
+ *
+ * Robustness: a stale lock (holder crashed) older than STALE_MS is stolen; if
+ * the lock can't be acquired within MAX_WAIT_MS we proceed anyway (degrading to
+ * the pre-lock last-writer-wins rather than failing the login). When the
+ * injected fs lacks the lock primitives (test fs / exotic fs) we run `fn`
+ * directly — single-process correctness is unchanged, only cross-process mutual
+ * exclusion is lost. Lock timing uses the wall clock (not the `now` test seam).
+ */
+function withStoreLock(file, fn) {
+  const fs = _deps.fs;
+  if (
+    typeof fs.openSync !== "function" ||
+    typeof fs.closeSync !== "function" ||
+    typeof fs.unlinkSync !== "function"
+  ) {
+    return fn(); // no lock primitives → run unlocked (back-compat)
+  }
+  const STALE_MS = 10_000;
+  const MAX_WAIT_MS = 5_000;
+  const lockPath = `${file}.lock`;
+  try {
+    fs.mkdirSync(pathDefault.dirname(file), { recursive: true, mode: 0o700 });
+  } catch {
+    /* dir may already exist — openSync below reports any real problem */
+  }
+  const start = Date.now();
+  let fd = null;
+  for (;;) {
+    try {
+      fd = fs.openSync(lockPath, "wx"); // O_CREAT|O_EXCL — fails if held
+      break;
+    } catch (err) {
+      if (!err || err.code !== "EEXIST") {
+        // Unexpected (e.g. ENOENT/EACCES): don't fail the login over the lock —
+        // proceed unlocked, same as a missing-primitives fs.
+        return fn();
+      }
+      let stale = false;
+      try {
+        const st = fs.statSync(lockPath);
+        const mtime = st.mtimeMs != null ? st.mtimeMs : 0;
+        stale = Date.now() - mtime > STALE_MS;
+      } catch {
+        /* lock vanished between open and stat → retry immediately */
+      }
+      if (stale) {
+        try {
+          fs.unlinkSync(lockPath); // steal a lock from a crashed holder
+        } catch {
+          /* someone else stole it first — retry */
+        }
+        continue;
+      }
+      if (Date.now() - start > MAX_WAIT_MS) break; // give up waiting; proceed
+      _sleepSyncMs(50);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        /* ignore */
+      }
+      try {
+        fs.unlinkSync(lockPath);
+      } catch {
+        /* ignore — a stale-steal by another process may have removed it */
+      }
+    }
+  }
+}
+
 export function saveStoredToken(serverUrl, record) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
-  _writeStoreSecure(file, store);
-  return store[serverKey(serverUrl)];
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    store[serverKey(serverUrl)] = { server: serverKey(serverUrl), ...record };
+    _writeStoreSecure(file, store);
+    return store[serverKey(serverUrl)];
+  });
 }
 
 export function deleteStoredToken(serverUrl) {
   const file = tokenStorePath();
-  const store = loadTokenStore();
-  const key = serverKey(serverUrl);
-  if (!(key in store)) return false;
-  delete store[key];
-  try {
-    _writeStoreSecure(file, store);
-  } catch {
-    /* best-effort */
-  }
-  return true;
+  return withStoreLock(file, () => {
+    const store = loadTokenStore(); // re-read inside the lock (latest state)
+    const key = serverKey(serverUrl);
+    if (!(key in store)) return false;
+    delete store[key];
+    try {
+      _writeStoreSecure(file, store);
+    } catch {
+      /* best-effort */
+    }
+    return true;
+  });
 }
 
 /** True when a record's access token is missing or within `skewMs` of expiry. */
@@ -409,12 +584,25 @@ function defaultOpenBrowser(url) {
   }
 }
 
-/** Wait for the OAuth redirect on a localhost callback server; resolve {code,state}. */
+/**
+ * Wait for the OAuth redirect on a localhost callback server; resolve
+ * {code,state}.
+ *
+ * When `expectedState` is given, a SUCCESS callback (`code`) is only accepted if
+ * its `state` matches: the callback port is fixed and guessable, so a duplicate
+ * browser request, a probe, or a drive-by request from a malicious local page
+ * must not abort the real login or inject a forged code — those are answered
+ * politely but the server keeps waiting for the genuine redirect (until the
+ * backstop timeout). A provider `error` is always terminal (so denying consent
+ * fails fast even if the provider omits state on error). With no `expectedState`
+ * the legacy contract is preserved (first `/callback` hit is terminal).
+ */
 export function waitForCallback({
   port,
   host = "127.0.0.1",
   path = "/callback",
   timeout = 300_000,
+  expectedState = null,
 }) {
   return new Promise((resolve, reject) => {
     const server = _deps.createServer((req, res) => {
@@ -434,13 +622,41 @@ export function waitForCallback({
       const code = u.searchParams.get("code");
       const state = u.searchParams.get("state");
       const error = u.searchParams.get("error");
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(renderCallbackPage(error));
+
+      // Provider error (e.g. user denied) — always terminal so we fail fast.
+      if (error) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(error));
+        server.close();
+        clearTimeout(timer);
+        reject(new Error(`authorization error: ${error}`));
+        return;
+      }
+
+      const stateOk = expectedState == null || state === expectedState;
+      if (code && stateOk) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage(null));
+        server.close();
+        clearTimeout(timer);
+        resolve({ code, state });
+        return;
+      }
+
+      // A mismatched/forged/duplicate request to our fixed port must not abort
+      // the real login — answer it but keep listening for the genuine redirect.
+      if (expectedState != null) {
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderCallbackPage("state mismatch"));
+        return;
+      }
+
+      // Legacy contract (no expectedState): a /callback hit with no code ends it.
+      res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+      res.end(renderCallbackPage("missing code"));
       server.close();
       clearTimeout(timer);
-      if (error) reject(new Error(`authorization error: ${error}`));
-      else if (!code) reject(new Error("no authorization code in callback"));
-      else resolve({ code, state });
+      reject(new Error("no authorization code in callback"));
     });
     const timer = setTimeout(() => {
       server.close();
@@ -509,6 +725,9 @@ export async function authorizeInteractive(serverUrl, opts = {}) {
     host,
     path: redirectPath,
     timeout,
+    // Ignore callbacks that don't carry the state we issued (forged / drive-by /
+    // duplicate hits to the fixed localhost port) instead of aborting the login.
+    expectedState: state,
   });
   const opened = _deps.openBrowser(authorizeUrl);
   writeOut(