pipeline-moe 0.1.3 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipeline-moe",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Local-first multi-agent chat room — N stateful pi agent sessions over a shared workspace, with terminal and web clients.",
   "license": "MIT",

package/src/server.ts

@@ -717,6 +717,15 @@ async function main(): Promise<void> {
     }
   })
 
+  // Pending manual inputs for in-flight OAuth flows (pasted redirect URL or
+  // authorization code), keyed by provider. Resolved by the /login/input route,
+  // rejected by DELETE /login (cancel) — rejecting is what makes pi's flow
+  // abort and release the localhost callback port instead of waiting forever.
+  const pendingOAuthInputs = new Map<
+    string,
+    { resolve: (value: string) => void; reject: (err: Error) => void }
+  >()
+
   // Start OAuth login flow for a provider (device-code or auth URL).
   app.post("/api/providers/:name/login", async (req, res) => {
     const name = req.params.name
@@ -731,9 +740,22 @@ async function main(): Promise<void> {
       return
     }
 
+    // Retrying while a previous flow for this provider is still waiting would
+    // collide on pi's fixed callback port (EADDRINUSE) — abort the old flow
+    // first so a retry always gets a fresh start.
+    const stale = pendingOAuthInputs.get(name)
+    if (stale) {
+      pendingOAuthInputs.delete(name)
+      stale.reject(new Error("Login restarted"))
+      await new Promise((r) => setTimeout(r, 100)) // let the old flow release the port
+    }
+
     // Start the login flow in the background — communicate progress via SSE.
     // Return 202 immediately so the client can wait for SSE events.
     const providerName = name // capture for closure
+    // Identity of THIS attempt's pending entry: the finally below must only
+    // clear the map when the entry is still ours, never a newer attempt's.
+    let myEntry: { resolve: (value: string) => void; reject: (err: Error) => void } | undefined
     setImmediate(async () => {
       try {
         await resolved.authStorage.login(name, {
@@ -760,14 +782,28 @@ async function main(): Promise<void> {
               message,
             })
           },
+          // Manual completion path: providers like Anthropic race a localhost
+          // callback server against a pasted redirect URL. Without this
+          // callback the flow waits on the callback forever when the browser
+          // is on another machine. The promise resolves when a client POSTs
+          // /login/input; cleanup happens in the outer finally.
+          onManualCodeInput: () =>
+            new Promise<string>((resolve, reject) => {
+              myEntry = { resolve, reject }
+              pendingOAuthInputs.set(providerName, myEntry)
+            }),
           onPrompt: async (prompt) => {
-            // For headless: reject prompts that require user input
+            // Ask the clients for input over SSE and wait for /login/input.
             hub.broadcast("oauth_progress", {
               provider: providerName,
-              type: "error",
-              message: `OAuth requires interactive prompt: "${prompt.message}" — use the pi CLI for this provider.`,
+              type: "prompt",
+              message: prompt.message,
+              placeholder: (prompt as { placeholder?: string }).placeholder,
+            })
+            return new Promise<string>((resolve, reject) => {
+              myEntry = { resolve, reject }
+              pendingOAuthInputs.set(providerName, myEntry)
             })
-            throw new Error("interactive prompt not supported in headless mode")
           },
           onSelect: async () => {
             hub.broadcast("oauth_progress", {
@@ -797,12 +833,49 @@ async function main(): Promise<void> {
           type: "error",
           message: msg,
         })
+      } finally {
+        if (myEntry && pendingOAuthInputs.get(providerName) === myEntry) {
+          pendingOAuthInputs.delete(providerName)
+        }
       }
     })
 
     res.status(202).json({ accepted: true, provider: name })
   })
 
+  // Feed manual input (pasted redirect URL / authorization code) into an
+  // in-flight OAuth login for this provider.
+  app.post("/api/providers/:name/login/input", (req, res) => {
+    const name = req.params.name
+    const resolveInput = pendingOAuthInputs.get(name)
+    if (!resolveInput) {
+      res.status(404).json({ error: `no OAuth flow waiting for input for "${name}"` })
+      return
+    }
+    const value = String((req.body as { value?: unknown } | undefined)?.value ?? "").trim()
+    if (!value) {
+      res.status(400).json({ error: "value is required" })
+      return
+    }
+    pendingOAuthInputs.delete(name)
+    resolveInput.resolve(value)
+    res.json({ ok: true })
+  })
+
+  // Cancel an in-flight OAuth login: rejecting the pending input makes pi's
+  // flow abort and release its localhost callback port.
+  app.delete("/api/providers/:name/login", (req, res) => {
+    const name = req.params.name
+    const pending = pendingOAuthInputs.get(name)
+    if (!pending) {
+      res.status(404).json({ error: `no OAuth flow in flight for "${name}"` })
+      return
+    }
+    pendingOAuthInputs.delete(name)
+    pending.reject(new Error("Login cancelled"))
+    res.json({ ok: true })
+  })
+
   // Remove credentials for a provider.
   app.delete("/api/providers/:name", async (req, res) => {
     const name = req.params.name