webcrawl 1.3.5 → 1.3.6

package/dist/cli.d.ts

@@ -10,6 +10,8 @@ export interface Deps {
     fetch?: typeof fetch;
     /** Config file path override (tests). */
     configFile?: string;
+    /** Browser opener override (tests). */
+    openUrl?: (url: string) => void;
     /** Home directory override for `webcrawl setup` tests. */
     homeDir?: string;
     /** Working directory override for `webcrawl setup` tests. */

package/dist/cli.js

@@ -112,7 +112,7 @@ function openBrowserUrl(url) {
         // ignore
     }
 }
-async function runWebOAuthLogin(baseUrl, fetchImpl, io) {
+async function runWebOAuthLogin(baseUrl, fetchImpl, io, openUrl = openBrowserUrl) {
     const verifier = crypto.randomBytes(32).toString("base64url");
     const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
     const state = crypto.randomBytes(16).toString("base64url");
@@ -153,7 +153,8 @@ async function runWebOAuthLogin(baseUrl, fetchImpl, io) {
                     "",
                     "Waiting for browser authorization...",
                 ].join("\n") + "\n");
-                openBrowserUrl(authUrl);
+                openUrl(authUrl);
+                let handled = false;
                 server.on("request", async (req, res) => {
                     try {
                         const u = new URL(req.url || "/", redirectUri);
@@ -163,14 +164,29 @@ async function runWebOAuthLogin(baseUrl, fetchImpl, io) {
                         }
                         const code = u.searchParams.get("code");
                         const returnedState = u.searchParams.get("state");
-                        if (!code || returnedState !== state) {
+                        if (handled) {
+                            // Browser retry / prefetch of the same callback: the code is single-use, so never exchange it twice.
+                            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                            res.end("<h3>Already received. You can close this tab and return to your terminal.</h3>");
+                            return;
+                        }
+                        const oauthError = u.searchParams.get("error");
+                        if (oauthError && returnedState === state) {
+                            handled = true;
                             res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-                            res.end("<h3>Authorization failed or state mismatch. You can close this tab.</h3>");
+                            res.end("<h3>Authorization was cancelled. You can close this tab.</h3>");
                             clearTimeout(timeout);
                             server.close();
-                            reject(new Error("OAuth callback missing code or state mismatch."));
+                            reject(new Error(`OAuth authorization failed: ${oauthError}.`));
+                            return;
+                        }
+                        if (!code || returnedState !== state) {
+                            // Stray or forged request: reject it but keep waiting for the real callback.
+                            res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                            res.end("<h3>Authorization failed or state mismatch.</h3>");
                             return;
                         }
+                        handled = true;
                         const tokenRes = await fetchImpl(`${baseUrl}/oauth/token`, {
                             method: "POST",
                             headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
@@ -183,7 +199,11 @@ async function runWebOAuthLogin(baseUrl, fetchImpl, io) {
                             }).toString(),
                         });
                         if (!tokenRes.ok) {
-                            throw new Error(`OAuth token exchange failed (HTTP ${tokenRes.status}).`);
+                            const detail = (await tokenRes.json().catch(() => ({})));
+                            const reason = detail.error_description || detail.error;
+                            res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                            res.end("<h3>Webcrawl sign-in failed. Return to your terminal for details.</h3>");
+                            throw new Error(`OAuth token exchange failed (HTTP ${tokenRes.status}${reason ? `: ${reason}` : ""}). Run \`webcrawl login\` again, or use \`webcrawl login --email <you@domain.com>\`.`);
                         }
                         const tokenData = (await tokenRes.json());
                         let finalKey = tokenData.access_token;
@@ -449,7 +469,7 @@ export async function main(argv, io, deps = {}) {
                 });
                 // 1. Browser OAuth PKCE redirect (default for `webcrawl login`; `--web` kept for compatibility)
                 if (v.web || (!v.email && !v.key)) {
-                    const webRes = await runWebOAuthLogin(cfg.baseUrl, deps.fetch ?? globalThis.fetch, io);
+                    const webRes = await runWebOAuthLogin(cfg.baseUrl, deps.fetch ?? globalThis.fetch, io, deps.openUrl);
                     const existing = readConfigFile(file);
                     writeConfigFile({ ...existing, apiKey: webRes.apiKey, ...(v.url ? { baseUrl: v.url } : {}) }, file);
                     const payload = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcrawl",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "Webcrawl Anything CLI & Core Engine — crawl, search, and extract structured evidence from any website, SPA, PDF, Office file, YouTube video, GitHub repo, ArXiv paper, or CVE",
   "type": "module",
   "license": "MIT",
@@ -127,8 +127,8 @@
     "@ai-sdk/gateway": "^4.0.123",
     "@firecrawl/pdf-inspector": "^1.25.2",
     "@vercel/sandbox": "^1.0.0",
-    "@webcrawl/client": "^1.3.5",
-    "@webcrawl/curl-impersonate": "^1.3.5",
+    "@webcrawl/client": "^1.3.6",
+    "@webcrawl/curl-impersonate": "^1.3.6",
     "ai": "^7.0.150",
     "impit": "^0.14.7",
     "mammoth": "^1.13.0",