fix(cloud): tolerate stray CLI login callbacks (#1009)

* fix(cloud): tolerate stray CLI login callbacks

* style: auto-format with Prettier

* fix(cloud): tolerate stray CLI login callbacks

* style: auto-format with Prettier

---------

Co-authored-by: Proactive Runtime Bot <agent@agent-relay.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -50,6 +50,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- `@agent-relay/cloud`: CLI browser login ignores stray localhost callbacks with an invalid state parameter, so first-time sign-ins are not shown a false hosted error or aborted before the real OAuth callback returns.
 - `agent-relay-broker` harness configs now report harness PIDs instead of wrapper worker PIDs, validate app-server protocol/auth/host settings at spawn, and give app-server release requests time to finish.
 - `@agent-relay/sdk` normalizes broker `pid: null` spawn responses to `undefined` while PTY harness PIDs are reported asynchronously.
 - `web`: PR preview SST deploys use and comment the generated CloudFront URL and AWS's managed disabled cache policy instead of creating per-preview Cloudflare DNS records, ACM certificates, and custom CloudFront cache policies.

packages/cloud/src/auth.test.ts

@@ -7,11 +7,21 @@ const fsMocks = vi.hoisted(() => ({
   rm: vi.fn(),
 }));
 
+const childProcessMocks = vi.hoisted(() => ({
+  spawn: vi.fn(() => ({
+    unref: vi.fn(),
+  })),
+}));
+
 vi.mock('node:fs/promises', () => ({
   default: fsMocks,
   ...fsMocks,
 }));
 
+vi.mock('node:child_process', () => ({
+  spawn: childProcessMocks.spawn,
+}));
+
 import { ensureAuthenticated, readStoredAuth, refreshStoredAuth } from './auth.js';
 import type { StoredAuth } from './types.js';
 
@@ -52,6 +62,7 @@ beforeEach(() => {
   fsMocks.mkdir.mockResolvedValue(undefined);
   fsMocks.rm.mockReset();
   fsMocks.rm.mockResolvedValue(undefined);
+  childProcessMocks.spawn.mockClear();
 });
 
 describe('readStoredAuth', () => {
@@ -180,6 +191,57 @@ describe('ensureAuthenticated', () => {
     const calledUrl = String(fetchSpy.mock.calls[0][0]);
     expect(calledUrl).toContain('origin.example');
   });
+
+  it('keeps waiting after a stray local callback with an invalid state', async () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => undefined);
+    const authPromise = ensureAuthenticated('https://example.com/cloud', { force: true });
+
+    await vi.waitFor(() => {
+      expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Opening browser for cloud login: '));
+    });
+
+    const loginLine = logSpy.mock.calls
+      .map((call) => String(call[0]))
+      .find((line) => line.startsWith('Opening browser for cloud login: '));
+    expect(loginLine).toBeTruthy();
+
+    const loginUrl = new URL(String(loginLine).slice('Opening browser for cloud login: '.length));
+    const callbackUrl = new URL(String(loginUrl.searchParams.get('redirect_uri')));
+    const state = loginUrl.searchParams.get('state');
+    expect(state).toBeTruthy();
+
+    const strayResponse = await fetch(callbackUrl, { redirect: 'manual' });
+    expect(strayResponse.status).toBe(400);
+    await expect(strayResponse.text()).resolves.toContain('Ignored invalid CLI login callback');
+
+    const stillWaiting = await Promise.race([
+      authPromise.then(
+        () => 'resolved',
+        () => 'rejected'
+      ),
+      new Promise<'pending'>((resolve) => setTimeout(() => resolve('pending'), 25)),
+    ]);
+    expect(stillWaiting).toBe('pending');
+
+    callbackUrl.searchParams.set('state', String(state));
+    callbackUrl.searchParams.set('access_token', 'access-token');
+    callbackUrl.searchParams.set('refresh_token', 'refresh-token');
+    callbackUrl.searchParams.set('access_token_expires_at', '2999-01-01T00:00:00.000Z');
+    callbackUrl.searchParams.set('api_url', 'https://example.com/cloud');
+
+    const successResponse = await fetch(callbackUrl, { redirect: 'manual' });
+    expect(successResponse.status).toBe(302);
+
+    await expect(authPromise).resolves.toEqual({
+      apiUrl: 'https://example.com/cloud',
+      accessToken: 'access-token',
+      refreshToken: 'refresh-token',
+      accessTokenExpiresAt: '2999-01-01T00:00:00.000Z',
+    });
+    expect(fsMocks.writeFile).toHaveBeenCalledOnce();
+
+    logSpy.mockRestore();
+  });
 });
 
 describe('refreshStoredAuth', () => {

packages/cloud/src/auth.ts

@@ -161,15 +161,9 @@ async function beginBrowserLogin(apiUrl: string): Promise<StoredAuth> {
       // Validate state parameter first (CSRF protection) — this check
       // must run unconditionally, before any user-controlled values.
       if (returnedState !== state) {
-        redirectToHostedCliAuthPage(response, apiUrl, {
-          status: 'error',
-          detail: 'Invalid state parameter',
-        });
-        if (!settled) {
-          settled = true;
-          server.close();
-          reject(new Error('Invalid state parameter in CLI login callback'));
-        }
+        response.statusCode = 400;
+        response.setHeader('content-type', 'text/plain; charset=utf-8');
+        response.end('Ignored invalid CLI login callback. Return to your terminal to continue login.');
         return;
       }