()
| 271 | }; |
| 272 | |
| 273 | const poll = async () => { |
| 274 | if (settled) return; |
| 275 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: fetch can reject for transient network errors during polling |
| 276 | try { |
| 277 | // The await poll is now gated like the rest of /api — carry the bearer |
| 278 | // (standalone web). On desktop the connection has no client-side auth and |
| 279 | // the main process injects the header instead. |
| 280 | const authorization = getExecutorServerAuthorizationHeader(); |
| 281 | const response = await fetch(`/api/oauth/await/${encodeURIComponent(input.sessionId)}`, { |
| 282 | signal: controller.signal, |
| 283 | cache: "no-store", |
| 284 | ...(authorization ? { headers: { authorization } } : {}), |
| 285 | }); |
| 286 | if (!response.ok) return; |
| 287 | const body = (await response.json()) as unknown; |
| 288 | if (body === null || settled) return; |
| 289 | if (!isOAuthPopupResult<TAuth>(body)) return; |
| 290 | settle(); |
| 291 | input.onResult(body); |
| 292 | } catch { |
| 293 | // Transient — next tick will retry. AbortError after settle is also caught here. |
| 294 | } |
| 295 | }; |
| 296 | |
| 297 | void (async () => { |
| 298 | // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: openExternal is host-provided IPC, no Effect runtime in this browser-only helper |
no test coverage detected