Function startLoopbackServer

src/node/utils/oauthLoopbackServer.ts:128–294

(options: LoopbackServerOptions)

 * after token exchange).
 */
export async function startLoopbackServer(options: LoopbackServerOptions): Promise<LoopbackServer> {
  const port = options.port ?? 0;
  const host = options.host ?? "127.0.0.1";
  // `server.listen()` expects IPv6 hosts without brackets, but callers may pass
  // "[::1]" since that's what URLs require.
  const listenHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
  const callbackPath = options.callbackPath ?? "/callback";
  const validateLoopback = options.validateLoopback ?? false;
  const deferSuccessResponse = options.deferSuccessResponse ?? false;

  const deferred = createDeferred<Result<LoopbackCallbackResult, string>>();
  let deferredSuccessResponse: http.ServerResponse | null = null;

  const render =
    options.renderHtml ??
    ((r: { success: boolean; error?: string }) =>
      renderOAuthCallbackHtml({
        title: r.success ? "Login complete" : "Login failed",
        message: r.success
          ? "You can return to Mux. You may now close this tab."
          : (r.error ?? "Unknown error"),
        success: r.success,
      }));

  const clearDeferredSuccessResponse = (response: http.ServerResponse) => {
    if (deferredSuccessResponse === response) {
      deferredSuccessResponse = null;
    }
  };

  const sendDeferredResponse = (result: { success: boolean; error?: string }) => {
    const pendingResponse = deferredSuccessResponse;
    if (!pendingResponse || pendingResponse.writableEnded || pendingResponse.destroyed) {
      deferredSuccessResponse = null;
      return;
    }

    deferredSuccessResponse = null;
    pendingResponse.statusCode = result.success ? 200 : 400;
    pendingResponse.setHeader("Content-Type", "text/html");
    pendingResponse.end(render(result));
  };

  const sendSuccessResponse = () => {
    sendDeferredResponse({ success: true });
  };

  const sendFailureResponse = (error: string) => {
    sendDeferredResponse({ success: false, error });
  };

  const sendCancelledResponseIfPending = () => {
    sendFailureResponse("OAuth flow cancelled");
  };

  const server = http.createServer((req, res) => {
    // Optionally reject non-loopback connections (Codex sets validateLoopback: true).
    if (validateLoopback && !isLoopbackAddress(req.socket.remoteAddress)) {