{"record":{"id":"97036e18af6e3fe0","repo":"Kuberwastaken/claurst","slug":"failed-to-bind-port","errorCode":null,"errorMessage":"Failed to bind port {}: {}","messagePattern":"Failed to bind port (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src-rust/crates/cli/src/codex_oauth_flow.rs","lineNumber":84,"sourceCode":"/// launch fails.\r\npub async fn run_oauth_flow(event_tx: mpsc::Sender<DeviceAuthEvent>) -> anyhow::Result<CodexTokens> {\r\n    run_oauth_flow_with_label(event_tx, None).await\r\n}\r\n\r\n/// Same as [`run_oauth_flow`] but lets the caller supply a label for the\r\n/// newly registered profile.\r\npub async fn run_oauth_flow_with_label(\r\n    event_tx: mpsc::Sender<DeviceAuthEvent>,\r\n    label: Option<&str>,\r\n) -> anyhow::Result<CodexTokens> {\r\n    let verifier = generate_code_verifier();\r\n    let challenge = compute_code_challenge(&verifier);\r\n    let state = generate_state();\r\n\r\n    // Bind local server for callback\r\n    let listener = TcpListener::bind(format!(\"127.0.0.1:{}\", CODEX_OAUTH_PORT))\r\n        .await\r\n        .map_err(|e| anyhow!(\"Failed to bind port {}: {}\", CODEX_OAUTH_PORT, e))?;\r\n\r\n    let auth_url = build_auth_url(&challenge, &state);\r\n\r\n    // Send the URL to the TUI so it can display + clipboard-copy it.\r\n    let _ = event_tx.send(DeviceAuthEvent::GotBrowserUrl { url: auth_url.clone() }).await;\r\n\r\n    // Also try to open the browser (best-effort; may silently fail in headless envs).\r\n    let _ = open::that(&auth_url);\r\n\r\n    // Wait for OAuth callback\r\n    let (code, callback_state) = wait_for_callback(listener).await?;\r\n\r\n    if callback_state != state {\r\n        bail!(\"OAuth state mismatch — possible CSRF attack\");\r\n    }\r\n\r\n    // Exchange code for tokens\r\n    let tokens = exchange_code_for_tokens(&code, &verifier).await?;\r","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/cli/src/codex_oauth_flow.rs#L66-L102","documentation":"The Codex OAuth flow binds a local TCP listener on 127.0.0.1:CODEX_OAUTH_PORT to receive the browser callback. If the OS refuses the bind, the flow cannot receive the authorization code and fails with this error wrapping the underlying io::Error (e.g. EADDRINUSE, EACCES).","triggerScenarios":"`TcpListener::bind(\"127.0.0.1:<CODEX_OAUTH_PORT>\")` fails inside `run_oauth_flow_with_label`: the port is already in use by another OAuth flow instance, a leftover process still holds the socket, or a firewall/security policy blocks binding to the port.","commonSituations":"Running two login flows concurrently; a previous login attempt crashed leaving a zombie process holding the port; running in a container/sandbox that disallows the port; port reserved by another local dev server.","solutions":["Find and stop the process holding the port: `lsof -i :<port>` then kill it, and retry the login.","Ensure only one OAuth login flow runs at a time (no parallel TUI instances doing login).","Run in an environment that permits binding to 127.0.0.1 on that port (adjust sandbox/container/firewall settings).","If it persists, reboot or wait for TIME_WAIT sockets to clear, then retry."],"exampleFix":"// before\nlet listener = TcpListener::bind(format!(\"127.0.0.1:{}\", CODEX_OAUTH_PORT)).await\n    .map_err(|e| anyhow!(\"Failed to bind port {}: {}\", CODEX_OAUTH_PORT, e))?;\n// after: check/free the port first\n// $ lsof -ti :1455 | xargs kill   (then retry; or run the flow once at a time)","handlingStrategy":"try-catch","validationCode":"// Pre-check port availability before starting the flow (bash)\nss -ltn | grep -q \":1455 \" && { echo \"port 1455 in use; close the other login\"; exit 1; }","typeGuard":null,"tryCatchPattern":"match run_oauth_flow(&mut app).await {\n    Err(e) if e.to_string().contains(\"Failed to bind port\") => {\n        eprintln!(\"Another login may be running; free the port and retry\");\n    }\n    other => other?,\n}","preventionTips":["Run only one OAuth login flow at a time.","Kill stale processes from previous failed logins (lsof -i :<port>).","Ensure your sandbox/container allows binding to loopback ports."],"tags":["oauth","network","bind","port-in-use","cli"],"backgroundTag":"address-already-in-use","analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}