before codex auth refactor

bin/codex-wrapper.sh

@@ -12,6 +12,7 @@ CODEX_WRAPPER_DEFAULT_CODEX_PROFILE="${CODEX_WRAPPER_DEFAULT_CODEX_PROFILE:-gpt-
 CODEX_WRAPPER_AUTH_ENV_FILE=""
 CODEX_WRAPPER_DEDICATED_AGENT_PID=""
 CODEX_WRAPPER_DEDICATED_AGENT_SOCK=""
+OCI_AUTH_CALLBACK_PORT="${OCI_AUTH_CALLBACK_PORT:-8181}"
 
 log() {
   print -u2 -- "$@"
@@ -142,13 +143,70 @@ should_refresh_confluence_cookies() {
   confluence_selected
 }
 
+terminate_stale_oci_auth_listener() {
+  local port="${1:-${OCI_AUTH_CALLBACK_PORT}}" pid cmd attempt
+  local -a terminated_pids=()
+
+  if ! command -v lsof >/dev/null 2>&1 || ! command -v ps >/dev/null 2>&1; then
+    return 1
+  fi
+
+  while IFS= read -r pid || [[ -n "${pid}" ]]; do
+    [[ -n "${pid}" ]] || continue
+
+    cmd="$(ps -p "${pid}" -o command= 2>/dev/null || true)"
+    if [[ "${cmd}" == *"oci session authenticate"* ]]; then
+      log "MCP Gateway auth preflight: terminating stale OCI session authenticate listener on port ${port} (pid ${pid})."
+      kill "${pid}" >/dev/null 2>&1 || true
+      terminated_pids+=("${pid}")
+    fi
+  done < <(lsof -nP -t -iTCP:"${port}" -sTCP:LISTEN 2>/dev/null || true)
+
+  if [[ ${#terminated_pids[@]} -eq 0 ]]; then
+    return 1
+  fi
+
+  for pid in "${terminated_pids[@]}"; do
+    for attempt in {1..10}; do
+      if ! kill -0 "${pid}" >/dev/null 2>&1; then
+        break
+      fi
+      sleep 0.2
+    done
+
+    if kill -0 "${pid}" >/dev/null 2>&1; then
+      log "MCP Gateway auth preflight: OCI auth listener pid ${pid} did not exit; sending SIGKILL."
+      kill -KILL "${pid}" >/dev/null 2>&1 || true
+    fi
+  done
+
+  return 0
+}
+
 run_mcpgw_required() {
   local mcpgw_bin="$1"
   shift
+  local output rc
 
   log "MCP Gateway auth preflight: mcpgw $*"
-  "${mcpgw_bin}" "$@" 2>&1 | sanitize_mcpgw_output
-  local rc="${pipestatus[1]}"
+
+  set +e
+  output="$("${mcpgw_bin}" "$@" 2>&1)"
+  rc=$?
+  set -e
+  printf '%s\n' "${output}" | sanitize_mcpgw_output
+
+  if [[ ${rc} -ne 0 && "$*" == "refresh" && "${output}" == *"port ${OCI_AUTH_CALLBACK_PORT} is already in use"* ]]; then
+    if terminate_stale_oci_auth_listener "${OCI_AUTH_CALLBACK_PORT}"; then
+      log "MCP Gateway auth preflight: retrying mcpgw refresh after clearing stale OCI auth listener."
+
+      set +e
+      output="$("${mcpgw_bin}" "$@" 2>&1)"
+      rc=$?
+      set -e
+      printf '%s\n' "${output}" | sanitize_mcpgw_output
+    fi
+  fi
 
   if [[ ${rc} -ne 0 ]]; then
     log "MCP Gateway auth preflight failed: mcpgw $* exited with ${rc}."