[pm25coder]

Problem

_find_free_port() bound a socket, read the port, and closed it again. Between that close and the callback server binding the port, any process on the machine could claim it — the browser's redirect then landed on a port nothing was listening on and the flow failed with a connection refused. devagent auth (and any MCP OAuth login) is exposed on a machine with normal socket churn.

Measured on this host, old helper and new one side by side:

helper: _find_free_port (bind, read, close), port=64311
another process can take the port: True       <- the window this fixes
helper: _bind_callback_socket (socket held open), port=64310
another process can take the port: False

Change

The socket is bound once and handed to the server, so the port is never free in between (issue option A — no retry loop needed):

• _bind_callback_socket() binds loopback on an ephemeral port and keeps the socket.
• _start_callback_server(sock) builds the HTTPServer with bind_and_activate=False, assigns the already-bound socket, and calls server_activate() to listen on it. The redirect URI is built from sock.getsockname(), so the address the browser is sent to is the socket the server serves on.
• the socket is closed when the flow ends (server_close() in the finally) — previously the listening socket stayed bound for the rest of the process.

_find_free_port() had no other caller and is removed.

Tests

7 tests in tests/test_pkce_callback_port.py, all offline (loopback only, no browser):

• another socket cannot take the port (the reservation, stated directly);
• the adopted socket actually serves the callback — code and error arms;
• closing the server releases the port;
• the redirect URI the flow advertises is the port it is listening on (the end-to-end arm, standing in for the browser following the redirect);
• the port is released when the flow returns.

uv run --python 3.13 --with pytest --with pytest-asyncio python -m pytest tests/ -q
809 passed, 1 skipped, 1 failed

The failure is test_phase17.py::TestFixtureProject::test_data_store_tests_pass_despite_bug, a pre-existing Windows GBK-locale UnicodeDecodeError that fails on unmodified main too. ruff clean.

Fixes #61.

[knight22-21]

Thanks for the fix! A PR merged just before this one touched \CHANGELOG.md,
so there's a conflict now. Could you rebase onto \main\ and force-push?

\
git fetch upstream
git rebase upstream/main
git push --force-with-lease
\\

Everything else looks good — CI passed on all test and lint checks.

[pm25coder]

Rebased onto main (5345a78) and force-pushed. The only conflict was CHANGELOG.md — both entries sit under ### Fixed, so I kept both, yours (Gemini tool definitions) first and mine after it.

Re-running the test file turned up something in my own entry: it claimed "7 tests" for tests/test_pkce_callback_port.py, and the file has 6 — it had 6 in the original branch too, so the number was wrong from the start. Corrected it in the same commit rather than leave a count that doesn't match the file.

Local after the rebase: 6 passed in tests/test_pkce_callback_port.py, 16 passed / 1 skipped for tests/ -k "pkce or oauth". CI should settle the rest.