• .orbital/AGENTS.md: Skipped file pattern
• CHANGELOG.md: Skipped file pattern
• README.md: Skipped file pattern
• package-lock.json: Skipped file pattern

src/mcp/auth.ts (1 suggestion)

Location: src/mcp/auth.ts (Lines 217-220)

🟠 Error Handling

Issue: startCallbackServer creates an HTTP server and calls listen() without attaching an 'error' event handler. If the callback port is already in use (likely due to the ephemeralPort fallback always returning 8765), the unhandled 'error' event will crash the Node.js process.

Fix: Attach a no-op error handler to prevent the process from crashing on EADDRINUSE or other listen errors.

Impact: Prevents fatal crashes during OAuth authentication

-  	})
-  	server.listen(port, "127.0.0.1")
-  	return server
-  }
+  	})
+  	server.on("error", () => {})
+  	server.listen(port, "127.0.0.1")
+  	return server

src/mcp/client.ts (1 suggestion)

Location: src/mcp/client.ts (Lines 123-139)

🟡 Type Safety

Issue: callMcpTool uses (result.content ?? []) as Array<Record<string, unknown>> to cast the MCP tool result content. If a misbehaving server returns a non-array value, the subsequent for...of loop will throw or behave unpredictably.

Fix: Validate that result.content is an array before iterating, and guard each block with an object type check.

Impact: Hardens the client against malformed MCP server responses

-  	const content = (result.content ?? []) as Array<Record<string, unknown>>
-  	const parts: string[] = []
-  	for (const block of content) {
-  		const type = block.type as string
-  		if (type === "text" && typeof block.text === "string") {
-  			parts.push(block.text)
-  		} else if (type === "resource") {
-  			const resource = block.resource as Record<string, unknown> | undefined
-  			if (resource && typeof resource.text === "string") parts.push(resource.text)
-  		} else if (type === "image") {
-  			parts.push(`[image: ${block.mimeType}]`)
-  		} else if (type === "audio") {
-  			parts.push(`[audio: ${block.mimeType}]`)
-  		} else if (type === "resource_link" && typeof block.uri === "string") {
-  			parts.push(`[resource: ${block.uri}]`)
-  		}
-  	}
+  	const content = Array.isArray(result.content) ? result.content : []
+  	const parts: string[] = []
+  	for (const block of content) {
+  		if (!block || typeof block !== "object") continue
+  		const b = block as Record<string, unknown>
+  		const type = b.type as string
+  		if (type === "text" && typeof b.text === "string") {
+  			parts.push(b.text)
+  		} else if (type === "resource") {
+  			const resource = b.resource as Record<string, unknown> | undefined
+  			if (resource && typeof resource.text === "string") parts.push(resource.text)
+  		} else if (type === "image") {
+  			parts.push(`[image: ${b.mimeType}]`)
+  		} else if (type === "audio") {
+  			parts.push(`[audio: ${b.mimeType}]`)
+  		} else if (type === "resource_link" && typeof b.uri === "string") {
+  			parts.push(`[resource: ${b.uri}]`)
+  		}
+  	}