PR #24968: fix(core): clear 5-minute timeouts in oauth flow to prevent memory leaks

• Repository: google-gemini/gemini-cli
• Author: spencer426
• State: open | merged: False
• Link: https://github.com/google-gemini/gemini-cli/pull/24968

Description (problem / solution / changelog)

Summary

Addresses a memory leak in the OAuth flow where a 5-minute timeout was never cleared upon successful authentication, leaving hanging Promises and Generators.

Details

In packages/core/src/code_assist/oauth2.ts and packages/core/src/utils/oauth-flow.ts, 5-minute timeouts were being created and never cleared upon success. This forced the garbage collector to retain the overarching Generator loop, pending Promises, and AsyncLocalStorage telemetry spans for the full 5 minutes. The fix explicitly tracks the timeout and clears it using a .finally() block.

Related Issues

Fixes #24982

How to Validate

1. Start a local OAuth callback server flow to verify the timeout is properly cleared immediately:

   Create a file test-timeout.ts:

   import { startCallbackServer } from './packages/core/src/utils/oauth-flow.ts';
   
   async function runTest() {
     console.log('Starting OAuth callback server with a 5-minute timeout...');
     const { port, response } = startCallbackServer('test-state-123');
     
     const assignedPort = await port;
     console.log(`Server listening on port ${assignedPort}.`);
   
     console.log('Simulating successful browser redirect...');
     await fetch(`http://localhost:${assignedPort}/oauth/callback?code=test-code-abc&state=test-state-123`);
   
     const result = await response;
     console.log('Authentication flow completed successfully with code:', result.code);
     console.log('Script finished. If the bug is fixed, the process will exit IMMEDIATELY.');
   }
   
   runTest().catch(console.error);

2. Execute the script:

   npx tsx test-timeout.ts

3. Ensure the script prints the output and exits instantaneously without hanging.

Pre-Merge Checklist

• Updated relevant documentation and README (if needed)
• Added/updated tests (if needed)
• Noted breaking changes (if any)
• Validated on required platforms/methods:
  • MacOS
    • npm run
    • npx
    • Docker
    • Podman
    • Seatbelt
  • Windows
    • npm run
    • npx
    • Docker
  • Linux
    • npm run
    • npx
    • Docker

Changed files

• packages/core/src/code_assist/oauth2.ts (modified, +14/-4)
• packages/core/src/mcp/oauth-provider.test.ts (modified, +25/-21)
• packages/core/src/utils/oauth-flow.test.ts (modified, +22/-0)
• packages/core/src/utils/oauth-flow.ts (modified, +20/-5)