When wrangler login is rejected by the Cloudflare OAuth provider — for example when the provider doesn't support a scope Wrangler is requesting — the OAuth callback redirects to http://localhost:8976/oauth/callback?error=.... Previously, for any error other than access_denied, Wrangler:

1. Threw the OAuth error from inside the local HTTP callback handler without ever calling res.end().
2. Called server.close(), which only fires its callback once all open connections have ended.
3. The browser tab was still waiting for a response, so server.close() never completed.
4. The login promise never settled, until the 120 second OAuth timeout fired with a generic "Timed out waiting for authorization code" message.

Net effect: the real OAuth error was silently swallowed and Wrangler hung for two minutes.

This PR:

• Always writes an HTTP response on every OAuth callback exit path (a minimal inline HTML error page for non-access_denied errors, mirroring how access_denied already redirects to a hosted "consent denied" page). The same fix covers the previously-broken no-auth-code branch (// render an error page here) and a now-try/catch-wrapped token-exchange branch.

• Reads error_description and error_uri from the OAuth callback query string (RFC 6749 §4.1.2.1) and includes them in the surfaced error so the user sees the specific reason. For example a misconfigured scope now surfaces as:

  OAuth error: invalid_scope
    The OAuth 2.0 Client is not allowed to request scope 'browser:write'.
  

  instead of hanging silently.

• Adds a defensive if (!res.writableEnded) res.end() in finish() so a future code path that forgets to send a response can't reintroduce the hang.

• Tightens mock-http-server.ts to faithfully reproduce production server.close() semantics (its callback only fires once res.end() has been observed). Without this, tests for the broken behaviour would pass by accident because the mock's close() fired its callback unconditionally.

• Adds tests for invalid_scope (with and without error_description), access_denied (previously untested), and a token-exchange failure on the success path.

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this is a bug fix for an error message that was previously swallowed; no user-visible documented behaviour changes.