GitHub sign-in intermittently returns HTTP 500 after ~15s (api.commandcode.ai/auth/sign-in/social)

[srafyhucl-cpu]

Describe the bug

The GitHub social sign-in endpoint intermittently returns HTTP 500 after approximately 15 seconds. Successful requests also take approximately 17–18 seconds before returning the GitHub authorization URL. This makes GitHub sign-in appear broken or permanently stalled from the web UI.

Endpoint

POST https://api.commandcode.ai/auth/sign-in/social

Content-Type: application/json

{
  "provider": "github",
  "callbackURL": "https://commandcode.ai/settings/usage"
}

To reproduce

1. Open the Command Code sign-in page.
2. Select Continue with GitHub.
3. The request to POST /auth/sign-in/social stalls for about 15 seconds.
4. The endpoint intermittently returns HTTP 500 with an empty response body.
5. Retrying can occasionally succeed, but the successful request still takes roughly 17–18 seconds to return the GitHub authorization URL.

Observed results

An earlier test of 4 requests produced 3 × 500 and 1 success.

A second test just before this issue was filed produced:

• 500 after 16997 ms; x-trace-id: 7f4302bd44a768e0c59544f12c49630d; cf-ray: a3dfcf8e6d47f2cb-SJC; server-timing: total;dur=15120.0
• 200 after 18163 ms; x-trace-id: 6aeed003f8bb5fed4e5f68afee389dae; cf-ray: a3dfcf8fe8995f13-SJC; server-timing: total;dur=15016.0
• 200 after 17646 ms; x-trace-id: 02c6aedbe1c117822b50754fe5339cea; cf-ray: a3dfcf8e4cbfa2db-SJC; server-timing: total;dur=15052.0
• 429 after 3095 ms while testing repeatedly; x-trace-id: fa8ccdee1763f1ab51623f0c32ac9d94

Earlier evidence from the same endpoint:

• x-trace-id: e0e2316bd7c181284b8e4c9bd1b28612
• cf-ray: a3dfc5b8c8632287-SJC
• server-timing: total;dur=16052ms

Expected behavior

POST /auth/sign-in/social should reliably return a GitHub authorization URL promptly (ideally well under a few seconds), without intermittent 500 responses.

Additional context

• Email/password authentication appears functional: it returns the expected 400 {"message":"Missing CAPTCHA response"} rather than a server error.
• Google sign-in is not configured: 404 PROVIDER_NOT_FOUND.
• GitHub's status page is healthy, so this appears to be specific to Command Code's social sign-in flow.
• The behavior has so far been reproducible both in the browser and via direct requests with a generic callback URL.
• This may be an upstream timeout between Command Code and GitHub OAuth, but the current result is an unhandled 500 and a browser-visible stall.

Please investigate the server-side OAuth initialization path and the ~15-second timeout behavior. The trace IDs above should help correlate the failed and slow requests.

[srafyhucl-cpu]

Additional evidence: email/password sign-in error

Attempting to sign in with email and password in the web UI returns:

Invalid email or password. Please try again.

This occurs while GitHub social sign-in is also intermittently returning 500. Please check whether both sign-in paths are affected by the current authentication issue.