fix: harden OAuth vault recovery#190
Conversation
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: fix: harden OAuth vault recovery This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf78f4d28a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const existing = isVaultEntry(vault.entries[key]) ? vault.entries[key] : undefined; | ||
| const fallback = findSameUrlCredentials(vault, definition, key, existing); | ||
| const inheritedKeys = scope === 'all' ? legacyOAuthRenameKeys(vault, definition, key) : fallback.sourceKeys; | ||
| if (!existing && inheritedKeys.length === 0) { | ||
| if (needsRepair) { |
There was a problem hiding this comment.
clearVaultEntry now treats a key as missing unless it passes isVaultEntry, so an exact entry that is present but malformed (for example missing updatedAt) will hit the early-return path and remain in the vault. That regresses the previous behavior where any existing keyed entry could be removed with scope === 'all', and it means clearOAuthCaches can silently fail to clear broken credentials for that server unless the file is manually edited.
Useful? React with 👍 / 👎.
1 participant
Summary
<server>-oauthlegacy path without reusing unrelated same-URL credentialsProof
pnpm vitest run tests/oauth-persistence.test.tspnpm typecheckpnpm test -- --runInBand/Users/steipete/Projects/agent-scripts/skills/autoreview/scripts/autoreview --mode local