fix(agent-core-v2): make managed OAuth login env-aware - #1634
Conversation
Resolve the login environment via resolveKimiCodeLoginAuth so KIMI_CODE_BASE_URL / KIMI_CODE_OAUTH_HOST steer the credential slot login writes to the same way they steer runtime token reads — fixes "login succeeds but every call 401s" against non-default environments. The provisioned provider entry now records the login environment and credential slot explicitly, and logout deletes from the runtime (env-aware) slot.
🦋 Changeset detectedLatest commit: 112334d The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 112334d961
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| readonly provider: string; | ||
| readonly controller: AbortController; | ||
| readonly oauthRef: OAuthRef | undefined; | ||
| /** Base URL of the environment the login targeted (env-aware); drives the provisioned provider entry. */ |
There was a problem hiding this comment.
packages/agent-core-v2/AGENTS.md requires comments in this package to live only in the top-of-file /** */ block and never beside fields, methods, or statements. This new field comment starts a set of added inline explanatory comments in authService.ts; please fold any necessary rationale into the module header or make the code self-explanatory so the file stays within the local convention.
Useful? React with 👍 / 👎.
1 participant
Related Issue
No linked issue — the problem is explained below.
Problem
The v2 managed OAuth login ignored
KIMI_CODE_BASE_URL/KIMI_CODE_OAUTH_HOST. Login always targeted the default environment's credential slot while the runtime read tokens env-aware (resolveKimiCodeRuntimeAuth). Against a non-default environment the token was written to one slot and read from another — "login succeeds but every call 401s".What changed
startLoginnow resolves the login environment viaresolveKimiCodeLoginAuth(v1managedAuth.loginparity), soKIMI_CODE_BASE_URL/KIMI_CODE_OAUTH_HOSTsteer the credential slot the token is written to the same way they steer runtime token reads.baseUrl) and the resolved credential slot (oauthref) explicitly instead of trusting a stale configured ref; the configured ref is reused only when it matches the login environment.logoutdeletes the token from the runtime (env-aware) slot, so an env-scoped login's token is actually removed.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.