fix(agent-core-v2): keep invalidated OAuth flows observable during login - #1663
Merged
Conversation
invalidateFlows() deleted flows outright when the provider configuration changed, including terminal ones. That voided the TERMINAL_RETENTION_MS window and, worse, left the status guards in handleSuccess / finalizeAuthentication blind when the invalidation landed in the microtask gap after toolkit.login resolved: setTerminal then wrote 'authenticated' onto an orphaned state the client could never observe, so the login hung after a successful browser authorization. Transition affected pending flows to a visible 'cancelled' terminal status instead, mirroring abortExisting(). Also normalize the KIMI_CODE_BASE_URL env override at the source in kimiCodeBaseUrl(): provision persists it verbatim while the model refresh rewrites it normalized, and the deep-equal diff between the two shapes fired a spurious providers-changed event mid-login.
🦋 Changeset detectedLatest commit: 6dc8bb7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
No linked issue — the problem is explained below.
Problem
When the provider configuration changed while a device-code OAuth login was in flight (e.g. a managed-provider model refresh rewriting the persisted config mid-login),
OAuthService.invalidateFlows()deleted the flow from the map outright. Two consequences:TERMINAL_RETENTION_MSobservability window.toolkit.loginresolved but beforehandleSuccessran, thestate.status !== 'pending'guards there could not observe it (an abort is inert once the final poll returned).setTerminalthen wroteauthenticatedonto an orphaned state thatgetFlowcould never return — the login hung after a successful browser authorization.A related trigger: a
KIMI_CODE_BASE_URLoverride with a trailing slash was persisted verbatim by provision but rewritten normalized by the model refresh, and the deep-equal diff between the two shapes fired a spurious providers-changed event during login.What changed
invalidateFlows()now transitions affected pending flows to a visiblecancelledterminal status (with an explanatoryerror_message) instead of deleting them, mirroring the existingabortExisting()behavior; non-pending flows keep their retention window.kimiCodeBaseUrl()strips trailing slashes from theKIMI_CODE_BASE_URLenv override at the source, so the persisted and the rewritten provider configs share the same canonical shape.auth.test.ts(provider removed, provider changed, and the post-resolve microtask gap) and a normalization test inmanaged-usage.test.ts.Checklist
gen-changesetsskill, or this PR needs no changeset.gen-docsskill, or this PR needs no doc update.