fix(oauth): store keyring tokens as one entry per provider - #668

Closed

euxaristia wants to merge 46 commits into

Gitlawb:mainfrom

euxaristia:fix/keyring-oauth-per-provider-entries

Commits on Aug 15, 2026

fix(oauth): store keyring tokens as one entry per provider
euxaristia
committed
3e024a5
fix(oauth): lock keyring reads against concurrent Save/Delete
euxaristia
committed
1e15a4b
fix(oauth): make the keyring token store bounded, recoverable, and mixed-version safe
euxaristia
committed
ec252e3
test(oauth): assert Status also stays lock-free behind a crashed writer's lock
euxaristia
committed
bb48e7a
fix(oauth): recover legacy tokens across an interrupted keyring migration
euxaristia
committed
7017b2f
fix(oauth): lease the keyring lock with wall-clock time
euxaristia
committed
98ff17b
fix(oauth): bound the keyring index chunk count before reading
euxaristia
committed
95faae0
fix(oauth): scope the keyring fallback lock to a per-user path
euxaristia
committed
1cc9a11
fix(oauth): fail logout on legacy-blob delete failure; cap index chunks on write

euxaristia
and
claude
committed
46f858e
fix(oauth): use wall clock for lock timeout and bound keyring index
euxaristia
committed
9e12e6d
fix(oauth): refuse keyring indexes over the reader key cap on write
euxaristia
committed
64707c5
fix(oauth): derive the keyring lock path from keyring identity, not file config
euxaristia
committed
a418471
fix(oauth): refuse to delete the legacy keyring blob on a transient read error
euxaristia
committed
3a0b470
fix(oauth): dedupe and validate the keyring index before fanning out lookups
euxaristia
committed
e3d7868
fix(oauth): anchor the keyring lock on home dir and honor the legacy lock
euxaristia
committed
163dd91
fix(oauth): preserve token scopes across refresh and encode keyring lock file components
euxaristia
committed
d778466
fix(oauth): address review findings on legacy freshness, unindexed keys, lock path, and keyring key cap
euxaristia
committed
c817cf6
fix(oauth): fix readKeyIndex chunked path rawKeys rename and cap order
euxaristia
committed
a99ff78
test(oauth): cover read() index/entry desync recovery for chunked index format

euxaristia
and
cairn-code
committed
20d077e
chore: force CodeRabbit re-review

euxaristia
and
cairn-code
committed
5e91dc1
fix(oauth): address PR requested changes for keyring per-provider entries
euxaristia
committed
b011d7b
fix(oauth): address review findings for per-provider keyring entries
euxaristia
committed
45bba7b
fix(oauth): address remaining keyring migration P1s
euxaristia
committed
26ffa43
fix(oauth): harden keyring index write and migration safety
euxaristia
committed
0cf4072
fix(oauth): freeze legacy keyring and tombstone durable deletes
euxaristia
committed
fe87d04
Harden OAuth migration state transitions against interrupted writes.
euxaristia
committed
f095ac9
fix(oauth): close lease panics, ownership refresh, and review findings.
euxaristia
committed
8c365a8
fix(oauth): preserve incomplete index chunks and tighten lease ownership.
euxaristia
committed
b7d850a
fix(oauth): fence lost leases, protect missing index chunks, and bound tombstones

euxaristia
and
cairn-code
committed
c5cf244
fix(oauth): anchor the Windows fallback keyring lock to the caller's identity
euxaristia
committed
d7b3cd3
fix(oauth): fence keyring writes at every step, not just around the callback
euxaristia
committed
496ee39
fix(oauth): honor a logout performed by a running pre-migration binary
euxaristia
committed
913a970
fix(oauth): preflight index chunk capacity before writing any chunk
euxaristia
committed
95fe65c
fix(oauth): stage index chunk growth under a new generation before publishing
euxaristia
committed
6ae0da9
Address review feedback for keyring OAuth per-provider entries.
euxaristia
committed
3627902
fix(oauth): close remaining CodeRabbit findings on keyring store

euxaristia
and
cairn-code
committed
4505f8d
fix(oauth): address review feedback on keyring per-provider entries
euxaristia
committed
735d5b4
Address reviewer feedback on durable logout, legacy origin lifecycle, and generation fencing.
euxaristia
committed
5b9457e
Freeze the legacy keyring entry on every write path.
euxaristia
committed
a667b3a
fix(oauth): propagate lock cleanup errors and discard staged chunks on failure
euxaristia
committed
3bc5493
fix(oauth): verify lock release token and reconcile legacy origin on missing blob
euxaristia
committed
e9fe983
fix(oauth): extract shared marker set helpers and overwrite stale in-place slots
euxaristia
committed
fccb2a4

Commits on Aug 16, 2026

Commits on Aug 18, 2026

Document the keyring persist contract and lock MCP refresh to refresh intent.
euxaristia
committed
82e4c17