fix: handle external rotation of the Claude Code credential - #260

Merged

griffinmartin merged 33 commits into

mainfrom

griffinmartin/cswap

Jul 30, 2026

Commits on Jul 29, 2026

docs: design for external credential rotation handling
griffinmartin
committed
docs: implementation plan for external credential rotation
griffinmartin
committed
test: make credentials keychain stub source-aware
griffinmartin
committed
docs: drop unused reset helper from harness task
griffinmartin
committed
test: drop unused __clearSourceOverrides from keychain stub
griffinmartin
committed
docs: format spec files with oxfmt
griffinmartin
committed
fix: re-read keychain sources so external credential rotation is picked up
griffinmartin
committed
docs: record actual Task 2 test breakage and check off completed steps
griffinmartin
committed
docs: state that the post-OAuth file-source exclusion is unjustified
griffinmartin
committed
docs: track the unjustified file-source exclusion as a follow-up
griffinmartin
committed
fix: validate the up-front source re-read before adopting
griffinmartin
committed
docs: record the validated-adopt rule in the design
griffinmartin
committed
docs: scope the orphaned-blob window to the reactive path
griffinmartin
committed
docs: scope the 60s premise to the reactive path and track the discarded write-back result
griffinmartin
committed
fix: guard credential write-back against an external switch
griffinmartin
committed
test: pin the write-back guard at every call site
griffinmartin
committed
docs: record the configDir write-back fix and check off Task 3
griffinmartin
committed
fix: recover from a rejected token by forcing an OAuth refresh
griffinmartin
committed
docs: correct Task 4 failure prediction and record the transform follow-up
griffinmartin
committed
refactor: log auth recovery failures and correct the loop's bound comment
griffinmartin
committed
docs: correct the transformResponseStream follow-up premise
griffinmartin
committed
fix: re-read credentials on a 429 so a resolved rate limit is not surfaced
griffinmartin
committed
test: pin the 429 retry to the rotated token and cover the unreadable-source arm
griffinmartin
committed
docs: document external credential rotation handling
griffinmartin
committed
fix: clear the borrowed flag when a source reload adopts own credentials
griffinmartin
committed
test: pin the keychain-branch write-back guard
griffinmartin
committed
test: pin the recovery attempt cap and the 429 token comparison
griffinmartin
committed
docs: record deferred findings from the final review
griffinmartin
committed
docs: record deferred findings from the final review
griffinmartin
committed
docs: check off completed Task 5 and 6 steps
griffinmartin
committed

Commits on Jul 30, 2026