clawdie/zot
Watch
1
0
Fork
You've already forked zot
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: keep API-key login out of OAuth code flow #22

Merged
clawdie merged 1 commit from fix/api-key-login-waiting-state into main 2026-10-09 12:46:28 +02:00
Conversation 0 Commits 1 Files changed 3 +123 -4
clawdie commented 2026-10-09 12:46:19 +02:00
Owner
Copy link

The API-key waiting state fell through into the OAuth code-entry branch:
Render displayed "paste the authorization code" for API-key logins, and
handleWaitingKey routed the submitted value to CompleteManualOAuth, which
failed with "no manual oauth flow in progress". The key was never stored
because the user was misdirected away from the browser form.

Introduce wantsCodeEntry(), true only for the browser-callback OAuth flows
(anthropic, openai-codex). API-key waiting now shows a browser-form hint,
ignores keystrokes, and places no cursor.

Regression tests:

  • TestLoginDialogAPIKeyWaitingStaysInBrowserForm
  • TestStartAPIKeyStoresKeyWithoutManualOAuth

Validation: gofmt clean; go test ./... pass; go test -race for
packages/agent/modes and packages/provider/auth pass; go vet ./... clean;
git diff --check clean.

The API-key waiting state fell through into the OAuth code-entry branch: Render displayed "paste the authorization code" for API-key logins, and handleWaitingKey routed the submitted value to CompleteManualOAuth, which failed with "no manual oauth flow in progress". The key was never stored because the user was misdirected away from the browser form. Introduce wantsCodeEntry(), true only for the browser-callback OAuth flows (anthropic, openai-codex). API-key waiting now shows a browser-form hint, ignores keystrokes, and places no cursor. Regression tests: - TestLoginDialogAPIKeyWaitingStaysInBrowserForm - TestStartAPIKeyStoresKeyWithoutManualOAuth Validation: gofmt clean; go test ./... pass; go test -race for packages/agent/modes and packages/provider/auth pass; go vet ./... clean; git diff --check clean.
fix: keep API-key login out of OAuth code flow
All checks were successful
leak-guard / guard (pull_request) Successful in 1s
Details
f2b685d007 
The API-key waiting state fell through into the OAuth code-entry branch:
Render displayed "paste the authorization code" for API-key logins, and
handleWaitingKey routed the submitted value to CompleteManualOAuth, which
failed with "no manual oauth flow in progress". The key was never stored
because the user was misdirected away from the browser form.

Introduce wantsCodeEntry(), true only for the browser-callback OAuth flows
(anthropic, openai-codex). API-key waiting now shows a browser-form hint,
ignores keystrokes, and places no cursor.

Regression tests:
- TestLoginDialogAPIKeyWaitingStaysInBrowserForm
- TestStartAPIKeyStoresKeyWithoutManualOAuth

Validation: gofmt clean; go test ./... pass; go test -race for
packages/agent/modes and packages/provider/auth pass; go vet ./... clean;
git diff --check clean.
clawdie deleted branch fix/api-key-login-waiting-state 2026-10-09 12:46:28 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawdie/zot!22
No description provided.