[yobushka]

Summary

Fixes #7378.

When an interactive OAuth login attempt is interrupted, cancelled, or fails, loginState.get(provider) retains a settled state (done: true) with the terminal error message.

Previously, cancelLoginFlow(provider, flowId) contained the check:

if (!active && (!existing || existing.done)) return false;

Because of this guard, calling cancelLoginFlow (such as via POST /api/oauth/login/cancel from the dashboard modal close/cancel button) had no effect once the flow reached existing.done === true. As a consequence, getLoginStatus(provider) permanently returned error: st?.error on every poll, displaying a persistent red error banner in the dashboard UI and masking an otherwise healthy authenticated provider pool until the process was restarted.

Changes

• In src/oauth/login-flow-state.ts, allow cancelLoginFlow to dismiss a settled (!active && existing) flow via dropLoginFlow(flowKey). This cleans up the latched terminal error from memory.
• Added comprehensive unit test in tests/oauth/oauth-cancel-clears-transient-error.test.ts verifying that canceling after a settled terminal error successfully clears status.error and resets status.done.

Verification

• Run bun test tests/oauth/oauth-cancel-clears-transient-error.test.ts (pass)
• Run bun test tests/oauth/oauth-manual-code.test.ts (pass)

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Canceling an OAuth login now clears lingering error information and resets its status, even when the login flow has already completed. This prevents an old error from continuing to appear after cancellation and ensures the status reflects that the flow is no longer active.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/login-flow-state.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/login-flow-state.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@yobushka Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 831beb00-03ef-4949-a37a-295ea58b7e72

📥 Commits

Reviewing files that changed from the base of the PR and between dd2bdd2 and b304f12.

📒 Files selected for processing: 2

• src/oauth/login-flow-state.ts
• tests/oauth/oauth-cancel-clears-transient-error.test.ts

📝 Walkthrough

cancelLoginFlow now removes an existing login flow when no abort controller is active, including a completed flow with an error. A test checks that cancellation clears the error and resets the reported status.

Changes: OAuth cancellation

Layer / File(s)	Summary
Clear flow state on cancellation src/oauth/login-flow-state.ts, tests/oauth/oauth-cancel-clears-transient-error.test.ts	When no abort controller is active, cancelLoginFlow returns false only if no flow exists. Otherwise, it drops the flow and returns true. The test checks that cancelling a completed login error clears the error and sets done to false.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to b304f

No actionable issue remains from the supplied evidence; this change is mergeable after normal checks.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately describes the main change: allowing cancelLoginFlow to dismiss settled OAuth terminal error states. The issue reference is relevant. The [WRONG BRANCH] prefix adds noise but does …
Linked Issues check		Issue #7378 requires cancellation to remove a settled login error so later OAuth status polling stops reporting stale failure state. In src/oauth/login-flow-state.ts:305-314, cancelLoginFlow now c…
Out of Scope Changes check		The whole-PR diff contains one targeted change in cancelLoginFlow and one focused regression test. Both changes support issue #7378 by clearing settled OAuth state and verifying the resulting status…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.

Full details: Title check

Explanation

The title accurately describes the main change: allowing cancelLoginFlow to dismiss settled OAuth terminal error states. The issue reference is relevant. The [WRONG BRANCH] prefix adds noise but does not make the title unclear or unrelated.

Full details: Linked Issues check

Explanation

Issue #7378 requires cancellation to remove a settled login error so later OAuth status polling stops reporting stale failure state. In src/oauth/login-flow-state.ts:305-314, cancelLoginFlow now calls dropLoginFlow(flowKey) when an existing flow has no active abort controller, which removes the settled state. The added test at tests/oauth/oauth-cancel-clears-transient-error.test.ts:5-28 verifies that a settled error is visible before cancellation, that cancellation returns true, and that subsequent getLoginStatus has no error and reports done: false.

Full details: Out of Scope Changes check

Explanation

The whole-PR diff contains one targeted change in cancelLoginFlow and one focused regression test. Both changes support issue #7378 by clearing settled OAuth state and verifying the resulting status. No unrelated source, API, or test changes are present.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Ingwannu]

[P2] Preserve the cancellation owner contract and successful outcomes — src/oauth/login-flow-state.ts:308–312.

The new !active branch drops any existing row, including a successful terminal flow and a stale pending flow whose controller has been replaced. Internal Codex cancellation interprets true as evidence that its actual live controller was cancelled; changing that boolean meaning allows a stale Codex flow to report a successful cancellation. The existing tests/codex-integration/codex-auth-cancel-ownership.test.ts covers that boundary. A completed code-login result/account receipt also needs to remain readable rather than disappearing on a later cancel.

The same issue already has Draft #7379 on dev, whose initial broad CI caught exactly this shared-caller regression. Its public-endpoint opt-in now preserves the internal boolean and successful outcome, and current-head CI is green. Please coordinate against that candidate; no code from this PR was carried into it.

Also retarget/rebase to dev (this PR currently targets main), register the new test in both layout maps, isolate/reset its global flow state, and update the owning flow contract. This is scoped static feedback at b304f12; no independent local run or merge approval of this new branch is claimed.

[yobushka]

Closing in favor of Draft #7379 which already addresses #7378 on dev while preserving the internal cancellation contract.