Clean OAuth setup hygiene

Author: TheGreatAxios

src/auth/oauth-scope-check.test.ts

@@ -62,13 +62,16 @@ describe("checkOAuthProviderScope", () => {
     expect(expired.access).toBe("refreshed-codex");
   });
 
-  test("codex: reports a definitive staged refresh rejection as invalid credentials", async () => {
+  test("codex: blocks a definitive staged refresh rejection", async () => {
     const expired = { ...codexTokens, expiresAt: 0 };
     stubFetch(() => new Response(JSON.stringify({ error: "invalid_grant" }), { status: 400 }));
 
     const result = await checkOAuthProviderScope("codex", expired);
 
-    expect(result.status).toBe("invalid-credentials");
+    expect(result.status).toBe("blocked");
+    if (result.status === "blocked") {
+      expect(result.message).toMatch(/expired|revoked/i);
+    }
   });
 
   test("codex: reports a transient staged refresh failure as unavailable", async () => {
@@ -82,21 +85,20 @@ describe("checkOAuthProviderScope", () => {
     expect(result.status).toBe("unavailable");
   });
 
-  test("codex: insufficient-scope on a definitive 403", async () => {
+  test("codex: blocks a definitive 403 without surfacing the raw body", async () => {
     stubFetch(() => new Response("forbidden", { status: 403 }));
     const result = await checkOAuthProviderScope("codex", codexTokens);
-    expect(result.status).toBe("insufficient-scope");
-    if (result.status === "insufficient-scope") {
+    expect(result.status).toBe("blocked");
+    if (result.status === "blocked") {
       expect(result.message).toMatch(/reconnect/i);
-      // Must never surface the raw response body.
       expect(result.message).not.toContain("forbidden");
     }
   });
 
-  test("codex: insufficient-scope on a definitive 401", async () => {
+  test("codex: blocks a definitive 401", async () => {
     stubFetch(() => new Response("nope", { status: 401 }));
     const result = await checkOAuthProviderScope("codex", codexTokens);
-    expect(result.status).toBe("insufficient-scope");
+    expect(result.status).toBe("blocked");
   });
 
   test("codex: unavailable on a network failure, not blocked", async () => {
@@ -144,13 +146,16 @@ describe("checkOAuthProviderScope", () => {
     expect(expired.access).toBe("refreshed-xai");
   });
 
-  test("xai: reports a definitive staged refresh rejection as invalid credentials", async () => {
+  test("xai: blocks a definitive staged refresh rejection", async () => {
     const expired = { ...xaiTokens, expiresAt: 0 };
     stubFetch(() => new Response(JSON.stringify({ error: "revoked" }), { status: 401 }));
 
     const result = await checkOAuthProviderScope("xai", expired);
 
-    expect(result.status).toBe("invalid-credentials");
+    expect(result.status).toBe("blocked");
+    if (result.status === "blocked") {
+      expect(result.message).toMatch(/expired|revoked/i);
+    }
   });
 
   test("xai: reports a transient staged refresh failure as unavailable", async () => {
@@ -164,10 +169,10 @@ describe("checkOAuthProviderScope", () => {
     expect(result.status).toBe("unavailable");
   });
 
-  test("xai: insufficient-scope on a definitive 403", async () => {
+  test("xai: blocks a definitive 403", async () => {
     stubFetch(() => new Response("forbidden", { status: 403 }));
     const result = await checkOAuthProviderScope("xai", xaiTokens);
-    expect(result.status).toBe("insufficient-scope");
+    expect(result.status).toBe("blocked");
   });
 
   test("xai: unavailable on a timeout-style abort", async () => {

src/auth/oauth-scope-check.ts

@@ -24,8 +24,7 @@ export type OAuthScopeCheckKind = "codex" | "xai";
 
 export type OAuthScopeCheckResult =
   | { status: "ok" }
-  | { status: "insufficient-scope"; message: string }
-  | { status: "invalid-credentials"; message: string }
+  | { status: "blocked"; message: string }
   // The probe could not run to completion (network blip, timeout, rate
   // limit, provider hiccup). This must never be treated the same as a
   // definitive scope failure — a transient failure must not lock a
@@ -36,7 +35,7 @@ const SCOPE_CHECK_TIMEOUT_MS = 10_000;
 
 function insufficientScope(providerLabel: string): OAuthScopeCheckResult {
   return {
-    status: "insufficient-scope",
+    status: "blocked",
     message:
       `Your ${providerLabel} sign-in doesn't carry API access (it looks like a chat-only plan). ` +
       `Reconnect ${providerLabel} with an account/plan that includes API access, then try again.`,
@@ -52,7 +51,7 @@ function unavailable(providerLabel: string): OAuthScopeCheckResult {
 
 function invalidCredentials(providerLabel: string): OAuthScopeCheckResult {
   return {
-    status: "invalid-credentials",
+    status: "blocked",
     message: `${providerLabel} sign-in expired or was revoked. Reconnect ${providerLabel}, then try again.`,
   };
 }
@@ -65,22 +64,13 @@ export class OAuthProviderScopeError extends Error {
 }
 
 export function isOAuthProviderScopeError(err: unknown): err is OAuthProviderScopeError {
-  return (
-    err instanceof OAuthProviderScopeError ||
-    (typeof err === "object" &&
-      err !== null &&
-      "name" in err &&
-      err.name === "OAuthProviderScopeError")
-  );
+  return err instanceof OAuthProviderScopeError;
 }
 
 export function isBlockingOAuthScopeCheckResult(
   result: OAuthScopeCheckResult,
-): result is Extract<
-  OAuthScopeCheckResult,
-  { status: "insufficient-scope" | "invalid-credentials" }
-> {
-  return result.status === "insufficient-scope" || result.status === "invalid-credentials";
+): result is Extract<OAuthScopeCheckResult, { status: "blocked" }> {
+  return result.status === "blocked";
 }
 
 function isDefinitiveRefreshAuthRejection(err: unknown): boolean {

src/tui/provider-setup-submit.test.ts

@@ -8,7 +8,7 @@ import { withMockedModule } from "../../tests/helpers/mock-module.js";
 
 // The oauth branch probes real provider scope over the network; stub the
 // check so these tests exercise buildProviderSubmitHandler's own branching
-// (ok / insufficient-scope / unavailable) without a live call.
+// (ok / blocked / unavailable) without a live call.
 let scopeCheckResult: OAuthScopeCheckResult = { status: "ok" };
 const scopeCheckCalls: unknown[][] = [];
 await withMockedModule(
@@ -39,10 +39,9 @@ function stagedCodexOAuth(commit: () => Promise<void> = async () => {}): OAuthRe
   return {
     kind: "codex",
     providerName: "codex/work",
-    profile: "work",
     tokens: stagedCodexTokens,
     commit,
-  } as OAuthResult;
+  };
 }
 
 async function withTempDir(run: (dir: string) => Promise<void>): Promise<void> {
@@ -272,7 +271,7 @@ describe("buildProviderSubmitHandler", () => {
     test("fresh insufficient scope persists no credential or restart selection", async () => {
       await withTempDir(async (dir) => {
         scopeCheckResult = {
-          status: "insufficient-scope",
+          status: "blocked",
           message: "Your Codex sign-in doesn't carry API access. Reconnect Codex and try again.",
         };
         const path = join(dir, "settings.json");
@@ -308,7 +307,7 @@ describe("buildProviderSubmitHandler", () => {
     test("invalid staged OAuth credentials persist no credential or restart selection", async () => {
       await withTempDir(async (dir) => {
         scopeCheckResult = {
-          status: "invalid-credentials",
+          status: "blocked",
           message: "Codex sign-in expired or was revoked. Reconnect Codex, then try again.",
         };
         const path = join(dir, "settings.json");
@@ -343,7 +342,7 @@ describe("buildProviderSubmitHandler", () => {
 
     test("failed same-name reauthorization preserves the exact durable profile", async () => {
       await withTempDir(async (dir) => {
-        scopeCheckResult = { status: "insufficient-scope", message: "Reconnect Codex." };
+        scopeCheckResult = { status: "blocked", message: "Reconnect Codex." };
         const oldProfile = {
           name: "work",
           tokens: { access: "old-access", refresh: "old-refresh", expiresAt: 500 },
@@ -420,7 +419,7 @@ describe("buildProviderSubmitHandler", () => {
 
     test("explicit save-anyway skips the scope probe and commits exactly once", async () => {
       await withTempDir(async (dir) => {
-        scopeCheckResult = { status: "insufficient-scope", message: "should never be thrown" };
+        scopeCheckResult = { status: "blocked", message: "should never be thrown" };
         const localPath = localSettingsPath(dir);
         const submit = buildProviderSubmitHandler(join(dir, "settings.json"), null, localPath);
         let commits = 0;

src/tui/provider-setup-submit.ts

@@ -51,20 +51,9 @@ export function buildProviderSubmitHandler(
     const trimmedKey = apiKey.trim();
     const selectedModel = model.trim();
 
-    // A signed-in subscription provider has no key to test or store in
-    // settings. Its exchanged credentials remain staged until this path has
-    // authorized persistence.
-    //
-    // Unlike a pasted key, this credential was just issued by the real
-    // provider's own OAuth server completing a PKCE round-trip — so the
-    // token is real. That still doesn't confirm it carries usable API scope
-    // (vs. e.g. a chat-only subscription), which would otherwise surface as
-    // a confusing first-send auth error with no setup-attributable hint.
-    // Probe the provider's own catalog endpoint with the issued token before
-    // treating onboarding as complete: a definitive scope rejection blocks
-    // the submit with an actionable message (mirrors the API-key path's
-    // connection test); a check that could not run at all (network blip,
-    // timeout, rate limit) never blocks — only a proven scope failure does.
+    // OAuth credentials stay staged until setup validation authorizes durable
+    // persistence. Definitive API-scope or credential failures block the save;
+    // inconclusive probe failures do not.
     if (oauth !== undefined) {
       if (!skipValidation) {
         const scopeCheck = await checkOAuthProviderScope(oauth.kind, oauth.tokens);

src/tui/provider-setup.test.ts

@@ -498,7 +498,6 @@ describe("runProviderSetup sign-in", () => {
     expect(seen[0]?.apiKey).toBe("");
     expect(opts[0]?.oauth).toMatchObject({
       kind: "codex",
-      profile: "default",
       providerName: "codex/default",
       tokens: { access: "test-access", refresh: "test-refresh", expiresAt: 10_000 },
     });

src/tui/provider-setup.ts

@@ -655,7 +655,6 @@ export interface SubmitOpts {
 
 export interface OAuthResult {
   readonly kind: OAuthKind;
-  readonly profile: string;
   readonly tokens: CodexTokens | XaiTokens;
   readonly commit: () => Promise<void>;
   /** Settings/catalog name the stored profile projects to. */
@@ -1379,7 +1378,6 @@ export async function runProviderSetup(config: ProviderSetupConfig): Promise<boo
     loginError = null;
     const result: OAuthResult = {
       kind,
-      profile: staged.profile.name,
       tokens: staged.profile.tokens,
       commit: staged.commit,
       providerName: oauthProviderName(kind, staged.profile.name),