Drop OAuth settings entries without a live profile

Author: TheGreatAxios

src/config/index.ts

@@ -101,6 +101,30 @@ function applyPersistedOAuthDefaults(
   return merged;
 }
 
+// OAuth entries in settings.json carry no credentials; they are only usable
+// while a matching auth-store profile exists. Drop orphans in memory so a
+// removed profile does not pin resolution to an unauthenticatable provider.
+function dropOrphanedOAuthEntries(
+  settings: Settings | null,
+  projected: Record<string, ProviderSettings>,
+): Settings | null {
+  if (settings === null) return null;
+  const providers = Object.fromEntries(
+    Object.entries(settings.providers).filter(
+      ([name]) =>
+        (!isCodexProviderName(name) && !isXaiProviderName(name)) || projected[name] !== undefined,
+    ),
+  );
+  const { defaultProvider, ...rest } = settings;
+  return {
+    ...rest,
+    providers,
+    ...(defaultProvider !== undefined && providers[defaultProvider] !== undefined
+      ? { defaultProvider }
+      : {}),
+  };
+}
+
 function hasExaEntry(servers: MCPServerSettingsEntry[] | undefined): boolean {
   return servers?.some((server) => server.name === EXA_MCP_SERVER_NAME) === true;
 }
@@ -719,13 +743,16 @@ export async function loadConfig(
   dangerouslySkipPermissions =
     dangerouslySkipPermissions || settings?.dangerouslySkipPermissions === true;
   projectedOAuthProviders = applyPersistedOAuthDefaults(settings, projectedOAuthProviders);
+  const liveSettings = useOAuthProfiles
+    ? dropOrphanedOAuthEntries(settings, projectedOAuthProviders)
+    : settings;
   const settingsForResolution: Settings | null =
     Object.keys(projectedOAuthProviders).length > 0
       ? {
-          ...(settings ?? { providers: {} }),
-          providers: { ...(settings?.providers ?? {}), ...projectedOAuthProviders },
+          ...(liveSettings ?? { providers: {} }),
+          providers: { ...(liveSettings?.providers ?? {}), ...projectedOAuthProviders },
         }
-      : settings;
+      : liveSettings;
 
   // The per-repo selection file still applies on top of a --config source: that
   // file supplies provider definitions, while .corbits/settings.json supplies

tests/unit/config.test.ts

@@ -376,6 +376,49 @@ test("aliased-home restart preserves a non-default OAuth model", async () => {
   }
 });
 
+test("loadConfig ignores a persisted OAuth entry whose auth profile is gone", async () => {
+  const fakeHome = await mkdtemp(join(tmpdir(), "ic-unit-config-oauth-orphan-home-"));
+  try {
+    await mkdir(join(fakeHome, ".corbits"), { recursive: true });
+    const settingsPath = join(fakeHome, ".corbits", "settings.json");
+    const original = JSON.stringify({
+      defaultProvider: "xai/gone",
+      providers: {
+        "xai/gone": {
+          baseURL: "https://api.x.ai/v1",
+          models: ["grok-4"],
+          defaultModel: "grok-4",
+        },
+        openai: {
+          baseURL: "https://api.openai.com/v1",
+          apiKey: "test-key",
+          models: ["gpt-5"],
+        },
+      },
+    });
+    await writeFile(settingsPath, original);
+
+    await withMockedModuleDuring(
+      import.meta.resolve("node:os"),
+      (real: typeof import("node:os")) => ({ ...real, homedir: () => fakeHome }),
+      async () => {
+        const { impl } = offlineFetch();
+        const config = await loadConfig(["--cwd", fakeHome, "do something"], {
+          pricing: { fetchImpl: impl },
+        });
+        expect(config.configured).toBe(true);
+        if (config.configured) {
+          expect(config.providerName).toBe("openai");
+          expect(config.providers.some((p) => p.name === "xai/gone")).toBe(false);
+        }
+      },
+    );
+    expect(await readFile(settingsPath, "utf8")).toBe(original);
+  } finally {
+    await rm(fakeHome, { recursive: true, force: true });
+  }
+});
+
 // Regression: OAuth credentials for an xai/<profile> provider are never read
 // from settings.json — home-level auth stores are the source of truth, and
 // loadConfig merges them into the catalog it hands to resolveProvider (see