The route at `src/app/api/oauth/[provider]/[action]/route.ts` invokes
`providerData.mapTokens({ accessToken: token })` (object), matching the
cursor/kiro signature. The windsurf provider was declared with
`mapTokens(token: string)` instead, so the entire object was stored as
`accessToken`. When the connection record reached the SQLite layer it
crashed with:
SQLite3 can only bind numbers, strings, bigints, buffers, and null
Fix by aligning windsurf's `mapTokens` signature with the route caller
and the cursor/kiro convention. Also dedupe a copy-pasted second
`if (action === "import-token")` block in the route handler — the
second block was unreachable but identical to the first.
Adds two regression tests asserting that
`provider.mapTokens({ accessToken })` returns a string `accessToken` for
both windsurf and devin-cli, so a future signature drift trips the gate
instead of the SQLite bind error in production.
Phase 1 hotfix: hide the 'Browser Login' tab and start in Paste API Key
mode. Removes windsurf/devin-cli from PKCE_CALLBACK_SERVER_PROVIDERS so
no callback server is started for them. Codex still uses the PKCE flow.
The 'Get token' link continues to point at windsurf.com/show-auth-token
via the existing supportsTokenPaste form copy.
Post-merge contract fixes for v3.8.6:
- src/app/api/cli-tools/logs/route.ts (#2810) now uses the shared
requireCliToolsAuth guard (param renamed req->request) to satisfy the
cli-tools-auth-hardening contract test.
- Document OMNIROUTE_OPENCODE_QUOTA_URL (#2867) in docs/reference/ENVIRONMENT.md
to satisfy the env/docs sync contract.
No behaviour change - comment-only update documenting that authorizeUrl,
codeChallengeMethod, callbackPort, callbackPath, apiServerUrl, and
exchangePath are no longer consumed. Active fields (inferenceUrl,
showAuthTokenUrl, firebaseApiKey, ideName) called out separately.
start-callback-server, authorize, and poll-callback (GET + POST) now
return 410 Gone with a pointer to /import-token. The 410 short-circuit
runs before auth so the response is honest about the action being
permanently gone, not gated. Codex PKCE flow unchanged.
Tests: 5 new assertions cover GET + POST 410 paths and a Codex
regression check.
Two-phase plan to fix the broken Windsurf OAuth flow:
- Phase 1: drop the dead app.devin.ai/editor/signin PKCE path, promote
import-token from windsurf.com/show-auth-token as the primary path
- Phase 2: port Firebase OAuth + RegisterUser flow from
fendoushaonian/WindSurf-gRPC-API for full browser-based automation
Spec only - no code changes yet.
Aligns the documented coverage gate with the v3.8.6 release decision
(lowered from 75/75/75/70). Matches the threshold already set in
package.json by the large feature PRs (planos 11-22).
These files were dirty in the worktree at session start and survived all
R3/R4/R5 fix work untouched — they belong to the review-discussions skill
and are independent of the AgentBridge/Traffic Inspector implementation.
Committing here so the worktree is clean for removal.
In startMitm(), read AGENTBRIDGE_UPSTREAM_CA_CERT (env wins over stored path in
<dataDir>/mitm/upstream-ca.path) and call configureUpstreamCa() at process start;
failures are caught and logged — boot continues without custom CA. In the POST
/api/tools/agent-bridge/upstream-ca handler, call configureUpstreamCa() immediately
after persisting the new path so the CA takes effect without reboot; throws → 400
with sanitizeErrorMessage (Hard Rule #12). New test file
tests/unit/mitm-upstream-ca-wiring.test.ts validates the path-selection logic and
the route wiring (8 tests, 0 failures).
Third code-review pass on plan 21 found two follow-up issues from the
previous round.
1. extractLastUserText accepted Responses API items with role===undefined
regardless of their type. function_call_output / tool_call_output /
reasoning items would slip through and be treated as user query input,
leaking the tool's reply or the model's chain of thought into the
memory retrieval query.
Fix: when role is undefined, skip items whose type is in a denylist of
non-user item types (function_call, function_call_output, tool_call,
tool_call_output, reasoning, computer_call, computer_call_output,
web_search_call, file_search_call). Also reject non-text content
parts inside multi-modal arrays (image_url, tool_use, ...) so that
image-only or tool-only user messages do not produce a query made of
irrelevant fragments.
2. MemoryEngineStatus introduced t("engine.configureCta") in round 2 but
the key was never added to en.json / pt-BR.json — even with the new
EN fallback merger, the CTA would render the literal key path.
Added "Configure" / "Configurar" to both locales.
Verified: typecheck:core clean; vitest UI 46/46; cli-memory-commands,
memory-settings, and mcp-memory-tools-strategy isolated sanity all
green; grep audit of memory.* i18n keys used by the UI confirms zero
missing keys in en.json.
Replaces 15 raw console.log/console.error calls in src/mitm/manager.ts with
structured pino logger calls via createLogger("mitm-manager"), aligning with
the project convention documented in docs/architecture/RESILIENCE_GUIDE.md.
Multi-arg console calls are converted to pino object form: logger.info({ x, y }, "msg").
