2 Commits

Author	SHA1	Message	Date
Diego Rodrigues de Sa e Souza	3d4f3e4960	test(infra): retry recursive temp-dir removal instead of failing a shard on ENOTEMPTY (#11966) (#11968) ... * test(infra): retry recursive temp-dir removal instead of failing a shard on ENOTEMPTY (#11966) Two shards on release/v3.8.51 went red in one day with the same signature — "ENOTEMPTY, Directory not empty: /tmp/omniroute-<test>-XXXXXX" — from combo-same-provider-cascade (Unit Tests fast-path 4/4, on a PR that touches only .github/) and auth-policy-embeddings-webfetch-7785 (the 20k-test TIA step). Both pass alone and on re-run: the cleanup races something still writing into the directory (SQLite WAL/-shm checkpoint, a worker, the backup) and under a loaded hosted runner the window opens. 1154 test files do their own cleanup with fs.rmSync(dir, { recursive: true, force: true }); 57 already asked for retries. One-shot codemod (scripts/ad-hoc/codemod-rm-maxretries.mjs, kept for the record): every rm / rmSync / rmdirSync option object with `recursive: true` and no `maxRetries` gains `maxRetries: 5, retryDelay: 100` — Node itself then retries ENOTEMPTY/EBUSY/EPERM for up to ~0.5 s before giving up. 2243 call sites in 1292 files under tests/, the shared tests/_setup/isolateDataDir.ts exit hook included. Only the option object changes: no call site, assertion or import is touched. Validation: prettier and ESLint (with the frozen suppressions) clean on all 1292 files; a random 20-file sample runs green (quota-redis-store hangs identically on the untouched tree — it needs a Redis on localhost, an environment matter). The four unit shards on this PR are the full run. * fix(quality): let check-forgotten-sibling-tests read a 1,000-file diff The gate shells out to `git diff` through execFileSync with Node's default 1 MB maxBuffer; the 1,292-file codemod in this PR is the first diff large enough to overflow it, and the gate died with `spawnSync git ENOBUFS` before comparing anything. 64 MB is far above any real PR and costs nothing when unused.	2026-08-29 01:17:40 -03:00
stanley	4540d303d7	fix(oauth): send required CLI headers in claude-auth import bootstrap call (#10144) ... * fix(oauth): send required CLI headers in claude-auth import bootstrap call enrichWithBootstrap() in claudeAuthImport.ts was missing the User-Agent and anthropic-beta headers that the two other callers of the same /api/claude_cli/bootstrap endpoint (claudeIdentity.ts and src/lib/oauth/providers/claude.ts) always send. Without them, Anthropic doesn't recognize the request as coming from a CLI client and the bootstrap call fails, silently returning a null identity (accountUUID/organizationUUID/organizationType all null). createConnectionFromAuthFile()'s identity-verification refusal then gets bypassed via overwriteExisting: true (the only way imports currently succeed, since first attempts fail with identity_unverified because of this same bug), so every imported Claude connection ends up with unverified identity. Downstream, resolveAccountUUID() in claudeIdentity.ts falls back to a hash-derived fake UUID when providerSpecificData.accountUUID is null. That fake UUID is shape-valid but was never associated with the real account by Anthropic, so requests carrying it get classified as unrecognized third-party traffic and routed to the separate extra-usage pool instead of the account's plan limits -- producing an intermittent (~50% observed) 400: "Third-party apps now draw from your extra usage, not your plan limits." on an otherwise perfectly valid, imported subscription token. Fixes the header mismatch so bootstrap succeeds and imported connections get a real, Anthropic-recognized account identity from the start, same as connections created via the native OAuth flow. Fixes #10143 * fix(oauth): persist cliUserID device identity on claude-auth import createConnectionFromAuthFile() in claudeAuthImport.ts never set providerSpecificData.cliUserID, unlike the native OAuth setup flow in src/lib/oauth/providers/claude.ts which always mints one. cliUserID is read by resolveCliUserID() (open-sse/executors/claudeIdentity.ts) as the request's device_id; when absent it falls back to a lazy-random device id regenerated fresh every process restart (in-memory Map, process-lifetime only), so every restart of an imported connection presents as a brand-new device to Anthropic for the same account -- a second, independent contributor (alongside Part 1's bootstrap header fix in this same PR) to the intermittent third-party-usage 400 on valid imported subscription tokens. - "create new connection" branch: always mint a fresh cliUserID. - "update existing connection" branch: preserve any already-persisted cliUserID from existing.providerSpecificData (don't rotate a working device identity on re-import); only mint a fresh one if absent. Adds changelog.d/fixes/10144-claude-import-cli-user-id.md per CONTRIBUTING.md. Fixes #10143 * test(oauth): cover claude-auth import bootstrap headers + cliUserID persistence Adds tests/unit/claudeAuthImport-bootstrap-headers-10144.test.ts (Rule #18 regression guard for #10143): 1. enrichWithBootstrap() sends the required CLI headers on the /api/claude_cli/bootstrap call — a claude-cli User-Agent (now sourced from CLAUDE_CODE_CLIENT_VERSION, matching the two working call-sites) and anthropic-beta: oauth-2025-04-20 — and still falls back to null identity fields on non-OK upstream responses. 2. createConnectionFromAuthFile() mints a 64-hex cliUserID device identity on create, preserves an already-persisted cliUserID on overwrite re-import (no rotation), and mints a fresh one when the existing connection has none. Also aligns the hardcoded claude-cli/1.0.0 User-Agent in the import bootstrap with the version constant the two working call-sites (claudeIdentity.ts, oauth/providers/claude.ts) already use. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(oauth): source claude-auth import UA from canonical constant (#10144 review nit) Addresses the hardcoded-version nit from review: the bootstrap User-Agent was re-typed as `claude-cli/${CLAUDE_CODE_CLIENT_VERSION}` instead of importing getClaudeCodeUserAgent() — the single source of truth the two working call-sites (claudeIdentity.ts, oauth/providers/claude.ts) use. - claudeAuthImport.ts: use getClaudeCodeUserAgent("cli") for the bootstrap call - test: import the same canonical helper instead of a local copy of the pinned version, and assert the outbound UA byte-for-byte against it, so a future version bump can't silently desync the wire identity. Verified: node --import tsx/esm --test on the new test file -> 5/5 pass; sibling claudeAuthImport.test.ts -> pass; eslint on both changed files -> no new findings (only the pre-existing @/lib/localDb barrel-import restriction on an untouched import line). * test(oauth): exercise claude auth import implementation Replace copied helper tests with real implementation coverage for bootstrap headers and persistent cliUserID behavior. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: stanleytejakusuma <stanleytejakusuma@users.noreply.github.com>	2026-08-17 08:01:45 -03:00