From d53ddf6b82c101d35894587afc9b0d135a5abc55 Mon Sep 17 00:00:00 2001 From: Dotta Date: Thu, 10 Sep 2026 12:37:10 -0500 Subject: [PATCH] fix: isolate saved Claude login cache from other providers Keep disabled provider queries from reading a cached Claude subscription, and cover Codex setup after a Claude login. Co-Authored-By: Paperclip --- .../new-agent/AgentProviderConnection.test.tsx | 13 +++++++++++++ .../onboarding/SavedProviderKeySelect.tsx | 4 +++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/ui/src/components/new-agent/AgentProviderConnection.test.tsx b/ui/src/components/new-agent/AgentProviderConnection.test.tsx index 28f81ffcdef..2116e0e6ccf 100644 --- a/ui/src/components/new-agent/AgentProviderConnection.test.tsx +++ b/ui/src/components/new-agent/AgentProviderConnection.test.tsx @@ -38,6 +38,7 @@ async function mount( canLogin = true, codexSubscriptions = false, savedApiKeys = true, + cachedClaudeLogin = false, ) { const key = adapterType === "claude_local" ? "ANTHROPIC_API_KEY" : "OPENAI_API_KEY"; @@ -86,6 +87,10 @@ async function mount( mocks.organization.mockResolvedValue([]); } client = new QueryClient({ defaultOptions: { queries: { retry: false } } }); + if (cachedClaudeLogin) { + client.setQueryData(["claude-oauth-token-status", "c1"], { secretId: "cached-claude", latestVersion: 1 }); + mocks.auth.mockResolvedValue({ status: "absent" }); + } host = document.createElement("div"); document.body.appendChild(host); root = createRoot(host); @@ -132,6 +137,14 @@ describe("AgentProviderConnection reuse", () => { expect(host.querySelector('input[type="password"]')).not.toBeNull(); }); + it("does not use a cached Claude login for Codex", async () => { + await mount("codex_local", false, true, false, false, true); + openProvider(); + expect(host.textContent).toContain("New subscription login"); + expect(host.textContent).not.toContain("saved Claude subscription"); + expect(host.textContent).not.toContain("Use saved subscription"); + expect(mocks.login).not.toHaveBeenCalled(); + }); it("reuses a saved ChatGPT account when the sandbox auth signal is unknown", async () => { const { test, connected } = await mount("codex_local", false, true, true); openProvider(); diff --git a/ui/src/components/onboarding/SavedProviderKeySelect.tsx b/ui/src/components/onboarding/SavedProviderKeySelect.tsx index 4a82ae4859a..4ee6fa265f1 100644 --- a/ui/src/components/onboarding/SavedProviderKeySelect.tsx +++ b/ui/src/components/onboarding/SavedProviderKeySelect.tsx @@ -27,7 +27,9 @@ export function useSavedProviderKeys( retry: false, }); const storedLogin = useQuery({ - queryKey: ["claude-oauth-token-status", companyId], + // Disabled queries still return cached data. Keep other providers away + // from the shared Claude login cache. + queryKey: ["claude-oauth-token-status", envKey === "ANTHROPIC_API_KEY" ? companyId : null], queryFn: async () => { try { return await agentsApi.getClaudeOAuthTokenStatus(companyId!);