[WRONG BRANCH] fix(oauth): require verified proxy before live credential update

[luvs01]

Motivation

• Close a regression where the CLI could post credential-bearing provider config to any process answering a spoofed /healthz on the configured port when no validated runtime identity existed.

Description

• Require a PID-verified live proxy before sending provider configuration by returning early when findLiveProxy() yields no PID (i.e. live.pid === null) in notifyRunningProxy. 【F:src/oauth/login-cli.ts†L18-L31】
• Add a regression test that spins a fake listener advertising a legacy/spoofable /healthz and asserts no credential-bearing POST is received. 【F:tests/oauth-login-cli-live-update.test.ts†L55-L77】
• Export notifyRunningProxy for direct testing and keep the existing notifyRunningProxyAfterOAuthLogin shim that loads disk config before notifying live proxy. 【F:src/oauth/login-cli.ts†L1-L35】【F:src/oauth/login-cli.ts†L36-L50】

Testing

• Ran the focused tests: bun test tests/oauth-login-cli-live-update.test.ts tests/proxy-liveness.test.ts, and the two modified/targeted tests passed (23 passing tests, 0 failing). ✅
• Ran typecheck: bun run typecheck succeeded. ✅
• Ran privacy scan: bun run privacy:scan succeeded. ✅
• Ran the broader test suite bun run test; the run progressed with many passing tests but encountered unrelated timeouts in some combo-management tests during a full run (these are not related to this change). ⚠️

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Improved OAuth security by ensuring live configuration updates are sent only to verified proxy processes.
  • Prevented provider credentials from being sent to spoofed listeners that merely respond as healthy.

• Tests

  • Added regression coverage confirming that unverified listeners do not receive OAuth configuration updates.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⚠️ Wrong target branch

This pull request currently targets main, but pull requests must target one of dev.

@luvs01 Please retarget this PR to dev. All contributions go to dev; main receives only release promotions. See our Contributing guide for details. Thanks! 🙏

Its title has been prefixed with [WRONG BRANCH].

This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5895bcd9-b5b5-4bd9-915d-a8c0f24afc7c

📥 Commits

Reviewing files that changed from the base of the PR and between 8a9c0ef and 8cb7c9d.

📒 Files selected for processing (2)

• src/oauth/login-cli.ts
• tests/oauth-login-cli-live-update.test.ts

---

📝 Walkthrough

Walkthrough

The OAuth live-update path now requires a discovered proxy to have an identity-verified PID before sending provider configuration. A regression test confirms that a spoofed listener on the configured port receives no request.

Changes

OAuth proxy notification

Layer / File(s)	Summary
Require verified proxy identity src/oauth/login-cli.ts, tests/oauth-login-cli-live-update.test.ts	At lines 23–25, notifyRunningProxy returns when no live proxy or PID is available. The regression test at lines 56–78 uses a fake configured-port listener and verifies that no request receives credentials.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ingwannu, lidge-jun, invalid-email-address, wonsh42

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: requiring a verified proxy before sending OAuth credentials.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-vulnerability-in-login-process

---

_{Comment @coderabbitai help to get the list of available commands.}