Repository navigation
Conversation
…h renew `gflow credits list` used to renew a stale profile's session as a side effect of its browser fallback. #802 rightly stopped re-asking aisandbox-pa with the same Bearer, and with it went the only automatic renewal. `--refresh` brings it back as an opt-in on `credits user` and `credits list` (MCP twin: `gflow_get_credits(refresh=true)`): a profile whose fast path raises an expired-session error is renewed headlessly and asked again; others are untouched, and a failed renewal keeps the fast path's diagnosis. The renewal is the new `gflow auth renew` (`auth/renew.py`). Measured live, loading FLOW_URL alone does not fix the credits path: it 308s to flow.google.com, so labs' NextAuth never runs. A stale labs session answers 200 with an expired token and ACCESS_TOKEN_REFRESH_NEEDED; the labs page's own JS re-signs in silently ~2.5 s after load. Renewal now loads labs.google/fx/ and polls the session until that error clears (bounded 20 s). Spike: docs/superpowers/spikes/2026-10-14-labs-nextauth-silent-refresh.md. Live: `credits list --refresh` 3 -> 7 of 10 profiles readable (510 -> 939 credits). The 3 left land on Flow's public page (the open /about entry); gflow-api's --refresh fails on them too. New e2e tests/e2e/test_credits_refresh_e2e.py passes on both doors against two genuinely stale profiles.
…h errors, docs Must-fix items from the review at 0c370f6: 1. skills/gflow-cli (+ plugin copy) and skillopt tasks.json no longer say `gflow auth renew` does not exist; auth-004/error-002 now expect it, with `auth login` as partial credit for the revoked case. 2. A browser that cannot launch is a per-profile `launch_error` row in `auth renew` (no traceback, no lost rows), and under `credits --refresh` re-raises the fast path's diagnosis `from` the launch error. 3. `renew_profile` returns RenewResult (verdict + Flow landing + final labs staleness). An /about landing or a still-stale labs session is NOT renewed, whatever the verifier says: `auth renew` reports public_landing/labs_stale, exits 1 and points at login + "Confirm it's you"; `credits --refresh` keeps its diagnosis. Live on an /about profile: exit 1 / exit 3 as designed. 4. USAGE no longer ties --refresh's limits to host membership; the credits 401 hint points at --refresh / `gflow auth renew` instead of "check Flow". 5. KNOWN_ISSUES session-expiry entry, AUTHENTICATION § Refresh / expiry and the MCP.md 401 row describe renewal; mirrors regenerated. 6. tests/e2e/test_auth_renew_e2e.py covers the leaf (live profile, in-use skip, stale profile, /about honesty); E2E_TESTING documents the env vars. Nice-to-haves: MCP description no longer says read-only; MCP.md "twin" wording matches the parity exemption; --json on every auth renew path; the labs poll caps each request at the remaining budget; AGENTS.md surface line; spike script runs the #477 guard; headless sign-in note; unit tests for launch failure, non-JSON body, zero profiles, engine_downgrade.
…ewResult Re-review of #982 at dbad8eb: - A labs session reply that is not a 200 JSON object, or a failed labs request, now leaves labs_stale=None and the renewal is reported `labs_unverified`, not renewed. Before, a 500, a 401 or an HTML body read as "fresh" and `auth renew` printed "renewed and verified". - RenewResult.result owns the row value, and `renewed` derives from it, so `auth renew` and `credits --refresh` cannot disagree. A public landing now wins over the verdict: on /about profiles the verifier answered google_session_only (measured 2026-10-15) and the row carried no /about guidance. - labs_stale / labs_unverified rows get their own message instead of the /about one. - Hints: the no-token hint states renewal does not change it, and drops the host-predicts-it claim; the 401 hint names refresh=true for MCP and no longer loops after a renewal that did not take. Same for docs/MCP.md. - skillopt auth-004: "No session for profile" means the profile dir is missing; renew cannot fix that, login can. - CHANGELOG covers the row values and the hint change. - e2e: the /about test asserts `public_landing`; the live-profile test skips when the profile reads no balance before renewal (#795). Signed-off-by: Flavio Oliva <ffroliva@gmail.com>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…re-ask Adversarial review of fe8f5a7: - e2e: the live-profile guard skipped on any AuthExpiredError, so an expired token (the case renewal exists for) would have skipped the test. It now skips only when labs issues no token at all (#795). - A public landing re-labels only the verdicts measured on /about (authenticated, google_session_only); no_session / verification_error are reported as themselves instead of a guessed "confirm it's you". - credits --refresh still re-asks on labs_unverified: it is one HTTP call that checks itself, and the Flow visit may have rotated what it needs. auth renew keeps refusing to claim success there. - AUTHENTICATION.md: a network that blocks labs.google makes auth renew exit 1 (labs_unverified) even when the Flow session verifies. Signed-off-by: Flavio Oliva <ffroliva@gmail.com>
Owner
Author
|
SonarCloud gate passed on 9073ad7 (run 38728865708; the scan step executed). The mirror has done its job, so I'm closing it and deleting the branch. |
3 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Maintainer SonarCloud check for fork PR #982 at
fe8f5a78. Fork PRs get no SONAR_TOKEN, so the gate is skipped there. This draft exists only to run the scan, and will be closed and its branch deleted once the gate reports. Do not merge.