Opus finding
OAuth refresh persists merged credentials with potentially stale fields when refresh result spreads after original cred
mediumbugmedium
- src/agents/auth-profiles/oauth.ts:78-86
The spread order is `...cred, ...result.newCredentials, type: "oauth"`. This is generally correct (new credentials override stored ones), but `result.newCredentials` for Chutes/Qwen branches comes directly from refresh functions that may not include `provider`, `email`, `projectId`, or other fields that the stored credential carries. The spread preserves those, which is intentional. However, if `refreshChutesTokens` or `refreshQwenPortalCredentials` returns credentials missing `expires` or with malformed `access`, the merged record will silently retain old `expires` (good) or replace with bad value (bad). This is a real concern only if those functions return partial objects; without seeing them this is speculative.
Recommendation
Validate that `result.newCredentials.expires` is a finite future timestamp before persisting, and explicitly construct the persisted record with required fields rather than spreading.