GPT-5 finding
upsertAuthProfileWithLock stores raw secrets without normalization (inconsistent with upsertAuthProfile)
mediumapi-contracthigh
- src/agents/auth-profiles/profiles.ts:53-63
- src/agents/auth-profiles/profiles.ts:74-80
The non-locking upsert path normalizes API keys/tokens, trimming or cleaning inputs. The locking variant writes the credential object as-is, which can persist secrets with trailing whitespace/newlines and lead to auth failures or inconsistent behavior depending on which API is used.
Recommendation
Apply the same normalization in upsertAuthProfileWithLock as in upsertAuthProfile (e.g., reuse the normalization branch or call normalizeSecretInput on key/token fields before updating the store). Consider delegating both code paths to a common helper to avoid drift.