Reproduce CL-6728 OAuth projection overwrite of hand-named providers

Author: TheGreatAxios

src/config/index.ts

@@ -135,7 +135,7 @@ function applyPersistedOAuthDefaults(
 // OAuth entries in settings.json carry no credentials; they are only usable
 // while a matching auth-store profile exists. Drop orphans in memory so a
 // removed profile does not pin resolution to an unauthenticatable provider.
-function dropOrphanedOAuthEntries(
+export function dropOrphanedOAuthEntries(
   settings: Settings | null,
   projected: Record<string, ProviderSettings>,
 ): Settings | null {
@@ -158,6 +158,22 @@ function dropOrphanedOAuthEntries(
   };
 }
 
+// Overlay live OAuth profile projections onto settings for runtime provider
+// resolution. Exported for tests; loadConfig is the only production caller.
+export function overlayOAuthProjections(
+  settings: Settings | null,
+  projected: Record<string, ProviderSettings>,
+): Settings | null {
+  if (Object.keys(projected).length === 0) return settings;
+  return {
+    ...(settings ?? { providers: {} }),
+    providers: {
+      ...(settings?.providers ?? {}),
+      ...projected,
+    },
+  };
+}
+
 function hasExaEntry(servers: MCPServerSettingsEntry[] | undefined): boolean {
   return (
     servers?.some((server) => server.name === EXA_MCP_SERVER_NAME) === true
@@ -936,16 +952,10 @@ export async function loadConfig(
   const liveSettings = useOAuthProfiles
     ? dropOrphanedOAuthEntries(settings, projectedOAuthProviders)
     : settings;
-  const settingsForResolution: Settings | null =
-    Object.keys(projectedOAuthProviders).length > 0
-      ? {
-          ...(liveSettings ?? { providers: {} }),
-          providers: {
-            ...(liveSettings?.providers ?? {}),
-            ...projectedOAuthProviders,
-          },
-        }
-      : liveSettings;
+  const settingsForResolution: Settings | null = overlayOAuthProjections(
+    liveSettings,
+    projectedOAuthProviders,
+  );
 
   // The per-repo selection file still applies on top of a --config source: that
   // file supplies provider definitions, while .corbits/settings.json supplies

src/config/oauth-catalog.test.ts

@@ -1,7 +1,17 @@
 import { describe, expect, test } from "bun:test";
 import type { CodexProfile } from "../auth/codex/store.js";
 import type { XaiProfile } from "../auth/xai/store.js";
-import { mergeOAuthCatalog } from "./index.js";
+import {
+  codexProfilesToCatalogEntries,
+  codexProvidersAsSettings,
+} from "./codex-providers.js";
+import {
+  dropOrphanedOAuthEntries,
+  mergeOAuthCatalog,
+  overlayOAuthProjections,
+  providerCatalogToSettings,
+  runtimeSettingsWithCatalog,
+} from "./index.js";
 import type {
   ProviderSettings,
   ResolvedProvider,
@@ -89,3 +99,103 @@ describe("mergeOAuthCatalog legacy bare-row dedupe (CL-5606)", () => {
     expect(merged.map((p) => p.name)).toEqual(["openai", "codex/default"]);
   });
 });
+
+describe("CL-6728: OAuth projections do not overwrite hand-named provider entries", () => {
+  const handNamed = (): ProviderSettings => ({
+    baseURL: "https://hand-named.example.com/v1",
+    apiKey: "hand-named-key",
+    models: ["hand-model"],
+  });
+  const liveMine: CodexProfile = {
+    name: "mine",
+    tokens: { access: "live-token", refresh: "r", expiresAt: 1 },
+    createdAt: 0,
+  };
+  const liveProjected = () => codexProvidersAsSettings([liveMine]);
+  const liveCatalog = () => codexProfilesToCatalogEntries([liveMine]);
+
+  test("overlayOAuthProjections keeps a hand-named codex/<slug> API-key entry", () => {
+    const overlaid = overlayOAuthProjections(
+      settingsWith({ "codex/mine": handNamed() }),
+      liveProjected(),
+    );
+    expect(overlaid?.providers["codex/mine"]?.apiKey).toBe("hand-named-key");
+  });
+
+  test("overlayOAuthProjections still applies the live token over a credential-less OAuth placeholder", () => {
+    const overlaid = overlayOAuthProjections(
+      settingsWith({ "codex/mine": entry() }),
+      liveProjected(),
+    );
+    expect(overlaid?.providers["codex/mine"]?.apiKey).toBe("live-token");
+  });
+
+  test("dropOrphanedOAuthEntries never drops a hand-named API-key entry", () => {
+    const kept = dropOrphanedOAuthEntries(
+      settingsWith({ "codex/mine": handNamed() }),
+      {},
+    );
+    expect(kept?.providers["codex/mine"]?.apiKey).toBe("hand-named-key");
+  });
+
+  test("dropOrphanedOAuthEntries still drops a credential-less orphan", () => {
+    const dropped = dropOrphanedOAuthEntries(
+      settingsWith({ "codex/mine": entry() }),
+      {},
+    );
+    expect(dropped?.providers["codex/mine"]).toBeUndefined();
+  });
+
+  test("runtimeSettingsWithCatalog keeps a hand-named codex/<slug> API-key entry", () => {
+    const runtime = runtimeSettingsWithCatalog(
+      settingsWith({ "codex/mine": handNamed() }),
+      liveCatalog(),
+    );
+    expect(runtime.providers["codex/mine"]?.apiKey).toBe("hand-named-key");
+  });
+
+  test("runtimeSettingsWithCatalog still overlays the live token over a placeholder", () => {
+    const runtime = runtimeSettingsWithCatalog(
+      settingsWith({ "codex/mine": entry() }),
+      liveCatalog(),
+    );
+    expect(runtime.providers["codex/mine"]?.apiKey).toBe("live-token");
+  });
+
+  test("mergeOAuthCatalog keeps a hand-named codex/<slug> entry when its profile is live", () => {
+    const merged = mergeOAuthCatalog(
+      settingsWith({ "codex/mine": handNamed() }),
+      resolved,
+      [liveMine],
+      [],
+    );
+    const rows = merged.filter((p) => p.name === "codex/mine");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.apiKey).toBe("hand-named-key");
+    expect(rows[0]?.codexProfile).toBeUndefined();
+  });
+
+  test("mergeOAuthCatalog keeps a hand-named codex/<slug> entry with no live profile", () => {
+    const merged = mergeOAuthCatalog(
+      settingsWith({ "codex/mine": handNamed() }),
+      resolved,
+      [],
+      [],
+    );
+    expect(merged.find((p) => p.name === "codex/mine")?.apiKey).toBe(
+      "hand-named-key",
+    );
+  });
+
+  test("persist round-trip keeps the hand-named key and no login token", () => {
+    const merged = mergeOAuthCatalog(
+      settingsWith({ "codex/mine": handNamed() }),
+      resolved,
+      [liveMine],
+      [],
+    );
+    const persisted = providerCatalogToSettings(merged, undefined);
+    expect(persisted.providers["codex/mine"]?.apiKey).toBe("hand-named-key");
+    expect(JSON.stringify(persisted)).not.toContain("live-token");
+  });
+});