From 20f355f2368ccf17f9a3270cb2b745e8166cf043 Mon Sep 17 00:00:00 2001
From: Ayaan Zaidi <hi@obviy.us>
Date: Thu, 9 Jul 2026 11:30:12 +0530
Subject: [PATCH] fix(agents): adopt relogged credential inside locked cas-miss
 recovery

---
 src/agents/auth-profiles/oauth-manager.ts | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/src/agents/auth-profiles/oauth-manager.ts b/src/agents/auth-profiles/oauth-manager.ts
index c90152ef32a8..fb811b149c59 100644
--- a/src/agents/auth-profiles/oauth-manager.ts
+++ b/src/agents/auth-profiles/oauth-manager.ts
@@ -472,16 +472,10 @@ export function createOAuthManager(adapter: OAuthManagerAdapter) {
     profileId: string;
     refreshed: OAuthCredential;
   }): Promise<OAuthCredential | null> {
-    const currentStore = loadStoredOAuthRefreshStore(params.agentDir);
-    const current = currentStore.profiles[params.profileId];
-    if (current?.type !== "oauth" || current.provider !== params.refreshed.provider) {
-      return null;
-    }
-    if (!hasMatchingOAuthIdentity(current, params.refreshed)) {
-      return hasUsableOAuthCredential(current) ? current : null;
-    }
-
-    let saved = false;
+    // Single locked pass decides both outcomes so no relog can slip between a
+    // pre-read and the update: same identity persists the rotation, different
+    // identity adopts the stored (re-logged) credential for this call.
+    let adopted: OAuthCredential | null = null;
     const result = await updateAuthProfileStoreWithLock({
       agentDir: params.agentDir,
       updater: (store) => {
@@ -493,13 +487,14 @@ export function createOAuthManager(adapter: OAuthManagerAdapter) {
         // losers must win the store or the token family is bricked.
         if (hasMatchingOAuthIdentity(existing, params.refreshed)) {
           store.profiles[params.profileId] = { ...params.refreshed };
-          saved = true;
+          adopted = params.refreshed;
           return true;
         }
+        adopted = hasUsableOAuthCredential(existing) ? existing : null;
         return false;
       },
     });
-    return result !== null && saved ? params.refreshed : null;
+    return result === null ? null : adopted;
   }
 
   async function doRefreshOAuthTokenWithLock(params: {