fix(auth): close Anthropic OAuth CSRF gap, cross-process refresh race, and API-key shadowing - #87891

Closed

JoaoMarcos44 wants to merge 7 commits into

NousResearch:mainfrom

JoaoMarcos44:fix/anthropic-oauth-csrf-race-apikey-shadow

Commits on Aug 28, 2026

fix(auth): close Anthropic OAuth CSRF gap, cross-process refresh race, and API-key shadowing
JoaoMarcos44
committed
a0fa434
docs(auth): record manual A/B validation of OAuth API-key shadowing fix
JoaoMarcos44
committed
04ab78e
fix(auth): harden claude_code refresh lock and remove dashboard Anthropic OAuth
JoaoMarcos44
committed
b236179
fix(auth): close Anthropic OAuth review gaps
JoaoMarcos44
committed
4145fe4
fix(auth): make the Anthropic refresh commit part of the transaction
JoaoMarcos44
committed
e0adee2
refactor(anthropic): split the adapter godfile into four modules
JoaoMarcos44
committed
f8358bc
fix(auth): keep the borrowed claude_code row out of token authority and carry the spent-rotation verdict through resolution

JoaoMarcos44
and
claude
committed
f228439