[kentcdodds]

Summary

• Make the package token editor’s value rotation affordance explicit with a Token value section.
• Rename the replacement field to New raw token value and explain that saving it rotates the bearer value while the current value remains hidden.
• Rename revoked-token restore terminology from un-revoke to reinstate in UI, same-origin action code, tests, and docs.
• Update the package invocation token setup guide to point agents/users to the Token value section for rotations.

Testing

• npx vitest run packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
• npm run typecheck
• npm run format:check
• npm run lint (existing unrelated warnings only)
• Manual local browser check: created a temporary token, verified the edit page shows Token value, New raw token value, Generate, and Copy, then permanently deleted the token.

  

Summary by CodeRabbit

• Documentation

  • Updated token-management docs to reference the new “reinstate” action.
  • Improved the token setup guide to direct users to the Token value section and clarify replacement-token entry.

• Bug Fixes

  • Revoked package invocation tokens can now be reinstated via the app and API using the reinstate flow.
  • Refreshed the token editor UI and revoked-token action button text/status messages to match the new process.
  • Improved the token editor’s replacement-token display with clearer “New raw token value” guidance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 46b517b7-76a7-4d8a-84ab-cf54d1d6b684

📥 Commits

Reviewing files that changed from the base of the PR and between 12cd2f8 and a9db550.

📒 Files selected for processing (1)

• packages/worker/client/routes/account-package-invocation-tokens.tsx

💤 Files with no reviewable changes (1)

• packages/worker/client/routes/account-package-invocation-tokens.tsx

---

📝 Walkthrough

Walkthrough

The PR renames token restoration from unrevoke to reinstate across the worker API, repository, client route, tests, and docs. The client route also updates the token editor copy and the revoked-token action label/state.

Changes

Package invocation token reinstate flow

Layer / File(s)	Summary
API action and repository rename packages/worker/src/app/handlers/account-package-invocation-tokens.ts, packages/worker/src/package-invocations/repo.ts	action: 'reinstate' now routes to handleReinstateAction, which calls reinstatePackageInvocationToken.
Handler test updates packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts	The node test updates its repository mock wiring, reset logic, and reinstate request assertions to match the renamed token-restoration flow.
Client reinstate flow packages/worker/client/routes/account-package-invocation-tokens.tsx	The route adds reinstating, posts action: 'reinstate', rewires the revoked-token button, and replaces the editor copy with the new Token value block.
Docs wording updates docs/contributing/package-invocation-api.md, docs/guides/account-package-invocation-token-setup.md	The API doc and setup guide replace unrevoke terminology with reinstate and update the token editor guidance text.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• kentcdodds/kody#562 — Touches the same account package invocation token API and client route flow that this PR updates.
• kentcdodds/kody#563 — Also changes the token editor rawToken/Token value UI that this PR rewords in the client route and guide.

Poem

A rabbit hopped through token fields at night,
And swapped unrevoke for reinstate just right.
With Token value glowing, I did not stall,
I copied, pasted, and saved them all.
Thump-thump, the revoked ones bounce back bright. 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main UI change by clarifying package token value editing, even though it omits the token reinstatement rename.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch package-token-ui-edit-view

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔎 Preview deployed: https://kody-pr-564.kentcdodds.workers.dev

Worker: kody-pr-564
D1: kody-pr-564-db
KV: kody-pr-564-oauth-kv

Mocks:

• cloudflare: https://kody-pr-564-mock-cloudflare.kentcdodds.workers.dev/__mocks (kody-pr-564-mock-cloudflare)

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/worker/client/routes/account-package-invocation-tokens.tsx (1)

1270-1401: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Duplicate raw token input in the edit form — the old "Replace raw token" block was not removed.

The PR adds the new "Token value" section (Lines 1327-1401) but the prior "Replace raw token" field (Lines 1270-1325) is still present in the same isEditingSelectedToken form. The edit form now renders two identical name="rawToken" password inputs, each with its own Generate/Copy buttons and helper text, both bound to editorState.rawToken.

This contradicts the PR intent (the new section was meant to replace the old layout) and produces a confusing UI with duplicated labels and controls. Remove the old block so only the "Token value" section remains.

🐛 Proposed fix: remove the old "Replace raw token" block

-									<label mix={css(fieldCss)}>
-										<span mix={css(fieldLabelCss)}>Replace raw token</span>
-										<div
-											mix={css({
-												display: 'grid',
-												gridTemplateColumns: 'minmax(0, 1fr) auto auto',
-												gap: spacing.sm,
-												[mq.mobile]: {
-													gridTemplateColumns: '1fr',
-												},
-											})}
-										>
-											<input
-												name="rawToken"
-												type="password"
-												value={editorState.rawToken}
-												placeholder="Leave blank to keep the current token value"
-												autoComplete="off"
-												disabled={isMutating}
-												mix={[
-													on('input', (event) => {
-														setEditorField(
-															'rawToken',
-															event.currentTarget.value,
-														)
-														handle.update()
-													}),
-													css(inputCss),
-												]}
-											/>
-											<button
-												type="button"
-												disabled={isMutating}
-												mix={[
-													on('click', generateEditorRawToken),
-													css(secondaryButtonCss),
-												]}
-											>
-												Generate
-											</button>
-											<button
-												type="button"
-												disabled={isMutating || !editorState.rawToken}
-												mix={[
-													on('click', () => void copyEditorRawToken()),
-													css(secondaryButtonCss),
-												]}
-											>
-												Copy
-											</button>
-										</div>
-										<span mix={css(descriptionCss)}>
-											Paste or generate a new raw token only when rotating this
-											credential. Kody stores only its hash.
-										</span>
-									</label>
-
 									<div
 										mix={css({
 											display: 'grid',
 											gap: spacing.sm,

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/client/routes/account-package-invocation-tokens.tsx` around
lines 1270 - 1401, The edit form currently renders two raw token inputs because
the old “Replace raw token” block is still present alongside the new “Token
value” section. In the `isEditingSelectedToken` form, remove the earlier
`rawToken` label/input/button group and keep only the new `Token value` section
so there is a single `editorState.rawToken` field with one set of Generate/Copy
controls.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@packages/worker/client/routes/account-package-invocation-tokens.tsx`:
- Around line 1270-1401: The edit form currently renders two raw token inputs
because the old “Replace raw token” block is still present alongside the new
“Token value” section. In the `isEditingSelectedToken` form, remove the earlier
`rawToken` label/input/button group and keep only the new `Token value` section
so there is a single `editorState.rawToken` field with one set of Generate/Copy
controls.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 73c35240-4084-40ff-878d-925849505104

📥 Commits

Reviewing files that changed from the base of the PR and between 72ad32d and 12cd2f8.

📒 Files selected for processing (6)

• docs/contributing/package-invocation-api.md
• docs/guides/account-package-invocation-token-setup.md
• packages/worker/client/routes/account-package-invocation-tokens.tsx
• packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
• packages/worker/src/app/handlers/account-package-invocation-tokens.ts
• packages/worker/src/package-invocations/repo.ts