fix(hosted): list only the providers the vault still accepts - #656
Merged
Conversation
The provider trim in #645 narrowed VAULT_PROVIDER_ID to Conductor, but the provider_key table still holds rows stored earlier for the removed ids, and the list endpoint answered every row. Both clients' readers drop the whole answer on a provider id they do not know, so an account with any old key saw "The vault answered with something unexpected" on the Provider keys section while observation, which looks keys up by adapter, kept working. The list now filters rows to the wire contract's provider set. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Provider keys section on iOS (simulators and device) showed "The vault answered with something unexpected. Try again later." for any account that had ever stored a key for a provider the vault no longer accepts, while Conductor sessions kept observing fine.
VAULT_PROVIDER_IDto Conductor, butprovider_keyrows stored earlier for cursor, devin, copilot, jules, or replicas are still there.GET /api/vault/keysanswered every row, and both the iOSVaultClient.listKeysand the desktopvaultKeysListAnswerFromWirereader deliberately drop the whole answer on an unknown provider id.The list handler now filters rows to
isVaultProviderIdbefore answering, so the endpoint's answer matches the wire contract both readers enforce. Stale rows stay in the table untouched; whether to purge them is a separate decision.Test plan
./scripts/check.shpasses🤖 Generated with Claude Code
Open workspace in Conductor
Open in Alchemize
Automated visual evidence
Download the deterministic macOS evidence · workflow run
cfcc555cbf51138062a0827049deb193b7d9bbc2smoke