🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

const storedAuthEpoch = normalizeOptionalString(binding?.authEpoch);
if (
  binding?.authEpochVersion === params.authEpochVersion &&
  storedAuthEpoch !== currentAuthEpoch
) {
  return { invalidatedReason: "auth-epoch" };
}

const storedAuthEpoch = normalizeOptionalString(binding?.authEpoch);
const storedVersion = typeof binding?.authEpochVersion === "number" ? binding.authEpochVersion : undefined;

​// Invalidate when versions differ OR are missing, unless you can safely recompute/translate the stored epoch.
if (storedVersion !== params.authEpochVersion) {
  return { invalidatedReason: "auth-epoch" };
}
if (storedAuthEpoch !== currentAuthEpoch) {
  return { invalidatedReason: "auth-epoch" };
}

Analyzed PR: #70132 at commit 10bc643

_{Last updated on: 2026-04-22T11:38:49Z}

Greptile Summary

This PR fixes OAuth token refresh causing CLI session loss by hashing only stable identity material (refresh token, provider) instead of volatile fields (access token, expiry) into the auth epoch, and introducing a versioned epoch scheme (authEpochVersion: 2) that lets existing unversioned bindings pass through once during upgrade without dropping the session.

The implementation is well-structured and thoroughly tested. One mild concern: authEpochVersion is declared optional in resolveCliSessionReuse's parameter type, so a future caller omitting it would silently bypass epoch validation even for already-versioned bindings (version undefined vs 2 → check skipped). All current production callers always pass the constant, so no immediate breakage, but hardening the signature would prevent the footgun.

Confidence Score: 4/5

Safe to merge; the one concern is a latent footgun in the optional parameter signature, not a current breakage.

All production callers correctly pass authEpochVersion and the epoch stability fix is sound. The P2 finding about the optional authEpochVersion creating a symmetrical bypass for future callers is a code-quality concern rather than a present defect, but it's subtle enough to warrant a look before merging.

src/agents/cli-session.ts — the authEpochVersion optional parameter type in resolveCliSessionReuse

This is a comment left during a code review.
Path: src/agents/cli-session.ts
Line: 152-157

Comment:
**Version-mismatch bypass applies symmetrically in both directions**

The guard `binding?.authEpochVersion === params.authEpochVersion` skips epoch validation whenever the versions differ — including the case where `params.authEpochVersion` is omitted (`undefined`) but the stored binding already carries `authEpochVersion: 2`. In that scenario, a versioned binding would silently pass the epoch check even if the refresh token had changed. The production call-site in `prepare.ts` always supplies `authEpochVersion: CLI_AUTH_EPOCH_VERSION`, so this isn't broken today, but `authEpochVersion` being optional in the parameter type makes it easy for a future caller to omit it and unknowingly get epoch validation bypassed for already-versioned bindings.

Consider making `authEpochVersion` a required parameter (or defaulting it to `CLI_AUTH_EPOCH_VERSION` inside the function) so omissions are caught at compile time rather than silently degrading security.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "test(cli): cover oauth auth epoch contin..." | Re-trigger Greptile}

Local smoke passed on this branch.

Covered:

• rebuilt local dist and restarted the gateway service
• confirmed Claude CLI warm-session reuse within one gateway process
• confirmed Claude CLI resumes the same conversation after gateway restart
• confirmed an unversioned/pre-fix auth-epoch binding upgrades to v2 without resetting the Claude session
• checked logs for auth-epoch resets; none appeared during the smoke

Only unrelated noise seen: existing channel network warnings.

Landed via rebase.

Commits:

• 1ff461fe7b
• 9ad58ddc7e
• 7fd8eeecf2
• 4a16cf8008

Verified locally:

• pnpm test src/agents/cli-auth-epoch.test.ts src/agents/cli-session.test.ts src/agents/cli-runner/prepare.test.ts src/agents/cli-runner.reliability.test.ts src/agents/cli-runner.spawn.test.ts
• pnpm check:changed