Files
orca/docs
Jinwoo-HandOrca 2c80621c7e fix: prevent 401 errors from CLI-refreshed tokens being clobbered by stale managed auth
Both CodexRuntimeHomeService and ClaudeRuntimeAuthService performed one-directional auth sync —
copying managed credentials to the runtime path on every PTY launch and rate-limit fetch, but
never reading back tokens that the CLI refreshed. When OAuth tokens expired and the CLI
silently refreshed them, the next sync would overwrite the fresh tokens with the stale
managed copy, causing intermittent 401 Unauthorized errors.

Adds readBackRefreshedTokens() to both services: before overwriting runtime auth, compare the
file to what Orca last wrote. If they differ, the CLI refreshed the token — write it back to
managed storage first. Also adds detectExternalLoginAndUpdateSnapshot() to Codex (already
existed on Claude side) and clearLastWritten*() methods to prevent re-auth flows from having
their fresh tokens clobbered by stale read-back.

Fixes #1284

Co-authored-by: Orca <help@stably.ai>
2026-05-01 01:16:42 -04:00
..

Orca CLI Docs

Keep this folder focused on the durable references for Orca's public CLI and runtime model.

Keep These Docs

  • orca-cli-focused-v1-status.md
    • What is actually implemented and intentionally in scope now.
  • orca-cli-v1-spec.md
    • The public CLI contract, selector grammar, JSON envelope, and command semantics.
  • orca-runtime-layer-design.md
    • Why the runtime layer exists and which boundaries it owns.
  • orca-cli-bundled-distribution.md
    • How the bundled desktop-app distribution and PATH registration model works.

Why The Folder Is Small

Earlier design and implementation work produced several planning and evaluation docs. Those were useful while the feature was taking shape, but they were intentionally removed once the implementation converged so future readers are not forced to choose between multiple overlapping sources of truth.