fix(windows): prevent credential reads from stalling subagents (v0.15.22) - #50
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows startup and agent creation repeatedly launched PowerShell to read credentials, including when no DPAPI file existed. A slow native read could block terminal progress long enough to fail the release gate.
Check the encrypted file directly and decrypt an unchanged record once per process. Each read compares the encrypted contents, configuration path and entropy, so another process's refresh/logout invalidates the cache immediately. Classified reads bypass it, mutations invalidate it, and callers receive independent data objects. Permission errors remain distinct from missing credentials. PowerShell consumes the exact encrypted snapshot over UTF-8 stdin and writes UTF-8 output.
Validation adds 13 cache/failure regression tests and five real Windows DPAPI checks on Node 22 and 24, including Unicode data and cross-process refresh/logout. All 20 CI checks pass at ee8017d, including the 198 installed CLI scenarios, real Windows DPAPI checks, complete isolated suite, security checks and four native desktop packages. Local validation also passes: 3,060 tests across 336 files and CLI/SDK builds.
Version: 0.15.22. Candidate 0.15.21 was not distributed by npm, Docker or desktop; its tag is preserved and its GitHub release is marked as a prerelease after the release gate failed.