thepopebot 1.2.74 → 1.2.75-beta.2

package/README.md

@@ -192,6 +192,17 @@ See [Different Models](docs/RUNNING_DIFFERENT_MODELS.md) for the full provider r
 
 ---
 
+## Known Issues
+
+### Windows: `SQLITE_IOERR_SHMOPEN`
+
+SQLite can't create or open its shared-memory (`.shm`) file. Common causes:
+
+- **Antivirus** (Windows Defender, etc.) locking the database files — add your project folder to the exclusion list
+- **Cloud-synced folders** (OneDrive, Dropbox, Google Drive) — move your project to a non-synced directory like `C:\Projects\`
+
+---
+
 ## Docs
 
 | Document | Description |

package/api/CLAUDE.md

@@ -25,6 +25,8 @@ Browser-facing data fetching uses **fetch route handlers** colocated with pages
 |--------|------|------|---------|
 | GET | `/api/ping` | None | Health check |
 | POST | `/api/create-agent-job` | `x-api-key` | Create agent job |
+| GET | `/api/get-agent-job-secret` | `x-api-key` | Get an agent job secret; oauth2 credentials return only the access_token (auto-refreshed) |
+| POST | `/api/set-agent-job-secret` | `x-api-key` | Set/update an agent job secret (for agents to persist rotated credentials) |
 | GET | `/api/agent-jobs/status` | `x-api-key` | Agent job status (query: `?agent_job_id=`) |
 | POST | `/api/telegram/webhook` | Telegram webhook secret | Telegram message handler |
 | POST | `/api/telegram/register` | `x-api-key` | Register bot token + webhook URL |

package/api/index.js

@@ -11,6 +11,9 @@ import { getConfig } from '../lib/config.js';
 import { parseOAuthState, exchangeCodeForToken } from '../lib/oauth/helper.js';
 import { setAgentJobSecret } from '../lib/db/config.js';
 
+// ── Per-key lock for OAuth token refresh ────────────────────────────
+const _refreshLocks = new Map();
+
 // Bot token — resolved from DB/env, can be overridden by /telegram/register
 let telegramBotToken = null;
 
@@ -104,6 +107,81 @@ async function handleCreateAgentJob(request) {
   }
 }
 
+async function handleGetAgentSecret(request) {
+  const record = verifyApiKey(request.headers.get('x-api-key'));
+  if (record.type !== 'agent_job_api_key') {
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const key = new URL(request.url).searchParams.get('key');
+  if (!key) return Response.json({ error: 'Missing key' }, { status: 400 });
+
+  const { getAgentJobSecretRaw, setAgentJobSecret: saveSecret } = await import('../lib/db/config.js');
+  const raw = getAgentJobSecretRaw(key);
+  if (!raw) return Response.json({ error: 'Not found' }, { status: 404 });
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    // Plain string
+    return Response.json({ value: raw });
+  }
+
+  if (parsed.type === 'oauth2') {
+    // Serialize refresh per key — prevents concurrent requests from racing on token rotation
+    if (!_refreshLocks.has(key)) _refreshLocks.set(key, Promise.resolve());
+    let release;
+    const gate = new Promise((r) => { release = r; });
+    const prev = _refreshLocks.get(key);
+    _refreshLocks.set(key, gate);
+    await prev;
+
+    try {
+      // Re-read after acquiring lock — previous request may have already refreshed
+      const freshRaw = getAgentJobSecretRaw(key);
+      const freshParsed = freshRaw ? JSON.parse(freshRaw) : parsed;
+
+      const { refreshOAuthToken } = await import('../lib/oauth/helper.js');
+      const newToken = await refreshOAuthToken({
+        refreshToken: freshParsed.token.refresh_token,
+        clientId: freshParsed.clientId,
+        clientSecret: freshParsed.clientSecret,
+        tokenUrl: freshParsed.tokenUrl,
+      });
+      // Persist updated token (refresh token may have rotated)
+      saveSecret(key, JSON.stringify({ ...freshParsed, token: { ...freshParsed.token, ...newToken } }), 'refresh');
+      return Response.json({ value: newToken.access_token });
+    } catch (err) {
+      console.error(`[secrets] OAuth refresh failed for "${key}":`, err.message);
+      return Response.json({ error: `OAuth refresh failed: ${err.message}` }, { status: 502 });
+    } finally {
+      release();
+    }
+  }
+  if (parsed.type === 'oauth_token') {
+    return Response.json({ value: JSON.stringify(parsed.token) });
+  }
+  // Unknown structured value — return raw
+  return Response.json({ value: raw });
+}
+
+async function handleSetAgentSecret(request) {
+  const record = verifyApiKey(request.headers.get('x-api-key'));
+  if (record.type !== 'agent_job_api_key') {
+    return Response.json({ error: 'Forbidden' }, { status: 403 });
+  }
+
+  const body = await request.json();
+  const { key, value } = body;
+  if (!key || typeof value !== 'string') {
+    return Response.json({ error: 'Missing key or value' }, { status: 400 });
+  }
+  const { setAgentJobSecret } = await import('../lib/db/config.js');
+  setAgentJobSecret(key, value, 'agent');
+  return Response.json({ success: true });
+}
+
 async function handleTelegramRegister(request) {
   const body = await request.json();
   const { bot_token, webhook_url } = body;
@@ -248,9 +326,21 @@ async function handleOAuthCallback(request) {
       redirectUri,
     });
 
-    // Save the full token JSON as the secret value
-    const tokenJson = JSON.stringify(tokenData);
-    setAgentJobSecret(state.secretName, tokenJson, 'oauth');
+    // Save token with typed wrapper so the API can auto-refresh on fetch
+    const secretType = state.secretType || 'oauth2';
+    let stored;
+    if (secretType === 'oauth_token') {
+      stored = JSON.stringify({ type: 'oauth_token', token: tokenData });
+    } else {
+      stored = JSON.stringify({
+        type: 'oauth2',
+        token: tokenData,
+        clientId: state.clientId,
+        clientSecret: state.clientSecret,
+        tokenUrl: state.tokenUrl,
+      });
+    }
+    setAgentJobSecret(state.secretName, stored, 'oauth');
 
     return oauthResultPage(true, state.secretName);
   } catch (err) {
@@ -315,6 +405,7 @@ async function POST(request) {
   // Route to handler
   switch (routePath) {
     case '/create-agent-job':     return handleCreateAgentJob(request);
+    case '/set-agent-job-secret':  return handleSetAgentSecret(request);
     case '/telegram/webhook':   return handleTelegramWebhook(request);
     case '/telegram/register':  return handleTelegramRegister(request);
     case '/github/webhook':     return handleGithubWebhook(request);
@@ -333,6 +424,7 @@ async function GET(request) {
   switch (routePath) {
     case '/ping':               return Response.json({ message: 'Pong!' });
     case '/agent-jobs/status':  return handleAgentJobStatus(request);
+    case '/get-agent-job-secret':   return handleGetAgentSecret(request);
     case '/oauth/callback':     return handleOAuthCallback(request);
     default:                    return Response.json({ error: 'Not found' }, { status: 404 });
   }

package/bin/cli.js

@@ -262,7 +262,7 @@ async function init() {
   }
 
   // Create default skill activation symlinks
-  const defaultSkills = ['get-secret'];
+  const defaultSkills = ['agent-job-secrets'];
   const activeDir = path.join(cwd, 'skills', 'active');
   fs.mkdirSync(activeDir, { recursive: true });
   for (const skill of defaultSkills) {

package/bin/managed-paths.js

@@ -13,7 +13,7 @@ export const MANAGED_PATHS = [
   'skills/CLAUDE.md',
   'cron/CLAUDE.md',
   'triggers/CLAUDE.md',
-  'docs/CLAUDE.md',
+  'docs/',
 ];
 
 export function isManaged(relPath) {

package/bin/sync.js

@@ -277,8 +277,7 @@ function buildDockerImage(projectPath) {
   fs.cpSync(webSrc, webDest, { recursive: true });
 
   try {
-    // Build using stdin Dockerfile with project dir as context (no cache to ensure fresh package)
-    execSync(`docker build --no-cache -f - -t ${imageTag} .`, {
+    execSync(`docker build -f - -t ${imageTag} .`, {
       input: dockerfile,
       stdio: ['pipe', 'inherit', 'inherit'],
       cwd: projectPath,
@@ -287,6 +286,12 @@ function buildDockerImage(projectPath) {
     fs.rmSync(webDest, { recursive: true, force: true });
   }
 
+  // Clean up dangling images from previous builds
+  try {
+    execSync('docker image prune -f', { stdio: 'ignore' });
+  } catch {}
+
+
   // Update THEPOPEBOT_VERSION in .env
   const envPath = path.join(projectPath, '.env');
   if (fs.existsSync(envPath)) {

package/config/instrumentation.js

@@ -70,5 +70,9 @@ export async function register() {
   const { startClusterRuntime } = await import('../lib/cluster/runtime.js');
   startClusterRuntime();
 
+  // Start internal maintenance cron (cleanup expired agent job keys, etc.)
+  const { startMaintenanceCron } = await import('../lib/maintenance.js');
+  startMaintenanceCron();
+
   console.log('thepopebot initialized');
 }

package/lib/chat/actions.js

@@ -915,10 +915,10 @@ export async function getChatSettings() {
     const customProviders = getCustomProviders();
 
     // Get active config values
-    const activeProvider = getConfigValue('LLM_PROVIDER') || process.env.LLM_PROVIDER || 'anthropic';
-    const activeModel = getConfigValue('LLM_MODEL') || process.env.LLM_MODEL || '';
-    const maxTokens = getConfigValue('LLM_MAX_TOKENS') || process.env.LLM_MAX_TOKENS || '4096';
-    const agentBackend = getConfigValue('AGENT_BACKEND') || process.env.AGENT_BACKEND || 'claude-code';
+    const activeProvider = getConfigValue('LLM_PROVIDER') || '';
+    const activeModel = getConfigValue('LLM_MODEL') || '';
+    const maxTokens = getConfigValue('LLM_MAX_TOKENS') || '4096';
+    const agentBackend = getConfigValue('AGENT_BACKEND') || '';
 
     return {
       builtinProviders: BUILTIN_PROVIDERS,

package/lib/chat/components/chat-input.js

@@ -87,7 +87,7 @@ function ChatInput({ input, setInput, onSubmit, status, stop, files, setFiles, d
     const textarea = textareaRef.current;
     if (!textarea) return;
     textarea.style.height = "auto";
-    textarea.style.height = `${Math.min(textarea.scrollHeight, 200)}px`;
+    textarea.style.height = `${textarea.scrollHeight}px`;
   }, []);
   useEffect(() => {
     adjustHeight();
@@ -213,7 +213,7 @@ function ChatInput({ input, setInput, onSubmit, status, stop, files, setFiles, d
             className: cn(
               "w-full resize-none bg-transparent px-2 py-1.5 text-sm text-foreground",
               "placeholder:text-muted-foreground focus:outline-none",
-              "max-h-[200px]"
+              "min-h-[84px] md:min-h-0 max-h-[40vh] md:max-h-[200px]"
             ),
             disabled: isStreaming
           }

package/lib/chat/components/chat-input.jsx

@@ -69,7 +69,7 @@ export function ChatInput({ input, setInput, onSubmit, status, stop, files, setF
     const textarea = textareaRef.current;
     if (!textarea) return;
     textarea.style.height = 'auto';
-    textarea.style.height = `${Math.min(textarea.scrollHeight, 200)}px`;
+    textarea.style.height = `${textarea.scrollHeight}px`;
   }, []);
 
   useEffect(() => {
@@ -229,7 +229,7 @@ export function ChatInput({ input, setInput, onSubmit, status, stop, files, setF
             className={cn(
               'w-full resize-none bg-transparent px-2 py-1.5 text-sm text-foreground',
               'placeholder:text-muted-foreground focus:outline-none',
-              'max-h-[200px]'
+              'min-h-[84px] md:min-h-0 max-h-[40vh] md:max-h-[200px]'
             )}
             disabled={isStreaming}
           />

package/lib/chat/components/settings-chat-page.js

@@ -57,11 +57,30 @@ function ActiveConfig({ settings, onSave }) {
   const [saved, setSaved] = useState(false);
   const initialized = useRef(false);
   const saveTimer = useRef(null);
+  const availableProviders = [];
+  if (settings?.builtinProviders && settings?.credentialStatuses) {
+    const statusMap = new Map(settings.credentialStatuses.map((s) => [s.key, s.isSet]));
+    for (const [slug, prov] of Object.entries(settings.builtinProviders)) {
+      const hasKey = prov.credentials.some((c) => statusMap.get(c.key));
+      if (hasKey) {
+        availableProviders.push({ slug, name: prov.name, models: prov.models });
+      }
+    }
+  }
+  if (settings?.customProviders) {
+    for (const cp of settings.customProviders) {
+      availableProviders.push({ slug: cp.key, name: cp.name, models: cp.models.map((m) => ({ id: m, name: m })) });
+    }
+  }
   useEffect(() => {
     if (settings?.active) {
-      setProvider(settings.active.provider || "anthropic");
-      setModel(settings.active.model || "");
-      setModelText(settings.active.model || "");
+      const prov = settings.active.provider || availableProviders[0]?.slug || "";
+      const resolved = availableProviders.find((p) => p.slug === prov);
+      const models = resolved?.models || [];
+      const def = models.find((m) => m.default);
+      setProvider(prov);
+      setModel(settings.active.model || def?.id || models[0]?.id || "");
+      setModelText(settings.active.model || def?.id || models[0]?.id || "");
       setMaxTokens(settings.active.maxTokens || "4096");
       setTimeout(() => {
         initialized.current = true;
@@ -82,21 +101,6 @@ function ActiveConfig({ settings, onSave }) {
     if (saveTimer.current) clearTimeout(saveTimer.current);
     saveTimer.current = setTimeout(() => doSave(p, m, mt, ws), 800);
   }, [doSave]);
-  const availableProviders = [];
-  if (settings?.builtinProviders && settings?.credentialStatuses) {
-    const statusMap = new Map(settings.credentialStatuses.map((s) => [s.key, s.isSet]));
-    for (const [slug, prov] of Object.entries(settings.builtinProviders)) {
-      const hasKey = prov.credentials.some((c) => statusMap.get(c.key));
-      if (hasKey) {
-        availableProviders.push({ slug, name: prov.name, models: prov.models });
-      }
-    }
-  }
-  if (settings?.customProviders) {
-    for (const cp of settings.customProviders) {
-      availableProviders.push({ slug: cp.key, name: cp.name, models: cp.models.map((m) => ({ id: m, name: m })) });
-    }
-  }
   const selectedProvider = availableProviders.find((p) => p.slug === provider);
   const handleProviderChange = (slug) => {
     setProvider(slug);
@@ -129,28 +133,28 @@ function ActiveConfig({ settings, onSave }) {
     }
   };
   return /* @__PURE__ */ jsxs("div", { className: "rounded-lg border bg-card p-4", children: [
-    (saving || saved) && /* @__PURE__ */ jsxs("div", { className: "flex justify-end mb-2", children: [
-      saving && /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: "Saving..." }),
-      saved && /* @__PURE__ */ jsxs("span", { className: "text-xs text-green-500 inline-flex items-center gap-1", children: [
-        /* @__PURE__ */ jsx(CheckIcon, { size: 12 }),
-        " Saved"
-      ] })
-    ] }),
     /* @__PURE__ */ jsxs("div", { className: "divide-y divide-border", children: [
       /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between py-3 first:pt-0", children: [
         /* @__PURE__ */ jsx("label", { className: "text-sm font-medium shrink-0", children: "Provider" }),
-        /* @__PURE__ */ jsxs(
-          "select",
-          {
-            value: provider,
-            onChange: (e) => handleProviderChange(e.target.value),
-            className: "w-48 rounded-md border border-border bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-1 focus:ring-foreground",
-            children: [
-              availableProviders.map((p) => /* @__PURE__ */ jsx("option", { value: p.slug, children: p.name }, p.slug)),
-              availableProviders.length === 0 && /* @__PURE__ */ jsx("option", { value: "", disabled: true, children: "No providers configured" })
-            ]
-          }
-        )
+        /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
+          saving && /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: "Saving..." }),
+          saved && /* @__PURE__ */ jsxs("span", { className: "text-xs text-green-500 inline-flex items-center gap-1", children: [
+            /* @__PURE__ */ jsx(CheckIcon, { size: 12 }),
+            " Saved"
+          ] }),
+          /* @__PURE__ */ jsxs(
+            "select",
+            {
+              value: provider,
+              onChange: (e) => handleProviderChange(e.target.value),
+              className: "w-48 rounded-md border border-border bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-1 focus:ring-foreground",
+              children: [
+                availableProviders.map((p) => /* @__PURE__ */ jsx("option", { value: p.slug, children: p.name }, p.slug)),
+                availableProviders.length === 0 && /* @__PURE__ */ jsx("option", { value: "", disabled: true, children: "No providers configured" })
+              ]
+            }
+          )
+        ] })
       ] }),
       /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between py-3", children: [
         /* @__PURE__ */ jsx("label", { className: "text-sm font-medium shrink-0", children: "Model" }),

package/lib/chat/components/settings-chat-page.jsx

@@ -73,11 +73,31 @@ function ActiveConfig({ settings, onSave }) {
   const initialized = useRef(false);
   const saveTimer = useRef(null);
 
+  const availableProviders = [];
+  if (settings?.builtinProviders && settings?.credentialStatuses) {
+    const statusMap = new Map(settings.credentialStatuses.map((s) => [s.key, s.isSet]));
+    for (const [slug, prov] of Object.entries(settings.builtinProviders)) {
+      const hasKey = prov.credentials.some((c) => statusMap.get(c.key));
+      if (hasKey) {
+        availableProviders.push({ slug, name: prov.name, models: prov.models });
+      }
+    }
+  }
+  if (settings?.customProviders) {
+    for (const cp of settings.customProviders) {
+      availableProviders.push({ slug: cp.key, name: cp.name, models: cp.models.map((m) => ({ id: m, name: m })) });
+    }
+  }
+
   useEffect(() => {
     if (settings?.active) {
-      setProvider(settings.active.provider || 'anthropic');
-      setModel(settings.active.model || '');
-      setModelText(settings.active.model || '');
+      const prov = settings.active.provider || availableProviders[0]?.slug || '';
+      const resolved = availableProviders.find((p) => p.slug === prov);
+      const models = resolved?.models || [];
+      const def = models.find((m) => m.default);
+      setProvider(prov);
+      setModel(settings.active.model || def?.id || models[0]?.id || '');
+      setModelText(settings.active.model || def?.id || models[0]?.id || '');
       setMaxTokens(settings.active.maxTokens || '4096');
       setTimeout(() => { initialized.current = true; }, 100);
     }
@@ -99,22 +119,6 @@ function ActiveConfig({ settings, onSave }) {
     saveTimer.current = setTimeout(() => doSave(p, m, mt, ws), 800);
   }, [doSave]);
 
-  const availableProviders = [];
-  if (settings?.builtinProviders && settings?.credentialStatuses) {
-    const statusMap = new Map(settings.credentialStatuses.map((s) => [s.key, s.isSet]));
-    for (const [slug, prov] of Object.entries(settings.builtinProviders)) {
-      const hasKey = prov.credentials.some((c) => statusMap.get(c.key));
-      if (hasKey) {
-        availableProviders.push({ slug, name: prov.name, models: prov.models });
-      }
-    }
-  }
-  if (settings?.customProviders) {
-    for (const cp of settings.customProviders) {
-      availableProviders.push({ slug: cp.key, name: cp.name, models: cp.models.map((m) => ({ id: m, name: m })) });
-    }
-  }
-
   const selectedProvider = availableProviders.find((p) => p.slug === provider);
 
   const handleProviderChange = (slug) => {
@@ -156,27 +160,25 @@ function ActiveConfig({ settings, onSave }) {
 
   return (
     <div className="rounded-lg border bg-card p-4">
-      {(saving || saved) && (
-        <div className="flex justify-end mb-2">
-          {saving && <span className="text-xs text-muted-foreground">Saving...</span>}
-          {saved && <span className="text-xs text-green-500 inline-flex items-center gap-1"><CheckIcon size={12} /> Saved</span>}
-        </div>
-      )}
       <div className="divide-y divide-border">
         <div className="flex items-center justify-between py-3 first:pt-0">
           <label className="text-sm font-medium shrink-0">Provider</label>
-          <select
-            value={provider}
-            onChange={(e) => handleProviderChange(e.target.value)}
-            className="w-48 rounded-md border border-border bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-1 focus:ring-foreground"
-          >
-            {availableProviders.map((p) => (
-              <option key={p.slug} value={p.slug}>{p.name}</option>
-            ))}
-            {availableProviders.length === 0 && (
-              <option value="" disabled>No providers configured</option>
-            )}
-          </select>
+          <div className="flex items-center gap-2">
+            {saving && <span className="text-xs text-muted-foreground">Saving...</span>}
+            {saved && <span className="text-xs text-green-500 inline-flex items-center gap-1"><CheckIcon size={12} /> Saved</span>}
+            <select
+              value={provider}
+              onChange={(e) => handleProviderChange(e.target.value)}
+              className="w-48 rounded-md border border-border bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-1 focus:ring-foreground"
+            >
+              {availableProviders.map((p) => (
+                <option key={p.slug} value={p.slug}>{p.name}</option>
+              ))}
+              {availableProviders.length === 0 && (
+                <option value="" disabled>No providers configured</option>
+              )}
+            </select>
+          </div>
         </div>
 
         <div className="flex items-center justify-between py-3">

package/lib/chat/components/settings-jobs-page.js

@@ -1,8 +1,8 @@
 "use client";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useState, useEffect, useRef, useCallback } from "react";
-import { PlusIcon, CopyIcon, CheckIcon, SpinnerIcon } from "./icons.js";
-import { SecretRow, Dialog, EmptyState } from "./settings-shared.js";
+import { PlusIcon, CopyIcon, CheckIcon, SpinnerIcon, TrashIcon } from "./icons.js";
+import { SecretRow, StatusBadge, Dialog, EmptyState } from "./settings-shared.js";
 import { OAUTH_PROVIDERS } from "../../oauth/providers.js";
 import {
   getAgentJobSecrets,
@@ -137,7 +137,7 @@ function ProviderCombobox({ value, onChange, inputClass }) {
     open && filtered.length === 0 && query && /* @__PURE__ */ jsx("div", { className: "absolute z-10 mt-1 w-full rounded-md border border-border bg-background shadow-lg px-3 py-2 text-sm text-muted-foreground", children: "No providers found" })
   ] });
 }
-function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
+function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess, editingSecret }) {
   const [mode, setMode] = useState("manual");
   const [name, setName] = useState("");
   const [error, setError] = useState(null);
@@ -156,8 +156,8 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
   const timeoutRef = useRef(null);
   useEffect(() => {
     if (open) {
-      setMode("manual");
-      setName("");
+      setMode(editingSecret ? "oauth" : "manual");
+      setName(editingSecret?.key || "");
       setError(null);
       setValue("");
       setShowValue(false);
@@ -169,7 +169,7 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
       setStatus("form");
       setCopied(false);
       setRedirectUri(`${window.location.origin}/api/oauth/callback`);
-      setTimeout(() => nameRef.current?.focus(), 50);
+      if (!editingSecret) setTimeout(() => nameRef.current?.focus(), 50);
     }
     return () => {
       if (timeoutRef.current) clearTimeout(timeoutRef.current);
@@ -262,7 +262,7 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
     }, 5 * 60 * 1e3);
   };
   const inputClass = "w-full rounded-md border border-border bg-background px-3 py-1.5 text-sm font-mono focus:outline-none focus:ring-1 focus:ring-foreground";
-  return /* @__PURE__ */ jsx(Dialog, { open, onClose: onCancel, title: "Add Secret", children: status === "success" ? /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center gap-2 py-8 text-green-500", children: [
+  return /* @__PURE__ */ jsx(Dialog, { open, onClose: onCancel, title: editingSecret ? "Re-authorize Secret" : "Add Secret", children: status === "success" ? /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-center gap-2 py-8 text-green-500", children: [
     /* @__PURE__ */ jsx(CheckIcon, { size: 20 }),
     /* @__PURE__ */ jsx("span", { className: "text-sm font-medium", children: "Token saved!" })
   ] }) : status === "waiting" ? /* @__PURE__ */ jsxs("div", { className: "flex flex-col items-center justify-center gap-3 py-8", children: [
@@ -271,7 +271,7 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
     /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: "Complete the login in the popup window." })
   ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsxs("div", { className: "space-y-3", children: [
-      /* @__PURE__ */ jsxs("div", { className: "flex rounded-md border border-border overflow-hidden", children: [
+      !editingSecret && /* @__PURE__ */ jsxs("div", { className: "flex rounded-md border border-border overflow-hidden", children: [
         /* @__PURE__ */ jsx(
           "button",
           {
@@ -301,7 +301,8 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
             value: name,
             onChange: (e) => setName(e.target.value.toUpperCase().replace(/[^A-Z0-9_]/g, "")),
             placeholder: mode === "manual" ? "e.g. GOOGLE_SERVICE_ACCOUNT_KEY" : "e.g. GOOGLE_OAUTH_TOKEN",
-            className: inputClass,
+            className: `${inputClass}${editingSecret ? " text-muted-foreground bg-muted" : ""}`,
+            readOnly: !!editingSecret,
             onKeyDown: (e) => e.key === "Enter" && mode === "manual" && handleSave()
           }
         )
@@ -439,10 +440,49 @@ function AddSecretDialog({ open, onAdd, onCancel, onOAuthSuccess }) {
     ] })
   ] }) });
 }
+function OAuthSecretRow({ secret, onReauthorize, onDelete }) {
+  const [confirmDelete, setConfirmDelete] = useState(false);
+  const handleDelete = async () => {
+    if (!confirmDelete) {
+      setConfirmDelete(true);
+      setTimeout(() => setConfirmDelete(false), 3e3);
+      return;
+    }
+    await onDelete();
+    setConfirmDelete(false);
+  };
+  return /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-1 sm:flex-row sm:items-center sm:justify-between py-3", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 min-w-0", children: [
+      /* @__PURE__ */ jsx("span", { className: "text-sm font-medium font-mono", children: secret.key }),
+      /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: "OAuth" }),
+      /* @__PURE__ */ jsx(StatusBadge, { isSet: secret.isSet })
+    ] }),
+    /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-1.5 shrink-0 self-start sm:self-auto", children: [
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          onClick: onReauthorize,
+          className: "rounded-md px-2.5 py-1.5 text-xs font-medium border border-border text-muted-foreground hover:bg-accent hover:text-foreground transition-colors",
+          children: "Re-authorize"
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          onClick: handleDelete,
+          className: `rounded-md p-1.5 text-xs border transition-colors ${confirmDelete ? "border-destructive text-destructive hover:bg-destructive/10" : "border-border text-muted-foreground hover:text-destructive hover:border-destructive"}`,
+          title: confirmDelete ? "Click again to confirm" : "Delete",
+          children: /* @__PURE__ */ jsx(TrashIcon, { size: 12 })
+        }
+      )
+    ] })
+  ] });
+}
 function JobsPage() {
   const [secrets, setSecrets] = useState([]);
   const [loading, setLoading] = useState(true);
   const [showAdd, setShowAdd] = useState(false);
+  const [reauthorizing, setReauthorizing] = useState(null);
   const loadSecrets = async () => {
     try {
       const result = await getAgentJobSecrets();
@@ -501,6 +541,16 @@ function JobsPage() {
         onOAuthSuccess: loadSecrets
       }
     ),
+    /* @__PURE__ */ jsx(
+      AddSecretDialog,
+      {
+        open: !!reauthorizing,
+        onAdd: handleAdd,
+        onCancel: () => setReauthorizing(null),
+        onOAuthSuccess: loadSecrets,
+        editingSecret: reauthorizing
+      }
+    ),
     secrets.length === 0 ? /* @__PURE__ */ jsx(
       EmptyState,
       {
@@ -508,7 +558,15 @@ function JobsPage() {
         actionLabel: "Add secret",
         onAction: () => setShowAdd(true)
       }
-    ) : /* @__PURE__ */ jsx("div", { className: "rounded-lg border bg-card p-4", children: /* @__PURE__ */ jsx("div", { className: "divide-y divide-border", children: secrets.map((s) => /* @__PURE__ */ jsx(
+    ) : /* @__PURE__ */ jsx("div", { className: "rounded-lg border bg-card p-4", children: /* @__PURE__ */ jsx("div", { className: "divide-y divide-border", children: secrets.map((s) => s.secretType === "oauth2" ? /* @__PURE__ */ jsx(
+      OAuthSecretRow,
+      {
+        secret: s,
+        onReauthorize: () => setReauthorizing(s),
+        onDelete: () => handleDelete(s.key)
+      },
+      s.key
+    ) : /* @__PURE__ */ jsx(
       SecretRow,
       {
         label: s.key,