disable requireOAuthToken for agentview task #12322
Conversation
|
Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message. |
There was a problem hiding this comment.
Pull request overview
This PR temporarily disables OAuth token validation for the agent-task command by commenting out the requireOAuthToken call in the PersistentPreRunE hook. The change is explicitly marked as temporary while feature flagging work is in progress for agent tasks.
Key Changes
- Disabled OAuth token authentication requirement for agent-task commands
- Added a NOTE comment explaining this is temporary for feature flagging work
- Changed PersistentPreRunE to return nil instead of validating OAuth tokens
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // NOTE: Temporarily disabled while we work on agent tasks feature flagging. | ||
| // return requireOAuthToken(f) | ||
| return nil |
There was a problem hiding this comment.
The OAuth token validation has been disabled, but all the existing test cases in agent_task_test.go still assume this validation is active. These tests verify various token scenarios (oauth_token, keyring, enterprise, etc.) and expect errors when invalid tokens are provided. With the validation disabled, all these tests will now pass regardless of token validity, making them ineffective at catching regressions. The tests should either be updated to reflect the current behavior or skipped/marked as pending until the OAuth validation is re-enabled.
| `), | ||
| PersistentPreRunE: func(cmd *cobra.Command, args []string) error { | ||
| return requireOAuthToken(f) | ||
| // NOTE: Temporarily disabled while we work on agent tasks feature flagging. |
There was a problem hiding this comment.
Disabling OAuth token validation removes an important security control that ensures only properly authenticated users can access agent task commands. The comment indicates this is temporary for feature flagging work, but there's no tracking mechanism (like a TODO with a ticket reference) to ensure this security check is re-enabled. Consider adding a TODO comment with a reference to the tracking issue to prevent this temporary change from becoming permanent.
| // NOTE: Temporarily disabled while we work on agent tasks feature flagging. | |
| // NOTE: Temporarily disabled while we work on agent tasks feature flagging. | |
| // TODO(gh/cli#12345): Re-enable OAuth token validation after agent tasks feature flagging is complete. |
No description provided.