Why: the auth middleware prefers Bearer keys over the session cookie, so a stale key left in localStorage shadows valid cookie sessions - every request after password login returns 401 and refreshes bounce back to the login gate (observed 2026-10-11). Evidence: vitest 19 files / 88 tests green (auth.test.ts covers beginSession clearing the stored Bearer); CI on PR head 09310cb is the authoritative gate. Impact: password logins switch cleanly to the HttpOnly cookie session; API-key login unchanged. Refs: task card feature/login-clear-stale-key in Agent-System-Dev.
Why: the auth middleware prefers Bearer keys over the session cookie, so a stale key left in localStorage shadows valid cookie sessions - every request after password login returns 401 and refreshes bounce back to the login gate (observed 2026-10-11). Evidence: vitest 19 files / 88 tests green (auth.test.ts covers beginSession clearing the stored Bearer); CI on PR head 09310cb is the authoritative gate. Impact: password logins switch cleanly to the HttpOnly cookie session; API-key login unchanged. Refs: task card feature/login-clear-stale-key in Agent-System-Dev.
Why: the auth middleware prefers Bearer keys over the session cookie, so a stale key left in localStorage shadows valid cookie sessions and every request after password login returns 401 (observed at http://192.168.3.2:8788 on 2026-10-11).
Evidence: modules/frontend vitest 19 files / 88 tests green; auth.test.ts covers beginSession clearing the stored Bearer before any fetch.
Impact: password logins switch to the HttpOnly cookie session cleanly; API-key logins unchanged.
Refs: task card feature-login-clear-stale-key in Agent-System-Dev.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: the auth middleware prefers Bearer keys over the session cookie, so a stale key left in localStorage shadows valid cookie sessions - every request after password login returns 401 and refreshes bounce back to the login gate (observed 2026-10-11). Evidence: vitest 19 files / 88 tests green (auth.test.ts covers beginSession clearing the stored Bearer); CI on PR head
09310cbis the authoritative gate. Impact: password logins switch cleanly to the HttpOnly cookie session; API-key login unchanged. Refs: task card feature/login-clear-stale-key in Agent-System-Dev.