fix(worker): support Claude CIMD metadata - #961
Conversation
|
3 clusters identified |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Reviewer's GuideUpgrades the Cloudflare OAuth provider to a version that negotiates optional CIMD capabilities correctly, adds a regression test using Claude's published CIMD document to ensure the authorize endpoint works when an optional JWT grant is advertised, and records the fix in a patch changeset for the worker package. Sequence diagram for OAuth authorize flow with Claude CIMD optional JWT grantsequenceDiagram
actor Client
participant WorkerHandler as worker_handler
participant Fetch as fetch
participant ClaudeCIMD as claude_cimd_document
Client->>WorkerHandler: Request authorize (response_type=code, client_id, redirect_uri)
WorkerHandler->>Fetch: fetch(client_id)
Fetch-->>WorkerHandler: Response.json(metadata with jwt_bearer grant)
WorkerHandler->>ClaudeCIMD: [metadata parsed]
WorkerHandler-->>Client: 200 OK consent page (contains Claude)
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Aug 9, 2026 3:25p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Cloudflare Worker preview
|
PR Summary by Qodofix(worker): support Claude CIMD metadata
AI Description
Diagram
High-Level Assessment
Files changed (4)
|
Bundle ReportBundle size has no change ✅ |
MCP tool token costMCP tool token costMeasured with
Component totals
Change from baseline
Per-tool changes
Component changes
Per-tool breakdown
Per-component counts are diagnostic and non-additive because keys and separators live in complete tool objects. Per-tool counts encode each complete tool object independently. The total encodes the complete |
![gitstream-cm[bot]](https://avatars.githubusercontent.com/in/230441?s=60&v=4){kind=small}
There was a problem hiding this comment.
✨ PR Review
The dependency upgrade and changeset look correct. The regression test validates the fix, but it leaves a global fetch stub in place without cleanup and contains a now-stale explanatory comment.
2 issues detected:
🐞 Bug - `vi.stubGlobal("fetch", fetchMock)` persists after the test exits, polluting the global environment for all subsequent tests in the suite. 🛠️
Details: vi.stubGlobal("fetch", fetchMock) is called inside the test but is never cleaned up with vi.unstubAllGlobals() or vi.restoreAllMocks(). Because Vitest does not automatically restore stubs between tests, every test that runs after this one in the same describe block will receive the mock fetch (which unconditionally returns the Claude metadata response) instead of the real global fetch. This could silently break unrelated CIMD / network-dependent tests that follow.
File: packages/worker/src/worker-oauth.test.ts (935-955)
🛠️ A suggested code correction is included in the review comments.
🧾 Readability - The phrase "until the provider is upgraded" is no longer accurate once this PR is merged, making the comment misleading. 🛠️
Details: The inline comment says "this test reproduces issue #942 until the provider is upgraded", but the provider upgrade is the very change this PR delivers. After merging, the comment describes the already-resolved past state and will mislead future readers about why the test exists.
File: packages/worker/src/worker-oauth.test.ts (950-952)
🛠️ A suggested code correction is included in the review comments.
Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Review using Guidelines Learn how
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #961 +/- ##
==========================================
+ Coverage 82.65% 82.66% +0.01%
==========================================
Files 92 92
Lines 6249 6249
Branches 1769 1769
==========================================
+ Hits 5165 5166 +1
Misses 491 491
+ Partials 593 592 -1 ☔ View full report in Codecov by Harness. |
Unit Test Results 1 files 80 suites 45s ⏱️ Results for commit 2ba81db. ♻️ This comment has been updated with latest results. |
Code Review by Qodo
1.
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
|
Warning Review limit reached
Next review available in: 22 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe worker updates ChangesOAuth CIMD compatibility
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/worker/src/worker-oauth.test.ts`:
- Around line 935-936: Update the fetchMock setup in the OAuth test to validate
requested URLs, rejecting or failing for any URL other than the expected
clientId document. Assert that fetchMock was called with the clientId URL, while
preserving the existing metadata response for the valid request.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 7aa7ce95-a14d-4c6d-bfaf-d99a8e4d0975
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
.changeset/issue-942-cimd-compatibility.mdpackage.jsonpackages/worker/package.jsonpackages/worker/src/worker-oauth.test.ts
Code Review ✅ Approved 1 resolved / 1 findingsUpgrades the OAuth provider dependency and adds regression coverage to support Claude's CIMD metadata, addressing the stale comment. No issues found.
✅ 1 resolved✅ Quality: Stale comment contradicts the provider upgrade in this PR
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
1 participant
Summary
@cloudflare/workers-oauth-providerto0.10.2.@hevy-mcp/worker.Root cause
Claude's CIMD advertises
authorization_code,refresh_token, and the optionalurn:ietf:params:oauth:grant-type:jwt-bearercapability. Provider0.10.0strictly rejected the unsupported JWT grant before rendering/authorize, producing the reported400 Invalid authorization request. Provider0.10.2negotiates unsupported optional CIMD capabilities away while retaining the supported authorization-code flow.Validation
mise exec -- npm run checkmise exec -- npm run check:typesmise exec -- npm run buildmise exec -- npm run test:prmise exec -- npm run test:performancemise exec -- npm run check:changesetmise exec -- npx vitest run packages/worker/src/worker-oauth.test.tsSummary by Sourcery
Upgrade the OAuth provider dependency to restore compatibility with Claude’s CIMD-based OAuth flow and document the change as a patch release.
Enhancements:
Tests:
Chores:
Summary by CodeRabbit
Bug Fixes
Tests
Chores
✨ PR Description
Purpose: Upgrade workers-oauth-provider to support Claude's CIMD metadata with optional JWT grant type support.
Main changes:
Generated by LinearB AI and added by gitStream.
AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how