fix(workflow-executor): harden OAuth reauth and token write-back [PRD-692]

[hercemer42]

What

Two correctness fixes on the executor OAuth2 MCP runtime, surfaced in the PR2 (#1665) review and deliberately deferred to land before the feature is enabled (PRD-627). Both touch the store-port surface, so they're bundled.

• Reauth pause stranding idempotencyPhase: 'executing' (HIGH) — a reauth pause left the write-ahead marker set, so the resumed step was rejected with "Step execution was interrupted". Added deleteStepExecution(runId, stepIndex) to the RunStore port (both store impls) and clear the marker on the OAuthReauthRequiredError path.
• Refresh write-back resurrecting a deleted credential (MED) — the rotated-token write-back now uses an atomic updateIfPresent (UPDATE … WHERE) on the credentials store instead of get-then-upsert, so a concurrent disconnect (DELETE) cannot be resurrected. upsert stays for the consent deposit path.

Audit-log behavior (intentional)

A re-auth pause's MCP tool call genuinely 401'd, so it surfaces as a failed activity-log entry. The audit records the call (which failed); the run history records the step (which pauses with needs-oauth-reauth and resumes). PR2's original "spurious failure" finding was reconsidered and dropped: the failure is real and worth surfacing for observability, and the resumed run logs its own entry — so no audit special-casing. (The earlier paused-status follow-up, PRD-693, is cancelled for the same reason.)

Stacking

Stacked on PR2 (#1665) — this PR targets feat/prd-367-pr2-executor-oauth-runtime, not main, because the OAuth runtime code it fixes only exists on that branch. Once PR2 merges, rebase and repoint this PR to main.

Tests

• Behavioral tests: resume-after-reauth (idempotency marker cleared), a re-auth pause audited as failed while the step pauses, and the write-back race (a concurrently-deleted credential is not resurrected).
• deleteStepExecution covered in both run stores; updateIfPresent covered in both credential stores (updates in place / does not insert when absent).
• Impacted suites green; tsc + eslint clean. Postgres *.pg.test.ts left to CI.

fixes PRD-692

🤖 Generated with Claude Code

Note

Harden OAuth re-auth pause state and rotated refresh token write-back in McpStepExecutor

• When an OAuth re-auth pause is triggered, McpStepExecutor.doExecute now calls a new clearReauthPauseState() helper before returning awaiting-input, preventing later resumes from being rejected as interrupted due to a stale executing write-ahead marker.
• clearReauthPauseState clears only the idempotencyPhase when pendingData exists (preserving confirmation-flow state), or deletes the step execution record entirely when there is no pendingData.
• OAuthTokenService.persistRotatedRefreshToken now calls store.updateIfPresent(id, ...) instead of store.upsert(...), making rotated token write-backs a no-op if the credential row was deleted or replaced since the token was read.
• Both McpOAuthCredentialsStore and RunStore interfaces gain new methods (updateIfPresent and deleteStepExecution) implemented across the database and in-memory stores.
• Risk: resumes that previously succeeded despite a stale write-ahead marker will now require the OAuth re-auth flow to complete before proceeding.

^{Macroscope summarized 50b58c5.}

[linear-code]

PRD-692

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (6)

Rating	File	% Diff	Uncovered Line #s
	...ow-executor/src/stores/database-mcp-oauth-credentials-store.ts	100.0%
	packages/workflow-executor/src/oauth/token-service.ts	100.0%
	packages/workflow-executor/src/stores/in-memory-store.ts	100.0%
	...w-executor/src/stores/in-memory-mcp-oauth-credentials-store.ts	100.0%
	packages/workflow-executor/src/executors/mcp-step-executor.ts	100.0%
	packages/workflow-executor/src/stores/database-store.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[Scra3]

praise: the clearReauthPauseState fix correctly clears the write-ahead 'executing' marker on the tool-call re-auth-pause path (delete for FullyAutomated, keep pendingData for confirmation flows), with resume-to-success and cleanup-failure coverage; the updateIfPresent id-scoped write-back also correctly stops a concurrent disconnect from resurrecting a deleted credential. No issues in this PR's diff. Heads-up: the SSRF blocker for this feature lives in the base branch (#1665, oauth/refresh-grant.ts — fetch follows redirects), and the evict/set race is also base-branch code.