fix(oauth): drop legacy credential backup on destructive mutations

[luvs01]

Summary

• auth.json.pre-multiauth is a one-time downgrade-recovery copy of the whole legacy credential store, written on the first new-shape persist. Destructive mutations went through the same path: removeCredential/removeAccount left an existing backup behind, and a still-legacy store even created the backup during the logout itself — so after the user removed an account, a file holding the very refresh tokens they destroyed remained on disk.
• mutateStore gains a removeLegacyBackup option: it skips the one-time create and unlinks the backup after the store is persisted. removeCredential and removeAccount opt in.
• Removal is best-effort (ENOENT ignored, other failures warn) because it runs after persist — a failed unlink must not report a failed logout for an account that is already gone. A stale uninstall-manifest entry is harmless: removeOwnedConfigState skips missing paths, so this composes with the owned-cleanup registration from fix(oauth): register legacy recovery backups for owned cleanup #4572.
• Automatic rollback paths (replaceProviderAccountSet, provider rekey) do not opt in — they are not user-initiated credential destruction.

Verification

• Head: 8640e2039c4d28a52e5320d92d9a543a5e4575db (tree cc1951344b636766b638741b00ca592885f0c7f0), based on dev a0f611d4aceb9476d44268e43722273b7b211846.
• bun test tests/oauth/oauth-store-multi.test.ts — 44 pass / 0 fail, including new regressions covering destructive-migration, pre-existing-backup, and stale-backup-on-migrated-store cases.
• bun x tsc --noEmit — clean.
• bun run structure:check — passed (structure/overview.md updated to describe the removal).
• bun run privacy:scan — passed.
• bun scripts/file-size-ratchet.ts — passed.

Remaining gates

• Fork CI dispatched via gh workflow run ci.yml: run 35279061859. The macOS control job is expected to cancel at the 30-minute mark; that is the known upstream limitation tracked in [Bug]: macOS control is cancelled near its 30-minute limit in full dispatch CI #4905, not a signal from this change. Occasional shard flakes are likewise known upstream noise.
• This touches src/oauth/, which the intake gate may classify as a restricted surface requiring maintainer sponsorship.
• No gui/ files are touched, so the UI-screenshot gate does not apply.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/store.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/store.ts.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[lidge-jun]

Reimplemented in #5598 on top of your three commits (authorship kept), with Co-authored-by on the repairs. Provider deletion is now covered too. Only the removed provider leaves the downgrade backup, so other providers keep recovery. The backup is never written through a symlink, and one an earlier install left unregistered stays unclaimed. Thank you, @luvs01. Closing in favor of #5598.