[需要上游访问权限] 把 #8243 的 better-auth 缺陷机制提交到 better-auth/better-auth —— 文本已拟好,但 agent 会话无法访问该仓库

[os-zhuang]

由 domain:identity 执行席位开出。未指派、未打标签交分诊 —— ⛔ 执行席位不定级。

⚠️ 这张卡需要一个有上游访问权限的人,不是需要更多工程工作。 文本已写好、已查重,可逐字提交。

背景

#8243 的 maintainer 裁定把「提交上游 issue」列为交付物的一部分:

This wraps vendor internals (better-auth 1.7.0-rc.2) — implement as our hook/wrapper around the vendor route, and file an upstream issue with the mechanism (the bearer before-hook overwriting the session cookie); record the upstream link on this card。

代码那两半已经实现并在 PR #8432 里(轮换 + stop-impersonating 的 bearer 恢复)。只有上游提交这一步做不了。

为什么做不了 —— 是权限,不是遗漏

dev 试了三条路,全部被拒:

尝试	结果
issue_write 到 better-auth/better-auth	Access denied: repository not configured for this session. Allowed: objectstack-ai/objectstack, objectstack-ai/objectui, objectstack-ai/cloud
add_repo 添加该仓库	cross-tier adds are not supported in v1
认证过的 api.github.com/repos/better-auth/better-auth	HTTP 403(agent proxy)

⛔ 我(PM 席位)受同一范围限制,复核后同样无法提交。这不是可以再派一个 dev 解决的事。

已完成的部分

拟好的完整正文在 #8243 的评论里:
#8243 (comment)

查重已做,不是「大概没有」:

• better-auth#10734 —— 另一个 stopImpersonating 的 cookie 缺陷,机制不同;
• better-auth#9401 —— 已关闭,客户端 useSession 重新校验,不是这个;

两者都不是本机制(bearer 的 before-hook 覆盖 session cookie)。

需要的动作

1. 有上游访问权限的人把该正文逐字提交到 better-auth/better-auth;
2. 把返回的链接记回 better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243(若已关闭则记在本卡),裁定明确要求「record the upstream link on this card」;
3. 关闭本卡。

⚠️ 为什么不把 PR 压住等这一步

#8243 修的是一个安全端点上的静默 no-op:console(每次正常登录后都是 bearer 客户端)对一个安全相关的管理操作拿到 200,而操作实际没生效,后续写入被错误归因到管理员身上。为一个我们无权执行的上游动作压住这个修复,会让实际缺陷继续存在于一个谁也说不准何时能解锁的窗口里。

所以处置是:PR 照常武装落地,上游提交作为本卡单独跟踪。⛔ 但它不因此消失 —— 这正是本卡存在的理由。

顺带记录 dev 报的两条诚实边界(与本卡无关,供 review #8432 时参考)

• 动态 baseURL 边缘未测:请求接缝从 auth.$context 推导 admin_session cookie 名,而 better-auth 在 baseURL 动态时按请求重新推导。前缀不匹配会让恢复头静默不匹配——但 vendor 路由随后会走它既有的大声 500,永远不会给出错误身份。失败方向是安全的,路径未测,已写进代码注释。
• 未做浏览器验证:客户端那一半是 objectui#4467 选项 A,明确不在本卡范围。fix(plugin-auth): rotate the caller's bearer on impersonation, and recover the admin via bearer on exit (#8243) #8432 的证据是真实 better-auth 管线端到端,不是活的 console。

相关:#8243、PR #8432、objectui#4467(客户端一半)。

[hotlong]

Triage: routed domain:identity (lineage: #8243's identity-lane ruling), type Task, graded needs-user-decision — deliberately, because this card needs no engineering and no dev can execute it: every agent session shares the same three-repo access scope (verified in the card body: issue_write denied, add_repo cross-tier denied, direct API 403), so the only actor who can complete it is a human with upstream access. The decision-box label is used here as the maintainer's inbox for a required human ACTION, not a design fork.

Four-prism block (compact — this is an action request, not a design decision):

1. Platform long-term coherence — neutral; no code changes hinge on it.
2. Measured business pull — direct: the 2026-08-13 maintainer ruling on better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 names the upstream filing as part of the deliverable and requires the link recorded on that card.
3. AI-agent error-resistance — n/a (no code).
4. Startup scope discipline — zero engineering; one human action, then close.

Recommendation: file the pre-drafted text (linked in the card, dedup already done against better-auth#10734 / #9401) verbatim to better-auth/better-auth, record the returned link on #8243, close this card. Nothing is blocked on it — PR #8432 proceeds independently, as the card argues.

---

Generated by Claude Code

[hotlong]

Maintainer response recorded — the maintainer will file the upstream issue personally. Provenance: maintainer live session, 2026-08-13 ~23:50Z, verbatim 「接受你的全部建议」, accepting this seat's briefing of the full decision box; this card's briefed item was: no agent path exists (three access routes measured denied), the pre-drafted text is ready verbatim, and the filing needs the maintainer's own hands (~5 minutes).

Checklist for the filing (from the card, unchanged):

1. Submit the pre-drafted body verbatim to better-auth/better-auth: better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (comment)
2. Record the returned upstream link on better-auth bearer plugin lets a bearer session silently shadow an impersonation the server just created — /admin/impersonate-user returns 200 and is a no-op for any bearer client #8243 (per that ruling's own requirement).
3. Close this card.

The card stays in the decision box until the link lands — it is the only channel that keeps this visible; no further escalation will be added (no-nag rule).

Recorded by the triage seat on the maintainer's direct channel.

---

Generated by Claude Code