Question 1

How do I fix GitHub gatekeeper connections failing with "Bad credentials" exactly 8 hours after connecting?

Accepted Answer

This affects new GitHub OAuth apps because GitHub now issues access tokens that expire after 8 hours and provides a refresh token. Older `gatekeeper-github` versions stored only the access token and discarded `refresh_token`, causing calls to fail after expiry.

Immediate workaround:
1. In GitHub, go to **Settings → Developer settings → OAuth Apps → select your app → Optional features**.
2. Opt out of **expiring user tokens**.
3. Have each affected user **Disconnect** and then **Connect** their GitHub account once. Tokens issued before the opt-out still expire.

Permanent fix: upgrade `gatekeeper-github` to a release containing the fix for issue #641. The fix persists `refresh_token` and token expiry, refreshes before expiration using `POST https://github.com/login/oauth/access_token` with `grant_type=refresh_token`, atomically stores GitHub's rotated token pair, serializes concurrent refreshes, and prompts reconnect when GitHub returns `bad_refresh_token`. OAuth apps without `expires_in` retain the previous non-expiring behavior.

Question 2

How do I fix “Failed to find executable rm” when running workshop-frontend build or pnpm lint on Windows?

Accepted Answer

The Vite+ `clean:dist` task invokes the POSIX-only `rm` binary directly, so Windows cannot find it. In `packages/workshop-frontend/vite.config.ts`, replace `command: 'rm -rf dist'` with Node's built-in filesystem removal:

```js
'clean:dist': {
  command: `node -e "require('node:fs').rmSync('dist', { recursive: true, force: true })"`,
  cache: false,
}
```

Alternatively, update to a revision containing PR #373 (`c0ccaa1`), which uses `fs.rmSync(..., { recursive: true, force: true })`. Then rerun `pnpm exec vp run -F @gadgets/workshop-frontend --no-cache build` or `pnpm lint`.

Question 3

How do I fix bundled blueprint test failures on Windows where expected paths use '/' but actual paths use '\'?

Accepted Answer

The implementation is correct; the tests hard-code POSIX path separators. On Windows, Node's `readlinkSync()` and `path.relative()` return backslash-separated paths. Fix `scripts/build-bundled-blueprints.test.ts` by making assertions platform-aware: compare the symlink target with `path.normalize("../NOTES.md")`, and change the error-message regexes to match either separator, for example `/ignored by Git: example[\/]files[\/]dist[\/]client\.js/` and `/ignored by Git: example[\/]blueprint\.json/`. Then run `pnpm --filter @gadgets/scripts test`. This is the fix in PR #653, verified on Windows 11 and Ubuntu/WSL with Node 24.18.0. As a temporary workaround, run the tests under WSL. The separate `gatekeeper-google` failures are unrelated and are caused by Git for Windows checking out symlinks as plain files when `core.symlinks=false`.

Question 4

Why does the Confluence gatekeeper show "Credentials expired" after one hour even though the refresh token works?

Accepted Answer

The Confluence gatekeeper records the short-lived Atlassian access token's one-hour expiry as the overall credential expiry. After that time, the UI marks the account expired even though `getAccessToken()` can transparently use the rotating refresh token. To fix it, edit `packages/gatekeeper-confluence/src/confluence.ts` and remove the `expiresAt`/`new Date(grant.expiresAt)` argument from `callback.complete()`, `callback.reconnectComplete()`, and `callback.credentialsRestored()`. Rely on the normal refresh path and the explicit `credentialsExpired()` signal sent only when refresh actually fails. Until patched, using an existing Confluence binding triggers a refresh and temporarily clears the expired state; reconnecting also works but the message returns after one hour.

Question 5

How do I fix 'GitLab OAuth token response was incomplete' when connecting a self-hosted GitLab older than 15.0?

Accepted Answer

This happens with self-hosted GitLab versions before 15.0, such as GitLab 13.3, because non-expiring OAuth tokens omit `expires_in`. The GitLab gatekeeper must not treat that field as required.

Fix the token exchange handling so `expires_in` is optional; when it is missing, leave `expiresAt` empty/undefined, which the credentials kit treats as a token that never needs refreshing:

```js
if (typeof tokenResponse.expires_in === "number") {
  credentials.expiresAt = new Date(
    Date.now() + tokenResponse.expires_in * 1000
  ).toISOString();
} else {
  credentials.expiresAt = undefined; // GitLab < 15.0: token does not expire
}
```

Only `access_token` should be required. Rebuild and redeploy Cloudflare OS, remove the failed GitLab connection if necessary, and reconnect through OAuth. Alternatively, upgrade GitLab to 15.0 or newer, or use a release containing the referenced fix.

cloudflare-os

Overview

README Preview

FAQ (5)

同类型项目

vscode

FreeDomain

stable-diffusion-webui

paperclip