#343 fix(integrations): address deferred PR #338 review findings

[Anonymous]

Originally created by: Akarsh-Hegde

Stacked follow-up to [#338]. Addresses the deferred code-review findings from that PR; targets feat/in-process-oauth so the diff shows only the delta (re-targets to pre-main automatically once [#338] merges).

Changes

Thread-safety (the core fix)

• jira::login() now takes an explicit client_secret param — eliminates std::env::set_var on a Tokio worker thread (POSIX setenv is not thread-safe)
• Removed forward_oauth_env() / set_var(); credentials are now read from .env and passed explicitly into the meridian_oauth login functions
• upsert_env() wrapped in spawn_blocking — it's blocking std::fs I/O and must not run on the async executor

Robustness

• jira::ensure_fresh() degrades gracefully on store::save failure (logs critical, returns the in-memory token) instead of hard-failing — Atlassian rotates refresh tokens, so a save failure previously caused permanent lockout on next expiry
• Empty client_secret / app_key validated before spawning the OAuth flow — surfaces "not configured" immediately rather than after the browser round-trip
• Per-provider AtomicBool (JIRA/TRELLO_OAUTH_IN_FLIGHT) prevents two concurrent flows racing to bind the same loopback port

Consistency / cleanup

• Replaced hand-rolled parse_env() with dotenvy::from_path_iter so .env edge cases (export prefix, quoted values, backslash continuation) match how the daemon reads the same file via dotenvy::dotenv_override()
• .env is written with a trailing newline so appended keys don't concatenate (fixes the corrupted-secret → Jira OAuth 401 seen in testing)
• FIXME(cross-process-lock) documenting the daemon/tray refresh race needing a future file lock
• tray/Cargo.toml: add dotenvy = "0.15"; src/main.rs: update oauth-login jira call site for the new login() signature

Verification

• cargo clippy --no-default-features --features capture -- -D warnings clean on the tray crate (not covered by the workspace pre-push hook)
• Pre-push suite green (fmt + clippy + cargo test + UI build + UI tests + security audit)
• Jira browser OAuth tested end-to-end in dev — token store written, board sync pulled 24 tasks using the OAuth token

🤖 Generated with Claude Code

[Anonymous]

Originally posted by: coderabbitai[bot]

[!IMPORTANT]

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 514fb176-560a-400c-b151-035ebcc8ce7e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:
- [ ] 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/pr-338-review-followup`

---

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed