feat: persist auth session to disk across restarts (#5)

* feat: persist auth session to disk across restarts

The GitHub OAuth token was only stored in-memory (AppState.token),
so every app restart required re-authenticating. Now the token is
saved to/loaded from a file in the app data directory.

Changes:
- auth.rs: added save_token_to_disk(), load_token_from_disk(),
  delete_token_from_disk() helpers using app data dir
- auth.rs: poll_for_token_cmd and poll_for_token now persist the
  token after successful OAuth
- auth.rs: logout_cmd deletes the persisted token
- lib.rs: setup closure loads saved token before checking auth state

* fix: use SHA-256 for Stronghold key derivation (32 bytes)

DefaultHasher only produced 8 bytes. Stronghold expects a 32-byte key.
Switch to sha2::Sha256 for proper key derivation.

* fix: restrict token file permissions + validate on startup

Addresses review feedback:
- P1: Token file now written with mode 0o600 on Unix (owner-only).
  Uses platform-specific write_token_file helper (std::fs::write
  fallback on Windows).
- P2: On startup, an async task validates the restored token via
  GET /user. If the token is confirmed invalid (401/403), it is
  cleared from memory and disk, and the tray falls back to sign-in.
  Network errors are tolerated (keeps the session for offline use).

* fix: only invalidate token on 401/403, not transient errors

validate_token now returns None (keep token) for 429/5xx responses
instead of Some(false), avoiding false logouts from rate limits or
GitHub outages.

* fix: guard token clear against race with fresh login

Before clearing an invalid token, re-check that it still matches
the one we validated. If the user re-authenticated while the async
validation was in-flight, keep the new token.

* docs: add Codex review comment workflow to AGENTS.md

Documents the requirement that all Codex review comments must be
resolved before merging, and the poll-fix-resolve loop.

* fix: emit auth-cleared event to frontend + poller detects revoked tokens

- lib.rs: emits 'auth-cleared' event when startup validation clears
  an invalid token, so the frontend switches to the login screen
- App.svelte: listens for 'auth-cleared' and resets auth state
- poller.rs: on fetch error, validates the token and clears session
  if confirmed invalid (401/403), preventing a stuck auth loop

* fix: poller guards token clear with identity check + clears PR caches

- Guards token clear with as_deref() == Some(&token) check, same as
  the startup validator, to avoid wiping a fresh login.
- Clears prs and previous_prs caches when invalidating, preventing
  stale data and incorrect notifications on re-login.

* fix: add libayatana-appindicator3 as Linux package dependency

- tauri.conf.json: added deb.depends and rpm.depends so the tray
  library installs automatically via .deb/.rpm packages
- AGENTS.md: added Linux Prerequisites section with install commands
  for Arch/Manjaro, Ubuntu/Debian, and Fedora

* fix: enable Wayland clipboard support on Linux

arboard's wayland-data-control feature is needed for clipboard
access on Wayland compositors (KDE/GNOME/Sway). Falls back to
X11 automatically when Wayland is unavailable.

* fix: register auth-cleared listener before init + only 401 invalidates token

- App.svelte: moved event listener registration before init() to
  avoid missing auth-cleared from fast startup validation
- github.rs: validate_token now only returns Some(false) for 401,
  not 403 (GitHub uses 403 for rate limits/abuse, not just bad creds)

* fix: await listener registration before init in App.svelte

listen() is async — fire-and-forget .then() still allowed init()
to race ahead. Now both listeners are awaited in a setup() function
before init() runs, closing the event-drop window.

Author: ibetitsmike

AGENTS.md

@@ -103,6 +103,18 @@ All commands are registered in `lib.rs` via `invoke_handler`. Frontend calls the
 |-------|-----------|---------|
 | `prs-updated` | Rust → Frontend | `PullRequest[]` |
 
+### Linux Prerequisites
+
+The system tray requires `libayatana-appindicator3`. Install it before running `make dev` or the release binary:
+
+| Distro | Command |
+|--------|---------|
+| Arch / Manjaro | `sudo pacman -S libayatana-appindicator` |
+| Ubuntu / Debian | `sudo apt install libayatana-appindicator3-dev` |
+| Fedora | `sudo dnf install libayatana-appindicator-gtk3` |
+
+The `.deb` and `.rpm` bundles declare this as a package dependency so it installs automatically when users install through those package formats. Arch/pacman users must install it manually.
+
 ## Essential Commands
 
 ```bash
@@ -284,3 +296,14 @@ Common prefixes: `feat`, `fix`, `chore`, `refactor`, `docs`.
 - Summarise what changed and why.
 - List files modified by category (Rust backend / Svelte frontend / config).
 - Note any build verification results (`npm run check`, `npm run vite:build`, `cargo check`).
+
+### Codex Review Comments
+
+Every PR with Codex reviews enabled must have **zero unresolved review comments** before merging. Follow this workflow:
+
+1. After pushing, poll for new Codex review comments (`gh api repos/{owner}/{repo}/pulls/{number}/comments`).
+2. For each new comment, fix the issue in code, commit, and push.
+3. Reply to each comment explaining the fix, then resolve the review thread via the GraphQL `resolveReviewThread` mutation.
+4. Repeat: each push may trigger a new Codex review. Keep polling (~2 min intervals) until no new comments appear after the latest push.
+5. Only consider the PR ready to merge when all review threads are resolved and no new comments arrive.
+

src-tauri/Cargo.toml

@@ -16,4 +16,5 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
 chrono = { version = "0.4", features = ["serde"] }
-arboard = "3"
+arboard = { version = "3", features = ["wayland-data-control"] }
+sha2 = "0.10"

src-tauri/src/auth.rs

@@ -1,10 +1,12 @@
 use reqwest::Client;
 use serde::{Deserialize, Serialize};
+use tauri::Manager;
 use tauri::State;
 
 use crate::state::AppState;
 
 const GITHUB_CLIENT_ID: &str = "Ov23liCVKFN3jOo9R7HS";
+const TOKEN_FILE: &str = "auth_token";
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct DeviceCodeResponse {
@@ -39,6 +41,65 @@ fn get_client_id() -> String {
     std::env::var("GITHUB_CLIENT_ID").unwrap_or_else(|_| GITHUB_CLIENT_ID.to_string())
 }
 
+// --- Token persistence (app data dir) ---
+
+fn save_token_to_disk(app: &tauri::AppHandle, token: &str) {
+    match app.path().app_data_dir() {
+        Ok(dir) => {
+            if let Err(e) = std::fs::create_dir_all(&dir) {
+                eprintln!("[auth] Failed to create app data dir: {}", e);
+                return;
+            }
+            let path = dir.join(TOKEN_FILE);
+            // Write with restrictive permissions (owner-only on Unix)
+            if let Err(e) = write_token_file(&path, token) {
+                eprintln!("[auth] Failed to save token to disk: {}", e);
+            } else {
+                eprintln!("[auth] Token persisted to disk");
+            }
+        }
+        Err(e) => eprintln!("[auth] Failed to resolve app data dir: {}", e),
+    }
+}
+
+#[cfg(unix)]
+fn write_token_file(path: &std::path::Path, token: &str) -> std::io::Result<()> {
+    use std::io::Write;
+    use std::os::unix::fs::OpenOptionsExt;
+    let mut file = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .mode(0o600)
+        .open(path)?;
+    file.write_all(token.as_bytes())
+}
+
+#[cfg(not(unix))]
+fn write_token_file(path: &std::path::Path, token: &str) -> std::io::Result<()> {
+    std::fs::write(path, token)
+}
+
+pub(crate) fn load_token_from_disk(app: &tauri::AppHandle) -> Option<String> {
+    let dir = app.path().app_data_dir().ok()?;
+    let path = dir.join(TOKEN_FILE);
+    match std::fs::read_to_string(&path) {
+        Ok(token) if !token.is_empty() => {
+            eprintln!("[auth] Loaded saved token from disk");
+            Some(token)
+        }
+        _ => None,
+    }
+}
+
+pub(crate) fn delete_token_from_disk(app: &tauri::AppHandle) {
+    if let Ok(dir) = app.path().app_data_dir() {
+        let path = dir.join(TOKEN_FILE);
+        let _ = std::fs::remove_file(&path);
+        eprintln!("[auth] Token deleted from disk");
+    }
+}
+
 #[tauri::command]
 pub async fn start_device_flow_cmd() -> Result<DeviceCodeResponse, AuthError> {
     let client = Client::new();
@@ -78,6 +139,7 @@ pub async fn start_device_flow_cmd() -> Result<DeviceCodeResponse, AuthError> {
 pub async fn poll_for_token_cmd(
     device_code: String,
     state: State<'_, AppState>,
+    app: tauri::AppHandle,
 ) -> Result<bool, AuthError> {
     let client = Client::new();
     let client_id = get_client_id();
@@ -119,6 +181,7 @@ pub async fn poll_for_token_cmd(
         eprintln!("[auth] ✅ Token received ({}...)", &token[..8.min(token.len())]);
         let mut stored_token = state.token.lock().unwrap();
         *stored_token = Some(token.clone());
+        save_token_to_disk(&app, token);
         Ok(true)
     } else if let Some(error) = token_response.error {
         eprintln!("[auth] GitHub response: error={}, desc={:?}", error, token_response.error_description);
@@ -138,7 +201,7 @@ pub async fn poll_for_token_cmd(
 }
 
 #[tauri::command]
-pub async fn logout_cmd(state: State<'_, AppState>) -> Result<(), AuthError> {
+pub async fn logout_cmd(state: State<'_, AppState>, app: tauri::AppHandle) -> Result<(), AuthError> {
     let mut token = state.token.lock().unwrap();
     *token = None;
     let mut user = state.user.lock().unwrap();
@@ -147,6 +210,7 @@ pub async fn logout_cmd(state: State<'_, AppState>) -> Result<(), AuthError> {
     prs.clear();
     let mut previous_prs = state.previous_prs.lock().unwrap();
     previous_prs.clear();
+    delete_token_from_disk(&app);
     Ok(())
 }
 
@@ -192,7 +256,7 @@ pub async fn start_device_flow() -> Result<DeviceCodeResponse, AuthError> {
 }
 
 /// Non-command version: takes &AppState directly instead of State<'_, AppState>
-pub async fn poll_for_token(device_code: &str, state: &AppState) -> Result<bool, AuthError> {
+pub async fn poll_for_token(device_code: &str, state: &AppState, app: &tauri::AppHandle) -> Result<bool, AuthError> {
     let client = Client::new();
     let client_id = get_client_id();
     eprintln!("[auth] Polling for token (device_code={}...)", &device_code[..8.min(device_code.len())]);
@@ -233,6 +297,7 @@ pub async fn poll_for_token(device_code: &str, state: &AppState) -> Result<bool,
         eprintln!("[auth] ✅ Token received ({}...)", &token[..8.min(token.len())]);
         let mut stored_token = state.token.lock().unwrap();
         *stored_token = Some(token.clone());
+        save_token_to_disk(app, token);
         Ok(true)
     } else if let Some(error) = token_response.error {
         eprintln!("[auth] GitHub response: error={}, desc={:?}", error, token_response.error_description);

src-tauri/src/github.rs

@@ -186,6 +186,32 @@ pub async fn fetch_user_info(token: &str) -> Result<GitHubUser, AuthError> {
     })
 }
 
+/// Validate a token by making a lightweight API call.
+/// Returns true only if the token is confirmed valid (200 OK).
+/// Returns false only for a definitive 401 Unauthorized.
+/// Returns None for network errors or any other status (403 can
+/// mean rate-limiting/abuse, not just bad credentials).
+pub async fn validate_token(token: &str) -> Option<bool> {
+    let client = Client::new();
+    let response = client
+        .get("https://api.github.com/user")
+        .header("Authorization", format!("Bearer {}", token))
+        .header("User-Agent", "PR-Buddy")
+        .send()
+        .await
+        .ok()?; // Network error → None (don't clear token)
+    let status = response.status();
+    if status.is_success() {
+        Some(true)
+    } else if status.as_u16() == 401 {
+        Some(false)
+    } else {
+        // 403 (rate limit/abuse), 429, 5xx, etc. — don't invalidate
+        eprintln!("[auth] Token validation got HTTP {}, treating as transient", status);
+        None
+    }
+}
+
 #[tauri::command]
 pub async fn get_pull_requests_cmd(
     state: State<'_, AppState>,

src-tauri/src/lib.rs

@@ -7,7 +7,7 @@ mod poller;
 mod state;
 
 use tauri::tray::TrayIconBuilder;
-use tauri::Manager;
+use tauri::{Emitter, Manager};
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
@@ -16,11 +16,9 @@ pub fn run() {
         .plugin(tauri_plugin_notification::init())
         .plugin(
             tauri_plugin_stronghold::Builder::new(|password| {
-                use std::hash::{DefaultHasher, Hasher};
-                let mut hasher = DefaultHasher::new();
-                hasher.write(password.as_bytes());
-                let hash = hasher.finish();
-                hash.to_le_bytes().to_vec()
+                use sha2::{Sha256, Digest};
+                let hash = Sha256::digest(password.as_bytes());
+                hash.to_vec()
             })
             .build(),
         )
@@ -35,6 +33,13 @@ pub fn run() {
             github::refresh_prs_cmd
         ])
         .setup(|app| {
+            // Restore saved auth token from disk (if any)
+            if let Some(saved_token) = auth::load_token_from_disk(app.handle()) {
+                let state = app.state::<state::AppState>();
+                *state.token.lock().unwrap() = Some(saved_token);
+                eprintln!("[setup] Restored auth session from disk");
+            }
+
             // Build initial menu based on auth state
             let state = app.state::<state::AppState>();
             let is_authed = state.token.lock().unwrap().is_some();
@@ -81,6 +86,55 @@ pub fn run() {
 
             poller::start_polling(app.handle().clone());
 
+            // Validate restored token asynchronously (don't block startup).
+            // If the token is revoked/invalid, clear it and fall back to sign-in.
+            if is_authed {
+                let app_handle = app.handle().clone();
+                tauri::async_runtime::spawn(async move {
+                    let token = {
+                        let state = app_handle.state::<state::AppState>();
+                        let val = state.token.lock().unwrap().clone();
+                        val
+                    };
+                    if let Some(token) = token {
+                        match github::validate_token(&token).await {
+                            Some(false) => {
+                                // Token is confirmed invalid (401/403) — clear it,
+                                // but only if the token hasn't been replaced by a
+                                // fresh login while we were validating.
+                                let state = app_handle.state::<state::AppState>();
+                                let mut current = state.token.lock().unwrap();
+                                if current.as_deref() == Some(&token) {
+                                    eprintln!("[setup] Saved token is invalid, clearing session");
+                                    *current = None;
+                                    drop(current);
+                                    auth::delete_token_from_disk(&app_handle);
+                                    {
+                                        let tray_guard = state.tray.lock().unwrap();
+                                        if let Some(tray) = tray_guard.as_ref() {
+                                            if let Ok(m) = menu::build_auth_menu(&app_handle) {
+                                                let _ = tray.set_menu(Some(m));
+                                            }
+                                        }
+                                    }
+                                    // Notify the frontend so it switches to the login screen
+                                    let _ = app_handle.emit("auth-cleared", ());
+                                } else {
+                                    eprintln!("[setup] Token changed during validation, keeping new session");
+                                }
+                            }
+                            Some(true) => {
+                                eprintln!("[setup] Saved token validated successfully");
+                            }
+                            None => {
+                                // Network error — keep the token, poller will retry
+                                eprintln!("[setup] Could not validate token (offline?), keeping session");
+                            }
+                        }
+                    }
+                });
+            }
+
             Ok(())
         })
         .run(tauri::generate_context!())
@@ -163,7 +217,7 @@ fn handle_menu_event(app: &tauri::AppHandle, id: &str) {
                             }
 
                             let state = app.state::<state::AppState>();
-                            match auth::poll_for_token(&resp.device_code, &state).await {
+                            match auth::poll_for_token(&resp.device_code, &state, &app).await {
                                 Ok(true) => {
                                     eprintln!("[auth] ✅ Authenticated via menu");
                                     let token = {

src-tauri/src/poller.rs

@@ -3,6 +3,8 @@ use std::time::Duration;
 
 use tauri::{AppHandle, Emitter, Manager};
 
+use crate::auth;
+
 use crate::github::fetch_pull_requests;
 use crate::models::{CheckStatus, PullRequest};
 use crate::notifications::{diff_pr_states, send_notification};
@@ -79,6 +81,38 @@ pub fn start_polling(app_handle: AppHandle) {
                         tokio::time::sleep(Duration::from_secs(interval)).await;
                     }
                     Err(_) => {
+                        // Check if this is an auth failure (revoked token)
+                        match crate::github::validate_token(&token).await {
+                            Some(false) => {
+                                // Token is confirmed invalid — clear session,
+                                // but only if it hasn't been replaced by a fresh login.
+                                let state = app_handle.state::<AppState>();
+                                let mut current = state.token.lock().unwrap();
+                                if current.as_deref() == Some(token.as_str()) {
+                                    eprintln!("[poller] Token is invalid, clearing session");
+                                    *current = None;
+                                    drop(current);
+                                    auth::delete_token_from_disk(&app_handle);
+                                    // Clear cached PR state to avoid stale data on re-login
+                                    state.prs.lock().unwrap().clear();
+                                    state.previous_prs.lock().unwrap().clear();
+                                    {
+                                        let tray_guard = state.tray.lock().unwrap();
+                                        if let Some(tray) = tray_guard.as_ref() {
+                                            if let Ok(m) = crate::menu::build_auth_menu(&app_handle) {
+                                                let _ = tray.set_menu(Some(m));
+                                            }
+                                        }
+                                    }
+                                    let _ = app_handle.emit("auth-cleared", ());
+                                } else {
+                                    eprintln!("[poller] Token changed during validation, keeping new session");
+                                }
+                            }
+                            _ => {
+                                // Network/transient error — keep token, retry later
+                            }
+                        }
                         tokio::time::sleep(Duration::from_secs(POLL_INTERVAL_IDLE)).await;
                     }
                 }

src-tauri/tauri.conf.json

@@ -38,9 +38,13 @@
       "icons/icon.ico"
     ],
     "linux": {
+      "deb": {
+        "depends": ["libayatana-appindicator3-1"]
+      },
       "rpm": {
         "epoch": 0,
-        "release": "1"
+        "release": "1",
+        "depends": ["libayatana-appindicator-gtk3"]
       }
     }
   },