fix(credentials): clean up personal secrets in archived workspaces

[icecrasher321]

Summary

• Remove deleted personal-secret credential records across all workspaces, including archived workspaces and workspaces the user can no longer access.
• Reconcile against the current secret map under its lock, so delayed saves cannot remove records for newer secrets. Continue creating records only in active workspaces.
• Make the MCP discovery timeout test deterministic with a fake clock.

Type of Change

• Bug fix

Testing

• 102 tests across the credential and environment regression suites.
• 25 MCP client tests, including the discovery timeout regression.
• App type-check, repository lint, block-registry check, repository audits, and docs-manifest check.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 16, 2026 6:37pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no outstanding correctness, security, or repository-rule issues identified.

Summary

This PR reconciles personal-secret credential mirrors against the current environment map while holding the appropriate locks.

• Removes deleted personal-secret credential records from archived and inaccessible workspaces.
• Continues creating credential mirrors only for active workspaces.
• Re-reads the environment map under lock to prevent delayed saves from pruning newer secrets.
• Makes the MCP timeout assertion deterministic by freezing time within the relevant test.

Diagram

sequenceDiagram
  participant Caller
  participant Sync as Credential reconciliation
  participant DB as Database
  Caller->>Sync: Sync personal environment credentials
  Sync->>DB: Begin transaction
  Sync->>DB: Lock personal environment map
  Sync->>DB: Acquire user identity fence
  Sync->>DB: Read current secret keys
  Sync->>DB: Delete obsolete user-owned mirrors globally
  alt Current keys and active workspaces exist
    Sync->>DB: Create missing active-workspace mirrors
    Sync->>DB: Restore owner memberships
  end
  DB-->>Sync: Commit

Loading

_{Reviews (2) · Last reviewed commit: "fix(mcp): use a deterministic clock for ..."}

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}