Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the resilience of batch secret resolution by implementing a mechanism to detect authentication failures, prompt the user for re-authentication via auth_command, and then automatically retry the batch operation. This change ensures that batch secret retrieval processes can recover from temporary authentication issues without manual intervention, streamlining workflows that rely on multiple secrets from a single provider.

Highlights

• Batch Authentication Retry: Enabled the auth_command fallback behavior for batch secret resolution, allowing the system to prompt for authentication and retry the batch operation upon ProviderAuthFailed errors.
• Error Extraction: Introduced a new helper function, extract_auth_error_from_batch, to efficiently identify and extract the first authentication error from a set of batch results.
• Improved Error Handling: Modified the try_batch_with_auth_retry function to integrate the new authentication error detection and retry logic, enhancing the robustness of batch secret retrieval.

Greptile Summary

This PR extends the auth-retry logic in try_batch_with_auth_retry to cover the case where a provider returns an outer Ok but embeds ProviderAuthFailed errors inside individual per-secret entries of the result map — the path that was previously silently falling through to process_batch_results without prompting the user. The fix mirrors the existing retry flow already present in the Err(error) arm.

Key changes:

• New extract_auth_error_from_batch helper scans a HashMap<String, Result<String>> for any ProviderAuthFailed variant and returns an owned clone so it doesn't hold a borrow over batch_results.
• When an auth error is detected in the Ok arm, prompt_and_run_auth is called; on confirmation the full batch is retried and the retry results replace the original.
• When no auth command is available, the user declines, or the error is not an auth error, process_batch_results falls through to process the original results with per-secret if_missing logic — preserving prior behaviour.
• No tests were added for the new code path. The extract_auth_error_from_batch helper and the Ok-arm retry flow have no unit or integration test coverage, making the new behaviour harder to verify and regress-protect.
• The doc-comment on try_batch_with_auth_retry still describes only the Err path and should be updated.
• In mixed-error batches (some ProviderAuthFailed, some other errors), the confirm+retry path re-fetches all secrets together, and a hard Err from the retry propagates without if_missing handling — a pre-existing characteristic of the retry path that applies equally here.

Confidence Score: 4/5

• Safe to merge with minor caveats; the core logic is sound and consistent with the existing Err-arm retry pattern.
• The new code correctly mirrors the established auth-retry pattern, the happy path and the decline path both behave as expected, and there are no data-loss or security issues. Score is 4 rather than 5 primarily because there are no tests for the new code path, and the mixed-error batch edge case could silently bypass if_missing on a hard retry failure.
• src/secret_resolver.rs — specifically the new Ok(batch_results) arm and extract_auth_error_from_batch.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[try_batch_with_auth_retry] --> B[try_get_secrets_batch]
    B --> C{Result?}

    C -->|Err - hard failure| D[prompt_and_run_auth]
    D -->|Ok false - declined/unavailable| E[handle_batch_error\nif_missing per-secret]
    D -->|Ok true - auth ran| F[retry try_get_secrets_batch]
    F -->|Ok batch_results| G[process_batch_results\nif_missing per-entry]
    F -->|Err retry_error| H[Propagate error]

    C -->|Ok batch_results| I{extract_auth_error\n_from_batch?}
    I -->|None - no auth error| J[process_batch_results\nnormal path]
    I -->|Some auth_err| K[prompt_and_run_auth\nNEW PATH]
    K -->|Ok false - declined/unavailable| L[process_batch_results\noriginal results with if_missing]
    K -->|Ok true - auth ran| M[retry try_get_secrets_batch\nNEW PATH]
    M -->|Ok retry_results| N[process_batch_results\nretry results]
    M -->|Err| O[Propagate error\nno if_missing]

    style K fill:#c8f7c5
    style M fill:#c8f7c5
    style N fill:#c8f7c5
    style L fill:#c8f7c5

_{Last reviewed commit: 9e6a976}