fix(backend): detect stale/revoked GitHub tokens and prompt re-auth

[faizahmad-khan]

📋 Pull Request Description

When a user's GitHub token is revoked or expires, commit_files in github_service.py had no 401 handler — the GithubException(401) fell straight through to the bare except Exception block, returning a generic "Unknown error". Both the Telegram bot and VS Code /commit-direct endpoint would silently swallow this error with no recovery guidance, leaving users permanently stuck with staged files that could never be committed.

This PR implements full stale-token detection and recovery across 4 files:

1. github_service.py: Added a 401 check in commit_files' outer GithubException handler — returns {"error": "invalid_token"} instead of falling through to unknown.

2. supabase_service.py: Added clear_github_token(telegram_id) to wipe the dead credential from the database, mirroring the existing update_github_token pattern.

3. bot.py: Both commit_confirm_callback and commit_force_callback now handle invalid_token — clearing the stale token from DB and sending the user an actionable re-auth message: "🔑 Your GitHub token has expired or been revoked. Please run /auth to reconnect."

4. routes/staged_files.py: POST /commit-direct now returns HTTP 401 with a descriptive message instead of the previous generic HTTP 500, so the VS Code extension can surface a clear error to the user.

🔗 Related Issue

Closes #

🏷️ PR Type

• 🐛 Bug fix
• ✨ New feature
• 📝 Documentation
• 🔧 Refactor / code quality
• 🔒 Security fix
• 🧪 Tests

✅ Checklist

• I have commented on the issue before starting work
• My branch is up to date with main
• I have added the ECSoC26 label to this PR
• Backend PRs: I ran ruff check backend/ locally and it passes
• Extension PRs: I ran npx tsc --noEmit locally and it passes
• I have NOT included any .env files, secrets, or tokens
• I have written a clear PR description above

🧪 How to Test

1. Register with GitPhone and authenticate with GitHub via /auth
2. Stage a file from VS Code and go to Telegram → /files → select file → enter commit message → confirm
3. Before clicking confirm, go to GitHub → Settings → Developer Settings → Personal Access Tokens and revoke the token
4. Click confirm in Telegram
5. ✅ Bot now shows: "🔑 Your GitHub token has expired or been revoked. Please run /auth..." (instead of cryptic unknown error)
6. Verify the token is cleared: run /files again — the bot should prompt re-authentication
7. For VS Code path: attempt Commit All with a revoked token → extension should receive HTTP 401 with a descriptive message

📸 Screenshots (if UI changes)

N/A — backend fix only.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d6e57f7-e894-45a6-9e64-09a6d7d5332a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}