Legacy updateDataSource can release old credentials before the DB write is durable

[youhaowei]

Problem

Clawpatch flagged a likely data-loss bug in the legacy updateDataSource RPC path.

updateDataSource calls applyCredentialField without the safer superseded-ref collection and post-write release ordering used by the newer command path. When a data-source credential is rotated or cleared, the old secret can be released before the DB update and snapshot are safely durable.

Evidence

Clawpatch run: 20260629T235052-baec0e

Finding: fnd_sig-feat-library-65745d6fa8-280a_57b14d6fcc

Relevant paths:

• apps/server/src/functions/app-artifacts.ts around updateDataSource
• apps/server/src/functions/utils.ts around applyCredentialField
• apps/server/src/functions/commands.ts around setDataSourceConfig
• apps/server/src/functions/app-artifacts.ts app artifact RPC exports

Expected fix

Either retire/delegate the legacy RPC to the safer command path, or mirror the command-path ordering: write the DB state and flush/snapshot successfully before releasing superseded credential refs.

Scope

Follow-up from PR #197 review. This is not introduced by the assistant read-layer changes.

[coderabbitai]

🔗 Related PRs

#119 - fix(server): stop returning plaintext credentials in data-source read responses [YW-258] [merged]
#166 - fix(server): release prior SecretRef on credential clear/rotate [YW-301] [merged]
#188 - [YW-345] Agent credential write path — transition-time vault-ref release (safe foundation) [merged]
#192 - Enable agent DataSource authoring with credential-ref hardening [merged]
#194 - [YW-354] fix(server): gate credential ref release on durable snapshot flush [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[youhaowei]

Scope addition from PR #205 review: the same synchronous prior-ref release inside applyCredentialField also means a mid-ROTATE throw (vault.delete rejecting) happens after the new ref is stored but before the caller can record it — so PR #205's minted-ref compensation cannot see it and a failed rotate can leave the freshly-stored ref as an inert orphan. The deferred-release fix described here dissolves that automatically. When fixing, add a regression test for the failed-rotate path: old ref survives, new ref applied or released, never orphaned.