Legacy removeDataSource can release credential refs before the row is safely removed

[youhaowei]

Problem

Clawpatch flagged a likely data-loss bug in the legacy removeDataSource RPC path.

The legacy coarse mutation can release vault credential refs before the DataSource row has been safely deleted and before the same durability gate used by the newer DeleteNode command path. A crash or failed write in that window can leave durable app state pointing at credentials that have already been released.

Evidence

Clawpatch run: 20260629T235052-baec0e

Finding: fnd_sig-feat-library-2d244dcc99-c448_42ff60499d

Relevant paths:

• apps/server/src/functions/app-artifacts.ts around removeDataSource
• apps/server/src/functions/utils.ts around credential release helpers
• apps/server/src/functions/commands.ts around DeleteNode

Expected fix

Either retire/delegate the legacy mutation to the command path, or move it to the same release ordering used by DeleteNode: remove/write durable app state first, then release credential refs after the durability gate succeeds.

Scope

Follow-up from PR #197 review. This is not introduced by the assistant read-layer changes.

[coderabbitai]

🔗 Related PRs

#119 - fix(server): stop returning plaintext credentials in data-source read responses [YW-258] [merged]
#166 - fix(server): release prior SecretRef on credential clear/rotate [YW-301] [merged]
#188 - [YW-345] Agent credential write path — transition-time vault-ref release (safe foundation) [merged]
#192 - Enable agent DataSource authoring with credential-ref hardening [merged]
#194 - [YW-354] fix(server): gate credential ref release on durable snapshot flush [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!