fix(identity): preserve likes through login and account navigation

[harlan-zw]

An anonymous Like link could silently lose its action when the browser already had a signed-in session, for example after signing in in another tab. /login redirected to the Skill without saving the like. Removing a Skill from Your skills also left the shared heart state and count unchanged, so returning to the Skill still showed “Unlike” and another click sent a second DELETE.

Preserve supported Like and Watch actions through the existing sealed OAuth callback even when /login finds a session. Keep failed attempts on the retry screen so they cannot cause an automatic OAuth loop. Route account removal through useLikes.remove, updating all hearts after a successful DELETE and waiting for any initial list request so an older response cannot restore the deleted like.

Reproduced both cases on production using mattpocock/skills/tdd:

• With TDD unliked and a session present, opening its anonymous /login?return_to=...&action=like-skill link returns to an empty heart.
• Liking TDD, removing it in Your skills, and returning through client navigation leaves the heart pressed although GET /api/v1/account/likes no longer includes it.

The ordinary signed-out Like → GitHub → Skill flow succeeded during investigation. Returning to a previously opened Your skills list after liking TDD through client navigation also showed the new like. Login and session responses used private, no-store and bypassed the CDN cache. Temporary test likes were removed.

Related to skilld-dev/skilld#240. The report lacks exact steps, so these are verified related failures rather than a claim that the reporter encountered either one.

Validation:

• Added regression coverage for Like/Watch intent with an existing session, error retry without a redirect loop, and ordinary signed-in return navigation. Four new cases fail against the old redirect.
• Existing regression coverage checks account removal → heart → like again, failed removal, and an in-flight initial list.
• CI run 38914678229 passed the full site test suite, build, lint, typecheck, declared Skills check, and Harness checks on commit 89f55a97.
• All eight login tests passed locally when run alone, and ESLint passed on the changed login files. The parallel local Nuxt run hit startup and test timeouts under shared WSL load; the full hosted test run passed.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-16 15:03 UTC.

GitHub merged this pull request.

No material findings were recorded.

cc72019a-cc96-4514-96d3-aeb9b6381560

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results