[AGE-2944] fix(frontend): add defensive checks for missing projectId in vault API calls

[mmabrouk]

Summary

• Adds defensive checks to all vault API functions to prevent requests when projectId is missing
• Returns early with safe defaults ([] for fetch, null for mutations) instead of making invalid requests with project_id=undefined
• Adds console warnings to help debug when this edge case occurs

Changes

• fetchVaultSecret: returns [] if no projectId
• createVaultSecret: returns null if no projectId
• updateVaultSecret: returns null if no projectId
• deleteVaultSecret: returns null if no projectId

Closes AGE-2944

---

[linear]

AGE-2944 Investigate fetching secrets without a project ID

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview, Comment	Feb 10, 2026 4:17pm

[devin-ai-integration]

Devin Review found 1 potential issue.

View 3 additional findings in Devin Review.

[junaway]

@mmabrouk -- there are conflicts
@ardaerzin -- we're been talking about these guards for about a year :D

[ardaerzin]

@mmabrouk -- there are conflicts @ardaerzin -- we're been talking about these guards for about a year :D

@jp it because we had the check for fetches already?

/**
 * Query atom for fetching vault secrets
 * Only enabled when user is authenticated and migration is complete
 */
export const vaultSecretsQueryAtom = atomWithQuery((get) => {
    const user = get(userAtom)
    const _migrationStatus = get(vaultMigrationAtom)
    const projectId = get(projectIdAtom)

    return {
        queryKey: ["vault", "secrets", user?.id, projectId],
        queryFn: fetchVaultSecret,
        staleTime: 1000 * 60 * 5, // 5 minutes
        refetchOnWindowFocus: false,
        refetchOnReconnect: false,
        refetchOnMount: true,
        enabled: !!user && !!projectId,
        //  && migrationStatus.migrated, // Only fetch when user exists and migration is done
    }
})

[ardaerzin]

we already have the check for fetch.

instead of doing this, I'd remove this project id read in the fetch function, and pass this value from the query atom and fix the projectId accessor there if it is not working as expected there

[mmabrouk]

@jp-agenta @ardaerzin Sorry guys! Was going over linear today closing things and I stumbled upon this one (the 401) so I asked the Agent whether it was fixed and it came up with this simple fix, os I just went ahead