[maxfain]

What

The AgentID OIDC client stored the bare global fetch on the instance (this.fetchImpl = … ?? fetch) and called it as this.fetchImpl(...). On Cloudflare Workers the native fetch throws "Illegal invocation" when its receiver is not the global realm, so every token-exchange and JWKS request failed with:

token endpoint unreachable: Illegal invocation: function called with incorrect this reference

which surfaced to owners as "Verification failed. Could not verify the AgentID sign-in." — no link could ever complete in production.

Why CI stayed green

The OIDC tests inject a mock fetch, so the real global-fetch fallback path was never exercised.

Fix

Wrap the fallback in an arrow so the global is always reached by a bare fetch(...) call, matching the existing convention in payments/arc.ts, circle-facilitator.ts, and cdp-facilitator.ts:

- this.fetchImpl = fetchImpl ?? testFetch ?? fetch;
+ this.fetchImpl = fetchImpl ?? testFetch ?? ((input, init) => fetch(input, init));

Plus a regression test that spies on the global fetch and asserts the client never invokes it with the instance as receiver (fails against the old code, passes now).

Verification

• 33 AgentID tests pass (incl. the new Illegal-invocation guard)
• repo typecheck, check-positioning, sync-positioning --check, sync-skill --check all green
• Confirmed live end-to-end: linked circle_test against auth.agentid.com → GET /v1/agents/ag_EaGeRhitpSsPPxG3P9A5Q86qMoHTv2hiiT1u8iEq4YV7/agentid now returns verified: true
• A Worker-runtime sweep found no sibling receiver-detachment bugs

Deploy note

Production already carries this fix via a direct wrangler deploy; this PR lands it on main so the next CI deploy from main doesn't silently revert it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NNqTSRyDjL1LcayDuUeDkr

---

Generated by Claude Code

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issues were found.

Summary

Fixes AgentID requests on Cloudflare Workers by calling global fetch without using the client as its receiver.

• AgentID OIDC requests call global fetch without the client as receiver.

_{Reviews (2) · Last reviewed commit: "Fix AgentID link: call global fetch bare..." · Reviewed by Greptile}

[github-actions]

🔎 Console preview: https://3cb47047.basedagents-console.pages.dev
🌐 Site preview: https://f1ebeefb.auth-ai-web.pages.dev

(Passkey ceremonies only work on app.basedagents.ai — previews are for UI review.)