Repository navigation
feat(management): expose Codex device login in v8 OAuth - #6715
JustYannicc wants to merge 174 commits into
Conversation
Codex Review Summary: 🔄 RunningThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d63464d715
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
d63464d to
17e7e8b
Compare
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
17e7e8b to
13eea25
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 13eea25367
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Claim the device-login session before persistence so cancellation cannot report success after saving starts. Remove failed startup sessions whose state was never returned, and cover both paths with deterministic regression tests.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c37ceab51
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 96a214b852
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d040b97f0c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b05e6d50b5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
The v8 management OAuth endpoint cannot expose Codex's existing device-code login, so clients that cannot receive a localhost callback have to use the browser callback flow.
GET /v8/management/oauth/auth-url?provider=codex&flow=devicenow starts the SDK's existing device login and returns its verification URL and user code before polling. The SDK keeps the private device authorization ID internal; the management handler saves the completed auth through its normal hooks and reuses the existing OAuth status and cancellation routes. Omittingflow=devicekeeps the browser flow. Device states reject browser callbacks with HTTP 409 and do not create callback files.Startup follows the management request until response writing begins. An earlier disconnect discards the session and stops both workers. Write or flush failure does the same. A successful flush establishes handoff, even if the client closes its response body immediately. Saving waits for that handoff, and polling then continues independently of the HTTP request. Polling and token exchange share a 15-minute deadline from code issuance, so stalled requests stop when the code expires. Persistence gets a fresh 30-minute context. The session completes after credentials are saved and before detached runtime notification, so a stalled registration cannot retain the commit claim.
Device login honors the v8 POST API's session proxy override and persists it with the account. It uses the shared OAuth commit claim, so cancellation, expiration, and another login cannot finish the session while its credential save is in flight. Device login clones its config under the same lock used by config updates. This keeps polling and token exchange on one config even if a legacy setting mutates the live config during authorization. Tests cover concurrent config reloads, proxy updates, and disconnects during a successful flush.
Remote-backed acquisition saves keep credentials in a private staged file until remote persistence succeeds. A durable publication record fences local readers while the remote write is pending. Failed writes restore the previous record; successful writes confirm the serialized credential before attempting atomic mirror publication. The remote commit defines login success even when the final rename fails. Credential downloads, full watcher scans, incremental reads, store listings and the manager's digest fence honor the confirmed record, including nested account paths and when the first mirror is missing. This prevents both new rescans and previously queued stale snapshots from reverting a successful login. A later local save repairs the mirror before merging credentials. Explicit deletion, including bulk deletion of accounts whose first mirror is absent, removes the backing credential before retiring its record. Raw and multipart uploads repair and retire committed records under the credential lock before replacing the file. Full scans share recursive discovery of mirrors and records, so repairing a nested account cannot make it disappear. Private staging directories stay excluded. An unreadable directory preserves loaded descendants; a symlinked auth root still works. Disabling a remotely committed credential whose first mirror is absent reaches repair and backend persistence, while the fence for genuinely deleted credentials remains. Startup reconciliation follows a symlinked auth root and retires prepared and confirmed records after loading the backend snapshot; it does not follow nested directory symlinks. Successful backend reconciliation retires the record, after which ordinary file edits work normally.
Git stages the credential blob directly in the index and records pending publication with its original base commit before push. Before pull, startup fetches under the publication lock, validates the local commit against that recorded base, and restores HEAD and index only when all committed changes belong to the marked credential. Normal pull applies newer remote changes without discarding unrelated worktree edits. Failed acquisition saves retain the Git journal because immediate rollback may also fail. Startup replays committed credentials, clears the reader overlay, and then retires the journal. An unconfirmed reader barrier without a Git journal cannot have committed a credential and is discarded under the destination lock. Acquisition saves reject symlink destinations. Pre-push errors attempt to restore the original branch and index; post-push tracking-ref and repository-close errors remain warnings. File-lock cache entries are removed after the last holder or waiter exits.
The management API docs include a curl demo. Current focused validation with Go 1.27.3 passes:
GOMAXPROCS=2 go test -race -p 2 -count=1 ./internal/authpublication ./internal/store ./internal/watcher ./internal/watcher/synthesizer ./internal/api/handlers/management go build ./cmd/serverRegressions verify that new and replacement credentials remain unpublished until remote commit succeeds across all three stores. They also cover lock-cache cleanup and canceled waiters, real Git lease rejection, pre-push Git recovery, post-push local failures, refresh ordering, concrete Codex/Claude serializers and symlink rejection. An HTTP-backed object-store regression removes the staged file after upload while leaving the old JSON readable, then verifies the runtime hook receives and the actual manager activates the remotely committed Codex and Claude access and refresh tokens. A control case verifies that an ordinary file-derived notification is still rejected if the file changes before manager update. All three stores also verify the retained bytes when final publication fails. A rollback regression injects a rejected push followed by a branch-write or index-write failure for new and replacement credentials. Restart restores the original runtime-visible credential, preserves unrelated work, clears the recovery journal and can save again without publishing the rejected credential. The full store package passes under the race detector. The watcher regression covers full and incremental scans, a fresh watcher, a stale snapshot queued before the commit, missing first mirrors, mirror repair and explicit deletion. The extended management regression verifies a rescan cannot replace the manager's committed Codex or Claude tokens. Full affected-package race tests pass, and the pinned source passes all 53 required regressions across ten packages. The actual download handler returns exactly the uploaded serialized bytes for new and replacement Codex and Claude credentials after a mirror rename failure. A nested-account regression verifies that a first failed mirror publication remains in the store listing. The actual management mutation regression covers single and bulk DELETE plus raw and multipart uploads for new and replacement Codex and Claude accounts, verifies remote and active state, and rescans afterward. Nested watcher cases cover repair, ordinary edits, explicit deletion, and private staging exclusion. Separate regressions cover a failed parent-directory scan and a symlinked auth root. Status regressions verify disable and re-enable through the actual management handler and manager after rescans for Codex and Claude. All three remote stores repair and persist disable after a first mirror failure and still refuse to recreate genuinely deleted disabled credentials. The actual object-store Bootstrap regression loads backend bytes through a symlinked root, retires prepared and confirmed records, preserves an unrelated record behind a nested directory symlink and resumes ordinary edits. The independent Input review cleared the publication layer through
32bbae8c. Its remaining Standards finding was test errors shadowing outer bindings without method suffixes.bea6fadbcorrects those names only; normalized diffs preserve every executable statement and assertion. The three affected regressions pass again on native and pinned Go versions, and both builds pass. The earlier full 53-test carry result is retained for unchanged behavior. No live provider login or credential exchange was performed.Initial implementation: Claude Code. Startup, cancellation, expiry, config and persistence fixes: GPT 6.1 Sol through the Codex harness. Earlier independent reviews: Opus 5.5 high. Independent GPT 6.1 Sol xhigh Standards and Input reviews cleared rollback and refresh protection at 6525bb7. The later Git failure corrections, staged publication and lock-cache cleanup have separate focused regression evidence. Opus unavailable (rate_limit_error), Sol xhigh fallback.