Repository navigation
Skip refresh for account-pilot managed Codex credentials - #3
Merged
Merged
Conversation
account-pilot keeps the Codex access token fresh from the Pi and writes a placeholder refresh token plus a trayManagedAccount marker. CLIProxyAPI's 5-day Codex refresh lead made it send that placeholder to auth.openai.com on every start, log a 401 and mark the auth unauthorized until the next write. Marked credentials are now never scheduled for background refresh and never refreshed after a 401; a request 401 still surfaces. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
The PC gateway writes codex-tray.json with the placeholder refresh token but no trayManagedAccount marker, so treat the exact sentinel as managed too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
account-pilot keeps each server's Codex access token fresh from the Pi. It writes a placeholder
refresh_token(managed-by-usage-display-tray) and atrayManagedAccountmarker. The placeholder is there on purpose, so that a local refresh fails instead of rotating the Pi's real login dead.The Codex refresh lead is 5 days, and the Pi serves tokens with about 4 days left. So CLIProxyAPI sent the placeholder to auth.openai.com on every start (3 attempts) and logged
background credential refresh failed … 401 token_expired. That 401 also marked the auth unauthorized until the next pilot write.Change
authRefreshedExternallychecks for thetrayManagedAccountmarker. A marked credential is:nextRefreshCheckAt);authHasRefreshCredential). The 401 still surfaces to the caller, as it does for any credential without a refresh token.Tests
TestPilotManagedAuthIsNeverScheduledForBackgroundRefresh: a control auth without the marker is scheduled; a marked one is not.TestPilotManagedAuthSurfacesUnauthorizedWithoutRefreshing: a request 401 returns the 401, with 0 refresh calls.go test -race ./sdk/cliproxy/authandgo vetpass, and the package is already in the release gate.Proof
I ran two throwaway local binaries with a fake pilot-shaped auth file (no real tokens) and a dummy proxy that logs and refuses CONNECTs:
Release as edgee.10 when merged.
🤖 Generated with Claude Code
Update: sentinel refresh token also counts as managed
The owner's PC gateway (
write_cliproxy_codex_authin codex-proxy-for-claude-code) writescodex-tray.jsonwith the same placeholder refresh token,managed-by-usage-display-tray, but notrayManagedAccountmarker.authRefreshedExternallynow also treats a login whoserefresh_token/refreshTokenequals that exact sentinel as managed (constantpilotSentinelRefreshToken).Tests: both tests now cover a marker-only login (real refresh token) and a sentinel-only login (no marker), and the scheduler test keeps an unmanaged control. Removing either check fails its matching case.