Keep the native-main login in memory while Codex rewrites auth.json #7345

Activity

1. github-actions commented on Oct 19, 2026

   

   github-actionsBot

   on Oct 19, 2026 – with GitHub Actions

   Last edited by github-actions

   Contributor

   More actions

   _{Automated translation bookkeeping — detected language: English.}
2. github-actions

   added

   enhancementNew feature or requestNew feature or request

   account-poolOAuth, credentials, Codex pool, quota, failover, plansOAuth, credentials, Codex pool, quota, failover, plans

   on Oct 19, 2026
3. Ingwannu commented on Oct 19, 2026

   

   Ingwannu

   on Oct 19, 2026

   Owner

   More actions

   Linked to Draft #7344. This is a change to native-main credential ownership and logout semantics, rather than only a file-read optimization. The ten-minute missing-file grace and retention of a last-good grant during rewrites need an explicit owner decision: distinguish transient empty/partial replacement, intentional logout, account switch, pause/revocation and a writer that lost ownership. Preserve #7048 refresh-mode ownership and #7035's request-local refreshed-token behavior independently.

   I am keeping this as needs-design while that decision and the required authentication-boundary review remain open. The PR's frozen/missing-write, directory-event-loss, rename-boundary and shutdown fixtures are relevant evidence; they do not themselves approve the retention policy. No live auth/config/service change or new scan was run.
4. Ingwannu

   added

   needs-design설계 필요. Implementation waits on a written design.설계 필요. Implementation waits on a written design.

   on Oct 19, 2026
5. MarcTCruz commented on Oct 24, 2026

   

   MarcTCruz

   on Oct 24, 2026

   ContributorAuthor

   More actions

   @lidge-jun, one question for you:

   Should OpenCodex keep the last complete login in memory while auth.json is briefly missing, empty or partial? If yes, what default time?

   Your answer unblocks PR 2b and PR 2d below. Nothing else in this comment needs a reply.

   ---

   #7344 is closed. As asked in #7344 (comment), I will land its work in six small pull requests against dev, in this order:

   PR	Content	Behavior change	Depends on
   1a	One reader. Every caller that reads <CODEX_HOME>/auth.json itself (main-account.ts, auth-collision.ts, auth-api/account-pause-group.ts, account-lifecycle.ts, orca-import.ts, desktop-compatibility/native-identity.ts) calls one module. The module still reads the file on each call. A guard test fails when a new src/ line names auth.json outside an allowlist.	None	—
   1b	One writer. The refresh and reauth writes in main-account.ts and the switch, rollback and recovery writes in native-profile-manager.ts go through one module.	None	1a
   2a	Watcher. A separate module that watches auth.json and reports its new state: complete, empty, partial, missing or unreadable.	None until a caller uses it	1a
   2b	In-memory copy. It keeps the last complete login and takes its input from the 2a watcher.	Yes	2a, your answer above
   2c	Checked write. Before the rename, the writer checks the file again. A change by Codex wins over the OpenCodex write.	Yes: an OpenCodex write can be dropped	1b
   2d	Grace setting nativeMainAuthGraceSeconds (whole seconds).	Yes	2b

   1a and 1b come first, because they do not change behavior.
6. MarcTCruz

   marked Split the native-main in-memory login work (#7344) into six small pull requests #7691 as a duplicate of this issue on Oct 25, 2026
7. lidge-jun commented on Oct 28, 2026

   

   lidge-jun

   on Oct 28, 2026

   Owner

   More actions

   At dev@fdc6dd82d, the file reader still maps missing, malformed and tokenless content to null (src/codex/main-account.ts:213-246). However, Codex refresh mode can resolve an absent file through the owned Codex RPC (main-account.ts:525-561), and its returned bearer deliberately survives keyring-related file removal for that request (main-account.ts:703-711). Process-wide retention must preserve that distinction. #7344 is closed; its six-step replacement plan is already recorded here.

   The outstanding owner decision can be evaluated as three contracts:

   • Keep current admission semantics and only consolidate reads/writes. This has the smallest compatibility surface but does not guarantee continuity through file rewrites.
   • Retain the last complete, same-owner login only for empty/partial replacement; treat absence as unavailable unless Codex positively confirms login. This limits ambiguous deletion retention but covers fewer replacement sequences.
   • Retain through empty/partial/missing states for an owner-selected maximum duration. This covers rename gaps, but intentional external logout can look identical to a rewrite until a separate authoritative signal arrives.

   I recommend settling that contract before implementing retention; this proposal chooses neither a duration nor deletion semantics. The duration should be an upper bound from the first incomplete observation, never renewed indefinitely by repeated events. Explicit no-login/logout, account replacement, pause/revocation, refresh-mode changes and ownership loss must invalidate retained and pending grants independently of time. Expired access tokens must still follow the selected refresh owner. A successful request-local refresh whose publication is refused remains the separate #7035 contract.

   There is no policy-independent retention slice yet. The already proposed reader/writer consolidation can proceed separately with unchanged behavior. After owner disposition, the smallest retention slice belongs in a new src/codex/native-main-credentials.ts behind that reader, with a sibling tests/codex-integration/native-main-credentials-retention.test.ts. Its decisive fixtures should distinguish truncate/restore, delete→different-account, authoritative logout during grace, repeated partial writes, pause/revocation, mode switch and stale completion after ownership loss. Retain tests/codex-integration/native-main-refresh-mode.test.ts as the existing refresh-owner parity check. No credential migration or new default should be implied by the preparatory refactor.
8. MarcTCruz

   added 2 commits that reference this issue on Oct 29, 2026

   refactor(codex): read the native-main auth.json through one module

   ...

   295860e

   test(codex): guard the auth.json literals in src with a file:line all…

   ...

   d90b205
9. lidge-jun

   added a commit that references this issue on Nov 11, 2026

   refactor(codex): read the native-main auth.json through one module (#…

   ...

   a80a329
10. lidge-jun commented on Nov 11, 2026

    

    lidge-jun

    on Nov 11, 2026

    Owner

    More actions

    Parts 1a and 1b of the plan above (one native-main auth.json reader and writer, no behavior change) landed in #7918 (merge a80a329). The retention parts (2a–2d) still wait on the owner decision about the retention contract, so this issue stays open.