fix(auth): preserve independent Codex pool entries on re-auth (#39236)
The #33538 fix refreshed every credential_pool entry with source "manual:device_code" on every Codex OAuth re-auth, on the assumption that such entries were always legacy aliases of the singleton from the #33000 workaround era. That assumption is no longer true: `hermes auth add openai-codex` also produces "manual:device_code" entries for independent ChatGPT accounts, and the broad sync silently clobbered them with the latest-authenticated token pair (labels preserved, token material overwritten, status / quota readings then lie). Narrow the sync: refresh a "manual:device_code" entry only when its existing access_token matches the previous singleton access_token (true legacy alias). Entries with distinct token material represent independent accounts and are now left alone. Error markers are cleared only on entries actually rewritten, so an independent account's own 429 / 401 state survives a re-auth that targeted a different account. Tests: * New: independent acctB/acctC are not overwritten when acctA re-auths. * New: legacy singleton-alias still refreshed (preserves #33538). * New: missing previous singleton state handled (no crash, no false alias match). * New: access_token-only alias match (legacy schema without refresh_token still recognized). * New: error markers cleared only on entries actually refreshed. * Updated: existing manual-device-code sync test now covers both the legacy-alias path AND the independent-account path in one fixture. Behaviour change is zero for users with a single Codex account and zero for users whose only "manual:device_code" entry is the legacy alias of the singleton. Users with multiple independent Codex accounts added via `hermes auth add` now keep their distinct token material across re-auths. Local: 29 passed in tests/hermes_cli/test_auth_codex_provider.py, no new failures in tests/hermes_cli/ vs upstream/main baseline. Fixes #39236.
This commit is contained in:
Ted Malone
+58
-17
@@ -3355,6 +3355,7 @@ def _sync_codex_pool_entries(
|
||||
auth_store: Dict[str, Any],
|
||||
tokens: Dict[str, str],
|
||||
last_refresh: Optional[str],
|
||||
previous_singleton_tokens: Optional[Dict[str, str]] = None,
|
||||
) -> None:
|
||||
"""Mirror a fresh Codex re-auth into the credential_pool OAuth entries.
|
||||
|
||||
@@ -3370,24 +3371,34 @@ def _sync_codex_pool_entries(
|
||||
OAuth flow when the user logged in via ``hermes setup`` / the model
|
||||
picker. Always synced with the fresh tokens.
|
||||
* ``manual:device_code`` — entries created by ``hermes auth add openai-codex``
|
||||
that use the same device-code OAuth mechanism. An interactive re-auth
|
||||
proves the user owns the ChatGPT account, so it is safe (and expected)
|
||||
to refresh these entries too. Without this, a user who once ran the
|
||||
``hermes auth add`` workaround for #33000 would silently leave that
|
||||
manual entry stale on every subsequent re-auth, recreating the issue
|
||||
reported in #33538.
|
||||
that use the same device-code OAuth mechanism. ONLY synced if the
|
||||
entry's existing access_token matches the *previous* singleton
|
||||
access_token (i.e. the entry is a legacy singleton-alias from the
|
||||
#33000 workaround era). Manual entries whose tokens never matched the
|
||||
singleton represent INDEPENDENT accounts added via
|
||||
``hermes auth add openai-codex`` and must not be overwritten by a
|
||||
re-auth that targeted a different account (regression for #39236).
|
||||
|
||||
The original #33538 fix refreshed every ``manual:device_code`` entry
|
||||
unconditionally. That worked when ``manual:device_code`` only meant
|
||||
"legacy alias of the singleton", but the same source string is now
|
||||
also produced by independent-account additions, and the broad sync
|
||||
silently clobbered distinct accounts with the latest-authenticated
|
||||
token pair. The access_token-match check distinguishes the two cases
|
||||
without changing the source-string contract.
|
||||
|
||||
What does NOT get refreshed:
|
||||
|
||||
* ``manual:api_key`` and any other non-device-code manual sources — those
|
||||
are independent credentials (an explicit API key, a different ChatGPT
|
||||
account, etc.) and must not be overwritten by a single re-auth.
|
||||
* ``manual:device_code`` entries whose access_token does NOT match the
|
||||
previous singleton — see above; these are independent accounts.
|
||||
|
||||
Error markers (``last_status``, ``last_error_*``) are also cleared on
|
||||
every device-code-backed entry — even those whose tokens we did not
|
||||
rewrite — so that an interactive re-auth gives every relevant pool entry
|
||||
a fresh selection chance instead of leaving them marked unhealthy from a
|
||||
pre-re-auth 401.
|
||||
Error markers (``last_status``, ``last_error_*``) are cleared ONLY on
|
||||
entries that actually had their tokens rewritten by this re-auth.
|
||||
Independent entries keep their own error state (their 401/429 markers
|
||||
belong to that account's own auth flow, not this re-auth).
|
||||
"""
|
||||
access_token = tokens.get("access_token")
|
||||
if not access_token:
|
||||
@@ -3399,15 +3410,34 @@ def _sync_codex_pool_entries(
|
||||
entries = pool.get("openai-codex")
|
||||
if not isinstance(entries, list):
|
||||
return
|
||||
# Sources whose tokens should be rewritten by a fresh Codex device-code
|
||||
# OAuth re-auth. ``manual:api_key`` and unknown sources are intentionally
|
||||
# excluded — they represent independent credentials.
|
||||
REFRESHABLE_SOURCES = {"device_code", "manual:device_code"}
|
||||
# Previous singleton access_token (before this re-auth overwrote it) —
|
||||
# used to distinguish legacy singleton-aliases from independent accounts.
|
||||
# When None or empty, no manual entry can be treated as an alias (which
|
||||
# is the right default for first-ever-save or a freshly initialized
|
||||
# auth.json).
|
||||
prev_at = None
|
||||
if isinstance(previous_singleton_tokens, dict):
|
||||
prev_at = previous_singleton_tokens.get("access_token") or None
|
||||
for entry in entries:
|
||||
if not isinstance(entry, dict):
|
||||
continue
|
||||
source = entry.get("source")
|
||||
if source not in REFRESHABLE_SOURCES:
|
||||
if source == "device_code":
|
||||
# Singleton-seeded mirror — always refresh.
|
||||
refresh_this_entry = True
|
||||
elif source == "manual:device_code":
|
||||
# Refresh only if this entry's existing access_token matches the
|
||||
# previous singleton access_token (i.e. it is a true alias of the
|
||||
# singleton from the #33000 workaround era). An entry with its
|
||||
# own distinct token material is an independent account and must
|
||||
# be left alone (#39236).
|
||||
refresh_this_entry = bool(
|
||||
prev_at and entry.get("access_token") == prev_at
|
||||
)
|
||||
else:
|
||||
# ``manual:api_key`` and any future non-device-code sources.
|
||||
refresh_this_entry = False
|
||||
if not refresh_this_entry:
|
||||
continue
|
||||
entry["access_token"] = access_token
|
||||
if refresh_token:
|
||||
@@ -3429,13 +3459,24 @@ def _save_codex_tokens(tokens: Dict[str, str], last_refresh: str = None, label:
|
||||
with _auth_store_lock():
|
||||
auth_store = _load_auth_store()
|
||||
state = _load_provider_state(auth_store, "openai-codex") or {}
|
||||
# Capture the previous singleton tokens BEFORE overwriting them. The
|
||||
# pool-sync step uses this to distinguish legacy singleton-aliases
|
||||
# (which should be refreshed) from independent accounts that
|
||||
# ``hermes auth add openai-codex`` created (which must not be
|
||||
# overwritten — see #39236).
|
||||
previous_singleton_tokens = state.get("tokens") if isinstance(state.get("tokens"), dict) else None
|
||||
state["tokens"] = tokens
|
||||
state["last_refresh"] = last_refresh
|
||||
state["auth_mode"] = "chatgpt"
|
||||
if label and str(label).strip():
|
||||
state["label"] = str(label).strip()
|
||||
_save_provider_state(auth_store, "openai-codex", state)
|
||||
_sync_codex_pool_entries(auth_store, tokens, last_refresh)
|
||||
_sync_codex_pool_entries(
|
||||
auth_store,
|
||||
tokens,
|
||||
last_refresh,
|
||||
previous_singleton_tokens=previous_singleton_tokens,
|
||||
)
|
||||
_save_auth_store(auth_store)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user