Skip to content
This repository was archived by the owner on Oct 9, 2026. It is now read-only.
This repository was archived by the owner on Oct 9, 2026. It is now read-only.

Sync subscription auth and multi-account substrate #306

Closed
Closed
Sync subscription auth and multi-account substrate#306
Labels
planDurable planning issueplan:donePlan completed or superseded

Description

@shiny-code-bot
shiny-code-bot
opened on Jul 11, 2026

Objective

Adopt upstream subscription-auth host abstractions, credential storage improvements, and account protocol substrate without regressing Every Code's multi-account product behavior or loaded-thread credential refresh.

This wave may proceed in parallel with the turn/history wave once the compatibility envelope is merged, but it must preserve all current add, switch, remove, fallback, profile, API-key, device-code, and ChatGPT account invariants.

Finish Line

Codex Lab uses the selected upstream auth/storage substrate while a loaded session can safely add, switch, remove, refresh, and log out accounts with deterministic identity and no stale credentials.

Current Status

State: Complete on #428's candidate.

PR #492 restored immediate loaded-thread account-lease repair on account removal, including safe fallback or explicit signed-out state, compare-and-swap persistence, and websocket-session invalidation. PR #493 restored a debug-only persisted integration keyring so cross-process auth tests remain hermetic and fail closed rather than reaching the host keychain.

Final candidate: PR #465 at a04892bafa27f5b5006e77944a4c36704935b0e1 on July 29, 2026.

Validation passed: 20 execution-account tests, 7 account-catalog tests, loaded-thread authorization regression coverage, 5 persisted-keyring tests, CLI app-server tests, strict config, JSON logging, websocket and plugin startup gates, app-test-support/app-server/CLI release checks, all 274 repository-check Python tests, convergence validation, four independent review lenses, and all 15 checks on PR #493.

Blocked by: none.
Next action: close this plan and activate #307's execution/tools/sandbox/external-agent lane.
Last verified: July 29, 2026.

Scope

  • In: auth host abstraction, credential serialization/storage, login/token refresh safety, active-account persistence, account list/add/switch/remove/logout APIs, loaded-thread refresh, migration fixtures, and account-related protocol aliases.
  • Out: automatic quota priming or broad routing policy from Classify deferred multi-account routing and quota-priming policy #290, unrelated TUI redesign, and collapsing Every Code multi-account UX into upstream single-account assumptions.

Acceptance Criteria

  • API-key, ChatGPT, device-code, and stored-account flows use the selected upstream host/storage primitives where compatible.
  • Existing account IDs and active-account state migrate deterministically without accidental identity replacement.
  • Loaded threads use refreshed credentials after login, switch, removal fallback, token refresh, and logout without requiring an unintended session restart.
  • Add Account preserves distinct accounts and rotates credentials only for the same logical account.
  • Account removal selects a safe fallback or explicit signed-out state.
  • Strict app-server/Desktop clients receive compatible account/auth shapes through aliases or capability gates.
  • Real-home credentials are never touched by automated tests.
  • Existing account regression suites plus new migration fixtures pass.

Relationships

Validation

  • Isolated-home core, login, app-server, and TUI account tests.
  • Loaded-thread credential assertions before and after each account mutation.
  • Legacy auth-store migration fixtures plus logout/recovery scenarios.
  • For any account/auth protocol shape change, run just write-app-server-schema, prove codex-rs/app-server-protocol/schema is clean, then run just test -p codex-app-server-protocol and the README Desktop initialize/thread/CLI strict-config gates.
  • No live-account automation beyond a separately approved bounded manual dogfood proof.

Decisions

  • Preserve Every Code multi-account UX as product-owned behavior.
  • Reuse upstream auth transport/storage safety wherever it does not erase those semantics.

Open Questions

  • None currently.

Activity

  1. shiny-code-bot
    added
    planDurable planning issue
    plan:blockedPlan blocked by an open native dependency issue
    on Jul 11, 2026
  2. shiny-code-bot
    added a parent issue on Jul 11, 2026
  3. shiny-code-bot
    marked this as blocked on Jul 11, 2026
  4. shiny-code-bot
    marked this as blocking 2 issues on Jul 11, 2026
  5. cbusillo
    added
    plan:activePlan is actionable now
    and removed
    plan:blockedPlan blocked by an open native dependency issue
    on Jul 12, 2026

  6. cbusillo commented on Jul 12, 2026

    @cbusillo
    cbusillo
    on Jul 12, 2026
    Owner

    Update 2026-07-12 UTC:

    • PR feat(secrets): isolate local auth namespaces #330 adds the dormant encrypted-secret namespace foundation adapted from upstream 7cc80b39f1 without the rejected feature-flag path.
    • Managed secrets retain the exact existing local.age filename and keyring account. Codex auth and MCP OAuth use separate encrypted files and separate OS-keyring accounts, preventing key reuse/collision.
    • Focused tests pass and an independent security review found no issues. The PR does not activate or migrate credentials yet.
    • A read-only architecture review is now defining the next coherent slice for both the active AuthDotJson mirror and credential-bearing auth_accounts catalog, including fail-closed decrypt errors, mocked-keyring migration tests, crash consistency, and preservation of File/Keyring/Auto/Ephemeral plus Every Code add/switch/remove/fallback/reload behavior.

    Blocked by: none. Partial encryption of only auth.json remains explicitly out of scope.

  7. cbusillo commented on Jul 13, 2026

    @cbusillo
    cbusillo
    on Jul 13, 2026
    Owner

    Update 2026-07-13 UTC:

    • PR refactor(login): plumb auth store mode through account catalog #336 merged with all 9 required checks, threading AuthCredentialsStoreMode through the account catalog, switching, import, session, app-server, and TUI call sites while preserving current plaintext behavior.
    • The next bounded stage is now implementing a shared codex-secrets encrypted-document engine plus thin login adapters for both the active auth mirror and account catalog.
    • Required invariants: corrupt encrypted data fails closed; failed migration writes keep plaintext readable; successful commits use atomic write then best-effort cleanup; File/Keyring/Auto/Ephemeral semantics and stable account IDs remain intact.

    Blocked by: none. Broad app-server/TUI activation remains a separate follow-up stage.

  8. shiny-code-bot
    unmarked this as blocked on Jul 13, 2026
  9. shiny-code-bot
    marked this as blocked on Jul 23, 2026
  10. shiny-code-bot
    added
    plan:blockedPlan blocked by an open native dependency issue
    and removed
    plan:activePlan is actionable now
    on Jul 23, 2026

  11. cbusillo commented on Jul 28, 2026

    @cbusillo
    cbusillo
    on Jul 28, 2026
    Owner

    Update 2026-07-28 UTC:

    • PR fix(auth): rebind threads after account removal #492 merged into the Build upstream snapshot integration and canary branch #428 candidate at 17385ebebe34ed3a836d261290cf75c6e02a4761.
    • Loaded threads now rebind immediately when their leased account is removed, including embedded-TUI non-active removals. The repair targets only affected threads, invalidates their cached websocket session, persists the replacement lease, and uses compare-and-swap so it cannot overwrite a concurrent account transition.
    • Validation passed: 20 execution-account tests, 7 account-catalog tests, the loaded-thread authorization regression, cargo check -p codex-tui, 13-job blocking CI, and the macOS app build. Four-lens review is clean.

    Remaining acceptance gap: the hermetic persisted integration-keyring support merged in PR #351 is no longer present in the current candidate tree after upstream convergence. Next action is a focused restoration so debug integration tests fail closed instead of ever reaching the host keychain; this remains required before closing #306.

  12. shiny-code-bot
    unmarked this as blocked on Jul 29, 2026
  13. shiny-code-bot
    closed this as completedon Jul 29, 2026
  14. shiny-code-bot
    added
    plan:donePlan completed or superseded
    on Jul 29, 2026

  15. shiny-code-bot commented on Jul 29, 2026

    @shiny-code-bot
    shiny-code-bot
    on Jul 29, 2026
    CollaboratorAuthor

    Completed on the converged candidate.

    This closes #306 and removes the final prerequisite from #307.

  16. shiny-code-bot
    unmarked this as blocking 2 issues on Jul 29, 2026
  17. shiny-code-bot
    removed
    plan:blockedPlan blocked by an open native dependency issue
    on Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    planDurable planning issueplan:donePlan completed or superseded

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions