@ouro.bot/cli 0.1.0-alpha.644 → 0.1.0-alpha.645

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.645",
+      "changes": [
+        "Rescue openai-codex refresh when the vault refresh token has rotated by retrying with the local Codex login, and classify sign-in-required refresh failures as human-required."
+      ]
+    },
     {
       "version": "0.1.0-alpha.644",
       "changes": [

package/dist/heart/providers/openai-codex-token.js

@@ -129,6 +129,29 @@ function parseRefreshFailure(body) {
     }
     return body.trim() || "refresh endpoint returned an empty error body";
 }
+function readLocalCodexAuthTokens(homeDir) {
+    const authPath = path.join(homeDir, ".codex", "auth.json");
+    let raw;
+    try {
+        raw = fs.readFileSync(authPath, "utf8");
+    }
+    catch {
+        return { status: "missing" };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed.tokens || typeof parsed.tokens !== "object")
+            return { status: "invalid" };
+        const accessToken = typeof parsed.tokens.access_token === "string" ? parsed.tokens.access_token.trim() : "";
+        const refreshToken = typeof parsed.tokens.refresh_token === "string" ? parsed.tokens.refresh_token.trim() : "";
+        if (!accessToken || !refreshToken)
+            return { status: "invalid" };
+        return { status: "ready", tokens: { accessToken, refreshToken } };
+    }
+    catch {
+        return { status: "invalid" };
+    }
+}
 async function updateLocalCodexAuthIfUnchanged(input) {
     const authPath = path.join(input.homeDir, ".codex", "auth.json");
     let raw;
@@ -190,6 +213,14 @@ async function requestOpenAICodexTokenRefresh(input) {
         return { ok: false, detail: "refresh endpoint returned no access_token" };
     return { ok: true, accessToken, refreshToken };
 }
+function refreshFailureRequiresHuman(refresh) {
+    const detail = refresh.detail.toLowerCase();
+    return refresh.status === 401
+        || detail.includes("signing in again")
+        || detail.includes("already been used")
+        || detail.includes("invalid_grant")
+        || detail.includes("refresh token expired");
+}
 async function refreshOpenAICodexProviderCredentials(agentName, options = {}) {
     const now = options.now ?? new Date();
     const readRecord = options.readRecord ?? provider_credentials_1.readProviderCredentialRecord;
@@ -212,25 +243,52 @@ async function refreshOpenAICodexProviderCredentials(agentName, options = {}) {
     }
     const oldAccessToken = recordCredentialString(record, "oauthAccessToken");
     const oldRefreshToken = recordCredentialString(record, "refreshToken");
-    if (!oldRefreshToken) {
+    const homeDir = options.homeDir ?? os.homedir();
+    const fallbackLocalAuth = oldRefreshToken ? undefined : readLocalCodexAuthTokens(homeDir);
+    let refreshSource = oldRefreshToken
+        ? { source: "vault", accessToken: oldAccessToken, refreshToken: oldRefreshToken }
+        : fallbackLocalAuth?.status === "ready"
+            ? { source: "local-codex-auth", accessToken: fallbackLocalAuth.tokens.accessToken, refreshToken: fallbackLocalAuth.tokens.refreshToken }
+            : undefined;
+    if (!refreshSource) {
         return {
             ok: false,
             actor: "human-required",
-            message: `openai-codex has no saved refresh token for ${agentName}. Run '${authCommand(agentName)}'.`,
+            message: `openai-codex has no saved refresh token for ${agentName} and no usable local Codex login to import. Run '${authCommand(agentName)}'.`,
         };
     }
     (0, runtime_1.emitNervesEvent)({
         component: "engine",
         event: "engine.openai_codex_token_refresh_start",
         message: "refreshing openai-codex OAuth token",
-        meta: { agentName, reason: options.reason ?? "unspecified" },
+        meta: { agentName, reason: options.reason ?? "unspecified", source: refreshSource.source },
     });
-    const refresh = await requestOpenAICodexTokenRefresh({
-        refreshToken: oldRefreshToken,
+    let refresh = await requestOpenAICodexTokenRefresh({
+        refreshToken: refreshSource.refreshToken,
         fetchImpl: options.fetchImpl ?? fetch,
     });
+    if (!refresh.ok && oldRefreshToken) {
+        const retryLocalAuth = readLocalCodexAuthTokens(homeDir);
+        if (retryLocalAuth.status === "ready" && retryLocalAuth.tokens.refreshToken !== oldRefreshToken) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "engine",
+                event: "engine.openai_codex_token_refresh_local_rescue",
+                message: "retrying openai-codex OAuth refresh with local Codex auth tokens",
+                meta: { agentName, reason: options.reason ?? "unspecified", status: refresh.status ?? "none", detail: refresh.detail },
+            });
+            refreshSource = {
+                source: "local-codex-auth",
+                accessToken: retryLocalAuth.tokens.accessToken,
+                refreshToken: retryLocalAuth.tokens.refreshToken,
+            };
+            refresh = await requestOpenAICodexTokenRefresh({
+                refreshToken: refreshSource.refreshToken,
+                fetchImpl: options.fetchImpl ?? fetch,
+            });
+        }
+    }
     if (!refresh.ok) {
-        const actor = refresh.status === 401 ? "human-required" : "agent-runnable";
+        const actor = refreshFailureRequiresHuman(refresh) ? "human-required" : "agent-runnable";
         (0, runtime_1.emitNervesEvent)({
             level: actor === "human-required" ? "warn" : "error",
             component: "engine",
@@ -240,6 +298,7 @@ async function refreshOpenAICodexProviderCredentials(agentName, options = {}) {
                 agentName,
                 reason: options.reason ?? "unspecified",
                 actor,
+                source: refreshSource.source,
                 ...(refresh.status ? { status: refresh.status } : {}),
                 detail: refresh.detail,
             },
@@ -266,10 +325,10 @@ async function refreshOpenAICodexProviderCredentials(agentName, options = {}) {
         provenance: { source: record.provenance.source },
         now,
     });
-    const localAuth = await updateLocalCodexAuthIfUnchanged({
-        homeDir: options.homeDir ?? os.homedir(),
-        oldAccessToken,
-        oldRefreshToken,
+    const localAuthSync = await updateLocalCodexAuthIfUnchanged({
+        homeDir,
+        oldAccessToken: refreshSource.accessToken,
+        oldRefreshToken: refreshSource.refreshToken,
         newAccessToken: refresh.accessToken,
         newRefreshToken: refresh.refreshToken,
         now,
@@ -282,7 +341,8 @@ async function refreshOpenAICodexProviderCredentials(agentName, options = {}) {
             agentName,
             reason: options.reason ?? "unspecified",
             credentialRevision: updated.revision,
-            localCodexAuth: localAuth,
+            source: refreshSource.source,
+            localCodexAuth: localAuthSync,
         },
     });
     return { ok: true, refreshed: true, record: updated };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.644",
+  "version": "0.1.0-alpha.645",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",