Skip to content

fix(auth): preserve legacy OAuth credential when adding accounts - #1308

Merged
code-yeongyu merged 7 commits into
code-yeongyu:mainfrom
eddieparc:lab-109-openai-codex-oauth-pool-fork
Sep 3, 2026
Merged

fix(auth): preserve legacy OAuth credential when adding accounts#1308
code-yeongyu merged 7 commits into
code-yeongyu:mainfrom
eddieparc:lab-109-openai-codex-oauth-pool-fork

Conversation

@eddieparc

@eddieparc eddieparc commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Linear: https://linear.app/jgplabs/issue/LAB-109/openai-codex-%EA%B8%B0%EB%B3%B8-oauth-%EB%8B%A4%EC%A4%91-%EA%B3%84%EC%A0%95-%EC%A7%80%EC%9B%90-%EC%83%81%ED%83%9C-%ED%99%95%EC%9D%B8

Summary

  • Promote a legacy flat credential to the default pool slot when a second login is saved.
  • Preserve the legacy top-level projection for older binaries.
  • Add API-key and OAuth regression coverage for repeated login storage.

Verification

  • bun run --cwd packages/ai test test/credential-pool-mutations.test.ts
  • Root bun run check passed.
  • Package build is currently blocked by pre-existing missing @earendil-works/pi-telemetry type resolution.

Summary by cubic

Fixes credential pool mutations for openai-codex OAuth accounts so a second login preserves the legacy credential as the default slot instead of overwriting it, and removing that account leaves the survivor actually in use (LAB-109). Adds a dedicated /gpt-account command for managing OpenAI Codex OAuth accounts.

  • Promotes a legacy flat credential to the pool's default slot when a new login is appended.
  • Removing the account the flat fields projected now re-projects them from the first surviving slot, so a single-account pool still authenticates as the account that remains.
  • Existing pooled accounts are unchanged; new credentials still get the next login-N name.
  • Adds /gpt-account with add, remove <name>, pin <name>, unpin, and listing that hides token material; add announces the new account so subscribed clients re-read the pool, and a cancelled login exits silently.
  • Adds regression tests for OAuth and API-key repeated login storage, survivor re-projection, and /gpt-account behavior.

Written for commit 1299bd1. Summary will update on new commits.

Review in cubic

@code-yeongyu

Copy link
Copy Markdown
Owner

Note: #1309 (merged as 10f58c0) changed appendLoginSlot to return a provider-owned pooled credential unchanged (fixes #1279). It does not touch the legacy-flat promotion this PR proposes for openai-codex (LAB-109), so this PR stays relevant but needs a rebase onto main; the guard was placed at the top of appendLoginSlot before the !current branch.

@code-yeongyu
code-yeongyu force-pushed the lab-109-openai-codex-oauth-pool-fork branch from 29f8ca1 to 6146f61 Compare September 3, 2026 06:09
eddieparc and others added 5 commits September 3, 2026 16:06
Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
The characterization test pinned the pre-LAB-109 overwrite: set() on a flat
credential asserted a one-field whole-write. appendLoginSlot now promotes that
legacy credential to the default slot and appends the new one as login-2, so the
test asserts the promoted shape (both slots present, legacy material still the
top-level projection for a build predating pools) and a companion case keeps the
first-login whole-write pinned for an absent credential.

Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
…led login

/gpt-account add persisted the new account but never emitted
emitProviderAccountsChanged, so subscribed clients (RPC account views) kept
showing the pre-login pool until something else re-read it; every other mutation
in the command already emits through credential-accounts.ts. The add error path
also surfaced the internal 'Login cancelled' sentinel as an error notice when the
user simply dismissed the prompt, which is a deliberate exit, not a failure.
Tests cover add success, cancellation, a real login failure, and remove.

Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
…ommand

Adds the Unreleased entries the release gate requires for both packages, a new
packages/ai/src/changes.md entry covering auth/pool/slots.ts (the senpi#1279
entry is left intact and cross-referenced, since its 'a flat current stores the
flat credential as-is' sentence is exactly what this pass changes), and the
missing canonical sections plus path tokens on the builtin gpt-account entry so
it actually covers gpt-account.ts and index.ts.

Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
@code-yeongyu
code-yeongyu force-pushed the lab-109-openai-codex-oauth-pool-fork branch from c090d3b to 594c4fa Compare September 3, 2026 07:07
code-yeongyu and others added 2 commits September 3, 2026 16:15
…removal

Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
Ultraworked with [omo](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: sisyphus-dev-ai <sisyphus-dev-ai@users.noreply.github.com>
@code-yeongyu
code-yeongyu merged commit c8de953 into code-yeongyu:main Sep 3, 2026
35 of 37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants