Repository navigation
Preserve SDK authentication failures and bind setup/readiness to the actual resource profile #2398
Description
Written-by: Codex
目标分支：delivery/ai-centric-development-service；负责人 @zy95-12。Owner 已明确要求直接修复并合入，延续基本 CI 的交付分支流程。
现象：同机宿主 Codex 可用，Reviewer 所在 opentoday-codex-exec 报 refresh token 已使用、需要重新登录。只读核查发现：容器 /codex-profile 挂载 /srv/flybot-codex-profiles/owner-1/codex，宿主使用 /root/.codex；auth 文件是不同文件且修改时间分别为2026-10-25和2026-11-04。两边 CLI0.166、login status 均显示已登录；缓存存在不是实际鉴权成功。未读取凭据内容，尚未证明是谁复制旧缓存或发生并发刷新。
代码基线 d39e70b：
- setup/probe/worker 已复用 projectHarness.profile，不需另造认证服务。但缺少安全的实际 profile 绑定元数据及认证故障的统一呈现，旧 readiness 可能与新 profile 不匹配。
- runHarnessTurn 将 Codex turn.failed/error 抛成通用 SDK failed；worker 进一步泛化错误；runtime probe 依赖文案正则，不能可靠识别 refresh_token_reused。
- 生成的 Task-role Session 不应意味着复制/重建 OAuth 登录缓存。
范围：
- 复用现有显式 profiles/configDir 和生成 profile，不静默切目录、复制 auth.json 或挂载整个宿主 .codex。记录非敏感 profile 身份，配置终端向已获资源管理权限的人展示实际目标；setup/probe/worker/健康缓存对应同一目标，配置变化不继承旧 ready。
- 在原 SDK/worker 协议传递脱敏的已知鉴权错误类别（包括 refresh_token_reused），区分网络、配置和一般执行失败。复用 authRequired，向 Chief/Owner 提供实际资源/profile 与配置入口；不泄漏 token/完整 provider 错误。
- 保留 Task-role Session、候选与审核证据，不把鉴权失效记为 Review request-changes/测试失败，不自动换资源、返工或转人工。
- 补关键回归、长期记忆、架构与必要 API/OpenAPI 文档。
验收：相同资源/profile 的多角色与多 Attempt 保持同一认证目标；明确的不同 profile 仍隔离；新 profile 不复用旧 ready；真实 SDK错误形状经适配器/worker/宿主/probe 到 authRequired；配置终端实际 CODEX_HOME 与 worker 一致；敏感错误内容不进入状态/日志；网络错误不误判鉴权；保留执行退出/lease门禁。区分 fixture/实际SDK与真实OAuth验证。
不新增 OAuth刷新服务、全局登录代理或业务恢复状态机。App GitHub 凭据与模型 OAuth 分离。此次代码工作不授权改现场凭据、重新登录、部署、重启服务或中断健康任务。失效的实际 refresh token 仍需原生 Codex 登录流程，不能凭代码修复声称已恢复现场认证。
Activity
Bind SDK authentication feedback to the actual resource profile (#2399)
zy95-12 commentedon Nov 4, 2026
Written-by: Codex
Implemented and merged via #2399 into
delivery/ai-centric-development-service, merge5382e137a63eaaf808c9a463f4e2583d19bce8e2(verified head55f8975c3d93f27ef242a6c9d859c7b0d68986eb).Setup/probe/worker share the selected persistent SDK profile and readiness binding. Changed/legacy unbound profiles require the existing check. Known authentication failures survive SDK → worker → host/probe as safe
authRequiredfacts; configuration terminals resolve the resource's pinned SDK CLI and actual CODEX_HOME, only for authorized resource administrators. No credential copies, OAuth broker, automatic resource selection, Chief routing policy, sandbox or Task-role Session changes.Validation: full root
npm run verifypasses (4,938 tests, zero failures); exact-head GitHub Node24 andtests-okpassed; generated patches/OpenAPI/lint pass. Actual pinned SDK worker passed locally and in Docker against an isolated HTTP401 refresh-token-reused fixture. Coverage sample for the new helper is 100% lines/functions, 95.92% branches, not whole-change coverage. Memory/architecture/operations/API docs updated. Owner-authorized delivery basic CI scope applied; no independent Verifier PASS was claimed.Source acceptance is complete. Live container credentials, service deployment and login were untouched: a reused/expired OAuth refresh token still needs native login in the chosen persistent profile after rollout. Fixture and login-status observations do not prove live token refresh or successful paid inference.