perf(gateway): reuse prepared auth stores

steipete · steipete · commit d2711c900d7b · 2026-05-27T04:51:43.000+01:00
diff --git a/extensions/codex/src/app-server/auth-bridge.ts b/extensions/codex/src/app-server/auth-bridge.ts
@@ -131,6 +131,16 @@ function resolveCodexAppServerAuthProfileStore(params: {
   authProfileStore?: AuthProfileStore;
   config?: AuthProfileOrderConfig;
 }): AuthProfileStore {
+  if (params.authProfileStore) {
+    const providedProfileId = resolveCodexAppServerAuthProfileId({
+      authProfileId: params.authProfileId,
+      store: params.authProfileStore,
+      config: params.config,
+    });
+    if (providedProfileId && params.authProfileStore.profiles[providedProfileId]) {
+      return params.authProfileStore;
+    }
+  }
   const overlaidStore = ensureCodexAppServerAuthProfileStore({
     agentDir: params.agentDir,
     authProfileId: params.authProfileId,
diff --git a/extensions/codex/src/app-server/run-attempt.ts b/extensions/codex/src/app-server/run-attempt.ts
@@ -4315,9 +4315,14 @@ async function buildDynamicTools(input: DynamicToolBuildParams) {
         : undefined,
     modelApi: params.model.api,
     modelContextWindowTokens: params.model.contextWindow,
-    modelAuthMode: resolveModelAuthMode(params.model.provider, params.config, undefined, {
-      workspaceDir: input.effectiveWorkspace,
-    }),
+    modelAuthMode: resolveModelAuthMode(
+      params.model.provider,
+      params.config,
+      params.toolAuthProfileStore ?? params.authProfileStore,
+      {
+        workspaceDir: input.effectiveWorkspace,
+      },
+    ),
     suppressManagedWebSearch: false,
     currentChannelId: params.currentChannelId,
     hookChannelId: resolveCodexAppServerHookChannelId(params, input.sandboxSessionKey),
diff --git a/src/agents/command/attempt-execution.ts b/src/agents/command/attempt-execution.ts
@@ -136,6 +136,7 @@ function resolveProfileAuthFromStore(params: { agentDir: string; profileId: stri
   }
   const credential = ensureAuthProfileStore(params.agentDir, {
     allowKeychainPrompt: false,
+    externalCliProfileIds: [profileId],
   }).profiles[profileId];
   return { provider: credential?.provider, mode: credential?.type };
 }
@@ -182,6 +183,7 @@ function resolveHarnessAuthProfileSelection(params: {
 
   const store = ensureAuthProfileStore(params.agentDir, {
     allowKeychainPrompt: false,
+    externalCliProviderIds: [harnessAuthProvider],
   });
   const authProfileId = resolveAuthProfileOrder({
     cfg: params.config,

Original file line number	Diff line number	Diff line change
`@@ -136,6 +136,7 @@ function resolveProfileAuthFromStore(params: { agentDir: string; profileId: stri`
`136`	`136`	`}`
`137`	`137`	`const credential = ensureAuthProfileStore(params.agentDir, {`
`138`	`138`	`allowKeychainPrompt: false,`
	`139`	`+ externalCliProfileIds: [profileId],`
`139`	`140`	`}).profiles[profileId];`
`140`	`141`	`return { provider: credential?.provider, mode: credential?.type };`
`141`	`142`	`}`
`@@ -182,6 +183,7 @@ function resolveHarnessAuthProfileSelection(params: {`
`182`	`183`
`183`	`184`	`const store = ensureAuthProfileStore(params.agentDir, {`
`184`	`185`	`allowKeychainPrompt: false,`
	`186`	`+ externalCliProviderIds: [harnessAuthProvider],`
`185`	`187`	`});`
`186`	`188`	`const authProfileId = resolveAuthProfileOrder({`
`187`	`189`	`cfg: params.config,`