Repository navigation
fix(auth): wire plugin-home staleAuth into setup verified verdict (v2.2.1, #2) - #13
Merged
Merged
Conversation
setup --json reported verified:true while the next rescue failed with `refresh token already used`. The dual-home split (CODEX_HOME=~/.codex/claude-code) means `codex login` rotates only root auth.json, leaving the plugin-home copy stale. inspectPluginHomeFreshness already detected the mtime skew but never fed it into the verdict, so the green light was a false-positive advisory. - new pure computeStaleHomeAuth(advisory, env) in lib/codex.mjs (named export + __testHooks); home-pinned (USE_DEFAULT_HOME=1 / explicit CODEX_HOME) means no dual-home, so no downgrade - buildSetupReport downgrades auth.verified + ready and adds staleHomeAuth / verificationNote (additive only - loggedIn/verified shape preserved) - daily-evolve parseSetupJson routes staleHomeAuth -> NOT_VERIFIED with an auth.json-sync hint instead of a misleading subscription hint - tests: plugin-home-verified-wiring.test.mjs (10) + auth-health-check staleHomeAuth case Refs #2 (fix #1). Follow-up (deferred): fix #2 broker self-heal copy root->plugin.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
요약
issue #2 (
setup --json가verified:true인데 직후 rescue 가refresh token already used로 실패하는 false-positive advisory) 의 fix #1 구현 + v2.2.1 release.Root cause
plugin v2.0 의 dual-home 분리(
buildPluginCodexEnv가CODEX_HOME=$HOME/.codex/claude-code/주입)로 root~/.codex/auth.json와 plugin home auth.json 두 개가 존재.codex login은 root 만 rotate → plugin home 의 refresh_token 이 stale → 다음 rescue 가 stale token 으로 refresh 강제 → 서버 reuse-detection 401.inspectPluginHomeFreshness()가 mtime skew(staleAuth)를 이미 계산하지만verifiedverdict 에 배선되지 않아 setup 이 계속 green 을 띄움.변경
lib/codex.mjs: 순수 helpercomputeStaleHomeAuth(advisory, env)(named export +__testHooks). home pin(CODEX_PLUGIN_USE_DEFAULT_HOME=1/ explicitCODEX_HOME) 시엔 dual-home 자체가 없어 무강등.codex-companion.mjsbuildSetupReport: stale & unpinned 시auth.verified=false+ready=false,staleHomeAuth/verificationNote필드 추가 (additive only — 기존loggedIn/verifiedshape 보존, fixture parity 유지).daily-evolve/lib/auth-health-check.mjsparseSetupJson:staleHomeAuth→NOT_VERIFIED(→FALLBACK_HEURISTIC) + remedy hint 를 subscription 이 아닌cp ~/.codex/auth.json ~/.codex/claude-code/auth.jsonsync 로 분기.검증
tests/plugin-home-verified-wiring.test.mjs(10) +auth-health-check.test.mjsstaleHomeAuth case. 전체tests 619 / pass 615 / fail 3— fail 3 은 기존 documented baseline flake(runtime.test.mjsjob 미기록, Windows-only). 회귀 0.verified:false+staleHomeAuth:true+ready:false양 분기를 라이브setup --json출력으로 확인.tsc): R1 6 finding(med 1 + low 5) → 수정 → R2 0 수렴.비범위 (follow-up)
Closes #2