Fix "could not refresh token" error resulting from concurrent CLI instances #8645

etraut-openai · 2025-12-31T20:08:59Z

Idle Codex CLI instances can get stuck after another concurrently-running instance refreshes and rotates the shared ChatGPT refresh token: the idle process wakes up, gets a 401, and its in-memory refresh token is no longer valid, so refresh fails permanently.

This change makes 401 recovery resilient to concurrent token rotation by first syncing ChatGPT tokens from the configured credential store (file/keyring/auto) and retrying the request, then performing a network refresh only if needed (using the refresh token loaded from storage). It also prevents accidental cross-account/workspace switching by only adopting/refreshing when chatgpt_account_id matches the request’s auth snapshot, and adds bounded retries on transient auth.json parse errors to handle concurrent truncate+write. Added unit tests for the storage-sync outcomes.

This addresses #6498, which several users have reported.

…tances Idle Codex CLI instances can get stuck after another concurrently-running instance refreshes and rotates the shared ChatGPT refresh token: the idle process wakes up, gets a 401, and its in-memory refresh token is no longer valid, so refresh fails permanently. This change makes 401 recovery resilient to concurrent token rotation by first syncing ChatGPT tokens from the configured credential store (file/keyring/auto) and retrying the request, then performing a network refresh only if needed (using the refresh token loaded from storage). It also prevents accidental cross-account/workspace switching by only adopting/refreshing when chatgpt_account_id matches the request’s auth snapshot, and adds bounded retries on transient auth.json parse errors to handle concurrent truncate+write. Added unit tests for the storage-sync outcomes.

etraut-openai · 2025-12-31T20:09:10Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/client.rs

pakrym-oai · 2026-01-02T22:50:28Z

It also prevents accidental cross-account/workspace switching by only adopting/refreshing when chatgpt_account_id matches the request’s auth snapshot

Why is this required?

pakrym-oai · 2026-01-02T22:53:42Z

codex-rs/core/src/auth.rs

+                        .await
+                        .map_err(RefreshTokenError::Transient)?
+                    else {
+                        return Ok(None);


should a method be extracted here that returns Optional and you can use ? to short circuit all these checks and return Ok(None);s?

codex-rs/core/src/auth.rs

pakrym-oai · 2026-01-02T22:57:09Z

codex-rs/core/src/client.rs

    auth: &Option<crate::auth::CodexAuth>,
 ) -> Result<()> {
-    if *refreshed {
+    if recovery.refreshed_token {


can we keep the refresh logic fully inside AuthManager so no external checking is needed? We can use some status endpoint to check whether the token is alive.

Will avoid every client having to maintain a complex recovery loop.

Clients already have a recovery loop. Implementing another recovery loop in the AuthManager seems a little redundant, but I agree that we can move more of the auth-specific recovery logic into AuthManager so it doesn't need to be repeated by each clients.

Yes, I'm mostly worried a about the fact that every client sending requests using token auth will need to reproduce this logic.

pakrym-oai

Is there a way we can make both the refresh logic and the consumption logic simpler?

etraut-openai · 2026-01-06T01:05:01Z

@pakrym-oai, I updated AGENTS.md to reflect your feedback about "too many return code paths in one function". I'm trying to get into the habit of reflecting code review feedback in AGENTS.md so we can reduce the need for back-and-forth code review changes in the future. Let me know if you think that the instructions don't capture what you're looking for in terms of code style.

pakrym-oai · 2026-01-06T02:12:43Z

codex-rs/core/src/auth.rs

        self.auth().map(|a| a.mode)
    }
+
+    pub(crate) async fn sync_from_storage_for_request(


nit: remove pub

pakrym-oai · 2026-01-06T02:24:27Z

codex-rs/core/src/auth.rs

+                    Ok(UnauthorizedRecoveryDecision::Retry)
+                }
+                SyncFromStorageResult::SkippedMissingIdentity => {
+                    Ok(UnauthorizedRecoveryDecision::Retry)


Why are we retrying on missing identity? Isn't it fatal?

pakrym-oai · 2026-01-06T02:25:31Z

codex-rs/core/src/auth.rs

+        Ok(SyncFromStorageResult::Applied { changed })
+    }
+
+    pub(crate) async fn refresh_token_for_request(


nit: rem pub

pakrym-oai · 2026-01-06T02:38:52Z

codex-rs/core/src/auth.rs

+        };
+
+        let storage =
+            create_auth_storage(self.codex_home.clone(), self.auth_credentials_store_mode);


should we use load_auth logic here and compare CodexAuth instances directly?

then we can use CodexAuth.refresh_token and avoid having another place where we update tokens

pakrym-oai · 2026-01-06T02:47:11Z

codex-rs/core/src/auth.rs

+            return Ok(SyncFromStorageResult::IdentityMismatch);
+        }
+
+        let changed = if let Some(current) = self.auth() {


Can we share this entire methods logic with reload() ? Seems very similar except for the extra identity check?

pakrym-oai · 2026-01-06T02:49:29Z

codex-rs/core/src/auth.rs

+                    // Another instance may have refreshed and rotated the refresh token while we
+                    // were attempting our refresh. Reload and retry once if the stored refresh
+                    // token differs and identity still matches.
+                    let Some(stored_refresh_token) = load_stored_refresh_token_if_identity_matches(


can we reuse sync_from_storage_for_request here?

so we reload the entire auth object if possible and then call refresh token on it if needed?

pakrym-oai · 2026-01-06T02:55:00Z

codex-rs/core/src/auth.rs

+    Ok(Some(tokens.refresh_token))
+}
+
+async fn load_auth_dot_json_with_retries(


Should the default storage implementation do retries?

pakrym-oai · 2026-01-06T03:08:36Z

codex-rs/core/src/auth.rs

+        };
+
+        if stored_account_id != expected_account_id {
+            // Keep cached auth in sync for subsequent requests, but do not retry the in-flight


I don't understand this. If we refresh the cached auth the next request will pick it up. The client pulls auth() for retries -

codex/codex-rs/core/src/client.rs

Lines 246 to 247 in d681ed2

let auth = auth_manager.as_ref().and_then(|m| m.auth());

let api_provider = self

chatgpt-codex-connector bot reviewed Dec 31, 2025

View reviewed changes

codex-rs/core/src/client.rs Outdated Show resolved Hide resolved

pakrym-oai reviewed Jan 2, 2026

View reviewed changes

codex-rs/core/src/auth.rs Show resolved Hide resolved

pakrym-oai reviewed Jan 2, 2026

View reviewed changes

pakrym-oai requested changes Jan 2, 2026

View reviewed changes

etraut-openai added 5 commits January 5, 2026 15:56

Merge branch 'main' into etraut/concurrent_refresh

ef60a31

Code review feedback

73a1642

Updated AGENTS.md to reflect code simplification rules

35567b3

Code review feedback

ddcb82c

Fixed lint

d681ed2

pakrym-oai reviewed Jan 6, 2026

View reviewed changes

codex-rs/core/src/auth.rs

self.auth().map(|a| a.mode)

}

pub(crate) async fn sync_from_storage_for_request(

Copy link

Collaborator

pakrym-oai Jan 6, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: remove pub

pakrym-oai reviewed Jan 6, 2026

View reviewed changes

etraut-openai closed this Jan 6, 2026

etraut-openai reopened this Jan 6, 2026

etraut-openai closed this Jan 8, 2026

	let auth = auth_manager.as_ref().and_then(\|m\| m.auth());
	let api_provider = self

Fix "could not refresh token" error resulting from concurrent CLI instances #8645

Fix "could not refresh token" error resulting from concurrent CLI instances #8645

Conversation

etraut-openai commented Dec 31, 2025

Uh oh!

etraut-openai commented Dec 31, 2025

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pakrym-oai commented Jan 2, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pakrym-oai left a comment

Choose a reason for hiding this comment

Uh oh!

etraut-openai commented Jan 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pakrym-oai Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pakrym-oai Jan 6, 2026 •

edited

Loading