fix(acp): require tokens key before selecting chatgpt auth method#3628
Draft
simonrosenberg wants to merge 1 commit into
Draft
fix(acp): require tokens key before selecting chatgpt auth method#3628simonrosenberg wants to merge 1 commit into
simonrosenberg wants to merge 1 commit into
Conversation
When codex-acp runs in apikey mode it rewrites $CODEX_HOME/auth.json with
{"auth_mode": "apikey", "OPENAI_API_KEY": "..."}. On the next launch
_select_auth_method saw the file and returned 'chatgpt' — but the payload
is in apikey format, so codex hung forever waiting for browser-based OAuth.
Gate chatgpt selection on the presence of the 'tokens' key (the ChatGPT
subscription token blob) rather than mere file existence.
Co-authored-by: openhands <openhands@all-hands.dev>
Contributor
Python API breakage checks — ✅ PASSEDResult: ✅ PASSED |
Contributor
REST API breakage checks (OpenAPI) — ✅ PASSEDResult: ✅ PASSED |
Contributor
Coverage Report •
|
||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
H:
AGENT:
Why
When
acp_isolate_data_dir=Trueand codex-acp is driven with API-key auth(
OPENAI_API_KEYonly, noCODEX_AUTH_JSON), the firstsession/newsucceeds, and during that session codex rewrites
$CODEX_HOME/auth.jsonwith
{"auth_mode": "apikey", "OPENAI_API_KEY": "..."}.On the next launch (pod recycle / agent-server restart)
_select_auth_methodin
acp_agent.pysaw the file at_codex_auth_file(env)and returned"chatgpt", because the check only verified file presence:codex-acp then read the apikey-format file as if it were a ChatGPT token
blob and hung indefinitely waiting for browser-based OAuth.
The production cloud path is unaffected — canvas always sends
CODEX_AUTH_JSONso the SDK materialises a proper chatgpt-formatauth.jsonbefore codex starts and codex never overwrites it. The bugonly manifested in test harnesses / non-standard deployments running with
API-key auth and
acp_isolate_data_dir=True(discovered during the ACPcloud pivot local validation, canvas#1290).
Summary
_codex_auth_file_is_chatgpt(env)which parsesauth.jsonandrequires a top-level
"tokens"key — the marker that distinguishesthe ChatGPT subscription token blob from the apikey-mode file codex
writes for itself.
chatgptbranch in_select_auth_methodon this strictercheck so an apikey-format file falls through to the
openai-api-key/codex-api-keyfallback instead of triggeringthe OAuth hang.
{}asauth.jsonto use thereal chatgpt-format payload, and add two new tests:
test_apikey_format_auth_file_falls_back_to_api_key(reproduces thebug from fix(acp): _select_auth_method picks chatgpt when $CODEX_HOME/auth.json is in apikey format, causing auth hang on resume #3627) and
test_malformed_auth_file_falls_back_to_api_key(defensive coverage for unreadable / non-JSON files).
Issue Number
Fixes #3627
How to Test
Result:
20 passed, including the two new tests(
test_apikey_format_auth_file_falls_back_to_api_key,test_malformed_auth_file_falls_back_to_api_key) that fail onmainand pass with this change.
End-to-end repro (matches the issue's reproduction sequence):
ACPAgentconversation withacp_isolate_data_dir=True,OPENAI_API_KEYin secrets (noCODEX_AUTH_JSON).openai-api-key. codex-acp writes$CODEX_HOME/auth.jsonwith{"auth_mode": "apikey", ...}._select_auth_methodreturns
"openai-api-key"(file does not contain"tokens")instead of
"chatgpt", and the conversation proceeds withouthanging on browser-based OAuth.
Video/Screenshots
N/A — auth-path selection change, exercised through the new unit tests.
Type
Notes
CODEX_AUTH_JSONmaterialises a proper chatgpt-format file with
"tokens").dicts containing"tokens"; malformed ornon-dict JSON also falls back to the API-key path, which is the safe
default.
This PR was created by an AI agent (OpenHands) on behalf of the user.
@simonrosenberg can click here to continue refining the PR
Agent Server images for this PR
• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server
Variants & Base Images
eclipse-temurin:17-jdknikolaik/python-nodejs:python3.13-nodejs22-slimgolang:1.21-bookwormPull (multi-arch manifest)
# Each variant is a multi-arch manifest supporting both amd64 and arm64 docker pull ghcr.io/openhands/agent-server:42e8d04-pythonRun
All tags pushed for this build
About Multi-Architecture Support
42e8d04-python) is a multi-arch manifest supporting both amd64 and arm6442e8d04-python-amd64) are also available if needed