smurching-oai fa4c0607d4 Surface refresh-token rejection errors during workspace routing (#57304) ...

## Why

When workspace discovery receives a 401 and token refresh is permanently rejected, the generic discovery error hides the guidance to sign in again.

## What changed

Propagate cached permanent refresh-token failures for the current credentials through workspace routing and model-provider resolution as `CodexErr::RefreshTokenFailed`. Preserve account-change checks and only surface the cached rejection when external authentication is absent and the auth generation is unchanged.

## Testing

Add an app-server regression test that simulates `refresh_token_reused` during workspace discovery and verifies that the turn fails with `Unauthorized` and tells the user to sign in again.

GitOrigin-RevId: cf89c71fd6a2103e56d637838b0cb34d58b3cc32

2026-10-26 23:21:18 +00:00

..

bin

Allow exec-server to proxy permitted private IPs upstream (#48568)

2026-09-26 23:17:41 +00:00

external_agent_migration

Support memory v2 in external-agent memory imports (#56414)

2026-10-23 09:06:13 +00:00

request_processors

Surface refresh-token rejection errors during workspace routing (#57304)

2026-10-26 23:21:18 +00:00

account_notifications_tests.rs

Add scoped leases for persisted account OAuth grants (#55546)

2026-10-20 11:48:54 +00:00

account_notifications.rs

Expose selected workspace routing in app-server account reads (#45529)

2026-09-14 22:31:32 +00:00

analytics_utils.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

app_info.rs

Use batch metadata for plugin app summaries (#34851)

2026-07-23 01:00:35 +00:00

app_server_tracing.rs

Reduce app-server JSON serialization overhead (#34761)

2026-07-22 14:16:51 +00:00

application_network_tests.rs

Apply shared network policy throughout embedded Codex startup (#47411)

2026-09-23 00:49:19 +00:00

application_network.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

attestation.rs

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

auth_mode.rs

Support managed AWS access keys for Amazon Bedrock (#40481)

2026-08-24 21:39:48 +00:00

bespoke_event_handling.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

code_mode_host_tests.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

code_mode_host.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

codex_home_metrics.rs

Limit app-server storage metrics to session directories (#43790)

2026-09-08 10:18:59 +00:00

command_exec.rs

Support close-on-exec attachments without changing PTY semantics (#47797)

2026-09-24 09:25:19 +00:00

config_layer.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_manager_provider_tests.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

config_manager_service_credential_edits.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

config_manager_service_tests.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

config_manager_service.rs

Bind plugin hook approval to plugin contents (#54619)

2026-10-16 14:38:19 +00:00

config_manager.rs

Integrate config-server policies with startup and authentication (#57175)

2026-10-26 18:14:57 +00:00

connection_cleanup.rs

fix(app-server): avoid blocking connection cleanup (#26852)

2026-06-08 10:20:54 -07:00

connection_rpc_gate.rs

Bind remote-control sessions to their authentication owner (#44341)

2026-09-09 23:59:14 +00:00

current_time.rs

[app-server] increase currentTime/read timeout (#30384)

2026-06-27 16:42:03 -07:00

daemon_thread_recovery.rs

Continue interrupted work after managed daemon restarts (#45820)

2026-09-16 00:54:58 +00:00

dynamic_tools.rs

Add audio output support to dynamic tools and code mode (#34080)

2026-07-18 23:22:13 +00:00

effective_plugin_change_tests.rs

Refresh runtimes for remote plugin state changes (#41396)

2026-08-28 19:12:34 +00:00

effective_plugin_change.rs

Bind plugin hook approval to plugin contents (#54619)

2026-10-16 14:38:19 +00:00

error_code.rs

Explain session creation failures during server shutdown (#52721)

2026-10-09 23:16:46 +00:00

extensions.rs

Add incremental skill catalogs behind skill_catalog_deltas (#57262)

2026-10-26 21:20:21 +00:00

external_auth.rs

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

filters.rs

…

fs_watch.rs

Fix fs/watch debounce batching (#24716)

2026-05-28 23:09:55 -07:00

fuzzy_file_search.rs

…

gateway_oauth_notifications.rs

Add explicit gateway OAuth sign-in to app-server (#47207)

2026-09-22 06:36:09 +00:00

image_url.rs

[codex] reject remote images at app-server ingress (#29419)

2026-06-23 00:43:56 +00:00

in_process_bootstrap_tests.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

in_process_bootstrap.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

in_process.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

lib_tests.rs

Consolidate Rust unit tests under dedicated test modules (#56247)

2026-10-22 19:36:47 +00:00

lib.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

log_write_warning_tests.rs

Warn users when SQLite diagnostic log writes fail (#47887)

2026-09-24 17:04:50 +00:00

log_write_warning.rs

Warn users when SQLite diagnostic log writes fail (#47887)

2026-09-24 17:04:50 +00:00

main_tests.rs

Remove WebSocket transport from code-mode hosts (#40692)

2026-08-25 20:37:15 +00:00

main.rs

Add frozen cloud skill snapshots to the app server (#55631)

2026-10-20 17:01:52 +00:00

managed_daemon.rs

Raise the managed app-server file descriptor limit on Unix (#51470)

2026-10-06 19:51:15 +00:00

mcp_refresh.rs

Preserve enterprise MCP authorization across runtime refreshes (#55696)

2026-10-20 23:03:56 +00:00

message_processor_gateway_oauth_tests.rs

Propagate authentication header failures before sending requests (#55607)

2026-10-20 15:43:19 +00:00

message_processor_thread_lifecycle_tests.rs

Fix idle cleanup for disconnected multi-agent v2 children (#52081)

2026-10-08 11:52:25 +00:00

message_processor_tracing_tests.rs

Surface automatic marketplace update failures as startup warnings (#57166)

2026-10-26 17:56:43 +00:00

message_processor_workspace_routing_tests.rs

Surface automatic marketplace update failures as startup warnings (#57166)

2026-10-26 17:56:43 +00:00

message_processor.rs

Allow disabling plugin discovery prefetch at app-server startup (#57249)

2026-10-26 20:54:08 +00:00

model_catalog.rs

Reload the model catalog after account changes (#54169)

2026-10-15 03:06:16 +00:00

models_refresh_worker_tests.rs

Reload the model catalog after account changes (#54169)

2026-10-15 03:06:16 +00:00

models_refresh_worker.rs

Enforce current provider requirements for the model catalog (#46917)

2026-09-21 01:19:40 +00:00

models.rs

Remove legacy personality template metadata (#51223)

2026-10-06 01:46:33 +00:00

notification_media.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

otel_reloader.rs

Reload app-server telemetry after account changes (#37339)

2026-08-07 00:28:32 +00:00

outgoing_message.rs

Bound retained turn analytics and clean up closed threads (#55847)

2026-10-21 09:54:36 +00:00

plugin_config_reload.rs

Keep global app-server config independent of the launch directory (#51872)

2026-10-07 23:19:26 +00:00

request_processors.rs

Add optional names to untrusted additional context (#57181)

2026-10-26 18:23:07 +00:00

request_serialization.rs

Include environment hooks in thread hook listings (#56553)

2026-10-23 18:39:28 +00:00

server_request_error.rs

…

skills_watcher.rs

Stop re-exporting skill APIs from codex-core (#37984)

2026-08-11 10:43:11 +00:00

startup_config.rs

Clarify config loader APIs and share interactive login setup (#57169)

2026-10-26 18:05:05 +00:00

startup_warnings.rs

Surface automatic marketplace update failures as startup warnings (#57166)

2026-10-26 17:56:43 +00:00

stderr_logging_tests.rs

Consolidate Rust unit tests under dedicated test modules (#56247)

2026-10-22 19:36:47 +00:00

thread_sample_cancel_context_tests.rs

Add cancellation for experimental thread samples (#55441)

2026-10-20 03:09:44 +00:00

thread_sample.rs

Allow callers to set the thread source for sampling (#56364)

2026-10-23 06:07:10 +00:00

thread_state.rs

Expose lifecycle timestamps on app-server thread items (#57172)

2026-10-26 18:13:00 +00:00

thread_status.rs

Track app-server running turns incrementally (#49084)

2026-09-28 21:33:00 +00:00

transport_tests.rs

Avoid redundant clones when sending app-server notifications (#55723)

2026-10-21 01:49:26 +00:00

transport.rs

Avoid redundant clones when sending app-server notifications (#55723)

2026-10-21 01:49:26 +00:00

turn_admission_tests.rs

Explain session creation failures during server shutdown (#52721)

2026-10-09 23:16:46 +00:00

turn_admission.rs

Gate new app-server work during graceful shutdown (#43959)

2026-09-09 01:03:42 +00:00

turn_cost_worker_chatgpt_tests.rs

Emit turn cost telemetry for ChatGPT sessions (#41944)

2026-09-01 00:30:55 +00:00

turn_cost_worker_chatgpt.rs

Enforce application network policy across app-server requests (#47407)

2026-09-23 00:47:07 +00:00

turn_cost_worker_tests.rs

Preserve turn attribution across recovery and compaction (#51402)

2026-10-06 15:50:27 +00:00

turn_cost_worker.rs

Route FedRAMP API keys to government endpoints by default (#57178)

2026-10-26 18:20:30 +00:00

user_verification_activation_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_adapter_tests.rs

Add user-verification provider abstractions and RPC adapters (#43547)

2026-09-07 18:43:20 +00:00

user_verification_adapter.rs

Add user-verification provider abstractions and RPC adapters (#43547)

2026-09-07 18:43:20 +00:00

user_verification_auth.rs

Enable user verification for the bundled TUI on supported devices (#43715)

2026-09-08 05:57:24 +00:00

user_verification_cancel_context_tests.rs

Add cancellation for native user-verification RPCs (#43925)

2026-09-08 21:48:53 +00:00

user_verification_cancel_tests.rs

Add cancellation for native user-verification RPCs (#43925)

2026-09-08 21:48:53 +00:00

user_verification_connection_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_ownership_tests.rs

Preserve metadata in native user verification requests (#46952)

2026-09-21 07:01:52 +00:00

user_verification_response_tests.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

user_verification_response.rs

Preserve diagnostic reasons for MCP user verification failures (#51808)

2026-10-07 19:28:14 +00:00

user_verification_rpc_tests.rs

Return public key metadata from user verification enrollment (#44877)

2026-09-11 17:36:50 +00:00

user_verification_test_support.rs

Surface automatic marketplace update failures as startup warnings (#57166)

2026-10-26 17:56:43 +00:00

user_verification_tests.rs

Return public key metadata from user verification enrollment (#44877)

2026-09-11 17:36:50 +00:00

user_verification.rs

Return public key metadata from user verification enrollment (#44877)

2026-09-11 17:36:50 +00:00