[Yuxin-Qiao]

Summary

When the same ChatGPT account and workspace appears as both the native main login (__main__) and a managed pool entry, manually pausing one entry can leave its duplicate eligible for selection. Fallback routing can then immediately choose that duplicate.

This change synchronizes manual pause and resume in the management API across existing entries with a confirmed matching account/workspace identity and normalized email:

• Publish all matching exclusions before fallback selection, so a duplicate cannot become the replacement.
• Preserve independence for different workspaces under the same email and different members of a shared workspace. Missing identity evidence never links unrelated entries.
• Hold native-main admission and the cross-process credential claim while resolving and publishing the group. A busy, unreadable, or conflicting main identity returns 503 without publishing a partial group.
• Return the existing opaque entry handles as affectedAccountIds from PUT /api/codex-auth/accounts/pause. Clients can re-read the account list to observe synchronized state.
• Keep the existing pausedCodexAccountIds format and per-entry automatic quota policies; routing performs no additional identity reads.

The final patch contains the backend implementation, regression tests, and documentation. It adds no frontend files or presentation changes. Explicit maintainer security review remains pending for the credential identity and management boundary.

Verification

Current base: 0511f458f1 (dev). Current head: ff6cec014e. The branch was synchronized with dev using a merge after removing the presentation changes.

• bun run typecheck — passed on the current head.
• bun test tests/codex-integration/codex-linked-account-pause.test.ts tests/codex-integration/codex-auth-api.test.ts tests/codex-integration/codex-routing.test.ts tests/codex-integration/codex-auth-context.test.ts tests/lab/core-lab-boundary.test.ts tests/ci-workflows/file-size-ratchet.test.ts — 649 passed, 1 skipped, 0 failed on the current head. The linked-pause cases cover both main/pool directions, fallback and pin release, persistence, resume, unrelated identities, ownership contention, unreadable main identity, conflicting workspace claims, and selected workspace versus organization membership.
• bun run structure:check, bun run privacy:scan, and git diff --check — passed.
• cd docs-site && bun install --frozen-lockfile && bun run build — passed (561 pages and internal-link validation).
• git diff origin/dev...HEAD -- gui — empty: there are no presentation changes in the final patch.
• bun run test:changed — not passed and incomplete. The parsed import graph expanded this 18-file diff to 1,518 of 2,079 test files. The run was explicitly interrupted with SIGTERM (exit 143) after recording 22 failure entries, including Anthropic Fast and provider management validation. Given that broad scope and the already recorded baseline failures, this update uses the documented resource exception in AGENTS.md: the current-head focused backend regression remains mandatory and passed, while broader compatibility coverage and exact-head hosted CI remain pending. Interruption is not a successful test result, and the failures have not all been independently classified.

Historical evidence from the previous head 8e8fa7a3e8, based on e53c8077e4: the new backend regression failed before the fix; the full local suite recorded 42 failures, with 21 provider management/verbosity failures reproduced on an unchanged baseline. That full run is not evidence for the current head, and no current full-suite pass is claimed. Hosted CI and maintainer review remain pending. Tests use isolated fixtures; no installed service, real-account login, or credentials were modified.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Explicit maintainer security review remains pending; the privacy scan passed.

Review readiness checklist

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Readiness boxes ticked by maintainer @lidge-jun during the 2026-10-05 bug triage round 2 (lane B5). Per owner instruction no tests were run locally; local validation was limited to static checks and tests ran in hosted CI at the exact head.

Maintainer update (lane B5), head 3468db3355c62c2a6d5e6f838758174fa1b17bf1

• Merged current dev. Changes:

  • Main auth.json is read through the bounded reader at the claim's pinned path.
  • An absent Codex home or an API-key-only auth.json allows pool-only grouping.
  • Main's ID and access tokens must agree on both workspace and member email, otherwise 503.
  • The six translated management-API rows are synced.
  • Cases were added to the existing codex-linked-account-pause.test.ts.

• No local tests were run, per owner instruction. Static checks at this head: bun run typecheck, bun run structure:check, bun run privacy:scan, and bun scripts/file-size-ratchet.ts all exit 0. Behavioral evidence comes from hosted PR CI at this head.

• Independent security review at this head: PASS (see PR comment).

• API-key-only recognition lives in the pause module, so src/codex/auth-collision.ts is unchanged from dev and the PR stays off the restricted credential surface.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7f42d082-029b-4c42-954e-2111e0d1e499

📥 Commits

Reviewing files that changed from the base of the PR and between 37189ca and 3468db3.

📒 Files selected for processing (24)

• docs-site/src/content/docs/fr/reference/configuration/providers.md
• docs-site/src/content/docs/fr/reference/management-api.md
• docs-site/src/content/docs/ja/reference/configuration/providers.md
• docs-site/src/content/docs/ja/reference/management-api.md
• docs-site/src/content/docs/ko/reference/configuration/providers.md
• docs-site/src/content/docs/ko/reference/management-api.md
• docs-site/src/content/docs/reference/configuration/providers.md
• docs-site/src/content/docs/reference/management-api.md
• docs-site/src/content/docs/ru/reference/configuration/providers.md
• docs-site/src/content/docs/ru/reference/management-api.md
• docs-site/src/content/docs/tr/reference/configuration/providers.md
• docs-site/src/content/docs/tr/reference/management-api.md
• docs-site/src/content/docs/zh-cn/reference/configuration/providers.md
• docs-site/src/content/docs/zh-cn/reference/management-api.md
• docs-site/src/content/docs/zh-tw/reference/configuration/providers.md
• docs-site/src/content/docs/zh-tw/reference/management-api.md
• scripts/test-layout/layout.json
• src/codex/auth-api/account-pause-group.ts
• src/codex/auth-api/routes.ts
• structure/gui-and-management-api.md
• structure/providers/openai-accounts.md
• structure/providers/openai-tiers.md
• tests/codex-integration/codex-linked-account-pause.test.ts
• tests/fixtures/test-layout-expected.json

 ________________________________________________________
< Code review is a dish best served cold. Like a carrot. >
 --------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request has been marked Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers notified: @lidge-jun @Ingwannu

[lidge-jun]

Independent security review (lane B5) — bound to head 6088a0a8e52731f5ab57d0edf4815a56305e1a18

Verdict: PASS from an independent gpt-6.1-sol reviewer. An earlier round on 359ddbb79a returned FAIL with one High finding, which is fixed at this head. This was a static review of the full PR diff against dev; no local tests were run, per owner instruction.

Maintainer changes pushed to this branch:

• Merged current dev.
• 359ddbb79a:
  • Main auth.json is now read through the bounded regular-file reader at the claim's pinned path.
  • If the Codex home is positively absent, or auth.json holds a valid API-key-only login (new opt-in api-key-only read status), pool-only pause and resume proceed and return 200 instead of failing.
  • An inaccessible home, malformed credentials, or a nonregular or oversized auth file returns 503 before anything is published.
  • The six translated management-API rows (fr, ja, ko, ru, tr, zh-tw) now match English.
• 8d05e3510b / 6088a0a8e5: main's ID and access tokens must name the same member email as well as the same workspace. The fixed High was a token pair naming two members of one workspace W, which could link Alice's pool entry to a main login whose bearer is Bob; that case now returns 503. A regression case was added, and the structure doc was updated.

Review findings at the final head:

• Linking requires both the full workspace ID and the normalized email. Missing evidence never links entries.
• Every exclusion is set before fallback reconciliation, and persistence happens while the admission lease and the shared claim are held. Both are released in finally.
• affectedAccountIds contains only opaque entry handles, with no emails, physical account IDs, or tokens.
• Existing readCodexTokensResult callers are unaffected because the new status is opt-in.

Static checks at the head: bun run typecheck, structure:check, privacy:scan, and bun scripts/file-size-ratchet.ts all exit 0.

[lidge-jun]

Independent security review (lane B5) — bound to head 3468db3355c62c2a6d5e6f838758174fa1b17bf1

Verdict: PASS. This is an independent gpt-6.1-sol delta review against the previously passing head 6088a0a8e5, plus a full reread of account-pause-group.ts. No local tests were run, per owner instruction.

This head reverts src/codex/auth-collision.ts to dev, so the PR no longer touches that restricted credential surface. API-key-only recognition now lives in readMainAuth in the pause module. It does a second bounded read (4 MiB limit) only when the shared reader reports invalid, and both reads happen under the same shared claim.

An auth.json is treated as having no ChatGPT identity only when all three hold: tokens is nullish, the mode is absent or api_key, and OPENAI_API_KEY is a nonblank string. Malformed JSON, malformed tokens, explicit ChatGPT mode, blank keys, and second-read failures still return 503. Key material is not logged or returned.

Static checks at the head: bun run typecheck, structure:check, privacy:scan, and bun scripts/file-size-ratchet.ts all exit 0.

[lidge-jun]

Maintainer integration (lidge-jun, dev only) — 2026-10-05 bug triage round 2, lane B5.

• Head: 3468db3
• CI at this head: PR CI 37324368992; every executed job passed.
• Review: synchronize manual account pause across matching main and pool entries; independent sol security review PASS at this head; readiness ticked by maintainer with hosted-CI-only note.
• No local tests were run, per owner instruction; hosted CI is the evidence.
• scripts/ci/assert-mergeable-review.sh --maintainer-integration: OK.