Files
CLIProxyAPI/internal/runtime/executor
Luis Pater 514d09f746 feat(codex): guide recovery when automatic credential renewal becomes impossible
- Classify terminal Codex refresh grant failures (`refresh_token_reused`, `refresh_token_expired`, `refresh_token_invalidated`, `token_revoked`, `invalid_client`, `invalid_grant`, and HTTP 401) as non-retryable, track rejected outer and SIWC refresh tokens independently, and defer retry checks until `access_token` expiry while keeping valid access tokens available for inference.
- Expose structured renewal states, recovery stages, sanitized refresh diagnostics, targeted account-matching OAuth re-authentication (`POST /v8/management/oauth/auth-url`), and pinned inference verification (`POST /v8/management/credentials/verify`) across Management API v8 and the TUI.
- Add unit and workflow regression tests covering terminal vs. transient refresh handling, per-partition SIWC/outer isolation, incomplete stream rejection, quota cooldown preservation, and secret redaction.

Closes: #5783
2026-10-30 07:06:33 +08:00
..