Repository navigation
fix(codex-oauth): keep shared workspace members separate - #509
Merged
Merged
Conversation
SaladDay
marked this pull request as ready for review
October 12, 2026 05:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Logging in a second member of the same ChatGPT workspace could overwrite the first member’s refresh token. Managed Codex OAuth accounts now have separate local IDs and workspace identities, using the account identity and login lifecycle implementation from cc-switch #6780 and its follow-up fixes.
Reauthenticate an existing account with
cc-switch auth login --account-id <id>or Reauthenticate in the TUI account menu. Workspace and OIDC subject checks preserve provider bindings and reject a different user. Older account records are marked as requiring reauthentication and cannot silently supply credentials until confirmed.Proxy requests, model discovery, quota inspection and quota reset resolve the workspace from the selected local account. The bound workspace overrides stale incoming headers. CLI managed OAuth remains a Claude proxy-provider feature; native Codex auth.json activation and ownership are outside this change. Source provenance and integration boundaries are documented in
docs/maintenance/codex-oauth-identity-alignment.md.Validation: 65 OAuth-related tests, 1851 TUI tests, 47 request-construction tests, 7 auth command parsing tests, and the auth service/command tests passed in isolated configuration directories (some filters overlap). Coverage includes shared-workspace members, targeted reauthentication, legacy quarantine, duplicate and concurrent logins, cancellation/expiry, and bound-member request headers. Formatting and whitespace checks passed. No real OAuth credentials or production configuration were used.
Closes #493.