fix(oauth): recover Muse Keychain login and preserve actionable errors

[lidge-jun]

Summary

• Fix macOS Muse CLI account import ending while a user is still approving the Keychain password prompt. The reader now permits 120 seconds, publishes a cancellable dashboard hint, and distinguishes missing, denied, interaction-disallowed, timeout and unknown outcomes. It keeps the verified service/account lookup and never changes Keychain ACLs.
• Preserve safe, actionable import and validation diagnostics across management login/status. Messages are rebuilt from a closed reason vocabulary and bounded HTTP status; credential text, arbitrary errors, paths, storage values and subprocess stderr are excluded. Malformed JSON shapes fail safely.
• Offer explicit existing-key paste recovery when import fails, using the existing dashboard continuation. Successful imports still win; no automatic second device grant/key mint is introduced. Validation now matches the existing Meta API-version and redirect policy. Instruction-only hints do not launch an empty URL in the CLI.
• Meta Muse OAuth fails after dashboard risk acknowledgement when using admin authentication #5877 was a different, already fixed principal/discovery problem: fix(oauth): keep Meta Muse login continuations current #5911 was carried by fix: isolate sibling routing and unblock Remote Link and OAuth dashboards (batch 9D) #5986 (6b2b66d194). Current dev at 7640a942b35044c974e534b84d5a8049f4a8ae9a still had the five-second read and generic error projection. This change does not relax the dashboard-session consent gate.

Closes #7112

Evidence limits: no real Keychain, user configuration, credentials or authenticated Meta requests were accessed. The approval cutoff, erased diagnostics and blocked paste recovery are reproduced with injected inputs. The reporter's exact underlying Keychain/credential state is still unknown. Current Meta authentication documentation and the official SDK source do not publish the host credential-store schema or prove device endpoint/client-id drift, so no new backend/location is guessed. Apple's SecurityTool source and SecBase error constants support the process-exit classifications.

If the updated flow still fails, request only the displayed safe reason/HTTP status, OpenCodex and Muse versions, whether the dashboard is remote from the proxy, prompt duration, and the error field from the login/status response. Do not request auth files, Keychain contents, tokens, or full HTTP traces.

Verification

All runtime/test commands were prefixed with OPENCODEX_HOME="$PWD/.tmp/7112/opencodex" CODEX_HOME="$PWD/.tmp/7112/codex". The new persistence test also creates, restores and cleans its own temporary homes independently of the test preloader. No GUI source changed.

• bun install — passed; no dependency/lockfile changes.
• Workspace-local Bun 1.4.3 (repository testRunnerBun pin) used below; the host's Bun 1.4.0 could not satisfy the tooling guard's nested runner selection. Downloaded runtime remains ignored scratch, with no shared installation changes.
• .tmp/7112/bun-runtime/bun-darwin-aarch64/bun test tests/providers/meta-muse-keychain.test.ts tests/oauth/oauth-meta-muse-login-diagnostics.test.ts tests/providers/meta-muse-oauth.test.ts tests/providers/meta-muse-login-order.test.ts tests/providers/meta-muse-device.test.ts tests/oauth/oauth-status-privacy.test.ts — 135 passed, 0 failed.
• .tmp/7112/bun-runtime/bun-darwin-aarch64/bun test tests/oauth/oauth-meta-muse-login-diagnostics.test.ts tests/oauth/oauth-login-cli-browser-launch.test.ts — 23 passed, 0 failed after independent review fixes (test-owned homes and instruction-only CLI hints).
• .tmp/7112/bun-runtime/bun-darwin-aarch64/bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts tests/ci-workflows/file-size-ratchet.test.ts — 36 passed, 0 failed. New tests registered in both the explicit map and fixture; baseline caps unchanged.
• bun run typecheck — passed.
• bun run structure:check — passed; Muse login contract split from the existing document to respect its 600-line budget.
• bun run privacy:scan — passed.
• (cd docs-site && bun install --frozen-lockfile && bun run build) — passed; 577 pages and 81,200 internal links checked.
• Scratch root-cause harness against original origin/dev reader/login: three expected failures (approval after 5s, public diagnostic, explicit paste recovery); against the fix: 3 passed, 0 failed. Subprocess and validation were injected; no live Keychain/network call.

Full local suite and prepush were NOT RUN: the maintainer explicitly forbids heavy/full local runs on this shared host. PR fast Ubuntu CI and then the ci.yml manual lane=all cross-platform dispatch provide broad validation; exact-head results will be recorded before handoff. CI has not yet been claimed passing.

Authentication/credential changes require explicit maintainer security review under MAINTAINERS.md. Independent read-only agent review found two correct issues (test persistence isolation and an empty CLI browser URL); both were fixed, focused regressions passed, and a bounded static re-review reported zero blockers. That review does not replace maintainer security review. No merge is authorized for this lane.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Maintainer security review requested before merge.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[nathanlisabio]

thx

[lidge-jun]

Maintainer integration into dev (MAINTAINERS.md dev maintainer-integration policy; batch integration authorized by @lidge-jun on 2026-10-15).

• Head: fa03fae9512ec408c4e363f00d44d261a0e3dd9b (tree c6a0d84bf081aa305967e670323e0225ca0ba91f) = this branch merged with origin/dev f3fbf82a84. Integration note: auto-resolved union conflicts: structure/INDEX.md.
• Exact-head evidence: GitHub-hosted Actions for this account have not been assigning runners since 2026-10-15 13:30 UTC, so by owner decision the evidence is a full bun run test (Bun 1.4.3 test runner, root and GUI dependencies installed, GUI built) of this exact tree on a maintainer host (Linux x86_64): exit 1, 7 min, 28 failing test(s), each also failing in the same host's baseline run of dev 60bf4c7 (environment-only): Codex shim install readiness > a refused install exits unsuccessfully and preserves its re, Codex shim install readiness > keeps install advisory when the Codex config cannot be read, Codex shim install readiness > the install command surfaces readiness warnings without lea, GUI pairing client > sends one bodyless origin-bound capability and redacts rejected bodie, Node launcher PATH fallback activation > broken bundle reaches validated PATH Bun, Node launcher PATH fallback activation > inspection bundle reaches validated PATH Bun, Node launcher PATH fallback activation > missing bundle reaches validated PATH Bun, bundledBunPath / durableBunPath > PATH-selected process provenance survives durable select, ….
• Local gates on the same tree: bun run typecheck, file-size ratchet, test-layout and structure:check.
• Security review: independent agent security review PASS at c1a33c7 (consent, fixed credential destination, redirect rejection, safe diagnostics).
• Hosted CI checks for this head may still be queued; they are not claimed as evidence.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T20:12:14.450450Z	fa03fae	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.