# fix\(server\): renew active managed Codex turns through native auth · PR \#21787 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/21787)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: codex-09/token-renewal

Target branch: codex-09/token-broker

Head commit: 47819dae181ec3a11ea4e04a6b3c1bd7a84eae66

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/21787)

[Commits](https://git.cafe/pingdotgg/t3code/pull/21787/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/21787/diffs?format=markdown)

## Description

---

Managed Codex app-servers retain launch-time bearer tokens after T3 renews saved ChatGPT credentials. Active turns can therefore keep receiving expired-token errors.

Use pinned Codex 0.156.1's native `auth.command` to request profile-bound tokens from the preceding broker layer. The lean helper uses T3's existing self-invocation conventions; launch arguments and environment contain no owned bearer. The native provider name stays compatible with existing saved threads, while runtime identity tracks sign-in changes and stays stable across refreshes. Catalog checks reject account changes before mixing an earlier account label with another account's token.

Rebuilt from @Timpan4's [#19895](https://github.com/pingdotgg/t3code/pull/19895). Across the stack, 28 added cases in 12 test files become eight in three existing behavior files, plus required service fixture wiring. The complete diff is 18 files, 936 additions and 53 deletions, compared with the original 21 files, 1,643 additions and 67 deletions.

Verification on Linux:

- Current source: 94 auth/runtime/driver tests passed. Earlier R2 verification passed 173 tests including both registry suites; the registry source is unchanged. The 13 gated live-provider tests were not rerun.
- Baseline tests reproduced bearer injection and both catalog account races. Runtime cases execute the actual helper subprocess against an isolated file-backed credential store.
- Current source: a native Codex 0.156.1 app-server, using the actual T3 launch configuration/helper/broker and synthetic OAuth/inference endpoints, received 401 then 200, persisted one refresh-token rotation, and completed the same turn in the same process and thread. The disposable fixture exited cleanly.
- Historical R2 proof on the unchanged runtime/helper path: a second native probe kept one legacy rollout/thread through upgrade, broker/runtime fixture restart, and controlled same-account sign-in replacement: four completed turns, with prior history retained and the previous profile’s helper refused.
- Historical R2 benchmark: the lean helper no longer loads the contracts module graph: median source-module import fell from 576 ms to 209 ms (seven fresh-process samples per module; production-bundle timing remains unmeasured).
- Server typecheck, changed-file lint/format, Knip exports on both layers, and diff checks passed. The broker’s queued-wait test fails without its new deadline; existing rotation coverage proves persistence after the deadline crosses during exchange.

This is service/native integration evidence, not an app UI or real OAuth run. Native model discovery used a synthetic 404 fallback; catalog account binding is covered by the driver regressions. No screenshots apply to this nonvisual change. Windows pipe permissions, macOS, packaged Electron/asar/SEA, native rollback, iOS, and Android remain unverified. A manually configured `model_providers.openai_token_sharing.env_key` in shared config conflicts with native `auth.command` and must be removed; older T3 versions set that key only as a process launch override and did not persist it. Human auth/IPC approval and current-head CI are separate gates. Forced desktop/process shutdown and power loss are outside the rotation durability guarantee.

Independent whole-stack review: Opus 5.5 and GPT-6 Sol completed four rounds. Round one found a native provider-name resume regression, resolved by the stable provider name and upgrade/restart/reconnect proof. Round three identified abandoned broker jobs behind sign-in; the current deadline and deterministic persistence coverage address it. Round four found no code blockers from either reviewer. Opus independently reran 73 lower auth tests and 94 integrated behavior tests, and verified that an unsafe exchange-operator reorder makes the strengthened durability test fail.

Tests: Codex GPT-6-Astra (high). Implementation: Codex GPT-6.1-Sol (high). Harness: Codex through T3 Code.