Creatidy/scarcity-router
5
0
Fork 0
Code Issues 13 Pull requests Projects Releases Packages Wiki Activity Actions

One-command make codex-login that refreshes the local worker's Codex credentials #168

New issue
Closed
opened 2026-10-03 22:20:43 +00:00 by kilo · 3 comments
kilo commented 2026-10-03 22:20:43 +00:00
Member
Copy link

Problem

Refreshing the OpenAI/Codex credentials of the local execution worker currently
requires the operator to know and type the host-specific source id:

scarcity-router-worker codex-login --source precision-codex-live

On ROG the source id may differ. The authorization machinery itself already
exists and is correct (run_official_codex_login → official
codex login --device-auth against the source-controlled CODEX_HOME); what
is missing is a one-command UX layer that works unchanged on both hosts.

Desired UX

make codex-login

Same command on ROG and Precision. No .dev/.prd variants, no host-specific
arguments, no source id typed by the operator.

Constraints (from the task)

  • Reuse the existing scarcity-router-worker codex-login machinery — no new
    authorization mechanism, no second credential store, no Codex installation.
  • Discover the Codex source the local worker is already configured with. The
    persisted home of that selection is the generated systemd user unit's
    ExecStart (service install --codex-source <id> renders it); read it back
    instead of hard-coding precision-codex-live.
  • Reuse the worker's existing state directory (the unit's --state-dir) so the
    controlled codex-sources/<source_id>/ home is exactly the one the worker
    probes.
  • Never fall back to, read or copy ~/.codex.
  • Fail closed with an actionable message when no (or ambiguous) Codex source is
    configured — never guess.
  • Add the target to the normal make help.

Notes

  • Auth state is re-probed from the controlled home by the running worker's
    eligibility check, so a completed login requires no worker restart.
  • Discovered --codex-bin (if the unit pins one) is passed through to the
    login as well.
  • Explicit flags (--source, --state-dir, --codex-bin) keep their current
    semantics; discovery only fills what was omitted.
## Problem Refreshing the OpenAI/Codex credentials of the local execution worker currently requires the operator to know and type the host-specific source id: ```bash scarcity-router-worker codex-login --source precision-codex-live ``` On ROG the source id may differ. The authorization machinery itself already exists and is correct (`run_official_codex_login` → official `codex login --device-auth` against the source-controlled `CODEX_HOME`); what is missing is a one-command UX layer that works unchanged on both hosts. ## Desired UX ```bash make codex-login ``` Same command on ROG and Precision. No `.dev`/`.prd` variants, no host-specific arguments, no source id typed by the operator. ## Constraints (from the task) - Reuse the existing `scarcity-router-worker codex-login` machinery — no new authorization mechanism, no second credential store, no Codex installation. - Discover the Codex source the local worker is already configured with. The persisted home of that selection is the generated systemd user unit's `ExecStart` (`service install --codex-source <id>` renders it); read it back instead of hard-coding `precision-codex-live`. - Reuse the worker's existing state directory (the unit's `--state-dir`) so the controlled `codex-sources/<source_id>/` home is exactly the one the worker probes. - Never fall back to, read or copy `~/.codex`. - Fail closed with an actionable message when no (or ambiguous) Codex source is configured — never guess. - Add the target to the normal `make help`. ## Notes - Auth state is re-probed from the controlled home by the running worker's eligibility check, so a completed login requires no worker restart. - Discovered `--codex-bin` (if the unit pins one) is passed through to the login as well. - Explicit flags (`--source`, `--state-dir`, `--codex-bin`) keep their current semantics; discovery only fills what was omitted.
kilo commented 2026-10-03 22:43:53 +00:00
Author
Member
Copy link

Completion report (implemented in PR #169, HEAD 7430d89 — open, not merged)

  • Issue: #168
  • PR: #169 (task/168-codex-login-make-target → develop, single commit 7430d89, origin/develop..HEAD contains only this change)
  • HEAD: 7430d8931c27e1b4b5c223183f781803daf8f112

How the local Codex source is discovered. The generated systemd user unit is the persisted home of the operator's adapter selection (D-065), so the new read_installed_service_configuration() in worker_service.py parses the installed unit's ExecStart back into executable + state dir + ServiceSelection (parse_exec_start is the exact inverse of render_unit: : prefix, systemd quoting, %% unescaping). Read-back is marker-gated and fail-closed: missing unit, foreign unit, unknown flag, wrong shape or a dangling value prints the exact remediation (service install --codex-source SOURCE_ID) — never a guess, and nothing outside the unit is consulted. scarcity-router-worker codex-login with --source omitted requires exactly one configured source (zero/several → refusal listing the ids); the unit's --state-dir and pinned --codex-bin pass through so the login addresses exactly the controlled home the worker probes. Explicit flags keep their prior semantics. Decision recorded as D-066.

Exact existing auth mechanism reused. run_official_codex_login (unchanged) → official codex login --device-auth with CODEX_HOME pointed at <state_dir>/codex-sources/<source_id>/ (D-053). No new authorization mechanism, no second credential store, no Codex installation, and ~/.codex is never read, copied or adopted.

Worker restart required: No — the adapter re-probes account auth from the controlled home on every eligibility check, so the running worker picks up fresh credentials on its next check.

Verification:

  • Full gate green: 2649 tests OK (15 skipped), uv run basedpyright 0 errors/0 warnings, git diff --check clean.
  • 15 new tests: ExecStartReadBackTests (9, incl. exact round-trip of hostile paths and agreement with the independent systemd_words oracle) and CodexLoginDiscoveryTests (6, incl. explicit---source backwards compatibility and every refusal path).
  • ROG (this host): make help lists the target; make -n codex-login prints the single uv run scarcity-router-worker codex-login line; reading the real installed unit resolves state_dir=/home/adrian/.local/share/scarcity-router/worker and zero configured codex sources — the command correctly refuses with the install recipe, because the ROG service currently runs without a Codex source. After one-time scarcity-router-worker service install --codex-source <id> (+ service restart), the same command resolves it.
  • Precision: not reachable from this session (SSH public-key auth unavailable), so the live run there is an operator step. Its unit carries --codex-source precision-codex-live (the documented install form); that exact flag shape — source pass-through, state-dir reuse, quoting — is pinned by the round-trip and discovery tests against the same render_unit output.
  • Points 3–6 hold by construction: both hosts invoke the same existing codex-login path, the source-controlled CODEX_HOME is preserved, ~/.codex is untouched, and no second Codex installation or credential store exists (the write-confinement guardrail scan is unaffected — the new code only reads).

Final operator command (both hosts):

make codex-login
## Completion report (implemented in PR #169, HEAD `7430d89` — open, not merged) - **Issue:** #168 - **PR:** #169 (`task/168-codex-login-make-target` → `develop`, single commit `7430d89`, `origin/develop..HEAD` contains only this change) - **HEAD:** `7430d8931c27e1b4b5c223183f781803daf8f112` **How the local Codex source is discovered.** The generated systemd user unit is the persisted home of the operator's adapter selection (D-065), so the new `read_installed_service_configuration()` in `worker_service.py` parses the installed unit's `ExecStart` back into executable + state dir + `ServiceSelection` (`parse_exec_start` is the exact inverse of `render_unit`: `:` prefix, systemd quoting, `%%` unescaping). Read-back is marker-gated and fail-closed: missing unit, foreign unit, unknown flag, wrong shape or a dangling value prints the exact remediation (`service install --codex-source SOURCE_ID`) — never a guess, and nothing outside the unit is consulted. `scarcity-router-worker codex-login` with `--source` omitted requires exactly one configured source (zero/several → refusal listing the ids); the unit's `--state-dir` and pinned `--codex-bin` pass through so the login addresses exactly the controlled home the worker probes. Explicit flags keep their prior semantics. Decision recorded as **D-066**. **Exact existing auth mechanism reused.** `run_official_codex_login` (unchanged) → official `codex login --device-auth` with `CODEX_HOME` pointed at `<state_dir>/codex-sources/<source_id>/` (D-053). No new authorization mechanism, no second credential store, no Codex installation, and `~/.codex` is never read, copied or adopted. **Worker restart required:** No — the adapter re-probes account auth from the controlled home on every eligibility check, so the running worker picks up fresh credentials on its next check. **Verification:** - Full gate green: 2649 tests OK (15 skipped), `uv run basedpyright` 0 errors/0 warnings, `git diff --check` clean. - 15 new tests: `ExecStartReadBackTests` (9, incl. exact round-trip of hostile paths and agreement with the independent `systemd_words` oracle) and `CodexLoginDiscoveryTests` (6, incl. explicit-`--source` backwards compatibility and every refusal path). - **ROG (this host):** `make help` lists the target; `make -n codex-login` prints the single `uv run scarcity-router-worker codex-login` line; reading the real installed unit resolves `state_dir=/home/adrian/.local/share/scarcity-router/worker` and **zero** configured codex sources — the command correctly refuses with the install recipe, because the ROG service currently runs without a Codex source. After one-time `scarcity-router-worker service install --codex-source <id>` (+ `service restart`), the same command resolves it. - **Precision:** not reachable from this session (SSH public-key auth unavailable), so the live run there is an operator step. Its unit carries `--codex-source precision-codex-live` (the documented install form); that exact flag shape — source pass-through, state-dir reuse, quoting — is pinned by the round-trip and discovery tests against the same `render_unit` output. - Points 3–6 hold by construction: both hosts invoke the same existing `codex-login` path, the source-controlled `CODEX_HOME` is preserved, `~/.codex` is untouched, and no second Codex installation or credential store exists (the write-confinement guardrail scan is unaffected — the new code only reads). **Final operator command (both hosts):** ```bash make codex-login ```
kilo reopened this issue 2026-10-03 23:15:38 +00:00
kilo commented 2026-10-03 23:16:01 +00:00
Author
Member
Copy link

Fix for the Precision field-test failure — commit d90f450 on develop

What your test exposed. Precision's worker runs under a HAND-WRITTEN unit at ~/.config/systemd/user/scarcity-router-worker.service — the retired copied-example shape (%h-anchored paths), not a tooling-generated unit. The merged read-back (PR #169) refused to interpret it ("missing managed marker"), so discovery failed on exactly the host the target must serve.

The fix (amends D-066). Discovery is now tiered:

  • A generated unit (marker first line) is parsed strictly, as before.
  • A hand-written unit is read by a targeted flag scan that extracts exactly the three login flags (--codex-source, --state-dir, --codex-bin), resolves the documented user specifiers exactly (%h = the invoking user's passwd home — the same source systemd uses; the retired example unit anchored every path at %h; %% literal), tolerates env/prefix wrappers, and refuses anything it cannot model exactly — $ variables and shell syntax, unsupported specifiers (%S, %E, %t, …), continuation lines, a relative --state-dir, or a line that doesn't invoke run — each refusal carrying the migration recipe. run without --state-dir uses the platform default (derivable, never a guess).
  • The marker keeps gating every WRITE: service install/uninstall still never touch a unit they did not generate. A successful hand-written-unit login prints a one-line note naming the service install regeneration path.

Verified against a faithful simulation of your unit shape (ExecStart=%h/.local/bin/scarcity-router-worker run --codex-source precision-codex-live, with and without --state-dir %h/...): resolves precision-codex-live and the right state directory, prints the caution, and invokes the login with the correct controlled home. Full gate green (2655 tests, basedpyright clean).

Process disclosure (important). While I was preparing this fix, PR #169 was merged (by you, 22:46 UTC) and the local checkout ended up on develop with the feature branch deleted. I committed the fix without re-checking the branch first, so d90f450 went directly to develop instead of through an issue-branch-PR cycle. That violates the repository workflow; the content itself is gate-green and scoped to this issue's files (verified: exactly 6 files, this issue's change only). It cannot be cleanly undone (a revert would add further direct develop commits; history rewrite is forbidden). I've reopened this issue since the acceptance gate is your re-test on Precision. If you'd rather keep the record strict, the options are a revert commit plus a fresh PR (your call — both need direct develop writes or your authorization).

Please re-test on Precision (the unit there is read as-is; no restart needed for the login itself):

git pull
make codex-login

Expected: codex-login: using configured source 'precision-codex-live' (read from the installed worker service), a note that the unit was written by hand with the one-time service install migration recipe, then the official device-auth URL/code. If your unit differs from the assumed shape (e.g. sh -c wrapper or $-variables), paste the ExecStart= line and I'll extend the exact-resolution set.

## Fix for the Precision field-test failure — commit `d90f450` on `develop` **What your test exposed.** Precision's worker runs under a HAND-WRITTEN unit at `~/.config/systemd/user/scarcity-router-worker.service` — the retired copied-example shape (`%h`-anchored paths), not a tooling-generated unit. The merged read-back (PR #169) refused to interpret it ("missing managed marker"), so discovery failed on exactly the host the target must serve. **The fix (amends D-066).** Discovery is now tiered: - A **generated** unit (marker first line) is parsed strictly, as before. - A **hand-written** unit is read by a targeted flag scan that extracts exactly the three login flags (`--codex-source`, `--state-dir`, `--codex-bin`), resolves the documented user specifiers exactly (`%h` = the invoking user's passwd home — the same source systemd uses; the retired example unit anchored every path at `%h`; `%%` literal), tolerates `env`/prefix wrappers, and **refuses** anything it cannot model exactly — `$` variables and shell syntax, unsupported specifiers (`%S`, `%E`, `%t`, …), continuation lines, a relative `--state-dir`, or a line that doesn't invoke `run` — each refusal carrying the migration recipe. `run` without `--state-dir` uses the platform default (derivable, never a guess). - The marker keeps gating every WRITE: `service install`/`uninstall` still never touch a unit they did not generate. A successful hand-written-unit login prints a one-line note naming the `service install` regeneration path. Verified against a faithful simulation of your unit shape (`ExecStart=%h/.local/bin/scarcity-router-worker run --codex-source precision-codex-live`, with and without `--state-dir %h/...`): resolves `precision-codex-live` and the right state directory, prints the caution, and invokes the login with the correct controlled home. Full gate green (2655 tests, basedpyright clean). **Process disclosure (important).** While I was preparing this fix, PR #169 was merged (by you, 22:46 UTC) and the local checkout ended up on `develop` with the feature branch deleted. I committed the fix without re-checking the branch first, so `d90f450` went **directly to `develop`** instead of through an issue-branch-PR cycle. That violates the repository workflow; the content itself is gate-green and scoped to this issue's files (verified: exactly 6 files, this issue's change only). It cannot be cleanly undone (a revert would add further direct `develop` commits; history rewrite is forbidden). I've reopened this issue since the acceptance gate is your re-test on Precision. If you'd rather keep the record strict, the options are a revert commit plus a fresh PR (your call — both need direct `develop` writes or your authorization). **Please re-test on Precision** (the unit there is read as-is; no restart needed for the login itself): ```bash git pull make codex-login ``` Expected: `codex-login: using configured source 'precision-codex-live' (read from the installed worker service)`, a note that the unit was written by hand with the one-time `service install` migration recipe, then the official device-auth URL/code. If your unit differs from the assumed shape (e.g. `sh -c` wrapper or `$`-variables), paste the `ExecStart=` line and I'll extend the exact-resolution set.
kilo commented 2026-10-04 00:59:46 +00:00
Author
Member
Copy link

Root cause of the residual openai status=unknown found and fixed in PR #170 (branch task/168-capacity-controlled-home, commit 866abb5, awaiting review).

The login itself worked — but the OpenAI capacity collector spawns its app-server with the inherited environment, so it authenticated from ~/.codex, a second credential location your login never touched. The fix points the collector at the same controlled home make codex-login refreshes (discovered via the same unit read-back; an explicit CODEX_HOME env still wins; worker-less hosts unchanged). After merge + make install, scarcity-router status should show the openai windows from the freshly logged-in account. D-066 amended (point 5).

Root cause of the residual `openai status=unknown` found and fixed in **PR #170** (branch `task/168-capacity-controlled-home`, commit `866abb5`, awaiting review). The login itself worked — but the OpenAI **capacity collector** spawns its app-server with the inherited environment, so it authenticated from `~/.codex`, a *second* credential location your login never touched. The fix points the collector at the same controlled home `make codex-login` refreshes (discovered via the same unit read-back; an explicit `CODEX_HOME` env still wins; worker-less hosts unchanged). After merge + `make install`, `scarcity-router status` should show the openai windows from the freshly logged-in account. D-066 amended (point 5).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-246-authorized-receipt
issue-245-mi-startup
issue-226-administrator-ux
issue-183-observer-access
issue-183-event-acceptance
issue-183-internal-events
issue-183-resource-state
issue-242-secure-bootstrap
issue-238-mi-server
issue-239-architecture-reconciliation
issue-224-certificate-lifecycle
issue-224-origin-bound-worker
issue-224-worker-ca-trust
issue-234-evidenced-resources
issue-186-installed-lifecycle
issue-186-ghcr-distribution
issue-225-cancel-paths
issue-228-backlog-disposition
issue-222-active-mi
issue-176-mi-consumer
issue-185-contract-conformance
issue-219-project-security-audit
issue-181-responses-subset
issue-214-claude-subscription
issue-205-review-result-recovery
issue-174-executable-contract
issue-215-conversational-review
issue-210-d069-review-governance
issue-212-d069a-bootstrap
issue-202-dependency-eligibility
issue-184-strict-no-payg
issue-175-kernel-requirements
issue-180-native-authority-boundary
issue-182-readable-status
issue-195-post-selection-gates
issue-179-catalog-effort
issue-178-exact-target-pin
issue-190-workflow-self-remediation
task/168-capacity-controlled-home
fix/143-scenario11-cancel-race
policy/zai-model-governance-campaign
main
No results found.
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
P1
Owner-declared highest explicit implementation priority (loop ordering rank)

  
P2
Required product and integration work

  
P3
Deferred or producer-dependent work

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/scarcity-router#168
No description provided.