From 65347e0a9c054890bab198ca1907229c470b9f3a Mon Sep 17 00:00:00 2001
From: luke2x <97411838+luke2x@users.noreply.github.com>
Date: Sat, 10 Oct 2026 21:49:20 +0100
Subject: [PATCH 1/6] fix(codex): renew managed credentials in active processes

---
 .../src/provider/CodexManagedRuntime.test.ts  | 92 ++++++++++++++++--
 .../src/provider/CodexManagedRuntime.ts       | 24 ++++-
 .../src/provider/CodexManagedTokenSource.ts   | 94 +++++++++++++++++++
 3 files changed, 198 insertions(+), 12 deletions(-)
 create mode 100644 apps/server/src/provider/CodexManagedTokenSource.ts

diff --git a/apps/server/src/provider/CodexManagedRuntime.test.ts b/apps/server/src/provider/CodexManagedRuntime.test.ts
index cf95d981d8a5..58f160609a7a 100644
--- a/apps/server/src/provider/CodexManagedRuntime.test.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.test.ts
@@ -1,5 +1,7 @@
-// @effect-diagnostics nodeBuiltinImport:off - checks the host's default Codex directory without writing to it.
+// @effect-diagnostics nodeBuiltinImport:off globalFetchInEffect:off - checks the host's default Codex directory without writing to it.
 import * as NodeOS from "node:os";
+import * as NodeChildProcess from "node:child_process";
+import * as NodeUtil from "node:util";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, it } from "@effect/vitest";
 import { CodexSettings, EnvironmentId, ProviderInstanceId } from "@t3tools/contracts";
@@ -16,12 +18,28 @@ import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
 import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
 import * as CodexInstallation from "./CodexInstallation.ts";
 import { makeCodexManagedRuntime } from "./CodexManagedRuntime.ts";
+import { makeCodexManagedTokenSource } from "./CodexManagedTokenSource.ts";
 import * as ProviderCredentialStore from "./ProviderCredentialStore.ts";
 import { codexAppServerArgs } from "./codexLaunchArgs.ts";
 import { resolveManagedCodexHomeLayout } from "./CodexManagedHome.ts";
 
 const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
 const decodeSettings = Schema.decodeSync(CodexSettings);
+it.effect("closes the managed credential bridge with its provider scope", () =>
+  Effect.gen(function* () {
+    const source = yield* makeCodexManagedTokenSource(
+      ProviderInstanceId.make("closed-codex"),
+      Effect.succeed({ accessToken: "dummy-token", clientId: "dummy-account" }),
+    ).pipe(Effect.scoped);
+    const reached = yield* Effect.promise(() =>
+      fetch(source.url).then(
+        () => true,
+        () => false,
+      ),
+    );
+    assert.isFalse(reached);
+  }),
+);
 it.effect("managed home defaults to the global Codex home and honors configured home paths", () =>
   Effect.gen(function* () {
     const path = yield* Path.Path;
@@ -149,7 +167,54 @@ it.effect.each(
             );
             assert.isFalse(yield* fs.exists(path.join(effective.config.homePath, "auth.json")));
           }
-          assert.strictEqual(effective.environment.ACCESS_TOKEN, "dummy-owned-access");
+          // Emulate the same app-server making later requests, without resolving
+          // or restarting its runtime. Run its configured credential command.
+          const requestToken = Effect.promise(async () => {
+            const argv = codexAppServerArgs(effective.config.launchArgs);
+            const prefix = "model_providers.openai_token_sharing.auth.args=";
+            const commandArgs = argv.find((value) => value.startsWith(prefix));
+            if (commandArgs === undefined) return effective.environment.ACCESS_TOKEN;
+            const { stdout } = await NodeUtil.promisify(NodeChildProcess.execFile)(
+              process.execPath,
+              JSON.parse(commandArgs.slice(prefix.length)),
+              { env: effective.environment, timeout: 25_000 },
+            );
+            return stdout;
+          });
+          assert.equal(yield* requestToken, "dummy-owned-access");
+          const expired = { ...JSON.parse(json), expiresAt: 0 };
+          yield* store.set(new TextEncoder().encode(JSON.stringify(expired)));
+          // A provider status read renews the saved token, as in the report.
+          assert.equal((yield* runtime.auth.access).accessToken, "dummy-renewed-access");
+          assert.deepEqual(
+            yield* Effect.all([requestToken, requestToken], { concurrency: "unbounded" }),
+            ["dummy-renewed-access", "dummy-renewed-access"],
+          );
+          assert.isUndefined(effective.environment.ACCESS_TOKEN);
+          assert.notInclude(JSON.stringify(effective.environment), "dummy-owned-access");
+          const rejected = yield* Effect.promise(() =>
+            fetch(effective.environment.T3CODE_MANAGED_CODEX_AUTH_URL!),
+          );
+          assert.equal(rejected.status, 401);
+          yield* store.set(
+            new TextEncoder().encode(
+              JSON.stringify({
+                ...expired,
+                clientId: "another-account",
+                expiresAt: (yield* Clock.currentTimeMillis) + 3_600_000,
+              }),
+            ),
+          );
+          const switched = yield* Effect.promise(() =>
+            fetch(effective.environment.T3CODE_MANAGED_CODEX_AUTH_URL!, {
+              headers: {
+                Authorization: `Bearer ${effective.environment.T3CODE_MANAGED_CODEX_AUTH_SECRET}`,
+                "X-T3-Codex-Account": effective.environment.T3CODE_MANAGED_CODEX_AUTH_ACCOUNT!,
+              },
+            }),
+          );
+          assert.equal(switched.status, 409);
+          assert.equal(yield* Effect.promise(() => switched.text()), "");
           assert.isUndefined(effective.environment.OPENAI_API_KEY);
           assert.isUndefined(effective.environment.OPENAI_BASE_URL);
           assert.isUndefined(effective.environment.T3CODE_CODEX_LAUNCH_ARGS);
@@ -192,19 +257,28 @@ it.effect.each(
                 [
                   "https://auth.openai.com/.well-known/openid-configuration",
                   "https://auth.openai.com/revoke",
+                  "https://auth.openai.com/api/accounts/oauth/token",
                 ].includes(request.url),
               );
               return HttpClientResponse.fromWeb(
                 request,
                 request.url.endsWith("/revoke")
                   ? new Response(null, { status: 200 })
-                  : Response.json({
-                      issuer: "https://auth.openai.com",
-                      authorization_endpoint: "https://auth.openai.com/api/accounts/authorize",
-                      token_endpoint: "https://auth.openai.com/api/accounts/oauth/token",
-                      jwks_uri: "https://auth.openai.com/jwks",
-                      revocation_endpoint: "https://auth.openai.com/revoke",
-                    }),
+                  : request.url.endsWith("/token")
+                    ? Response.json({
+                        access_token: "dummy-renewed-access",
+                        refresh_token: "dummy-rotated-refresh",
+                        expires_in: 3600,
+                        token_type: "Bearer",
+                        scope: "chatgpt.tokens.use.direct",
+                      })
+                    : Response.json({
+                        issuer: "https://auth.openai.com",
+                        authorization_endpoint: "https://auth.openai.com/api/accounts/authorize",
+                        token_endpoint: "https://auth.openai.com/api/accounts/oauth/token",
+                        jwks_uri: "https://auth.openai.com/jwks",
+                        revocation_endpoint: "https://auth.openai.com/revoke",
+                      }),
               );
             }),
           ),
diff --git a/apps/server/src/provider/CodexManagedRuntime.ts b/apps/server/src/provider/CodexManagedRuntime.ts
index f21cc6c3bcf3..371d02a97d29 100644
--- a/apps/server/src/provider/CodexManagedRuntime.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.ts
@@ -4,8 +4,13 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
 import * as ServerConfig from "../config.ts";
 import * as CodexInstallation from "./CodexInstallation.ts";
+import {
+  makeCodexManagedTokenSource,
+  managedCodexTokenCommand,
+} from "./CodexManagedTokenSource.ts";
 import { makeCodexChatGptAuth } from "./CodexChatGptAuth.ts";
 import { materializeCodexShadowHome } from "./Drivers/CodexHomeLayout.ts";
 
@@ -22,12 +27,15 @@ const managedCodexLaunchArgs = [
   'model_providers.openai_token_sharing.base_url="https://api.openai.com/v1"',
   'model_providers.openai_token_sharing.model_catalog_url="https://api.openai.com/v1/models"',
   "features.api_key_model_discovery=true",
-  'model_providers.openai_token_sharing.env_key="ACCESS_TOKEN"',
+  `model_providers.openai_token_sharing.auth.command=${JSON.stringify(process.execPath)}`,
+  `model_providers.openai_token_sharing.auth.args=${JSON.stringify(["-e", managedCodexTokenCommand])}`,
+  "model_providers.openai_token_sharing.auth.timeout_ms=25000",
+  "model_providers.openai_token_sharing.auth.refresh_interval_ms=30000",
   'model_providers.openai_token_sharing.wire_api="responses"',
   "model_providers.openai_token_sharing.requires_openai_auth=false",
   "model_providers.openai_token_sharing.supports_websockets=false",
 ]
-  .map((value) => `-c '${value}'`)
+  .map((value) => `-c '${value.replaceAll("'", "'\"'\"'")}'`)
   .join(" ");
 
 export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(function* (options: {
@@ -47,6 +55,11 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
       config.devUrl ?? `http://localhost:${config.port}`,
     ).toString(),
   });
+  const scope = yield* Scope.Scope;
+  const tokenSource = yield* makeCodexManagedTokenSource(options.instanceId, auth.access).pipe(
+    Effect.provideService(Scope.Scope, scope),
+    Effect.cached,
+  );
   const homeLayout = yield* resolveManagedCodexHomeLayout(
     config.stateDir,
     options.instanceId,
@@ -65,6 +78,7 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
       ),
     );
     const credentials = yield* auth.access;
+    const source = yield* tokenSource;
     yield* materializeCodexShadowHome(homeLayout).pipe(
       Effect.provideService(FileSystem.FileSystem, fs),
       Effect.provideService(Path.Path, path),
@@ -90,9 +104,13 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
     // Ambient CLI overrides cannot redirect a T3-owned token to a different provider.
     const environment: NodeJS.ProcessEnv = {
       ...options.environment,
-      ACCESS_TOKEN: credentials.accessToken,
+      T3CODE_MANAGED_CODEX_AUTH_URL: source.url,
+      T3CODE_MANAGED_CODEX_AUTH_SECRET: source.secret,
+      T3CODE_MANAGED_CODEX_AUTH_ACCOUNT: credentials.clientId,
+      ...(process.versions.electron ? { ELECTRON_RUN_AS_NODE: "1" } : {}),
       CODEX_HOME: homePath,
     };
+    delete environment.ACCESS_TOKEN;
     delete environment.T3CODE_CODEX_LAUNCH_ARGS;
     delete environment.OPENAI_API_KEY;
     delete environment.OPENAI_BASE_URL;
diff --git a/apps/server/src/provider/CodexManagedTokenSource.ts b/apps/server/src/provider/CodexManagedTokenSource.ts
new file mode 100644
index 000000000000..7a6c379841d6
--- /dev/null
+++ b/apps/server/src/provider/CodexManagedTokenSource.ts
@@ -0,0 +1,94 @@
+// @effect-diagnostics nodeBuiltinImport:off - scope-owned loopback bridge for Codex's credential command.
+import * as NodeCrypto from "node:crypto";
+import * as NodeHttp from "node:http";
+import { ProviderSetupError, type ProviderInstanceId } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
+
+// Codex invokes this command again when its cached bearer expires or receives a 401.
+// The child receives a bridge credential, never a fixed copy of the provider token.
+export const managedCodexTokenCommand = `
+fetch(process.env.T3CODE_MANAGED_CODEX_AUTH_URL, {
+  headers: { Authorization: "Bearer " + process.env.T3CODE_MANAGED_CODEX_AUTH_SECRET,
+    "X-T3-Codex-Account": process.env.T3CODE_MANAGED_CODEX_AUTH_ACCOUNT },
+}).then(async response => {
+  if (!response.ok) throw new Error();
+  process.stdout.write(await response.text());
+}).catch(() => {
+  process.stderr.write("Could not renew managed Codex credentials.\\n");
+  process.exitCode = 1;
+});
+`;
+
+export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSource")(function* (
+  instanceId: ProviderInstanceId,
+  access: Effect.Effect<
+    { readonly accessToken: string; readonly clientId: string },
+    ProviderSetupError
+  >,
+) {
+  const context = yield* Effect.context<never>();
+  const runPromise = Effect.runPromiseWith(context);
+  const secret = NodeCrypto.randomBytes(32).toString("base64url");
+  const server = yield* Effect.acquireRelease(
+    Effect.tryPromise({
+      try: () =>
+        new Promise<NodeHttp.Server>((resolve, reject) => {
+          const server = NodeHttp.createServer((request, response) => {
+            if (request.method !== "GET" || request.url !== "/token") {
+              response.writeHead(404).end();
+              return;
+            }
+            if (request.headers.authorization !== `Bearer ${secret}`) {
+              response.writeHead(401).end();
+              return;
+            }
+            const abort = new AbortController();
+            response.once("close", () => abort.abort());
+            void runPromise(access, { signal: abort.signal }).then(
+              (credentials) => {
+                if (response.destroyed) return;
+                if (request.headers["x-t3-codex-account"] !== credentials.clientId) {
+                  response.writeHead(409).end();
+                  return;
+                }
+                if (!response.destroyed)
+                  response
+                    .writeHead(200, {
+                      "content-type": "text/plain",
+                      "cache-control": "no-store",
+                    })
+                    .end(credentials.accessToken);
+              },
+              () => {
+                if (!response.destroyed) response.writeHead(503).end();
+              },
+            );
+          });
+          server.once("error", reject);
+          server.listen(0, "127.0.0.1", () => resolve(server));
+        }),
+      catch: () =>
+        new ProviderSetupError({
+          instanceId,
+          operation: "runtime",
+          detail: "Could not start the managed Codex credential bridge.",
+        }),
+    }),
+    (server) =>
+      Effect.promise(
+        () =>
+          new Promise<void>((resolve) => {
+            server.closeAllConnections();
+            server.close(() => resolve());
+          }),
+      ),
+  );
+  const address = server.address();
+  if (address === null || typeof address === "string")
+    return yield* new ProviderSetupError({
+      instanceId,
+      operation: "runtime",
+      detail: "Could not resolve the managed Codex credential bridge.",
+    });
+  return { url: `http://127.0.0.1:${address.port}/token`, secret };
+});

From fd8db67407188129eb8e505b057a77a32aa43d1b Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Sat, 10 Oct 2026 23:14:55 +0100
Subject: [PATCH 2/6] fix(codex): renew managed credentials through a T3
 subcommand

The credential command ran `process.execPath -e <script>`, which the packaged
T3 executable cannot evaluate, so it now re-invokes this install's own hidden
`codex-managed-token` subcommand. The model catalog request reads the access
token from the credential store instead of the launch environment, which no
longer carries it, and the bridge compares its secret in constant time.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 apps/server/src/bin.ts                        |  6 ++-
 apps/server/src/binCli.ts                     |  2 +
 apps/server/src/cli/codexManagedToken.ts      | 21 ++++++++
 .../src/provider/CodexManagedRuntime.test.ts  | 24 ++++++---
 .../src/provider/CodexManagedRuntime.ts       | 49 +++++++++++--------
 .../src/provider/CodexManagedTokenSource.ts   | 25 ++++------
 .../src/provider/Drivers/CodexDriver.test.ts  | 10 +++-
 .../provider/Drivers/CodexManagedProvider.ts  |  3 +-
 .../src/provider/codexManagedTokenCommand.ts  | 27 ++++++++++
 9 files changed, 120 insertions(+), 47 deletions(-)
 create mode 100644 apps/server/src/cli/codexManagedToken.ts
 create mode 100644 apps/server/src/provider/codexManagedTokenCommand.ts

diff --git a/apps/server/src/bin.ts b/apps/server/src/bin.ts
index 063093874503..3796866f1ba6 100644
--- a/apps/server/src/bin.ts
+++ b/apps/server/src/bin.ts
@@ -5,7 +5,8 @@
  * terminal-fallback agents run `t3 acp-mcp-call` per tool call, so their
  * startup sits on first-message latency. Both dispatch here before the full
  * CLI module graph (seconds of evaluation) loads; everything else defers to
- * the real CLI in ./binCli.ts.
+ * the real CLI in ./binCli.ts. Managed Codex re-runs `t3 codex-managed-token`
+ * on a short interval to renew its bearer, so it dispatches here as well.
  */
 import { isEntrypoint } from "./entrypoint.ts";
 
@@ -20,6 +21,9 @@ if (
   if (command === "acp-mcp-bridge" || command === "acp-mcp-call") {
     const { runAcpMcpCliFastPath } = await import("./mcp/AcpMcpStdioBridge.ts");
     await runAcpMcpCliFastPath(command, process.argv.slice(3));
+  } else if (command === "codex-managed-token") {
+    const { runCodexManagedTokenCommand } = await import("./provider/codexManagedTokenCommand.ts");
+    await runCodexManagedTokenCommand();
   } else {
     const { runCli } = await import("./binCli.ts");
     runCli();
diff --git a/apps/server/src/binCli.ts b/apps/server/src/binCli.ts
index 76035ded632b..c957bd176a6f 100644
--- a/apps/server/src/binCli.ts
+++ b/apps/server/src/binCli.ts
@@ -8,6 +8,7 @@ import * as CliError from "effect/cli/CliError";
 import * as NetService from "@t3tools/shared/Net";
 import packageJson from "../package.json" with { type: "json" };
 import { acpMcpBridgeCommand, acpMcpCallCommand } from "./cli/acpMcpBridge.ts";
+import { codexManagedTokenCommand } from "./cli/codexManagedToken.ts";
 import { authCommand } from "./cli/auth.ts";
 import { appCommand } from "./cli/app.ts";
 import { browserCommand } from "./cli/browser.ts";
@@ -67,6 +68,7 @@ export const makeCli = ({ cloudEnabled = hasCloudPublicConfig } = {}) =>
       ),
       acpMcpBridgeCommand,
       acpMcpCallCommand,
+      codexManagedTokenCommand,
       startCommand,
       serveCommand,
       appCommand,
diff --git a/apps/server/src/cli/codexManagedToken.ts b/apps/server/src/cli/codexManagedToken.ts
new file mode 100644
index 000000000000..b2034cd1af62
--- /dev/null
+++ b/apps/server/src/cli/codexManagedToken.ts
@@ -0,0 +1,21 @@
+import * as Effect from "effect/Effect";
+import { Command } from "effect/cli";
+
+import {
+  codexManagedTokenCommandName,
+  runCodexManagedTokenCommand,
+} from "../provider/codexManagedTokenCommand.ts";
+
+/**
+ * `t3 codex-managed-token` — internal credential command managed Codex runs to
+ * renew its bearer from the provider's loopback bridge.
+ *
+ * Real invocations dispatch through the bin.ts fast path before the CLI graph
+ * loads; this definition keeps the command wired for anything that drives the
+ * full CLI programmatically.
+ */
+export const codexManagedTokenCommand = Command.make(codexManagedTokenCommandName).pipe(
+  Command.withDescription("Print the current managed Codex credential for Codex."),
+  Command.unlisted,
+  Command.withHandler(() => Effect.promise(() => runCodexManagedTokenCommand())),
+);
diff --git a/apps/server/src/provider/CodexManagedRuntime.test.ts b/apps/server/src/provider/CodexManagedRuntime.test.ts
index 58f160609a7a..749e0957f106 100644
--- a/apps/server/src/provider/CodexManagedRuntime.test.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.test.ts
@@ -2,6 +2,7 @@
 import * as NodeOS from "node:os";
 import * as NodeChildProcess from "node:child_process";
 import * as NodeUtil from "node:util";
+import * as NodeURL from "node:url";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, it } from "@effect/vitest";
 import { CodexSettings, EnvironmentId, ProviderInstanceId } from "@t3tools/contracts";
@@ -13,6 +14,7 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import { HttpClient, HttpClientResponse } from "effect/http";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as ServerConfig from "../config.ts";
 import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
 import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
@@ -25,6 +27,7 @@ import { resolveManagedCodexHomeLayout } from "./CodexManagedHome.ts";
 
 const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
 const decodeSettings = Schema.decodeSync(CodexSettings);
+const serverEntrypoint = NodeURL.fileURLToPath(new URL("../bin.ts", import.meta.url));
 it.effect("closes the managed credential bridge with its provider scope", () =>
   Effect.gen(function* () {
     const source = yield* makeCodexManagedTokenSource(
@@ -169,14 +172,22 @@ it.effect.each(
           }
           // Emulate the same app-server making later requests, without resolving
           // or restarting its runtime. Run its configured credential command.
+          const authSetting = (name: string) => {
+            const prefix = `model_providers.openai_token_sharing.auth.${name}=`;
+            const value = codexAppServerArgs(effective.config.launchArgs).find((arg) =>
+              arg.startsWith(prefix),
+            );
+            assert.isDefined(value);
+            return JSON.parse(value!.slice(prefix.length));
+          };
+          // The command is T3's own hidden subcommand, not a Node `-e` script the
+          // packaged executable cannot evaluate.
+          assert.equal(authSetting("command"), process.execPath);
+          assert.deepEqual(authSetting("args"), [serverEntrypoint, "codex-managed-token"]);
           const requestToken = Effect.promise(async () => {
-            const argv = codexAppServerArgs(effective.config.launchArgs);
-            const prefix = "model_providers.openai_token_sharing.auth.args=";
-            const commandArgs = argv.find((value) => value.startsWith(prefix));
-            if (commandArgs === undefined) return effective.environment.ACCESS_TOKEN;
             const { stdout } = await NodeUtil.promisify(NodeChildProcess.execFile)(
-              process.execPath,
-              JSON.parse(commandArgs.slice(prefix.length)),
+              authSetting("command"),
+              authSetting("args"),
               { env: effective.environment, timeout: 25_000 },
             );
             return stdout;
@@ -286,6 +297,7 @@ it.effect.each(
       );
     }).pipe(
       Effect.scoped,
+      Effect.provideService(HostProcess.Arguments, [process.execPath, serverEntrypoint]),
       Effect.provide(
         ServerConfig.layerTest(process.cwd(), {
           prefix: "t3-managed-runtime-",
diff --git a/apps/server/src/provider/CodexManagedRuntime.ts b/apps/server/src/provider/CodexManagedRuntime.ts
index 371d02a97d29..124252cc55e1 100644
--- a/apps/server/src/provider/CodexManagedRuntime.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.ts
@@ -5,12 +5,15 @@ import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
+import {
+  resolveSelfInvocation,
+  selfInvocationArgs,
+  type SelfInvocation,
+} from "@t3tools/shared/nodeRuntime";
 import * as ServerConfig from "../config.ts";
 import * as CodexInstallation from "./CodexInstallation.ts";
-import {
-  makeCodexManagedTokenSource,
-  managedCodexTokenCommand,
-} from "./CodexManagedTokenSource.ts";
+import { makeCodexManagedTokenSource } from "./CodexManagedTokenSource.ts";
+import { codexManagedTokenCommandName } from "./codexManagedTokenCommand.ts";
 import { makeCodexChatGptAuth } from "./CodexChatGptAuth.ts";
 import { materializeCodexShadowHome } from "./Drivers/CodexHomeLayout.ts";
 
@@ -21,22 +24,25 @@ export interface CodexEffectiveRuntime {
 }
 const decodeSettings = Schema.decodeSync(CodexSettings);
 // Managed sign-in stores tokens in T3's credential store and never writes native auth.json.
-const managedCodexLaunchArgs = [
-  'model_provider="openai_token_sharing"',
-  'model_providers.openai_token_sharing.name="OpenAI Token Sharing"',
-  'model_providers.openai_token_sharing.base_url="https://api.openai.com/v1"',
-  'model_providers.openai_token_sharing.model_catalog_url="https://api.openai.com/v1/models"',
-  "features.api_key_model_discovery=true",
-  `model_providers.openai_token_sharing.auth.command=${JSON.stringify(process.execPath)}`,
-  `model_providers.openai_token_sharing.auth.args=${JSON.stringify(["-e", managedCodexTokenCommand])}`,
-  "model_providers.openai_token_sharing.auth.timeout_ms=25000",
-  "model_providers.openai_token_sharing.auth.refresh_interval_ms=30000",
-  'model_providers.openai_token_sharing.wire_api="responses"',
-  "model_providers.openai_token_sharing.requires_openai_auth=false",
-  "model_providers.openai_token_sharing.supports_websockets=false",
-]
-  .map((value) => `-c '${value.replaceAll("'", "'\"'\"'")}'`)
-  .join(" ");
+// The credential command is this T3 install's own hidden subcommand: the packaged
+// executable has no Node CLI, so `node -e` is not available to every host.
+const managedCodexLaunchArgs = (invocation: SelfInvocation) =>
+  [
+    'model_provider="openai_token_sharing"',
+    'model_providers.openai_token_sharing.name="OpenAI Token Sharing"',
+    'model_providers.openai_token_sharing.base_url="https://api.openai.com/v1"',
+    'model_providers.openai_token_sharing.model_catalog_url="https://api.openai.com/v1/models"',
+    "features.api_key_model_discovery=true",
+    `model_providers.openai_token_sharing.auth.command=${JSON.stringify(invocation.command)}`,
+    `model_providers.openai_token_sharing.auth.args=${JSON.stringify(selfInvocationArgs(invocation, [codexManagedTokenCommandName]))}`,
+    "model_providers.openai_token_sharing.auth.timeout_ms=25000",
+    "model_providers.openai_token_sharing.auth.refresh_interval_ms=30000",
+    'model_providers.openai_token_sharing.wire_api="responses"',
+    "model_providers.openai_token_sharing.requires_openai_auth=false",
+    "model_providers.openai_token_sharing.supports_websockets=false",
+  ]
+    .map((value) => `-c '${value.replaceAll("'", "'\"'\"'")}'`)
+    .join(" ");
 
 export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(function* (options: {
   readonly instanceId: ProviderInstanceId;
@@ -55,6 +61,7 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
       config.devUrl ?? `http://localhost:${config.port}`,
     ).toString(),
   });
+  const launchArgs = managedCodexLaunchArgs(yield* resolveSelfInvocation());
   const scope = yield* Scope.Scope;
   const tokenSource = yield* makeCodexManagedTokenSource(options.instanceId, auth.access).pipe(
     Effect.provideService(Scope.Scope, scope),
@@ -120,7 +127,7 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
         setupMode: "managed",
         binaryPath: executable.executablePath,
         homePath,
-        launchArgs: managedCodexLaunchArgs,
+        launchArgs,
       }),
       environment,
       revision: credentials.accessToken,
diff --git a/apps/server/src/provider/CodexManagedTokenSource.ts b/apps/server/src/provider/CodexManagedTokenSource.ts
index 7a6c379841d6..9a668b3e391d 100644
--- a/apps/server/src/provider/CodexManagedTokenSource.ts
+++ b/apps/server/src/provider/CodexManagedTokenSource.ts
@@ -4,21 +4,6 @@ import * as NodeHttp from "node:http";
 import { ProviderSetupError, type ProviderInstanceId } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
 
-// Codex invokes this command again when its cached bearer expires or receives a 401.
-// The child receives a bridge credential, never a fixed copy of the provider token.
-export const managedCodexTokenCommand = `
-fetch(process.env.T3CODE_MANAGED_CODEX_AUTH_URL, {
-  headers: { Authorization: "Bearer " + process.env.T3CODE_MANAGED_CODEX_AUTH_SECRET,
-    "X-T3-Codex-Account": process.env.T3CODE_MANAGED_CODEX_AUTH_ACCOUNT },
-}).then(async response => {
-  if (!response.ok) throw new Error();
-  process.stdout.write(await response.text());
-}).catch(() => {
-  process.stderr.write("Could not renew managed Codex credentials.\\n");
-  process.exitCode = 1;
-});
-`;
-
 export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSource")(function* (
   instanceId: ProviderInstanceId,
   access: Effect.Effect<
@@ -29,6 +14,8 @@ export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSourc
   const context = yield* Effect.context<never>();
   const runPromise = Effect.runPromiseWith(context);
   const secret = NodeCrypto.randomBytes(32).toString("base64url");
+  const digest = (value: string) => NodeCrypto.createHash("sha256").update(value).digest();
+  const expectedAuthorization = digest(`Bearer ${secret}`);
   const server = yield* Effect.acquireRelease(
     Effect.tryPromise({
       try: () =>
@@ -38,7 +25,13 @@ export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSourc
               response.writeHead(404).end();
               return;
             }
-            if (request.headers.authorization !== `Bearer ${secret}`) {
+            // Fixed-length digests keep the comparison constant-time for any header length.
+            if (
+              !NodeCrypto.timingSafeEqual(
+                digest(request.headers.authorization ?? ""),
+                expectedAuthorization,
+              )
+            ) {
               response.writeHead(401).end();
               return;
             }
diff --git a/apps/server/src/provider/Drivers/CodexDriver.test.ts b/apps/server/src/provider/Drivers/CodexDriver.test.ts
index 7ac25a2e6bc1..92446d16292e 100644
--- a/apps/server/src/provider/Drivers/CodexDriver.test.ts
+++ b/apps/server/src/provider/Drivers/CodexDriver.test.ts
@@ -210,7 +210,8 @@ it.layer(layerTest)("CodexDriver", (it) => {
           `providers/codex/${instanceId}/shadow`,
         );
         yield* Deferred.await(observedAccount);
-        // Sessions launch the T3-installed Codex with the account's token, not ambient credentials.
+        // Sessions launch the T3-installed Codex with a bridge to the account's token, not a
+        // fixed copy of it or ambient credentials.
         const threadId = ThreadId.make("managed-account-thread");
         yield* instance.orchestrationAdapter
           .openSession({
@@ -228,7 +229,12 @@ it.layer(layerTest)("CodexDriver", (it) => {
         const launch = launches[0]!;
         expect(launch.settings.binaryPath).toBe(executable.executablePath);
         expect(launch.settings.launchArgs).toContain("openai_token_sharing");
-        expect(launch.environment.ACCESS_TOKEN).toBe("dummy-owned-access");
+        expect(launch.environment.ACCESS_TOKEN).toBeUndefined();
+        expect(launch.environment.T3CODE_MANAGED_CODEX_AUTH_URL).toMatch(
+          /^http:\/\/127\.0\.0\.1:\d+\/token$/,
+        );
+        expect(launch.environment.T3CODE_MANAGED_CODEX_AUTH_ACCOUNT).toBe("oaiapp_test");
+        expect(JSON.stringify(launch.environment)).not.toContain("dummy-owned-access");
         expect(launch.environment.OPENAI_API_KEY).toBeUndefined();
         expect(launch.environment.CODEX_HOME).toBe(launch.settings.homePath);
         const before = yield* instance.auth!.subscribe("test-owner").pipe(Stream.runHead);
diff --git a/apps/server/src/provider/Drivers/CodexManagedProvider.ts b/apps/server/src/provider/Drivers/CodexManagedProvider.ts
index 92c461390aea..9ae926f4f12f 100644
--- a/apps/server/src/provider/Drivers/CodexManagedProvider.ts
+++ b/apps/server/src/provider/Drivers/CodexManagedProvider.ts
@@ -124,8 +124,9 @@ export const makeManagedCodexProvider = Effect.fn("makeManagedCodexProvider")(fu
             effective.environment,
             managedAuth,
           );
+          // The launch environment carries only the bridge credential, never the token.
           const models = yield* chatGptModels(
-            effective.environment.ACCESS_TOKEN!,
+            (yield* runtime.auth.access).accessToken,
             draft.models,
           ).pipe(Effect.provideService(HttpClient.HttpClient, http));
           return { ...draft, models };
diff --git a/apps/server/src/provider/codexManagedTokenCommand.ts b/apps/server/src/provider/codexManagedTokenCommand.ts
new file mode 100644
index 000000000000..bd048a02c45e
--- /dev/null
+++ b/apps/server/src/provider/codexManagedTokenCommand.ts
@@ -0,0 +1,27 @@
+// @effect-diagnostics globalFetch:off - import-free CLI fast path that runs before any Effect runtime exists.
+/**
+ * `t3 codex-managed-token` — internal credential command for managed Codex.
+ *
+ * Codex runs it again when its cached bearer expires or receives a 401. It
+ * reads the provider's loopback bridge from the environment and prints the
+ * current token, so the child holds a bridge credential and never a fixed copy
+ * of the provider token. Kept free of imports: bin.ts dispatches it before the
+ * CLI module graph loads, and Codex re-runs it on a short interval.
+ */
+export const codexManagedTokenCommandName = "codex-managed-token";
+
+export async function runCodexManagedTokenCommand(): Promise<void> {
+  try {
+    const response = await fetch(process.env.T3CODE_MANAGED_CODEX_AUTH_URL ?? "", {
+      headers: {
+        Authorization: `Bearer ${process.env.T3CODE_MANAGED_CODEX_AUTH_SECRET}`,
+        "X-T3-Codex-Account": process.env.T3CODE_MANAGED_CODEX_AUTH_ACCOUNT ?? "",
+      },
+    });
+    if (!response.ok) throw new Error();
+    process.stdout.write(await response.text());
+  } catch {
+    process.stderr.write("Could not renew managed Codex credentials.\n");
+    process.exitCode = 1;
+  }
+}

From da059acd22bbcb2bcb0dc0bcfe3336400207fa4e Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Sun, 11 Oct 2026 08:52:48 +0100
Subject: [PATCH 3/6] Update CodexManagedTokenSource.ts

Co-authored-by: macroscopeapp[bot] <170038800+macroscopeapp[bot]@users.noreply.github.com>
---
 apps/server/src/provider/CodexManagedTokenSource.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/provider/CodexManagedTokenSource.ts b/apps/server/src/provider/CodexManagedTokenSource.ts
index 9a668b3e391d..a70753fe06d2 100644
--- a/apps/server/src/provider/CodexManagedTokenSource.ts
+++ b/apps/server/src/provider/CodexManagedTokenSource.ts
@@ -60,13 +60,13 @@ export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSourc
           server.once("error", reject);
           server.listen(0, "127.0.0.1", () => resolve(server));
         }),
-      catch: () =>
+      catch: (cause) =>
         new ProviderSetupError({
           instanceId,
           operation: "runtime",
           detail: "Could not start the managed Codex credential bridge.",
+          cause,
         }),
-    }),
     (server) =>
       Effect.promise(
         () =>

From 1c2f3411c05d2d30529aad43af7fc5fc8bfdc5b7 Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Sun, 11 Oct 2026 08:55:15 +0100
Subject: [PATCH 4/6] fix(server): restore managed token bridge error handler
 syntax

---
 apps/server/src/provider/CodexManagedTokenSource.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/server/src/provider/CodexManagedTokenSource.ts b/apps/server/src/provider/CodexManagedTokenSource.ts
index a70753fe06d2..a9cdf6885686 100644
--- a/apps/server/src/provider/CodexManagedTokenSource.ts
+++ b/apps/server/src/provider/CodexManagedTokenSource.ts
@@ -67,6 +67,7 @@ export const makeCodexManagedTokenSource = Effect.fn("makeCodexManagedTokenSourc
           detail: "Could not start the managed Codex credential bridge.",
           cause,
         }),
+    }),
     (server) =>
       Effect.promise(
         () =>

From 7c897266bf3ea8900c61afcbcfb4e1d5823a383a Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:02:41 +0100
Subject: [PATCH 5/6] fix(codex): retire replaced managed credential bridges

Use the pinned Effect ScopedCache to finalize evicted listeners. Retire bridge capabilities during auth session replacement and verify account-switch and logout cleanup without interrupting ordinary token renewal.
---
 apps/server/src/provider/CodexChatGptAuth.ts  |  9 +++-
 .../src/provider/CodexManagedRuntime.test.ts  | 53 +++++++++++++++++++
 .../src/provider/CodexManagedRuntime.ts       | 21 ++++----
 3 files changed, 71 insertions(+), 12 deletions(-)

diff --git a/apps/server/src/provider/CodexChatGptAuth.ts b/apps/server/src/provider/CodexChatGptAuth.ts
index 2eda1e31533d..b2089c36842d 100644
--- a/apps/server/src/provider/CodexChatGptAuth.ts
+++ b/apps/server/src/provider/CodexChatGptAuth.ts
@@ -106,6 +106,8 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
   readonly defaultReturnUrl?: string;
   readonly reconnectProfile?: ChatGptReconnectProfile | null;
   readonly telemetryFlow?: "direct" | "primary_handoff";
+  /** Retire issued runtime credentials on sign-in, logout or credential replacement, not renewal. */
+  readonly onCredentialsReplaced?: Effect.Effect<void>;
 }) {
   const analytics = yield* Effect.serviceOption(AnalyticsService.AnalyticsService);
   const settings = yield* Effect.serviceOption(ServerSettings.ServerSettingsService);
@@ -439,6 +441,7 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
     method: string,
     context: ProviderAuthFlowContext,
   ) {
+    yield* options.onCredentialsReplaced ?? Effect.void;
     const endpoints = yield* discover;
     const existing = yield* read;
     const previous = Option.getOrUndefined(existing);
@@ -786,6 +789,7 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
     ),
   );
   const logout = Effect.gen(function* () {
+    yield* options.onCredentialsReplaced ?? Effect.void;
     const credentials = Option.getOrUndefined(yield* read);
     let confirmed = !credentials?.refreshToken;
     if (credentials?.refreshToken) {
@@ -967,6 +971,7 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
           "import",
           "The transferred identity conflicts with the saved ChatGPT connection.",
         );
+      yield* options.onCredentialsReplaced ?? Effect.void;
       yield* saveRegistration(registration);
       yield* save(profile.credentials, true);
     });
@@ -985,6 +990,8 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
     read,
     access,
     exportProfile,
-    revoke: lock.withPermit(withSessionLock(remove)),
+    revoke: lock.withPermit(
+      withSessionLock((options.onCredentialsReplaced ?? Effect.void).pipe(Effect.andThen(remove))),
+    ),
   };
 });
diff --git a/apps/server/src/provider/CodexManagedRuntime.test.ts b/apps/server/src/provider/CodexManagedRuntime.test.ts
index ab4e85c43090..59ec8dc666ef 100644
--- a/apps/server/src/provider/CodexManagedRuntime.test.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.test.ts
@@ -256,6 +256,59 @@ it.effect.each(
             return stdout;
           });
           assert.equal(replacementToken, "dummy-other-account-access");
+          const oldListenerReached = yield* Effect.promise(() =>
+            fetch(effective.environment.T3CODE_MANAGED_CODEX_AUTH_URL!).then(
+              () => true,
+              () => false,
+            ),
+          );
+          assert.isFalse(oldListenerReached);
+          yield* runtime.auth.controller.logout(Effect.void);
+          const signedOutListenerReached = yield* Effect.promise(() =>
+            fetch(replacement.environment.T3CODE_MANAGED_CODEX_AUTH_URL!).then(
+              () => true,
+              () => false,
+            ),
+          );
+          assert.isFalse(signedOutListenerReached);
+          // Model a later sign-in to the same registration without replacing
+          // the provider. Its old capability must not become usable again.
+          yield* store.set(
+            new TextEncoder().encode(
+              JSON.stringify({
+                ...expired,
+                clientId: "another-account",
+                accessToken: "dummy-reconnected-access",
+                expiresAt: (yield* Clock.currentTimeMillis) + 3_600_000,
+              }),
+            ),
+          );
+          const reconnected = yield* runtime.resolve;
+          assert.notEqual(
+            reconnected.environment.T3CODE_MANAGED_CODEX_AUTH_SECRET,
+            replacement.environment.T3CODE_MANAGED_CODEX_AUTH_SECRET,
+          );
+          const oldCapabilityStatus = yield* Effect.promise(() =>
+            fetch(replacement.environment.T3CODE_MANAGED_CODEX_AUTH_URL!, {
+              headers: {
+                Authorization: `Bearer ${replacement.environment.T3CODE_MANAGED_CODEX_AUTH_SECRET}`,
+                "X-T3-Codex-Account": "another-account",
+              },
+            }).then(
+              (response) => response.status,
+              () => null,
+            ),
+          );
+          assert.notEqual(oldCapabilityStatus, 200);
+          const reconnectedToken = yield* Effect.promise(async () => {
+            const { stdout } = await NodeUtil.promisify(NodeChildProcess.execFile)(
+              authSetting("command"),
+              authSetting("args"),
+              { env: reconnected.environment, timeout: 25_000 },
+            );
+            return stdout;
+          });
+          assert.equal(reconnectedToken, "dummy-reconnected-access");
           assert.isUndefined(effective.environment.OPENAI_API_KEY);
           assert.isUndefined(effective.environment.OPENAI_BASE_URL);
           assert.isUndefined(effective.environment.T3CODE_CODEX_LAUNCH_ARGS);
diff --git a/apps/server/src/provider/CodexManagedRuntime.ts b/apps/server/src/provider/CodexManagedRuntime.ts
index 288b668c4936..bba14464cc3b 100644
--- a/apps/server/src/provider/CodexManagedRuntime.ts
+++ b/apps/server/src/provider/CodexManagedRuntime.ts
@@ -1,11 +1,10 @@
 import { resolveManagedCodexHomeLayout } from "./CodexManagedHome.ts";
 import { CodexSettings, ProviderSetupError, type ProviderInstanceId } from "@t3tools/contracts";
-import * as Cache from "effect/Cache";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
-import * as Scope from "effect/Scope";
+import * as ScopedCache from "effect/ScopedCache";
 import {
   resolveSelfInvocation,
   selfInvocationArgs,
@@ -57,22 +56,22 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
   const config = yield* ServerConfig.ServerConfig;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
+  // Only the selected account needs a bridge. The cache owns each listener's
+  // scope, so replacing an account closes its previous endpoint immediately.
+  const tokenSources = yield* ScopedCache.make({
+    capacity: 1,
+    lookup: (clientId: string): ReturnType<typeof makeCodexManagedTokenSource> =>
+      makeCodexManagedTokenSource(options.instanceId, clientId, auth.access),
+  });
   const auth = yield* makeCodexChatGptAuth({
     instanceId: options.instanceId,
     defaultReturnUrl: new URL(
       "/welcome",
       config.devUrl ?? `http://localhost:${config.port}`,
     ).toString(),
+    onCredentialsReplaced: ScopedCache.invalidateAll(tokenSources),
   });
   const launchArgs = managedCodexLaunchArgs(yield* resolveSelfInvocation());
-  const scope = yield* Scope.Scope;
-  const tokenSources = yield* Cache.make({
-    capacity: Number.POSITIVE_INFINITY,
-    lookup: (clientId: string) =>
-      makeCodexManagedTokenSource(options.instanceId, clientId, auth.access).pipe(
-        Effect.provideService(Scope.Scope, scope),
-      ),
-  });
   const homeLayout = yield* resolveManagedCodexHomeLayout(
     config.stateDir,
     options.instanceId,
@@ -91,7 +90,7 @@ export const makeCodexManagedRuntime = Effect.fn("makeCodexManagedRuntime")(func
       ),
     );
     const credentials = yield* auth.access;
-    const source = yield* Cache.get(tokenSources, credentials.clientId);
+    const source = yield* ScopedCache.get(tokenSources, credentials.clientId);
     yield* materializeCodexShadowHome(homeLayout).pipe(
       Effect.provideService(FileSystem.FileSystem, fs),
       Effect.provideService(Path.Path, path),

From 26436da249dd2dfe8357532fb8025ef8ac5bde45 Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Sun, 11 Oct 2026 14:46:02 +0100
Subject: [PATCH 6/6] fix(codex): preserve active bridges after failed sign-in

---
 .../src/provider/CodexChatGptAuth.test.ts     | 89 +++++++++++++++++++
 apps/server/src/provider/CodexChatGptAuth.ts  |  9 +-
 2 files changed, 96 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/provider/CodexChatGptAuth.test.ts b/apps/server/src/provider/CodexChatGptAuth.test.ts
index 96465947b651..39c4985a40f8 100644
--- a/apps/server/src/provider/CodexChatGptAuth.test.ts
+++ b/apps/server/src/provider/CodexChatGptAuth.test.ts
@@ -10,6 +10,7 @@ import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import * as Fiber from "effect/Fiber";
 import * as Deferred from "effect/Deferred";
+import * as ScopedCache from "effect/ScopedCache";
 import * as TestClock from "effect/testing/TestClock";
 import { subscribeChatGptHandoff } from "./CodexChatGptHandoff.ts";
 import { FetchHttpClient } from "effect/http";
@@ -20,6 +21,7 @@ import * as ProviderCredentialStore from "./ProviderCredentialStore.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import * as AnalyticsService from "../telemetry/AnalyticsService.ts";
 import { makeCodexChatGptAuth } from "./CodexChatGptAuth.ts";
+import { makeCodexManagedTokenSource } from "./CodexManagedTokenSource.ts";
 
 const assertSameCallback = (actual: string | null, expected: string | null) => {
   const left = new URL(actual!);
@@ -221,10 +223,16 @@ const makeHarnessFor = Effect.fnUntraced(function* (
           }),
     flush: Effect.void,
   });
+  const tokenSources = yield* ScopedCache.make({
+    capacity: 1,
+    lookup: (clientId: string): ReturnType<typeof makeCodexManagedTokenSource> =>
+      makeCodexManagedTokenSource(instanceId, clientId, auth.access),
+  });
   const auth = yield* makeCodexChatGptAuth({
     instanceId,
     discoveryUrl: `${origin}/discovery`,
     resource: `${origin}/v1`,
+    onCredentialsReplaced: ScopedCache.invalidateAll(tokenSources),
   }).pipe(
     Effect.provideService(AnalyticsService.AnalyticsService, analytics),
     Effect.provideService(ServerSecretStore.ServerSecretStore, secrets),
@@ -278,6 +286,10 @@ const makeHarnessFor = Effect.fnUntraced(function* (
   });
   return {
     auth,
+    tokenSource: Effect.gen(function* () {
+      const credentials = Option.getOrThrow(yield* auth.read);
+      return yield* ScopedCache.get(tokenSources, credentials.clientId);
+    }),
     analyticsEvents,
     secrets,
     environmentId,
@@ -386,6 +398,16 @@ const makeHarnessFor = Effect.fnUntraced(function* (
   };
 });
 const makeHarness = makeHarnessFor(instanceId);
+const readManagedToken = (source: { url: string; secret: string }, clientId: string) =>
+  Effect.promise(async () => {
+    const response = await fetch(source.url, {
+      headers: {
+        authorization: `Bearer ${source.secret}`,
+        "x-t3-codex-account": clientId,
+      },
+    });
+    return { status: response.status, token: await response.text() };
+  });
 const provision = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   effect.pipe(
     Effect.scoped,
@@ -1359,6 +1381,68 @@ it.effect(
     ),
 );
 
+it.effect.each(["cancel", "expired code", "wrong subject", "invalid nonce"])(
+  "preserves the live credential bridge after reconnect fails: %s",
+  (failure) =>
+    provision(
+      Effect.gen(function* () {
+        const h = yield* makeHarness;
+        yield* h.signIn;
+        yield* h.phase("succeeded");
+        const before = Option.getOrThrow(yield* h.auth.read);
+        const source = yield* h.tokenSource;
+        assert.deepEqual(yield* readManagedToken(source, before.clientId), {
+          status: 200,
+          token: before.accessToken,
+        });
+        if (failure === "cancel") {
+          const { waiting } = yield* h.startRemote();
+          yield* h.auth.controller.cancel("owner", waiting.flowId!);
+          yield* h.phase("cancelled");
+        } else {
+          if (failure === "expired code") h.setCodeError("invalid_grant");
+          if (failure === "wrong subject") h.setIdentity("another-user", "another@example.test");
+          if (failure === "invalid nonce") h.setInvalidNonce();
+          yield* h.signIn;
+          yield* h.phase("failed");
+        }
+        assert.deepEqual(Option.getOrThrow(yield* h.auth.read), before);
+        assert.deepEqual(yield* readManagedToken(source, before.clientId), {
+          status: 200,
+          token: before.accessToken,
+        });
+      }),
+    ),
+);
+
+it.effect(
+  "successful same-account reconnect retires the old bridge and issues a fresh capability",
+  () =>
+    provision(
+      Effect.gen(function* () {
+        const h = yield* makeHarness;
+        yield* h.signIn;
+        yield* h.phase("succeeded");
+        const source = yield* h.tokenSource;
+        const { waiting, callbackUrl } = yield* h.startRemote();
+        // Token reads wait for the auth lock while sign-in is pending, but the
+        // listener itself must remain available until credentials are saved.
+        const pending = yield* Effect.promise(() => fetch(source.url));
+        assert.strictEqual(pending.status, 401);
+        yield* h.auth.controller.complete("owner", { flowId: waiting.flowId!, callbackUrl });
+        yield* h.phase("succeeded");
+        const old = yield* Effect.tryPromise(() => fetch(source.url)).pipe(Effect.result);
+        assert.strictEqual(old._tag, "Failure");
+        const replacement = yield* h.tokenSource;
+        assert.notStrictEqual(replacement.secret, source.secret);
+        assert.deepEqual(yield* readManagedToken(replacement, "oaiapp_test"), {
+          status: 200,
+          token: Option.getOrThrow(yield* h.auth.read).accessToken,
+        });
+      }),
+    ),
+);
+
 it.effect("declined sharing on an older profile does not replace the active account", () =>
   provision(
     Effect.gen(function* () {
@@ -1370,6 +1454,7 @@ it.effect("declined sharing on an older profile does not replace the active acco
       yield* h.changeAccount;
       yield* h.phase("succeeded");
       const before = h.storedRecords();
+      const source = yield* h.tokenSource;
       h.setIdentity("user-test", "hidden@example.test");
       h.setCallbackClientId("oaiapp_test");
       h.declineSharing();
@@ -1382,6 +1467,10 @@ it.effect("declined sharing on an older profile does not replace the active acco
         Option.getOrThrow(yield* h.auth.read),
         before.find((record) => record.clientId === "oaiapp_other_account"),
       );
+      assert.deepEqual(yield* readManagedToken(source, "oaiapp_other_account"), {
+        status: 200,
+        token: Option.getOrThrow(yield* h.auth.read).accessToken,
+      });
     }),
   ),
 );
diff --git a/apps/server/src/provider/CodexChatGptAuth.ts b/apps/server/src/provider/CodexChatGptAuth.ts
index b2089c36842d..89298aec2c14 100644
--- a/apps/server/src/provider/CodexChatGptAuth.ts
+++ b/apps/server/src/provider/CodexChatGptAuth.ts
@@ -441,7 +441,6 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
     method: string,
     context: ProviderAuthFlowContext,
   ) {
-    yield* options.onCredentialsReplaced ?? Effect.void;
     const endpoints = yield* discover;
     const existing = yield* read;
     const previous = Option.getOrUndefined(existing);
@@ -667,6 +666,12 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
       const scopes = tokens.scope.split(/\s+/).filter(Boolean);
       yield* withSessionLock(
         Effect.gen(function* () {
+          const active = yield* read;
+          const activate = scopes.includes(REQUIRED_SCOPE) || Option.isNone(active);
+          // Failed sign-in leaves the running connection intact. A declined
+          // grant for another profile also leaves the active credentials alone.
+          if (activate || (Option.isSome(active) && active.value.clientId === clientId))
+            yield* options.onCredentialsReplaced ?? Effect.void;
           yield* saveRegistration({
             clientId,
             redirectUri,
@@ -685,7 +690,7 @@ export const makeCodexChatGptAuth = Effect.fn("makeCodexChatGptAuth")(function*
               scopes,
               ...identity,
             },
-            scopes.includes(REQUIRED_SCOPE) || Option.isNone(yield* read),
+            activate,
           );
         }),
       );