fix(shell): route codex auth through controller state

skulidropek · skulidropek · commit 40d0b1eae966 · 2026-04-03T15:55:31.000Z
diff --git a/docker-compose.api.yml b/docker-compose.api.yml
@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: packages/api/Dockerfile
-    container_name: docker-git-api
+    container_name: ${DOCKER_GIT_API_CONTAINER_NAME:-docker-git-api}
     environment:
       DOCKER_GIT_API_PORT: ${DOCKER_GIT_API_PORT:-3334}
       DOCKER_GIT_PROJECTS_ROOT: ${DOCKER_GIT_PROJECTS_ROOT:-/home/dev/.docker-git}
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -5,7 +5,7 @@ services:
       dockerfile: packages/api/Dockerfile
       args:
         DOCKER_GIT_CONTROLLER_REV: ${DOCKER_GIT_CONTROLLER_REV:-unknown}
-    container_name: docker-git-api
+    container_name: ${DOCKER_GIT_API_CONTAINER_NAME:-docker-git-api}
     environment:
       DOCKER_GIT_API_PORT: ${DOCKER_GIT_API_PORT:-3334}
       DOCKER_GIT_PROJECTS_ROOT: ${DOCKER_GIT_PROJECTS_ROOT:-/home/dev/.docker-git}
diff --git a/packages/api/src/http.ts b/packages/api/src/http.ts
@@ -191,6 +191,8 @@ const configuredFederationPublicOrigin =
 
 const configuredFederationActorUsername =
   process.env["DOCKER_GIT_FEDERATION_ACTOR"] ?? "docker-git"
+const controllerRevision =
+  process.env["DOCKER_GIT_CONTROLLER_REV"]?.trim() ?? null
 
 const readHeader = (
   request: HttpServerRequest.HttpServerRequest,
@@ -245,7 +247,7 @@ export const makeRouter = () => {
     ),
     HttpRouter.get("/ui/styles.css", textResponse(uiStyles, "text/css; charset=utf-8", 200)),
     HttpRouter.get("/ui/app.js", textResponse(uiScript, "application/javascript; charset=utf-8", 200)),
-    HttpRouter.get("/health", jsonResponse({ ok: true }, 200)),
+    HttpRouter.get("/health", jsonResponse({ ok: true, revision: controllerRevision }, 200)),
     HttpRouter.get(
       "/auth/github/status",
       Effect.gen(function*(_) {
diff --git a/packages/app/src/docker-git/controller-docker.ts b/packages/app/src/docker-git/controller-docker.ts
@@ -19,7 +19,7 @@ export type ControllerRuntime =
   | FileSystem.FileSystem
   | Path.Path
 
-export const controllerContainerName = "docker-git-api"
+export const controllerContainerName = process.env["DOCKER_GIT_API_CONTAINER_NAME"]?.trim() || "docker-git-api"
 
 const inspectNetworksTemplate = String
   .raw`{{range $k,$v := .NetworkSettings.Networks}}{{printf "%s=%s\n" $k $v.IPAddress}}{{end}}`
diff --git a/packages/app/src/docker-git/controller.ts b/packages/app/src/docker-git/controller.ts
@@ -31,6 +31,11 @@ export { buildApiBaseUrlCandidates, isRemoteDockerHost } from "./controller-reac
 
 let selectedApiBaseUrl: string | undefined
 
+type HealthProbeResult = {
+  readonly apiBaseUrl: string
+  readonly revision: string | null
+}
+
 const controllerBootstrapError = (message: string): ControllerBootstrapError => ({
   _tag: "ControllerBootstrapError",
   message
@@ -43,13 +48,30 @@ const rememberSelectedApiBaseUrl = (value: string): void => {
 export const resolveApiBaseUrl = (): string =>
   resolveExplicitApiBaseUrl() ?? selectedApiBaseUrl ?? resolveConfiguredApiBaseUrl()
 
-const probeHealth = (apiBaseUrl: string): Effect.Effect<void, ControllerBootstrapError> =>
+const parseHealthRevision = (text: string): string | null => {
+  try {
+    const parsed: unknown = JSON.parse(text)
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null
+    }
+    const revision = Reflect.get(parsed, "revision")
+    return typeof revision === "string" && revision.trim().length > 0 ? revision.trim() : null
+  } catch {
+    return null
+  }
+}
+
+const probeHealth = (apiBaseUrl: string): Effect.Effect<HealthProbeResult, ControllerBootstrapError> =>
   Effect.gen(function*(_) {
     const client = yield* _(HttpClient.HttpClient)
     const response = yield* _(client.get(`${apiBaseUrl}/health`, { headers: { accept: "application/json" } }))
+    const bodyText = yield* _(response.text)
 
     if (response.status >= 200 && response.status < 300) {
-      return
+      return {
+        apiBaseUrl,
+        revision: parseHealthRevision(bodyText)
+      }
     }
 
     return yield* _(
@@ -74,6 +96,11 @@ const probeHealth = (apiBaseUrl: string): Effect.Effect<void, ControllerBootstra
 const findReachableApiBaseUrl = (
   candidateUrls: ReadonlyArray<string>
 ): Effect.Effect<string, ControllerBootstrapError> =>
+  findReachableHealthProbe(candidateUrls).pipe(Effect.map(({ apiBaseUrl }) => apiBaseUrl))
+
+const findReachableHealthProbe = (
+  candidateUrls: ReadonlyArray<string>
+): Effect.Effect<HealthProbeResult, ControllerBootstrapError> =>
   Effect.gen(function*(_) {
     if (candidateUrls.length === 0) {
       return yield* _(
@@ -85,14 +112,14 @@ const findReachableApiBaseUrl = (
       const healthy = yield* _(
         probeHealth(candidateUrl).pipe(
           Effect.match({
-            onFailure: () => false,
-            onSuccess: () => true
+            onFailure: () => undefined,
+            onSuccess: (result) => result
           })
         )
       )
 
-      if (healthy) {
-        return candidateUrl
+      if (healthy !== undefined) {
+        return healthy
       }
     }
 
@@ -176,10 +203,20 @@ const findReachableApiBaseUrlOption = (
     })
   )
 
-const findReachableDirectApiBaseUrl = (
+const findReachableHealthProbeOption = (
+  candidateUrls: ReadonlyArray<string>
+): Effect.Effect<HealthProbeResult | undefined, ControllerBootstrapError> =>
+  findReachableHealthProbe(candidateUrls).pipe(
+    Effect.match({
+      onFailure: (): HealthProbeResult | undefined => undefined,
+      onSuccess: (probe) => probe
+    })
+  )
+
+const findReachableDirectHealthProbe = (
   explicitApiBaseUrl: string | undefined
-): Effect.Effect<string | undefined, ControllerBootstrapError> =>
-  findReachableApiBaseUrlOption(
+): Effect.Effect<HealthProbeResult | undefined, ControllerBootstrapError> =>
+  findReachableHealthProbeOption(
     buildApiBaseUrlCandidates({
       explicitApiBaseUrl,
       cachedApiBaseUrl: selectedApiBaseUrl,
@@ -324,14 +361,25 @@ export const ensureControllerReady = (): Effect.Effect<void, ControllerBootstrap
   Effect.gen(function*(_) {
     yield* _(failIfRemoteDockerWithoutApiUrl())
     const explicitApiBaseUrl = resolveExplicitApiBaseUrl()
-    const reachableBeforeDocker = yield* _(findReachableDirectApiBaseUrl(explicitApiBaseUrl))
-
-    if (reachableBeforeDocker !== undefined) {
-      rememberSelectedApiBaseUrl(reachableBeforeDocker)
-      return
+    const localControllerRevision = yield* _(prepareLocalControllerRevision())
+    if (explicitApiBaseUrl !== undefined) {
+      const reachableBeforeDocker = yield* _(findReachableDirectHealthProbe(explicitApiBaseUrl))
+      if (reachableBeforeDocker !== undefined) {
+        rememberSelectedApiBaseUrl(reachableBeforeDocker.apiBaseUrl)
+        return
+      }
+      yield* _(failIfExplicitApiUrlIsUnreachable(explicitApiBaseUrl))
+    } else {
+      const reachableBeforeDocker = yield* _(findReachableDirectHealthProbe(undefined))
+      if (
+        reachableBeforeDocker !== undefined &&
+        reachableBeforeDocker.revision === localControllerRevision
+      ) {
+        rememberSelectedApiBaseUrl(reachableBeforeDocker.apiBaseUrl)
+        return
+      }
     }
 
-    yield* _(failIfExplicitApiUrlIsUnreachable(explicitApiBaseUrl))
     const bootstrapContext = yield* _(loadControllerBootstrapContext())
     const reusedExistingController = yield* _(reuseReachableControllerIfPossible(bootstrapContext))
     if (reusedExistingController) {
diff --git a/packages/app/src/lib/core/templates-entrypoint/nested-docker-git.ts b/packages/app/src/lib/core/templates-entrypoint/nested-docker-git.ts
@@ -218,14 +218,6 @@ fi
 
 SOURCE_CODEX_CONFIG="__CODEX_HOME__/config.toml"
 copy_if_distinct_file "$SOURCE_CODEX_CONFIG" "$DOCKER_GIT_AUTH_DIR/config.toml" || true
-
-SOURCE_SHARED_AUTH="__CODEX_HOME__-shared/auth.json"
-SOURCE_LOCAL_AUTH="__CODEX_HOME__/auth.json"
-if [[ -f "$SOURCE_SHARED_AUTH" ]]; then
-  copy_if_distinct_file "$SOURCE_SHARED_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json" || true
-elif [[ -f "$SOURCE_LOCAL_AUTH" ]]; then
-  copy_if_distinct_file "$SOURCE_LOCAL_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json" || true
-fi
 if [[ -f "$DOCKER_GIT_AUTH_DIR/auth.json" ]]; then
   chmod 600 "$DOCKER_GIT_AUTH_DIR/auth.json" || true
 fi
diff --git a/packages/app/src/lib/core/templates-entrypoint/opencode.ts b/packages/app/src/lib/core/templates-entrypoint/opencode.ts
@@ -124,10 +124,6 @@ if (!isRecord(codex)) process.exit(0)
 let opencode = readJson(opencodePath)
 if (!isRecord(opencode)) opencode = {}
 
-if (opencode.openai) {
-  process.exit(0)
-}
-
 const apiKey = codex.OPENAI_API_KEY
 if (typeof apiKey === "string" && apiKey.trim().length > 0) {
   opencode.openai = { type: "api", key: apiKey.trim() }
diff --git a/packages/app/src/lib/usecases/auth-copy.ts b/packages/app/src/lib/usecases/auth-copy.ts
@@ -93,8 +93,15 @@ export const copyCodexFile = (
     if (!sourceExists) {
       return
     }
+    const sourceText = yield* _(fs.readFileString(sourceFile))
     const targetExists = yield* _(fs.exists(targetFile))
     if (targetExists) {
+      const targetText = yield* _(fs.readFileString(targetFile))
+      if (targetText === sourceText) {
+        return
+      }
+      yield* _(fs.writeFileString(targetFile, sourceText))
+      yield* _(Effect.log(`Synced Codex ${spec.label} from ${sourceFile} to ${targetFile}`))
       return
     }
     yield* _(fs.copyFile(sourceFile, targetFile))
diff --git a/packages/lib/src/core/templates-entrypoint/nested-docker-git.ts b/packages/lib/src/core/templates-entrypoint/nested-docker-git.ts
@@ -217,14 +217,6 @@ fi
 
 SOURCE_CODEX_CONFIG="__CODEX_HOME__/config.toml"
 copy_if_distinct_file "$SOURCE_CODEX_CONFIG" "$DOCKER_GIT_AUTH_DIR/config.toml" || true
-
-SOURCE_SHARED_AUTH="__CODEX_HOME__-shared/auth.json"
-SOURCE_LOCAL_AUTH="__CODEX_HOME__/auth.json"
-if [[ -f "$SOURCE_SHARED_AUTH" ]]; then
-  copy_if_distinct_file "$SOURCE_SHARED_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json" || true
-elif [[ -f "$SOURCE_LOCAL_AUTH" ]]; then
-  copy_if_distinct_file "$SOURCE_LOCAL_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json" || true
-fi
 if [[ -f "$DOCKER_GIT_AUTH_DIR/auth.json" ]]; then
   chmod 600 "$DOCKER_GIT_AUTH_DIR/auth.json" || true
 fi
diff --git a/packages/lib/src/core/templates-entrypoint/opencode.ts b/packages/lib/src/core/templates-entrypoint/opencode.ts
@@ -123,10 +123,6 @@ if (!isRecord(codex)) process.exit(0)
 let opencode = readJson(opencodePath)
 if (!isRecord(opencode)) opencode = {}
 
-if (opencode.openai) {
-  process.exit(0)
-}
-
 const apiKey = codex.OPENAI_API_KEY
 if (typeof apiKey === "string" && apiKey.trim().length > 0) {
   opencode.openai = { type: "api", key: apiKey.trim() }
diff --git a/packages/lib/src/usecases/auth-copy.ts b/packages/lib/src/usecases/auth-copy.ts
@@ -92,8 +92,15 @@ export const copyCodexFile = (
     if (!sourceExists) {
       return
     }
+    const sourceText = yield* _(fs.readFileString(sourceFile))
     const targetExists = yield* _(fs.exists(targetFile))
     if (targetExists) {
+      const targetText = yield* _(fs.readFileString(targetFile))
+      if (targetText === sourceText) {
+        return
+      }
+      yield* _(fs.writeFileString(targetFile, sourceText))
+      yield* _(Effect.log(`Synced Codex ${spec.label} from ${sourceFile} to ${targetFile}`))
       return
     }
     yield* _(fs.copyFile(sourceFile, targetFile))
diff --git a/packages/lib/tests/usecases/auth-sync.test.ts b/packages/lib/tests/usecases/auth-sync.test.ts
@@ -131,6 +131,47 @@ describe("syncGithubAuthKeys", () => {
       })
     ).pipe(Effect.provide(NodeContext.layer)))
 
+  it.effect("overwrites stale Codex auth.json in the target auth dir", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const sourceBase = path.join(root, "source")
+        const targetBase = path.join(root, "target")
+        const sourceCodexDir = path.join(sourceBase, ".orch", "auth", "codex")
+        const targetCodexDir = path.join(targetBase, ".orch", "auth", "codex")
+        const sourceAuthText = JSON.stringify({ tokens: { account_id: "new-account" } }, null, 2)
+        const targetAuthText = JSON.stringify({ tokens: { account_id: "old-account" } }, null, 2)
+
+        yield* _(fs.makeDirectory(sourceCodexDir, { recursive: true }))
+        yield* _(fs.makeDirectory(targetCodexDir, { recursive: true }))
+        yield* _(fs.writeFileString(path.join(sourceCodexDir, "auth.json"), sourceAuthText))
+        yield* _(fs.writeFileString(path.join(targetCodexDir, "auth.json"), targetAuthText))
+
+        yield* _(
+          syncAuthArtifacts({
+            sourceBase,
+            targetBase,
+            source: {
+              envGlobalPath: ".orch/env/global.env",
+              envProjectPath: ".orch/env/project.env",
+              codexAuthPath: ".orch/auth/codex",
+              claudeAuthPath: ".orch/auth/claude"
+            },
+            target: {
+              envGlobalPath: ".orch/env/global.env",
+              envProjectPath: ".orch/env/project.env",
+              codexAuthPath: ".orch/auth/codex",
+              claudeAuthPath: ".orch/auth/claude"
+            }
+          })
+        )
+
+        const copiedAuthText = yield* _(fs.readFileString(path.join(targetCodexDir, "auth.json")))
+        expect(copiedAuthText).toBe(sourceAuthText)
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("rewrites managed codex config to include gpt-5.4 and plan mode xhigh", () =>
     withTempDir((root) =>
       Effect.gen(function*(_) {
diff --git a/packages/lib/tests/usecases/prepare-files.test.ts b/packages/lib/tests/usecases/prepare-files.test.ts
@@ -179,7 +179,6 @@ describe("prepareProjectFiles", () => {
         expect(entrypoint).toContain('docker_git_load_env_file "$DOCKER_GIT_ENV_GLOBAL"')
         expect(entrypoint).toContain('docker_git_load_env_file "$DOCKER_GIT_ENV_PROJECT"')
         expect(entrypoint).not.toContain('export "$line"')
-        expect(entrypoint).toContain('SOURCE_SHARED_AUTH="/home/dev/.codex-shared/auth.json"')
         expect(entrypoint).toContain('CODEX_LABEL_RAW="$CODEX_AUTH_LABEL"')
         expect(entrypoint).toContain('OPENCODE_DATA_DIR="/home/dev/.local/share/opencode"')
         expect(entrypoint).toContain('OPENCODE_SHARED_HOME="/home/dev/.codex-shared/opencode"')
@@ -210,6 +209,11 @@ describe("prepareProjectFiles", () => {
         expect(entrypoint).not.toContain("\n  EOFMOVE\n")
         expect(entrypoint).toContain('sync_file_if_present "$BOOTSTRAP_AUTH_KEYS" "$DOCKER_GIT_AUTH_KEYS" || true')
         expect(entrypoint).toContain('sync_labeled_auth_files "$BOOTSTRAP_CODEX_SHARED_AUTH_DIR" "$DOCKER_GIT_AUTH_DIR"')
+        expect(entrypoint).not.toContain('SOURCE_SHARED_AUTH="/home/dev/.codex-shared/auth.json"')
+        expect(entrypoint).not.toContain('SOURCE_LOCAL_AUTH="/home/dev/.codex/auth.json"')
+        expect(entrypoint).not.toContain('copy_if_distinct_file "$SOURCE_SHARED_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json"')
+        expect(entrypoint).not.toContain('copy_if_distinct_file "$SOURCE_LOCAL_AUTH" "$DOCKER_GIT_AUTH_DIR/auth.json"')
+        expect(entrypoint).not.toContain("if (opencode.openai) {")
         expect(entrypoint).toContain('rm -f "$SHARED_AUTH_FILE" || true')
         expect(entrypoint).toContain(
           "if [[ \"$CLONE_OK\" -eq 1 ]]; then\n  docker_git_prepare_active_agent_project_rules\nfi"
diff --git a/scripts/e2e/opencode-autoconnect.sh b/scripts/e2e/opencode-autoconnect.sh
@@ -22,6 +22,10 @@ VOLUME_NAME="dg-e2e-opencode-$RUN_ID-home"
 SSH_PORT="$(( (RANDOM % 1000) + 20000 ))"
 
 export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
+export DOCKER_GIT_PROJECTS_ROOT_VOLUME="docker-git-e2e-opencode-$RUN_ID-projects"
+export DOCKER_GIT_API_CONTAINER_NAME="docker-git-e2e-opencode-$RUN_ID-api"
+export DOCKER_GIT_API_PORT="$(( (RANDOM % 1000) + 34000 ))"
+export COMPOSE_PROJECT_NAME="docker-git-e2e-opencode-$RUN_ID"
 export DOCKER_GIT_STATE_AUTO_SYNC=0
 
 REPO_URL="https://github.com/octocat/Hello-World/issues/1"
@@ -64,6 +68,7 @@ cleanup() {
     echo "e2e/opencode-autoconnect: out dir: $OUT_DIR" >&2
     return
   fi
+  (cd "$REPO_ROOT" && docker compose down -v --remove-orphans) >/dev/null 2>&1 || true
   if [[ -d "$OUT_DIR" ]] && [[ -f "$OUT_DIR/docker-compose.yml" ]]; then
     (cd "$OUT_DIR" && docker compose down -v --remove-orphans) >/dev/null 2>&1 || true
   fi
