fix(auth): stop Codex OAuth worker on cancel, pin resolved profile

[JoaoMarcos44]

%%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#00f0ff', 'mainBkg': '#0a0a16', 'primaryTextColor': '#ffffff', 'primaryBorderColor': '#ff007f', 'lineColor': '#00f0ff'}}}%%
graph TD
    A[🔒 Cancel Request] --> B{Old Behavior}
    A --> C{Fixed Behavior}

    B --> D[⚠️ Session Removed]
    D --> E[🐛 Worker Keeps Polling]
    E --> F[🐛 Code Approved Late]
    F --> G[💀 Profile Lookup Returns None]
    G --> H[💀 Tokens Written To Wrong Profile]

    C --> I[⚡ Cancel Event Set]
    I --> J[🚀 Worker Checks Event]
    J --> K[✅ Safe Abort - No Write]

    style B fill:#3a0a12,stroke:#ff007f
    style D fill:#3a0a12,stroke:#ff007f
    style E fill:#3a0a12,stroke:#ff007f
    style F fill:#3a0a12,stroke:#ff007f
    style G fill:#3a0a12,stroke:#ff007f
    style H fill:#3a0a12,stroke:#ff007f
    style C fill:#0a2a2f,stroke:#00f0ff
    style I fill:#0a2a2f,stroke:#00f0ff
    style J fill:#0a2a2f,stroke:#00f0ff
    style K fill:#0a2a2f,stroke:#00f0ff

Loading

Summary

• Cancelling an OpenAI Codex device-code OAuth flow from the dashboard did not stop the background polling worker, and the worker could still write credentials afterward — potentially to the wrong profile.
• Adds a per-session threading.Event that the cancel endpoint sets, and wires it into every checkpoint of the Codex device-code worker (poll loop, code exchange, token write).
• Pins the worker's target profile once at session start instead of re-resolving it lazily at write time, so a cancelled/removed session can never fall back to whatever profile happens to be "current".

Root Cause

In hermes_cli/web_server.py:

1. _codex_full_login_worker's poll loop (while time.monotonic() < deadline: time.sleep(poll_interval); poll = client.post(...)) never checked any cancellation signal — it ran to completion regardless of whether the dashboard had cancelled the session.
2. DELETE /api/providers/oauth/sessions/{session_id} only did _oauth_sessions.pop(session_id, None) — it removed the session bookkeeping but never signalled the worker thread to stop.
3. The token-write path resolved the destination profile lazily, at write time, via _oauth_session_profile(session_id). Once the session had been popped by cancellation, that lookup returned None, and _profile_scope(None) silently fell back to whatever profile was currently active — not the profile the session was originally started for.

Net effect: cancel a Codex login, then approve the device code late (or race the cancel against an in-flight approval) → the worker kept running, "succeeded", and wrote OAuth tokens into the wrong profile with no user-visible error.

Fix

• _new_oauth_session now stores a threading.Event() (cancel_event) alongside each session.
• DELETE /api/providers/oauth/sessions/{session_id} sets that event before popping the session from _oauth_sessions.
• _codex_full_login_worker:
  • Captures cancel_event and the resolved target_profile once, at the very start, while the session entry is still guaranteed to exist.
  • Checks cancel_event.is_set() before and after each poll-loop sleep, before exchanging the device code for tokens, and immediately before calling _save_codex_tokens.
  • Returns immediately (no write, thread exits) the moment cancellation is observed.
  • Uses the pinned target_profile for the write instead of re-resolving _oauth_session_profile(session_id), so even a raced write always lands on the originally-intended profile — and only happens if the session was never cancelled.

The other device-code pollers (Nous, MiniMax, xAI) are unchanged — this fix is scoped to the Codex flow reported in the issue, since it's the only one that inlines its own poll loop directly in web_server.py.

Test Plan

• Added test_codex_dashboard_worker_aborts_after_cancel in tests/hermes_cli/test_web_oauth_dispatch.py: starts a Codex session, cancels it via the real DELETE /api/providers/oauth/sessions/{id} endpoint from inside a monkeypatched time.sleep (simulating "user clicks Cancel while the worker is paused between polls"), then lets the poll "succeed" and code-exchange "succeed" — asserts _save_codex_tokens was never called and the session stays removed.
• pytest tests/hermes_cli/test_web_oauth_dispatch.py -v → 25 passed (new test + all pre-existing OAuth dispatch tests, including the two pre-existing Codex worker tests, confirming no regression).
• python -m py_compile hermes_cli/web_server.py → compiles cleanly.
• Confirmed test_dashboard_oauth_write_uses_owner_only_permissions failure in test_web_server_oauth_write.py is pre-existing (fails identically on main before this change) — Windows file-mode semantics, unrelated to this fix.

Closes #74308

[alt-glitch]

This was generated by AI during triage.

Duplicate of #73914: both patches add cancellation checks through the Codex device-code worker and pin its session profile to prevent post-cancel credential persistence.