fix(provider-openai-codex): improve credential handling and function …

[ytallo]

…availability checks

• Updated README to clarify fallback behavior when the auth-credentials vault is not running.
• Enhanced identity prompts to support batch function calls for improved efficiency.
• Refactored authentication functions to check for availability before attempting token operations, preventing unnecessary errors.
• Added tests for function list parsing to ensure robustness against malformed entries.

Summary by CodeRabbit

• New Features

  • Improved credential handling to better support environments where the remote auth vault isn’t available.
  • Added safer fallback behavior so local credentials can be used when needed.

• Bug Fixes

  • Prevented repeated import attempts when the vault service is not running.
  • Made token refresh behavior more resilient by only refreshing when the capability is available.

• Documentation

  • Updated troubleshooting guidance for auth and credential fallback scenarios.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview, Comment	Jul 9, 2026 2:15pm
workers-tech-spec	Ready	Preview, Comment	Jul 9, 2026 2:15pm

[github-actions]

skill-check — worker

0 verified, 41 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 809fd4e8-a631-4197-a3cc-500d12d5214d

📥 Commits

Reviewing files that changed from the base of the PR and between 4e7e783 and 8d6ea82.

📒 Files selected for processing (5)

• provider-openai-codex/README.md
• provider-openai-codex/prompts/identity.txt
• provider-openai-codex/src/auth.rs
• provider-openai-codex/src/router_client.rs
• provider-openai-codex/src/stream_fn.rs

---

📝 Walkthrough

Walkthrough

Router client gains function-availability detection so vault-dependent calls degrade gracefully when target functions aren't registered. Auth import and token refresh flows in auth.rs and stream_fn.rs are updated to use these availability-aware wrappers. README troubleshooting text and identity.txt prompt instructions are also revised.

Changes

Vault availability-aware auth flow

Layer / File(s)	Summary
Function-availability helpers and wrappers provider-openai-codex/src/router_client.rs	Adds internal helpers to check whether engine functions are registered and exposes auth_get_token_available, get_token_if_available, set_token_if_available, refresh_if_available, with unit tests for the parser.
Import guard using availability checks provider-openai-codex/src/auth.rs	import_codex_home_if_absent returns early when no token is available and writes credentials via set_token_if_available, handling Ok(true)/Ok(false)/Err outcomes.
Conditional refresh in credential fetch provider-openai-codex/src/stream_fn.rs	fetch_fresh_credential uses availability-aware get/refresh calls, only re-fetching when refresh succeeds, otherwise returning the existing credential.
README troubleshooting update provider-openai-codex/README.md	Troubleshooting row updated to describe local fallback behavior when the auth-credentials vault is not running.

Identity Prompt Guidance Updates

Layer / File(s)	Summary
Batched contract-fetching guidance provider-openai-codex/prompts/identity.txt	Clarifies missing field causes, adds a batched engine::functions::info example, and requires single-batch contract fetches before installs/renames/moves.
Sub-agent policy and failure handling provider-openai-codex/prompts/identity.txt	Documents fail-closed sub-agent baseline requiring explicit function allow-listing, and adds FAILED-line/checklist requirements for denied functions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant StreamFn as fetch_fresh_credential
  participant RouterClient
  participant EngineFunctions
  participant Vault

  StreamFn->>RouterClient: get_token_if_available(provider)
  RouterClient->>EngineFunctions: LIST_FUNCTIONS
  EngineFunctions-->>RouterClient: function list
  RouterClient->>Vault: auth::get_token (if registered)
  Vault-->>RouterClient: credential
  RouterClient-->>StreamFn: Ok(Some(credential))

  alt credential near expiry
    StreamFn->>RouterClient: refresh_if_available(provider)
    RouterClient->>EngineFunctions: check refresh function registered
    alt refresh available
      RouterClient->>Vault: trigger OAuth refresh
      Vault-->>RouterClient: Ok(true)
      StreamFn->>RouterClient: get_token_if_available(provider)
      RouterClient-->>StreamFn: Ok(Some(refreshed credential))
    else refresh unavailable
      RouterClient-->>StreamFn: Ok(false)
      StreamFn-->>StreamFn: return existing near-expiry credential
    end
  end

Loading

Poem

A rabbit checks before it hops,
"Is the function there?" before it stops.
No more crashes, no more fright,
Fallback keeps the tokens right. 🥕
Batch your contracts, hop as one—
Vault or not, the work gets done! 🐇

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/openai-codex-auth-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}