[alexalok]

Summary

• Keep stored ChatGPT pool accounts visible in the dashboard and account-list/refresh API when the native Codex home is absent. Previously the native-main observation threw CODEX_HOME_UNAVAILABLE and failed the entire account list.
• Treat that failure as an unavailable observation without creating a home or changing the native account's cached identity or reauthentication state. Invalid default/explicit home resolution and credential mutations retain their strict checks; storage validation runs before missing-home fallback so unsafe roots still fail closed.
• Add regression coverage for all three list/refresh routes with Codex integration enabled and disabled, a disappearing home, preserved cached state, and rejected unsafe paths; document the behavior.

Verification

Current head 437939f19642ef26c0450b85d005555e44ef3dae

• Native-home observation now tolerates CODEX_HOME_UNAVAILABLE only when codexHomeIsAbsent(getCodexHome()) proves absence. Non-directory default homes, dangling links, and parent traversal failures still report errors. Existing unavailable/busy-claim behavior and credential-mutation checks are unchanged.
• Added ten default-home cases: missing/file/dangling-link across GET, GET with refresh, and POST refresh, plus an inaccessible parent. With the final isolated fixture, the old predicate fails seven cases (17 passed, 7 failed); the fixed predicate passes all 24 tests, 126 assertions. The fixture delegates to the real home resolver with isolated home/WSL discovery inputs.
• bun scripts/test.ts tests/codex-integration/codex-auth-headless-accounts.test.ts tests/codex-integration/codex-auth-api.test.ts tests/codex-integration/native-profile-store.test.ts tests/codex-integration/codex-home-owner.test.ts tests/lab/core-lab-boundary.test.ts: 434 passed, 0 failed. After the WSL-only fixture correction, the complete headless file was rerun with the red/green results above; runtime code was unchanged.
• bun scripts/test.ts --changed=HEAD, run before committing against b6f9a3b124995b6e909e8fa8187c633bcb276e43: 33,052 passed, 40 skipped, 1 failed across 1,468 files. The sole failure, connected-client runtime probe scope > a rejected preferred runtime falls back without rewriting the saved selection, is the already reproduced host Codex discovery leak. Rechecking tests/cli/cli-connect-readiness.test.ts with the documented process-only isolation profile passed 27 tests, 1 skipped, 0 failed; assertions and host configuration were unchanged.
• Completed account-list guidance in French, Turkish, and Traditional Chinese, and synchronized the resolution-error boundary across all eight published locale pages.
• With repository-pinned Bun 1.4.3: bun node_modules/typescript/bin/tsc --noEmit, bun scripts/privacy-scan.ts, bun scripts/structure-ssot.ts, and git diff --check passed. cd docs-site && bun install --frozen-lockfile passed with no dependency changes; bun --bun run build passed with 585 pages and 83,065 internal links checked.
• Opus 5.5 and Astra at medium effort reviewed the follow-up. Their WSL fixture finding and the final verifier's documentation precision finding were fixed. Fresh final verification completed with no supported remaining findings.
• Scope exception: the affected graph and explicit regressions cover this narrow fallback change; another 51k-test macOS run would repeat the documented host-tool/process-isolation conflict below. The affected run is not claimed as uniformly green. Fork Ubuntu CI passed on this exact head, including all four test shards and aggregate ci. Codex, Bugbot, and upstream CodeRabbit completed without remaining findings. Fork PR fix(codex): list pool accounts without a native home #1 was squash-merged into alexalok/opencodex:dev as 4abfcc6d0c26b4444469833de67f216851f18882; its feature branch is preserved for upstream PR fix(codex): list pool accounts without a native home lidge-jun/opencodex#7450. Upstream required CI still awaits maintainer approval. Older-head evidence below remains historical.

Runtime validation at 22a9f85e85f70ab6d7d81dd8b31af4765aa26863

• Review follow-up: validate the OpenCodex storage root before resolving the native Codex home. An unsafe OPENCODEX_HOME now reports PROFILE_STORAGE_UNSAFE even when CODEX_HOME is absent, including if the home disappears during quota refresh. No credential-write checks were relaxed.
• Added two regression cases and observed both fail before the fix (resolved 200 instead of a storage error). After the fix, the focused auth/headless/native-profile run passed 436 tests across 4 matched files, 0 failures, including all 14 headless account cases. Matched files: codex-auth-headless-accounts.test.ts, codex-auth-api.test.ts, native-profile-store.test.ts, and native-profile-manager.test.ts, under tests/codex-integration/.
• bun scripts/test.ts --changed=dev (Bun 1.4.3, merge base 12025981e5a304cdb6b1b54f525ba8554f623977): 34,169 passed, 42 skipped, 2 failed across 1,527 files. The two failures are the previously reproduced host-runtime leaks: resolveCodexRuntime > treats missing persisted and resolved versions as the same selection and connected-client runtime probe scope > a rejected preferred runtime falls back without rewriting the saved selection.
• Rechecked those two files under the existing test-process isolation profile that hides host Codex installations: sandbox-exec -f /tmp/opencodex-test-isolation.sb bun scripts/test.ts tests/codex-integration/codex-runtime.test.ts tests/cli/cli-connect-readiness.test.ts: 86 passed, 1 skipped, 0 failed. Assertions and installed tools were unchanged.
• bun node_modules/typescript/bin/tsc --noEmit, bun scripts/privacy-scan.ts, bun scripts/structure-ssot.ts, and git diff --check: passed.
• cd docs-site && bun --bun run build: passed; 585 pages and 83,065 internal links checked.
• Fresh Opus 5.5 and Astra reviews at medium effort covered the full diff and authentication/storage boundary; neither found an actionable issue. Fresh final findings verification completed with no supported remaining findings.
• Fork CI passed on this exact head: all four Ubuntu test shards and aggregate ci, plus the supporting gates. macOS/Windows lanes were skipped by repository policy. This does not substitute for upstream required CI or maintainer approval.
• Scope exception: the affected-test graph and explicit regressions cover this validation-order change; another 51k-test local full run would repeat the documented macOS host-tool/process-isolation conflicts below. The affected run is not claimed as uniformly green. New-head hosted Ubuntu CI and remote bot reviews must finish before merge; older-head results below remain historical evidence only.

Prior implementation validation at b2a8fb30cdaf8715e4a23b2a5c9aeb458df48688

• Base: 12025981e5a304cdb6b1b54f525ba8554f623977; head: b2a8fb30cdaf8715e4a23b2a5c9aeb458df48688.
• bun scripts/test.ts with repository-pinned Bun 1.4.3: 51,144 passed, 145 skipped, 7 failed across the parallel suite and serial lanes. All 12 new account-list regression cases passed.
• Six failures reproduced on untouched upstream 12025981e in this same checkout: Desktop remote-hub cold-restart model IDs (1), Codex runtime discovery (1), CLI connect readiness (1), and launcher PATH fallback (3). The seventh was a 5-second crash-guard diagnostic timeout; that file passed on untouched upstream and on an immediate focused rerun of the PR head (18 passed, 0 failed).
• bun node_modules/typescript/bin/tsc --noEmit: passed.
• bun scripts/privacy-scan.ts: passed.
• bun scripts/structure-ssot.ts: passed.
• cd docs-site && bun --bun run build: passed; 585 pages and 83,065 internal links checked.
• git diff --check origin/dev...HEAD: passed.
• Opus 5.5 and Astra reviews at medium effort found no actionable bugs before rebasing; final independent findings verification also passed. GitHub Codex and Cursor Bugbot both completed review of b2a8fb3 with no findings and no unresolved threads in that prior round.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

The isolation profile and historical full-suite exceptions are documented in upstream PR #7450.

---

Note

Medium Risk
Touches Codex auth/account-list and native-home resolution on a security-sensitive path; behavior is narrowed with strict fail-closed rules for bad paths and credential mutations, plus broad integration tests.

Overview
Codex account list/refresh no longer fails when the native CODEX_HOME is genuinely missing. Stored ChatGPT pool accounts still return from the dashboard and GET/POST codex-auth account routes; listing does not create a home or alter cached main identity or needsReauth state.

Runtime: isNativeMainObservationUnavailable treats busy/unavailable claims and proven-absent CODEX_HOME as “observation skipped” for passive reads (account-list, main quota probe), while withNativeMainCredentialClaim still errors on a missing home for mutations. Invalid explicit/default home paths (file, dangling symlink, untraversable parent) and unsafe OPENCODEX_HOME still fail closed; OpenCodex storage is validated before missing-home tolerance.

Docs (EN + 7 locales) and structure openai-accounts.md document the boundary. Tests: new codex-auth-headless-accounts.test.ts and test-layout registration.

^{Reviewed by Cursor Bugbot for commit 437939f. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T08:43:11.721911Z	437939f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[alexalok]

@codex review

[alexalok]

@cursor review

[cursor]

Stale Bugbot comment from a previous run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09e092bf6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alexalok]

@codex review

[alexalok]

@cursor review

[cursor]

Stale Bugbot comment from a previous run.

[alexalok]

@codex review

Please review current head b6f9a3b124995b6e909e8fa8187c633bcb276e43. The latest follow-up adds the missing account-list guidance to four translated documentation pages.

[alexalok]

@cursor review

Please review current head b6f9a3b124995b6e909e8fa8187c633bcb276e43. The latest follow-up adds the missing account-list guidance to four translated documentation pages.

[cursor]

Stale Bugbot comment from a previous run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b6f9a3b124

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alexalok]

@codex review

Please review current head 437939f19642ef26c0450b85d005555e44ef3dae. Follow-ups now require positive native-home absence and complete the remaining translated account-list guidance. The two prior findings are fixed and resolved; final local validation and review results are recorded in the PR description.

[alexalok]

@cursor review

Please review current head 437939f19642ef26c0450b85d005555e44ef3dae. Follow-ups now require positive native-home absence and complete the remaining translated account-list guidance. The two prior findings are fixed and resolved; final local validation and review results are recorded in the PR description.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 437939f196

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 437939f. Configure here.}