[bug] first-run auto app-bind can orphan ~/.codex/config.toml with no restorable backup #614

Activity

1. ndycode

   added

   bugSomething isn't workingSomething isn't working

   on Jun 16, 2026
2. ndycode commented on Jun 16, 2026

   

   ndycode

   on Jun 16, 2026

   OwnerAuthor

   More actions

   Sharper root cause (confirmed via testing on 2.3.1)

   While smoke-testing I reproduced this deterministically and traced the exact mechanism — it's worse than "first-run only," and the no-backup part is confirmed.

   Trigger: the first-run marker is keyed off getCodexMultiAuthDir():

   markerPath = getCodexMultiAuthDir() + "/first-run-setup.json"   // lib/runtime/first-run.ts:236-238
   

   ensureFirstRunSetup early-returns only if existsSync(markerPath) (first-run.ts:409). So any invocation that points CODEX_MULTI_AUTH_DIR at a directory without that marker re-runs first-run setup — including re-running app-bind. This isn't limited to a true first run; a new/relocated multi-auth dir (or anything that resolves getCodexMultiAuthDir() to a fresh path) re-arms it.

   Blast radius: the re-run binds against the real CODEX_HOME (~/.codex), not the relocated dir — bindCodexAppRuntimeRotation() resolves the codex home independently of CODEX_MULTI_AUTH_DIR. So a command run with an isolated/alternate multi-auth dir still mutates the real ~/.codex/config.toml.

   No backup persists: after each re-bind, ~/.codex/multi-auth/app-bind/ contained only an empty runtime-rotation-app-router.log — no runtime-rotation-app-bind.json, no codex-config-backup.json. So bindCodexAppRuntimeRotationLocked's pre-write atomicWriteFile(paths.backupPath, …) is either not landing or being cleaned up, leaving the rewritten config unrecoverable by unbind-app. Observed it re-bind to a fresh port on a second invocation (51758 → 51707), each time with no backup.

   Observed sequence:

   1. CODEX_MULTI_AUTH_DIR=<fresh dir> codex-multi-auth list → prints Bound Codex app config C:\Users\neil\.codex\config.toml to http://127.0.0.1:51707 + Routed 2 existing Codex app shortcut(s).
   2. Real ~/.codex/config.toml now has model_provider = "codex-multi-auth-runtime-proxy" + the proxy block, pointing at a port with no live router.
   3. rotation status → Codex app bind: not configured; unbind-app → Codex app bind was not configured (no-op).
   4. Only fix is hand-editing the config.

   Note on first-run marker: even the normal marker recorded appBind: "skipped" while the config was still bound on a later run — consistent with the bind coming from the marker-less re-run path rather than the recorded first-run outcome, and with status/unbind trusting state files over the actual config.

   Reliable workaround for testers: to exercise the CLI without touching the real config, set all of: CODEX_HOME=<temp> (so any bind targets the temp home), plus CODEX_MULTI_AUTH_APP_BIND=0, CODEX_MULTI_AUTH_APP_BIND_INSTALL=0, CODEX_MULTI_AUTH_APP_LAUNCHER_INSTALL=0, CODEX_MULTI_AUTH_RUNTIME_ROTATION_PROXY=0. With those, no bind fires and the real ~/.codex is untouched (verified).

   This reinforces the two fixes proposed above: (a) make unbind-app/status derive "bound" from config.toml itself, not the state files; and (b) guarantee a restorable backup (or an in-config sentinel) before the provider rewrite — and gate the bind so it doesn't fire just because the multi-auth dir lacks a marker.
3. coderabbitai commented on Jun 16, 2026

   

   coderabbitaiBot

   on Jun 16, 2026 – with coderabbitai

   Contributor

   More actions

   🔗 Related PRs

   #439 - Enable runtime rotation and auto-update by default [merged]
   #460 - Fix app bind history repair [merged]
   #462 - Fix Codex TUI goal proxy handling [merged]
   #485 - fix: preserve hook trust in runtime shadows [merged]
   #607 - fix(rotation): break stale-recovery deadlock on transient account state [merged]

   ---

   📝 Issue Planner

   _{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

   • Create Plan

   ---

   🧪 Issue enrichment is currently in open beta.

   To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

   issue_enrichment:
     auto_enrich:
       enabled: false

   💬 Have feedback or questions? Drop into our discord!
4. ndycode

   added a commit that references this issue on Jun 16, 2026

   fix(config-toml): avoid duplicate model_provider in half-orphan recov…

   ...

   46c2bdc
5. coderabbitai commented on Jun 16, 2026

   

   coderabbitaiBot

   on Jun 16, 2026 – with coderabbitai

   Contributor

   More actions

   Coding Plan

   Summary

   • add isConfigBoundToRuntimeProxy to detect proxy provider in config.toml independent of state files
   • extend AppBindStatus with configBound field so callers can identify orphaned state (bound: false, configBound: true)
   • modify unbindCodexAppRuntimeRotationLocked to restore orphaned configs by stripping proxy block and defaulting to model_provider = "openai" when no backup exists
   • update status display to clearly indicate orphaned state and guide users to unbind-app

   Design Choices

   Design Choice 1: fallback model_provider when no backup exists

   Options Considered:

   1. fall back to model_provider = "openai" as the safe default
   2. remove the model_provider line entirely (leave unset)
   3. leave the proxy provider in place (no change — defeats the purpose)

   Chosen Option: 1

   Rationale: openai is the documented default for codex; users who had a different provider before bind lost their backup anyway and openai is the least surprising restore target.

   💡 User Tips

   Regenerate the plan with different choices with @coderabbitai <feedback>.

   Implementation Steps

   Phase 1: add config.toml proxy detection utility

   this phase adds a function to detect whether config.toml currently has model_provider set to the runtime proxy id, independent of state files. this is the foundation for both status reporting and self-healing unbind.

   Task 1: create `isConfigBoundToRuntimeProxy` helper

   add an exported function in lib/runtime/config-toml.ts that takes raw config string and returns boolean indicating whether model_provider equals RUNTIME_ROTATION_PROXY_PROVIDER_ID.

   • use extractTopLevelModelProviderLine (already exists) to get the current provider line
   • parse the value from the line and compare against RUNTIME_ROTATION_PROXY_PROVIDER_ID from lib/runtime-constants.ts
   • return true if match, false otherwise (including when no model_provider line exists)

   Task 2: add fallback restoration function

   extend lib/runtime/config-toml.ts with logic to restore config.toml when no backup exists — strip proxy block and set model_provider = "openai".

   • create restoreConfigTomlFromOrphanedBind(currentConfig: string): string that:
     • calls removeRuntimeRotationProviderBlock to strip the proxy table
     • replaces the proxy model_provider line with model_provider = "openai"
     • calls restoreTopLevelResponseStorage with empty original (removes the forced setting)
   • alternatively, modify restoreTopLevelModelProvider to accept a fallback value parameter when originalConfig has no provider line

   🤖 Prompt for AI agents

   implement two new utilities in `lib/runtime/config-toml.ts`. the goal is
   proxy-provider detection and orphaned-config restoration, both independent of
   state files.
   
   **task 1: `isConfigBoundToRuntimeProxy(configContent: string): boolean`**
   - export this function from `lib/runtime/config-toml.ts`
   - call the existing `extractTopLevelModelProviderLine` helper to pull the
   current provider line from `configContent`
   - parse the value out of the line and compare it strictly against
   `RUNTIME_ROTATION_PROXY_PROVIDER_ID` imported from `lib/runtime-constants.ts`
   - return `true` on match, `false` in all other cases including missing line
   
   **task 2: `restoreConfigTomlFromOrphanedBind(currentConfig: string): string`**
   - export this function from `lib/runtime/config-toml.ts`
   - call `removeRuntimeRotationProviderBlock` to strip the proxy table block from
   the config string
   - replace the proxy `model_provider` line with `model_provider = "openai"`
   - call `restoreTopLevelResponseStorage` with an empty original to remove the
   forced `disable_response_storage` setting
   - alternatively, consider modifying `restoreTopLevelModelProvider` to accept a
   fallback value when `originalConfig` has no provider line — pick whichever
   approach is cleaner given the existing function signatures
   

   Phase 2: extend status and unbind to handle orphaned state

   this phase wires the detection utility into getAppBindStatus and unbindCodexAppRuntimeRotationLocked so they can identify and fix orphaned configs.

   Task 1: extend `AppBindStatus` type with orphaned indicator

   update the AppBindStatus type in lib/runtime/app-bind.ts to include a new field indicating orphaned bind state.

   • add configBound: boolean field — true when config.toml has proxy provider regardless of state files
   • the combination bound: false, configBound: true means orphaned
   • update jsdoc to explain the orphaned scenario

   Task 2: update `getAppBindStatus` to scan config.toml

   modify getAppBindStatus at lib/runtime/app-bind.ts:611 to also read and scan config.toml for proxy provider presence.

   • after reading state files, call readConfigIfExists(paths.configPath)
   • use isConfigBoundToRuntimeProxy on the content to set configBound
   • existing bound field remains state-file based for backward compat
   • callers can now detect !status.bound && status.configBound as orphaned

   Task 3: update `unbindCodexAppRuntimeRotationLocked` for orphaned recovery

   modify the unbind function at lib/runtime/app-bind.ts:751 to restore config.toml even when state files are missing.

   • after existing early checks, add a new branch: if state === null && backup === null, read config.toml
   • if isConfigBoundToRuntimeProxy(configContent) is true, call the new orphan restoration function
   • write restored config via atomicWriteFile
   • return success message like "Restored orphaned Codex app config (no backup available, defaulted to openai)"
   • if config is not bound either, return existing "not configured" message

   Task 4: update `formatAppBindStatus` for orphaned display

   update the status formatter in lib/codex-manager/commands/rotation.ts to display orphaned state clearly.

   • when !status.bound && status.configBound, display: "Codex app bind: orphaned (config bound but state files missing)"
   • suggest running codex-multi-auth rotation unbind-app to fix
   • this gives users a clear signal instead of the misleading "not configured"

   🤖 Prompt for AI agents

   wire the detection and restoration utilities from phase 1 into the status and
   unbind paths. four changes across `lib/runtime/app-bind.ts` and
   `lib/codex-manager/commands/rotation.ts`.
   
   **task 1: extend `AppBindStatus` type in `lib/runtime/app-bind.ts`**
   - add a `configBound: boolean` field to the `AppBindStatus` type
   - update the jsdoc: `bound: false, configBound: true` signals an orphaned bind
   state
   
   **task 2: update `getAppBindStatus` at `lib/runtime/app-bind.ts:611`**
   - after reading state files, call `readConfigIfExists(paths.configPath)` to get
   the raw config content
   - pass the content to `isConfigBoundToRuntimeProxy` (from phase 1) and assign
   the result to `configBound` in the returned status object
   - keep the existing `bound` field purely state-file driven — no backward-compat
   breakage
   
   **task 3: update `unbindCodexAppRuntimeRotationLocked` at
   `lib/runtime/app-bind.ts:751`**
   - after the existing early checks, add a new branch specifically for `state ===
   null && backup === null`
   - within that branch, read config.toml and call `isConfigBoundToRuntimeProxy`
   - if the config is bound, call `restoreConfigTomlFromOrphanedBind` (from phase
   1) and write the result via `atomicWriteFile`
   - return a clear success message: `"Restored orphaned Codex app config (no
   backup available, defaulted to openai)"`
   - if the config is also not bound, fall through to the existing "not configured"
   return
   
   **task 4: update `formatAppBindStatus` in
   `lib/codex-manager/commands/rotation.ts`**
   - add a condition for `!status.bound && status.configBound`
   - display: `"Codex app bind: orphaned (config bound but state files missing)"`
   - append a suggestion to run `codex-multi-auth rotation unbind-app` to recover
   

   Phase 3: tests for orphaned bind scenarios

   add comprehensive test coverage for the orphaned state detection and recovery, following existing patterns in test/app-bind.test.ts.

   Task 1: test `isConfigBoundToRuntimeProxy` detection

   add unit tests in test/config-toml-restore.test.ts or new test/config-toml-detection.test.ts for the detection helper.

   • test returns true when model_provider = "codex-multi-auth-runtime-proxy" present
   • test returns false when model_provider = "openai" or other value
   • test returns false when no model_provider line exists
   • test handles quoted/unquoted values, whitespace variations

   Task 2: test orphan restoration function

   add unit tests for the fallback restoration when no backup exists.

   • test that proxy block is removed
   • test that model_provider is set to "openai"
   • test that disable_response_storage forced setting is removed
   • test preserves other unrelated config sections

   Task 3: test `getAppBindStatus` orphaned detection

   add integration tests in test/app-bind.test.ts for orphaned state detection.

   • set up temp dir with config.toml containing proxy provider but NO state files in app-bind/
   • call getAppBindStatus and assert bound: false, configBound: true
   • test normal bound state still reports bound: true, configBound: true
   • test clean state reports bound: false, configBound: false

   Task 4: test `unbindCodexAppRuntimeRotation` orphan recovery

   add integration tests for unbind self-healing in test/app-bind.test.ts.

   • seed config.toml with proxy provider, NO state files
   • call unbindCodexAppRuntimeRotation
   • assert config.toml now has model_provider = "openai" and no proxy block
   • assert result message indicates orphan recovery
   • test on windows (important: windows file handles may behave differently on atomic writes)

   Task 5: test `formatAppBindStatus` orphaned output

   add test in test/codex-manager-rotation-command.test.ts for orphaned status display.

   • mock getAppBindStatus returning { bound: false, configBound: true, ... }
   • assert output contains "orphaned" indicator
   • assert output suggests unbind-app fix

   🤖 Prompt for AI agents

   add test coverage for all orphaned-bind scenarios. follow existing patterns in
   `test/app-bind.test.ts`.
   
   **task 1: detection unit tests — `test/config-toml-detection.test.ts` (or
   `test/config-toml-restore.test.ts`)**
   - test `isConfigBoundToRuntimeProxy` returns `true` when `model_provider =
   "codex-multi-auth-runtime-proxy"` is present
   - test returns `false` for `model_provider = "openai"` or any other provider
   - test returns `false` when no `model_provider` line exists
   - cover quoted/unquoted values and whitespace variations — these are easy to
   miss
   
   **task 2: restoration unit tests — same file as above**
   - test `restoreConfigTomlFromOrphanedBind` removes the proxy block entirely
   - test `model_provider` is set to `"openai"` in the output
   - test `disable_response_storage` forced setting is gone
   - test that unrelated config sections are preserved verbatim
   
   **task 3: `getAppBindStatus` integration tests — `test/app-bind.test.ts`**
   - set up a temp dir with a config.toml containing the proxy provider but no
   state files under `app-bind/`
   - assert `getAppBindStatus` returns `{ bound: false, configBound: true }`
   - also cover the normal bound case (`bound: true, configBound: true`) and clean
   state (`bound: false, configBound: false`)
   
   **task 4: `unbindCodexAppRuntimeRotation` recovery integration tests —
   `test/app-bind.test.ts`**
   - seed config.toml with the proxy provider and no state files
   - call `unbindCodexAppRuntimeRotation` and assert config.toml is rewritten with
   `model_provider = "openai"` and no proxy block
   - assert the returned message signals orphan recovery
   - flag windows explicitly: test atomic write behavior on windows — file handle
   semantics differ and `atomicWriteFile` must be verified to not leave partial
   state
   
   **task 5: `formatAppBindStatus` display tests —
   `test/codex-manager-rotation-command.test.ts`**
   - mock `getAppBindStatus` to return `{ bound: false, configBound: true, ... }`
   - assert the formatted output contains "orphaned"
   - assert the output suggests running `codex-multi-auth rotation unbind-app`
   

   Research

   the app-bind subsystem lives in lib/runtime/app-bind.ts with state files under ~/.codex/multi-auth/app-bind/. getAppBindStatus at lib/runtime/app-bind.ts:611 reads only runtime-rotation-app-bind.json to determine bound. unbindCodexAppRuntimeRotationLocked at lib/runtime/app-bind.ts:751 keys restoration off statePath/backupPath — when both are missing it early-returns "not configured" without inspecting config.toml. toml manipulation happens in lib/runtime/config-toml.ts with restoreConfigTomlFromRuntimeRotationProvider capable of stripping the proxy block even without a backup. the provider id constant is RUNTIME_ROTATION_PROXY_PROVIDER_ID = "codex-multi-auth-runtime-proxy" in lib/runtime-constants.ts.

   ---

   🚀 Next Steps

   🤖 All AI agent prompts combined

   Task: 1
   
   implement two new utilities in `lib/runtime/config-toml.ts`. the goal is
   proxy-provider detection and orphaned-config restoration, both independent of
   state files.
   
   **task 1: `isConfigBoundToRuntimeProxy(configContent: string): boolean`**
   - export this function from `lib/runtime/config-toml.ts`
   - call the existing `extractTopLevelModelProviderLine` helper to pull the
   current provider line from `configContent`
   - parse the value out of the line and compare it strictly against
   `RUNTIME_ROTATION_PROXY_PROVIDER_ID` imported from `lib/runtime-constants.ts`
   - return `true` on match, `false` in all other cases including missing line
   
   **task 2: `restoreConfigTomlFromOrphanedBind(currentConfig: string): string`**
   - export this function from `lib/runtime/config-toml.ts`
   - call `removeRuntimeRotationProviderBlock` to strip the proxy table block from
   the config string
   - replace the proxy `model_provider` line with `model_provider = "openai"`
   - call `restoreTopLevelResponseStorage` with an empty original to remove the
   forced `disable_response_storage` setting
   - alternatively, consider modifying `restoreTopLevelModelProvider` to accept a
   fallback value when `originalConfig` has no provider line — pick whichever
   approach is cleaner given the existing function signatures
   ===============================================================================
   
   Task: 2
   
   wire the detection and restoration utilities from phase 1 into the status and
   unbind paths. four changes across `lib/runtime/app-bind.ts` and
   `lib/codex-manager/commands/rotation.ts`.
   
   **task 1: extend `AppBindStatus` type in `lib/runtime/app-bind.ts`**
   - add a `configBound: boolean` field to the `AppBindStatus` type
   - update the jsdoc: `bound: false, configBound: true` signals an orphaned bind
   state
   
   **task 2: update `getAppBindStatus` at `lib/runtime/app-bind.ts:611`**
   - after reading state files, call `readConfigIfExists(paths.configPath)` to get
   the raw config content
   - pass the content to `isConfigBoundToRuntimeProxy` (from phase 1) and assign
   the result to `configBound` in the returned status object
   - keep the existing `bound` field purely state-file driven — no backward-compat
   breakage
   
   **task 3: update `unbindCodexAppRuntimeRotationLocked` at
   `lib/runtime/app-bind.ts:751`**
   - after the existing early checks, add a new branch specifically for `state ===
   null && backup === null`
   - within that branch, read config.toml and call `isConfigBoundToRuntimeProxy`
   - if the config is bound, call `restoreConfigTomlFromOrphanedBind` (from phase
   1) and write the result via `atomicWriteFile`
   - return a clear success message: `"Restored orphaned Codex app config (no
   backup available, defaulted to openai)"`
   - if the config is also not bound, fall through to the existing "not configured"
   return
   
   **task 4: update `formatAppBindStatus` in
   `lib/codex-manager/commands/rotation.ts`**
   - add a condition for `!status.bound && status.configBound`
   - display: `"Codex app bind: orphaned (config bound but state files missing)"`
   - append a suggestion to run `codex-multi-auth rotation unbind-app` to recover
   ===============================================================================
   
   Task: 3
   
   add test coverage for all orphaned-bind scenarios. follow existing patterns in
   `test/app-bind.test.ts`.
   
   **task 1: detection unit tests — `test/config-toml-detection.test.ts` (or
   `test/config-toml-restore.test.ts`)**
   - test `isConfigBoundToRuntimeProxy` returns `true` when `model_provider =
   "codex-multi-auth-runtime-proxy"` is present
   - test returns `false` for `model_provider = "openai"` or any other provider
   - test returns `false` when no `model_provider` line exists
   - cover quoted/unquoted values and whitespace variations — these are easy to
   miss
   
   **task 2: restoration unit tests — same file as above**
   - test `restoreConfigTomlFromOrphanedBind` removes the proxy block entirely
   - test `model_provider` is set to `"openai"` in the output
   - test `disable_response_storage` forced setting is gone
   - test that unrelated config sections are preserved verbatim
   
   **task 3: `getAppBindStatus` integration tests — `test/app-bind.test.ts`**
   - set up a temp dir with a config.toml containing the proxy provider but no
   state files under `app-bind/`
   - assert `getAppBindStatus` returns `{ bound: false, configBound: true }`
   - also cover the normal bound case (`bound: true, configBound: true`) and clean
   state (`bound: false, configBound: false`)
   
   **task 4: `unbindCodexAppRuntimeRotation` recovery integration tests —
   `test/app-bind.test.ts`**
   - seed config.toml with the proxy provider and no state files
   - call `unbindCodexAppRuntimeRotation` and assert config.toml is rewritten with
   `model_provider = "openai"` and no proxy block
   - assert the returned message signals orphan recovery
   - flag windows explicitly: test atomic write behavior on windows — file handle
   semantics differ and `atomicWriteFile` must be verified to not leave partial
   state
   
   **task 5: `formatAppBindStatus` display tests —
   `test/codex-manager-rotation-command.test.ts`**
   - mock `getAppBindStatus` to return `{ bound: false, configBound: true, ... }`
   - assert the formatted output contains "orphaned"
   - assert the output suggests running `codex-multi-auth rotation unbind-app`
   

   💡 Iterate on the plan with: `@coderabbitai` <feedback>

   Example Feedback
   - `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
   - `@coderabbitai` For design choice 1 go ahead with option 3 and replan.
   

   ---

   💬 Have feedback or questions? Drop into our discord!
6. coderabbitai commented on Jun 16, 2026

   

   coderabbitaiBot

   on Jun 16, 2026 – with coderabbitai

   Contributor

   More actions

   🔗 Related PRs

   #439 - Enable runtime rotation and auto-update by default [merged]
   #460 - Fix app bind history repair [merged]
   #462 - Fix Codex TUI goal proxy handling [merged]
   #485 - fix: preserve hook trust in runtime shadows [merged]
   #607 - fix(rotation): break stale-recovery deadlock on transient account state [merged]

   ---

   📝 Issue Planner

   _{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

   • Create Plan

   ---

   🧪 Issue enrichment is currently in open beta.

   To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

   issue_enrichment:
     auto_enrich:
       enabled: false

   💬 Have feedback or questions? Drop into our discord!
7. ndycode

   added 3 commits that reference this issue on Jun 16, 2026

   test(app-bind): add integration coverage for half-orphan unbind (#614)

   ...

   cd4c5d7

   test(app-bind): assert disable_response_storage cleanup in orphan unb…

   ...

   a490274

   fix(app-bind): self-heal orphaned runtime-proxy bind with no backup (#…

   ...

   cd1a700
8. ndycode

   closed this as completedin #615on Jun 16, 2026
9. ndycode

   added a commit that references this issue on Jun 16, 2026

   chore(release): cut v2.3.2

   ...

   fa9bde3