Skip to content

[WRONG BRANCH] fix(oauth): treat zero auto-switch threshold as disabled for generic fill-first routing - #511

Draft
luvs01 wants to merge 27 commits into
devfrom
codex/fix-oauth-account-switching-vulnerability
Draft

luvs01 wants to merge 27 commits into
devfrom
codex/fix-oauth-account-switching-vulnerability

Conversation

@luvs01

@luvs01 luvs01 commented Sep 14, 2026

Copy link
Copy Markdown
Owner

Motivation

  • Prevent proactive account rotation when a generic OAuth provider's autoSwitchThreshold is explicitly set to 0, which previously evaluated as exceeded and could move requests and billing to another pooled account.
  • Preserve the established invariant that 0 = disabled for usage-driven auto-switching while leaving reactive recovery (429/401 driven) unchanged.

Description

  • Add a non-positive guard in isOverAutoSwitchThreshold so threshold <= 0 always returns false, disabling proactive switching when the stored threshold is non-positive (src/oauth/generic-account-failover.ts).
  • Update CLI status logic to treat a stored zero threshold as off when the pool is live and to render a clearer human reason for the off state (src/cli/account-extended.ts).
  • Add focused regression tests that assert fill-first holds the active account when autoSwitchThreshold is 0 and that the CLI status JSON reports a zero threshold as disabled (tests/oauth/generic-oauth-failover.test.ts, tests/cli/cli-account-pool-verbs.test.ts).
  • Update structure docs to record the invariant and the behavior change for maintainers (structure/config.md, structure/transports/inventory.md, structure/runtime.md).

Testing

  • Ran the focused routing test: ./node_modules/bun/bin/bun.exe test tests/oauth/generic-oauth-failover.test.ts, and the suite covering the new regressions passed (44 tests passed for that file).
  • Ran the focused CLI tests: ./node_modules/bun/bin/bun.exe test tests/cli/cli-account-pool-verbs.test.ts, and the CLI-focused tests passed (30 tests passed for that file).
  • Ran bun run typecheck and bun run privacy:scan (via the pinned Bun) and both succeeded.
  • Ran bun run structure:check and it passed to keep structure/ docs in sync.
  • Note: a repository-wide bun run test in the current container encountered unrelated environment/system-level failures (external fixtures and environment-generated 403 responses); the focused tests and gates relevant to this change are green.

Codex Task

lidge-jun and others added 27 commits September 6, 2026 01:08
…43-01a07240

[WRONG BRANCH] chore(release): promote verified candidate to 2.43.0
…in-07c0

chore(release): promote validated 2.44.0 to main
Promote frozen dev source cf9f662; no new runtime changes. Candidate CI34061274315 and service34061276621 are the validation references. Publication waits for successful validation and the final main push CI at the exact release SHA.
Promote frozen dev source cf9f662 as 2.45.0.

The repository owner explicitly authorized this main/preview release promotion and admin PR-only merge. This is a release-specific owner decision, not an independent approval or the dev-only maintainer exception.

Frozen candidate full CI34061274315 passed all25jobs after one unchanged-source rerun of Windows5; the initial holder busy assertion remains recorded without a root-cause resolution claim. Service lifecycle34061276621 passed Linux/macOS/Windows. Dev version pre-move3812 is merged. Publication still requires this actual main merge SHA's own successful push CI and Service lifecycle. No local suites were run.
[WRONG BRANCH] chore(release): promote verified 2.46.0 to main
[WRONG BRANCH] release: promote 2.47.0 to main
[WRONG BRANCH] release: apply final roster correction to main
[WRONG BRANCH] release: promote 2.48.0 to main
…in-01a08498

release: promote verified 2.49.0 product tree to main
Promotes the audited freeze SHA 12c248f unchanged. The resulting tree is byte-identical to that commit's tree, d8f5a71, so what ships is exactly what the six-lane regression audit read.
…in-01a08a81

[WRONG BRANCH] release: promote verified 2.50.0 product tree to main
[WRONG BRANCH] release: promote verified 2.51.0 product tree to main
Product tree is dev at 7bfb2ad. Only package.json differs, carrying the
stable channel version 2.52.0.

This promotion follows a CI repair and a regression sweep: dev had drifted 79
commits past its last finished run and the one run allowed to complete had
failed. lidge-jun#4390 fixed an integration test that never denied anything and had been
red on dev since lidge-jun#4342; lidge-jun#4396/lidge-jun#4397/lidge-jun#4398 closed four gaps in the quota
avoidance contract lidge-jun#4368 introduced; lidge-jun#4403 made a port fixture deterministic.
release: promote verified 2.52.0 product tree to main
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c76abea7-41cd-4c29-bee0-65591ec14739


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 14, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-14T00:23:08.932320Z 6f5554c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@github-actions

Copy link
Copy Markdown

Deterministic PR hygiene checks passed.

@luvs01
luvs01 changed the base branch from main to Dev September 14, 2026 00:22

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f5554c709

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +406 to +408
// A positive stored threshold only steers selection once the pool consumes it, which is
// exactly what `inert: false` reports. Zero remains the explicit disabled value.
const enabled = inert === false && storedThreshold !== null && storedThreshold > 0;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update every structure document mapped to src/cli

This changes src/cli/, but structure/manifest.json also maps that area to structure/clients/claude-desktop.md and structure/ops/docs-and-release.md, neither of which is updated by this commit. Synchronize those mapped owners with the new zero-threshold CLI contract, or correct the ownership map if they no longer describe this area.

AGENTS.md reference: src/AGENTS.md:L10-L11

Useful? React with 👍 / 👎.

* quota-less provider off its active account on the very first request.
*/
function isOverAutoSwitchThreshold(providerName: string, accountId: string, threshold: number): boolean {
if (threshold <= 0) return false;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Document zero as the disabled generic threshold

With this guard, the public configuration reference is now contradictory: docs-site/src/content/docs/reference/configuration/providers.md:573 still defines the full 0–100 range as the usage percentage at which fill-first advances, which makes zero read as immediate rotation rather than disabled, and the CLI reference still says inert: false means the threshold is being applied. Update the English references and translations to state that zero disables usage-based generic fill-first switching while reactive recovery remains active.

AGENTS.md reference: AGENTS.md:L380-L381

Useful? React with 👍 / 👎.

@github-actions github-actions Bot added the bug Something isn't working label Sep 14, 2026
@github-actions github-actions Bot changed the title fix(oauth): treat zero auto-switch threshold as disabled for generic fill-first routing [WRONG BRANCH] fix(oauth): treat zero auto-switch threshold as disabled for generic fill-first routing Sep 14, 2026
@github-actions

Copy link
Copy Markdown

⏳ DRAFT

  • wrong target branch (Dev); retarget to dev. UI screenshot required.

What to do

  • Retarget this PR to dev — all contributions go to dev.
  • Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aardvark bug Something isn't working codex

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants