Add server auth sync and refresh OAuth tokens

Author: lawrencecchen

README.md

@@ -156,6 +156,8 @@ It does not edit Codex config or set auth environment variables. Do not set a du
 
 Override the subrouter URL with `SUBROUTER_CODEX_BASE_URL` if needed. See [docs/codex.md](docs/codex.md) for details and the custom-provider fallback.
 
+If `SUBROUTER_CODEX_BASE_URL` is not set, the wrapper uses local `127.0.0.1:31415` when it is a healthy Subrouter. If that local listener is missing or stale and exactly one server is configured with `sr server add`, `sr codex` uses that server instead.
+
 Set `SUBROUTER_CODEX_USER_EMAIL` to attribute Codex traffic to a teammate:
 
 ```bash
@@ -179,6 +181,20 @@ Subrouter has a native Go implementation of the Codex account manager. It reads
 ~/.codex-accounts/accounts/*.json
 ```
 
+Server-owned OAuth accounts must be created with fresh logins because Codex refresh tokens rotate. Do not copy local OAuth account files to a server. To compare local OAuth emails with a configured server and reauth missing accounts on the server, run:
+
+```bash
+sr server sync community --device-auth
+```
+
+To only show the diff:
+
+```bash
+sr server diff community
+```
+
+Use `--email you@example.com` to reauth one local email, or `--all` to replace every local OAuth email on the server with a new server-owned refresh-token chain.
+
 Account-management commands are built into the `subrouter` binary:
 
 ```bash

cmd/subrouter/codex.go

@@ -3,18 +3,25 @@ package main
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"os"
 	"os/exec"
 	"strconv"
 	"strings"
+	"time"
 
+	"github.com/manaflow-ai/subrouter/internal/accounts"
 	"github.com/manaflow-ai/subrouter/internal/session"
 )
 
 const defaultCodexBaseURL = "http://127.0.0.1:31415/v1"
+const defaultSubrouterHealthURL = "http://127.0.0.1:31415/_subrouter/health"
 
 func codex(args []string) error {
-	baseURL := envOrDefault("SUBROUTER_CODEX_BASE_URL", defaultCodexBaseURL)
+	baseURL := os.Getenv("SUBROUTER_CODEX_BASE_URL")
+	if baseURL == "" {
+		baseURL = defaultCodexBaseURLFor(defaultSubrouterHealthURL, defaultCXServerStore(accounts.DefaultCodexStore()), &http.Client{Timeout: 500 * time.Millisecond})
+	}
 	bin := envOrDefault("SUBROUTER_CODEX_BIN", "codex")
 	userEmailRaw := os.Getenv("SUBROUTER_CODEX_USER_EMAIL")
 	accountID := session.NormalizeAccountID(os.Getenv("SUBROUTER_CODEX_ACCOUNT_ID"))
@@ -38,6 +45,41 @@ func codex(args []string) error {
 	return cmd.Run()
 }
 
+func defaultCodexBaseURLFor(localHealthURL string, store cxServerStore, client *http.Client) string {
+	if subrouterHealthOK(localHealthURL, client) {
+		return defaultCodexBaseURL
+	}
+	file, err := store.load()
+	if err != nil || len(file.Servers) != 1 {
+		return defaultCodexBaseURL
+	}
+	return codexBaseURLForServer(file.Servers[0])
+}
+
+func subrouterHealthOK(healthURL string, client *http.Client) bool {
+	if client == nil {
+		client = &http.Client{Timeout: 500 * time.Millisecond}
+	}
+	req, err := http.NewRequest(http.MethodGet, healthURL, nil)
+	if err != nil {
+		return false
+	}
+	res, err := client.Do(req)
+	if err != nil {
+		return false
+	}
+	defer res.Body.Close()
+	return res.StatusCode >= 200 && res.StatusCode < 300
+}
+
+func codexBaseURLForServer(server cxServerConfig) string {
+	baseURL := strings.TrimRight(server.URL, "/")
+	if strings.HasSuffix(baseURL, "/v1") {
+		return baseURL
+	}
+	return baseURL + "/v1"
+}
+
 func codexArgs(args []string, baseURL, userEmail, accountID string) []string {
 	configArgs := codexConfigArgs(baseURL, userEmail, accountID)
 	if len(args) == 0 || strings.HasPrefix(args[0], "-") || !isKnownCodexCommand(args[0]) {

cmd/subrouter/codex_test.go

@@ -1,6 +1,9 @@
 package main
 
 import (
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
 	"strings"
 	"testing"
 )
@@ -13,6 +16,63 @@ func TestCodexArgsInjectsSubrouterBaseURLAsGlobalConfig(t *testing.T) {
 	}
 }
 
+func TestDefaultCodexBaseURLUsesConfiguredServerWhenLocalHealthFails(t *testing.T) {
+	local := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "old gateway", http.StatusForbidden)
+	}))
+	t.Cleanup(local.Close)
+	store := cxServerStore{Path: filepath.Join(t.TempDir(), "servers.json")}
+	if err := store.save(cxServerFile{Servers: []cxServerConfig{{
+		Name: "community",
+		URL:  "http://100.99.8.37:31415",
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+
+	got := defaultCodexBaseURLFor(local.URL+"/_subrouter/health", store, local.Client())
+	if got != "http://100.99.8.37:31415/v1" {
+		t.Fatalf("base URL = %q", got)
+	}
+}
+
+func TestDefaultCodexBaseURLKeepsLocalWhenLocalHealthWorks(t *testing.T) {
+	local := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(local.Close)
+	store := cxServerStore{Path: filepath.Join(t.TempDir(), "servers.json")}
+	if err := store.save(cxServerFile{Servers: []cxServerConfig{{
+		Name: "community",
+		URL:  "http://100.99.8.37:31415",
+	}}}); err != nil {
+		t.Fatal(err)
+	}
+
+	got := defaultCodexBaseURLFor(local.URL+"/_subrouter/health", store, local.Client())
+	if got != defaultCodexBaseURL {
+		t.Fatalf("base URL = %q, want %q", got, defaultCodexBaseURL)
+	}
+}
+
+func TestDefaultCodexBaseURLDoesNotGuessWhenMultipleServersAreConfigured(t *testing.T) {
+	local := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "old gateway", http.StatusForbidden)
+	}))
+	t.Cleanup(local.Close)
+	store := cxServerStore{Path: filepath.Join(t.TempDir(), "servers.json")}
+	if err := store.save(cxServerFile{Servers: []cxServerConfig{
+		{Name: "community", URL: "http://100.99.8.37:31415"},
+		{Name: "other", URL: "http://100.99.8.38:31415"},
+	}}); err != nil {
+		t.Fatal(err)
+	}
+
+	got := defaultCodexBaseURLFor(local.URL+"/_subrouter/health", store, local.Client())
+	if got != defaultCodexBaseURL {
+		t.Fatalf("base URL = %q, want %q", got, defaultCodexBaseURL)
+	}
+}
+
 func TestCodexArgsWorksWithoutSubcommand(t *testing.T) {
 	got := codexArgs(nil, "http://127.0.0.1:31415/v1", "", "")
 	want := []string{"-c", `openai_base_url="http://127.0.0.1:31415/v1"`}

cmd/subrouter/cx.go

@@ -55,6 +55,7 @@ Usage:
   cx server add <name> --url <url> --gcp-instance <name> --gcp-zone <zone> [--gcp-project <project>]
   cx server install <name>
   cx server login <name> [--device-auth]
+  cx server sync <name> [--device-auth]
 
   cx admin-keys         List stored OpenAI admin keys
   cx add-admin-key      Add an sk-admin-* key