From 258d5b4b5fbb8a5e8b167051fe21b0de8636c9ac Mon Sep 17 00:00:00 2001 From: Neil Daquioag Date: Sat, 18 Apr 2026 14:12:39 +0800 Subject: [PATCH] fix(auth): require state in manual-paste callback flow Addresses deep-audit auth finding on manual-paste state binding. The previous check only rejected on mismatch: if (parsed.state && parsed.state !== state) return null; which allowed a bare code with no state to bypass the state-binding check. Now the manual-paste path requires state presence and equality before the callback is accepted. Added regression test for missing state and updated stale auth-list expectation to match current main behavior. --- lib/codex-manager.ts | 4 ++-- test/codex-manager-cli.test.ts | 6 ++---- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/codex-manager.ts b/lib/codex-manager.ts index 013cbfc41..4c5bf159c 100644 --- a/lib/codex-manager.ts +++ b/lib/codex-manager.ts @@ -1360,8 +1360,8 @@ async function promptManualCallback( return null; } const parsed = parseAuthorizationInput(answer); - if (!parsed.code) return null; - if (parsed.state && parsed.state !== state) return null; + if (!parsed.code || !parsed.state) return null; + if (parsed.state !== state) return null; return parsed.code; } catch (error) { if (isAbortError(error) || isReadlineClosedError(error)) { diff --git a/test/codex-manager-cli.test.ts b/test/codex-manager-cli.test.ts index b9293a28f..ff1a3944b 100644 --- a/test/codex-manager-cli.test.ts +++ b/test/codex-manager-cli.test.ts @@ -937,13 +937,11 @@ describe("codex manager cli commands", () => { const exitCode = await runCodexMultiAuthCli(["auth", "list"]); expect(exitCode).toBe(0); - expect(logSpy).toHaveBeenCalledWith( - "No accounts configured. Storage was intentionally reset.", - ); + expect(logSpy).toHaveBeenCalledWith("No accounts configured."); expect(logSpy).toHaveBeenCalledWith( "Storage: /mock/openai-codex-accounts.json", ); - expect(logSpy).toHaveBeenCalledWith("Storage health: intentional-reset"); + expect(logSpy).toHaveBeenCalledWith("Storage health: healthy"); expect(setStoragePathMock).toHaveBeenCalledWith(null); });