Add re-authenticate actions for Codex/Kiro, and a background-repair toggle for Claude#2340
Add re-authenticate actions for Codex/Kiro, and a background-repair toggle for Claude#2340Vit129 wants to merge 3 commits into
Conversation
Previously the only way to change claudeOAuthKeychainPromptMode away from onlyOnUserAction was a defaults write — users hitting "background repair is suppressed... Click Refresh" had no in-app way to opt into always-on background repair. Adds a Privacy-section toggle in Advanced settings wrapping the existing mode as a simple on/off (always vs onlyOnUserAction), leaving the never/prompt-free path untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HzWPve8BJ9KqMcSBiGXzPN
Codex had no settings action to recover from an expired OAuth token
short of running \`codex login\` manually in a terminal. Adds a
settingsActions entry (same pattern already used by Antigravity's
"Login with Google" button) that calls the existing runLoginFlow ->
CodexLoginRunner -> \`codex login\` subprocess path.
Antigravity already exposes an equivalent button ("Login with Google" /
"Add Google Account" in Settings > Antigravity > Connection) wired to a
real browser OAuth flow via AntigravityLoginRunner — no change needed
there. Kiro has no CLI login/auth surface in its \`kiro\` binary
(confirmed via \`kiro --help\`: file/diff/chat/tunnel commands only, no
login or auth subcommand), so no button was added for it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HzWPve8BJ9KqMcSBiGXzPN
Earlier claim that Kiro has no CLI login was wrong — it was tested against \`kiro\` (the editor launcher), not \`kiro-cli\` (a separate binary at ~/.local/bin/kiro-cli). \`kiro-cli login\` opens a real browser OAuth flow and blocks until it completes, same shape as \`codex login\`. Adds BinaryLocator.resolveKiroCLIBinary (mirrors resolveAntigravityBinary) and KiroLoginRunner (mirrors CodexLoginRunner's subprocess-lifecycle handling) to wire a settingsActions "Re-authenticate" button through the existing runLoginFlow -> StatusItemController path already used by Codex and Antigravity. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HzWPve8BJ9KqMcSBiGXzPN
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 883624f090
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| stdoutCapture.start() | ||
| stderrCapture.start() | ||
|
|
||
| let timedOut = await self.wait(timeout: timeout, termination: termination) |
There was a problem hiding this comment.
When kiro-cli login uses device flow (the documented fallback for remote/browser-doesn't-open cases, where it prints a device code/URL and then polls), this waits for the subprocess to exit or hit the 120s timeout before combinedOutput is ever shown to the user. In that scenario the user never sees the code while the CLI is still polling, so the new Re-authenticate action times out and kills the login instead of letting them complete it; stream/detect the URL as it appears or run the login in a terminal/PTY.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Codex review: needs real behavior proof before merge. Reviewed July 19, 2026, 12:48 PM ET / 16:48 UTC. Summary Reproducibility: yes. source-reproducible: invoke the Kiro Settings action where Review metrics: 1 noteworthy metric.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review findings
Review detailsBest possible solution: Run interactive Kiro login through a PTY or visible Terminal-style flow that exposes device instructions while polling, then add focused runner tests and redacted runtime proof for Kiro, Codex, and the Claude toggle. Do we have a high-confidence way to reproduce the issue? Yes, source-reproducible: invoke the Kiro Settings action where Is this the best way to solve the issue? No. Reusing the existing subprocess shape is not sufficient for Kiro’s interactive device flow; a PTY or visible streaming/terminal presentation is the narrower reliable solution. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 3b4d9a85cbec. Label changesLabel changes:
Label justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
1 participant
Summary
claudeOAuthKeychainPromptModeisonlyOnUserAction(the default) and the token expires.runLoginFlow->CodexLoginRunner->codex loginpath already used elsewhere (e.g. Switch Account). Previously the only recovery from an expired Codex OAuth token was runningcodex loginmanually in a terminal.KiroLoginRunnerthat spawnskiro-cli login(mirrorsCodexLoginRunner's subprocess-lifecycle handling) and a newBinaryLocator.resolveKiroCLIBinary(mirrorsresolveAntigravityBinary). Antigravity already has an equivalent flow ("Login with Google"); this brings Codex and Kiro to parity with it.Test plan
swift build --product CodexBar -c debugsucceedsclaudeOAuthKeychainPromptModebetweenonlyOnUserActionandalways