fix(codex): fence device reauth cancellation

[luvs01]

Motivation

• Prevent a race where a cancelled native-main device reauth flow could still complete its credential commit and replace auth.json, clearing the reauth quarantine.
• Ensure cancellation is a true publication fence by propagating the flow's AbortSignal into the prepared commit and exclusive claim so in-flight commits observe aborts.

Description

• Propagate cancellation: extend the prepared commit signature to accept an options?: { signal?: AbortSignal } parameter and pass the flow's AbortSignal through to the commit call path and to withNativeMainExclusiveClaim in src/codex/main-account.ts.
• Fence publication: pass the flow signal into flow.prepared.commit(...) from src/codex/main-device-reauth.ts and recheck cancellation immediately before and after claim acquisition so a cancelled flow cannot proceed to write auth.json or clear quarantine.
• Make terminal settlements first-write-wins: tighten finish(...) so an already-terminal flow cannot be overwritten by a later succeeded result, preventing a cancelled terminal from being replaced by success.
• Tests and docs: add/adjust integration tests in tests/codex-integration/main-device-reauth.test.ts to cover cancelling a commit-in-flight and a pre-aborted production commit, and update structure/codex-home.md to document the cancellation fencing guarantee.

Testing

• Ran bun test tests/codex-integration/main-device-reauth.test.ts tests/codex-integration/main-device-reauth-api.test.ts and the focused suites passed (24 tests, all green).
• Ran bun run typecheck, bun run structure:check, and bun run privacy:scan and each check completed successfully.
• Attempted bun run test:changed but it could not run in this checkout because no resolvable dev comparison ref was available in this environment.
• Ran the full bun run test; the changed reauth tests passed but the full-suite run returned nonzero due to unrelated, environment-sensitive failures in tests/server/api-catalog-route.test.ts and tests/codex-integration/codex-shim.test.ts, which are not caused by these changes.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c6438c79-37f8-4800-945d-f128292d6ba2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T06:27:14.445777Z	31b435e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 31b435efbf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update every mapped structure document

This changes the src/codex/ authentication contract, but the commit updates only structure/codex-home.md; structure/INDEX.md:104 also maps this area to runtime.md, config.md, catalog.md, subagents.md, providers/openai-tiers.md, gui-and-management-api.md, and ops/docs-and-release.md. Reconcile the cancellation contract across every mapped document in this change as required by the repository's source-to-doc ownership rule.

AGENTS.md reference: src/AGENTS.md:L10-L11

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Document the new cancellation semantics

Passing the flow signal into the commit changes user-visible behavior for ocx account main reauth cancel and DELETE /api/codex-auth/main/reauth-device: cancellation while waiting to publish now fences the credential write instead of allowing eventual success. Update the English CLI/management documentation to describe that guarantee and ensure the localized pages do not contradict it.

AGENTS.md reference: AGENTS.md:L380-L381

Useful? React with 👍 / 👎.