From 7b153c5aa9c89c474f7905ba9fc5e360cc9b9290 Mon Sep 17 00:00:00 2001
From: chengyongru <chengyongru.ai@gmail.com>
Date: Thu, 18 Jun 2026 16:57:53 +0800
Subject: [PATCH] Avoid refreshing Codex token in settings

---
 nanobot/webui/settings_api.py    | 11 ++++++++---
 tests/webui/test_settings_api.py | 28 +++++++++++++---------------
 2 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/nanobot/webui/settings_api.py b/nanobot/webui/settings_api.py
index 51cd9797..afce1452 100644
--- a/nanobot/webui/settings_api.py
+++ b/nanobot/webui/settings_api.py
@@ -283,7 +283,8 @@ def _oauth_provider_status(spec: Any) -> dict[str, Any]:
 
     if spec.name == "openai_codex":
         try:
-            from oauth_cli_kit import get_token as get_codex_token
+            from oauth_cli_kit.providers import OPENAI_CODEX_PROVIDER
+            from oauth_cli_kit.storage import FileTokenStorage
         except Exception:
             return {
                 "configured": False,
@@ -293,10 +294,14 @@ def _oauth_provider_status(spec: Any) -> dict[str, Any]:
             }
         token = None
         with suppress(Exception):
-            token = get_codex_token()
+            token = FileTokenStorage(
+                token_filename=OPENAI_CODEX_PROVIDER.token_filename,
+            ).load()
         expires_at = getattr(token, "expires", None) if token else None
         return {
-            "configured": bool(token and token.access),
+            "configured": bool(
+                token and token.access and expires_at and expires_at > int(time.time() * 1000)
+            ),
             "account": getattr(token, "account_id", None) if token else None,
             "expires_at": expires_at,
             "login_supported": True,
diff --git a/tests/webui/test_settings_api.py b/tests/webui/test_settings_api.py
index f001f657..eccdaa85 100644
--- a/tests/webui/test_settings_api.py
+++ b/tests/webui/test_settings_api.py
@@ -788,19 +788,17 @@ def test_update_network_safety_settings_default_access_is_webui_only(
 def test_openai_codex_oauth_status_uses_available_token(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    def fake_get_token():
-        return type(
-            "Token",
-            (),
-            {
-                "access": "access-token",
-                "refresh": "refresh-token",
-                "expires": 2_000_000_000_000,
-                "account_id": "acct-codex",
-            },
-        )()
-
-    monkeypatch.setattr("oauth_cli_kit.get_token", fake_get_token)
+    token = type(
+        "Token",
+        (),
+        {
+            "access": "access-token",
+            "refresh": "refresh-token",
+            "expires": 2_000_000_000_000,
+            "account_id": "acct-codex",
+        },
+    )()
+    monkeypatch.setattr("oauth_cli_kit.storage.FileTokenStorage.load", lambda _self: token)
 
     status = _oauth_provider_status(find_by_name("openai_codex"))
 
@@ -811,10 +809,10 @@ def test_openai_codex_oauth_status_uses_available_token(
 def test_openai_codex_oauth_status_rejects_unavailable_token(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    def fake_get_token():
+    def fake_load(_self):
         raise RuntimeError("refresh failed")
 
-    monkeypatch.setattr("oauth_cli_kit.get_token", fake_get_token)
+    monkeypatch.setattr("oauth_cli_kit.storage.FileTokenStorage.load", fake_load)
 
     status = _oauth_provider_status(find_by_name("openai_codex"))