$ the-wire · showcase
Codex TUI and openai-node fix stale state and timers
By RepoJournal · Filed · About OpenAI
The Codex TUI now trusts server metadata over local config for sessions and providers, and openai-node hones its OAuth and zod tooling for correctness.
The Codex TUI stops trusting local state it no longer owns. `/status` now displays the server-reported model provider ID instead of local provider names and base URLs, and the provider row is omitted until a thread configures one [1]. Fresh startup loads `model` and `model_reasoning_effort` through `config/read` before `thread/start`, using server defaults instead of possibly stale client settings [2]. Session restoration now carries the working directory from `thread/list` and `thread/read`, using app-server metadata for resume and fork directories, and helper reads of rollout files and the state database are gone [3]. "Use app-server metadata for TUI session restoration" [3].
This metadata shift also touches rollout migration. The TUI still allows the cached legacy resume shortcut when background rollout migration is enabled, so long as the embedded session holds the maintenance lock and revalidates the thread still uses legacy history through `thread/resume` [4]. Separately, the npm release pipeline stages tarballs in a job with `contents: read` permissions and uploads them as the `npm-packages` artifact; the release job now consumes that artifact and drops its dependency installation and packaging steps. Staging must succeed first [5].
The openai-node auth path tightens its token cache. The workload-identity OAuth exchange now measures duration with a monotonic clock, and the cache deadline comes from the remaining lifetime at response completion; expired tokens are rejected before caching or API dispatch. This is a breaking change for any code that relies on `expiresAt` being set immediately after the token exchange began [6]. The Steady cache lock's 10-second acquisition budget now uses a monotonic clock, and two regression tests cover forward and backward wall-clock corrections [7].
Zod tool users get a reliability fix: `zodFunction()` and `zodResponsesFunction()` capture the original `parameters` schema once and use that same reference for JSON Schema generation and argument parsing. The regression suite covers Zod v3, v4, and v4 Mini through both Chat Completions and Responses [8]. Two smaller correctness fixes are in: audio helpers signal a recording process only when its child object has a PID, and Steady commands with unsuccessful lease creation get their child process reaped before the lifecycle lock releases [9][10].
Action items
- → Review token-auth expiry handling after the monotonic-clock change openai/openai-node [monitor]
- → Flatten pytest cache if stale under concurrent read/write openai/openai-node [plan]
- → Upgrade to openai-node with the zod schema-identity fix to preserve schema identity openai/openai-node [plan]
References
- [1] Show the server's model provider ID in TUI status (#43359) ↗ openai/codex
- [2] Use server model defaults for fresh TUI startup ↗ openai/codex
- [3] Use app-server metadata for TUI session restoration (#43360) ↗ openai/codex
- [4] Allow guarded legacy resume with background migration enabled ↗ openai/codex
- [5] Move npm package staging into a separate release workflow job (#43281) ↗ openai/codex
- [6] fix(auth): account for token exchange elapsed time (#2609) ↗ openai/openai-node
- [7] fix(test): use a monotonic Steady lock timeout (#2661) ↗ openai/openai-node
- [8] fix(zod): retain the original tool parameter schema ↗ openai/openai-node
- [9] fix(audio): only signal started recording processes ↗ openai/openai-node
- [10] fix(test): reap Steady commands when lease creation fails ↗ openai/openai-node
