fix(codex): treat a bare WHAM 401 as transient while the main token is live

[harryzhou2000]

WHAM is the ChatGPT usage/quota endpoint (GET https://chatgpt.com/backend-api/wham/usage) that ocx polls for plan, rate-limit windows, and reset credits. A bare 401 from WHAM does not prove the local credential died: upstream edges can transiently reject a still-valid access token. ocx treated every 401 as terminal, so the GUI's periodic refresh flipped a healthy main account to needs-reauth within a minute.

This PR only marks the main account needsReauth when the response carries a terminal code (invalid_workspace_selected / invalid_refresh_token) or the local access-token JWT has actually expired. Bare 401s with a live token are transient and leave the account usable.

Tests: updated and added auth-api tests for live-token 401 (transient), expired-token 401 (terminal), and the BUG-R327 flow.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@harryzhou2000 Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0b2382c6-e391-4ac7-8ed8-1c476525298d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[harryzhou2000]

@Wibias — when you get a chance, could you share your opinion on this one? It touches the auth surface (src/codex/auth-api.ts), so per MAINTAINERS.md it needs a maintainer to apply maintainer-sponsored after review. Happy to adjust the approach if you prefer something different.