fix(daemon): skip codex sync when auth is unavailable

Author: AnnatarHe

cmd/daemon/main.go

@@ -148,12 +148,23 @@ func main() {
 		}
 	}
 
-	codexUsageSyncService := daemon.NewCodexUsageSyncService(cfg)
-	if err := codexUsageSyncService.Start(ctx); err != nil {
-		slog.Error("Failed to start Codex usage sync service", slog.Any("err", err))
+	codexInstalled, err := daemon.CodexInstallationStatus()
+	if err != nil {
+		if reason, ok := daemon.CodexSyncSkipReason(err); ok {
+			slog.Info("Skipping Codex usage sync service startup", slog.String("reason", reason))
+		} else {
+			slog.Error("Failed to check Codex installation status", slog.Any("err", err))
+		}
+	} else if !codexInstalled {
+		slog.Info("Skipping Codex usage sync service startup", slog.String("reason", "codex_not_configured"))
 	} else {
-		slog.Info("Codex usage sync service started")
-		defer codexUsageSyncService.Stop()
+		codexUsageSyncService := daemon.NewCodexUsageSyncService(cfg)
+		if err := codexUsageSyncService.Start(ctx); err != nil {
+			slog.Error("Failed to start Codex usage sync service", slog.Any("err", err))
+		} else {
+			slog.Info("Codex usage sync service started")
+			defer codexUsageSyncService.Stop()
+		}
 	}
 
 	// Create processor instance

daemon/codex_ratelimit.go

@@ -3,6 +3,7 @@ package daemon
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -16,6 +17,14 @@ const codexUsageCacheTTL = 10 * time.Minute
 var (
 	loadCodexAuthFunc   = loadCodexAuth
 	fetchCodexUsageFunc = fetchCodexUsage
+	codexPathExistsFunc = codexPathExists
+)
+
+var (
+	errCodexDirMissing      = errors.New("codex directory missing")
+	errCodexAuthFileMissing = errors.New("codex auth file missing")
+	errCodexAuthInvalid     = errors.New("codex auth invalid")
+	errCodexTokenInvalid    = errors.New("codex token invalid")
 )
 
 // CodexRateLimitData holds the parsed rate limit data from the Codex API
@@ -63,15 +72,79 @@ type codexIDTokenClaims struct {
 	AccountID string `json:"accountId"`
 }
 
+func codexConfigDirPath() (string, error) {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to get home directory: %w", err)
+	}
+
+	return filepath.Join(homeDir, ".codex"), nil
+}
+
+func codexAuthFilePath() (string, error) {
+	dir, err := codexConfigDirPath()
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Join(dir, "auth.json"), nil
+}
+
+func codexPathExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true, nil
+	}
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+	return false, err
+}
+
+func codexInstallationStatus() (bool, error) {
+	dirPath, err := codexConfigDirPath()
+	if err != nil {
+		return false, err
+	}
+	exists, err := codexPathExistsFunc(dirPath)
+	if err != nil {
+		return false, err
+	}
+	if !exists {
+		return false, errCodexDirMissing
+	}
+
+	authPath, err := codexAuthFilePath()
+	if err != nil {
+		return false, err
+	}
+	exists, err = codexPathExistsFunc(authPath)
+	if err != nil {
+		return false, err
+	}
+	if !exists {
+		return false, errCodexAuthFileMissing
+	}
+
+	return true, nil
+}
+
+func CodexInstallationStatus() (bool, error) {
+	return codexInstallationStatus()
+}
+
 // loadCodexAuth reads the Codex authentication data from ~/.codex/auth.json.
 func loadCodexAuth() (*codexAuthData, error) {
-	homeDir, err := os.UserHomeDir()
+	authPath, err := codexAuthFilePath()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get home directory: %w", err)
+		return nil, err
 	}
 
-	data, err := os.ReadFile(filepath.Join(homeDir, ".codex", "auth.json"))
+	data, err := os.ReadFile(authPath)
 	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, errCodexAuthFileMissing
+		}
 		return nil, fmt.Errorf("codex auth file read failed: %w", err)
 	}
 
@@ -81,7 +154,7 @@ func loadCodexAuth() (*codexAuthData, error) {
 	}
 
 	if auth.TokenData == nil || auth.TokenData.AccessToken == "" {
-		return nil, fmt.Errorf("no access token found in codex auth")
+		return nil, errCodexAuthInvalid
 	}
 
 	accountID := ""
@@ -133,6 +206,9 @@ func fetchCodexUsage(ctx context.Context, auth *codexAuthData) (*CodexRateLimitD
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
+		if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+			return nil, errCodexTokenInvalid
+		}
 		return nil, fmt.Errorf("codex usage API returned status %d", resp.StatusCode)
 	}
 
@@ -172,3 +248,18 @@ func shortenCodexAPIError(err error) string {
 
 	return "network"
 }
+
+func CodexSyncSkipReason(err error) (string, bool) {
+	switch {
+	case errors.Is(err, errCodexDirMissing):
+		return "missing_codex_dir", true
+	case errors.Is(err, errCodexAuthFileMissing):
+		return "missing_auth_file", true
+	case errors.Is(err, errCodexAuthInvalid):
+		return "invalid_auth", true
+	case errors.Is(err, errCodexTokenInvalid):
+		return "invalid_auth_token", true
+	default:
+		return "", false
+	}
+}

daemon/codex_usage_sync.go

@@ -2,7 +2,6 @@ package daemon
 
 import (
 	"context"
-	"fmt"
 	"log/slog"
 	"sync"
 	"time"
@@ -70,6 +69,10 @@ func (s *CodexUsageSyncService) sync() {
 	}
 
 	if err := syncCodexUsage(context.Background(), s.config); err != nil {
+		if reason, ok := CodexSyncSkipReason(err); ok {
+			slog.Info("Skipping codex usage sync", slog.String("reason", reason))
+			return
+		}
 		slog.Warn("Failed to sync codex usage", slog.Any("err", err))
 	}
 }
@@ -83,12 +86,12 @@ func syncCodexUsage(ctx context.Context, config model.ShellTimeConfig) error {
 	defer cancel()
 
 	auth, err := loadCodexAuthFunc()
-	if err != nil || auth == nil {
-		if err == nil && auth == nil {
-			err = fmt.Errorf("codex auth unavailable")
-		}
+	if err != nil {
 		return err
 	}
+	if auth == nil {
+		return errCodexAuthInvalid
+	}
 
 	usage, err := fetchCodexUsageFunc(runCtx, auth)
 	if err != nil {

daemon/codex_usage_sync_test.go

@@ -3,6 +3,7 @@ package daemon
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"sync/atomic"
@@ -99,6 +100,105 @@ func TestSyncCodexUsage_AuthError(t *testing.T) {
 	assert.ErrorIs(t, err, assert.AnError)
 }
 
+func TestSyncCodexUsage_InvalidTokenSkips(t *testing.T) {
+	t.Helper()
+
+	originalLoad := loadCodexAuthFunc
+	originalFetch := fetchCodexUsageFunc
+	defer func() {
+		loadCodexAuthFunc = originalLoad
+		fetchCodexUsageFunc = originalFetch
+	}()
+
+	loadCodexAuthFunc = func() (*codexAuthData, error) {
+		return &codexAuthData{AccessToken: "test-token"}, nil
+	}
+	fetchCodexUsageFunc = func(ctx context.Context, auth *codexAuthData) (*CodexRateLimitData, error) {
+		return nil, errCodexTokenInvalid
+	}
+
+	cfg := model.ShellTimeConfig{Token: "shelltime-token"}
+	err := syncCodexUsage(context.Background(), cfg)
+	require.Error(t, err)
+
+	reason, ok := CodexSyncSkipReason(err)
+	require.True(t, ok)
+	assert.Equal(t, "invalid_auth_token", reason)
+}
+
+func TestCodexInstallationStatus_MissingCodexDir(t *testing.T) {
+	originalExists := codexPathExistsFunc
+	defer func() {
+		codexPathExistsFunc = originalExists
+	}()
+
+	codexPathExistsFunc = func(path string) (bool, error) {
+		return false, nil
+	}
+
+	ok, err := CodexInstallationStatus()
+	assert.False(t, ok)
+	assert.ErrorIs(t, err, errCodexDirMissing)
+}
+
+func TestCodexInstallationStatus_MissingAuthFile(t *testing.T) {
+	originalExists := codexPathExistsFunc
+	defer func() {
+		codexPathExistsFunc = originalExists
+	}()
+
+	callCount := 0
+	codexPathExistsFunc = func(path string) (bool, error) {
+		callCount++
+		if callCount == 1 {
+			return true, nil
+		}
+		return false, nil
+	}
+
+	ok, err := CodexInstallationStatus()
+	assert.False(t, ok)
+	assert.ErrorIs(t, err, errCodexAuthFileMissing)
+}
+
+func TestCodexInstallationStatus_Ready(t *testing.T) {
+	originalExists := codexPathExistsFunc
+	defer func() {
+		codexPathExistsFunc = originalExists
+	}()
+
+	codexPathExistsFunc = func(path string) (bool, error) {
+		return true, nil
+	}
+
+	ok, err := CodexInstallationStatus()
+	require.NoError(t, err)
+	assert.True(t, ok)
+}
+
+func TestCodexSyncSkipReason(t *testing.T) {
+	testCases := []struct {
+		name     string
+		err      error
+		expected string
+		ok       bool
+	}{
+		{name: "missing dir", err: errCodexDirMissing, expected: "missing_codex_dir", ok: true},
+		{name: "missing auth file", err: errCodexAuthFileMissing, expected: "missing_auth_file", ok: true},
+		{name: "invalid auth", err: errCodexAuthInvalid, expected: "invalid_auth", ok: true},
+		{name: "invalid token", err: errCodexTokenInvalid, expected: "invalid_auth_token", ok: true},
+		{name: "other error", err: errors.New("boom"), expected: "", ok: false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			reason, ok := CodexSyncSkipReason(tc.err)
+			assert.Equal(t, tc.ok, ok)
+			assert.Equal(t, tc.expected, reason)
+		})
+	}
+}
+
 func TestCodexUsageSyncService_StartRunsImmediatelyAndOnTicker(t *testing.T) {
 	t.Helper()