OAuth token rotation

GEODE-managed API keys and ChatGPT login credentials live in~/.geode/auth.toml. The terminal owns secret input and login presentation; core/auth/ validates and persists credentials. The model can inspect nonsecret state and request permitted choices.

Persistence and activation

Auth changes re-read the current file under a cross-process lock, validate the candidate, and replace the file before publishing it in the current process. Other processes adopt changes through/login refresh. Reconciliation includes removed file-owned entries; environment and externally managed credentials retain their own owners. A conflict after persistence reports the saved file and failed local adoption separately and requests refresh.

Requests and tokens

• Each request selects an account within the session's chosen provider and billing source. Replacing a credential preserves already borrowed requests.
• An imported Codex credential remains owned by its external file. Subsequent reads and requests reflect replacement or deletion; Codex CLI is never spawned for inference.
• GEODE allows one ChatGPT device-code login attempt per auth store at a time. Failure or cancellation is not completion; success follows successful file persistence and local publication.
• Use /login openai to replace an expired GEODE credential. Refresh an external Codex credential in its owning client. The retired GEODE auth.json is left untouched; register again with /login openai instead of automatic migration.

What status establishes

Model availability and startup readiness inspect actual routing, policy, and credential eligibility instead of key-string presence. This is offline route availability, not a network check of provider acceptance or remaining quota. Stored error and cooldown fields affect eligibility, but active adapters do not attribute every SDK success or failure to an automatic profile-health tracker. The retired global tracking path and claims based on it have been removed.

Atomic auth-file replacement does not establish whole-workspace restoration or exactly-once external effects. Recovery must inspect the actual credential source and the session's selection together.

• Auth and OAuth
• Provider setup