[ntindle]

Summary

• Detect only the cyberPolicy subtype that explicitly says the Codex session lacks hardware-key authentication; ordinary policy refusals remain unchanged.
• Start or reuse a short-lived OpenAI device flow for the exact file-backed OAuth credential selected for the failed request, then append the first-party verification URL and user code to the error T3 already displays.
• Complete the flow in the background and atomically replace only that credential's outer OAuth tokens after both its registration epoch and OpenAI account still match.
• Preserve SIWC and unrelated credential metadata, reject a different account or stale registration, and require the client to retry instead of replaying or rotating the failed request.
• Keep the exact camelCase cyberPolicy terminal event classified as HTTP 400.

Security properties

• No management credential, account email, auth filename, access token, refresh token, or device auth identifier is sent downstream.
• Recovery hints accept only an HTTPS auth.openai.com verification URL and a bounded, short-lived user code.
• Concurrent failures deduplicate to one credential-bound device flow.
• A completed login for a different account is discarded without changing persisted credentials.

Validation

• go test ./... -count=1
• go test -race ./sdk/cliproxy -run '^TestCodexHardwareReauth' -count=1
• go test -race ./sdk/cliproxy/auth -run '^TestBindCodexOuter' -count=1
• go vet ./internal/runtime/executor ./sdk/auth ./sdk/cliproxy/auth ./sdk/cliproxy
• go build -o test-output ./cmd/server

Relates to router-for-me#7036.