From d5eb810671751d509112d27003738e6171a2abcd Mon Sep 17 00:00:00 2001
From: Cooper Gamble <cooper@openai.com>
Date: Tue, 19 May 2026 20:30:40 +0000
Subject: [PATCH] [codex-cli] bound startup ChatGPT token refresh [ci
 changed_files]

---
 codex-rs/exec/src/lib.rs | 18 ++++++++++++++----
 codex-rs/tui/src/lib.rs  | 18 ++++++++++++++----
 2 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/codex-rs/exec/src/lib.rs b/codex-rs/exec/src/lib.rs
index fb1006ce88..74b88bdeca 100644
--- a/codex-rs/exec/src/lib.rs
+++ b/codex-rs/exec/src/lib.rs
@@ -157,6 +157,8 @@ use crate::event_processor::EventProcessor;
 
 const DEFAULT_ANALYTICS_ENABLED: bool = true;
 const EXEC_DEFAULT_LOG_FILTER: &str = "error,opentelemetry_sdk=off,opentelemetry_otlp=off";
+const CHATGPT_ACCESS_TOKEN_STARTUP_REFRESH_TIMEOUT: std::time::Duration =
+    std::time::Duration::from_secs(15);
 
 enum InitialOperation {
     UserTurn {
@@ -371,11 +373,19 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         Some(chatgpt_base_url.clone()),
     )
     .await;
-    if let Err(err) = cloud_auth_manager
-        .refresh_managed_chatgpt_token_if_near_expiry()
-        .await
+    match tokio::time::timeout(
+        CHATGPT_ACCESS_TOKEN_STARTUP_REFRESH_TIMEOUT,
+        cloud_auth_manager.refresh_managed_chatgpt_token_if_near_expiry(),
+    )
+    .await
     {
-        warn!("failed to proactively refresh ChatGPT access token during CLI startup: {err}");
+        Ok(Ok(())) => {}
+        Ok(Err(err)) => {
+            warn!("failed to proactively refresh ChatGPT access token during CLI startup: {err}");
+        }
+        Err(_) => {
+            warn!("timed out proactively refreshing ChatGPT access token during CLI startup");
+        }
     }
     let cloud_requirements = cloud_requirements_loader(
         cloud_auth_manager,
diff --git a/codex-rs/tui/src/lib.rs b/codex-rs/tui/src/lib.rs
index 4a3622d0d8..7e1503a98c 100644
--- a/codex-rs/tui/src/lib.rs
+++ b/codex-rs/tui/src/lib.rs
@@ -283,6 +283,8 @@ pub use public_widgets::composer_input::ComposerInput;
 #[cfg(unix)]
 const AUTO_CONNECT_DAEMON_CONNECT_TIMEOUT: std::time::Duration =
     std::time::Duration::from_millis(50);
+const CHATGPT_ACCESS_TOKEN_STARTUP_REFRESH_TIMEOUT: std::time::Duration =
+    std::time::Duration::from_secs(15);
 
 #[allow(clippy::too_many_arguments)]
 async fn start_embedded_app_server(
@@ -994,11 +996,19 @@ pub async fn run_main(
         Some(chatgpt_base_url.clone()),
     )
     .await;
-    if let Err(err) = cloud_auth_manager
-        .refresh_managed_chatgpt_token_if_near_expiry()
-        .await
+    match tokio::time::timeout(
+        CHATGPT_ACCESS_TOKEN_STARTUP_REFRESH_TIMEOUT,
+        cloud_auth_manager.refresh_managed_chatgpt_token_if_near_expiry(),
+    )
+    .await
     {
-        warn!("failed to proactively refresh ChatGPT access token during CLI startup: {err}");
+        Ok(Ok(())) => {}
+        Ok(Err(err)) => {
+            warn!("failed to proactively refresh ChatGPT access token during CLI startup: {err}");
+        }
+        Err(_) => {
+            warn!("timed out proactively refreshing ChatGPT access token during CLI startup");
+        }
     }
     let cloud_requirements = cloud_requirements_loader(
         cloud_auth_manager,