From 529744c7c76992f6a978719097d125a7feab47f6 Mon Sep 17 00:00:00 2001
From: cat <git@chen.rs>
Date: Wed, 15 Jul 2026 16:38:09 +0800
Subject: [PATCH] =?UTF-8?q?fix(openai):=20=E4=BF=AE=E5=A4=8D=20Agent=20Ide?=
 =?UTF-8?q?ntity=20=E5=AF=BC=E5=85=A5=E8=BF=87=E6=9C=9F=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...ccount_codex_agent_identity_import_test.go | 36 +++++++++++++++++++
 .../handler/admin/account_codex_import.go     |  6 ++++
 2 files changed, 42 insertions(+)

diff --git a/backend/internal/handler/admin/account_codex_agent_identity_import_test.go b/backend/internal/handler/admin/account_codex_agent_identity_import_test.go
index db55182b6..85d1a21f4 100644
--- a/backend/internal/handler/admin/account_codex_agent_identity_import_test.go
+++ b/backend/internal/handler/admin/account_codex_agent_identity_import_test.go
@@ -1,6 +1,7 @@
 package admin
 
 import (
+	"context"
 	"crypto/ed25519"
 	"crypto/rand"
 	"crypto/x509"
@@ -45,3 +46,38 @@ func TestNormalizeCodexImportEntryAcceptsAgentIdentityAuthJSON(t *testing.T) {
 	require.NotContains(t, item.Credentials, "refresh_token")
 	require.NotEmpty(t, item.WarningTexts)
 }
+
+func TestImportCodexSessionsCreatesAgentIdentityWithoutOAuthExpiry(t *testing.T) {
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	require.NoError(t, err)
+	der, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	require.NoError(t, err)
+
+	svc := newCodexImportMemoryAdminService(nil)
+	handler := NewAccountHandler(svc, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, nil)
+	result, err := handler.importCodexSessions(context.Background(), CodexSessionImportRequest{
+		SkipDefaultGroupBind: boolPtr(true),
+	}, []codexImportEntry{{
+		Index: 1,
+		Value: map[string]any{
+			"auth_mode": "agentIdentity",
+			"agent_identity": map[string]any{
+				"agent_runtime_id":  "runtime-import",
+				"agent_private_key": base64.StdEncoding.EncodeToString(der),
+				"task_id":           "task-import",
+				"account_id":        "account-import",
+				"chatgpt_user_id":   "user-import",
+			},
+		},
+	}})
+	require.NoError(t, err)
+	require.Equal(t, 1, result.Created)
+	require.Zero(t, result.Failed)
+	require.Len(t, svc.createdAccounts, 1)
+	created := svc.createdAccounts[0]
+	require.Nil(t, created.ExpiresAt)
+	require.Nil(t, created.AutoPauseOnExpired)
+	require.Equal(t, service.OpenAIAuthModeAgentIdentity, created.Credentials["auth_mode"])
+	require.NotContains(t, created.Credentials, "access_token")
+	require.NotContains(t, created.Credentials, "refresh_token")
+}
diff --git a/backend/internal/handler/admin/account_codex_import.go b/backend/internal/handler/admin/account_codex_import.go
index 57b97f847..aa471494f 100644
--- a/backend/internal/handler/admin/account_codex_import.go
+++ b/backend/internal/handler/admin/account_codex_import.go
@@ -774,6 +774,12 @@ func resolveCodexImportExpiry(req CodexSessionImportRequest, item *codexImportAc
 	if item == nil {
 		return nil, nil, nil, nil, errors.New("导入项为空")
 	}
+	// Agent Identity has no OAuth access-token lifetime. Its runtime/task
+	// lifecycle is handled by the upstream task recovery path, so it must not
+	// be rejected or auto-paused by the OAuth import expiry policy.
+	if item.IsAgentIdentity {
+		return nil, nil, nil, nil, nil
+	}
 
 	var requestExpiresAt *time.Time
 	if req.ExpiresAt != nil && *req.ExpiresAt > 0 {