fix: sync checks local management status before downloading from R2

When objectstore sync is about to download an auth file from R2,
it first queries CLIProxyAPI's local management API for runtime status.
If the auth is already marked invalid (status=error, unavailable,
status_message contains 401/unauthorized/token_invalidated etc),
the file is deleted from R2 instead of downloaded — preventing
invalid auths from being resurrected by sync.

entrypoint.sh

@@ -140,6 +140,8 @@ ensure_objectstore_config() {
   OBJECTSTORE_ROOT="$OBJECTSTORE_MIRROR_ROOT" \
   OBJECTSTORE_CONFIG_FALLBACK="$CONFIG_PATH" \
   MC_CONFIG_DIR="$MC_CONFIG_DIR" \
+  MANAGEMENT_PASSWORD="$MGMT_KEY_VALUE" \
+  PORT="$APP_PORT" \
   /usr/local/bin/python3 /opt/daili/objectstore_sync.py "$1" >/dev/null 2>&1
 }
 

objectstore_sync.py

@@ -9,6 +9,8 @@ import subprocess
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
+from urllib.request import Request, urlopen
+from urllib.error import HTTPError, URLError
 
 
 def env_required(name: str) -> str:
@@ -160,6 +162,63 @@ def upload_file(rel: str) -> None:
     run_mc(["cp", str(src), remote_path(rel)])
 
 
+def delete_remote(rel: str) -> None:
+    run_mc(["rm", "--force", remote_path(rel)], check=False)
+
+
+INVALID_STATUS_KEYWORDS = [
+    "token_invalidated",
+    "token_revoked",
+    "invalidated oauth token",
+    "authentication token has been invalidated",
+    "account has been deactivated",
+    "no_organization",
+    "unauthorized",
+    "401",
+]
+
+
+def _fetch_invalid_auth_names() -> set[str]:
+    """Query local CLIProxyAPI management API for auth names with invalid status."""
+    mgmt_key = os.environ.get("MANAGEMENT_PASSWORD") or os.environ.get("API_KEY") or ""
+    port = os.environ.get("PORT", "8317")
+    if not mgmt_key:
+        return set()
+    url = f"http://127.0.0.1:{port}/v0/management/auth-files"
+    req = Request(url)
+    req.add_header("Authorization", f"Bearer {mgmt_key}")
+    try:
+        with urlopen(req, timeout=10) as resp:
+            data = json.loads(resp.read())
+    except (HTTPError, URLError, OSError, ValueError):
+        return set()
+    if not isinstance(data, dict):
+        return set()
+    files = data.get("files", [])
+    if not isinstance(files, list):
+        return set()
+
+    invalid_names: set[str] = set()
+    for entry in files:
+        if not isinstance(entry, dict):
+            continue
+        name = str(entry.get("name") or "").strip()
+        if not name:
+            continue
+        status = str(entry.get("status") or "").strip().lower()
+        status_message = str(entry.get("status_message") or "").strip().lower()
+        unavailable = entry.get("unavailable", False)
+        if status == "error" or unavailable:
+            invalid_names.add(name)
+            continue
+        if status_message:
+            for kw in INVALID_STATUS_KEYWORDS:
+                if kw in status_message:
+                    invalid_names.add(name)
+                    break
+    return invalid_names
+
+
 def restore() -> None:
     ensure_alias()
     ROOT.mkdir(parents=True, exist_ok=True)
@@ -184,12 +243,23 @@ def sync() -> None:
     ensure_alias()
     ROOT.mkdir(parents=True, exist_ok=True)
 
+    invalid_names = _fetch_invalid_auth_names()
+
     remote = remote_inventory()
     local = local_inventory()
 
-    # Remote has, local doesn't → download
-    # Both have, md5 differs → compare mtime, newer wins
+    # Remote has, local doesn't → download (unless invalid)
+    # Both have, md5 differs → compare mtime, newer wins (unless invalid)
     for rel, meta in remote.items():
+        # Extract auth file name from rel path (e.g. "auths/codex-xxx-free.json" → "codex-xxx-free.json")
+        file_name = rel.rsplit("/", 1)[-1] if "/" in rel else rel
+        if file_name in invalid_names:
+            delete_remote(rel)
+            dest = local_path(rel)
+            if dest.is_file():
+                dest.unlink()
+            continue
+
         local_meta = local.get(rel)
         if local_meta is None:
             download_file(rel, meta)
@@ -203,6 +273,12 @@ def sync() -> None:
 
     # Local has, remote doesn't → upload to remote (new file from management UI)
     for rel in sorted(set(local) - set(remote)):
+        file_name = rel.rsplit("/", 1)[-1] if "/" in rel else rel
+        if file_name in invalid_names:
+            dest = local_path(rel)
+            if dest.is_file():
+                dest.unlink()
+            continue
         upload_file(rel)
 
     prune_empty_dirs(local_path(REMOTE_AUTHS_PREFIX))