Recover invalid bot authentication

run.ts

@@ -3,6 +3,7 @@
 // GITEA_TOKEN; everything this script posts goes through the reviewer token,
 // so it appears as the bot account.
 import { TextLineStream } from "jsr:@std/streams@1/text-line-stream";
+import { retryInvalidToken } from "./auth.ts";
 
 type GiteaUser = { login: string; email: string };
 type GiteaComment = { user: GiteaUser; created_at: string; body: string };
@@ -252,21 +253,35 @@ async function runCodex(prompt: string): Promise<string> {
     .output();
   if (!loggedIn.success) await codexDeviceLogin();
   const file = await Deno.makeTempFile();
-  const status = await new Deno.Command("codex", {
-    args: [
-      "exec",
-      "--model",
-      model("codex"),
-      "--dangerously-bypass-approvals-and-sandbox",
-      "--output-last-message",
-      file,
-      prompt,
-    ],
-    env: agentEnv,
-    clearEnv: true,
-    stdout: "inherit",
-    stderr: "inherit",
-  }).spawn().status;
+  const attempt = async () => {
+    const codex = new Deno.Command("codex", {
+      args: [
+        "exec",
+        "--model",
+        model("codex"),
+        "--dangerously-bypass-approvals-and-sandbox",
+        "--output-last-message",
+        file,
+        prompt,
+      ],
+      env: agentEnv,
+      clearEnv: true,
+      stdout: "inherit",
+      stderr: "piped",
+    }).spawn();
+    const decoder = new TextDecoder();
+    let error = "";
+    for await (const chunk of codex.stderr) {
+      await Deno.stderr.write(chunk);
+      error += decoder.decode(chunk, { stream: true });
+    }
+    error += decoder.decode();
+    return { status: await codex.status, error };
+  };
+  const { status } = await retryInvalidToken(attempt, async () => {
+    await run("codex", ["logout"]);
+    await codexDeviceLogin();
+  });
   if (!status.success) throw new Error(`codex exited with ${status.code}`);
   return await Deno.readTextFile(file);
 }