@f5-sales-demo/pi-ai 20.19.0 → 20.19.2

package/README.md

@@ -46,8 +46,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 
 ## Supported Providers
 
-- **OpenAI**
-- **OpenAI Codex** (ChatGPT Plus/Pro subscription, requires OAuth, see below)
+- **OpenAI** (usage-based Platform API access)
 - **Anthropic**
 - **Google**
 - **Vertex AI** (Gemini via Vertex AI)
@@ -907,35 +906,35 @@ const response = await complete(
 
 In Node.js environments, you can set environment variables to avoid passing API keys:
 
-| Provider       | Environment Variable(s)                                                      |
-| -------------- | ---------------------------------------------------------------------------- |
-| OpenAI         | `OPENAI_API_KEY`                                                             |
-| Anthropic      | `ANTHROPIC_API_KEY` or `ANTHROPIC_OAUTH_TOKEN` (or `ANTHROPIC_FOUNDRY_API_KEY` when `CLAUDE_CODE_USE_FOUNDRY=true`) |
-| Google         | `GEMINI_API_KEY`                                                             |
-| Vertex AI      | `GOOGLE_CLOUD_PROJECT` (or `GCLOUD_PROJECT`) + `GOOGLE_CLOUD_LOCATION` + ADC |
-| Mistral        | `MISTRAL_API_KEY`                                                            |
-| Groq           | `GROQ_API_KEY`                                                               |
-| Cerebras       | `CEREBRAS_API_KEY`                                                           |
-| Together       | `TOGETHER_API_KEY`                                                           |
-| Qianfan        | `QIANFAN_API_KEY`                                                            |
-| Hugging Face   | `HUGGINGFACE_HUB_TOKEN` or `HF_TOKEN`                                        |
-| Synthetic      | `SYNTHETIC_API_KEY`                                                          |
-| NVIDIA         | `NVIDIA_API_KEY`                                                             |
-| NanoGPT        | `NANO_GPT_API_KEY`                                                          |
-| Venice         | `VENICE_API_KEY`                                                             |
-| Moonshot       | `MOONSHOT_API_KEY`                                                           |
-| xAI            | `XAI_API_KEY`                                                                |
-| OpenRouter     | `OPENROUTER_API_KEY`                                                         |
-| LiteLLM        | `LITELLM_API_KEY`                                                            |
-| Ollama         | `OLLAMA_API_KEY` (optional for local deployments)                            |
-| Qwen Portal    | `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`                                  |
-| zAI            | `ZAI_API_KEY`                                                                |
-| MiniMax Code   | `MINIMAX_CODE_API_KEY` (international) or `MINIMAX_CODE_CN_API_KEY` (China) |
-| Xiaomi MiMo    | `XIAOMI_API_KEY`                                                             |
-| ZenMux         | `ZENMUX_API_KEY`                                                             |
-| vLLM           | `VLLM_API_KEY`                                                               |
-| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
-| GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
+| Provider              | Environment Variable(s)                                                                                             |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| OpenAI                | `OPENAI_API_KEY`                                                                                                    |
+| Anthropic             | `ANTHROPIC_API_KEY` or `ANTHROPIC_OAUTH_TOKEN` (or `ANTHROPIC_FOUNDRY_API_KEY` when `CLAUDE_CODE_USE_FOUNDRY=true`) |
+| Google                | `GEMINI_API_KEY`                                                                                                    |
+| Vertex AI             | `GOOGLE_CLOUD_PROJECT` (or `GCLOUD_PROJECT`) + `GOOGLE_CLOUD_LOCATION` + ADC                                        |
+| Mistral               | `MISTRAL_API_KEY`                                                                                                   |
+| Groq                  | `GROQ_API_KEY`                                                                                                      |
+| Cerebras              | `CEREBRAS_API_KEY`                                                                                                  |
+| Together              | `TOGETHER_API_KEY`                                                                                                  |
+| Qianfan               | `QIANFAN_API_KEY`                                                                                                   |
+| Hugging Face          | `HUGGINGFACE_HUB_TOKEN` or `HF_TOKEN`                                                                               |
+| Synthetic             | `SYNTHETIC_API_KEY`                                                                                                 |
+| NVIDIA                | `NVIDIA_API_KEY`                                                                                                    |
+| NanoGPT               | `NANO_GPT_API_KEY`                                                                                                  |
+| Venice                | `VENICE_API_KEY`                                                                                                    |
+| Moonshot              | `MOONSHOT_API_KEY`                                                                                                  |
+| xAI                   | `XAI_API_KEY`                                                                                                       |
+| OpenRouter            | `OPENROUTER_API_KEY`                                                                                                |
+| LiteLLM               | `LITELLM_API_KEY`                                                                                                   |
+| Ollama                | `OLLAMA_API_KEY` (optional for local deployments)                                                                   |
+| Qwen Portal           | `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`                                                                         |
+| zAI                   | `ZAI_API_KEY`                                                                                                       |
+| MiniMax Code          | `MINIMAX_CODE_API_KEY` (international) or `MINIMAX_CODE_CN_API_KEY` (China)                                         |
+| Xiaomi MiMo           | `XIAOMI_API_KEY`                                                                                                    |
+| ZenMux                | `ZENMUX_API_KEY`                                                                                                    |
+| vLLM                  | `VLLM_API_KEY`                                                                                                      |
+| Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                                                                     |
+| GitHub Copilot        | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                                                              |
 
 For Cloudflare AI Gateway models, use provider base URL format
 `https://gateway.ai.cloudflare.com/v1/<account>/<gateway>/anthropic`.
@@ -988,7 +987,6 @@ const key = getEnvApiKey("openai"); // checks OPENAI_API_KEY
 Several providers support OAuth authentication (some also support static API keys):
 
 - **Anthropic** (Claude Pro/Max subscription)
-- **OpenAI Codex** (ChatGPT Plus/Pro subscription, access to GPT-5.x Codex models)
 - **GitHub Copilot** (Copilot subscription)
 - **Google Gemini CLI** (Gemini 2.0/2.5 via Google Cloud Code Assist; free tier or paid subscription)
 - **Antigravity** (Free Gemini 3, Claude, GPT-OSS via Google Cloud)
@@ -1047,7 +1045,8 @@ bunx @f5-sales-demo/pi-ai list               # list available providers
 
 Credentials are saved to `agent.db` in the agent directory. `/login qianfan` opens the Qianfan console and stores the pasted API key.
 
-`login` supports OAuth providers (Anthropic, OpenAI Codex, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
+`login` supports OAuth providers (Anthropic, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
+OpenAI uses usage-based Platform API access through `OPENAI_API_KEY`. For ChatGPT subscription access, use the official Codex CLI and run `codex login`.
 
 For the current OpenAI-compatible integrations, API-key onboarding covers Together, Moonshot, Qianfan, NVIDIA, NanoGPT, Hugging Face, Venice, Xiaomi, vLLM, LiteLLM, Cloudflare AI Gateway, and Qwen Portal. Ollama is typically local and unauthenticated; set `OLLAMA_API_KEY` only when your Ollama deployment enforces bearer auth.
 
@@ -1059,7 +1058,6 @@ The library provides login and token refresh functions. Credential storage is th
 import {
  // Login functions (return credentials, do not store)
  loginAnthropic,
- loginOpenAICodex,
  loginGitHubCopilot,
  loginGeminiCli,
  loginAntigravity,
@@ -1081,20 +1079,11 @@ import {
  getOAuthApiKey, // (provider, credentialsMap) => { newCredentials, apiKey } | null
 
  // Types
- type OAuthProvider, // includes 'anthropic', 'openai-codex', 'github-copilot', 'google-gemini-cli', 'google-antigravity', 'together', 'moonshot', 'qianfan', 'nvidia', 'nanogpt', 'huggingface', 'venice', 'xiaomi', 'vllm', 'litellm', 'cloudflare-ai-gateway', 'qwen-portal', ...
+ type OAuthProvider,
  type OAuthCredentials,
 } from "@f5-sales-demo/pi-ai";
 ```
 
-`loginOpenAICodex` accepts an optional `originator` value used in the OAuth flow:
-
-```typescript
-await loginOpenAICodex({
- onAuth: ({ url }) => console.log(url),
- originator: "my-cli",
-});
-```
-
 ### Login Flow Example
 
 ```typescript
@@ -1149,7 +1138,7 @@ const response = await complete(
 
 ### Provider Notes
 
-**OpenAI Codex**: Requires a ChatGPT Plus or Pro subscription. Provides access to GPT-5.x Codex models with extended context windows and reasoning capabilities. The library automatically handles session-based prompt caching when `sessionId` is provided in stream options.
+**OpenAI**: Set `OPENAI_API_KEY` for usage-based Platform API access. ChatGPT subscription access is available through the official Codex CLI, not this library.
 
 **GitHub Copilot**: If you get "The requested model is not supported" error, enable the model manually in VS Code: open Copilot Chat, click the model selector, select the model (warning icon), and click "Enable".
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "20.19.0",
+	"version": "20.19.2",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "20.19.0",
+		"@f5-sales-demo/pi-utils": "20.19.2",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -51,7 +51,6 @@ import { loginMoonshot } from "./utils/oauth/moonshot";
 import { loginNanoGPT } from "./utils/oauth/nanogpt";
 import { loginNvidia } from "./utils/oauth/nvidia";
 import { loginOllama } from "./utils/oauth/ollama";
-import { loginOpenAICodex } from "./utils/oauth/openai-codex";
 import { loginOpenCode } from "./utils/oauth/opencode";
 import { loginParallel } from "./utils/oauth/parallel";
 import { loginPerplexity } from "./utils/oauth/perplexity";
@@ -175,6 +174,8 @@ const USAGE_CACHE_PREFIX = "usage_cache:";
 const USAGE_REPORT_TTL_MS = 30_000;
 const DEFAULT_USAGE_REQUEST_TIMEOUT_MS = 3_000;
 const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 10_000;
+const LEGACY_OPENAI_CODEX_PROVIDER = "openai-codex";
+const LEGACY_OPENAI_CODEX_DISABLED_CAUSE = "unsupported OpenAI Codex OAuth; remove manually with logout";
 
 type UsageCacheEntry<T> = {
 	value: T;
@@ -344,7 +345,9 @@ export class AuthStorage {
 	 * Used for CLI --api-key flag.
 	 */
 	setRuntimeApiKey(provider: string, apiKey: string): void {
-		this.#runtimeOverrides.set(canonicalizeOAuthProviderId(provider), apiKey);
+		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return;
+		this.#runtimeOverrides.set(provider, apiKey);
 	}
 
 	/**
@@ -655,6 +658,13 @@ export class AuthStorage {
 	 */
 	async set(provider: string, credential: AuthCredentialEntry): Promise<void> {
 		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) {
+			this.#store.replaceAuthCredentialsForProvider(provider, Array.isArray(credential) ? credential : [credential]);
+			this.#store.disableLegacyOpenAICodexCredentials();
+			this.#data.delete(provider);
+			this.#resetProviderAssignments(provider);
+			return;
+		}
 		const normalized = Array.isArray(credential) ? credential : [credential];
 		const deduped = this.#dedupeOAuthCredentials(provider, normalized);
 		const stored = this.#store.replaceAuthCredentialsForProvider(provider, deduped);
@@ -679,6 +689,12 @@ export class AuthStorage {
 	 */
 	async remove(provider: string): Promise<void> {
 		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) {
+			this.#store.hardDeleteAuthCredentialsForProvider(provider);
+			this.#data.delete(provider);
+			this.#resetProviderAssignments(provider);
+			return;
+		}
 		this.#store.deleteAuthCredentialsForProvider(provider, "deleted by user");
 		this.#data.delete(provider);
 		this.#resetProviderAssignments(provider);
@@ -704,6 +720,7 @@ export class AuthStorage {
 	 */
 	hasAuth(provider: string): boolean {
 		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return false;
 		if (this.#runtimeOverrides.has(provider)) return true;
 		if (this.#getCredentialsForProvider(provider).length > 0) return true;
 		if (getEnvApiKey(provider)) return true;
@@ -812,12 +829,10 @@ export class AuthStorage {
 					},
 				);
 				break;
+			case "openai":
+				throw new Error("OpenAI uses usage-based API access. Set OPENAI_API_KEY instead of signing in.");
 			case "openai-codex":
-				credentials = await loginOpenAICodex({
-					...ctrl,
-					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
-				});
-				break;
+				throw new Error("OpenAI Codex OAuth is unsupported. Use official codex or set OPENAI_API_KEY for xcsh.");
 			case "gitlab-duo":
 				credentials = await loginGitLabDuo({
 					...ctrl,
@@ -1921,6 +1936,7 @@ export class AuthStorage {
 	 */
 	async peekApiKey(provider: string): Promise<string | undefined> {
 		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return undefined;
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {
 			return runtimeKey;
@@ -1963,6 +1979,7 @@ export class AuthStorage {
 	 */
 	async getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined> {
 		provider = canonicalizeOAuthProviderId(provider);
+		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return undefined;
 		// Runtime override takes highest priority
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {
@@ -2224,6 +2241,7 @@ export class AuthCredentialStore {
 			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at",
 		);
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
+		this.disableLegacyOpenAICodexCredentials();
 	}
 
 	static async open(dbPath: string = getAgentDbPath()): Promise<AuthCredentialStore> {
@@ -2462,6 +2480,25 @@ export class AuthCredentialStore {
 		return results;
 	}
 
+	/**
+	 * List disabled credentials for inspection or explicit user-directed removal.
+	 * Legacy OpenAI Codex rows stay here; they are never reactivated automatically.
+	 */
+	listDisabledAuthCredentials(provider: string): StoredAuthCredential[] {
+		const rows = this.#listDisabledByProviderStmt.all(provider) as AuthRow[];
+		const results: StoredAuthCredential[] = [];
+		for (const row of rows) {
+			const credential = deserializeCredential(row);
+			if (credential) results.push(toStoredAuthCredential(row, credential));
+		}
+		return results;
+	}
+
+	/** Disable unsupported Codex OAuth rows without deleting the user's stored data. */
+	disableLegacyOpenAICodexCredentials(): void {
+		this.deleteAuthCredentialsForProvider(LEGACY_OPENAI_CODEX_PROVIDER, LEGACY_OPENAI_CODEX_DISABLED_CAUSE);
+	}
+
 	replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[] {
 		const replace = this.#db.transaction((providerName: string, items: AuthCredential[]) => {
 			const existingRows = this.#listActiveByProviderStmt.all(providerName) as AuthRow[];
@@ -2619,6 +2656,15 @@ export class AuthCredentialStore {
 		}
 	}
 
+	/** Permanently remove credentials only after an explicit user logout/removal request. */
+	hardDeleteAuthCredentialsForProvider(provider: string): void {
+		try {
+			this.#db.prepare("DELETE FROM auth_credentials WHERE provider = ?").run(provider);
+		} catch {
+			// Ignore delete failures
+		}
+	}
+
 	getCache(key: string): string | null {
 		try {
 			const row = this.#getCacheStmt.get(key) as { value?: string } | undefined;

package/src/cli.ts

@@ -12,7 +12,6 @@ import { loginKilo } from "./utils/oauth/kilo";
 import { loginKimi } from "./utils/oauth/kimi";
 import { loginMiniMaxCode, loginMiniMaxCodeCn } from "./utils/oauth/minimax-code";
 import { loginNanoGPT } from "./utils/oauth/nanogpt";
-import { loginOpenAICodex } from "./utils/oauth/openai-codex";
 import { loginParallel } from "./utils/oauth/parallel";
 import { loginTavily } from "./utils/oauth/tavily";
 import type { OAuthCredentials, OAuthProvider } from "./utils/oauth/types";
@@ -127,20 +126,6 @@ async function login(provider: OAuthProvider): Promise<void> {
 					},
 				});
 				break;
-			case "openai-codex":
-				credentials = await loginOpenAICodex({
-					onAuth(info) {
-						const { url, instructions } = info;
-						console.log(`\nOpen this URL in your browser:\n${url}`);
-						if (instructions) console.log(instructions);
-						console.log();
-					},
-					async onPrompt(p) {
-						return await promptFn(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
-					},
-				});
-				break;
-
 			case "kimi-code":
 				credentials = await loginKimi({
 					onAuth(info) {
@@ -336,7 +321,9 @@ Providers:
   github-copilot    GitHub Copilot
   google-gemini-cli Google Gemini CLI
   google-antigravity Antigravity (Gemini 3, Claude, GPT-OSS)
-  openai-codex      OpenAI Codex (ChatGPT Plus/Pro)
+
+OpenAI models use usage-based Platform API access. Set OPENAI_API_KEY, then select an OpenAI model.
+For ChatGPT subscription access, use the official codex CLI: codex login
   kimi-code         Kimi Code
   kilo              Kilo Gateway
   kagi              Kagi
@@ -429,6 +416,15 @@ Examples:
 				console.error("No provider selected");
 				process.exit(1);
 			}
+			if (provider === "openai-codex") {
+				if (storage.listDisabledAuthCredentials(provider).length === 0) {
+					console.error("No disabled legacy OpenAI Codex credentials found");
+					process.exit(1);
+				}
+				storage.hardDeleteAuthCredentialsForProvider(provider);
+				console.log("Removed disabled legacy OpenAI Codex credentials");
+				return;
+			}
 
 			const oauth = storage.getOAuth(provider);
 			const apiKey = storage.getApiKey(provider);
@@ -470,6 +466,13 @@ Examples:
 			console.error("No provider selected");
 			process.exit(1);
 		}
+		if (provider === "openai") {
+			console.log(
+				"OpenAI Responses API uses usage-based Platform API access. Set OPENAI_API_KEY, then select an OpenAI model.",
+			);
+			console.log("For ChatGPT subscription access, use the official codex CLI: codex login");
+			return;
+		}
 
 		if (!PROVIDERS.some(p => p.id === provider)) {
 			console.error(`Unknown provider: ${provider}`);

package/src/stream.ts

@@ -80,7 +80,6 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	"opencode-go": "OPENCODE_API_KEY",
 	"opencode-zen": "OPENCODE_API_KEY",
 	cursor: "CURSOR_ACCESS_TOKEN",
-	"openai-codex": "OPENAI_CODEX_OAUTH_TOKEN",
 	"azure-openai-responses": "AZURE_OPENAI_API_KEY",
 	exa: "EXA_API_KEY",
 	jina: "JINA_API_KEY",
@@ -164,6 +163,11 @@ export function stream<TApi extends Api>(
 	context: Context,
 	options?: OptionsForApi<TApi>,
 ): AssistantMessageEventStream {
+	if (model.provider === "openai-codex") {
+		throw new Error(
+			"OpenAI Codex subscription access is unsupported in xcsh. Use official codex or an OpenAI API-key model.",
+		);
+	}
 	// Check custom API registry first (extension-provided APIs like "vertex-claude-api")
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {
@@ -244,6 +248,11 @@ export function streamSimple<TApi extends Api>(
 	context: Context,
 	options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
+	if (model.provider === "openai-codex") {
+		throw new Error(
+			"OpenAI Codex subscription access is unsupported in xcsh. Use official codex or an OpenAI API-key model.",
+		);
+	}
 	// Check custom API registry first (extension-provided APIs)
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {

package/src/utils/oauth/index.ts

@@ -8,7 +8,6 @@ import { refreshGitLabDuoToken } from "./gitlab-duo";
 import { refreshAntigravityToken } from "./google-antigravity";
 import { refreshGoogleCloudToken } from "./google-gemini-cli";
 import { refreshKimiToken } from "./kimi";
-import { refreshOpenAICodexToken } from "./openai-codex";
 import type {
 	OAuthCredentials,
 	OAuthProvider,
@@ -97,9 +96,6 @@ export { loginNanoGPT } from "./nanogpt";
 export { loginNvidia } from "./nvidia";
 // Ollama (optional API key)
 export { loginOllama } from "./ollama";
-export type { OpenAICodexLoginOptions } from "./openai-codex";
-// OpenAI Codex (ChatGPT OAuth)
-export { loginOpenAICodex, refreshOpenAICodexToken } from "./openai-codex";
 // OpenCode Zen / OpenCode Go (API key)
 export { loginOpenCode } from "./opencode";
 // Parallel (API key)
@@ -142,8 +138,8 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		available: true,
 	},
 	{
-		id: "openai-codex",
-		name: "ChatGPT Plus/Pro (Codex Subscription)",
+		id: "openai",
+		name: "OpenAI Responses API (usage-based API access)",
 		available: true,
 	},
 	{
@@ -384,8 +380,8 @@ export async function refreshOAuthToken(
 			}
 			newCredentials = await refreshAntigravityToken(credentials.refresh, credentials.projectId);
 			break;
-		case "openai-codex":
-			newCredentials = await refreshOpenAICodexToken(credentials.refresh);
+		case "openai":
+			newCredentials = credentials;
 			break;
 		case "kimi-code":
 			newCredentials = await refreshKimiToken(credentials.refresh);
@@ -463,6 +459,9 @@ export async function getOAuthApiKey(
 	if (!creds) {
 		return null;
 	}
+	if (provider === "openai-codex") {
+		return null;
+	}
 
 	if (provider === "perplexity") {
 		const normalizedExpires =

package/src/utils/oauth/types.ts

@@ -33,6 +33,8 @@ export type OAuthProvider =
 	| "nvidia"
 	| "nanogpt"
 	| "ollama"
+	| "openai"
+	/** Legacy ID retained only so stored credentials can be explicitly removed. */
 	| "openai-codex"
 	| "opencode-go"
 	| "opencode-zen"

package/src/utils/oauth/openai-codex.ts

@@ -1,190 +0,0 @@
-/**
- * OpenAI Codex (ChatGPT OAuth) flow
- */
-import { OAuthCallbackFlow } from "./callback-server";
-import { generatePKCE } from "./pkce";
-import type { OAuthController, OAuthCredentials } from "./types";
-
-const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
-const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
-const TOKEN_URL = "https://auth.openai.com/oauth/token";
-const CALLBACK_PORT = 1455;
-const CALLBACK_PATH = "/auth/callback";
-const SCOPE = "openid profile email offline_access";
-const JWT_CLAIM_PATH = "https://api.openai.com/auth";
-const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
-const TOKEN_REQUEST_TIMEOUT_MS = 15_000;
-
-type JwtPayload = {
-	[JWT_CLAIM_PATH]?: {
-		chatgpt_account_id?: string;
-	};
-	[JWT_PROFILE_CLAIM]?: {
-		email?: string;
-	};
-	[key: string]: unknown;
-};
-
-function decodeJwt(token: string): JwtPayload | null {
-	try {
-		const parts = token.split(".");
-		if (parts.length !== 3) return null;
-		const payload = parts[1] ?? "";
-		const decoded = Buffer.from(payload, "base64").toString("utf-8");
-		return JSON.parse(decoded) as JwtPayload;
-	} catch {
-		return null;
-	}
-}
-
-function getTokenProfile(accessToken: string): { accountId?: string; email?: string } {
-	const payload = decodeJwt(accessToken);
-	const auth = payload?.[JWT_CLAIM_PATH];
-	const accountId = auth?.chatgpt_account_id;
-	const email = payload?.[JWT_PROFILE_CLAIM]?.email?.trim().toLowerCase();
-	return {
-		accountId: typeof accountId === "string" && accountId.length > 0 ? accountId : undefined,
-		email: typeof email === "string" && email.length > 0 ? email : undefined,
-	};
-}
-
-interface PKCE {
-	verifier: string;
-	challenge: string;
-}
-
-class OpenAICodexOAuthFlow extends OAuthCallbackFlow {
-	constructor(
-		ctrl: OAuthController,
-		private readonly pkce: PKCE,
-		private readonly originator: string,
-	) {
-		super(ctrl, CALLBACK_PORT, CALLBACK_PATH);
-	}
-
-	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
-		const searchParams = new URLSearchParams({
-			response_type: "code",
-			client_id: CLIENT_ID,
-			redirect_uri: redirectUri,
-			scope: SCOPE,
-			code_challenge: this.pkce.challenge,
-			code_challenge_method: "S256",
-			state,
-			id_token_add_organizations: "true",
-			codex_cli_simplified_flow: "true",
-			originator: this.originator,
-		});
-
-		const url = `${AUTHORIZE_URL}?${searchParams.toString()}`;
-		return { url, instructions: "A browser window should open. Complete login to finish." };
-	}
-
-	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
-		return exchangeCodeForToken(code, this.pkce.verifier, redirectUri);
-	}
-}
-
-async function exchangeCodeForToken(code: string, verifier: string, redirectUri: string): Promise<OAuthCredentials> {
-	const tokenResponse = await fetch(TOKEN_URL, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "authorization_code",
-			client_id: CLIENT_ID,
-			code,
-			code_verifier: verifier,
-			redirect_uri: redirectUri,
-		}),
-		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
-	});
-
-	if (!tokenResponse.ok) {
-		throw new Error(`Token exchange failed: ${tokenResponse.status}`);
-	}
-
-	const tokenData = (await tokenResponse.json()) as {
-		access_token?: string;
-		refresh_token?: string;
-		expires_in?: number;
-	};
-
-	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
-		throw new Error("Token response missing required fields");
-	}
-
-	const { accountId, email } = getTokenProfile(tokenData.access_token);
-	if (!accountId) {
-		throw new Error("Failed to extract accountId from token");
-	}
-
-	return {
-		access: tokenData.access_token,
-		refresh: tokenData.refresh_token,
-		expires: Date.now() + tokenData.expires_in * 1000,
-		accountId,
-		email,
-	};
-}
-
-/**
- * Login with OpenAI Codex OAuth
- */
-export type OpenAICodexLoginOptions = OAuthController & {
-	/** Optional originator value for OpenAI Codex OAuth. Default: "opencode". */
-	originator?: string;
-};
-
-export async function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials> {
-	const pkce = await generatePKCE();
-	const originator = options.originator?.trim() || "opencode";
-	const flow = new OpenAICodexOAuthFlow(options, pkce, originator);
-
-	return flow.login();
-}
-
-/**
- * Refresh OpenAI Codex OAuth token
- */
-export async function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials> {
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "refresh_token",
-			refresh_token: refreshToken,
-			client_id: CLIENT_ID,
-		}),
-		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
-	});
-
-	if (!response.ok) {
-		let detail = `${response.status}`;
-		try {
-			const body = (await response.json()) as { error?: string; error_description?: string };
-			if (body.error)
-				detail = `${response.status} ${body.error}${body.error_description ? `: ${body.error_description}` : ""}`;
-		} catch {}
-		throw new Error(`OpenAI Codex token refresh failed: ${detail}`);
-	}
-
-	const tokenData = (await response.json()) as {
-		access_token?: string;
-		refresh_token?: string;
-		expires_in?: number;
-	};
-
-	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
-		throw new Error("Token response missing required fields");
-	}
-
-	const { accountId, email } = getTokenProfile(tokenData.access_token);
-
-	return {
-		access: tokenData.access_token,
-		refresh: tokenData.refresh_token || refreshToken,
-		expires: Date.now() + tokenData.expires_in * 1000,
-		accountId: accountId ?? undefined,
-		email,
-	};
-}