@f5-sales-demo/pi-ai 20.19.2 → 20.19.4

package/README.md

@@ -46,7 +46,8 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 
 ## Supported Providers
 
-- **OpenAI** (usage-based Platform API access)
+- **OpenAI** (usage-based Platform API access through `OPENAI_API_KEY`)
+- **OpenAI Codex** (ChatGPT Plus/Pro subscription through browser OAuth)
 - **Anthropic**
 - **Google**
 - **Vertex AI** (Gemini via Vertex AI)
@@ -1046,7 +1047,7 @@ bunx @f5-sales-demo/pi-ai list               # list available providers
 Credentials are saved to `agent.db` in the agent directory. `/login qianfan` opens the Qianfan console and stores the pasted API key.
 
 `login` supports OAuth providers (Anthropic, GitHub Copilot, Gemini CLI, Antigravity) and API-key onboarding flows.
-OpenAI uses usage-based Platform API access through `OPENAI_API_KEY`. For ChatGPT subscription access, use the official Codex CLI and run `codex login`.
+OpenAI has two credential paths. Use `OPENAI_API_KEY` for usage-based Platform API access. Use `login openai-codex` for ChatGPT Plus/Pro subscription OAuth; `login openai` explains the API-key path.
 
 For the current OpenAI-compatible integrations, API-key onboarding covers Together, Moonshot, Qianfan, NVIDIA, NanoGPT, Hugging Face, Venice, Xiaomi, vLLM, LiteLLM, Cloudflare AI Gateway, and Qwen Portal. Ollama is typically local and unauthenticated; set `OLLAMA_API_KEY` only when your Ollama deployment enforces bearer auth.
 
@@ -1138,7 +1139,7 @@ const response = await complete(
 
 ### Provider Notes
 
-**OpenAI**: Set `OPENAI_API_KEY` for usage-based Platform API access. ChatGPT subscription access is available through the official Codex CLI, not this library.
+**OpenAI**: Set `OPENAI_API_KEY` for usage-based Platform API access, or use the `openai-codex` OAuth provider for ChatGPT Plus/Pro subscription access.
 
 **GitHub Copilot**: If you get "The requested model is not supported" error, enable the model manually in VS Code: open Copilot Chat, click the model selector, select the model (warning icon), and click "Enable".
 

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/pi-ai",
-	"version": "20.19.2",
+	"version": "20.19.4",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -46,7 +46,7 @@
 		"@anthropic-ai/sdk": "^0.115",
 		"@aws-sdk/client-bedrock-runtime": "^3",
 		"@bufbuild/protobuf": "^2.11",
-		"@f5-sales-demo/pi-utils": "20.19.2",
+		"@f5-sales-demo/pi-utils": "20.19.4",
 		"@google/genai": "^2.15",
 		"@sinclair/typebox": "^0.34",
 		"@smithy/node-http-handler": "^4.4",

package/src/auth-storage.ts

@@ -51,6 +51,7 @@ import { loginMoonshot } from "./utils/oauth/moonshot";
 import { loginNanoGPT } from "./utils/oauth/nanogpt";
 import { loginNvidia } from "./utils/oauth/nvidia";
 import { loginOllama } from "./utils/oauth/ollama";
+import { loginOpenAICodex } from "./utils/oauth/openai-codex";
 import { loginOpenCode } from "./utils/oauth/opencode";
 import { loginParallel } from "./utils/oauth/parallel";
 import { loginPerplexity } from "./utils/oauth/perplexity";
@@ -174,8 +175,9 @@ const USAGE_CACHE_PREFIX = "usage_cache:";
 const USAGE_REPORT_TTL_MS = 30_000;
 const DEFAULT_USAGE_REQUEST_TIMEOUT_MS = 3_000;
 const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 10_000;
-const LEGACY_OPENAI_CODEX_PROVIDER = "openai-codex";
-const LEGACY_OPENAI_CODEX_DISABLED_CAUSE = "unsupported OpenAI Codex OAuth; remove manually with logout";
+
+/** Exact marker written by #3210 when valid ChatGPT credentials were regression-disabled. */
+export const OPENAI_CODEX_REGRESSION_DISABLED_CAUSE = "unsupported OpenAI Codex OAuth; remove manually with logout";
 
 type UsageCacheEntry<T> = {
 	value: T;
@@ -345,9 +347,7 @@ export class AuthStorage {
 	 * Used for CLI --api-key flag.
 	 */
 	setRuntimeApiKey(provider: string, apiKey: string): void {
-		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return;
-		this.#runtimeOverrides.set(provider, apiKey);
+		this.#runtimeOverrides.set(canonicalizeOAuthProviderId(provider), apiKey);
 	}
 
 	/**
@@ -658,13 +658,6 @@ export class AuthStorage {
 	 */
 	async set(provider: string, credential: AuthCredentialEntry): Promise<void> {
 		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) {
-			this.#store.replaceAuthCredentialsForProvider(provider, Array.isArray(credential) ? credential : [credential]);
-			this.#store.disableLegacyOpenAICodexCredentials();
-			this.#data.delete(provider);
-			this.#resetProviderAssignments(provider);
-			return;
-		}
 		const normalized = Array.isArray(credential) ? credential : [credential];
 		const deduped = this.#dedupeOAuthCredentials(provider, normalized);
 		const stored = this.#store.replaceAuthCredentialsForProvider(provider, deduped);
@@ -689,12 +682,6 @@ export class AuthStorage {
 	 */
 	async remove(provider: string): Promise<void> {
 		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) {
-			this.#store.hardDeleteAuthCredentialsForProvider(provider);
-			this.#data.delete(provider);
-			this.#resetProviderAssignments(provider);
-			return;
-		}
 		this.#store.deleteAuthCredentialsForProvider(provider, "deleted by user");
 		this.#data.delete(provider);
 		this.#resetProviderAssignments(provider);
@@ -720,7 +707,6 @@ export class AuthStorage {
 	 */
 	hasAuth(provider: string): boolean {
 		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return false;
 		if (this.#runtimeOverrides.has(provider)) return true;
 		if (this.#getCredentialsForProvider(provider).length > 0) return true;
 		if (getEnvApiKey(provider)) return true;
@@ -829,10 +815,14 @@ export class AuthStorage {
 					},
 				);
 				break;
+			case "openai-codex":
+				credentials = await loginOpenAICodex({
+					...ctrl,
+					onManualCodeInput: ctrl.onManualCodeInput ?? manualCodeInput,
+				});
+				break;
 			case "openai":
 				throw new Error("OpenAI uses usage-based API access. Set OPENAI_API_KEY instead of signing in.");
-			case "openai-codex":
-				throw new Error("OpenAI Codex OAuth is unsupported. Use official codex or set OPENAI_API_KEY for xcsh.");
 			case "gitlab-duo":
 				credentials = await loginGitLabDuo({
 					...ctrl,
@@ -1936,7 +1926,6 @@ export class AuthStorage {
 	 */
 	async peekApiKey(provider: string): Promise<string | undefined> {
 		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return undefined;
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {
 			return runtimeKey;
@@ -1979,7 +1968,6 @@ export class AuthStorage {
 	 */
 	async getApiKey(provider: string, sessionId?: string, options?: AuthApiKeyOptions): Promise<string | undefined> {
 		provider = canonicalizeOAuthProviderId(provider);
-		if (provider === LEGACY_OPENAI_CODEX_PROVIDER) return undefined;
 		// Runtime override takes highest priority
 		const runtimeKey = this.#runtimeOverrides.get(provider);
 		if (runtimeKey) {
@@ -2241,7 +2229,7 @@ export class AuthCredentialStore {
 			"INSERT INTO cache (key, value, expires_at) VALUES (?, ?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value, expires_at = excluded.expires_at",
 		);
 		this.#deleteExpiredCacheStmt = this.#db.prepare(`DELETE FROM cache WHERE expires_at <= ${SQLITE_NOW_EPOCH}`);
-		this.disableLegacyOpenAICodexCredentials();
+		this.reactivateRegressionDisabledOpenAICodexCredentials();
 	}
 
 	static async open(dbPath: string = getAgentDbPath()): Promise<AuthCredentialStore> {
@@ -2481,22 +2469,57 @@ export class AuthCredentialStore {
 	}
 
 	/**
-	 * List disabled credentials for inspection or explicit user-directed removal.
-	 * Legacy OpenAI Codex rows stay here; they are never reactivated automatically.
+	 * Reactivate credentials disabled solely by #3210. Rows disabled for any other reason are untouched.
+	 * When the same stored identity is already active, the regression-disabled duplicate is removed.
 	 */
-	listDisabledAuthCredentials(provider: string): StoredAuthCredential[] {
-		const rows = this.#listDisabledByProviderStmt.all(provider) as AuthRow[];
-		const results: StoredAuthCredential[] = [];
-		for (const row of rows) {
-			const credential = deserializeCredential(row);
-			if (credential) results.push(toStoredAuthCredential(row, credential));
-		}
-		return results;
-	}
+	reactivateRegressionDisabledOpenAICodexCredentials(): { reactivated: number; deduplicated: number } {
+		const provider = "openai-codex";
+		const migrate = this.#db.transaction(() => {
+			const activeRows = this.#listActiveByProviderStmt.all(provider) as AuthRow[];
+			const activeIdentities = new Set(
+				activeRows.flatMap(row => {
+					const identity = resolveRowCredentialIdentityKey(provider, row);
+					return identity ? [identity] : [];
+				}),
+			);
+			const disabledRows = this.#db
+				.prepare(
+					"SELECT id, provider, credential_type, data, disabled_cause, identity_key FROM auth_credentials WHERE provider = ? AND disabled_cause = ? ORDER BY id ASC",
+				)
+				.all(provider, OPENAI_CODEX_REGRESSION_DISABLED_CAUSE) as AuthRow[];
+			const reactivate = this.#db.prepare(
+				"UPDATE auth_credentials SET disabled_cause = NULL, updated_at = strftime('%s','now') WHERE id = ? AND disabled_cause = ?",
+			);
 
-	/** Disable unsupported Codex OAuth rows without deleting the user's stored data. */
-	disableLegacyOpenAICodexCredentials(): void {
-		this.deleteAuthCredentialsForProvider(LEGACY_OPENAI_CODEX_PROVIDER, LEGACY_OPENAI_CODEX_DISABLED_CAUSE);
+			let reactivated = 0;
+			let deduplicated = 0;
+			for (const row of disabledRows) {
+				const identity = resolveRowCredentialIdentityKey(provider, row);
+				if (identity && activeIdentities.has(identity)) {
+					this.#hardDeleteStmt.run(row.id);
+					deduplicated += 1;
+					continue;
+				}
+				const credential = deserializeCredential(row);
+				if (credential?.type === "oauth") {
+					// #3210 may have kept access-token expiry metadata beyond the token's server-side
+					// validity. Force the first post-migration use through the normal refresh path.
+					const serialized = serializeCredential(provider, { ...credential, expires: 0 });
+					if (serialized) {
+						this.#updateStmt.run(serialized.credentialType, serialized.data, serialized.identityKey, row.id);
+					}
+				}
+				const result = reactivate.run(row.id, OPENAI_CODEX_REGRESSION_DISABLED_CAUSE);
+				if (result.changes > 0) {
+					reactivated += 1;
+					if (identity) activeIdentities.add(identity);
+				}
+			}
+
+			return { reactivated, deduplicated };
+		});
+
+		return migrate();
 	}
 
 	replaceAuthCredentialsForProvider(provider: string, credentials: AuthCredential[]): StoredAuthCredential[] {
@@ -2656,15 +2679,6 @@ export class AuthCredentialStore {
 		}
 	}
 
-	/** Permanently remove credentials only after an explicit user logout/removal request. */
-	hardDeleteAuthCredentialsForProvider(provider: string): void {
-		try {
-			this.#db.prepare("DELETE FROM auth_credentials WHERE provider = ?").run(provider);
-		} catch {
-			// Ignore delete failures
-		}
-	}
-
 	getCache(key: string): string | null {
 		try {
 			const row = this.#getCacheStmt.get(key) as { value?: string } | undefined;

package/src/cli.ts

@@ -12,6 +12,7 @@ import { loginKilo } from "./utils/oauth/kilo";
 import { loginKimi } from "./utils/oauth/kimi";
 import { loginMiniMaxCode, loginMiniMaxCodeCn } from "./utils/oauth/minimax-code";
 import { loginNanoGPT } from "./utils/oauth/nanogpt";
+import { loginOpenAICodex } from "./utils/oauth/openai-codex";
 import { loginParallel } from "./utils/oauth/parallel";
 import { loginTavily } from "./utils/oauth/tavily";
 import type { OAuthCredentials, OAuthProvider } from "./utils/oauth/types";
@@ -126,6 +127,20 @@ async function login(provider: OAuthProvider): Promise<void> {
 					},
 				});
 				break;
+			case "openai-codex":
+				credentials = await loginOpenAICodex({
+					onAuth(info) {
+						const { url, instructions } = info;
+						console.log(`\nOpen this URL in your browser:\n${url}`);
+						if (instructions) console.log(instructions);
+						console.log();
+					},
+					async onPrompt(p) {
+						return await promptFn(`${p.message}${p.placeholder ? ` (${p.placeholder})` : ""}:`);
+					},
+				});
+				break;
+
 			case "kimi-code":
 				credentials = await loginKimi({
 					onAuth(info) {
@@ -321,9 +336,8 @@ Providers:
   github-copilot    GitHub Copilot
   google-gemini-cli Google Gemini CLI
   google-antigravity Antigravity (Gemini 3, Claude, GPT-OSS)
-
-OpenAI models use usage-based Platform API access. Set OPENAI_API_KEY, then select an OpenAI model.
-For ChatGPT subscription access, use the official codex CLI: codex login
+  openai-codex      ChatGPT Plus/Pro (Codex subscription)
+  openai            OpenAI Responses API (usage-based; set OPENAI_API_KEY)
   kimi-code         Kimi Code
   kilo              Kilo Gateway
   kagi              Kagi
@@ -416,15 +430,6 @@ Examples:
 				console.error("No provider selected");
 				process.exit(1);
 			}
-			if (provider === "openai-codex") {
-				if (storage.listDisabledAuthCredentials(provider).length === 0) {
-					console.error("No disabled legacy OpenAI Codex credentials found");
-					process.exit(1);
-				}
-				storage.hardDeleteAuthCredentialsForProvider(provider);
-				console.log("Removed disabled legacy OpenAI Codex credentials");
-				return;
-			}
 
 			const oauth = storage.getOAuth(provider);
 			const apiKey = storage.getApiKey(provider);
@@ -467,10 +472,9 @@ Examples:
 			process.exit(1);
 		}
 		if (provider === "openai") {
-			console.log(
-				"OpenAI Responses API uses usage-based Platform API access. Set OPENAI_API_KEY, then select an OpenAI model.",
-			);
-			console.log("For ChatGPT subscription access, use the official codex CLI: codex login");
+			console.log("OpenAI Responses API uses usage-based Platform API access.");
+			console.log("Set OPENAI_API_KEY, then select an OpenAI model.");
+			console.log("For ChatGPT subscription access, use: login openai-codex");
 			return;
 		}
 

package/src/providers/openai-codex/request-transformer.ts

@@ -85,6 +85,14 @@ export async function transformRequestBody(
 ): Promise<RequestBody> {
 	body.store = false;
 	body.stream = true;
+	// The ChatGPT Codex backend rejects sampling controls with `Unsupported parameter`.
+	// Generic stream options may supply defaults, so remove them at the provider boundary.
+	delete body.temperature;
+	delete body.top_p;
+	delete body.top_k;
+	delete body.min_p;
+	delete body.presence_penalty;
+	delete body.repetition_penalty;
 
 	if (body.input && Array.isArray(body.input)) {
 		body.input = filterInput(body.input);

package/src/stream.ts

@@ -80,6 +80,7 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	"opencode-go": "OPENCODE_API_KEY",
 	"opencode-zen": "OPENCODE_API_KEY",
 	cursor: "CURSOR_ACCESS_TOKEN",
+	"openai-codex": "OPENAI_CODEX_OAUTH_TOKEN",
 	"azure-openai-responses": "AZURE_OPENAI_API_KEY",
 	exa: "EXA_API_KEY",
 	jina: "JINA_API_KEY",
@@ -163,11 +164,6 @@ export function stream<TApi extends Api>(
 	context: Context,
 	options?: OptionsForApi<TApi>,
 ): AssistantMessageEventStream {
-	if (model.provider === "openai-codex") {
-		throw new Error(
-			"OpenAI Codex subscription access is unsupported in xcsh. Use official codex or an OpenAI API-key model.",
-		);
-	}
 	// Check custom API registry first (extension-provided APIs like "vertex-claude-api")
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {
@@ -248,11 +244,6 @@ export function streamSimple<TApi extends Api>(
 	context: Context,
 	options?: SimpleStreamOptions,
 ): AssistantMessageEventStream {
-	if (model.provider === "openai-codex") {
-		throw new Error(
-			"OpenAI Codex subscription access is unsupported in xcsh. Use official codex or an OpenAI API-key model.",
-		);
-	}
 	// Check custom API registry first (extension-provided APIs)
 	const customApiProvider = getCustomApi(model.api);
 	if (customApiProvider) {

package/src/utils/oauth/index.ts

@@ -8,6 +8,7 @@ import { refreshGitLabDuoToken } from "./gitlab-duo";
 import { refreshAntigravityToken } from "./google-antigravity";
 import { refreshGoogleCloudToken } from "./google-gemini-cli";
 import { refreshKimiToken } from "./kimi";
+import { refreshOpenAICodexToken } from "./openai-codex";
 import type {
 	OAuthCredentials,
 	OAuthProvider,
@@ -96,6 +97,9 @@ export { loginNanoGPT } from "./nanogpt";
 export { loginNvidia } from "./nvidia";
 // Ollama (optional API key)
 export { loginOllama } from "./ollama";
+export type { OpenAICodexLoginOptions } from "./openai-codex";
+// OpenAI Codex (ChatGPT OAuth)
+export { loginOpenAICodex, refreshOpenAICodexToken } from "./openai-codex";
 // OpenCode Zen / OpenCode Go (API key)
 export { loginOpenCode } from "./opencode";
 // Parallel (API key)
@@ -137,6 +141,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "Alibaba Coding Plan",
 		available: true,
 	},
+	{
+		id: "openai-codex",
+		name: "ChatGPT Plus/Pro (Codex Subscription)",
+		available: true,
+	},
 	{
 		id: "openai",
 		name: "OpenAI Responses API (usage-based API access)",
@@ -380,6 +389,9 @@ export async function refreshOAuthToken(
 			}
 			newCredentials = await refreshAntigravityToken(credentials.refresh, credentials.projectId);
 			break;
+		case "openai-codex":
+			newCredentials = await refreshOpenAICodexToken(credentials.refresh);
+			break;
 		case "openai":
 			newCredentials = credentials;
 			break;
@@ -459,9 +471,6 @@ export async function getOAuthApiKey(
 	if (!creds) {
 		return null;
 	}
-	if (provider === "openai-codex") {
-		return null;
-	}
 
 	if (provider === "perplexity") {
 		const normalizedExpires =

package/src/utils/oauth/openai-codex.ts

@@ -0,0 +1,255 @@
+/**
+ * OpenAI Codex (ChatGPT OAuth) flow.
+ */
+import { isRecord } from "../../utils";
+import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
+import { generatePKCE } from "./pkce";
+import type { OAuthController, OAuthCredentials } from "./types";
+
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize";
+const TOKEN_URL = "https://auth.openai.com/oauth/token";
+const CALLBACK_PORT = 1455;
+const CALLBACK_PATH = "/auth/callback";
+const CALLBACK_URI = `http://localhost:${CALLBACK_PORT}${CALLBACK_PATH}`;
+const SCOPE = "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const JWT_CLAIM_PATH = "https://api.openai.com/auth";
+const JWT_PROFILE_CLAIM = "https://api.openai.com/profile";
+const TOKEN_REQUEST_TIMEOUT_MS = 15_000;
+
+type JwtPayload = {
+	[JWT_CLAIM_PATH]?: {
+		chatgpt_account_id?: string;
+	};
+	[JWT_PROFILE_CLAIM]?: {
+		email?: string;
+	};
+	[key: string]: unknown;
+};
+
+function decodeJwt(token: string): JwtPayload | null {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return null;
+		const payload = parts[1] ?? "";
+		const decoded = Buffer.from(payload, "base64").toString("utf-8");
+		return JSON.parse(decoded) as JwtPayload;
+	} catch {
+		return null;
+	}
+}
+
+function getTokenProfile(accessToken: string): { accountId?: string; email?: string } {
+	const payload = decodeJwt(accessToken);
+	const auth = payload?.[JWT_CLAIM_PATH];
+	const accountId = auth?.chatgpt_account_id;
+	const email = payload?.[JWT_PROFILE_CLAIM]?.email?.trim().toLowerCase();
+	return {
+		accountId: typeof accountId === "string" && accountId.length > 0 ? accountId : undefined,
+		email: typeof email === "string" && email.length > 0 ? email : undefined,
+	};
+}
+
+interface PKCE {
+	verifier: string;
+	challenge: string;
+}
+
+function describeTokenEndpointValue(value: unknown): string | undefined {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : undefined;
+	}
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (!isRecord(value)) return undefined;
+
+	const code = describeTokenEndpointValue(value.code ?? value.error);
+	const message = describeTokenEndpointValue(value.message ?? value.error_description ?? value.description);
+	if (code && message && code !== message) return `${code}: ${message}`;
+	return code ?? message;
+}
+
+function redactTokenEndpointDetail(detail: string): string {
+	return detail
+		.replace(/(https?:\/\/[^\s?]+)\?[^\s)]+/gi, "$1?[REDACTED]")
+		.replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [REDACTED]")
+		.replace(
+			/\b(access_token|refresh_token|id_token|authorization_code|code|token|state)\b(\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,
+			"$1$2[REDACTED]",
+		)
+		.replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
+		.slice(0, 500);
+}
+
+/** Format useful OAuth token endpoint failures without echoing credentials or callback query strings. */
+export function formatOpenAICodexTokenEndpointError(status: number, bodyText: string): string {
+	const trimmed = bodyText.trim();
+	if (trimmed.length === 0) return `${status}`;
+
+	let detail: string | undefined;
+	try {
+		const body: unknown = JSON.parse(trimmed);
+		if (isRecord(body)) {
+			const error = describeTokenEndpointValue(body.error);
+			const description = describeTokenEndpointValue(body.error_description);
+			const message = describeTokenEndpointValue(body.message);
+			detail =
+				error && description && error !== description
+					? `${error}: ${description}`
+					: (error ?? description ?? message);
+		} else {
+			detail = describeTokenEndpointValue(body);
+		}
+	} catch {
+		detail = trimmed;
+	}
+
+	return detail ? `${status} ${redactTokenEndpointDetail(detail)}` : `${status}`;
+}
+
+/** Build the browser OAuth URL; exported for regression coverage. */
+export function createOpenAICodexAuthorizationUrl(args: {
+	state: string;
+	redirectUri: string;
+	challenge: string;
+	originator?: string;
+}): string {
+	const searchParams = new URLSearchParams({
+		response_type: "code",
+		client_id: CLIENT_ID,
+		redirect_uri: args.redirectUri,
+		scope: SCOPE,
+		code_challenge: args.challenge,
+		code_challenge_method: "S256",
+		state: args.state,
+		id_token_add_organizations: "true",
+		codex_cli_simplified_flow: "true",
+		originator: args.originator?.trim() || "pi",
+	});
+
+	return `${AUTHORIZE_URL}?${searchParams.toString()}`;
+}
+
+class OpenAICodexOAuthFlow extends OAuthCallbackFlow {
+	constructor(
+		ctrl: OAuthController,
+		private readonly pkce: PKCE,
+		private readonly originator: string,
+	) {
+		super(ctrl, {
+			preferredPort: CALLBACK_PORT,
+			callbackPath: CALLBACK_PATH,
+			redirectUri: CALLBACK_URI,
+		} satisfies OAuthCallbackFlowOptions);
+	}
+
+	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		return {
+			url: createOpenAICodexAuthorizationUrl({
+				state,
+				redirectUri,
+				challenge: this.pkce.challenge,
+				originator: this.originator,
+			}),
+			instructions: "A browser window should open. Complete login to finish.",
+		};
+	}
+
+	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		return exchangeCodeForToken(code, this.pkce.verifier, redirectUri);
+	}
+}
+
+async function exchangeCodeForToken(code: string, verifier: string, redirectUri: string): Promise<OAuthCredentials> {
+	const tokenResponse = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: CLIENT_ID,
+			code,
+			code_verifier: verifier,
+			redirect_uri: redirectUri,
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+	});
+
+	if (!tokenResponse.ok) {
+		const bodyText = await tokenResponse.text();
+		throw new Error(`Token exchange failed: ${formatOpenAICodexTokenEndpointError(tokenResponse.status, bodyText)}`);
+	}
+
+	const tokenData = (await tokenResponse.json()) as {
+		access_token?: string;
+		refresh_token?: string;
+		expires_in?: number;
+	};
+
+	if (!tokenData.access_token || !tokenData.refresh_token || typeof tokenData.expires_in !== "number") {
+		throw new Error("Token response missing required fields");
+	}
+
+	const { accountId, email } = getTokenProfile(tokenData.access_token);
+	if (!accountId) {
+		throw new Error("Failed to extract accountId from token");
+	}
+
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token,
+		expires: Date.now() + tokenData.expires_in * 1000,
+		accountId,
+		email,
+	};
+}
+
+export type OpenAICodexLoginOptions = OAuthController & {
+	/** Optional originator value. The default matches xcsh Codex request headers. */
+	originator?: string;
+};
+
+export async function loginOpenAICodex(options: OpenAICodexLoginOptions): Promise<OAuthCredentials> {
+	const pkce = await generatePKCE();
+	const originator = options.originator?.trim() || "pi";
+	const flow = new OpenAICodexOAuthFlow(options, pkce, originator);
+	return flow.login();
+}
+
+export async function refreshOpenAICodexToken(refreshToken: string): Promise<OAuthCredentials> {
+	const response = await fetch(TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken,
+			client_id: CLIENT_ID,
+		}),
+		signal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),
+	});
+
+	if (!response.ok) {
+		const bodyText = await response.text();
+		throw new Error(
+			`OpenAI Codex token refresh failed: ${formatOpenAICodexTokenEndpointError(response.status, bodyText)}`,
+		);
+	}
+
+	const tokenData = (await response.json()) as {
+		access_token?: string;
+		refresh_token?: string;
+		expires_in?: number;
+	};
+
+	if (!tokenData.access_token || typeof tokenData.expires_in !== "number") {
+		throw new Error("Token response missing required fields");
+	}
+
+	const { accountId, email } = getTokenProfile(tokenData.access_token);
+	return {
+		access: tokenData.access_token,
+		refresh: tokenData.refresh_token || refreshToken,
+		expires: Date.now() + tokenData.expires_in * 1000,
+		accountId,
+		email,
+	};
+}

package/src/utils/oauth/types.ts

@@ -34,7 +34,6 @@ export type OAuthProvider =
 	| "nanogpt"
 	| "ollama"
 	| "openai"
-	/** Legacy ID retained only so stored credentials can be explicitly removed. */
 	| "openai-codex"
 	| "opencode-go"
 	| "opencode-zen"