chat: sign in to Codex (a ChatGPT plan) in the browser, and codeaf connect from the terminal

[AbirAbbas]

Santosh's ask (Slack, 2026-09-21): the browser sign-in OpenRouter already has, for Codex too, and a terminal door for signing in.

What changes

• Codex is a model service. /connect has a Codex row that says browser; enter opens the sign-in the Codex CLI uses (S256 PKCE, the fixed loopback callback on 1455 then 1457), the waiting card keeps the address to copy, and a finished sign-in moves the conversation to codex/gpt-5.5. The models are the account's own list; ids are codex/<slug> everywhere.
• The wire. The provider client keeps speaking chat completions. A translating transport on provider.Config.HTTPClient turns each turn into a Responses-API request on the ChatGPT backend and its stream back into the chunks the client already decodes: text, reasoning summaries, tool calls, usage. Encrypted reasoning rides the reasoning_details field the session already round-trips. Tokens live in an owner-only codex.json in the profile, registered for redaction, refreshed single-flight with the file re-read first.
• codeaf connect [service] [--no-browser] [--region intl|cn] and codeaf disconnect <service>. openrouter and codex sign in in the browser (or print the address, with the ssh -L line for a machine without one); the key services take a key on stdin or ask without echo; no argument lists what this profile knows. Under Housekeeping on codeaf --help.
• No price is ever shown for a codex call. Tokens are counted. A spent plan window ends the turn with codex reached your chatgpt plan's usage limit · it resets on its own; an expired sign-in with codex sign-in has expired · /connect or codeaf connect codex signs in again.
• The manual, README and GUIDE say all of the above, including that this signs in the way the Codex CLI does and OpenAI's terms for a ChatGPT plan apply.

Out of scope, and said so in the pages: first run (unchanged, OpenRouter only), the device-code road, OpenAI API keys (the custom-service row), Codex's own base instructions, websockets.

How it was verified

• Every contract item in the spec has a named test; the wire is proven through a real provider.Client, the real config chain and a real session.Agent against httptest issuer and backend servers. No real host is contacted by any test.

• A fixture drive of the built binary (a fake issuer that redirects like a browser that clicked yes, and a fake backend): the printed authorize address carries exactly the Codex CLI's parameters; the callback lands codex connected · <email> · pro plan; the token file is mode 0600; the code exchange happens and no API-key exchange does; codeaf connect lists the row as connected; a --once turn reaches the backend with the bearer, chatgpt-account-id, originator, OpenAI-Beta, store:false, stream:true, non-empty instructions and no OpenRouter attribution; no dollar figure is printed; no token appears in any output; codeaf disconnect codex removes the file.

• Constants were read from the installed Codex CLI binary and Codex's own source, and the backend's models listing was called once with the owner's own Codex sign-in to ground the vendored fallback list.

• The default road. Every step of the first drive used --no-host, the in-process door, and the owner found on the real screen that a plain codeaf chat answered the Codex row with codex did not connect · codex browser sign-in is unavailable here: the ordinary launch takes the engine road, whose screen is assembled by the --host builder plus localDoors, and the Codex seam had been handed to the in-process door alone (the same family as The plain launch keeps this machine's doors: /connect, /harness, always and /model on the engine road #906). localDoors now hands it over, the doors test asserts both sides, and the drive has a phase that runs bare codeaf in a pristine home, goes through /connect → Codex with a stub browser on PATH, lands codex connected · <email> · pro plan on the card, answers say hi through the daemon, then runs --once without --no-host. Against the build before the fix that phase fails with the owner's exact sentence; on this head every check passes.

• The real backend. Two turns on the real ChatGPT backend from a throwaway profile seeded with the owner's Codex CLI access token (a placeholder refresh token, so the CLI's own sign-in was never rotated): a plain reply, and a tool call round trip. No token bytes in any output.

What only the owner can verify: a real click-through on auth.openai.com with a real ChatGPT plan.

Found on the way and filed, not in this PR: #1383 — a Codex model keeps the previous model's context window because the listing's context_window (272k) is dropped.

What the adversarial review found, and what the fix round closed

A read-only review of the first seven commits refuted eight claims, all now fixed with a test that would fail on regression:

• Refresh across processes. Two codeaf processes near expiry could invalidate each other's rotated refresh token. The refresh now holds the repository's file lock across load, refresh and save, and re-reads first, so whichever process refreshed wins (proven with two re-executed test processes sharing one token file against an issuer that invalidates a refresh token after one use).
• Only the issuer signs you out. A 429, a 5xx or a network error during refresh no longer clears the token file; only the issuer's own 400/401 marks the sign-in expired.
• The expiry sentence reaches the person, headless or in the chat, and a token file deleted underneath a running conversation is the same condition. The dispatcher does not spend its retry walk on a dead credential.
• A failed or cut reply is an error, not a success. response.failed and error events become a classifiable 402 or 502 on both the streaming and whole-response roads; an incomplete reply carries length only for max_output_tokens.
• The transport's tokens never leave it. Every body, status and error it returns is scrubbed; provider's error ingress and the call log scrub as a second boundary; a fake backend that echoes the bearer in a 400 leaves no token bytes in the turn's error, the transcript, the call log or the debug record.
• The last catalog road. The media resolver built a catalog without the codex client; every connected-service catalog now comes from one constructor, and a go/ast law refuses any other literal.
• A headless plan refusal keeps its own words. A --once run used to end every 401/402/403-class refusal with your key was not accepted for this model, for Z.ai as much as for Codex; both roads now end it the way the chat already did: the service, that the account cannot pay, and what the vendor said.
• Also: absent usage stays absent; a browser that would not start says so and the terminal keeps waiting; the listener test pins 1455 then 1457; first run is rendered and asserted to offer no Codex.

A second read-only review of the fixed branch closed those and added a refresh that could wait forever behind another process sitting in an issuer round trip with no deadline. Now the issuer exchange has a thirty-second deadline, both locks are taken without blocking and given up when the turn is cancelled or after a minute with one plain sentence, and the lock file is owner-only. From the same round: provider's error ingress removes only the credentials this process registered and leaves every other byte alone; an expired sign-in is accounted once through the taxonomy like any terminal failure instead of short-circuiting the loop; the transcript journal and the error event scrub assembled text at write time (the journal only for registered credentials, so a key a person pasted into their own message replays on resume exactly as written); and the catalog law refuses an assignment to Source as well as a literal.

Evidence, the fixture, and both review ledgers are in the handoff folder on the owner's machine; the fixture drive of the final binary passes all thirteen checks. One unrelated load-sensitive session test surfaced in the local gate and is filed as #1339.

🤖 Generated with Claude Code