[rafaeelricco]

What's New

Device-Code OAuth

• OpenAI login now uses Codex device-code endpoints (/api/accounts/deviceauth/usercode and /token) instead of a loopback callback on port 1455, then exchanges the authorization code at auth.openai.com/oauth/token with redirect https://auth.openai.com/deviceauth/callback.
• xAI login now uses the RFC 8628 device-code grant (/oauth2/device/code, then /oauth2/token with urn:ietf:params:oauth:grant-type:device_code) instead of a loopback PKCE callback, retrying authorization_pending and slow_down.

Setup CLI

• Setup prints the one-time code, waits for confirm, then opens the verification URL and logs "Waiting for authentication...". Auth failures from any method are logged in run() instead of only after finalizeSetup.

Documentation

• README notes that ChatGPT and Grok sign-in use device code plus URL and work over SSH.

Device-Code Login Flow

flowchart TB
    A["Setup: ChatGPT or Grok OAuth"] --> B["Request device code"]
    B --> C{"Usercode OK?"}
    C -->|404 OpenAI| D["Tell user to enable Codex device auth"]
    C -->|OK| E["Show one-time code"]
    E --> F["Confirm to open verification URL"]
    F -->|Cancel| G["Setup cancelled"]
    F -->|Enter| H["Open browser"]
    H --> I["Poll token endpoint"]
    I --> J{"Poll result"}
    J -->|pending / slow_down| I
    J -->|complete| K["Store tokens and finish setup"]
    J -->|denied / expired / timeout| L["Log error and fail"]

Loading

Changed Files

File	Change Type	Summary
src/infra/auth/openai.ts	Modified	Codex device-code request, poll, and token exchange
src/infra/auth/xai.ts	Modified	RFC 8628 device-code request and token poll
src/cli/setup.ts	Modified	Device-code prompt, browser open, and error logging
README.md	Modified	SSH-friendly device-code login notes
test/infra/auth/openai.test.ts	Added	OpenAI device-code flow unit tests
test/infra/auth/xai.test.ts	Modified	xAI device-code flow unit tests
test/cli/setup.test.ts	Modified	Setup prompt and error-logging coverage

Additional for Run Locally

OpenAI device-code authorization

• Location/Access: ChatGPT → Settings → Security
• Setup: Turn on device code authorization for Codex before using Sign in with ChatGPT. xAI device login does not need this extra toggle.
• Notes: If the usercode endpoint returns 404, setup tells you to enable that setting or use an API key.

Testing & Feedback

Review the OpenAI device-code request, poll, token exchange, pending retries, and onDeviceCode coverage in test/infra/auth/openai.test.ts. Review the xAI device-code request, poll retries (authorization_pending, slow_down), access_denied, expired_token, and onDeviceCode coverage in test/infra/auth/xai.test.ts. Review the setup prompt, waiting log, and error logging on a failed xAI device login in test/cli/setup.test.ts.

If you find any bugs or have recommendations for improvements, please open an issue and assign it to me.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T16:12:55.280819Z	6f6a908	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.