Skip to content

Add experimental ChatGPT OAuth login for OpenAI - #1

Merged
robitec97 merged 3 commits into
robitec97:mainfrom
claudi47:experimental/openai-chatgpt-oauth
Jul 14, 2026
Merged

robitec97 merged 3 commits into
robitec97:mainfrom
claudi47:experimental/openai-chatgpt-oauth

Conversation

@claudi47

Copy link
Copy Markdown
Collaborator

Experimental ChatGPT login for OpenAI

Adds an experimental OAuth login option for ChatGPT Plus/Pro subscribers, while preserving API-key authentication.

  • Uses PKCE, renewable credentials, and the Codex backend.
  • OpenAI provider migrated to Responses API.
  • Verified live: browser login, normal response, and file write/read tool use.

The ChatGPT path remains experimental because OpenAI does not publish a third-party OAuth contract.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a66a98178d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/provider/openai.go Outdated
continue
}
if b.Kind == BlockText && b.Text != "" {
appendJSON(map[string]any{"role": "assistant", "content": []map[string]string{{"type": "output_text", "text": b.Text}}})

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve Responses assistant output items

For any OpenAI follow-up after a normal assistant text turn, this serializes prior assistant text as an easy input message containing output_text. The Responses input schema treats output_text as part of prior response.output message items, while easy input messages use input content; because parseOAIResponse discards the raw message item, the next request can be rejected or lose fields such as id/phase that must be replayed for multi-turn state. Preserve the raw message output item and replay it like the reasoning/function-call items instead.

Useful? React with 👍 / 👎.

robitec97 added a commit that referenced this pull request Jul 14, 2026
- Revert the synthetic assistant-text fallback in oaiResponseInput to
  output_text (d282f95 had switched it to input_text): the Responses API
  rejects input_text under the assistant role, and the only history that
  takes this path is the locally-built /compact ack, which live testing
  did not exercise. Added TestOpenAIReplaysSyntheticAssistantText and a
  ROADMAP live-check item to re-confirm on the Codex backend.
- Wire Options.OpenAIAuth only for the ChatGPT credential: API keys are
  static, so the post-401 refresh retry was a wasted duplicate request
  (and the adapter comment promised API-key callers never take it).
- Surface the real error when a ChatGPT token refresh fails at startup
  instead of the misleading "no credentials" message.
- Note the cross-process refresh-token rotation limit on
  chatGPTCredential.Token.
- Fix the broken sentence in the CLI usage text.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@robitec97
robitec97 merged commit 4a26799 into robitec97:main Jul 14, 2026
1 check passed
@robitec97

robitec97 commented Jul 14, 2026 •

Copy link
Copy Markdown
Owner

Mergiata in main (a112090) con alcuni follow-up dalla review — uno merita la tua attenzione:

Revert input_text → output_text nel fallback dei messaggi assistant (oaiResponseInput). Il commit d282f95 aveva cambiato il fallback in input_text, ma l'endpoint Platform rifiuta input_text sotto il ruolo assistant (accetta solo output_text/refusal). L'unico punto della history che passa da quel fallback è l'ack sintetico dopo /compact (agent.go), che i test live non coprivano — quindi il primo turno dopo una compattazione sarebbe andato in 400 con l'auth API-key. Il vero fix del replay era il mantenimento verbatim degli item (che resta). Se il passaggio a input_text era invece una necessità emersa live sul backend Codex, dimmelo: in quel caso va differenziato per backend, non condiviso. Ti chiederei di rifare il check live su Codex: /compact seguito da un turno normale.

Altri follow-up minori (dettagli nel commit):

  • Options.OpenAIAuth ora è cablato solo per la credenziale ChatGPT: con l'API key il retry post-401 rifaceva la stessa richiesta identica.
  • buildAgent ora propaga l'errore reale se il refresh del token fallisce all'avvio, invece del fuorviante "no credentials".
  • Documentato il limite delle sessioni concorrenti (rotazione del refresh token tra processi) su chatGPTCredential.Token.
  • Sistemata la frase spezzata nell'usage della CLI.

Restano nel ROADMAP come live-check da fare con credenziali reali: /compact su entrambe le modalità di auth, gli estremi di effort (minimal/xhigh) sui modelli curati, e la rotazione del token tra sessioni.

Bel lavoro sulla parte OAuth: PKCE + state su listener loopback, salvataggio atomico del config e pulizia della history al cambio di sign-in sono tutti dettagli giusti.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants