Chatgpt auth fixes - #212
Merged
Merged
Conversation
Replace host-seeded ~/.codex/auth.json sharing (which broke when one session's proxy rotated a refresh token, invalidating it for others) with an explicit --provider chatgpt opt-in: every session runs its own codex login inside the container, and paude-proxy (bumped to dcfc77827d09e73d418b631897347a9d9c35d9b1) captures and manages the resulting tokens independently per session. Restricted to the local Podman/Docker backend for now; --backend openshift is rejected since it has no equivalent credential/injection wiring. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codex's own `codex login` always does the ChatGPT OAuth device flow regardless of paude's --provider flag, so a session created without --provider chatgpt could still log in successfully while silently missing the websocket-disabling HTTP/SSE profile and chatgpt.com domain allowlist, since those were gated behind that explicit flag. Flip the default so `paude create --agent codex` gets ChatGPT-plan mode out of the box; --provider openai remains for API-key auth (required on --backend openshift, which chatgpt mode still can't support). Also fixes the OpenShift rejection guard to check the resolved provider instead of the raw CLI flag, so the guard still triggers when chatgpt is picked up implicitly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Fresh Codex ChatGPT-plan containers get a synthetic auth.json so the CLI never shows a login prompt, but before any session-local `codex login` completes, paude-proxy has no real tokens to inject and every request silently failed with a 502. paude-proxy now distinguishes "no tokens yet" from a genuine injection failure and returns 401 for the former, giving Codex's auth-recovery path an actionable signal instead of an opaque gateway error. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Writing a well-formed but fake auth.json on every session start made Codex CLI believe it was already logged in, so it skipped its own login prompt and went straight to making API calls — which paude-proxy had no real tokens for yet, since `codex login` had never actually run. paude now only installs the ChatGPT provider profile TOML and leaves auth.json alone; Codex's native login flow creates it, paude-proxy swaps in synthetic values at the token exchange as before, and the file then persists across stop/start of the same session since paude no longer overwrites it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
token_vending.go's errorResponse() helper built *http.Response values without a Request field, which crashed goproxy with a nil pointer dereference when the response was written back over the HTTPS/MITM tunnel (e.g. LOGIN_SANITIZE rejecting a malformed token exchange). All error responses now carry the originating request. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This cleans up various issues with the chatgpt oauth flow for codex CLI. The refresh tokens are one-time use, so we don't do any injection of those into the container and instead expect the user to use the device code login flow to authenticate inside their paude containers.