Native ChatGPT/Codex subscription sign-in without the Codex CLI installed

[Hmbown]

User report (2026-08-31): connecting a ChatGPT/Codex subscription currently requires the Codex CLI installed, because the only credential source for the openai-codex route is the external ~/.codex/auth.json (now behind the explicit-consent path from #5772). Most harnesses (e.g. opencode) offer a native browser sign-in.

Current state (verified from source):

• The codex_oauth route itself is first-class: openai-codex provider, Responses API via https://chatgpt.com/backend-api, oauth_only, official-route guard in route_runtime.
• crates/tui/src/oauth.rs only loads the external CLI's auth.json (read-only, consent-gated after Make provider selection explicit; stop implicit external CLI credential reuse #5772). There is no PKCE authorize/callback flow.
• xAI already has this solved the right way: xai_oauth.rs implements native device-code login against auth.x.ai with refresh, no grok CLI needed.

Acceptance:

• /provider setup openai-codex (or picker) offers 'Sign in with ChatGPT' — browser PKCE flow with a localhost callback (or device code if offered by the issuer), storing tokens in CodeWhale's own secure store with refresh, independent of any Codex CLI install.
• Token custody stays local; same consent/disclosure language family as Make provider selection explicit; stop implicit external CLI credential reuse #5772; revoke path included.
• The external-CLI import path remains as an explicit alternative, not a prerequisite.
• Picker/setup copy distinguishes 'subscription (ChatGPT sign-in)' from API-key billing ownership before any run.
• Terms check first: confirm OpenAI's current terms permit third-party harness sign-in via the published Codex OAuth client; if ambiguous, document the boundary rather than smuggling it.

Related: #5772 (explicit consent for external CLI credentials), #5755 (picker authority), #5092 (Responses provider-profiling).

[Hmbown]

Research receipt (2026-08-31, sources verified against openai/codex @ main):

ToS position: no explicit OpenAI prohibition or permission for third-party harnesses using the Codex OAuth public client — unwritten-tolerance territory (unlike Anthropic's explicit ban). Mitigations: honest originator: codewhale (never impersonate codex_cli_rs), local-only tokens, respect server rate-limit signals, clean API-key fallback.

Technical flow (from codex-rs/login): client_id app_EMoamEEZ73f0CkXaXp7hrann, issuer https://auth.openai.com, PKCE S256, loopback 127.0.0.1:1455 (fallback 1457 — the only registered redirect ports), scope openid profile email offline_access, token exchange at /oauth/token, optional RFC 8693 id-token→API-key exchange (not required — access token is used directly as Bearer against chatgpt.com/backend-api/codex/responses). Refresh tokens are single-use rotating — persist rotated tokens atomically; refresh_token_reused/expired/invalidated and 401/invalid_grant are permanent → re-login. Headless variant exists via /api/accounts/deviceauth/*.

Transport requirements: ChatGPT-Account-ID header from the id_token claim, originator, versioned User-Agent, session-id per conversation, store:false, stream:true, include:[reasoning.encrypted_content], optional residency header. OAuth route serves only Codex-eligible models (opencode filters via allowlist+heuristic).

Implementation shape (~300-line PKCE login module mirroring codex-rs/login/src/server.rs + pkce.rs; device-code variant for headless; ~/.codewhale/auth.json 0600 with optional keyring; single-flight refresh; revoke-on-logout). Reference implementations: opencode packages/opencode/src/plugin/openai/codex.ts, codex-rs login/src/server.rs.