feat(accounts): export OpenCode auth json by lNimien · Pull Request #532 · Soju06/codex-lb

lNimien · 2026-05-01T11:44:28Z

Summary

Add per-account export for stock OpenCode auth.json payloads.
Add dashboard copy/download flow with truncated token previews for long access and refresh tokens.
Add backend/frontend coverage plus OpenSpec change artifacts for the new export flow.

Changes

Area	Change
Backend	Added `POST /api/accounts/{account_id}/export/opencode-auth` endpoint.
Backend	Decrypts stored account tokens and returns stock OpenCode-compatible `auth.json`.
Backend	Derives `expires` from the access token JWT `exp` claim in epoch milliseconds.
Backend	Adds audit event `account_auth_exported` without logging token material.
Frontend	Adds `Export OpenCode auth` action to account details.
Frontend	Adds export dialog with warning, account metadata, token previews, copy buttons, and download button.
Frontend	Keeps downloaded/copied `auth.json` complete while truncating long tokens visually.
Tests	Adds backend integration tests for successful export and missing account.
Tests	Adds frontend schema and dialog tests.
OpenSpec	Adds `add-opencode-auth-export` proposal, design, specs, tasks, and verification report.

Test Plan

.venv\Scripts\python -m pytest tests/integration/test_account_opencode_auth_export.py tests/unit/test_auth.py -q -ra
- Result: 6 passed, 1 skipped
- Skip is expected on Windows for POSIX chmod behavior.
bun run test src/features/accounts/schemas.test.ts src/features/accounts/components/opencode-auth-export-dialog.test.tsx
- Result: 2 files passed, 8 tests passed
Manual UI smoke test locally
- Verified modal does not overflow with long tokens.
- Verified token previews are truncated.
- Verified per-token copy buttons.
- Verified full auth.json copy/download still works.
openspec validate --specs
- Blocked locally because the openspec CLI is not installed/available on PATH.

Notes

The exported file intentionally uses stock OpenCode format:

{
  "openai": {
    "type": "oauth",
    "refresh": "...",
    "access": "...",
    "expires": 1234567890000,
    "accountId": "..."
  }
}

Account email is shown only as dashboard metadata and is not included in the downloaded auth.json.
Token values are never logged in the audit event.

Allow users to move a selected account into stock OpenCode without relying on custom multi-account auth fields.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d915f4f4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-01T11:47:58Z

+        access_token = self._encryptor.decrypt(account.access_token_encrypted)
+        refresh_token = self._encryptor.decrypt(account.refresh_token_encrypted)
+        expires = token_expiry_epoch_ms(access_token) or 0
+        opencode_account_id = account.chatgpt_account_id or account.id


Preserve null OpenCode accountId when ChatGPT ID is missing

Falling back to account.id here can generate an authJson.openai.accountId value that is not a real ChatGPT account ID (e.g. deduplicated IDs like acc_xxx_<hash> or local fallback IDs). For accounts where chatgpt_account_id is absent, this exports a misleading accountId instead of leaving it unset, and OpenCode will then send that invalid value as ChatGPT-Account-Id, which can cause downstream auth/account selection failures for those exported credentials.

Useful? React with 👍 / 👎.

# Conflicts: # frontend/src/features/accounts/components/accounts-page.tsx

Komzpa · 2026-05-16T17:52:49Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 766d2e0b12

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-16T17:57:12Z

+        access_token = self._encryptor.decrypt(account.access_token_encrypted)
+        refresh_token = self._encryptor.decrypt(account.refresh_token_encrypted)
+        expires = token_expiry_epoch_ms(access_token) or 0
+        opencode_account_id = account.chatgpt_account_id or account.id


Keep accountId null when ChatGPT account id is unknown

When chatgpt_account_id is missing, this code falls back to account.id and exports that as authJson.openai.accountId. Internal account IDs can be synthetic (for example email_.../local_... or hashed variants), so the export may inject a non-ChatGPT identifier into OpenCode auth and cause downstream requests to send an invalid account header instead of omitting it. The payload should leave accountId unset/null unless a real ChatGPT account id exists.

Useful? React with 👍 / 👎.

Soju06 · 2026-05-21T06:10:04Z

Maintainer cleanup: closing this as stale / no longer merge-ready against the current main.

This PR has been open across substantial main-branch churn and is currently carrying at least one stale signal (conflicts/blocked or failing checks, outstanding codex: needs work, draft/old branch state, or overlap with newer/current implementation). Keeping it open is making the PR queue harder to reason about.

If the change is still needed, please open a fresh, focused PR rebased on current main with green CI and a clean Codex review.

Komzpa · 2026-05-21T13:22:11Z

Revived on a maintainer-owned branch as #757 because this PR head has maintainerCanModify=false and cannot be updated here. Keeping credit to the original implementation in the replacement PR.

feat(accounts): export OpenCode auth json

5d915f4

Allow users to move a selected account into stock OpenCode without relying on custom multi-account auth fields.

chatgpt-codex-connector Bot reviewed May 1, 2026

View reviewed changes

lNimien and others added 3 commits May 1, 2026 19:49

ci(docker): publish fork image to ghcr

cbe730f

Merge remote-tracking branch 'origin/main' into repair/pr532

48bbf13

# Conflicts: # frontend/src/features/accounts/components/accounts-page.tsx

test: satisfy auth export type check

766d2e0

Komzpa mentioned this pull request May 16, 2026

Tested live aggregate stack and suggested merge order #554

Closed

chatgpt-codex-connector Bot reviewed May 16, 2026

View reviewed changes

Komzpa added 🤖 codex: needs work [@codex review] raised an issue 🤖 codex: ok [@codex review] says no issues found. and removed 🤖 codex: needs work [@codex review] raised an issue 🤖 codex: ok [@codex review] says no issues found. labels May 16, 2026

Soju06 closed this May 21, 2026

Komzpa added needs rebase Needs rebase or conflict repair against current main stale No response from reporter; scheduled for close labels May 21, 2026

Komzpa mentioned this pull request May 21, 2026

feat(accounts): export OpenCode auth json #757

Merged

Komzpa added superseded Replaced by another PR, issue track, or merged implementation and removed 🤖 codex: needs work [@codex review] raised an issue needs rebase Needs rebase or conflict repair against current main labels May 21, 2026

Soju06 added the 🤖 codex: needs work [@codex review] raised an issue label May 21, 2026

Komzpa removed the 🤖 codex: needs work [@codex review] raised an issue label May 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(accounts): export OpenCode auth json#532

feat(accounts): export OpenCode auth json#532
lNimien wants to merge 4 commits into
Soju06:mainfrom
lNimien:feat/opencode-auth-export

lNimien commented May 1, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 1, 2026

Uh oh!

Komzpa commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 16, 2026

Uh oh!

Soju06 commented May 21, 2026

Uh oh!

Komzpa commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

lNimien commented May 1, 2026

Summary

Changes

Test Plan

Notes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

Komzpa commented May 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 16, 2026

Choose a reason for hiding this comment

Uh oh!

Soju06 commented May 21, 2026

Uh oh!

Komzpa commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants