Module codex 

Codex (ChatGPT) sign-in: artifactize’s own OAuth tokens in $STATE/auth/codex.json, or a Codex auth file that artifactize only reads.

The protocol follows Pi’s openai-codex provider (pi-mono packages/ai/src/auth/oauth/openai-codex.ts): the Codex public OAuth client, PKCE with S256, the localhost:1455 callback or a pasted redirect URL, the authorization-code and refresh-token grants, and the ChatGPT account ID from the access token’s https://api.openai.com/auth claim. Revocation on logout follows the Codex CLI (codex-rs/login/src/auth/revoke.rs). Callers must never print or log a token.

Structs

Prompt

What a sign-in asks the person to do: open url, and whether the browser can return to this machine’s callback (when the port is taken, only a pasted redirect URL finishes it).

Timestamp

Token

A bearer token and the ChatGPT account it belongs to. Never printed or logged.

TokenError

Why no token is available. A transient failure (the token endpoint unreachable or failing with 429 or 5xx) may succeed on a retry; any other means signing in again.

Enums

FileExpiry

A read-only file can carry a usable token without an expiry claim. An expired file reports no timestamp because the existing reader refuses it before returning a token.

Status

Offline sign-in states: only file states have a path, only stored states have a mandatory expiry, and a storage refusal can only accompany an absent sign-in.

StoredExpiry

Owned credentials always carry the expiry saved by the token exchange.

Constants

AUTH_FILE_VARIABLE

A Codex auth file (for example ~/.codex/auth.json) to read instead of artifactize’s own tokens. It is never written, copied or refreshed.

AUTH_URL_VARIABLE

A loopback test endpoint replacing the sign-in root, beside the backends’ own.

CLIENT_ID

The Codex CLI’s public OAuth client, which Pi’s provider uses too.

ORIGINATOR

The originator that sign-in and every Codex request name.

Functions

access_token

A usable token: from the read-only auth file when one is set, else artifactize’s own, refreshed under a cross-process lock when it is about to expire.

auth_file

The configured read-only auth file, if any.

auth_root

The sign-in root: its loopback test endpoint, else https://auth.openai.com.

login

Sign in interactively and save artifactize’s own tokens. The sign-in URL goes to stderr, also with –json.

login_with

The sign-in behind login codex for any interface: show receives the prompt once the callback listener is up, pasted may deliver the redirect URL the browser was sent to, and browser hands the URL to the desktop’s opener. It ends when the tokens are saved, the sign-in fails, or after five minutes; dropping the future stops it and frees the port.

logout

Revoke and remove artifactize’s own tokens; a read-only auth file is left alone. Returns whether the revocation was confirmed.

status

Inspect the sign-in offline: no lock, refresh, network or writes.