Skip to content

fix: support non-OAuth auth in login status check #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sudev-chirappat wants to merge 5 commits into from
+32 −1
Closed

fix: support non-OAuth auth in login status check #71

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4e99583
fix: support non-OAuth auth in login status check
sudev-chirappat Mar 31, 2026
e1db310
fix: use native fs for provider detection (Windows + single-quote sup…
sudev-chirappat Mar 31, 2026
ff79978
fix: also check project-level .codex/config.toml for custom providers
sudev-chirappat Apr 1, 2026
958487b
fix: resolve workspace root for project config and allow indented keys
sudev-chirappat Apr 1, 2026
83a32d5
fix: gate project config on trust state from global config
sudev-chirappat Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion plugins/codex/scripts/lib/codex.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,11 @@
* onProgress: ProgressReporter | null
* }} TurnCaptureState
*/
import { readJsonFile } from "./fs.mjs";
import { readJsonFile, safeReadFile } from "./fs.mjs";
import { BROKER_BUSY_RPC_CODE, BROKER_ENDPOINT_ENV, CodexAppServerClient } from "./app-server.mjs";
import { loadBrokerSession } from "./broker-lifecycle.mjs";
import { binaryAvailable, runCommand } from "./process.mjs";
import { resolveWorkspaceRoot } from "./workspace.mjs";

const SERVICE_NAME = "claude_code_codex_plugin";
const TASK_THREAD_PREFIX = "Codex Companion Task";
Expand Down Expand Up @@ -691,6 +692,12 @@ export function getSessionRuntimeStatus(env = process.env, cwd = process.cwd())
};
}

function isProjectTrusted(globalConfig, workspaceRoot) {
const escaped = workspaceRoot.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
const re = new RegExp(`\\[projects\\."${escaped}"\\][\\s\\S]*?trust_level\\s*=\\s*["']?trusted`);
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Restrict trust lookup to the matched project section

The trust check regex can cross section boundaries, so an untrusted workspace can be treated as trusted if any later [projects."..."] block in ~/.codex/config.toml has trust_level = "trusted". In isProjectTrusted, \[projects\."<path>"\][\s\S]*?trust_level... is not bounded to the current table, and getCodexLoginStatus then reads project .codex/config.toml and may report loggedIn: true for custom providers even though Codex would ignore that untrusted project config.

Useful? React with 👍 / 👎.

return re.test(globalConfig);
}

export function getCodexLoginStatus(cwd) {
const availability = getCodexAvailability(cwd);
if (!availability.available) {
Expand All @@ -701,6 +708,30 @@ export function getCodexLoginStatus(cwd) {
};
}

if (process.env.OPENAI_API_KEY) {
return {
available: true,
loggedIn: true,
detail: "authenticated via OPENAI_API_KEY"
};
}

const providerRe = /^\s*model_provider\s*=\s*["']?([^"'\s\r\n]+)["']?/m;
const globalConfigPath = `${process.env.HOME || process.env.USERPROFILE}/.codex/config.toml`;
const globalConfig = safeReadFile(globalConfigPath);
const workspaceRoot = resolveWorkspaceRoot(cwd);
const projectConfig = isProjectTrusted(globalConfig, workspaceRoot)
? safeReadFile(`${workspaceRoot}/.codex/config.toml`)
: "";
const providerMatch = projectConfig.match(providerRe) || globalConfig.match(providerRe);
if (providerMatch && providerMatch[1] !== "openai") {
return {
available: true,
loggedIn: true,
detail: "authenticated via custom model provider"
};
}

const result = runCommand("codex", ["login", "status"], { cwd });
if (result.error) {
return {
Expand Down