Subscription auth: Codex ChatGPT OAuth + harness-carried model auth (supersedes #126, #128)

.codex/skills/dev-instance/SKILL.md

@@ -119,8 +119,14 @@ The dev instance should exercise the real system:
 
 - real LLM: needs a model credential for the harness you run. Core supports several
   (`HARNESS=pi|opencode|codex|claude`); the launcher picks one from the credentials it
-  finds and honours an explicit `HARNESS`. Set the key your chosen harness expects, or
-  pass `DEV_INSTANCE_ALLOW_MOCK=1` for a deliberate no-model wiring check
+  finds and honours an explicit `HARNESS`. Set the key your chosen harness expects. For
+  Codex, a ChatGPT OAuth session is also supported: `HARNESS=codex` discovers a valid
+  `$HOME/.codex/auth.json`, or you can set `CODEX_AUTH_FILE` to another auth file. Core
+  refreshes OAuth tokens centrally and hands the Codex child ephemeral material (no
+  refresh token). Pass `DEV_INSTANCE_ALLOW_MOCK=1` for a deliberate no-model wiring
+  check. The auth-file path is for local dev instances; deployed production processes
+  use an API key or a keychain credential (`CODEX_AUTH_CREDENTIAL` /
+  `CLAUDE_AUTH_CREDENTIAL`), whose secret lives encrypted in its owner's keychain.
 - real durability: uses `DATABASE_URL` when supplied; otherwise starts/reuses a local
   Docker Postgres container and runs core with `SESSION_STORE=postgres` and
   `RUN_STORE=postgres`

.env.example

@@ -1,5 +1,13 @@
 
 HARNESS=pi
+# Subscription-backed harness auth. Production path: point at a keychain
+# credential id (the login lives encrypted in its owner's keychain; core
+# refreshes it centrally and hands harnesses ephemeral derived material).
+#CODEX_AUTH_CREDENTIAL=
+#CLAUDE_AUTH_CREDENTIAL=
+# Local-dev fallback only: a Codex CLI auth.json on this machine
+# (defaults to ~/.codex/auth.json when HARNESS=codex). Not allowed in production.
+CODEX_AUTH_FILE=
 HARNESS_SECURITY_POSTURE=auto
 
 #ANTHROPIC_API_KEY=sk-ant-...

plugins/admin/public/index.html

@@ -7253,19 +7253,20 @@ <h2 id="governance-review-title">Confirm governance change</h2>
         const baseModel = config.data.baseModel || config.data.baseModelDefault || "";
         const baseProvider = onboardingProviderForModel(baseModel);
         const baseStatus = onboardingModelStatuses.find((item) => item.provider === baseProvider);
-        onboardingBadge(
-          "onboarding-model-badge",
-          baseStatus?.configured ? "Ready" : "Needs a key",
-          Boolean(baseStatus?.configured),
-        );
+        const harnessAuth = models.data.harnessAuth;
+        const baseHarnessAuth = Boolean(harnessAuth && harnessAuth.provider === baseProvider);
+        const baseReady = Boolean(baseModel) && (Boolean(baseStatus?.configured) || baseHarnessAuth);
+        onboardingBadge("onboarding-model-badge", baseReady ? "Ready" : "Needs a key", baseReady);
         $("onboarding-model-summary").textContent = !baseModel
           ? "No base model is configured yet — pick a provider and model below."
           : baseStatus?.configured
             ? baseModel + " · " + (baseStatus.source === "admin" ? "admin-managed key" : "deployment key")
-            : baseModel +
-              " cannot run until its " +
-              (MODEL_PROVIDER_LABELS[baseProvider] || connectorName(baseProvider)) +
-              " key is configured.";
+            : baseHarnessAuth
+              ? baseModel + " · authenticated by the " + harnessAuth.harnessId + " harness — no API key needed."
+              : baseModel +
+                " cannot run until its " +
+                (MODEL_PROVIDER_LABELS[baseProvider] || connectorName(baseProvider)) +
+                " key is configured.";
         renderOnboardingProviderOptions(baseProvider);
         renderOnboardingModelOptions(baseModel);
 

plugins/admin/test/onboarding-view.test.ts

@@ -28,6 +28,98 @@ function resolveView(pathname: string, search: string): string {
   return vm.runInContext(src, context);
 }
 
+interface FakeElement {
+  textContent: string;
+  className: string;
+  value: string;
+  placeholder: string;
+  disabled: boolean;
+  href: string;
+  options: Array<{ value?: string; textContent?: string }>;
+  appendChild(option: { value?: string; textContent?: string }): void;
+}
+
+async function runLoadOnboarding(modelProviders: unknown): Promise<Record<string, FakeElement>> {
+  const src = slice("let onboardingModels = {};", '$("onboarding-model-provider").onchange') + "\nloadOnboarding();";
+  const elements: Record<string, FakeElement> = {};
+  const fixtures: Record<string, unknown> = {
+    "/api/model-providers": modelProviders,
+    "/api/slack-installation": { configured: false },
+    "/api/connector-catalog": { catalog: [] },
+    "/api/scopes/org%3Adefault-org": { baseModel: "claude-opus-5" },
+  };
+  const context = vm.createContext({
+    $: (id: string) =>
+      (elements[id] ??= {
+        textContent: "",
+        className: "",
+        value: "",
+        placeholder: "",
+        disabled: false,
+        href: "",
+        options: [],
+        appendChild(option) {
+          this.options.push(option);
+        },
+      }),
+    api: async (_method: string, path: string) => ({ ok: true, data: fixtures[path] ?? {} }),
+    orgScope: () => "org:default-org",
+    encodeURIComponent,
+    setStatus: () => {},
+    connectorName: (id: string) => id,
+    viewLoadedAt: {},
+    Date,
+    document: { createElement: () => ({}) },
+  });
+  await vm.runInContext(src, context);
+  return elements;
+}
+
+const UNCONFIGURED_PROVIDERS = [
+  { provider: "anthropic", configured: false, source: "absent" },
+  { provider: "openai", configured: false, source: "absent" },
+  { provider: "openrouter", configured: false, source: "absent" },
+];
+const ANTHROPIC_MODELS = [{ id: "claude-opus-5", name: "Claude Opus 5", provider: "anthropic" }];
+
+test("harness-carried auth shows the model step as ready without a stored key", async () => {
+  const elements = await runLoadOnboarding({
+    providers: UNCONFIGURED_PROVIDERS,
+    models: ANTHROPIC_MODELS,
+    harnessAuth: { harnessId: "claude", provider: "anthropic" },
+  });
+  assert.equal(elements["onboarding-model-badge"]!.textContent, "Ready");
+  assert.equal(elements["onboarding-model-badge"]!.className, "badge ok");
+  assert.equal(
+    elements["onboarding-model-summary"]!.textContent,
+    "claude-opus-5 · authenticated by the claude harness — no API key needed.",
+  );
+});
+
+test("without harness auth an unconfigured provider still needs a key", async () => {
+  const elements = await runLoadOnboarding({
+    providers: UNCONFIGURED_PROVIDERS,
+    models: ANTHROPIC_MODELS,
+  });
+  assert.equal(elements["onboarding-model-badge"]!.textContent, "Needs a key");
+  assert.equal(elements["onboarding-model-badge"]!.className, "badge warn");
+  assert.match(elements["onboarding-model-summary"]!.textContent, /cannot run until its Anthropic key is configured/);
+});
+
+test("a stored key keeps its summary even when the harness also carries auth", async () => {
+  const elements = await runLoadOnboarding({
+    providers: [
+      { provider: "anthropic", configured: true, source: "admin" },
+      { provider: "openai", configured: false, source: "absent" },
+      { provider: "openrouter", configured: false, source: "absent" },
+    ],
+    models: ANTHROPIC_MODELS,
+    harnessAuth: { harnessId: "claude", provider: "anthropic" },
+  });
+  assert.equal(elements["onboarding-model-badge"]!.textContent, "Ready");
+  assert.equal(elements["onboarding-model-summary"]!.textContent, "claude-opus-5 · admin-managed key");
+});
+
 test("onboarding is a navigable view", () => {
   assert.match(html, /\{ label: "Admin", views: \["onboarding",/);
 });

scripts/dev/lib/envctx.ts

@@ -4,11 +4,13 @@ import { dirname, join } from "node:path";
 import { liveEnvPath } from "./pool.ts";
 import { bestEffort, readEnvFile, sha256Hex } from "./util.ts";
 import { run } from "./proc.ts";
+import { codexAuthFileForEnv, readCodexOAuthAuthFile } from "../../../src/harness/codex-auth-file.ts";
 
 export interface AssembledEnv {
   env: Record<string, string>;
   anthropicKeySource: string;
   openaiKeySource: string;
+  codexAuthSource: string;
   harness: "pi" | "mock" | "opencode" | "codex" | "claude";
   liveEnvFile: string;
   warnings: string[];
@@ -100,6 +102,7 @@ export async function assembleEnv(opts: {
   for (const [k, v] of Object.entries(readEnvFile(liveEnvFile))) {
     if (!env[k]) env[k] = v;
   }
+  const wtEnv = readEnvFile(join(opts.worktree, ".env"));
 
   let anthropicKeySource = "";
   if (opts.callerEnv.ANTHROPIC_API_KEY) anthropicKeySource = "your shell export";
@@ -112,7 +115,6 @@ export async function assembleEnv(opts: {
       anthropicKeySource = liveEnvFile;
     }
   }
-  const wtEnv = readEnvFile(join(opts.worktree, ".env"));
   if (!env.ANTHROPIC_API_KEY && wtEnv.ANTHROPIC_API_KEY) {
     env.ANTHROPIC_API_KEY = wtEnv.ANTHROPIC_API_KEY;
     anthropicKeySource = "the worktree .env";
@@ -125,13 +127,22 @@ export async function assembleEnv(opts: {
     openaiKeySource = "the worktree .env";
   }
 
+  if (!env.CODEX_AUTH_FILE && wtEnv.CODEX_AUTH_FILE) env.CODEX_AUTH_FILE = wtEnv.CODEX_AUTH_FILE;
+  let codexAuthSource = "";
+  const codexAuthCandidate = codexAuthFileForEnv({ ...env, ...opts.callerEnv }, true);
+  const codexOAuthConfigured = Boolean(codexAuthCandidate && readCodexOAuthAuthFile(codexAuthCandidate));
+  if (codexOAuthConfigured && codexAuthCandidate) {
+    env.CODEX_AUTH_FILE = codexAuthCandidate;
+    codexAuthSource = codexAuthCandidate;
+  }
+
   let harness: "pi" | "mock" | "opencode" | "codex" | "claude";
   if (opts.callerEnv.HARNESS === "codex" || opts.callerEnv.HARNESS === "claude") {
     harness = opts.callerEnv.HARNESS;
     env.HARNESS = harness;
-    if (harness === "codex" && !env.OPENAI_API_KEY) {
+    if (harness === "codex" && !env.OPENAI_API_KEY && !codexOAuthConfigured) {
       throw new Error(
-        "HARNESS=codex needs OPENAI_API_KEY (its CLI cannot do browser OAuth in a container) -- export it, or add it to the live env file or the worktree .env",
+        "HARNESS=codex needs OPENAI_API_KEY or a readable ChatGPT OAuth auth.json via CODEX_AUTH_FILE (or ~/.codex/auth.json)",
       );
     }
   } else if (env.ANTHROPIC_API_KEY) {
@@ -155,7 +166,7 @@ export async function assembleEnv(opts: {
     if (!env[k] && wtEnv[k]) env[k] = wtEnv[k];
   }
 
-  return { env, anthropicKeySource, openaiKeySource, harness, liveEnvFile, warnings };
+  return { env, anthropicKeySource, openaiKeySource, codexAuthSource, harness, liveEnvFile, warnings };
 }
 
 export function envFileGet(path: string, key: string): string {

scripts/dev/supervisor/main.ts

@@ -318,7 +318,9 @@ async function assembleAndPrepare(spec: BootSpec): Promise<SpecInputs> {
   let harnessDetail = `live ${assembled.harness} turns (anthropic key from ${assembled.anthropicKeySource})`;
   if (assembled.harness === "mock") harnessDetail = "mock turns";
   else if (assembled.harness === "codex") {
-    harnessDetail = `live codex turns (openai key from ${assembled.openaiKeySource || "the environment"})`;
+    harnessDetail = assembled.codexAuthSource
+      ? "live codex turns (ChatGPT OAuth auth.json)"
+      : `live codex turns (openai key from ${assembled.openaiKeySource || "the environment"})`;
   } else if (assembled.harness === "claude") harnessDetail = "live claude turns (native CLI authentication)";
   phase("env", "ok", harnessDetail);
 

scripts/dev/supervisor/specs.ts

@@ -21,6 +21,10 @@ export interface SpecInputs {
 export function buildChildSpecs(i: SpecInputs): ChildSpec[] {
   const watchArgs = i.watch ? ["--watch"] : [];
   const base = { ...i.baseEnv, ...i.sandboxEnv };
+  const siblingBase = Object.fromEntries(
+    Object.entries(base).filter(([key]) => key !== "HOME" && key !== "CODEX_HOME"),
+  );
+  siblingBase.CODEX_AUTH_FILE = "";
   const orgId = i.baseEnv.DEV_INSTANCE_ORG_ID || "acme";
   const signing: Record<string, string> = i.coreSigningSecret ? { CORE_SIGNING_SECRET: i.coreSigningSecret } : {};
   return [
@@ -58,7 +62,7 @@ export function buildChildSpecs(i: SpecInputs): ChildSpec[] {
       cwd: join(i.worktree, "plugins/web-ui"),
       argv: ["node", "--env-file-if-exists=.env", "server/index.ts"],
       env: {
-        ...base,
+        ...siblingBase,
         ...signing,
         PORT: String(i.ports.web),
         CORE_API_URL: `http://localhost:${i.ports.core}`,
@@ -78,7 +82,7 @@ export function buildChildSpecs(i: SpecInputs): ChildSpec[] {
       cwd: join(i.worktree, "plugins/admin"),
       argv: ["node", `--env-file-if-exists=${join(i.worktree, ".env")}`, ...watchArgs, "src/index.ts"],
       env: {
-        ...base,
+        ...siblingBase,
         ...signing,
         PORT: String(i.ports.admin),
         CORE_API_URL: `http://localhost:${i.ports.core}`,
@@ -95,7 +99,7 @@ export function buildChildSpecs(i: SpecInputs): ChildSpec[] {
       cwd: join(i.worktree, "plugins/portal"),
       argv: ["node", ...watchArgs, "src/index.ts"],
       env: {
-        ...base,
+        ...siblingBase,
         ...signing,
         PORT: String(i.ports.portal),
         PORTAL_PUBLIC_URL: `http://localhost:${i.ports.portal}`,

src/api/deps.ts

@@ -1,4 +1,4 @@
-import type { ModelProviderAvailability } from "../model/pi-models.ts";
+import type { ModelProvider, ModelProviderAvailability } from "../model/pi-models.ts";
 import type { ModelCredentialStore } from "../model/model-credential-store.ts";
 import type { CustomProviderStore } from "../model/custom-provider-store.ts";
 import type { McpServerStore } from "../mcp/mcp-server-store.ts";
@@ -94,6 +94,7 @@ export interface ServerDeps {
   refreshCustomProviders?: () => Promise<void>;
   brandingDefault?: OrgBranding;
   harnessId?: string;
+  harnessCarriedModelAuth?: ModelProvider;
   admin?: AdminService;
   rateLimiter?: RateLimiter;
   sessions?: SessionStore;

src/api/routes/admin/model-providers.ts

@@ -61,6 +61,9 @@ export async function getModelProviders(ctx: ApiCtx): Promise<void> {
   return sendJson(ctx.res, 200, {
     providers: await ctx.deps.modelCredentials.statuses(),
     models: await selectableModelCatalog(ctx.deps.modelCredentialFetch),
+    ...(ctx.deps.harnessCarriedModelAuth
+      ? { harnessAuth: { harnessId: ctx.deps.harnessId ?? "pi", provider: ctx.deps.harnessCarriedModelAuth } }
+      : {}),
   });
 }
 

src/api/routes/surface.ts

@@ -1062,6 +1062,8 @@ async function getSurfaceConfig(ctx: ApiCtx): Promise<void> {
   ]);
   const harnessId = deps.harnessId ?? "pi";
   const managedKeys = deps.modelCredentials ? await deps.modelCredentials.availability() : null;
+  const configuredKeys = deps.providerKeys ?? managedKeys;
+  const providerStatus = harnessId === "pi" && managedKeys ? managedKeys : configuredKeys;
   const catalog = managedKeys?.openrouter
     ? await selectableModelCatalog(deps.modelCredentialFetch)
     : builtInModelCatalog();
@@ -1079,7 +1081,9 @@ async function getSurfaceConfig(ctx: ApiCtx): Promise<void> {
     webuiModels: configuredPicker.length ? configuredPicker : allowed,
     baseModel: resolvedBase,
     harnessId,
-    ...(managedKeys ? { modelProviderConfigured: Object.values(managedKeys).some(Boolean) } : {}),
+    ...(providerStatus && {
+      modelProviderConfigured: Object.values(providerStatus).some(Boolean) || Boolean(deps.harnessCarriedModelAuth),
+    }),
     externalSlackParticipants,
     ...(Object.keys(resolvedBranding).length ? { branding: resolvedBranding } : {}),
   });