dsh-openai-codex-auth

Integrating OpenAI Codex into the DSH pi-ai stack used to mean hand-rolling the OAuth device-code flow, managing credential persistence, and handling concurrent write safety yourself. dsh-openai-codex-auth packages all of that into a standalone, independently versioned plugin: one install command surfaces a ChatGPT device-code login on the Models page, and uninstall cleanly removes the controller and credential contribution without touching the base adapter or adding a second model adapter.

Three capabilities stand out. First, credential storage serializes mutations both in-process and across processes; POSIX files are atomically replaced at mode 0600, and a provider-generation guard prevents a login that finishes after a logout from resurrecting a deleted credential. Second, the interactive-auth controller registers against the pi-ai credential seam and participates in the Models collection snapshot, so an in-flight request keeps its original store while later requests immediately observe load or unload. Third, Browser RPC payloads never carry tokens or raw provider responses; the model request itself sees no authentication material, yielding zero direct token cost and leaving KV-cache behavior entirely to the selected model.

This plugin is best for developers already working inside the DSH pi-ai ecosystem who want a reliable OpenAI Codex connection without maintaining their own OAuth state machine and file-locking logic. Today it exposes device-authorization as the sole login method, and activation requires the installed catalog to correctly surface the openai-codex OAuth entry. If your upstream DSH release has not yet exposed the piAiCredentials contribution interface, installation will fail loudly at startup rather than silently dropping OAuth persistence.