codex-oauth.json

gistfile1.txt

{
  "extends": "default",
  "meta": {
    "name": "codex-oauth",
    "description": "Codex CLI OAuth profile for login and normal sessions. Isolates CODEX_HOME and rewrites ChatGPT OAuth tokens to nono phantoms before they reach the sandbox."
  },
  "groups": {
    "include": [
      {
        "name": "user_caches_macos",
        "when": "macos"
      },
      {
        "name": "user_caches_linux",
        "when": "linux"
      },
      "node_runtime",
      "rust_runtime",
      "python_runtime",
      "nix_runtime",
      "git_config",
      "unlink_protection"
    ]
  },
  "filesystem": {
    "allow": [
      "$HOME/.codex-nono-oauth",
      "$HOME/.agents",
      "$NONO_CONFIG/profile-drafts"
    ],
    "read": [
      "$NONO_PACKAGES",
      "$NONO_CONFIG/profiles"
    ]
  },
  "environment": {
    "deny_vars": [
      "CODEX_*",
      "OPENAI_*",
      "ANTHROPIC_*",
      "GEMINI_*",
      "GOOGLE_*",
      "GITHUB_*",
      "GH_TOKEN"
    ],
    "set_vars": {
      "CODEX_HOME": "$HOME/.codex-nono-oauth"
    }
  },
  "network": {
    "block": false,
    "tls_intercept": {
      "ca_env_vars": [
        "CODEX_CA_CERTIFICATE"
      ]
    },
    "listen_port": [
      0,
      1455
    ]
  },
  "credential_providers": {
    "codex_openai": {
      "type": "oauth_capture",
      "token_endpoints": [
        {
          "host": "https://auth.openai.com",
          "path": "/oauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            },
            {
              "path": "id_token",
              "kind": "jwt"
            }
          ],
          "request_body": "form",
          "request_nonce_fields": [
            "refresh_token"
          ]
        },
        {
          "host": "https://auth.openai.com",
          "path": "/api/accounts/deviceauth/token",
          "response_fields": [
            {
              "path": "access_token",
              "kind": "opaque"
            },
            {
              "path": "refresh_token",
              "kind": "opaque"
            },
            {
              "path": "id_token",
              "kind": "jwt"
            }
          ],
          "request_body": "form",
          "request_nonce_fields": [
            "refresh_token"
          ]
        }
      ],
      "api_hosts": [
        "https://api.openai.com",
        "https://auth.openai.com"
      ],
      "credential_store": {
        "type": "file_json",
        "path": "$HOME/.codex-nono-oauth/auth.json",
        "phantom_fields": [
          "tokens.id_token",
          "tokens.access_token",
          "tokens.refresh_token"
        ]
      },
      "helpers": {
        "status": [
          "codex",
          "login",
          "status"
        ],
        "login": [
          "codex",
          "login"
        ],
        "logout": [
          "codex",
          "logout"
        ]
      }
    }
  },
  "credential_routes": [
    {
      "name": "codex_openai_oauth",
      "provider": "codex_openai"
    }
  ],
  "security": {
    "signal_mode": "isolated",
    "capability_elevation": false
  },
  "workdir": {
    "access": "readwrite"
  },
  "interactive": true,
  "open_urls": {
    "allow_origins": [
      "https://auth.openai.com",
      "https://api.openai.com"
    ],
    "allow_localhost": true
  },
  "allow_launch_services": true
}