Add OpenAI Codex OAuth provider support

README.md

@@ -44,6 +44,7 @@ Config file: `~/.clawlet/config.json`
 clawlet currently supports these LLM providers:
 
 - **OpenAI** (`openai/<model>`, API key: `env.OPENAI_API_KEY`)
+- **OpenAI Codex (OAuth)** (`openai-codex/<model>`, no API key; login: `clawlet provider login openai-codex`)
 - **OpenRouter** (`openrouter/<provider>/<model>`, API key: `env.OPENROUTER_API_KEY`)
 - **Anthropic** (`anthropic/<model>`, API key: `env.ANTHROPIC_API_KEY`)
 - **Gemini** (`gemini/<model>`, API key: `env.GEMINI_API_KEY` or `env.GOOGLE_API_KEY`)
@@ -89,7 +90,21 @@ Minimal config (Local via vLLM using the same `ollama/` route):
 }
 ```
 
-clawlet will fill in sensible defaults for missing sections (tools, gateway, cron, heartbeat, channels).
+OpenAI Codex (OAuth):
+
+```bash
+# one-time login
+clawlet provider login openai-codex
+
+# headless environment (SSH / container)
+clawlet provider login openai-codex --device-code
+```
+
+```json
+{
+  "agents": { "defaults": { "model": "openai-codex/gpt-5.1-codex" } }
+}
+```
 
 ### Option: Memory search setup
 

cmd/clawlet/cmd_provider.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/mosaxiv/clawlet/llm"
+	"github.com/urfave/cli/v3"
+)
+
+const oauthProviderOpenAICodex = "openai-codex"
+
+func cmdProvider() *cli.Command {
+	return &cli.Command{
+		Name:  "provider",
+		Usage: "provider authentication utilities",
+		Commands: []*cli.Command{
+			{
+				Name:      "login",
+				Usage:     "authenticate an OAuth provider",
+				ArgsUsage: "<provider>",
+				Flags: []cli.Flag{
+					&cli.BoolFlag{
+						Name:  "device-code",
+						Usage: "use OAuth device code flow (for headless environments)",
+					},
+				},
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					if cmd.Args().Len() < 1 {
+						return cli.Exit("usage: clawlet provider login <provider>", 2)
+					}
+					switch cmd.Args().Get(0) {
+					case oauthProviderOpenAICodex:
+						return loginOpenAICodex(ctx, cmd.Bool("device-code"))
+					default:
+						return cli.Exit(fmt.Sprintf("unsupported oauth provider: %s (supported: %s)", cmd.Args().Get(0), oauthProviderOpenAICodex), 1)
+					}
+				},
+			},
+		},
+	}
+}
+
+func loginOpenAICodex(ctx context.Context, useDeviceCode bool) error {
+	if tok, err := llm.LoadCodexOAuthToken(); err == nil && tok.Valid() {
+		fmt.Printf("already authenticated with OpenAI Codex (%s)\n", tok.AccountID)
+		return nil
+	}
+	fmt.Println("starting OpenAI Codex OAuth login...")
+	var err error
+	if useDeviceCode {
+		err = llm.LoginCodexOAuthDeviceCode(ctx)
+	} else {
+		err = llm.LoginCodexOAuthInteractive(ctx)
+	}
+	if err != nil {
+		return err
+	}
+	tok, err := llm.LoadCodexOAuthToken()
+	if err != nil {
+		return err
+	}
+	fmt.Printf("authenticated with OpenAI Codex (%s)\n", tok.AccountID)
+	return nil
+}

cmd/clawlet/config.go

@@ -120,7 +120,7 @@ func resolveWorkspace(flagValue string) (string, error) {
 
 func providerNeedsAPIKey(provider string) bool {
 	switch strings.ToLower(strings.TrimSpace(provider)) {
-	case "ollama":
+	case "ollama", "openai-codex":
 		return false
 	default:
 		return true

cmd/clawlet/main.go

@@ -19,6 +19,7 @@ func main() {
 			cmdStatus(),
 			cmdAgent(),
 			cmdGateway(),
+			cmdProvider(),
 			cmdChannels(),
 			cmdCron(),
 		},

config/config.go

@@ -259,6 +259,7 @@ const (
 	DefaultMemorySearchHybridTextWeight    = 0.3
 	DefaultMemorySearchCandidateMultiplier = 4
 	DefaultOpenAIBaseURL                   = "https://api.openai.com/v1"
+	DefaultOpenAICodexBaseURL              = "https://chatgpt.com/backend-api"
 	DefaultOpenRouterBaseURL               = "https://openrouter.ai/api/v1"
 	DefaultAnthropicBaseURL                = "https://api.anthropic.com"
 	DefaultGeminiBaseURL                   = "https://generativelanguage.googleapis.com/v1beta"
@@ -541,6 +542,8 @@ func (cfg *Config) ApplyLLMRouting() (provider string, configuredModel string) {
 				cfg.LLM.BaseURL = DefaultGeminiBaseURL
 			case "ollama":
 				cfg.LLM.BaseURL = DefaultOllamaBaseURL
+			case "openai-codex":
+				cfg.LLM.BaseURL = DefaultOpenAICodexBaseURL
 			default:
 				cfg.LLM.BaseURL = DefaultOpenAIBaseURL
 			}
@@ -570,6 +573,8 @@ func (cfg *Config) ApplyLLMRouting() (provider string, configuredModel string) {
 		switch provider {
 		case "openai":
 			cfg.LLM.BaseURL = DefaultOpenAIBaseURL
+		case "openai-codex":
+			cfg.LLM.BaseURL = DefaultOpenAICodexBaseURL
 		case "openrouter":
 			cfg.LLM.BaseURL = DefaultOpenRouterBaseURL
 		case "anthropic":
@@ -602,6 +607,9 @@ func (cfg *Config) ApplyLLMRouting() (provider string, configuredModel string) {
 
 func parseRoutedModel(s string) (provider string, model string) {
 	s = strings.TrimSpace(s)
+	if after, ok := strings.CutPrefix(s, "openai-codex/"); ok {
+		return "openai-codex", after
+	}
 	if after, ok := strings.CutPrefix(s, "openai/"); ok {
 		return "openai", after
 	}

config/config_test.go

@@ -186,6 +186,27 @@ func TestApplyLLMRouting_OllamaLocal(t *testing.T) {
 	}
 }
 
+func TestApplyLLMRouting_OpenAICodex(t *testing.T) {
+	cfg := Default()
+	cfg.Agents.Defaults.Model = "openai-codex/gpt-5.1-codex"
+	cfg.LLM.BaseURL = ""
+	cfg.LLM.APIKey = ""
+
+	provider, _ := cfg.ApplyLLMRouting()
+	if provider != "openai-codex" {
+		t.Fatalf("provider=%q", provider)
+	}
+	if cfg.LLM.BaseURL != DefaultOpenAICodexBaseURL {
+		t.Fatalf("baseURL=%q", cfg.LLM.BaseURL)
+	}
+	if cfg.LLM.APIKey != "" {
+		t.Fatalf("apiKey=%q", cfg.LLM.APIKey)
+	}
+	if cfg.LLM.Model != "gpt-5.1-codex" {
+		t.Fatalf("model=%q", cfg.LLM.Model)
+	}
+}
+
 func TestApplyLLMRouting_LocalAlias(t *testing.T) {
 	cfg := Default()
 	cfg.Agents.Defaults.Model = "local/qwen2.5:14b"

llm/client.go

@@ -48,6 +48,8 @@ func (c *Client) Chat(ctx context.Context, messages []Message, tools []ToolDefin
 		return c.chatAnthropic(ctx, messages, tools)
 	case "gemini":
 		return c.chatGemini(ctx, messages, tools)
+	case "openai-codex":
+		return c.chatOpenAICodex(ctx, messages, tools)
 	default:
 		return nil, fmt.Errorf("unsupported llm provider: %s", strings.TrimSpace(c.Provider))
 	}