fix(codex): write token refresh to openai provider ID

[shuv1337]

Summary

• Fixes token refresh to write to openai provider ID instead of legacy codex
• Ensures backward compatibility with existing codex entries through migration fallback

Greptile Summary

This PR fixes the token refresh mechanism to write to the openai provider ID instead of the legacy codex ID, ensuring consistency across the codebase. The migration includes backward compatibility through a fallback mechanism in Auth.get() that automatically migrates legacy codex entries to openai when requested.

Key Changes:

• Token refresh in codex.ts:531 now writes to openai provider ID (was implicit legacy behavior)
• Migration fallback in Auth.get() handles existing codex entries transparently
• Enhanced OAuth flow to capture and store user metadata (email, name, plan, orgName)
• New /auth/info/:providerID API endpoint exposes authentication status to UI
• TUI components updated to display user email and subscription plan badges
• Comprehensive test coverage validates migration behavior and token refresh writes to correct provider ID

Additional Features:

• Skills registry infrastructure added (config.ts, registry.ts)
• openai_multi_account experimental config flag added for future multi-account support

Confidence Score: 4/5

• Safe to merge with minor considerations for the migration edge case and async fire-and-forget pattern
• The PR implements a well-tested migration with comprehensive test coverage. The core token refresh fix is straightforward and properly scoped. However, there's one edge case where multiple rapid calls to Auth.get("openai") could trigger duplicate migrations, and the fire-and-forget updatePlan() pattern lacks error visibility. These are minor issues that don't affect core functionality.
• Check packages/opencode/src/auth/index.ts for the migration race condition pattern, and verify the fire-and-forget async pattern in packages/opencode/src/plugin/codex.ts:632 meets your error handling requirements

Important Files Changed

Filename	Overview
packages/opencode/src/auth/index.ts	Added migration logic in get() to fallback to legacy codex provider when requesting openai auth, with automatic migration to openai key. Added new optional fields (email, name, plan, orgName) to OAuth schema.
packages/opencode/src/plugin/codex.ts	Updated token refresh to write to openai provider ID (line 531). Added extractUserInfo() function, fetchChatGPTUserInfo() for plan/org metadata retrieval, and normalizePlanType() helper. OAuth callback now extracts and stores email, name, plan, and orgName.
packages/opencode/src/provider/auth.ts	Added storage of new OAuth fields (email, name, plan, orgName) in the callback() function when processing successful OAuth results.
packages/opencode/test/auth/codex-migration.test.ts	New test file with comprehensive coverage of the migration logic: tests for non-existent providers, fresh openai auth, legacy codex migration, and verifies token refresh writes to openai (not codex).

Sequence Diagram

sequenceDiagram
    participant User
    participant Plugin as CodexAuthPlugin
    participant AuthModule as Auth Module
    participant API as ChatGPT API

    Note over User,API: Token Refresh Flow
    
    Plugin->>AuthModule: get("openai")
    alt openai exists
        AuthModule-->>Plugin: Return openai entry
    else fallback to codex
        Note over AuthModule: Migration logic
        AuthModule->>AuthModule: Check legacy codex
        AuthModule->>AuthModule: set("openai", legacy)
        AuthModule-->>Plugin: Return migrated entry
    end
    
    Plugin->>Plugin: Check expiration
    alt Expired
        Plugin->>API: Refresh request
        API-->>Plugin: New tokens
        Plugin->>AuthModule: set("openai", updated)
        Note over Plugin,AuthModule: Writes to openai ID
    end

    Note over User,API: OAuth Authentication Flow
    
    User->>Plugin: Start OAuth
    Plugin->>User: Browser redirect
    User->>API: Authorize
    API-->>Plugin: Callback
    Plugin->>Plugin: Extract user info
    Plugin->>API: Fetch metadata
    API-->>Plugin: Plan and org
    Plugin->>AuthModule: set("openai", full info)
    Note over Plugin,AuthModule: Includes metadata

Loading

[greptile-apps]

_{17 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

style: Consider adding a lock to prevent race conditions if Auth.get("openai") called multiple times rapidly - each call could trigger duplicate migrations before the first set() completes.

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/opencode/src/auth/index.ts
Line: 50:58

Comment:
**style:** Consider adding a lock to prevent race conditions if `Auth.get("openai")` called multiple times rapidly - each call could trigger duplicate migrations before the first `set()` completes.

How can I resolve this? If you propose a fix, please make it concise.