got claude auth for codex

[acoliver]

What happened?

What did you expect to happen?

it shouldn't cause auth if I'm not using a claude profile or provider... (or if it does it should be for codex but it wasn't invalid)

Client information

About LLxprt Code

CLI Version 0.10.0-nightly.260403.86d44b2f6
Git Commit 6485690
Model codex:gpt-5.3-codex
Provider codex
Base URL https://chatgpt.com/backend-api/codex
Sandbox no sandbox
OS darwin

Login information

No response

Anything else we need to know?

No response

[acoliver]

@CodeRabbit investiaget this

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
gh issue view 1878 --repo vybestack/llxprt-code --json title,body,labels,assignees,comments,state,author,createdAt,url

Length of output: 2504

---

Let me dig into the codebase to understand the auth flow.

---

🏁 Script executed:

#!/bin/bash
echo "=== Find auth-related files ==="
fd -e ts -e js auth --exclude node_modules --exclude dist

echo ""
echo "=== Search for Claude auth / OAuth trigger code ==="
rg -rn --type ts "claude.*auth|auth.*claude" -i -C3

echo ""
echo "=== Search for OAuth flow entry points ==="
rg -rn --type ts "oauth|OAuthFlow|ensureAuth|requiresAuth|needsAuth" -C3 -l

echo ""
echo "=== Find provider selection logic ==="
rg -rn --type ts "provider.*codex|codex.*provider|getProvider|selectProvider" -C3 -l

Length of output: 44267

---

🏁 Script executed:

#!/bin/bash
echo "=== auth-flow-orchestrator.ts ==="
cat packages/cli/src/auth/auth-flow-orchestrator.ts

echo ""
echo "=== global-oauth-ui.ts ==="
cat packages/cli/src/auth/global-oauth-ui.ts

echo ""
echo "=== oauth-provider-registration.ts ==="
cat packages/cli/src/providers/oauth-provider-registration.ts

echo ""
echo "=== MultiBucketAuthenticator.ts ==="
cat packages/cli/src/auth/MultiBucketAuthenticator.ts

Length of output: 33456

---

🏁 Script executed:

#!/bin/bash
echo "=== validateNonInterActiveAuth.ts ==="
cat packages/cli/src/validateNonInterActiveAuth.ts

echo ""
echo "=== anthropic-oauth-defaults.test.ts (to understand what anthropic-oauth-defaults does) ==="
cat packages/cli/src/runtime/anthropic-oauth-defaults.test.ts

echo ""
echo "=== Search for where anthropic OAuth is triggered unconditionally ==="
rg -rn --type ts "anthropic" packages/cli/src/runtime/ -C3

echo ""
echo "=== postConfigRuntime.ts ==="
cat packages/cli/src/config/postConfigRuntime.ts

echo ""
echo "=== profileApplication.ts (key parts) ==="
rg -n "anthropic\|oauth\|auth\|OAuthEnabled\|oauthEnabled" packages/cli/src/runtime/profileApplication.ts -C2 -i

Length of output: 136990

---

🏁 Script executed:

#!/bin/bash
echo "=== providerSwitch.ts ==="
cat packages/cli/src/runtime/providerSwitch.ts

echo ""
echo "=== proactive-renewal-manager.ts ==="
cat packages/cli/src/auth/proactive-renewal-manager.ts

echo ""
echo "=== auth-status-service.ts ==="
cat packages/cli/src/auth/auth-status-service.ts

Length of output: 52164

---

🏁 Script executed:

#!/bin/bash
echo "=== OnAuthErrorHandlerImpl.ts ==="
cat packages/cli/src/auth/OnAuthErrorHandlerImpl.ts

echo ""
echo "=== OAuthBucketManager.ts ==="
cat packages/cli/src/auth/OAuthBucketManager.ts

echo ""
echo "=== useOAuthOrchestration.ts ==="
cat packages/cli/src/ui/hooks/useOAuthOrchestration.ts

echo ""
echo "=== Search for where 'anthropic' is referenced in oauth-manager.ts ==="
rg -n "anthropic\|getToken\|authenticate\|onAuthError" packages/cli/src/auth/oauth-manager.ts -i -C3 | head -150

Length of output: 9925

---

🏁 Script executed:

#!/bin/bash
echo "=== anthropic-oauth-provider.ts ==="
cat packages/cli/src/auth/anthropic-oauth-provider.ts

echo ""
echo "=== Search for __oauth_needs_code across codebase ==="
rg -rn "__oauth_needs_code" -C3

echo ""
echo "=== oauth-manager.ts getToken and key methods ==="
rg -n "getToken\|authenticate\|onAuthError\|requiresAuth\|isOAuthEnabled" packages/cli/src/auth/oauth-manager.ts -C3 | head -200

Length of output: 38529

---

🏁 Script executed:

#!/bin/bash
echo "=== codex-oauth-provider.ts ==="
sed -n '1,240p' packages/cli/src/auth/codex-oauth-provider.ts || true
sed -n '241,520p' packages/cli/src/auth/codex-oauth-provider.ts || true

echo ""
echo "=== oauth-manager.ts (show full for call sites) ==="
sed -n '1,220p' packages/cli/src/auth/oauth-manager.ts || true
sed -n '221,520p' packages/cli/src/auth/oauth-manager.ts || true
sed -n '521,1000p' packages/cli/src/auth/oauth-manager.ts || true

echo ""
echo "=== search: authenticate('anthropic') ==="
rg -nP "authenticate\\(['\"]anthropic['\"]" -C3 || true

echo ""
echo "=== search: toggleOAuthEnabled('anthropic') ==="
rg -nP "toggleOAuthEnabled\\(['\"]anthropic['\"]" -C3 || true

echo ""
echo "=== search: ensureOAuthProviderRegistered\\(\\s*['\"]anthropic['\"] ==="
rg -nP "ensureOAuthProviderRegistered\\(\\s*['\"]anthropic['\"]" -C3 || true

Length of output: 66691

---

@acoliver Thanks — I dug into #1878 (“got claude auth for codex”). Here’s what I found and how we can fix it:

What’s happening

• The OAuth “paste code” dialog opens whenever a global flag is set: useOAuthOrchestration.ts polls global.n and opens the dialog unconditionally. It does not check which provider is active.
• The Anthropic (Claude) OAuth flow sets:
  • global.__oauth_provider = 'anthropic'
  • global.n = true
    via AnthropicOAuthProvider.armPendingAuthDialog().
• Codex OAuth never sets global.n (it uses a local callback or device flow + oauth_url items). So if you see a “Claude” dialog while on provider=codex, something elsewhere set global.n — almost certainly Anthropic’s initiateAuth() ran.
• I verified the main switch path: handleAnthropicOAuth in runtime/providerSwitch.ts only runs when switching TO anthropic and when autoOAuth is true; it won’t run for codex. ProactiveRenewalManager won’t start new auth either (only refreshes when OAuth is already enabled).

Likely trigger

• A background call or prior state ended up invoking oauthManager.authenticate('anthropic') (e.g., transient provider alias ‘n’ in a profile or onboarding path), which set global.n and popped the dialog. Because the UI opens the dialog for any provider when n=true, you saw the Claude dialog even though your active provider was codex.

Low-risk fix (UI guard)

• Gate the dialog by provider. Only open when the pending dialog’s provider matches the current active provider. We already track the intended provider in global.__oauth_provider.

Proposed patch

• Change useOAuthOrchestration.ts so it checks both the flag and the provider match before opening:

// packages/cli/src/ui/hooks/useOAuthOrchestration.ts
import { getCliRuntimeServices } from '../../runtime/runtimeAccessors.js';

export function useOAuthOrchestration({ appDispatch, isOAuthCodeDialogOpen }: UseOAuthOrchestrationOptions): void {
  useEffect(() => {
    const checkOAuthFlag = setInterval(() => {
      const g = global as Record<string, unknown>;
      const needsCode = Boolean(g.n);
      const pendingProvider = typeof g.__oauth_provider === 'string' ? (g.__oauth_provider as string) : undefined;

      // Read active provider from runtime
      let activeProvider: string | undefined;
      try {
        activeProvider = getCliRuntimeServices().providerManager.getActiveProviderName?.();
      } catch {
        // no-op
      }

      // Only open if the pending auth is for the active provider
      if (needsCode && (!pendingProvider || pendingProvider === activeProvider)) {
        g.n = false;
        appDispatch({ type: 'OPEN_DIALOG', payload: 'oauthCode' });
      }
    }, 100);

    return () => clearInterval(checkOAuthFlag);
  }, [appDispatch]);

  // existing auto-dismiss effect unchanged...
}

Why this helps

• If some code path accidentally kicks off Anthropic OAuth while you’re on codex, the UI won’t open an Anthropic dialog. The oauth_url item will still show in history (from globalOAuthUI), but the intrusive paste-code modal will not hijack the session.

Next steps I can take

• Add a debug log when we open the dialog including pendingProvider and activeProvider to aid future triage.
• Optionally tighten the back-end: add a lightweight guard in OAuthManager/AuthFlowOrchestrator to prevent initiateAuth for a provider different from the active provider unless explicitly requested (but the UI-side guard above is the safest minimal change).

Can you share the exact steps that led to the screenshot (especially if a profile or alias ‘n’ was selected momentarily), and whether this reproduces after a fresh run with no prior Anthropic OAuth? I can wire a short PR with the UI gating change once you confirm.