Chatgpt Codex Oauth Provider

# Goose ChatGPT Codex OAuth Provider

Session capture: 2026-05-29.

## Durable finding

Goose has a native ChatGPT Codex OAuth provider named `chatgpt_codex`. For the user's local machine this is the preferred Goose route when the goal is to use his Codex OAuth. Do not force the Kimi/Infisical path just because Goose setup is usually provider/API-key based.

## Provider facts

- Provider: `chatgpt_codex`
- Default model observed in Goose source: `gpt-5.5`
- Known model family observed: `gpt-5.5`, `gpt-5.4`, `gpt-5.3-codex`
- Reasoning effort config key: `CHATGPT_CODEX_REASONING_EFFORT`
- Valid efforts observed: `low`, `medium`, `high`, `xhigh`
- Token cache path: `~/.config/goose/chatgpt_codex/tokens.json`
- Token cache file shape:
  - `access_token`
  - `refresh_token`
  - `id_token`
  - `expires_at`
  - `account_id`

## Safe bootstrap from Codex CLI OAuth

If Codex CLI is already logged in through ChatGPT OAuth, its auth file may contain the same token material Goose needs.

Source:
- `~/.codex/auth file`

Target:
- `~/.config/goose/chatgpt_codex/tokens.json`

Safe rules:
1. Never print raw token values.
2. Read only structure/metadata when reporting.
3. Write Goose token cache mode `0600`.
4. Prefer deriving `expires_at` from the JWT `exp` claim in the access token.
5. Derive `account_id` from existing Codex token metadata or JWT auth claims if present.
6. Back up an existing Goose token cache before replacing it.

Verification command shape: