codex oauth · Codex OAuth model connector

Key features

• Built on the published seam packages (@deepseek-ai/dsh-llm, @deepseek-ai/cordis) — no fork, no core change.
• The store document is written atomically with 0600 permissions under a 0700 directory, and a group/world-readable document is refused on POSIX.
• src/store.ts — FileCredentialStore, a persistent pi-ai CredentialStore with serialized read-modify-write (dsh-atomic-write).
• pi-ai's provider-owned Codex OAuth flows handle the wire protocol: browser login with a local callback server, headless device-code login, and automatic refresh under a cross-process credential-store lock.
• Tokens live in $DSH_HOME/codex-oauth.json (0600, owner-only directory), the same place the CLI bin and the harness plugin both read.