#7796: Enable model login with OpenAI device code
cli
commands
stale
Cluster:
Model Authentication Enhancements
## Purpose
In a remote access setup, such as a Docker environment, it is easier to use device code to log in to the OpenAI Codex account. The current codebase didn't support it, and this PR added this feature.
## Changes
When mode (open-device-code) is selected, run `codex login --device-auth` with runCommandWithTimeout to print the code on the terminal. However, stdout and stderr default to "pipe", so device-code login was hanging without showing the URL/code because stdout/stderr were piped. We need to change them to inherit.
- Add `inheritChildStdOut` option to `runCommandWithTimeout`.
- Extend `resolveCommandStdio` to allow optional stdout/stderr inheritance.
## Tests
- `src/process/spawn-utils.test.ts` to test the behaviors of `runCommandWithTimeout` and `resolveCommandStdio,` when setting inheritChildStdOut to True and False (should stay the original results when being False).
- For the end-to-end tests on the login using a real account and the device code, we tested manually.
<!-- greptile_comment -->
<h2>Greptile Overview</h2>
<h3>Greptile Summary</h3>
This PR adds an interactive onboarding option `openai-device-code` that runs `codex login --device-auth` to support OpenAI/Codex login in remote environments (e.g., Docker), and extends process spawning utilities to optionally inherit child stdout/stderr so the device URL/code is visible.
Key wiring changes include new auth choice option/group entries and preferred provider mapping, plus a new `inheritChildStdOut` flag on `runCommandWithTimeout()` that routes through `resolveCommandStdio()`.
Main concern: with inherited stdout/stderr, `runCommandWithTimeout()` can no longer collect output into `SpawnResult.stdout/stderr`, but the new device-code path still assumes it can show captured output on failure. There’s also a test coverage regression where `spawnWithFallback` tests were removed entirely.
<h3>Confidence Score: 3/5</h3>
- Reasonably safe to merge, but error reporting for device-code login failures is likely misleading when stdio is inherited.
- The feature is straightforward and localized, but changing stdio behavior introduces a real semantic mismatch: inherited stdout/stderr cannot be captured, yet callers still treat `stdout/stderr` as available. Also, test coverage dropped for `spawnWithFallback`, reducing confidence against regressions in process spawning.
- src/process/exec.ts; src/commands/auth-choice.apply.openai.ts; src/process/spawn-utils.test.ts
<!-- greptile_other_comments_section -->
<sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub>
<!-- /greptile_comment -->
Most Similar PRs
#3591: CLI: add OpenAI-compatible endpoint auth choice
by surak · 2026-01-28
74.8%
#13079: feat: Add OpenAI-compatible API option to CLI for self-hosted models
by MikeWang0316tw · 2026-02-10
71.2%
#6730: feat: Make OpenAI Codex CLI models usable - reasoning effort directive
by levineam · 2026-02-02
71.2%
#8729: feat(auth): sync OpenAI Codex CLI credentials into auth store
by thosvesta · 2026-02-04
70.7%
#21884: feat(models): auth improvements — status command, heuristics, multi...
by kckylechen1 · 2026-02-20
69.9%
#8821: Security: Holistic capability-based sandbox (replaces pattern-match...
by tonioloewald · 2026-02-04
69.7%
#17605: fix: preserve scopes when disableControlUiDeviceAuth is enabled
by MisterGuy420 · 2026-02-16
69.5%
#21699: feat(agents): add opt-in OpenAI payload logging for embedded runs
by jcp · 2026-02-20
69.4%
#8876: Confirmaciones para equipo de IT
by m4xjunior · 2026-02-04
69.4%
#15306: fix: explicit exit after onboarding command completes
by jeroenbaas · 2026-02-13
69.1%