Codex Login Manager v1.0.0-beta.2

Codex Login Manager diagnoses Codex CLI authentication on macOS and starts the official ChatGPT OAuth login flow.

This community build is open source and ad-hoc signed, but it is not Apple-notarized yet. Try to open it once; if macOS blocks it, open System Settings > Privacy & Security, click Open Anyway for Codex Login Manager, and confirm Open. Never disable Gatekeeper globally.

The app reads ~/.codex/auth.json locally, invokes the installed official codex CLI, redacts secrets before showing command output, and does not upload credentials or write to config.toml.

Changes in v1.0.0-beta.2

Security

• Hardened named-secret redaction for quoted and escaped JSON fields, camelCase
  keys, authorization headers, bearer-token fields, OAuth client secrets, and
  opaque values wrapped across structurally bounded, indented lines.
• Hardened API-key and JWT redaction when token fragments are wrapped across
  adjacent indented lines. Ambiguous token-shaped continuation lines are now
  conservatively redacted, while blank lines, prose, structured diagnostics,
  and indentation rollbacks stop the scan.
• Redacted three-segment JWTs, including unsecured JWTs with an empty signature,
  and five-segment compact JWEs with the empty encrypted-key segment used by
  direct encryption.
• Rejected placeholder-like values and trailing secret text instead of trusting
  any value that merely starts with a redaction marker.
• Required a successful CLI exit and an exact positive status line before
  reporting ChatGPT login, so negated or failing output cannot spoof success.
• Stopped reflecting unrecognized auth_mode values from auth.json into the
  interface; unsupported modes now use fixed localized text.
• Preserved surrounding JSON fields and diagnostic structure instead of
  discarding internal indentation and blank lines during sanitization.

Tests

• Added adversarial coverage for quoted and escaped JSON, authorization headers,
  compact JWE, multiline secrets, CRLF output, malformed token shapes,
  identifier-boundary false positives, and idempotence.
• Added service-level tests using temporary Codex CLI executables to verify that
  stdout and stderr are both scrubbed, unfamiliar CLI text remains visible,
  malformed auth.json contents are never echoed, and unrecognized
  auth_mode values cannot reach visible status fields.
• Added status-parsing coverage proving that negated text and nonzero exits do
  not report a successful ChatGPT login.

Codex Login Manager v1.0.0-beta.1

Codex Login Manager is a native macOS utility for diagnosing Codex CLI authentication and restarting the official ChatGPT OAuth login flow.

What it checks

• Whether the active Codex CLI is using ChatGPT OAuth or API-key mode.
• The CLI inside ChatGPT.app, legacy Codex.app, or PATH.
• Missing, malformed, incomplete, or stale ~/.codex/auth.json state.
• Redacted output from the official codex login status command.

The app does not implement OAuth, receive passwords, upload credentials, or write to ~/.codex/config.toml. Signing in launches the installed official codex login command and checks the result again.

Download and verify

Download CodexLoginManager-v1.0.0-beta.1-macOS-universal.zip. The app supports both Apple Silicon and Intel Macs and requires macOS 14 or later.

Verify the archive beside SHA256SUMS.txt with:

shasum -a 256 -c SHA256SUMS.txt

Current beta limitation

This community build is ad-hoc signed but is not Apple Developer ID signed or notarized yet. On first launch, Control-click CodexLoginManager.app, choose Open, and confirm. Never disable Gatekeeper globally. You can also review the source and build locally.

中文说明

这个版本会检查 Codex CLI 当前使用 ChatGPT OAuth 还是 API key，定位 ChatGPT.app、旧 Codex.app 或 PATH 中的 CLI，并区分 auth.json 缺失、损坏、不完整和登录过期等状态。登录按钮只会启动官方 codex login，本工具不接收密码、不上传凭据，也不写入 config.toml。

下载包同时支持 Apple Silicon 和 Intel Mac，要求 macOS 14 或更高版本。当前社区 beta 使用 ad-hoc 签名，尚未经过 Apple 公证；首次启动请按住 Control 点击应用，选择“打开”并确认，不要全局关闭 Gatekeeper。