CI: openai_codex provider (matrix check for upstream PR #1195)

README.md

@@ -155,6 +155,8 @@ For local models, configure Ollama with `llm_provider: "ollama"`. The default en
 
 For any other OpenAI-compatible server (vLLM, LM Studio, llama.cpp, or a custom relay), use `llm_provider: "openai_compatible"` and set the endpoint via `backend_url` (or `TRADINGAGENTS_LLM_BACKEND_URL`), e.g. `http://localhost:8000/v1` for vLLM or `http://localhost:1234/v1` for LM Studio. The model is whatever your server serves. No key is needed for local servers; set `OPENAI_COMPATIBLE_API_KEY` when the endpoint requires one.
 
+To bill runs to a ChatGPT subscription instead of API credits, use `llm_provider: "openai_codex"`. It reuses the login held by the official Codex app or CLI (`~/.codex/auth.json`, overridable with `TRADINGAGENTS_CODEX_AUTH_PATH`), so sign in there first; no API key is needed and none is read. TradingAgents refreshes and rewrites that file when the token nears expiry, because the refresh token rotates and not persisting it would log the Codex client out. Set `TRADINGAGENTS_LLM_MAX_RETRIES=5` or higher: subscription traffic hits transient "servers are currently overloaded" errors far more often than the paid API. Note that this endpoint is undocumented and unversioned — OpenAI can change it without notice — and that driving subscription credentials from a third-party tool is not clearly sanctioned by OpenAI's terms.
+
 Alternatively, copy `.env.example` to `.env` and fill in your keys:
 ```bash
 cp .env.example .env
@@ -197,7 +199,7 @@ An interface will appear showing results as they load, letting you track the age
 
 ### Implementation Details
 
-We built TradingAgents with LangGraph to ensure flexibility and modularity. The framework supports multiple LLM providers: OpenAI, Google, Anthropic, xAI, DeepSeek, Qwen (Alibaba DashScope, international and China endpoints), GLM (Zhipu), MiniMax (global + China), OpenRouter, Ollama for local models, and Azure OpenAI for enterprise.
+We built TradingAgents with LangGraph to ensure flexibility and modularity. The framework supports multiple LLM providers: OpenAI, OpenAI Codex (ChatGPT subscription), Google, Anthropic, xAI, DeepSeek, Qwen (Alibaba DashScope, international and China endpoints), GLM (Zhipu), MiniMax (global + China), OpenRouter, Ollama for local models, and Azure OpenAI for enterprise.
 
 ### Python Usage
 

cli/main.py

@@ -711,7 +711,10 @@ def thinking_value_or_prompt(env_var, config_key, label, box_title, box_body, pr
             "Gemini thinking mode", "Step 8: Thinking Mode",
             "Configure Gemini thinking mode", ask_gemini_thinking_config,
         )
-    elif provider_lower == "openai":
+    elif provider_lower in ("openai", "openai_codex"):
+        # Same branch set as TradingAgentsGraph._get_provider_kwargs: the Codex
+        # endpoint serves the same GPT-5 family and accepts reasoning.effort, so
+        # leaving it out here would forward a knob the CLI never offers.
         reasoning_effort = thinking_value_or_prompt(
             "TRADINGAGENTS_OPENAI_REASONING_EFFORT", "openai_reasoning_effort",
             "Reasoning effort", "Step 8: Reasoning Effort",

cli/utils.py

@@ -347,6 +347,8 @@ def _llm_provider_table() -> list[tuple[str, str, str | None]]:
     ollama_url = os.environ.get("OLLAMA_BASE_URL") or "http://localhost:11434/v1"
     return [
         ("OpenAI", "openai", "https://api.openai.com/v1"),
+        ("OpenAI Codex (ChatGPT subscription quota)", "openai_codex",
+         "https://chatgpt.com/backend-api/codex"),
         ("Google", "google", None),
         ("Anthropic", "anthropic", "https://api.anthropic.com/"),
         ("xAI", "xai", "https://api.x.ai/v1"),
@@ -600,6 +602,23 @@ def confirm_ollama_endpoint(url: str) -> None:
         )
 
 
+def _preflight_codex_auth() -> None:
+    """Validate the Codex login before the run starts.
+
+    Codex has no API-key env var, so the usual prompt does not apply. Resolving
+    the credential now turns a missing or dead login into an immediate, fixable
+    message instead of a failure on the first LLM call.
+    """
+    from tradingagents.llm_clients.codex_auth import CodexAuthError, resolve
+
+    try:
+        resolve()
+    except CodexAuthError as exc:
+        console.print(f"\n[red]{exc}[/red]")
+        raise SystemExit(1) from exc
+    console.print("[green]✓ Codex credentials OK (ChatGPT subscription quota)[/green]")
+
+
 def ensure_api_key(provider: str) -> str | None:
     """Make sure the API key for `provider` is available in the environment.
 
@@ -613,6 +632,10 @@ def ensure_api_key(provider: str) -> str | None:
     """
     env_var = get_api_key_env(provider)
     if env_var is None:
+        # Codex authenticates from the Codex client's auth file rather than an
+        # env var, so it gets a login check in place of the key prompt.
+        if provider.lower() == "openai_codex":
+            _preflight_codex_auth()
         return None  # ollama / unknown — no key check possible
 
     # Key-optional providers (generic OpenAI-compatible / local servers) read the

tests/test_api_key_env.py

@@ -18,7 +18,7 @@ def test_every_select_llm_provider_choice_has_an_entry():
     # stay in lockstep. Region-specific keys (qwen-cn / minimax-cn / glm-cn)
     # are reached via the secondary region prompt, so they must also be present.
     expected = {
-        "openai", "google", "anthropic", "xai", "deepseek",
+        "openai", "openai_codex", "google", "anthropic", "xai", "deepseek",
         "qwen", "qwen-cn",
         "glm", "glm-cn",
         "minimax", "minimax-cn",

tests/test_cli_env_skip.py

@@ -145,5 +145,39 @@ def test_effort_env_skips_step8_prompt(self):
         self.assertEqual(sel["openai_reasoning_effort"], "high")
 
 
+@pytest.mark.unit
+class TestReasoningEffortOfferedForCodex(unittest.TestCase):
+    def test_codex_provider_is_asked_for_reasoning_effort(self):
+        # openai_codex serves the same GPT-5 family over the ChatGPT-subscription
+        # endpoint and TradingAgentsGraph._get_provider_kwargs forwards
+        # openai_reasoning_effort for it, so Step 8 must offer the knob here too
+        # — otherwise the config key is wired end-to-end but can only ever be set
+        # through the env var.
+        import cli.main as m
+
+        with mock.patch.dict(
+            os.environ, {"TRADINGAGENTS_OPENAI_REASONING_EFFORT": ""}, clear=False
+        ), \
+             mock.patch.object(m, "fetch_announcements", return_value=None), \
+             mock.patch.object(m, "display_announcements"), \
+             mock.patch.object(m, "get_ticker", return_value="AAPL"), \
+             mock.patch.object(m, "get_analysis_date", return_value="2026-05-29"), \
+             mock.patch.object(m, "select_analysts", return_value=[]), \
+             mock.patch.object(m, "select_research_depth", return_value=1), \
+             mock.patch.object(m, "ensure_api_key"), \
+             mock.patch.object(
+                 m, "select_llm_provider",
+                 return_value=("openai_codex", "https://chatgpt.com/backend-api/codex"),
+             ), \
+             mock.patch.object(m, "ask_output_language", return_value="English"), \
+             mock.patch.object(m, "select_shallow_thinking_agent", return_value="gpt-5.4-mini"), \
+             mock.patch.object(m, "select_deep_thinking_agent", return_value="gpt-5.6-sol"), \
+             mock.patch.object(m, "ask_openai_reasoning_effort", return_value="high") as prompt_effort:
+            sel = m.get_user_selections()
+
+        prompt_effort.assert_called_once()
+        self.assertEqual(sel["openai_reasoning_effort"], "high")
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_codex_auth.py

@@ -0,0 +1,230 @@
+"""Codex credential resolution from the official client's auth.json.
+
+Two behaviours matter for not breaking the user's Codex login: refresh only
+when the token is genuinely near expiry, and always persist the rotated refresh
+token atomically (the refresh token rotates on every refresh, so refreshing
+without persisting silently logs the user out of Codex).
+"""
+from __future__ import annotations
+
+import base64
+import json
+import os
+import stat
+import time
+from pathlib import Path
+
+import pytest
+
+from tradingagents.llm_clients import codex_auth
+
+
+def _jwt(exp: float, aud: str = "app_TEST") -> str:
+    """Build an unsigned JWT whose payload carries exp and aud."""
+    def part(obj: dict) -> str:
+        return base64.urlsafe_b64encode(json.dumps(obj).encode()).decode().rstrip("=")
+
+    return f"{part({'alg': 'none'})}.{part({'exp': exp, 'aud': [aud]})}.sig"
+
+
+def _auth_file(tmp_path: Path, exp_offset: float = 3600.0, **overrides) -> Path:
+    payload = {
+        "auth_mode": "chatgpt",
+        "OPENAI_API_KEY": None,
+        "tokens": {
+            "id_token": _jwt(time.time() + exp_offset),
+            "access_token": _jwt(time.time() + exp_offset),
+            "refresh_token": "refresh-old",
+            "account_id": "acct-123",
+        },
+        "last_refresh": "2026-07-20T05:33:55.696789Z",
+    }
+    payload.update(overrides)
+    path = tmp_path / "auth.json"
+    path.write_text(json.dumps(payload))
+    path.chmod(0o600)
+    return path
+
+
+def _fresh_tokens(**overrides) -> dict:
+    payload = {
+        "access_token": _jwt(time.time() + 864000),
+        "refresh_token": "refresh-new",
+        "id_token": _jwt(time.time() + 3600),
+        "expires_in": 864000,
+    }
+    payload.update(overrides)
+    return payload
+
+
+@pytest.mark.unit
+def test_valid_token_is_returned_without_refreshing(tmp_path, monkeypatch):
+    path = _auth_file(tmp_path)
+    before = path.read_text()
+
+    def _explode(*args, **kwargs):
+        raise AssertionError("refresh must not run for a healthy token")
+
+    monkeypatch.setattr(codex_auth, "_refresh", _explode)
+    creds = codex_auth.resolve(str(path))
+
+    assert creds.account_id == "acct-123"
+    assert creds.token == json.loads(before)["tokens"]["access_token"]
+    assert path.read_text() == before
+
+
+@pytest.mark.unit
+def test_headers_carry_the_account_id():
+    creds = codex_auth.CodexCredentials(token="t", account_id="acct-9")
+    assert creds.headers["chatgpt-account-id"] == "acct-9"
+    assert "Authorization" not in creds.headers
+
+
+@pytest.mark.unit
+@pytest.mark.parametrize("exp_offset", [-10.0, 60.0])
+def test_expiring_token_is_refreshed_and_persisted(tmp_path, monkeypatch, exp_offset):
+    path = _auth_file(tmp_path, exp_offset=exp_offset)
+    calls = []
+    fresh = _fresh_tokens()
+
+    def _fake_refresh(refresh_token: str, client_id: str) -> dict:
+        calls.append((refresh_token, client_id))
+        return fresh
+
+    monkeypatch.setattr(codex_auth, "_refresh", _fake_refresh)
+    creds = codex_auth.resolve(str(path))
+
+    assert calls == [("refresh-old", "app_TEST")]
+    assert creds.token == fresh["access_token"]
+    assert creds.account_id == "acct-123"
+
+    written = json.loads(path.read_text())
+    assert written["tokens"]["access_token"] == fresh["access_token"]
+    assert written["tokens"]["refresh_token"] == "refresh-new"
+    assert written["tokens"]["account_id"] == "acct-123"
+    assert set(written) == {"auth_mode", "OPENAI_API_KEY", "tokens", "last_refresh"}
+    assert written["auth_mode"] == "chatgpt"
+    assert written["last_refresh"] != "2026-07-20T05:33:55.696789Z"
+    assert stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert not list(tmp_path.glob("*.tmp"))
+
+
+@pytest.mark.unit
+def test_write_back_is_atomic(tmp_path, monkeypatch):
+    path = _auth_file(tmp_path, exp_offset=-10.0)
+    monkeypatch.setattr(codex_auth, "_refresh", lambda *a, **k: _fresh_tokens())
+    destinations = []
+    real_replace = os.replace
+
+    def _spy(src, dst):
+        destinations.append(str(dst))
+        real_replace(src, dst)
+
+    monkeypatch.setattr(codex_auth.os, "replace", _spy)
+    codex_auth.resolve(str(path))
+
+    # A direct truncating write would never call os.replace.
+    assert destinations == [str(path)]
+
+
+@pytest.mark.unit
+def test_refresh_failure_leaves_the_file_untouched(tmp_path, monkeypatch):
+    path = _auth_file(tmp_path, exp_offset=-10.0)
+    before = path.read_text()
+
+    def _fail(*args, **kwargs):
+        raise codex_auth.CodexAuthError("refresh rejected")
+
+    monkeypatch.setattr(codex_auth, "_refresh", _fail)
+    with pytest.raises(codex_auth.CodexAuthError):
+        codex_auth.resolve(str(path))
+    assert path.read_text() == before
+
+
+@pytest.mark.unit
+def test_missing_file_names_the_path_and_the_fix(tmp_path):
+    missing = tmp_path / "nope.json"
+    with pytest.raises(codex_auth.CodexAuthError, match="Sign in"):
+        codex_auth.resolve(str(missing))
+
+
+@pytest.mark.unit
+def test_api_key_auth_mode_points_at_the_openai_provider(tmp_path):
+    path = _auth_file(tmp_path, auth_mode="apikey")
+    with pytest.raises(codex_auth.CodexAuthError, match="'openai' provider"):
+        codex_auth.resolve(str(path))
+
+
+@pytest.mark.unit
+def test_missing_account_id_is_rejected(tmp_path):
+    path = _auth_file(tmp_path)
+    payload = json.loads(path.read_text())
+    del payload["tokens"]["account_id"]
+    path.write_text(json.dumps(payload))
+    with pytest.raises(codex_auth.CodexAuthError, match="account"):
+        codex_auth.resolve(str(path))
+
+
+@pytest.mark.unit
+def test_expired_token_without_refresh_token_is_rejected(tmp_path):
+    path = _auth_file(tmp_path, exp_offset=-10.0)
+    payload = json.loads(path.read_text())
+    del payload["tokens"]["refresh_token"]
+    path.write_text(json.dumps(payload))
+    with pytest.raises(codex_auth.CodexAuthError, match="refresh token"):
+        codex_auth.resolve(str(path))
+
+
+@pytest.mark.unit
+def test_client_id_falls_back_when_the_id_token_is_unreadable(tmp_path, monkeypatch):
+    path = _auth_file(tmp_path, exp_offset=-10.0)
+    payload = json.loads(path.read_text())
+    payload["tokens"]["id_token"] = "not-a-jwt"
+    path.write_text(json.dumps(payload))
+    seen = []
+
+    def _capture(refresh_token: str, client_id: str) -> dict:
+        seen.append(client_id)
+        return _fresh_tokens()
+
+    monkeypatch.setattr(codex_auth, "_refresh", _capture)
+    codex_auth.resolve(str(path))
+    assert seen == [codex_auth.FALLBACK_CLIENT_ID]
+
+
+def _degrading_reads(monkeypatch, path, drop: str):
+    """Make the second read of the auth file return a file missing ``drop``.
+
+    resolve() reads once to decide whether a refresh is needed, then re-reads
+    under the lock. Nothing guarantees the two reads see the same file — the
+    official Codex client can rewrite it in between.
+    """
+    intact = json.loads(path.read_text())
+    degraded = json.loads(json.dumps(intact))
+    del degraded["tokens"][drop]
+    reads = iter([intact, degraded])
+    monkeypatch.setattr(codex_auth, "_read_auth", lambda _path: next(reads))
+
+
+@pytest.mark.unit
+@pytest.mark.parametrize(
+    "dropped,message", [("refresh_token", "refresh token"), ("account_id", "account")]
+)
+def test_file_degrading_under_the_lock_stays_actionable(
+    tmp_path, monkeypatch, dropped, message
+):
+    path = _auth_file(tmp_path, exp_offset=-10.0)
+    _degrading_reads(monkeypatch, path, dropped)
+    monkeypatch.setattr(codex_auth, "_refresh", lambda *a, **k: _fresh_tokens())
+
+    # Without re-validating after the second read this raises a bare KeyError,
+    # which tells the user nothing about how to fix it.
+    with pytest.raises(codex_auth.CodexAuthError, match=message):
+        codex_auth.resolve(str(path))
+
+
+@pytest.mark.unit
+def test_env_var_selects_the_auth_path(tmp_path, monkeypatch):
+    path = _auth_file(tmp_path)
+    monkeypatch.setenv("TRADINGAGENTS_CODEX_AUTH_PATH", str(path))
+    assert codex_auth.resolve().account_id == "acct-123"