fix: ChatGPT/Claude subscription auth — use Codex Responses API, add rate-limit retry

ChatGPT sign-in was failing because the OAuth callback tried to mint an
API key via token-exchange, which requires API platform access that most
ChatGPT subscriptions don't include. Now uses the Codex Responses API
(chatgpt.com/backend-api/codex/responses) with the OAuth access token
directly — same approach the Codex CLI and Aside browser use.

Claude token exchange was failing on 429 rate limits with no retry. Added
exponential backoff with retry-after header support.

Changes:
- Rewrite callOpenAIOAuth to use Codex Responses API with SSE streaming
- Remove mintOpenAIApiKey call from OAuth callback handler
- Add getOpenAIAccessToken helper for direct token access
- Add parseCodexResponsesSSE for streaming response parsing
- Fix tokenErrorMessage [object Object] bug on nested error objects
- Add fetchWithRetry to oauth-anthropic.js for 429 backoff
- Update OpenAI model catalog: add GPT-5.4/5.5, make GPT-5.4 recommended
- Add chatgpt.com to manifest host_permissions
- Fix waitForOpenAIOAuthResult to poll for credentials not minted key
- 945/945 tests pass

Author: New1Direction

CHANGELOG.md

@@ -7,6 +7,24 @@ This project follows [Semantic Versioning](https://semver.org/) and groups chang
 by theme. Dates are when the release landed on `main`. 1.1.0 through 1.6.0 shipped
 the same day, as a rapid burst of improvements, so they share a date.
 
+## [Unreleased] — 2026-06-25 · _Subscription Auth Fix · Codex Responses API_
+
+### Fixed
+
+- **ChatGPT subscription sign-in now works without API platform access.** The previous flow tried to mint an OpenAI API key (`sk-…`) from the OAuth `id_token` via a token-exchange grant — which only works if your ChatGPT plan includes API platform access. Most ChatGPT Plus/Pro subscriptions don't, so every sign-in failed with "Couldn't enable API access for this ChatGPT account." RepoLens now uses the **Codex Responses API** at `chatgpt.com/backend-api/codex/responses` with the OAuth access token directly — the same endpoint the Codex CLI and Aside browser use. No API key minting required; the subscription itself authorizes the request.
+- **ChatGPT OAuth error messages are now readable.** The token-exchange error handler was stringifying nested error objects as `[object Object]`. It now drills into `error.message`, `error_description`, and stringifies objects properly.
+- **ChatGPT OAuth callback no longer clears credentials on success.** The callback handler was still calling `mintOpenAIApiKey()` after the code exchange, which failed and then wiped the just-stored OAuth credentials — making the provider look disconnected even though the sign-in itself succeeded.
+- **Claude sign-in rate-limit handling.** Anthropic's token endpoint rate-limits aggressively on repeated sign-in attempts or concurrent refreshes, surfacing as "Claude token exchange failed: Rate limited." Both the token exchange and refresh paths now retry with exponential backoff (up to 2 retries, reads `retry-after` header, 30s max delay) before giving up.
+
+### Changed
+
+- **OpenAI model catalog updated.** Added GPT-5.4 (recommended), GPT-5.4 mini, and GPT-5.5 to the model picker — matching what ChatGPT subscriptions expose via the Codex Responses API. GPT-4.1, GPT-4o, and o4-mini remain as fallbacks.
+- **Default OpenAI model is now GPT-5.4** (was GPT-4.1), matching the current generation available through ChatGPT subscriptions.
+- **`waitForOpenAIOAuthResult` now polls for OAuth credentials** instead of a minted API key, since the Codex Responses API path uses the access token directly.
+- **Removed unused `mintOpenAIApiKey` import** from background.js — the minting step is no longer part of the inference or callback path.
+
+---
+
 ## [Unreleased] — 2026-06-19 · _Actionable Scans · Smooth Loading · Provider Refresh · Stability_
 
 ### Added

manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "RepoLens",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Click any repo. Get a straight answer on whether to use it.",
   "content_security_policy": { "extension_pages": "script-src 'self'; object-src 'self'" },
   "permissions": [
@@ -34,6 +34,7 @@
     "https://cli-chat-proxy.grok.com/*",
     "https://api.openai.com/*",
     "https://auth.openai.com/*",
+    "https://chatgpt.com/*",
     "https://api.deepseek.com/*",
     "https://api.groq.com/*",
     "https://integrate.api.nvidia.com/*",

src/background.js

@@ -54,8 +54,8 @@ import {
   OPENAI_CREDENTIALS_KEY,
   clearOpenAICredentials,
   exchangeOpenAICode,
+  getOpenAIAccessToken,
   isOpenAIOAuthCallbackUrl,
-  mintOpenAIApiKey,
   refreshOpenAIToken,
 } from './oauth-openai.js';
 import {
@@ -603,8 +603,9 @@ const _handledOAuthCodes = new Set();
 //
 // The redirect lands on http://localhost:1455/auth/callback — the loopback server
 // the CLI runs doesn't exist in a browser, so the navigation can't complete. We
-// intercept it (onBeforeNavigate fires first, with the ?code=), exchange the code,
-// then mint an API key so inference uses the standard OpenAI engine.
+// intercept it (onBeforeNavigate fires first, with the ?code=), exchange the code
+// for OAuth credentials. Inference uses the Codex Responses API with the access
+// token directly — no API key minting needed.
 
 async function handleOpenAIOAuthCallback(rawUrl, tabId) {
   if (!rawUrl || !isOpenAIOAuthCallbackUrl(rawUrl)) return;
@@ -652,15 +653,12 @@ async function handleOpenAIOAuthCallback(rawUrl, tabId) {
 
   try {
     const creds = await exchangeOpenAICode({ code, state, verifier, storedState });
-    // Mint a usable API key so scans run through the ordinary OpenAI engine.
-    const apiKey = await mintOpenAIApiKey(creds.id_token);
-    await chrome.storage.local.set({ openaiKey: apiKey });
+    // Store the OAuth credentials. Inference uses the Codex Responses API
+    // with the access token directly — no API key minting needed.
     await cleanupFlowMarkers();
     if (tabId) chrome.tabs.remove(tabId).catch(() => {});
   } catch (err) {
     console.error('[RepoLens OAuth] OpenAI exchange error:', err.message);
-    // No usable key ⇒ don't leave half-finished OAuth state that reads as "connected".
-    await clearOpenAICredentials().catch(() => {});
     await chrome.storage.local.set({ [OPENAI_OAUTH_ERROR_KEY]: err.message });
     await cleanupFlowMarkers();
     if (tabId) chrome.tabs.remove(tabId).catch(() => {});
@@ -1657,48 +1655,124 @@ async function callEmbeddings(keys, texts) {
   }
 }
 
-// OpenAI via "Sign in with ChatGPT" (the Codex CLI OAuth flow). The OAuth session is
-// exchanged for a normal OpenAI API key; on a 401 we refresh the session, re-mint, and
-// retry once. Inference itself is the standard api.openai.com chat-completions engine.
-async function callOpenAIOAuth(model = 'gpt-4.1', prompt) {
-  let { openaiKey } = await chrome.storage.local.get('openaiKey');
-  if (!openaiKey) openaiKey = await mintAndStoreOpenAIKey();
+// OpenAI via "Sign in with ChatGPT" (Codex CLI OAuth flow).
+//
+// Instead of trying to mint an API key (which requires API platform access that
+// most ChatGPT subscriptions don't include), we use the Codex Responses API at
+// chatgpt.com/backend-api/codex/responses — the same endpoint Aside and the
+// Codex CLI use. The OAuth access token works directly; no sk- key needed.
+//
+// The endpoint returns SSE. We stream it and accumulate the text.
+async function callOpenAIOAuth(model = 'gpt-5.4', prompt) {
+  const accessToken = await getOpenAIAccessToken();
+
+  const body = {
+    model,
+    instructions: 'You are a helpful assistant.',
+    input: [{ role: 'user', content: [{ type: 'input_text', text: prompt }] }],
+    stream: true,
+    store: false,
+  };
 
-  let res = await openaiChat(openaiKey, model, prompt);
+  let res = await fetchWithTimeout(
+    'https://chatgpt.com/backend-api/codex/responses',
+    {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(body),
+    },
+    'OpenAI (Codex)'
+  );
+
+  // 401 on first try → force-refresh the access token and retry once.
   if (res.status === 401) {
-    openaiKey = await mintAndStoreOpenAIKey(); // the minted key may have been revoked — re-mint once
-    res = await openaiChat(openaiKey, model, prompt);
+    const fresh = await refreshOpenAIToken({ force: true });
+    res = await fetchWithTimeout(
+      'https://chatgpt.com/backend-api/codex/responses',
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${fresh.access_token}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      },
+      'OpenAI (Codex)'
+    );
   }
+
   if (!res.ok) {
     if (res.status === 401) {
       await clearOpenAICredentials();
       throw new Error('OpenAI session expired — please reconnect in Settings');
     }
-    const err = await res.json().catch(() => ({}));
-    throw new Error(err.error?.message ?? `OpenAI API error ${res.status}`);
+    const detail = await res.text().catch(() => '');
+    let msg;
+    try { msg = JSON.parse(detail)?.error?.message; } catch { msg = ''; }
+    throw new Error(msg || `OpenAI Codex API error ${res.status}`);
   }
-  return parseOpenAiText(await res.json());
-}
 
-// Refresh the ChatGPT OAuth session and mint a fresh OpenAI API key into the shared slot.
-async function mintAndStoreOpenAIKey() {
-  const creds = await refreshOpenAIToken({ force: true }); // guarantee a fresh id_token to exchange
-  const key = await mintOpenAIApiKey(creds?.id_token);
-  await chrome.storage.local.set({ openaiKey: key });
-  return key;
+  return parseCodexResponsesSSE(res, AI_FETCH_TIMEOUT_MS);
 }
 
-// Bare OpenAI chat request returning the raw Response, so callers can branch on 401.
-function openaiChat(key, model, prompt) {
-  return fetchWithTimeout(
-    'https://api.openai.com/v1/chat/completions',
-    {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(openaiBody(model, prompt, 4096)),
-    },
-    'OpenAI'
-  );
+// Parse the SSE stream from the Codex Responses API. Events include:
+//   response.output_text.delta  → incremental text chunks
+//   response.completed          → final response with full output
+//   response.done / .incomplete → terminal signal
+//   error / response.failed     → error
+// We accumulate delta text and, if a completed event arrives with full text,
+// prefer that over the accumulated deltas.
+async function parseCodexResponsesSSE(response, timeoutMs = 60_000) {
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  let fullText = '';
+  const deadline = Date.now() + timeoutMs;
+
+  for (;;) {
+    if (Date.now() > deadline) throw new Error('OpenAI Codex stream timed out');
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+
+    let sep;
+    while ((sep = buffer.indexOf('\n\n')) !== -1) {
+      const block = buffer.slice(0, sep);
+      buffer = buffer.slice(sep + 2);
+      const dataLines = block
+        .split('\n')
+        .filter((l) => l.startsWith('data:'))
+        .map((l) => l.slice(5).trim())
+        .filter(Boolean);
+      for (const data of dataLines) {
+        if (data === '[DONE]') continue;
+        let evt;
+        try { evt = JSON.parse(data); } catch { continue; }
+        if (evt.type === 'response.output_text.delta' && typeof evt.delta === 'string') {
+          fullText += evt.delta;
+        }
+        if ((evt.type === 'response.completed' || evt.type === 'response.done') && evt.response?.output) {
+          for (const item of evt.response.output) {
+            if (item.type === 'message' && Array.isArray(item.content)) {
+              for (const blk of item.content) {
+                if (blk.type === 'output_text' && blk.text) fullText = blk.text;
+              }
+            }
+          }
+        }
+        if (evt.type === 'error' || evt.type === 'response.failed') {
+          const msg = evt.error?.message || evt.message || 'Codex API error';
+          throw new Error(msg);
+        }
+      }
+    }
+  }
+
+  if (!fullText) throw new Error('OpenAI Codex returned no text content');
+  return fullText;
 }
 
 // Anthropic-compatible Messages API (x-api-key + anthropic-version).
@@ -1736,7 +1810,7 @@ async function callAnthropicCompatible({
 async function testProvider(provider, keys) {
   const p = compatProviderById(provider);
   if (!p) return { ok: false, connection: false, function: false, detail: 'Unknown provider' };
-  // OpenAI connected via "Sign in with ChatGPT" exercises the OAuth → mint → call path.
+  // OpenAI connected via "Sign in with ChatGPT" exercises the Codex Responses API path.
   const isOpenAiOAuth = provider === 'openai' && !!keys[OPENAI_CREDENTIALS_KEY]?.refresh_token;
   if (!isCompatConnected(provider, keys) && !isOpenAiOAuth) {
     return {

src/oauth-anthropic.js

@@ -59,12 +59,45 @@ function expiresAt(expiresInSec) {
   return Date.now() + sec * 1000 - 5 * 60 * 1000;
 }
 
+const _sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** Fetch with retry on 429 rate-limit. Anthropic's token endpoint throttles
+ *  aggressively — a single retry with backoff prevents false failures. */
+async function fetchWithRetry(url, opts, { maxRetries = 2, baseDelayMs = 2000 } = {}) {
+  let lastErr;
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      const res = await fetch(url, opts);
+      if (res.status !== 429) return res;
+      // Rate limited — read retry hint and back off
+      const retryAfter = res.headers.get('retry-after');
+      const delay = retryAfter ? Math.max(1000, Number(retryAfter) * 1000) : baseDelayMs * (2 ** attempt);
+      if (attempt < maxRetries) {
+        await _sleep(Math.min(delay, 30000));
+        continue;
+      }
+      return res; // last attempt — let the caller handle the 429
+    } catch (err) {
+      lastErr = err;
+      if (attempt < maxRetries) {
+        await _sleep(baseDelayMs * (2 ** attempt));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw lastErr || new Error('Token request failed after retries');
+}
+
 async function parseTokenResponse(res, context) {
   const json = await res.json().catch(() => ({}));
   if (!res.ok) {
+    if (res.status === 429) {
+      throw new Error(`${context} failed: Rate limited. Please try again in a minute.`);
+    }
     const detail =
       json.error_description || json.error?.message || json.error || json.message || `${res.status}`;
-    throw new Error(`${context} failed: ${detail}`);
+    throw new Error(`${context} failed: ${typeof detail === 'object' ? JSON.stringify(detail) : detail}`);
   }
   if (!json.access_token) throw new Error(`${context} failed: Anthropic returned no access token`);
   return {
@@ -79,7 +112,7 @@ export async function exchangeAnthropicCode({ authCode, verifier }) {
   if (!code) throw new Error('Paste the Claude authorization code first.');
   if (state && state !== verifier) throw new Error('Claude sign-in state mismatch. Start the sign-in again.');
 
-  const res = await fetch(ANTHROPIC_TOKEN_URL, {
+  const res = await fetchWithRetry(ANTHROPIC_TOKEN_URL, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
@@ -136,7 +169,7 @@ export async function refreshAnthropicAccessToken() {
       throw new Error('Claude sign-in expired — reconnect Anthropic in Settings.');
     }
 
-    const res = await fetch(ANTHROPIC_TOKEN_URL, {
+    const res = await fetchWithRetry(ANTHROPIC_TOKEN_URL, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({

src/oauth-openai.js

@@ -224,18 +224,34 @@ async function tokenErrorMessage(res, fallback) {
   const body = await res.text().catch(() => '');
   try {
     const e = JSON.parse(body);
-    return e.error_description || e.error || fallback || `Token request failed (${res.status})`;
+    return e.error_description || e.error?.message || e.error || e.message || fallback || `Token request failed (${res.status})`;
   } catch {
+    // body isn't JSON — if it's an object stringified somehow, stringify it properly
+    if (body && typeof body === 'object') return JSON.stringify(body).slice(0, 160);
     return (body && body.slice(0, 160)) || fallback || `Token request failed (${res.status})`;
   }
 }
 
-/** Poll storage until background.js finishes the callback exchange + key mint. */
+/** Get a valid (refreshed if needed) OAuth access_token for the ChatGPT session.
+ *  Used by the Codex Responses API path — no API-key minting required. */
+export async function getOpenAIAccessToken() {
+  let creds = await getOpenAICredentials();
+  if (!creds?.refresh_token) {
+    await clearOpenAICredentials();
+    throw new Error('OpenAI session expired — please reconnect in Settings');
+  }
+  if (isOpenAITokenExpired(creds)) {
+    creds = await refreshOpenAIToken();
+  }
+  return creds.access_token;
+}
+
+/** Poll storage until background.js finishes the callback exchange. */
 export async function waitForOpenAIOAuthResult({ timeoutMs = 300_000, intervalMs = 500 } = {}) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const s = await chrome.storage.local.get([OPENAI_API_KEY_NAME, OPENAI_OAUTH_ERROR_KEY]);
-    if (s[OPENAI_API_KEY_NAME]) return { key: s[OPENAI_API_KEY_NAME] };
+    const s = await chrome.storage.local.get([OPENAI_CREDENTIALS_KEY, OPENAI_OAUTH_ERROR_KEY]);
+    if (s[OPENAI_CREDENTIALS_KEY]?.access_token) return { ok: true };
     if (s[OPENAI_OAUTH_ERROR_KEY]) return { error: s[OPENAI_OAUTH_ERROR_KEY] };
     await new Promise((r) => setTimeout(r, intervalMs));
   }

src/options-providers.js

@@ -258,7 +258,8 @@ function buildCard(p, snapshot) {
   }
 
   // "Sign in with ChatGPT" — PKCE authorize in a new tab; background.js intercepts the
-  // loopback redirect, exchanges the code, and mints an OpenAI API key into openaiKey.
+  // loopback redirect, exchanges the code, and stores the OAuth credentials.
+  // Inference uses the Codex Responses API with the access token directly.
   async function connectOpenAiOAuth() {
     const restore = () => {
       openAiOAuthBtn.disabled = false;

src/providers.js

@@ -28,8 +28,11 @@ export const COMPAT_PROVIDERS = [
     host: 'https://api.openai.com/*',
     docsUrl: 'https://platform.openai.com/api-keys',
     models: [
-      { value: 'gpt-4.1', label: 'GPT-4.1', recommended: true },
-      { value: 'gpt-4.1-mini', label: 'GPT-4.1 mini — fast' },
+      { value: 'gpt-5.4', label: 'GPT-5.4', recommended: true },
+      { value: 'gpt-5.4-mini', label: 'GPT-5.4 mini — fast' },
+      { value: 'gpt-5.5', label: 'GPT-5.5 — max quality' },
+      { value: 'gpt-4.1', label: 'GPT-4.1' },
+      { value: 'gpt-4.1-mini', label: 'GPT-4.1 mini' },
       { value: 'gpt-4o', label: 'GPT-4o' },
       { value: 'o4-mini', label: 'o4-mini — reasoning' },
     ],

tests/oauth-openai.test.js

@@ -253,10 +253,10 @@ describe('mintOpenAIApiKey', () => {
 });
 
 describe('waitForOpenAIOAuthResult', () => {
-  it('resolves with the minted key once it appears', async () => {
-    store.openaiKey = 'sk-final';
+  it('resolves with ok once OAuth credentials appear', async () => {
+    store[OPENAI_CREDENTIALS_KEY] = { access_token: 'acc', refresh_token: 'ref', id_token: 'id', expires_at: Date.now() + 3600000 };
     const r = await waitForOpenAIOAuthResult({ timeoutMs: 1000, intervalMs: 10 });
-    expect(r).toEqual({ key: 'sk-final' });
+    expect(r).toEqual({ ok: true });
   });
 
   it('resolves with an error when the callback recorded one', async () => {

tests/routing.test.js

@@ -96,7 +96,7 @@ describe('buildAttemptPlan', () => {
   it('treats ChatGPT-login OAuth as connected before the OpenAI key is minted', () => {
     expect(isConnected('openai', { openaiOauthCredentials: { refresh_token: 'refresh' } })).toBe(true);
     const plan = buildAttemptPlan({ keys: { openaiOauthCredentials: { refresh_token: 'refresh' } } });
-    expect(plan).toEqual([{ provider: 'openai', model: 'gpt-4.1' }]);
+    expect(plan).toEqual([{ provider: 'openai', model: 'gpt-5.4' }]);
   });
 
   it('a registry provider can be the per-part override and is tried first', () => {