Support host-managed ChatGPT tokens through Codex app-server external auth

[simonrosenberg]

Request

Codex app-server supports externally managed ChatGPT access tokens:

• account/login/start with type: "chatgptAuthTokens"
• account/chatgptAuthTokens/refresh when a backend request receives a 401

Could codex-acp expose this flow to ACP hosts?

A minimal shape could be:

1. Accept the initial access token, account ID, and plan through namespaced authenticate metadata.
2. Call Codex's chatgptAuthTokens login variant.
3. Forward Codex's refresh request to the ACP client through an extension request and return the response.
4. Keep the existing browser/file-based chat-gpt flow as the default.

The host would remain responsible for refresh-token storage and concurrency. codex-acp would only pass access tokens between the host and Codex.

Current state

Version 1.1.4 already enables experimentalApi, and its generated app-server types include this flow. However, chat-gpt still uses Codex-managed authentication and no refresh handler is registered.

Codex tests the complete 401 → client refresh → retry behavior:

• https://github.com/openai/codex/blob/rust-v0.144.6/codex-rs/app-server/tests/suite/v2/account.rs#L470-L590

The underlying login variant is marked UNSTABLE and FOR OPENAI INTERNAL USE ONLY - DO NOT USE. Would the maintainers be open to this opt-in integration, or should it wait for Codex to stabilize the API?

Motivating OpenHands work:

• fix(acp): broker concurrent Codex subscription auth OpenHands/OpenHands#15287
• fix(acp): persist brokered Codex subscription auth OpenHands/software-agent-sdk#4124