feat(adapter-codex-local): add device-login output parser

Parse the Codex device-login output for the login URL and the one-time code.
Accept only the exact origin and path https://auth.openai.com/codex/device and
reject any query or fragment. Accept only the XXXX-XXXXX code structure. Keep the
URL and the code out of every log and every thrown error. Add redacted, real
sample fixtures from the capture step and table-driven tests.

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: nickyleach

packages/adapters/codex-local/src/server/__fixtures__/README.md

@@ -0,0 +1,38 @@
+# Device-login sample fixtures
+
+These fixtures hold redacted, real Codex device-login output. A capture step ran
+`codex login --device-auth` inside a Daytona sandbox and recorded the output. The
+capture step redacted every secret before it kept or posted the text. The parser
+tests read these fixtures. The tests never read a live secret.
+
+## Source
+
+- Capture date (UTC): `2026-08-08`.
+- Daytona image: `cr.app.daytona.io/sbox/daytona-6a8d60e245981dd72d0e647e6afae46e0fd7b8bdfdb29b08120747509a39dc33:daytona`.
+- Sandbox id: `3bd22e18-2103-4227-b918-6c375fd30b49` (region `us`).
+- Codex home: a new throwaway directory for each independent run.
+
+## Files
+
+| File | Row | Condition | Expected parse result |
+|---|---|---|---|
+| `device-login-sample.txt` | A — normal prompt | `timeout 60 codex login --device-auth` | a URL and a code |
+| `device-login-edge.txt` | D — error / retry | offline run with an unreachable local proxy | `null` |
+
+Two more rows from the capture are not committed as fixtures. Row B (timeout
+tail) printed no extra Codex line; the external `timeout` process ended the
+command with exit status `124`. Row C (`codex login --help`) and Row E
+(`codex --version`) are not device-login prompts.
+
+## Redaction
+
+The capture step transformed the real one-time code to question marks and kept
+the shape. So `device-login-sample.txt` holds `????-?????` in the code position.
+The real code alphabet is a Codex detail and the capture did not keep it. The
+parser matches the grounded structure of the code — four characters, a hyphen,
+then five characters — and does not invent an alphabet. The token class is bound
+to alphanumerics and the redaction sentinel `?`, so the committed sample parses
+to a code without a real secret in the repository.
+
+The capture step checked the final text for common credential field names and
+for an unredacted device-code pattern. It found no match.

packages/adapters/codex-local/src/server/__fixtures__/device-login-edge.txt

@@ -0,0 +1 @@
+Error logging in with device code: error sending request for url (https://auth.openai.com/api/accounts/deviceauth/<redacted-path>)

packages/adapters/codex-local/src/server/__fixtures__/device-login-sample.txt

@@ -0,0 +1,5 @@
+1. Open this link in your browser and sign in to your account
+https://auth.openai.com/codex/device
+2. Enter this one-time code (expires in 15 minutes)
+????-?????
+Device codes are a common phishing target. Never share this code.

packages/adapters/codex-local/src/server/device-login-parse.test.ts

@@ -0,0 +1,102 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { parseDeviceLoginPrompt } from "./device-login-parse.js";
+
+const fixturesDir = path.join(path.dirname(fileURLToPath(import.meta.url)), "__fixtures__");
+
+function readFixture(name: string): string {
+  return readFileSync(path.join(fixturesDir, name), "utf8");
+}
+
+const EXACT_URL = "https://auth.openai.com/codex/device";
+
+describe("parseDeviceLoginPrompt", () => {
+  it("parse_returns_url_and_code_from_sample", () => {
+    const result = parseDeviceLoginPrompt(readFixture("device-login-sample.txt"));
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(EXACT_URL);
+    // The committed sample keeps the capture-time redaction of the code. The
+    // parser extracts the four-hyphen-five structure without a real secret.
+    expect(result?.code).toBe("????-?????");
+  });
+
+  it("parse_returns_null_when_prompt_absent", () => {
+    const text = "Some unrelated log line\nNothing to see here\n";
+    expect(parseDeviceLoginPrompt(text)).toBeNull();
+  });
+
+  it("parse_returns_null_for_url_with_query_or_fragment", () => {
+    const withQuery = [
+      "Open this link",
+      "https://auth.openai.com/codex/device?foo=bar",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    const withFragment = [
+      "Open this link",
+      "https://auth.openai.com/codex/device#section",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    expect(parseDeviceLoginPrompt(withQuery)).toBeNull();
+    expect(parseDeviceLoginPrompt(withFragment)).toBeNull();
+  });
+
+  it("parse_returns_null_for_wrong_origin_or_path", () => {
+    const wrongOrigin = [
+      "Open this link",
+      "https://auth.example.com/codex/device",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    const wrongPath = [
+      "Open this link",
+      "https://auth.openai.com/codex/device/extra",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    const httpScheme = [
+      "Open this link",
+      "http://auth.openai.com/codex/device",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    expect(parseDeviceLoginPrompt(wrongOrigin)).toBeNull();
+    expect(parseDeviceLoginPrompt(wrongPath)).toBeNull();
+    expect(parseDeviceLoginPrompt(httpScheme)).toBeNull();
+  });
+
+  it("parse_returns_null_for_malformed_short_code", () => {
+    const shortCode = [EXACT_URL, "ABC-EFGHJ"].join("\n"); // 3 then 5
+    const longCode = [EXACT_URL, "ABCDE-EFGHJ"].join("\n"); // 5 then 5
+    const noHyphen = [EXACT_URL, "ABCDEFGHJ"].join("\n");
+    const noCode = [EXACT_URL, "no code on this line"].join("\n");
+    expect(parseDeviceLoginPrompt(shortCode)).toBeNull();
+    expect(parseDeviceLoginPrompt(longCode)).toBeNull();
+    expect(parseDeviceLoginPrompt(noHyphen)).toBeNull();
+    expect(parseDeviceLoginPrompt(noCode)).toBeNull();
+  });
+
+  it("parse_ignores_token_like_text", () => {
+    // Token-like noise without the exact device URL must not yield a prompt.
+    const text = [
+      "tokens received",
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.payload.signature",
+      "sk-proj-ABCD1234ABCD1234ABCD1234",
+      "ABCD-EFGHJ",
+    ].join("\n");
+    expect(parseDeviceLoginPrompt(text)).toBeNull();
+  });
+
+  it("parse_returns_null_for_edge_sample", () => {
+    // The grounded edge row carries a URL, but a wrong path and a wrong origin
+    // segment, so the parser rejects it.
+    expect(parseDeviceLoginPrompt(readFixture("device-login-edge.txt"))).toBeNull();
+  });
+
+  it("keeps the url and the code out of a thrown error", () => {
+    // A non-string input is a programming error, but the message must never
+    // carry secret-bearing input. The parser returns null instead of throwing.
+    // @ts-expect-error deliberate wrong type
+    expect(parseDeviceLoginPrompt(undefined)).toBeNull();
+    // @ts-expect-error deliberate wrong type
+    expect(parseDeviceLoginPrompt(12345)).toBeNull();
+  });
+});

packages/adapters/codex-local/src/server/device-login-parse.ts

@@ -0,0 +1,93 @@
+// The device-login output parser. It reads the Codex `login --device-auth`
+// output and returns the login URL and the one-time code, or null.
+//
+// Security (Control 1 — strict validation): the parser accepts only the exact
+// origin and path of the device-login URL. It rejects any query, any fragment, a
+// different origin, and a different path. It accepts only the short-code
+// structure `XXXX-XXXXX` (four characters, a hyphen, then five characters). The
+// parser never logs the URL, the code, or any input byte, and it keeps them out
+// of every thrown error. The parser is a pure function.
+
+export interface DeviceLoginPrompt {
+  url: string;
+  code: string;
+}
+
+// The one and only accepted device-login URL. The parser returns this exact
+// constant string on a match, so the output is never a caller-controlled value.
+export const DEVICE_LOGIN_URL = "https://auth.openai.com/codex/device";
+
+// A candidate URL token is a run of non-space characters that starts with an
+// http or https scheme. The parser validates each candidate with the `URL`
+// class; the regular expression only splits tokens out of the text.
+const URL_TOKEN_RE = /https?:\/\/\S+/g;
+
+// Trailing punctuation that prose commonly puts right after a URL. The parser
+// strips only these characters. It never strips `?` or `#`, so a URL with a
+// query or a fragment stays malformed and the parser rejects it.
+const TRAILING_PUNCTUATION_RE = /[)\].,;:!]+$/;
+
+// The one-time code structure: four characters, a hyphen, then five characters.
+// The real code alphabet is a Codex detail that the grounded capture did not
+// keep (the capture redacted the code to `?`). So the parser matches the
+// grounded structure and binds the token class to alphanumerics and the
+// redaction sentinel `?`. The code sits on its own token, so the pattern anchors
+// on a word boundary at the start and requires a space or the end after it.
+const SHORT_CODE_RE = /(?:^|\s)([A-Za-z0-9?]{4}-[A-Za-z0-9?]{5})(?=\s|$)/m;
+
+/**
+ * Returns the exact device-login URL when `text` holds it as a standalone token
+ * with the exact origin `https://auth.openai.com` and the exact path
+ * `/codex/device` and no query, fragment, or credentials. Returns null
+ * otherwise. Returns the canonical {@link DEVICE_LOGIN_URL} constant on a match.
+ */
+function findExactDeviceUrl(text: string): string | null {
+  const tokens = text.match(URL_TOKEN_RE);
+  if (!tokens) return null;
+  for (const token of tokens) {
+    const cleaned = token.replace(TRAILING_PUNCTUATION_RE, "");
+    let parsed: URL;
+    try {
+      parsed = new URL(cleaned);
+    } catch {
+      continue;
+    }
+    if (
+      parsed.protocol === "https:" &&
+      parsed.host === "auth.openai.com" &&
+      parsed.pathname === "/codex/device" &&
+      parsed.search === "" &&
+      parsed.hash === "" &&
+      parsed.username === "" &&
+      parsed.password === ""
+    ) {
+      return DEVICE_LOGIN_URL;
+    }
+  }
+  return null;
+}
+
+/**
+ * Returns the one-time code when `text` holds a token with the structure
+ * `XXXX-XXXXX`. Returns null otherwise.
+ */
+function findShortCode(text: string): string | null {
+  const match = SHORT_CODE_RE.exec(text);
+  return match ? match[1] : null;
+}
+
+/**
+ * Parses Codex device-login output. Returns the login URL and the one-time code
+ * when both are present and valid. Returns null for any other input, including a
+ * non-string input, an absent prompt, a URL with a query or a fragment, a wrong
+ * origin or path, and a malformed short code. Never throws on input, and never
+ * puts the URL or the code into a log or an error.
+ */
+export function parseDeviceLoginPrompt(text: string): DeviceLoginPrompt | null {
+  if (typeof text !== "string" || text.length === 0) return null;
+  const url = findExactDeviceUrl(text);
+  if (!url) return null;
+  const code = findShortCode(text);
+  if (!code) return null;
+  return { url, code };
+}