feat: accept full ChatGPT session JSON for Codex manual import (#6636)

[diegosouzapw]

Summary

The Codex OAuth modal's manual-paste handler only recognized a bare JWT (/^eyJ/). Pasting the raw JSON object copied straight from https://chatgpt.com/api/auth/session ({user, accessToken, expires}) fell through to the OAuth-code/URL parser and errored out — exactly the failure reported in #6636.

• Added src/lib/oauth/utils/codexSessionImport.ts — a pure, unit-testable normalizer (parseCodexSessionJson / looksLikeCodexSessionJson) that extracts the access token from the exact chatgpt.com/api/auth/session shape plus common aliases (access_token, sessionToken, session_token, nested tokens.access_token), and rejects malformed/tokenless/expired input with a typed, actionable error.
• Wired OAuthModal.tsx's handleManualSubmit Codex branch to detect a pasted JSON object and route it through the normalizer before falling through to the OAuth-code parser. Extracted the existing bare-JWT fetch logic into a small shared submitCodexAccessToken() helper reused by both branches (same pattern as the oauthBlobSubmit.ts extraction from feat(oauth): remote Antigravity login via local helper + paste-credentials #5203) — OAuthModal.tsx is a frozen god-file (config/quality/file-size-baseline.json), so all new normalizer/parsing logic lives in the new sibling module; only wiring lives in the modal itself. The modal's frozen line budget grew 998->1030 (gate units) and required a rebaseline entry (_rebaseline_2026_07_19_6636_codex_session_json) since this is a genuine new branch, not pure wiring.
• Hardened POST /api/oauth/codex/import-token (Step 3, shipped) to accept either the existing { accessToken: string, name?: string } body or { session: {...}, name?: string } for non-UI/API callers, reusing the same normalizer. Error responses continue to go through buildErrorBody().

Validation (TDD, Hard Rule #18)

New tests were written first — they fail on origin/release/v3.8.49 (the codexSessionImport.ts module doesn't exist there) and pass after the fix:

• tests/unit/codex-session-json-import-6636.test.ts (new, 10 tests) — normalizer field-alias detection, expired-session rejection (expires field and JWT exp claim), malformed/non-object rejection, tokenless rejection, non-JWT token rejection, and looksLikeCodexSessionJson shape-guard cases.
• tests/unit/codex-import-token-route.test.ts (extended, +2 tests) — the route accepts a full session-JSON body end-to-end and creates an identical connection to the bare-accessToken path; an expired session-JSON body is rejected with a 400.

node --import tsx/esm --test tests/unit/codex-session-json-import-6636.test.ts tests/unit/codex-import-token-route.test.ts
# 21 pass, 0 fail

Gates run (all green)

• node scripts/check/check-test-discovery.mjs
• npm run typecheck:core
• npm run typecheck:noimplicit:core (pre-existing unrelated failures in combo.ts/usageTracking.ts/cliRuntime.ts confirmed present on origin/release/v3.8.49, untouched by this PR)
• npx eslint --suppressions-location config/quality/eslint-suppressions.json <changed files>
• npm run check:complexity-ratchets (required extracting parseRequestBody()/resolveAccessToken() in the route to keep POST's own cyclomatic complexity flat as the accepted body shapes grew)
• node scripts/check/check-file-size.mjs (OAuthModal.tsx rebaselined 998->1030 with a dated, cited justification comment, following the feat(oauth): remote Antigravity login via local helper + paste-credentials #5203/feat(providers): add xAI OAuth PKCE provider #7399 precedent)
• npm run check:cycles
• npm run check:docs-sync

npm run test:coverage was not run locally (heavy gate, shared box) — the change is additive-only: a new pure module with its own full test file, plus 2 new route tests; no existing assertion was removed or weakened. CI runs the coverage gate authoritatively.

Deferred

• The plan's Step 6/manual-verification item — a live VPS smoke test importing a real chatgpt.com/api/auth/session JSON to confirm the token has sufficient backend-api scope through the executor — was deferred: no live ChatGPT session was available in this session. This is the plan's own stated residual risk ("a chatgpt.com web-session accessToken may carry narrower scopes than the Codex CLI's PKCE-issued token"); the server-side storage/executor path is unchanged from the already-shipped bare-token import ([BUG] compressContext() is implemented but never integrated into chatCore.ts request pipeline #1290, authType: "access_token"), so this widens only which pasted shapes reach that existing, working path.

Closes #6636

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!