对齐 Codex CLI 0.159.3 的通用画像、模型能力与原生协议

crates/aether-oauth/src/provider/providers/codex.rs

@@ -3,6 +3,16 @@ use super::generic::{
 };
 use crate::provider::ProviderOAuthAdapter;
 
+/// Codex CLI 的公开 OAuth 权限范围，不包含账户专属值。
+pub const CODEX_OAUTH_SCOPES: &[&str] = &[
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    "api.connectors.read",
+    "api.connectors.invoke",
+];
+
 #[derive(Debug, Clone)]
 pub struct CodexProviderOAuthAdapter {
     inner: GenericProviderOAuthAdapter,
@@ -45,6 +55,7 @@ impl ProviderOAuthAdapter for CodexProviderOAuthAdapter {
             query.append_pair("prompt", "login");
             query.append_pair("id_token_add_organizations", "true");
             query.append_pair("codex_cli_simplified_flow", "true");
+            query.append_pair("originator", "codex_cli_rs");
         }
         response.authorize_url = url.to_string();
         Ok(response)
@@ -156,6 +167,26 @@ mod tests {
         assert!(response
             .authorize_url
             .contains("codex_cli_simplified_flow=true"));
+        let url = url::Url::parse(&response.authorize_url).unwrap();
+        let query = url.query_pairs().collect::<BTreeMap<_, _>>();
+        assert_eq!(
+            query.get("scope").map(|value| value.as_ref()),
+            Some("openid profile email offline_access api.connectors.read api.connectors.invoke")
+        );
+        assert_eq!(
+            query.get("originator").map(|value| value.as_ref()),
+            Some("codex_cli_rs")
+        );
+        assert_eq!(
+            query
+                .get("code_challenge_method")
+                .map(|value| value.as_ref()),
+            Some("S256")
+        );
+        assert_eq!(
+            query.get("state").map(|value| value.as_ref()),
+            Some("state-1")
+        );
     }
 
     #[tokio::test]

crates/aether-oauth/src/provider/providers/generic.rs

@@ -92,7 +92,7 @@ pub const GENERIC_PROVIDER_OAUTH_TEMPLATES: &[GenericProviderOAuthTemplate] = &[
         client_id: "app_EMoamEEZ73f0CkXaXp7hrann",
         client_id_env: None,
         client_secret_env: None,
-        scopes: &["openid", "email", "profile", "offline_access"],
+        scopes: super::codex::CODEX_OAUTH_SCOPES,
         redirect_uri: "http://localhost:1455/auth/callback",
         use_pkce: true,
         uses_json_payload: false,

crates/aether-oauth/src/provider/providers/mod.rs

@@ -12,7 +12,7 @@ pub use claude_code::{
     CLAUDE_CODE_COOKIE_SCOPE, CLAUDE_CODE_OAUTH_SCOPES, CLAUDE_CODE_PROVIDER_TYPE,
     CLAUDE_CODE_REDIRECT_URI, CLAUDE_CODE_TOKEN_URL, CLAUDE_CODE_WEB_BASE_URL,
 };
-pub use codex::CodexProviderOAuthAdapter;
+pub use codex::{CodexProviderOAuthAdapter, CODEX_OAUTH_SCOPES};
 pub use generic::{
     derive_codex_identity_fingerprint, GenericProviderOAuthAdapter, GenericProviderOAuthTemplate,
     ANTIGRAVITY_OAUTH_CLIENT_ID_ENV, ANTIGRAVITY_OAUTH_CLIENT_SECRET_ENV,