[GH-ISSUE #435] Windows: codex-deepseek-setup-en.ps1 breaks the ChatGPT desktop app (forced_login_method=api); no request ever reaches DeepSeek #132

New issue

Open

opened 2026-10-26 09:45:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 09:45:49 +00:00

Owner

Originally created by @Tyxiang on GitHub (Sep 30, 2026).
Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/435

Environment

Item	Version
OS	Windows 11
Codex / ChatGPT desktop app (MSIX `OpenAI.Codex`)	26.928.2636.0 (app-server reports `client_version=26.928.21956`)
Codex CLI	0.130.0 (npm), 0.159.2 (bundled with the app)
Script	`codex-deepseek-setup-en.ps1` (menu option 1, `deepseek-flash`); the zh-CN `.ps1` was run as well
Log source	`%USERPROFILE%\.codex\logs_2.sqlite`, table `logs`, 21,103 rows covering 2026-09-20 → 2026-09-30

Symptom

After running the one-command script, the Codex / ChatGPT desktop app becomes unusable: every model request fails with 401, the plugin marketplace and remote control stop working, and escalated turns end in Turn error.

At the same time not a single request ever reached the DeepSeek API. In the whole 21,103-row log database the string api.deepseek.com appears exactly twice, and both occurrences are the client echoing its own configuration object — there is no request or response from DeepSeek anywhere.

So this is not an API key, balance, or base_url problem: the client breaks before any DeepSeek traffic is produced.

Evidence (2026-09-30, local time; secrets redacted)

1. The provider block the script wrote is correct and did load:

[12:57:30] DEBUG codex_core::session::session
Configuring session: model=gpt-5.5;
provider=ConfiguredModelProvider { info: ModelProviderInfo {
  name: "deepseek",
  base_url: Some("https://api.deepseek.com/"),
  experimental_bearer_token: Some(<redacted>),
  wire_api: Responses,
  requires_openai_auth: false, ... },
  auth_manager: Some(AuthManager { codex_home: "C:\\Users\\en143\\.codex",
    auth_credentials_store_mode: File,
    forced_login_method: Some(Api),                    <-- the problem
    chatgpt_base_url: Some("https://chatgpt.com/backend-api/"), ... }) }

2. Global auth was forced to API-key mode, so ChatGPT-dependent services 401:

[12:55:40] WARN codex_core::responses_retry
sampling_error=unexpected status 401 Unauthorized:
Missing bearer or basic authentication in header, url: https://api.openai.com/v1/responses

[12:57:23] WARN codex_core_plugins::manager
failed to warm featured plugin ids cache error=remote featured plugin request to
https://chatgpt.com/backend-api/plugins/featured?platform=codex failed with status 401 Unauthorized

[12:54:00 ~ 12:58:02] INFO codex_app_server_transport::...::websocket   (360 occurrences)
waiting to resolve remote control preference until authentication is available
error=remote control requires ChatGPT authentication

3. The two routing worlds collide — a DeepSeek model id is sent to the ChatGPT backend:

[12:58:48] WARN codex_core::session::startup_prewarm
startup websocket prewarm setup failed: {"type":"error","status":400,
 "error":{"type":"invalid_request_error",
 "message":"The 'deepseek-flash' model is not supported when using Codex with a ChatGPT account."}}

4. preferred_auth_method is a dead key in every shipped build:

[12:57:23] ERROR codex_app_server
Codex is ignoring 1 unrecognized configuration setting. ...
  user (C:\Users\en143\.codex\config.toml): `preferred_auth_method` is ignored.

String scanning both codex.exe binaries confirms it: preferred_auth_method occurs 0 times in 0.130.0 and 0.159.2, while forced_login_method occurs 2 and 22 times. So only the latter takes effect, and it is the destructive one.

5. model_catalog_json replaces the built-in catalog:

Unknown model gpt-5.5 is used. This will use fallback model metadata.
Unknown model gpt-6-sol is used. This will use fallback model metadata.

Writing ~/.codex/models.json with only the two DeepSeek slugs removes metadata for the app's built-in models.

Restoring config.toml (13:00:14) resolved everything: from 13:02 the logs show auth_mode="Chatgpt", auth_header_attached=true, successful /models calls and zero ERROR rows.

Root cause

The script's DeepSeek provider stanza is correct and matches the docs. The failure comes from the three settings it writes alongside it:

forced_login_method = "api" switches the client to API-key auth and stops attaching the ChatGPT OAuth credential. But the desktop app is not a pure model client: its plugin marketplace, remote control, account state, model-catalog refresh and startup prewarm all target chatgpt.com/backend-api and require the ChatGPT session. They all fail with 401.
preferred_auth_method = "apikey" is not recognized by any shipped Codex build (see 4) and only produces an ERROR-level log line.
model_catalog_json = "~/.codex/models.json" replaces rather than merges the built-in catalog.

Because all three live in the shared ~/.codex/config.toml, config.toml-based isolation is impossible: the CLI, the desktop app and the IDE extension all read it.

Suggested fixes

Do not write forced_login_method = "api" by default. At minimum, detect the ChatGPT desktop app and let the user choose between "CLI only" and "desktop app degrades".
Drop preferred_auth_method, or add support for it — today it only yields an ERROR log.
Offer a CLI-only mode that writes the configuration into a separate CODEX_HOME (e.g. %USERPROFILE%\.codex-deepseek) and leaves the shared ~/.codex/config.toml untouched. This should be the recommended default, since it keeps the desktop app fully signed in.
Merge model_catalog_json with the built-in catalog, or document that built-in model metadata is replaced.
Verify the documented rollback path. The docs say the previous configuration is backed up to ~/.codex/backup-deepseek/, but that directory did not exist on this machine (nor did ~/.codex/models.json), so the restore was done by hand.
Document the desktop-app limitation in the Codex integration guide. It currently mentions only that session history is grouped by login method; it does not say the desktop app loses plugins, remote control and cloud features in API-key mode.

Note

This is a user-side diagnosis from client logs, not a patch — the script source itself was not available to me (the CDN serves it as application/octet-stream). Happy to provide the full raw log rows or reproduce on request.

中文摘要

Windows 上执行 codex-deepseek-setup-en.ps1（菜单 1，deepseek-flash）后，Codex / ChatGPT 桌面端完全不可用：模型请求全部 401，插件市场与远程控制失效；而整个日志库 21,103 条中 api.deepseek.com 只出现 2 次（均为配置回显），没有任何请求真正到达 DeepSeek。

脚本写入的 provider 段（base_url / wire_api = "responses" / experimental_bearer_token）与文档一致、本身正确。问题是它一并写入的 forced_login_method = "api" 把客户端切成 API Key 认证模式，而桌面端的插件市场、远程控制、账号态固定访问 chatgpt.com/backend-api 且必须携带 ChatGPT OAuth，因此全部 401。另外 preferred_auth_method 在当前所有已发布 Codex 构建中都不存在（两个 codex.exe 字符串扫描均为 0 次命中），model_catalog_json 会替换而非合并内置模型目录。

建议：不要默认写入 forced_login_method；删除 preferred_auth_method；增加"仅 CLI"模式（写入独立 CODEX_HOME，不碰共享配置）；合并而非替换模型目录；复核文档承诺的备份路径。

Originally created by @Tyxiang on GitHub (Sep 30, 2026). Original GitHub issue: https://github.com/deepseek-ai/awesome-deepseek-agent/issues/435 ### Environment | Item | Version | | --- | --- | | OS | Windows 11 | | Codex / ChatGPT desktop app (MSIX `OpenAI.Codex`) | 26.928.2636.0 (app-server reports `client_version=26.928.21956`) | | Codex CLI | 0.130.0 (npm), 0.159.2 (bundled with the app) | | Script | `codex-deepseek-setup-en.ps1` (menu option 1, `deepseek-flash`); the zh-CN `.ps1` was run as well | | Log source | `%USERPROFILE%\.codex\logs_2.sqlite`, table `logs`, 21,103 rows covering 2026-09-20 → 2026-09-30 | ### Symptom After running the one-command script, the Codex / ChatGPT desktop app becomes unusable: every model request fails with `401`, the plugin marketplace and remote control stop working, and escalated turns end in `Turn error`. At the same time **not a single request ever reached the DeepSeek API**. In the whole 21,103-row log database the string `api.deepseek.com` appears exactly twice, and both occurrences are the client echoing its own configuration object — there is no request or response from DeepSeek anywhere. So this is not an API key, balance, or `base_url` problem: the client breaks before any DeepSeek traffic is produced. ### Evidence (2026-09-30, local time; secrets redacted) **1. The provider block the script wrote is correct and did load:** ``` [12:57:30] DEBUG codex_core::session::session Configuring session: model=gpt-5.5; provider=ConfiguredModelProvider { info: ModelProviderInfo { name: "deepseek", base_url: Some("https://api.deepseek.com/"), experimental_bearer_token: Some(<redacted>), wire_api: Responses, requires_openai_auth: false, ... }, auth_manager: Some(AuthManager { codex_home: "C:\\Users\\en143\\.codex", auth_credentials_store_mode: File, forced_login_method: Some(Api), <-- the problem chatgpt_base_url: Some("https://chatgpt.com/backend-api/"), ... }) } ``` **2. Global auth was forced to API-key mode, so ChatGPT-dependent services 401:** ``` [12:55:40] WARN codex_core::responses_retry sampling_error=unexpected status 401 Unauthorized: Missing bearer or basic authentication in header, url: https://api.openai.com/v1/responses [12:57:23] WARN codex_core_plugins::manager failed to warm featured plugin ids cache error=remote featured plugin request to https://chatgpt.com/backend-api/plugins/featured?platform=codex failed with status 401 Unauthorized [12:54:00 ~ 12:58:02] INFO codex_app_server_transport::...::websocket (360 occurrences) waiting to resolve remote control preference until authentication is available error=remote control requires ChatGPT authentication ``` **3. The two routing worlds collide — a DeepSeek model id is sent to the ChatGPT backend:** ``` [12:58:48] WARN codex_core::session::startup_prewarm startup websocket prewarm setup failed: {"type":"error","status":400, "error":{"type":"invalid_request_error", "message":"The 'deepseek-flash' model is not supported when using Codex with a ChatGPT account."}} ``` **4. `preferred_auth_method` is a dead key in every shipped build:** ``` [12:57:23] ERROR codex_app_server Codex is ignoring 1 unrecognized configuration setting. ... user (C:\Users\en143\.codex\config.toml): `preferred_auth_method` is ignored. ``` String scanning both `codex.exe` binaries confirms it: `preferred_auth_method` occurs **0 times** in 0.130.0 and 0.159.2, while `forced_login_method` occurs 2 and 22 times. So only the latter takes effect, and it is the destructive one. **5. `model_catalog_json` replaces the built-in catalog:** ``` Unknown model gpt-5.5 is used. This will use fallback model metadata. Unknown model gpt-6-sol is used. This will use fallback model metadata. ``` Writing `~/.codex/models.json` with only the two DeepSeek slugs removes metadata for the app's built-in models. Restoring `config.toml` (13:00:14) resolved everything: from 13:02 the logs show `auth_mode="Chatgpt"`, `auth_header_attached=true`, successful `/models` calls and zero `ERROR` rows. ### Root cause The script's DeepSeek provider stanza is correct and matches the docs. The failure comes from the three settings it writes alongside it: 1. **`forced_login_method = "api"`** switches the client to API-key auth and stops attaching the ChatGPT OAuth credential. But the desktop app is not a pure model client: its plugin marketplace, remote control, account state, model-catalog refresh and startup prewarm all target `chatgpt.com/backend-api` and require the ChatGPT session. They all fail with 401. 2. **`preferred_auth_method = "apikey"`** is not recognized by any shipped Codex build (see 4) and only produces an ERROR-level log line. 3. **`model_catalog_json = "~/.codex/models.json"`** replaces rather than merges the built-in catalog. Because all three live in the shared `~/.codex/config.toml`, `config.toml`-based isolation is impossible: the CLI, the desktop app and the IDE extension all read it. ### Suggested fixes 1. **Do not write `forced_login_method = "api"` by default.** At minimum, detect the ChatGPT desktop app and let the user choose between "CLI only" and "desktop app degrades". 2. **Drop `preferred_auth_method`**, or add support for it — today it only yields an ERROR log. 3. **Offer a CLI-only mode** that writes the configuration into a separate `CODEX_HOME` (e.g. `%USERPROFILE%\.codex-deepseek`) and leaves the shared `~/.codex/config.toml` untouched. This should be the recommended default, since it keeps the desktop app fully signed in. 4. **Merge `model_catalog_json` with the built-in catalog**, or document that built-in model metadata is replaced. 5. **Verify the documented rollback path.** The docs say the previous configuration is backed up to `~/.codex/backup-deepseek/`, but that directory did not exist on this machine (nor did `~/.codex/models.json`), so the restore was done by hand. 6. **Document the desktop-app limitation** in the Codex integration guide. It currently mentions only that session history is grouped by login method; it does not say the desktop app loses plugins, remote control and cloud features in API-key mode. ### Note This is a user-side diagnosis from client logs, not a patch — the script source itself was not available to me (the CDN serves it as `application/octet-stream`). Happy to provide the full raw log rows or reproduce on request. --- ### 中文摘要 Windows 上执行 `codex-deepseek-setup-en.ps1`（菜单 1，`deepseek-flash`）后，Codex / ChatGPT 桌面端完全不可用：模型请求全部 401，插件市场与远程控制失效；而整个日志库 21,103 条中 `api.deepseek.com` 只出现 2 次（均为配置回显），**没有任何请求真正到达 DeepSeek**。脚本写入的 provider 段（`base_url` / `wire_api = "responses"` / `experimental_bearer_token`）与文档一致、本身正确。问题是它一并写入的 `forced_login_method = "api"` 把客户端切成 API Key 认证模式，而桌面端的插件市场、远程控制、账号态固定访问 `chatgpt.com/backend-api` 且必须携带 ChatGPT OAuth，因此全部 401。另外 `preferred_auth_method` 在当前所有已发布 Codex 构建中都不存在（两个 codex.exe 字符串扫描均为 0 次命中），`model_catalog_json` 会替换而非合并内置模型目录。建议：不要默认写入 `forced_login_method`；删除 `preferred_auth_method`；增加"仅 CLI"模式（写入独立 CODEX_HOME，不碰共享配置）；合并而非替换模型目录；复核文档承诺的备份路径。

bsakaguchi referenced this issue

2026-10-26 09:46:56 +00:00

[PR #132] Add Proma — open-source desktop AI agent with DeepSeek as a preset provider #219