Remove vendored keyring wrapper from auth spine

epiphany-openai-auth-spine/Cargo.toml

@@ -12,7 +12,7 @@ anyhow = "1"
 base64 = "0.22"
 chrono = { version = "0.4", features = ["serde"] }
 codex-client = { path = "../vendor/codex/codex-rs/codex-client" }
-codex-keyring-store = { path = "../vendor/codex/codex-rs/keyring-store" }
+keyring = "3.6.3"
 reqwest = { version = "0.12", features = ["blocking", "json"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

epiphany-openai-auth-spine/src/lib.rs

@@ -10,8 +10,7 @@ use chrono::DateTime;
 use chrono::Utc;
 use codex_client::build_reqwest_client_with_custom_ca;
 use codex_client::with_chatgpt_cloudflare_cookie_store;
-use codex_keyring_store::DefaultKeyringStore;
-use codex_keyring_store::KeyringStore;
+use keyring::Entry;
 use reqwest::StatusCode;
 use reqwest::header::HeaderMap;
 use reqwest::header::HeaderValue;
@@ -495,34 +494,32 @@ fn compute_store_key(codex_home: &Path) -> String {
 }
 
 fn load_keyring_auth_dot_json(codex_home: &Path) -> std::io::Result<Option<AuthDotJson>> {
-    let store = DefaultKeyringStore;
     let key = compute_store_key(codex_home);
-    match store.load(KEYRING_SERVICE, &key) {
-        Ok(Some(serialized)) => serde_json::from_str(&serialized).map(Some).map_err(|err| {
+    let entry = Entry::new(KEYRING_SERVICE, &key).map_err(|error| {
+        std::io::Error::other(format!("failed to open CLI auth keyring entry: {error}"))
+    })?;
+    match entry.get_password() {
+        Ok(serialized) => serde_json::from_str(&serialized).map(Some).map_err(|err| {
             std::io::Error::other(format!(
                 "failed to deserialize CLI auth from keyring: {err}"
             ))
         }),
-        Ok(None) => Ok(None),
+        Err(keyring::Error::NoEntry) => Ok(None),
         Err(error) => Err(std::io::Error::other(format!(
-            "failed to load CLI auth from keyring: {}",
-            error.message()
+            "failed to load CLI auth from keyring: {error}"
         ))),
     }
 }
 
 fn save_keyring_auth_dot_json(codex_home: &Path, auth: &AuthDotJson) -> std::io::Result<()> {
-    let store = DefaultKeyringStore;
     let key = compute_store_key(codex_home);
     let serialized = serde_json::to_string(auth).map_err(std::io::Error::other)?;
-    store
-        .save(KEYRING_SERVICE, &key, &serialized)
-        .map_err(|error| {
-            std::io::Error::other(format!(
-                "failed to write OAuth tokens to keyring: {}",
-                error.message()
-            ))
-        })?;
+    let entry = Entry::new(KEYRING_SERVICE, &key).map_err(|error| {
+        std::io::Error::other(format!("failed to open CLI auth keyring entry: {error}"))
+    })?;
+    entry.set_password(&serialized).map_err(|error| {
+        std::io::Error::other(format!("failed to write OAuth tokens to keyring: {error}"))
+    })?;
     if let Err(err) = delete_file_if_exists(codex_home) {
         warn!("failed to remove CLI auth fallback file: {err}");
     }

notes/fresh-workspace-handoff.md

@@ -795,6 +795,13 @@ request. `epiphany_automation.rs` still gathers live host facts and executes
 the host side effects: submit `Op::Compact`, call `epiphany_launch_job`, and
 emit JSON-RPC state-update notifications.
 
+The native OpenAI auth spine no longer depends on the vendored
+`codex-keyring-store` wrapper. It uses the standard `keyring` crate directly
+while keeping Codex's `Codex Auth` service name and `cli|{sha256 path prefix}`
+store key so existing Codex subscription keyring entries remain readable.
+`codex-client` is now the only vendored crate intentionally kept in the native
+OpenAI request path.
+
 The MCP config path is now product-quarantined. `Config::to_mcp_config` keeps
 user-declared MCP servers but no longer accepts a `PluginsManager`, folds
 plugin-provided MCP servers into the runtime, enables Codex apps, enables skill

vendor/codex/codex-rs/Cargo.lock

@@ -5138,7 +5138,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "codex-client",
- "codex-keyring-store",
+ "keyring",
  "reqwest",
  "serde",
  "serde_json",