Add Codex OAuth LLM provider

README.md

@@ -144,7 +144,7 @@ import { MemoryClient } from '@atomicmemory/sdk';
 
 const memory = new MemoryClient({
   providers: {
-    atomicmemory: { apiUrl: 'http://localhost:3050' },
+    atomicmemory: { apiUrl: 'http://localhost:17350' },
   },
 });
 

adapters/openai-agents/README.md

@@ -117,7 +117,7 @@ pnpm --filter @atomicmemory/openai-agents build
 Run the backend smoke test without making an OpenAI API call:
 
 ```bash
-export ATOMICMEMORY_API_URL="http://localhost:3050"
+export ATOMICMEMORY_API_URL="http://localhost:17350"
 export ATOMICMEMORY_API_KEY="..."
 export ATOMICMEMORY_PROVIDER="atomicmemory"
 export ATOMICMEMORY_SCOPE_USER="$USER"

adapters/openai-agents/scripts/smoke-backend.mjs

@@ -2,7 +2,7 @@ import { MemoryClient } from '@atomicmemory/sdk';
 import { augmentInputWithMemory, runWithMemory } from '../dist/index.js';
 import { userInfo } from 'node:os';
 
-const apiUrl = 'http://127.0.0.1:3050';
+const apiUrl = 'http://127.0.0.1:17350';
 const provider = process.env.ATOMICMEMORY_PROVIDER || 'atomicmemory';
 
 if (provider !== 'atomicmemory' && provider !== 'mem0') {

packages/cli/README.md

@@ -59,7 +59,7 @@ the rest of the integrations repo.
 
 ```bash
 atomicmemory
-atomicmemory init --api-url http://127.0.0.1:3050 --user "$USER"
+atomicmemory init --api-url http://127.0.0.1:17350 --user "$USER"
 atomicmemory doctor
 atomicmemory status
 atomicmemory add "The project uses pnpm workspaces."
@@ -78,7 +78,7 @@ Every command accepts the same provider and scope overrides:
 ```bash
 atomicmemory search "release policy" \
   --provider atomicmemory \
-  --api-url http://127.0.0.1:3050 \
+  --api-url http://127.0.0.1:17350 \
   --user "$USER" \
   --namespace atomicmemory
 ```

packages/cli/cli-spec.json

@@ -71,7 +71,7 @@
         "--trust-surface local|self-hosted|authenticated-wrapper"
       ],
       "examples": [
-        "atomicmemory init --profile local --api-url http://127.0.0.1:3050 --user $USER",
+        "atomicmemory init --profile local --api-url http://127.0.0.1:17350 --user $USER",
         "echo \"$ATOMICMEMORY_API_KEY\" | atomicmemory init --api-key-stdin --save-api-key --profile cloud"
       ]
     },

packages/cli/scripts/test-backend-docker.mjs

@@ -173,7 +173,7 @@ function listDockerPublishedPorts() {
 function bringUp(appPort, pgPort) {
   log(`docker compose up${SKIP_BUILD ? '' : ' --build'} (this may take a few minutes on first run)…`);
   // Layer order matters: core base → core smoke (transformers
-  // embedding, dummy OpenAI key, port 3050) → CLI overlay (routes
+  // embedding, dummy OpenAI key, port 17350) → CLI overlay (routes
   // LLM at the mock-openai-extraction service so /v1/memories/ingest
   // actually returns 200 instead of 401).
   const args = [

packages/cli/src/__tests__/adapter-atomicmemory.test.ts

@@ -35,7 +35,7 @@ import { CliError } from '../types.js';
 
 const profile: CliProfileShape = {
   provider: 'atomicmemory',
-  apiUrl: 'http://localhost:3050',
+  apiUrl: 'http://localhost:17350',
   trustSurface: 'local',
   apiKey: 'sk-test',
 };

packages/cli/src/__tests__/adapter-registry.test.ts

@@ -19,7 +19,7 @@ import type { MemoryClient } from '@atomicmemory/sdk';
 
 const baseProfile: CliProfileShape = {
   provider: 'atomicmemory',
-  apiUrl: 'http://localhost:3050',
+  apiUrl: 'http://localhost:17350',
   trustSurface: 'local',
 };
 

packages/cli/src/__tests__/backend-gated-smoke.test.ts

@@ -5,7 +5,7 @@
  * network access; opt in with:
  *
  *   ATOMICMEMORY_TEST_BACKEND=1 \
- *     ATOMICMEMORY_TEST_API_URL=http://127.0.0.1:3050 \
+ *     ATOMICMEMORY_TEST_API_URL=http://127.0.0.1:17350 \
  *     pnpm test:backend
  *
  * These tests verify semantic outcomes, not just exit codes: persisted
@@ -27,7 +27,7 @@ const binPath = resolve(cliRoot, 'dist', 'bin.js');
 
 const skipIfDisabled =
   process.env.ATOMICMEMORY_TEST_BACKEND !== '1' || !existsSync(binPath);
-const apiUrl = process.env.ATOMICMEMORY_TEST_API_URL ?? 'http://127.0.0.1:3050';
+const apiUrl = process.env.ATOMICMEMORY_TEST_API_URL ?? 'http://127.0.0.1:17350';
 
 interface RunResult {
   stdout: string;

packages/cli/src/__tests__/interactive-dashboard.test.ts

@@ -98,7 +98,7 @@ test('bare dashboard hydrates saved profile and scope for cached commands', () =
   const scope = resolveRuntimeScope(invocation, profile, {});
 
   assert.equal(profile?.provider, 'atomicmemory');
-  assert.equal(profile?.apiUrl, 'http://localhost:3050');
+  assert.equal(profile?.apiUrl, 'http://localhost:17350');
   assert.deepEqual(scope, { user: 'user-from-profile' });
 });
 
@@ -116,7 +116,7 @@ test('mergeInteractiveFlags inherits only profile, provider, scope, and config f
   const merged = mergeInteractiveFlags(
     {
       agent: true,
-      'api-url': 'http://localhost:3050',
+      'api-url': 'http://localhost:17350',
       json: true,
       namespace: 'testing',
       output: 'quiet',
@@ -128,7 +128,7 @@ test('mergeInteractiveFlags inherits only profile, provider, scope, and config f
   );
 
   assert.deepEqual(merged, {
-    'api-url': 'http://localhost:3050',
+    'api-url': 'http://localhost:17350',
     interactive: false,
     limit: 5,
     namespace: 'testing',
@@ -320,7 +320,7 @@ test('formatDashboardCommandResult styles config profiles without leaking api ke
         },
         local: {
           provider: 'atomicmemory',
-          apiUrl: 'http://localhost:3050',
+          apiUrl: 'http://localhost:17350',
           trustSurface: 'local',
           scope: {
             user: 'user-1',
@@ -335,7 +335,7 @@ test('formatDashboardCommandResult styles config profiles without leaking api ke
   assert.match(rendered, /profile local \(active\)/);
   assert.match(rendered, /provider\s+atomicmemory/);
   assert.match(rendered, /trust surface\s+local/);
-  assert.match(rendered, /api url\s+http:\/\/localhost:3050/);
+  assert.match(rendered, /api url\s+http:\/\/localhost:17350/);
   assert.match(rendered, /scope\s+user=user-1 namespace=testing/);
   assert.match(rendered, /api key\s+configured \(redacted\)/);
   assert.match(rendered, /profile cloud/);
@@ -418,7 +418,7 @@ function sessionConfig(user: string): RuntimeState['config'] {
     profiles: {
       default: {
         provider: 'atomicmemory',
-        apiUrl: 'http://localhost:3050',
+        apiUrl: 'http://localhost:17350',
         trustSurface: 'local',
         scope: { user },
       },

packages/cli/src/__tests__/profile-resolution.test.ts

@@ -47,7 +47,7 @@ test('persisted profile keeps its saved trust surface', () => {
       profiles: {
         default: {
           provider: 'atomicmemory',
-          apiUrl: 'http://127.0.0.1:3050',
+          apiUrl: 'http://127.0.0.1:17350',
           trustSurface: 'local',
         },
       },

packages/core/.env.example

@@ -41,14 +41,14 @@ CORE_API_KEY=replace-with-a-strong-random-secret
 STORAGE_KEY_HMAC_SECRET=000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
 
 # --- Server ---
-PORT=3050
+PORT=17350
 # Required deployment posture for storage-policy gates. Use `local` for
 # laptop/docker-compose development, `staging` for pre-prod, and `production`
 # for hardened hosted deployments.
 # Docker image local mode defaults this to `local` when omitted.
 RAW_STORAGE_DEPLOYMENT_ENV=local
-# Comma-separated list of allowed CORS origins (default: localhost:3050,3081)
-# ALLOWED_ORIGINS=http://localhost:3050,http://localhost:3081
+# Comma-separated list of allowed CORS origins (default: localhost:17350,3081)
+# ALLOWED_ORIGINS=http://localhost:17350,http://localhost:3081
 
 # --- Embedding ---
 # EMBEDDING_PROVIDER=openai
@@ -108,6 +108,13 @@ EMBEDDING_DIMENSIONS=1536
 # For fully local/no-provider-key development, pair this with a non-OpenAI
 # embedding provider such as EMBEDDING_PROVIDER=transformers.
 
+# Personal local Codex extraction, no separate OpenAI API key:
+# LLM_PROVIDER=codex
+# Optional: defaults to CODEX_HOME/auth.json or ~/.codex/auth.json.
+# CODEX_AUTH_PATH=/path/to/codex/auth.json
+# For fully local/no-provider-key development, pair this with a non-OpenAI
+# embedding provider such as EMBEDDING_PROVIDER=transformers.
+
 # --- Runtime config mutation (dev/test only) ---
 # Opt-in gate for PUT /memories/config. Leave unset in production — the
 # route returns 410 Gone unless this is true.

packages/core/Dockerfile

@@ -52,6 +52,10 @@ COPY --from=node-base /usr/local/lib/node_modules /usr/local/lib/node_modules
 RUN ln -sf ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
   && ln -sf ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
 
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+
 # Production node_modules + package.json from pnpm deploy.
 COPY --from=builder /deploy/node_modules ./node_modules
 COPY --from=builder /deploy/package.json ./package.json
@@ -69,7 +73,7 @@ RUN useradd --create-home appuser \
 
 ENV PATH="/usr/lib/postgresql/17/bin:${PATH}"
 ENV NODE_ENV=production
-ENV PORT=3050
+ENV PORT=17350
 ENV DATABASE_URL=embedded
 ENV EMBEDDING_DIMENSIONS=1536
 ENV RAW_STORAGE_DEPLOYMENT_ENV=local
@@ -79,7 +83,7 @@ ENV EMBEDDED_POSTGRES_PORT=5432
 ENV EMBEDDED_POSTGRES_USER=atomicmemory
 ENV EMBEDDED_POSTGRES_DB=atomicmemory
 
-EXPOSE 3050
+EXPOSE 17350
 
 ENTRYPOINT ["/app/scripts/docker-entrypoint.sh"]
 CMD ["./node_modules/.bin/tsx", "src/server.ts"]

packages/core/README.md

@@ -56,7 +56,7 @@ Postgres/pgvector database and persists it to the mounted host directory:
 export OPENAI_API_KEY=sk-...
 
 docker run --rm -it --pull always \
-  -p 127.0.0.1:3050:3050 \
+  -p 127.0.0.1:17350:17350 \
   -e OPENAI_API_KEY=$OPENAI_API_KEY \
   -v $HOME/.atomicstrata/atomicmemory-docker:/var/lib/atomicmemory/postgres \
   ghcr.io/atomicstrata/atomicmemory-core:latest
@@ -78,7 +78,7 @@ export CORE_API_KEY=$(openssl rand -hex 32)
 export STORAGE_KEY_HMAC_SECRET=$(openssl rand -hex 32)
 
 docker run --rm -it --pull always \
-  -p 3050:3050 \
+  -p 17350:17350 \
   -e DATABASE_URL=postgresql://user:pass@postgres.example.com:5432/atomicmemory \
   -e OPENAI_API_KEY=$OPENAI_API_KEY \
   -e CORE_API_KEY=$CORE_API_KEY \
@@ -123,7 +123,7 @@ npm run migrate
 npm run dev
 ```
 
-Health check: `curl http://localhost:3050/v1/memories/health`
+Health check: `curl http://localhost:17350/v1/memories/health`
 
 ### Migrations
 
@@ -237,7 +237,7 @@ overlays the startup `RuntimeConfig` for that single request. Useful for
 A/B tests, experiments, or dial-turning without restarting the server.
 
 ```bash
-curl -X POST http://localhost:3050/v1/memories/search \
+curl -X POST http://localhost:17350/v1/memories/search \
   -H 'Content-Type: application/json' \
   -d '{
     "user_id": "alice",
@@ -268,7 +268,7 @@ release.
 |----------|-------------|
 | `DATABASE_URL` | Postgres connection string (must have pgvector extension) |
 | `OPENAI_API_KEY` | OpenAI API key (when using `openai` embedding/LLM provider) |
-| `PORT` | Server port (default: 3050) |
+| `PORT` | Server port (default: 17350) |
 
 ### Embedding Provider
 
@@ -297,13 +297,20 @@ Set `LLM_PROVIDER` to choose the extraction backend:
 | `anthropic` | Anthropic Messages API |
 | `google-genai` | Google Gemini OpenAI-compatible endpoint |
 | `claude-code` | Local Claude Code Agent SDK session for personal development |
-
-For personal local use, `LLM_PROVIDER=claude-code` uses the logged-in
-`claude` CLI session instead of requiring `ANTHROPIC_API_KEY`. It still consumes
-the user's Claude Code / Claude subscription limits and is not intended for
-hosted or team deployments. Pair it with a non-OpenAI embedding provider, such
-as `EMBEDDING_PROVIDER=transformers`, if you want to run without an OpenAI API
-key as well.
+| `codex` | Local Codex account session for personal development |
+
+For personal local use, `LLM_PROVIDER=claude-code` and `LLM_PROVIDER=codex`
+use the logged-in `claude` or `codex` account session instead of requiring a
+separate LLM API key. `claude-code` routes through the Claude Agent SDK;
+`codex` reads the auth file produced by `codex login` and calls the Codex
+backend directly. They still consume the user's account limits and are not
+intended for hosted or team deployments. Pair either one with a non-OpenAI
+embedding provider, such as `EMBEDDING_PROVIDER=transformers`, if you want to
+run without an OpenAI API key as well.
+
+For AtomicMemory for Codex local setup, prefer `codex login` with
+`LLM_PROVIDER=codex`. Use `LLM_PROVIDER=openai` plus `OPENAI_API_KEY` for
+hosted or team deployments.
 
 In-process benchmark harnesses can avoid editing env files by passing a
 composition-time config to the runtime:

packages/core/docker-compose.image.yml

@@ -20,10 +20,10 @@ services:
     image: ghcr.io/atomicstrata/atomicmemory-core:latest
     restart: unless-stopped
     ports:
-      - "${APP_PORT:-3050}:3050"
+      - "${APP_PORT:-17350}:17350"
     environment:
       DATABASE_URL: postgresql://atomicmemory:atomicmemory@postgres:5432/atomicmemory
-      PORT: "3050"
+      PORT: "17350"
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
     env_file:
       - ${ENV_FILE:-.env}
@@ -33,7 +33,7 @@ services:
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://localhost:3050/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:17350/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
       interval: 15s
       timeout: 5s
       retries: 3

packages/core/docker-compose.smoke-isolated.yml

@@ -20,10 +20,10 @@ services:
     build: .
     restart: unless-stopped
     ports:
-      - "${APP_PORT:-3061}:3050"
+      - "${APP_PORT:-3061}:17350"
     environment:
       DATABASE_URL: postgresql://atomicmemory:atomicmemory@postgres:5432/atomicmemory
-      PORT: "3050"
+      PORT: "17350"
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
       EMBEDDING_PROVIDER: transformers
       EMBEDDING_MODEL: Xenova/all-MiniLM-L6-v2
@@ -55,7 +55,7 @@ services:
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://localhost:3050/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:17350/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
       interval: 15s
       timeout: 5s
       retries: 3

packages/core/docker-compose.smoke.yml

@@ -10,4 +10,4 @@ services:
       - EMBEDDING_DIMENSIONS=384
       - LLM_PROVIDER=openai
       - OPENAI_API_KEY=sk-smoke-test-dummy
-      - PORT=3050
+      - PORT=17350

packages/core/docker-compose.yml

@@ -24,10 +24,10 @@ services:
       dockerfile: packages/core/Dockerfile
     restart: unless-stopped
     ports:
-      - "${APP_PORT:-3050}:3050"
+      - "${APP_PORT:-17350}:17350"
     environment:
       DATABASE_URL: postgresql://atomicmemory:atomicmemory@postgres:5432/atomicmemory
-      PORT: "3050"
+      PORT: "17350"
       OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
     env_file:
       - ${ENV_FILE:-.env}
@@ -37,7 +37,7 @@ services:
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://localhost:3050/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
+      test: ["CMD", "node", "-e", "fetch('http://localhost:17350/health').then(r=>{if(!r.ok)throw 1}).catch(()=>process.exit(1))"]
       interval: 15s
       timeout: 5s
       retries: 3

packages/core/openapi.json

@@ -15591,7 +15591,7 @@
   "servers": [
     {
       "description": "Local development server",
-      "url": "http://localhost:3050"
+      "url": "http://localhost:17350"
     }
   ],
   "webhooks": {}

packages/core/openapi.yaml

@@ -10924,5 +10924,5 @@ security:
   - bearerAuth: []
 servers:
   - description: Local development server
-    url: http://localhost:3050
+    url: http://localhost:17350
 webhooks: {}

packages/core/scripts/generate-openapi.ts

@@ -50,7 +50,7 @@ function generate(): void {
       license: { name: 'Apache-2.0', url: 'https://www.apache.org/licenses/LICENSE-2.0' },
     },
     servers: [
-      { url: 'http://localhost:3050', description: 'Local development server' },
+      { url: 'http://localhost:17350', description: 'Local development server' },
     ],
     // Document-level default: every `/v1/*` route requires the
     // `bearerAuth` scheme registered in `openapi.ts`. Individual