feat: add provider-aware OAuth login for memory-pro

Author: BlakeFunTeis

.gitignore

@@ -3,3 +3,4 @@ node_modules/
 memory-plugin-feature-dev
 memory-plugin-host-validation
 memory-plugin-release-consistency
+.memory-lancedb-pro/oauth.json

README.md

@@ -509,9 +509,12 @@ When `smartExtraction` is enabled (default: `true`), the plugin uses an LLM to i
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
 | `smartExtraction` | boolean | `true` | Enable/disable LLM-powered 6-category extraction |
+| `llm.auth` | string | `api-key` | `api-key` uses `llm.apiKey` / `embedding.apiKey`; `oauth` uses a project-scoped OAuth token file |
 | `llm.apiKey` | string | *(falls back to `embedding.apiKey`)* | API key for the LLM provider |
 | `llm.model` | string | `openai/gpt-oss-120b` | LLM model name |
 | `llm.baseURL` | string | *(falls back to `embedding.baseURL`)* | LLM API endpoint |
+| `llm.oauthProvider` | string | `openai-codex` | OAuth provider id used when `llm.auth` is `oauth` |
+| `llm.oauthPath` | string | `.memory-lancedb-pro/oauth.json` | Project-scoped OAuth token file used when `llm.auth` is `oauth` |
 | `extractMinMessages` | number | `2` | Minimum messages before extraction triggers |
 | `extractMaxChars` | number | `8000` | Maximum characters sent to the LLM |
 
@@ -534,6 +537,21 @@ Full config (separate LLM endpoint):
 }
 ```
 
+OAuth `llm` config (use existing Codex / ChatGPT login cache for LLM calls):
+```json
+{
+  "llm": { "auth": "oauth", "oauthProvider": "openai-codex", "model": "gpt-5.4", "oauthPath": ".memory-lancedb-pro/oauth.json" }
+}
+```
+
+Notes for `llm.auth: "oauth"`:
+
+- `llm.oauthProvider` is currently `openai-codex`.
+- OAuth tokens are project-scoped by default and should live in `.memory-lancedb-pro/oauth.json`.
+- You can set `llm.oauthPath` if you want to store that file somewhere else inside the project.
+- In `oauth` mode, leave `llm.baseURL` unset unless you intentionally want a custom ChatGPT/Codex-compatible backend.
+- This makes token rotation and revocation local to the project instead of sharing `~/.codex/auth.json` across unrelated workspaces.
+
 Disable: `{ "smartExtraction": false }`
 
 </details>
@@ -748,6 +766,9 @@ The **agent workspace** is the agent's working directory (default: `~/.openclaw/
 openclaw memory-pro list [--scope global] [--category fact] [--limit 20] [--json]
 openclaw memory-pro search "query" [--scope global] [--limit 10] [--json]
 openclaw memory-pro stats [--scope global] [--json]
+openclaw memory-pro auth login [--provider openai-codex] [--model gpt-5.4] [--oauth-path /abs/path/oauth.json]
+openclaw memory-pro auth status
+openclaw memory-pro auth logout
 openclaw memory-pro delete <id>
 openclaw memory-pro delete-bulk --scope global [--before 2025-01-01] [--dry-run]
 openclaw memory-pro export [--scope global] [--output memories.json]
@@ -757,6 +778,13 @@ openclaw memory-pro upgrade [--dry-run] [--batch-size 10] [--no-llm] [--limit N]
 openclaw memory-pro migrate check [--source /path]
 openclaw memory-pro migrate run [--source /path] [--dry-run] [--skip-existing]
 openclaw memory-pro migrate verify [--source /path]
+
+OAuth login flow:
+
+1. Run `openclaw memory-pro auth login`
+2. If `--provider` is omitted in an interactive terminal, the CLI shows an OAuth provider picker before opening the browser
+3. The command prints an authorization URL and opens your browser unless `--no-browser` is set
+4. After the callback succeeds, the command saves a project OAuth file and replaces the plugin `llm` config with OAuth settings (`auth`, `oauthProvider`, `model`, `oauthPath`)
 ```
 
 ---

README_CN.md

@@ -508,9 +508,12 @@ OpenClaw 默认行为：
 | 字段 | 类型 | 默认值 | 说明 |
 |------|------|--------|------|
 | `smartExtraction` | boolean | `true` | 是否启用 LLM 智能 6 类别提取 |
+| `llm.auth` | string | `api-key` | `api-key` 使用 `llm.apiKey` / `embedding.apiKey`；`oauth` 使用项目级 OAuth token 文件 |
 | `llm.apiKey` | string | *（复用 `embedding.apiKey`）* | LLM 提供商 API Key |
 | `llm.model` | string | `openai/gpt-oss-120b` | LLM 模型名称 |
 | `llm.baseURL` | string | *（复用 `embedding.baseURL`）* | LLM API 端点 |
+| `llm.oauthProvider` | string | `openai-codex` | `llm.auth` 为 `oauth` 时使用的 OAuth provider id |
+| `llm.oauthPath` | string | `.memory-lancedb-pro/oauth.json` | `llm.auth` 为 `oauth` 时使用的项目级 OAuth token 文件 |
 | `extractMinMessages` | number | `2` | 触发提取所需最少消息数 |
 | `extractMaxChars` | number | `8000` | 发送给 LLM 的最大字符数 |
 
@@ -533,6 +536,20 @@ OpenClaw 默认行为：
 }
 ```
 
+OAuth `llm` 配置（复用现有 Codex / ChatGPT 登录态进行 LLM 调用）：
+```json
+{
+  "llm": { "auth": "oauth", "oauthProvider": "openai-codex", "model": "gpt-5.4", "oauthPath": ".memory-lancedb-pro/oauth.json" }
+}
+```
+
+`llm.auth: "oauth"` 说明：
+
+- `llm.oauthProvider` 当前仅支持 `openai-codex`。
+- OAuth token 默认按项目存放在 `.memory-lancedb-pro/oauth.json`。
+- 如需自定义路径，可设置 `llm.oauthPath`。
+- `oauth` 模式下除非你明确要覆盖为自定义 ChatGPT/Codex 兼容后端，否则不要设置 `llm.baseURL`。
+
 禁用：`{ "smartExtraction": false }`
 
 </details>
@@ -747,6 +764,9 @@ Key 存储：不要提交到 git。使用 `${...}` 环境变量时确保 Gateway
 openclaw memory-pro list [--scope global] [--category fact] [--limit 20] [--json]
 openclaw memory-pro search "query" [--scope global] [--limit 10] [--json]
 openclaw memory-pro stats [--scope global] [--json]
+openclaw memory-pro auth login [--provider openai-codex] [--model gpt-5.4] [--oauth-path /abs/path/oauth.json]
+openclaw memory-pro auth status
+openclaw memory-pro auth logout
 openclaw memory-pro delete <id>
 openclaw memory-pro delete-bulk --scope global [--before 2025-01-01] [--dry-run]
 openclaw memory-pro export [--scope global] [--output memories.json]