chore(vendor): import pi 1.3.0

Imported as a linear vendor commit so forge rebases do not replay the upstream root tree.

git-subtree-dir: third_party/pi

git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0

third_party/pi/packages/ai/test/openai-codex-oauth.test.ts

@@ -1,3 +1,4 @@
+import { createServer } from "node:http";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { openaiCodexOAuth } from "../src/auth/oauth/openai-codex.ts";
 
@@ -483,4 +484,76 @@ describe("OpenAI Codex OAuth", () => {
 		).rejects.toThrow(/OpenAI Codex token refresh failed \(401\).*Could not validate your token/);
 		expect(consoleError).not.toHaveBeenCalled();
 	});
+
+	it("uses the app's agent name as the browser login originator", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async () =>
+				jsonResponse({ access_token: createAccessToken("acct"), refresh_token: "refresh", expires_in: 3600 }),
+			),
+		);
+
+		let authUrl = "";
+		await openaiCodexOAuth.login(
+			{
+				signal: neverAbortedSignal,
+				notify: (event) => {
+					if (event.type === "auth_url") authUrl = event.url;
+				},
+				prompt: async (prompt) => {
+					if (prompt.type === "select") return "browser";
+					if (prompt.type !== "manual_code") throw new Error(`Unexpected prompt: ${prompt.type}`);
+					const state = new URL(authUrl).searchParams.get("state");
+					return `http://localhost:1455/auth/callback?code=pasted-code&state=${state}`;
+				},
+			},
+			{ agentName: "my-app" },
+		);
+
+		expect(new URL(authUrl).searchParams.get("originator")).toBe("my-app");
+	});
+
+	it("falls back to the pasted redirect URL when the fixed callback port is taken", async () => {
+		// Port 1455 is registered with OpenAI; the Codex CLI may hold it. Occupy it unless it already is.
+		const blocker = createServer();
+		await new Promise<void>((resolve) => {
+			blocker.once("error", () => resolve());
+			blocker.listen(1455, "127.0.0.1", () => resolve());
+		});
+		try {
+			let exchangeBody: URLSearchParams | undefined;
+			vi.stubGlobal(
+				"fetch",
+				vi.fn(async (input: unknown, init?: RequestInit) => {
+					expect(getUrl(input)).toBe("https://auth.openai.com/oauth/token");
+					exchangeBody = new URLSearchParams(String(init?.body));
+					return jsonResponse({
+						access_token: createAccessToken("acct"),
+						refresh_token: "refresh",
+						expires_in: 3600,
+					});
+				}),
+			);
+
+			let authUrl = "";
+			const credential = await openaiCodexOAuth.login({
+				signal: neverAbortedSignal,
+				notify: (event) => {
+					if (event.type === "auth_url") authUrl = event.url;
+				},
+				prompt: async (prompt) => {
+					if (prompt.type === "select") return "browser";
+					if (prompt.type !== "manual_code") throw new Error(`Unexpected prompt: ${prompt.type}`);
+					const state = new URL(authUrl).searchParams.get("state");
+					return `http://localhost:1455/auth/callback?code=pasted-code&state=${state}`;
+				},
+			});
+
+			expect(credential.accountId).toBe("acct");
+			expect(exchangeBody?.get("code")).toBe("pasted-code");
+			expect(exchangeBody?.get("redirect_uri")).toBe("http://localhost:1455/auth/callback");
+		} finally {
+			blocker.close();
+		}
+	});
 });