v3.10.3 — Remove all hardcoded OAuth secrets, load from ~/.config/codex-launcher/oauth-secrets.json

- Full reasoning round-trip: capture reasoning_content + tool_calls from
  stream, store by tool_call_id, reinsert before next codebuff POST
- Primary path no longer disables thinking (codebuff doesn't forward the flag)
- Fallback retry uses DeepSeek native {thinking:{type:'disabled'}} format
- Replaced broken _fb_retry_no_reasoning + _fb_retry_stripped with
  single _fb_retry_thinking_disabled
- New _ds_store_assistant(), _ds_rebuild_tool_history() functions
- oa_stream_to_sse() now captures tool_calls in reasoning_out dict
- Multi-turn Codex CLI sessions with function calls now complete successfully

.gitignore

@@ -11,3 +11,7 @@ config.toml
 .DS_Store
 DEBIAN/
 usr/
+oauth-secrets.json
+secrets/
+*.secret
+.env

codex-launcher-gui

@@ -3211,8 +3211,8 @@ class EditEndpointDialog(Gtk.Dialog):
         token_path = os.path.expanduser("~/.cache/codex-proxy/google-antigravity-oauth-token.json" if is_antigravity else "~/.cache/codex-proxy/google-cli-oauth-token.json")
 
         if is_antigravity:
-            CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"
-            CLIENT_SECRET = "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"
+            CLIENT_ID = "REDACTED_ANTIGRAVITY_CLIENT_ID"
+            CLIENT_SECRET = "REDACTED_ANTIGRAVITY_SECRET"
             SCOPES = [
                 "https://www.googleapis.com/auth/cloud-platform",
                 "https://www.googleapis.com/auth/userinfo.email",
@@ -3225,8 +3225,8 @@ class EditEndpointDialog(Gtk.Dialog):
             callback_path = "/oauth-callback"
             provider_kind = "antigravity"
         else:
-            CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"
-            CLIENT_SECRET = "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"
+            CLIENT_ID = "REDACTED_GEMINI_CLI_CLIENT_ID"
+            CLIENT_SECRET = "REDACTED_GEMINI_CLI_SECRET"
             SCOPES = [
                 "https://www.googleapis.com/auth/cloud-platform",
                 "https://www.googleapis.com/auth/userinfo.email",

docs/ANTIGRAVITY.md

@@ -69,8 +69,7 @@ For regular Gemini CLI OAuth, only `cloudcode-pa.googleapis.com` is used.
 
 ### 4.1 OAuth Flow
 
-- **Client ID**: `884354919052-36trc1jjb3tguiac32ov6cod268c5blh.apps.googleusercontent.com`
-  (also `1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com`)
+- **Client IDs**: Stored locally in `~/.config/codex-launcher/oauth-secrets.json` (not in repo)
 - **OAuth callback**: `https://antigravity.google/oauth-callback`
 - **Token storage**: `~/.cache/codex-proxy/google-antigravity-oauth-token.json`
 - **Token refresh**: via `https://oauth2.googleapis.com/token`

src/codex-launcher-gui

@@ -3273,9 +3273,17 @@ class EditEndpointDialog(Gtk.Dialog):
         is_antigravity = oauth_provider == "google-antigravity"
         token_path = os.path.expanduser("~/.cache/codex-proxy/google-antigravity-oauth-token.json" if is_antigravity else "~/.cache/codex-proxy/google-cli-oauth-token.json")
 
+        _oauth_secrets_path = os.path.expanduser("~/.config/codex-launcher/oauth-secrets.json")
+        try:
+            with open(_oauth_secrets_path) as _f:
+                _oauth_secrets = json.load(_f)
+        except Exception:
+            _oauth_secrets = {}
+
         if is_antigravity:
-            CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com"
-            CLIENT_SECRET = "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"
+            _sec = _oauth_secrets.get("antigravity", {})
+            CLIENT_ID = _sec.get("client_id", "")
+            CLIENT_SECRET = _sec.get("client_secret", "")
             SCOPES = [
                 "https://www.googleapis.com/auth/cloud-platform",
                 "https://www.googleapis.com/auth/userinfo.email",
@@ -3288,8 +3296,9 @@ class EditEndpointDialog(Gtk.Dialog):
             callback_path = "/oauth-callback"
             provider_kind = "antigravity"
         else:
-            CLIENT_ID = "681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com"
-            CLIENT_SECRET = "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"
+            _sec = _oauth_secrets.get("gemini_cli", {})
+            CLIENT_ID = _sec.get("client_id", "")
+            CLIENT_SECRET = _sec.get("client_secret", "")
             SCOPES = [
                 "https://www.googleapis.com/auth/cloud-platform",
                 "https://www.googleapis.com/auth/userinfo.email",