Community implementation of #924 — Sign in with ChatGPT subscription

[YizukiAme]

This is a complete, cherry-pickable community implementation of #924 — "Sign in with ChatGPT (Codex subscription)" as an LLM provider.

Status: the maintainers have declined a native adapter in core for now, and I respect that decision. This branch exists for self-hosters who want the feature today, as an opt-in patch you apply to your own deployment. If OpenAI ever ships an officially supported third-party OAuth path, this can serve as a reference for reconsidering native support.

What's included

Branch codex-oauth-provider — based on current upstream/main, five commits:

1. 528502b6 — server-side OAuth core: browser PKCE + device-code login, atomic on-disk credential vault (0600, symlink-safe), token refresh/rotation, bounded response parsing
2. d63096b3 — AI SDK provider plumbing: Codex Responses transport with stream guards, stable logical sessions, reasoning support
3. cb832cc3 — auth API routes and model catalog (models reflect what your account actually exposes)
4. 38cccf53 — settings UI ("Sign in with ChatGPT", account status, sign-out), device-code & browser flows, i18n (8 locales), deployment gating
5. 139d0f15 — gpt-image-2 image generation via the same subscription

How to adopt

git remote add yizuki https://github.com/YizukiAme/SpiralMAIC.git
git fetch yizuki codex-oauth-provider
git cherry-pick 528502b6^..139d0f15

Disclaimers — read before adopting

• This uses the unofficial integration path (Codex CLI client ID against ChatGPT backend endpoints). OpenAI documents ChatGPT sign-in for its own Codex clients, not third-party apps — it can change or stop working at any time.
• Usage counts against your ChatGPT plan limits, not an API balance, and is subject to OpenAI's terms.
• Tokens are stored server-side on your machine. Never expose such a deployment as a public multi-user service.