Add managed ChatGPT auth and local Responses API compatibility resources

[incapdns]

What variant of Codex are you using?

CLI

What feature would you like to see?

Summary

• add --auth chatgpt to responses-api-proxy, backed by the existing Codex login and configuration;
• preserve the original stdin API-key mode as the default;
• expose OpenAI-compatible Models list and retrieve operations in ChatGPT mode, dynamically backed
  by the configured Codex provider catalog;
• expose the complete REST Responses resource through the loopback-only /v1/responses API;
• support create, retrieve, delete, cancel, compact, input-token counting, and input-item listing;
• keep Responses resource bodies opaque so JSON responses and SSE streams are forwarded without schema translation;
• normalize the public API's string/easy-message input shorthand to the item-list representation required by the ChatGPT Codex backend;
• supply store: false and an empty input list when those optional public fields are omitted, without overwriting explicit values;
• add an enabled-by-default POST /v1/chat/completions compatibility adapter over the Responses backend, including JSON and SSE output translation;
• make the compatibility adapter configurable through --chat-completions-compat, standard -c overrides, and [responses_api_proxy] in config.toml.
• implement the complete Conversations and Conversation Items REST resources locally when using ChatGPT auth;
• integrate conversation requests with Responses JSON/SSE while keeping the upstream stateless;
• persist logical history separately from opportunistic Compact checkpoints.
• allow an explicit IPv4 or IPv6 listener address through --listen-host and
  responses_api_proxy.listen_host, while retaining loopback as the secure default.

Authentication and configuration

ChatGPT mode reuses Codex's AuthManager, configured model provider, HTTP client factory, and auth-header provider. This keeps token refresh, 401 recovery, account/FedRAMP headers, Cloudflare cookies, proxy policy, and custom CA behavior aligned with the rest of Codex. Inbound Authorization is always discarded and replaced with the managed credential.

The subcommand accepts standard Codex -c key=value overrides and --strict-config, and can be run directly or through the root codex responses-api-proxy command. The listener remains restricted to 127.0.0.1, with a configurable or ephemeral port.

Chat Completions compatibility is enabled by default and can be disabled with --chat-completions-compat=false or responses_api_proxy.chat_completions_compat = false. The CLI flag has precedence over configuration.

Conversations compatibility is also enabled by default. Its persistent store path and automatic Compact interval are configurable through CLI flags or [responses_api_proxy] values.

The listener defaults to 127.0.0.1. --listen-host <IP> overrides
responses_api_proxy.listen_host; non-loopback binds emit a warning because downstream clients
are not authenticated by the proxy.

Responses routes

• POST /v1/responses
• GET /v1/responses/{response_id}
• DELETE /v1/responses/{response_id}
• POST /v1/responses/{response_id}/cancel
• POST /v1/responses/compact
• POST /v1/responses/input_tokens
• GET /v1/responses/{response_id}/input_items

Only documented retrieve and input-item-list query parameters are accepted. Unsupported methods, paths, traversal-like IDs, and query parameters continue to receive 403 Forbidden. Provider-level query parameters are preserved when resource URLs are derived.

Models compatibility

GET /v1/models and GET /v1/models/{model} return the public API's list and model object
shapes. Each call fetches the current Codex provider catalog with managed authentication and exposes
only entries whose visibility is list and whose supported_in_api flag is true. The compact
decoder deliberately ignores instructions and all other backend-only metadata. Models outside the
dynamic filter return the standard 404 model_not_found envelope. Since the Codex catalog has no
public creation timestamp, the required created value uses the Unix epoch as a stable unknown
sentinel.

Chat Completions compatibility

POST /v1/chat/completions translates common text/image/file messages, assistant function calls, tool outputs, function definitions and choices, reasoning effort, structured output, token limits, and sampling fields to a stateless Responses request. Chat file parts are flattened from the public type: "file" wrapper into Responses type: "input_file" content. The reverse adapter emits standard non-streaming chat.completion objects or incremental chat.completion.chunk SSE frames, including function-call argument deltas, finish reasons, usage, errors, and [DONE].

The adapter rejects unsupported parameters explicitly and supports only n: 1. Stored Chat Completions resource methods are deliberately out of scope because the ChatGPT Codex backend requires store: false.

Conversations compatibility

Because the ChatGPT Codex backend does not expose /conversations, the proxy provides local create, retrieve, update, and delete operations plus create, list, retrieve, and delete item operations. A Responses request containing conversation is expanded with local history before being sent upstream with store: false; completed input/output items are then persisted and the downstream JSON/SSE response is annotated with the public conversation ID.

The local store preserves the logical item history across restarts. Compact output is maintained as a separate execution checkpoint after a configurable number of new items, so REST pagination remains lossless. Unsupported Compact models or backends fall back to full stateless history.

Testing

• just test -p codex-responses-api-proxy — 42 tests passed
• cargo build --release -p codex-cli
• just fix -p codex-responses-api-proxy
• just fmt
• release-binary Models smoke test confirming the provider-backed dynamic filter, individual model
  retrieval, and 404 model_not_found for filtered models
• release-binary smoke test covering Conversations and Conversation Items CRUD plus persistent
  storage permissions
• live ChatGPT SSE regression test covering named event: frames, terminal responses with an empty
  output array, persisted response.output_item.done items, and context continuity across calls
• config smoke test confirming responses_api_proxy.listen_host="127.0.0.2" binds the actual
  socket to an alternate loopback address

The tests exercise managed ChatGPT header injection and every supported Responses route against a mock upstream, route/query rejection, provider-query preservation, Chat request translation, Conversation/Items persistence and pagination, Responses context expansion, Compact checkpointing, and JSON/SSE response adaptation.

Additional information

Verifiable via the remote repository at https://github.com/incapdns/codex