Sign in with a ChatGPT subscription

Start with #38, which this work depends on, then read src/server/upstream/client.ts and src/server/upstream/proxy/handler.ts to understand request routing. The issue maps work across provider types and runtime, OAuth storage and API, desktop settings, CLI cleanup, and docs/glossary.md. Done means the ChatGPT sign-in flow, token refresh, model routing, safeguards, and cleanup work, with the listed tests and manual checks passing.

Problem

DreamCoder only accepts API keys. Many people pay for ChatGPT but have no OpenAI API key, so they cannot use DreamCoder with that subscription.

#104 (ac0ea44) removed the earlier subscription sign-in ("DreamCoder is BYOK only"). This issue brings back ChatGPT only. Claude account sign-in stays removed, and Grok is out of scope.

What is in the tree today

• CLI side, still present but unreachable from the app: src/services/openaiAuth/.
  • client.ts:9-15 holds the issuer (auth.openai.com), the Codex client id, the endpoint chatgpt.com/backend-api/codex/responses, callback port 1455 and /auth/callback.
  • It also has the authorize, exchange and refresh code, and reads chatgpt_account_id from the JWT.
  • fetch.ts rewrites /v1/messages into a streaming Responses request. models.ts has a hard-coded model list. claude auth login --openai is still registered.
• Reusable: AuthCodeListener (src/services/oauth/auth-code-listener.ts), a temporary localhost server that checks state, and the PKCE helpers (src/services/oauth/crypto.ts).
• Removed in #104: the server OAuth service, /api/provider-openai-oauth, the fixed openai-official provider (runtimeKind: 'openai_oauth') and the desktop login component. They can be read with git show ac0ea44^:<path> as a reference.

In the removed design the CLI process called ChatGPT itself and skipped the upstream module (docs/glossary.md:23-25, "官方渠道"). This issue proposes a different design.

Design

The server owns the tokens, and requests go through the upstream module.

Why not restore the old design:

• OpenAI rotates refresh tokens. With several CLI and scheduled-task processes refreshing from one token file, one refresh can invalidate the tokens the others hold.
• #83 made src/server/upstream/client.ts the only place that talks to upstreams. ChatGPT should not be the exception.

Upstream module (src/server/upstream/client.ts)

• UpstreamTarget (:25-30) is a fixed { baseUrl, apiKey, apiFormat, authStrategy }, and both OpenAI formats hard-code Authorization: Bearer ${apiKey} (:125, :133). Changes:
  • Auth resolved per request. Add an async auth step that returns fresh headers. The target is already rebuilt on every request (proxy/handler.ts:23), so this is the natural place.
  • Full endpoint URL. /v1/responses is hard-coded and cannot produce /backend-api/codex/responses.
  • Extra headers: ChatGPT-Account-Id, plus whatever client identification the backend requires.
  • Streaming only. The Codex backend needs stream: true. Non-streaming callers (title generation, the provider test) must stream and aggregate. The aggregator exists: proxy/streaming/openaiResponsesStreamToAnthropicResponse.ts.
  • Reasoning summaries. When thinking is enabled, send reasoning: { effort, summary: 'auto' }, as the Codex CLI does. Without summary the backend streams no reasoning_summary_text events and no thinking shows. #38 leaves this out on purpose: OpenAI's public API rejects summary for unverified organizations on some models, so it is added only for this provider.
  • One refresh and retry on 401.

Provider model

• Add an OAuth kind next to anthropic_compatible (src/server/types/provider.ts:19). It has no apiKey and uses apiFormat: openai_responses.
• It always routes through /proxy (providerRuntimeEnv.ts:185-190). The CLI sees the usual dummy key.
• checkAuthStatus and runProviderTest (providerService.ts:305-308, which rejects an empty key) learn about it.
• Models: follow #120. The candidates come from the account's model list on the Codex backend, with the current list in models.ts as a fallback (it is already out of date). The user adds models and may pick a fast model, like any other provider. No role mapping of its own.

Server OAuth service and API

• Start sign-in: PKCE, state, callback on localhost:1455/auth/callback through AuthCodeListener. Also offer copy-link and paste-the-code fallbacks for when the browser cannot reach the callback.
• Status and sign-out endpoints.
• Token storage (decided): a 0600 file under <configDir>/dreamcoder/ on every platform, written atomically. No keychain: once an unsigned app carries the quarantine attribute, the macOS keychain can silently refuse a headless process like the sidecar, so token reads would fail with 403. The file also gives one code path on all three platforms (Windows and Linux have no keychain support in the tree, src/utils/secureStorage/index.ts:9-17). API keys are already stored in plain providers.json, so this is no weaker.
• Tokens never leave the server. GET /api/providers already returns API keys to the UI (providerService.ts:101-104). OAuth tokens must not be added to it.

Desktop

• A "Sign in with ChatGPT" choice in Settings → Providers, showing the account and plan and offering sign-out.
• A risk confirmation before the first sign-in. This is not an official integration (see below). The user should know the account could be restricted.

Clean-up

• Remove the CLI-only path that nothing in the app reaches: src/services/api/client.ts:185-208, claude auth login --openai, fetch.ts. Keep only what the server reuses.
• Update docs/glossary.md ("官方渠道") to the new design.

Depends on

• #120 (any number of models per provider, optional fast model).
• #38 (Responses content shape, reasoning, cached tokens). Without it screenshots are dropped and reasoning never shows. One point there needs checking against the Codex backend: assistant text parts are sent as input_text, and the backend may expect output_text.

Risks

• Not official. Sign-in uses the Codex CLI's public client id, and requests identify as the Codex client. OpenAI can block this or restrict accounts at any time.
• Unpublished backend. Headers, required fields and allowed models can change without notice. Our client identification (codex-cli/0.91.0 in client.ts:15) is already far behind the current Codex CLI.
• Port 1455 is fixed by the registered redirect. It collides with a running Codex CLI login.
• Windows: AuthCodeListener binds localhost (auth-code-listener.ts:46), which may resolve to ::1. Tokens are stored as a plain file. Needs separate verification.
• Local access to /proxy: it requires a token only in some modes (src/server/index.ts:283-295). Any local process could then spend the user's subscription through it. Worth tightening as part of this work.

Plan

One PR, after #38:

1. Upstream module: per-request auth, endpoint override, headers, streaming only, retry on 401.
2. Provider kind and runtime env.
3. Server OAuth service, API, token storage.
4. Desktop sign-in, risk confirmation, model list.
5. Remove the CLI-only path and update the glossary.
6. Tests: a fake auth server for the full flow and refresh (including a rotated refresh token), the upstream request shape for Codex, and the aggregation for non-streaming callers.

Verification

• Unit and integration tests as above.
• Manual on macOS with a real ChatGPT account:
  • sign in, chat with a screenshot, see the reasoning;
  • a title is generated;
  • a scheduled task runs;
  • force an expired access token and confirm the refresh;
  • sign out.
• Windows needs separate verification.