[staklab]

Motivation

Add an explicit provider for OpenAI's documented Sign in with ChatGPT flow for
open-source, locally hosted tools. Users authorize their own ChatGPT account and
eligible plan usage, discover account-specific models, and run Claude Code through
the public Responses API. Existing provider selection and defaults are preserved.

The implementation follows OpenAI's registration,
inference,
preview limitations,
and recovery
documentation, reviewed on October 28, 2026.

Design

• Add siwc auth login/status/logout, siwc models, and siwc serve with named
  account profiles. Browser authorization uses PKCE, fresh state/nonce, the issued
  dynamic client ID, and a stable installation host ID. Returning authorization
  validates identity before replacing the selected profile.
• Keep credentials separate from other providers. Validate ID-token signatures
  and claims through official discovery/JWKS. Serialize refresh rotation across
  processes, persist atomically, retain registration on logout, and require
  reauthorization after an uncertain refresh outcome.
• Select an isolated SIWC registry explicitly. Inference uses only
  POST https://api.openai.com/v1/responses with the selected OAuth access token;
  model discovery uses the corresponding public /models endpoint. There is no
  inference fallback or configurable alternative SIWC endpoint.
• Reuse the pure Responses request translator and Anthropic event translator.
  System content becomes instructions/developer input; local function definitions
  become additional_tools input items. Every upstream inference request sends
  the required history, store: false, and stream: true.
• Add a default optional provider catalog hook, isolated routing/security checks,
  and an opt-out for the legacy Codex Read-stall repair. Other providers retain
  their existing behavior.

Compatibility and failure handling

Claude Code text, supported images, local function tools, tool results, buffered
responses, and portable session history are translated. Unsupported hosted tools,
document blocks, invalid tool history, and unsupported Responses parameters fail
explicitly. Anthropic sampling/output-limit/cache fields accepted for client
compatibility are omitted upstream. Token counts are estimates.

HTTP errors are handled before SSE validation and preserve upstream status,
error.code, error.param, request ID, and a safe message. Legal media-type
parameters are accepted. Headerless responses require a complete Responses SSE
event with bounded probing; large initial events containing echoed instructions
or schemas are supported. JSON/HTML/empty HTTP 200 responses cannot become a
successful turn. response.completed is required; failed, incomplete, disconnected,
or malformed tool streams do not produce synthetic success.

Inference POSTs are not automatically replayed. A bounded in-memory guard blocks
identical failed requests for 60 seconds, including stream-to-buffered fallback,
and responses advise clients with x-should-retry: false. Catalog GETs retain
bounded backoff. A plan usage-limit error pauses new inference in that process.
These measures are not durable exactly-once execution guarantees.

The client setup example scopes CLAUDE_CODE_AUTO_MODE_SERVER=0 to the Claude Code
process. It disables the server classifier probe while retaining client
classification, permissions, and their possible token usage. No permission bypass
or fabricated classifier result is introduced.

Security boundaries

• SIWC listeners are restricted to loopback. Browser-origin requests, external
  Host values, and non-loopback peers are rejected. Other local processes still
  have access to the unauthenticated local API.
• Credential directories/files require 0700/0600; symlinks and hard-linked
  credential files are rejected. Credentials are private plaintext, not encrypted
  at rest. This storage implementation currently requires macOS/Linux permissions.
• Traffic capture and persistent upstream error-body files are disabled for SIWC.
  Structured diagnostics contain bounded metadata and request-shape counts;
  prompts, tool arguments, and bearer credentials are excluded/redacted.
• Tests contain synthetic accounts, a deliberately public mock RSA signing key,
  and a sanitized Claude Code 2.1.310 request structure. No real registration,
  user credentials, project data, or build artifacts are included.
• The original MIT license and copyright remain unchanged. This project remains
  independent of OpenAI and Anthropic.

Validation

On macOS Apple Silicon with Rust 1.95.0:

• cargo fmt --check — passed.
• cargo clippy --all-targets -- -D warnings — passed.
• cargo test — 1,187 passed, 0 failed; includes 47 SIWC unit/Mock cases and the
  SIWC CLI integration case.
• cargo build --release --locked — passed.
• Locked documentation installation and bun run --cwd docs build — passed,
  23 pages generated.
• git diff --check and commit-snapshot credential/scope audit — passed.

The first preparatory commit resolves three pre-existing collapsible_match
warnings in upstream main under this Rust toolchain. It preserves behavior and
is isolated from the SIWC feature commits.

Known limitations

No live account requests were made during preparation of this extracted branch.
Real OAuth consent, live model availability, native Claude Code text, Read/Write/
Bash, and --resume/--continue acceptance must still be repeated against these
exact commits with a test account. Mock success is not live SIWC acceptance.
Linux was not exercised locally, Windows SIWC storage is not implemented, and
GitHub CI has not run for this unpublished branch.

The adapter implements a bounded subset of the preview: HTTP/SSE and portable
history, without native Codex continuation, hosted search, native compaction, or
OpenAI-compatible ingress routes. Service/model/account support may change.

The scope is the provider, protocol compatibility, tests, and upstream docs.
Launchers, desktop UI, installers, and release packaging are outside this PR.

Related work

PR #76 concerns an optional
Codex-backed Responses ingress endpoint; PR #85
concerns Codex Images routes. PR #183
changes Codex auto-review behavior. These do not provide this separate official
SIWC registration and public inference path. Searches of open/closed PRs for
SIWC and the official OSS flow found no duplicate implementation.