feat(voice): add ChatGPT OAuth auth option

server/providers/openai.js

@@ -1,13 +1,17 @@
 import { defaultSourceRoot } from './common/source-root.js';
 import { handleHudSummary } from './openai/hud-summary.js';
 import { createDebugLogHandler } from './openai/debug-log.js';
-import { createRealtimeTokenHandler } from './openai/realtime.js';
+import {
+  createRealtimeOAuthLoginHandler,
+  createRealtimeOAuthStatusHandler,
+  createRealtimeTokenHandler,
+} from './openai/realtime.js';
 
 /**
  * Vite plugin: OpenAI Realtime ephemeral client secret.
  *
- * Keeps OPENAI_API_KEY server-side while the browser connects to the
- * Realtime API over WebRTC with a short-lived secret.
+ * Keeps the selected cloud credential server-side while the browser connects
+ * to the Realtime API over WebRTC with a short-lived secret.
  */
 function openAiRealtimeProxy({
   sourceRoot = defaultSourceRoot,
@@ -26,6 +30,16 @@ function openAiRealtimeProxy({
       '/api/realtime/token',
       createRealtimeTokenHandler({ ...realtime, annotationGuidance }),
     );
+
+    middlewares.use(
+      '/api/realtime/oauth-status',
+      createRealtimeOAuthStatusHandler(realtime),
+    );
+
+    middlewares.use(
+      '/api/realtime/oauth-login',
+      createRealtimeOAuthLoginHandler(realtime),
+    );
   }
 
   return {

server/providers/openai/codex-auth.js

@@ -0,0 +1,100 @@
+import { spawn } from 'node:child_process';
+import { accessSync, constants as fsConstants, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+export function codexAuthPath({
+  environment = process.env,
+  home = os.homedir(),
+} = {}) {
+  const explicit = String(environment.CODEX_AUTH_JSON || '').trim();
+  if (explicit) return path.resolve(explicit);
+  const codexHome = String(environment.CODEX_HOME || '').trim();
+  return path.join(
+    codexHome ? path.resolve(codexHome) : path.join(home, '.codex'),
+    'auth.json',
+  );
+}
+
+export function readCodexOAuthAccessToken({
+  authPath = codexAuthPath(),
+  readFile = readFileSync,
+} = {}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFile(authPath, 'utf8'));
+  } catch {
+    throw new Error(
+      'ChatGPT sign-in is unavailable. Sign in to Codex or the ChatGPT desktop app and try again.',
+    );
+  }
+  const token = String(parsed?.tokens?.access_token || '').trim();
+  if (!token) {
+    throw new Error(
+      'ChatGPT sign-in is unavailable. Sign in to Codex or the ChatGPT desktop app and try again.',
+    );
+  }
+  return token;
+}
+
+export function resolveCodexExecutable({
+  environment = process.env,
+  home = os.homedir(),
+  access = accessSync,
+} = {}) {
+  const explicit = String(environment.CODEX_BIN || '').trim();
+  if (explicit) return explicit;
+
+  for (const candidate of [
+    path.join(home, '.local', 'bin', 'codex'),
+    path.join(
+      home,
+      '.codex',
+      'packages',
+      'standalone',
+      'current',
+      'bin',
+      'codex',
+    ),
+  ]) {
+    try {
+      access(candidate, fsConstants.X_OK);
+      return candidate;
+    } catch {
+      // Fall through to the next known location, then PATH.
+    }
+  }
+  return 'codex';
+}
+
+export function startCodexChatGptLogin({
+  spawnImpl = spawn,
+  environment = process.env,
+  home = os.homedir(),
+  executable = resolveCodexExecutable({ environment, home }),
+} = {}) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawnImpl(executable, ['login'], {
+        cwd: home,
+        detached: true,
+        stdio: 'ignore',
+        env: environment,
+      });
+    } catch (error) {
+      reject(error);
+      return;
+    }
+
+    child.once('error', reject);
+    child.once('spawn', () => {
+      child.unref?.();
+      resolve({ executable });
+    });
+  }).catch((error) => {
+    throw new Error(
+      `Could not start ChatGPT sign-in with Codex: ${error?.message || error}`,
+    );
+  });
+}

server/providers/openai/realtime.js

@@ -13,12 +13,167 @@ import {
 } from './constants.js';
 import { realtimeInstructions } from './instructions.js';
 import { GEV_REALTIME_TOOLS } from './tools.js';
+import {
+  readCodexOAuthAccessToken,
+  startCodexChatGptLogin,
+} from './codex-auth.js';
+
+const LOOPBACK_ADDRESSES = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+
+function isLoopbackRequest(req) {
+  return LOOPBACK_ADDRESSES.has(String(req.socket?.remoteAddress || ''));
+}
+
+function isSameOriginRequest(req) {
+  const origin = String(req.headers?.origin || '').trim();
+  if (!origin) return true;
+  const host = String(req.headers?.host || '').trim();
+  if (!host) return false;
+  const protocol = req.socket?.encrypted ? 'https:' : 'http:';
+  try {
+    return new URL(origin).origin === new URL(`${protocol}//${host}`).origin;
+  } catch {
+    return false;
+  }
+}
+
+function requestQuery(req) {
+  try {
+    return new URL(req.url || '', 'http://localhost').searchParams;
+  } catch {
+    return new URLSearchParams();
+  }
+}
+
+function resolveRealtimeAuthMode(query) {
+  const requested = String(query.get('auth') || 'api-key').toLowerCase();
+  if (requested === 'api-key' || requested === 'oauth') return requested;
+  return null;
+}
+
+function createRealtimeOAuthStatusHandler({
+  resolveOAuthAccessToken = () => readCodexOAuthAccessToken(),
+} = {}) {
+  return (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', 'application/json');
+    if (req.method !== 'GET') {
+      res.statusCode = 405;
+      res.end(JSON.stringify({ error: 'Method not allowed' }));
+      return;
+    }
+    if (!isLoopbackRequest(req)) {
+      res.statusCode = 403;
+      res.end(
+        JSON.stringify({
+          available: false,
+          error: 'ChatGPT OAuth is available only from this machine',
+        }),
+      );
+      return;
+    }
+    try {
+      const token = resolveOAuthAccessToken();
+      if (!token) throw new Error('ChatGPT sign-in is unavailable');
+      res.statusCode = 200;
+      res.end(JSON.stringify({ available: true }));
+    } catch (error) {
+      res.statusCode = 200;
+      res.end(
+        JSON.stringify({
+          available: false,
+          error: error?.message || 'ChatGPT sign-in is unavailable',
+        }),
+      );
+    }
+  };
+}
+
+function createRealtimeOAuthLoginHandler({
+  resolveOAuthAccessToken = () => readCodexOAuthAccessToken(),
+  startOAuthLogin = () => startCodexChatGptLogin(),
+  now = () => Date.now(),
+  restartCooldownMs = 30_000,
+} = {}) {
+  let lastStartedAt = 0;
+  return async (req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', 'application/json');
+    if (req.method !== 'POST') {
+      res.statusCode = 405;
+      res.end(JSON.stringify({ error: 'Method not allowed' }));
+      return;
+    }
+    if (!isLoopbackRequest(req)) {
+      res.statusCode = 403;
+      res.end(
+        JSON.stringify({
+          available: false,
+          error: 'ChatGPT OAuth sign-in is available only from this machine',
+        }),
+      );
+      return;
+    }
+    if (!isSameOriginRequest(req)) {
+      res.statusCode = 403;
+      res.end(
+        JSON.stringify({
+          available: false,
+          error: 'Cross-origin ChatGPT OAuth sign-in is not allowed',
+        }),
+      );
+      return;
+    }
+
+    try {
+      if (resolveOAuthAccessToken()) {
+        res.statusCode = 200;
+        res.end(
+          JSON.stringify({ available: true, started: false, pending: false }),
+        );
+        return;
+      }
+    } catch {
+      // No usable local token yet; launch the supported Codex sign-in flow.
+    }
+
+    const currentTime = now();
+    if (
+      lastStartedAt > 0 &&
+      currentTime - lastStartedAt < Math.max(0, restartCooldownMs)
+    ) {
+      res.statusCode = 202;
+      res.end(
+        JSON.stringify({ available: false, started: false, pending: true }),
+      );
+      return;
+    }
+
+    try {
+      await startOAuthLogin();
+      lastStartedAt = currentTime;
+      res.statusCode = 202;
+      res.end(
+        JSON.stringify({ available: false, started: true, pending: true }),
+      );
+    } catch (error) {
+      res.statusCode = 503;
+      res.end(
+        JSON.stringify({
+          available: false,
+          error: error?.message || 'Could not start ChatGPT sign-in',
+        }),
+      );
+    }
+  };
+}
 
 function createRealtimeTokenHandler({
   annotationGuidance,
   endpoint = 'https://api.openai.com/v1/realtime/client_secrets',
   fetchImpl = (...args) => fetch(...args),
   resolveApiKey = () => process.env.OPENAI_API_KEY,
+  resolveOAuthAccessToken = () => readCodexOAuthAccessToken(),
   models = {},
 } = {}) {
   return async (req, res) => {
@@ -30,15 +185,62 @@ function createRealtimeTokenHandler({
       return;
     }
 
+    const query = requestQuery(req);
+    const authMode = resolveRealtimeAuthMode(query);
+    if (!authMode) {
+      res.statusCode = 400;
+      res.setHeader('Content-Type', 'application/json');
+      res.end(JSON.stringify({ error: 'Unsupported cloud voice auth mode' }));
+      return;
+    }
+
     // Opt-in per-IP throttle (GEV_RATELIMIT_OPENAI_PER_MIN). No-op when unset.
     if (!enforceOptInRateLimit(openAiRateLimiter(), req, res)) return;
 
-    const apiKey = resolveApiKey();
-    if (!apiKey) {
-      res.statusCode = 503;
-      res.setHeader('Content-Type', 'application/json');
-      res.end(JSON.stringify({ error: 'OPENAI_API_KEY is not set' }));
-      return;
+    let bearer;
+    if (authMode === 'oauth') {
+      if (!isLoopbackRequest(req)) {
+        res.statusCode = 403;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(
+          JSON.stringify({
+            error: 'ChatGPT OAuth voice is available only from this machine',
+          }),
+        );
+        return;
+      }
+      try {
+        bearer = resolveOAuthAccessToken();
+      } catch (error) {
+        res.statusCode = 503;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(
+          JSON.stringify({
+            error: error?.message || 'ChatGPT sign-in is unavailable',
+            code: 'CODEX_OAUTH_UNAVAILABLE',
+          }),
+        );
+        return;
+      }
+      if (!bearer) {
+        res.statusCode = 503;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(
+          JSON.stringify({
+            error: 'ChatGPT sign-in is unavailable',
+            code: 'CODEX_OAUTH_UNAVAILABLE',
+          }),
+        );
+        return;
+      }
+    } else {
+      bearer = resolveApiKey();
+      if (!bearer) {
+        res.statusCode = 503;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ error: 'OPENAI_API_KEY is not set' }));
+        return;
+      }
     }
 
     // Voice model tier, requested by the client as ?tier=standard|mini.
@@ -47,15 +249,7 @@ function createRealtimeTokenHandler({
     // bad querystring degrades to a normal session rather than a dead mic.
     // The env overrides stay authoritative per tier (see .env.example) —
     // a wrong upstream model id is then a config fix, not a code change.
-    const requestedTier = (() => {
-      try {
-        return new URL(req.url || '', 'http://localhost').searchParams.get(
-          'tier',
-        );
-      } catch {
-        return null;
-      }
-    })();
+    const requestedTier = query.get('tier');
     const tier = resolveVoiceModel(requestedTier).tier;
     const model =
       tier === 'mini'
@@ -124,7 +318,7 @@ function createRealtimeTokenHandler({
         redirect: 'error',
         signal: AbortSignal.timeout(30_000),
         headers: {
-          Authorization: `Bearer ${apiKey}`,
+          Authorization: `Bearer ${bearer}`,
           'Content-Type': 'application/json',
           'OpenAI-Safety-Identifier': 'gev-local-dev',
         },
@@ -167,4 +361,8 @@ function createRealtimeTokenHandler({
   };
 }
 
-export { createRealtimeTokenHandler };
+export {
+  createRealtimeOAuthLoginHandler,
+  createRealtimeOAuthStatusHandler,
+  createRealtimeTokenHandler,
+};