[feature] OAuth passthrough for OpenAI provider (Codex CLI subscription support)#2775

Draft

thiscantbeserious wants to merge 38 commits intomaximhq:mainfrom

thiscantbeserious:feature/openai-oauth-passthrough

Commits on Apr 24, 2026

feat: add ChatGPT OAuth passthrough toggle for OpenAI provider

thiscantbeserious
and
claude
committed
fix: refactor ChatGPT OAuth — centralize body transform, fix stream forcing

thiscantbeserious
and
claude
committed
refactor: add route map and generic path resolver for ChatGPT OAuth

thiscantbeserious
and
claude
committed
test: comprehensive 100% coverage tests for ChatGPT OAuth module

thiscantbeserious
and
claude
committed
security: sanitize chatgpt_account_id against HTTP header injection

thiscantbeserious
and
claude
committed
docs: add ChatGPT OAuth passthrough setup guide for Codex CLI

thiscantbeserious
and
claude
committed
feat: auto-extract OAuth token — remove allow_direct_keys requirement

thiscantbeserious
and
claude
committed
fix(ws): default WebSocket /v1/responses to OpenAI provider

thiscantbeserious
and
claude
committed
fix(ws): also default OpenAI provider in convertEventToRequest

thiscantbeserious
and
claude
committed
fix(ws): apply ChatGPT OAuth transformations to upstream WebSocket too

thiscantbeserious
and
claude
committed
fix: apply ChatGPT OAuth to ALL OpenAI provider routes

thiscantbeserious
and
claude
committed
fix(chatgpt-oauth): append required client_version query param to /models

thiscantbeserious
and
claude
committed
debug: include upstream HTTP response in WS dial errors

thiscantbeserious
and
claude
committed
fix(openai): scope /v1/models requests to OpenAI provider only

thiscantbeserious
and
claude
committed
fix(openai): preserve Azure SDK detection in /v1/models converter

thiscantbeserious
and
claude
committed
review: address CodeRabbit findings + 100% coverage

thiscantbeserious
and
claude
committed
review: address 2nd-round CodeRabbit + Greptile findings

thiscantbeserious
and
claude
committed
test: 100% coverage on OpenAIListModelsResponse.UnmarshalJSON

thiscantbeserious
and
claude
committed
Merge branch 'main' into feature/openai-oauth-passthrough
thiscantbeserious
committed
fix(openai): forward Codex identity headers over chatgpt_oauth WebSocket

thiscantbeserious
and
claude
committed
fix(openai): move Codex identity defaults to merge helper, harden WS header blocklist

thiscantbeserious
and
claude
committed
fix(openai): gate Codex identity defaults injection to chatgpt_oauth path only

thiscantbeserious
and
claude
committed
fix(wsresponses): finalize logs for native WS upstream when parse fails or upstream closes cleanly

thiscantbeserious
and
claude
committed
fix(wsresponses): add idle timeout to upstream WS reads in tryNativeWSUpstream

thiscantbeserious
and
claude
committed
chore(wsresponses): log raw upstream WS frames for OAuth terminal-event diagnosis

thiscantbeserious
and
claude
committed
fix(logging): flush WS responses trace so log row is written to DB

thiscantbeserious
and
claude
committed
Merge remote-tracking branch 'origin/main' into feature/openai-oauth-passthrough
thiscantbeserious
committed
chore: remove /openai/v1/responses WS bare-model fix (extracted to #3006)
thiscantbeserious
committed
chore: remove /openai/v1/models fanout fix (extracted to #3007)
thiscantbeserious
committed
chore: remove WS pool dial error verbosity (extracted to #3012)

thiscantbeserious
and
claude
committed
chore: remove WS upstream idle timeout (extracted to #3013)

thiscantbeserious
and
claude
committed
chore: remove x-bf-eh-* WS forwarding (extracted to #3014)
thiscantbeserious
committed
chore: remove WS log finalization on parse failure and close (extracted to #3016)
thiscantbeserious
committed
chore: remove WS tracer flush (extracted to #3017)
thiscantbeserious
committed
chore: remove WS logging switch case (extracted to #3019)
thiscantbeserious
committed
chore: remove accumulator WS responses case (extracted to #3020)
thiscantbeserious
committed
chore: pool session liveness probe extracted to #3021 (no feature-branch duplicate)

thiscantbeserious
and
claude
committed
chore: TTL sweeper orphan flush extracted to #3022 (no feature-branch duplicate)
thiscantbeserious
committed