feat: add optional ChatGPT agent runtime

[DavidDing16]

Summary

Thanks @DavidDing16 for the original multi-provider exploration and ChatGPT sign-in implementation.

This PR adds ChatGPT sign-in as an optional Codex App Server adapter. It does not replace GoAgent's domain-specific teacher runtime. The existing OpenAI-compatible API path remains the stable default and existing user settings continue to work.

Runtime architecture

• Adds a small AgentRuntimeAdapter boundary for OpenAI-compatible and Codex App Server providers.
• Keeps GoAgent in control of teacher sessions, cancellation, KataGo evidence, board-image evidence, knowledge retrieval, student profiles, and final evidence gates.
• Uses Codex experimental dynamicTools to call the same allowlisted Go-domain tools; no fixed evidence prefetch path remains.
• Filters Codex to board, SGF, KataGo, knowledge, profile, and report tools. Shell, filesystem, web, plugins, apps, MCP, browser, computer use, and collaboration tools are disabled.
• Runs turns with approvalPolicy=never, a read-only/network-disabled sandbox, and the per-turn temporary workspace in runtimeWorkspaceRoots using fields supported by the pinned App Server schema.
• Tool failures remain failures and do not satisfy required current-move, whole-game, or move-range evidence gates.
• Provider failures are explicit. There is no automatic fallback from ChatGPT to an API provider or the reverse.

Login and privacy

• ChatGPT login uses a GoAgent-specific CODEX_HOME under the app data directory.
• Login and logout do not modify the user's Codex CLI or Codex Desktop account state.
• OAuth and App Server tokens are never exposed through preload or renderer APIs.
• API-key profiles keep independent verification state and encrypted local keys.

Capability verification

AI readiness is granted only after three real checks pass:

• text response
• randomized PNG image recognition with high-detail vision input
• an actual dynamic-tool call and tool-result round trip

Model discovery comes from the signed-in account. Unknown image metadata is not treated as proof; the real image probe is authoritative.

Packaging

• Pins Codex App Server runtime 0.149.0.
• Adds checksummed native-runtime manifest and Apache-2.0 license.
• Packages only the current target runtime, not every platform binary.
• Source Git does not contain native Codex binaries.
• Release workflows prepare and verify macOS arm64/x64 and Windows x64 runtimes.
• Packaged smoke checks verify version, architecture, signature/runtime transform, initialize App Server, and create a real ephemeral App Server thread.

UI

• First launch and Settings offer API Key and ChatGPT sign-in as clear alternatives.
• Existing seven-language onboarding remains available.
• Status polling is single-flight and stops when the user leaves setup.
• User-facing connection status is localized instead of exposing main-process diagnostic text.

Verification

• pnpm install --frozen-lockfile
• pnpm test (262/262)
• pnpm typecheck
• pnpm build
• pnpm check
• pnpm check:teacher-quality
• Codex development and release runtime checks
• macOS arm64 packaged App Server starts as 0.149.0 and creates a real thread
• macOS arm64 app and embedded runtime pass strict code-sign verification
• Packaged first-run and Settings visual QA in a clean isolated app home
• PR CI passes on macOS, Windows, and Linux
• P0 Release Candidate passes on macOS and Windows
• Real ChatGPT account completes sign-in, image probe, and dynamic Go-tool call

The code and automated release gates are complete. Merge remains blocked only on the real-account capability check above.

[DavidDing16]

@wimi321 这份 Draft PR 新增了 ChatGPT 登录 / Codex App Server provider，并补上了当前手的 AI 讲解入口。方便时烦请 review，尤其希望确认 provider runtime 边界、旧 API Key 的兼容迁移，以及 OAuth token 的隐私处理。谢谢！

[wimi321]

感谢你投入这么多精力完善 ChatGPT 登录、多 provider 架构和当前手入口。方向很有价值，我也在 PR head 上实际跑过 pnpm test（249 项通过）、pnpm typecheck、pnpm build。不过目前有几项发布级阻塞，暂时不能合并：

1. 安装包缺少原生 Codex 可执行文件。 我用当前 PR 实际执行了 macOS directory packaging，GoAgent.app 的 app.asar 里只有 @openai/codex/bin/codex.js，Resources 与 app.asar.unpacked 中没有平台 codex binary。当前 asarUnpack: node_modules/@openai/codex-*/vendor/**/* 没有覆盖 pnpm 的 optional platform package，干净机器会退回全局 codex，普通用户因此不可用。需要增加 macOS/Windows/Linux 打包契约和“安装包内启动 app-server”的 smoke。

2. ChatGPT 路径退化成固定预取，不是 GoAgent 的 Tool-first Agent。 activeProviderSupportsTools() 对 codex-app-server 返回 false，随后 prefetchEvidenceForManagedProvider() 固定执行一组工具；而 onboarding 却把 tools 标为 ok: true，并没有真实 tool-call 验证。PR 使用的 App Server schema 已支持 dynamicTools 与 item/tool/call，建议接入同一套 teacher tool loop；若暂时不接入，必须把它明确标记为受限实验 provider，不能宣称工具能力通过。

3. 隔离与账号副作用和文档承诺不一致。 当前只设置 sandboxPolicy: { type: readOnly }，没有真正限制到临时棋盘目录，也没有禁用 Codex 内置读取/命令工具；“prompt 里要求不要调用工具”不能替代权限隔离。另外进程直接复用默认 Codex home，应用内 logout 会影响用户现有 Codex CLI/Desktop 登录。需要使用 GoAgent 独立的 Codex home，或在 UI 中明确告知共享登录与退出副作用，并用实际 allowlist/permission profile 限制能力。

4. 能力探测还不是真实探测。 inputModalities 缺失时当前默认按支持图片处理，测试连接也没有真正发送图片或触发一次工具调用。首次引导要求的文字、图片、工具三项应分别用真实请求验证，失败时不能标绿。

5. 当前分支已落后 main 并与最新老师/KataGo 修复冲突。 请先 rebase 最新 main，解决 katagoRuntime.ts、teacherAgent.ts 冲突，并保留 #38 的整盘缓存隔离、取消和实时反馈修复。

建议把上述四项补齐后再转 Ready for review。届时我会继续做完整跨平台与真实账号复测。再次感谢这次高质量探索。

[DavidDing16]

已按审核意见补齐并转为 Ready：

• 已以当前 main 与维护者的隔离 App Server 提交为基础，保留 fix: harden teacher analysis and live KataGo feedback #38 的缓存隔离、取消与实时反馈改动；
• 安装包继续通过 afterPack 内置并校验当前平台 Codex 原生运行时；CI 现会在 macOS/Windows/Linux 做 directory packaging，并从包内 runtime 初始化 App Server；
• ChatGPT 路径使用 dynamic tools 与老师同一套工具循环，首次引导以真实文字、图片、工具调用分别验证；
• Codex 使用 GoAgent 独立 CODEX_HOME；turn sandbox 限制为本次临时棋盘目录的只读 allowlist，网络关闭、approvalPolicy=never，内建高风险 item 会拒绝；
• 本机验证：pnpm test（262/262）、pnpm typecheck、pnpm package:dir，以及从 win-unpacked/resources/data/codex/bin/win32-x64/codex.exe 初始化 App Server 的 smoke 均通过。

[wimi321]

感谢 @DavidDing16 补上跨平台 directory packaging 与包内 App Server smoke，这对干净机器可用性很重要。最终复核时发现，Codex 0.149.0 的正式 App Server schema 并不支持 access/readableRoots/includePlatformDefaults 这组字段，因此不能据此宣称目录级沙盒隔离。我已在原 PR 分支做最小修正：使用该版本支持的只读且禁网 sandbox，并在 thread/turn 显式传入临时 runtimeWorkspaceRoots；整包 smoke 也从“进程能初始化”升级为“完成 initialize 并真正创建 ephemeral thread”。本地 262 项测试、类型检查、构建、老师质量门禁、macOS 包内运行时与严格签名校验均通过；GitHub 的 macOS/Windows/Linux CI 与 P0 RC 也已全部通过。现在只剩真实 ChatGPT 账号的文字、棋盘图片、动态围棋工具三项能力验收。

[wimi321]

发布准备已补到当前 PR：版本提升为 v0.4.21，新增七语言发布说明并更新全部 README 下载链接；同时修复了发布工作流默认 Transformer 选择步骤与 notarization 文档测试中的硬编码版本。pnpm check（262/262）、pnpm check:release-quality、发布说明/NVIDIA/无精简包门禁均通过，最新 macOS/Windows/Linux CI 与 P0 RC 全绿。当前只保留真实 ChatGPT OAuth 后的文字、随机棋盘图片和动态围棋工具三项人工验收；通过后即可批准、合并并创建 v0.4.21 tag。

[wimi321]

Real ChatGPT validation passed through the GoAgent Codex App Server adapter: text response, randomized board-image recognition, and dynamic GoAgent tool calling all succeeded. CI, release-quality, teacher-quality, packaged runtime, signing, and protocol checks are green.