Allow provider selection for gateway OAuth reads and logins (#59819)

## Why

Gateway OAuth reads and logins previously used only the current provider, preventing clients from authorizing another configured provider without changing the default.

## What changed

- Add optional `modelProvider` params to `account/gatewayOAuth/read` and `account/gatewayOAuth/login`, preserving current-provider behavior for omitted or null params and selectors.
- Validate explicit providers against current managed policy without changing the default or any thread's provider.
- Retain readiness state across providers and send `account/gatewayOAuth/changed` notifications for every configured provider sharing the changed credential.
- Update protocol schemas, TypeScript types, Python models, and documentation.

## Testing

Add coverage for non-default provider login, retained readiness when alternating providers, notifications for shared credentials without starting login, and legacy TypeScript request compatibility.

GitOrigin-RevId: cfd472c322b821fe36b8c133a8de774f4ba48534

codex-rs/app-server-protocol/src/export.rs

@@ -2206,6 +2206,16 @@ mod tests {
             "params?: GetAccountRateLimitsParams | undefined, }"
         );
         assert!(client_request_ts.contains(LEGACY_ACCOUNT_RATE_LIMITS_REQUEST));
+        const LEGACY_GATEWAY_READ_REQUEST: &str = concat!(
+            "{ \"method\": \"account/gatewayOAuth/read\", id: RequestId, ",
+            "params?: GatewayOAuthReadParams | null | undefined, }"
+        );
+        assert!(client_request_ts.contains(LEGACY_GATEWAY_READ_REQUEST));
+        const LEGACY_GATEWAY_LOGIN_REQUEST: &str = concat!(
+            "{ \"method\": \"account/gatewayOAuth/login\", id: RequestId, ",
+            "params?: GatewayOAuthLoginParams | null | undefined, }"
+        );
+        assert!(client_request_ts.contains(LEGACY_GATEWAY_LOGIN_REQUEST));
         let account_usage_response_ts = std::str::from_utf8(
             fixture_tree
                 .get(Path::new("v2/GetAccountTokenUsageResponse.ts"))
@@ -2290,18 +2300,22 @@ mod tests {
                 });
 
             let contents = std::str::from_utf8(contents)?;
-            // Both stable usage RPCs originally required `params: undefined`. Preserve that
+            // These existing RPCs originally required `params: undefined`. Preserve that
             // source compatibility only for these exact envelopes, not arbitrary new fields.
             let checked_contents = if path == Path::new("ClientRequest.ts") {
                 contents
                     .replace(LEGACY_ACCOUNT_USAGE_REQUEST, "")
                     .replace(LEGACY_ACCOUNT_RATE_LIMITS_REQUEST, "")
+                    .replace(LEGACY_GATEWAY_READ_REQUEST, "")
+                    .replace(LEGACY_GATEWAY_LOGIN_REQUEST, "")
             } else {
                 contents.to_owned()
             };
             if checked_contents.contains("| undefined") {
                 undefined_offenders.push(path.clone());
             }
+            // The exact gateway envelopes above also accept legacy null params.
+            let contents = checked_contents.as_str();
 
             const SKIP_PREFIXES: &[&str] = &[
                 "const ",

codex-rs/app-server-protocol/src/protocol/common.rs

@@ -499,6 +499,26 @@ enum GetAccountRateLimitsParamsTypeScript {
     Undefined,
 }
 
+/// Preserve null and explicit undefined params while adding provider selection to gateway reads.
+#[allow(dead_code)]
+#[derive(TS)]
+#[ts(untagged)]
+enum GatewayOAuthReadParamsTypeScript {
+    Params(Option<v2::GatewayOAuthReadParams>),
+    #[ts(type = "undefined")]
+    Undefined,
+}
+
+/// Preserve null and explicit undefined params while adding provider selection to gateway login.
+#[allow(dead_code)]
+#[derive(TS)]
+#[ts(untagged)]
+enum GatewayOAuthLoginParamsTypeScript {
+    Params(Option<v2::GatewayOAuthLoginParams>),
+    #[ts(type = "undefined")]
+    Undefined,
+}
+
 client_request_definitions! {
     Initialize => "initialize" {
         params: v1::InitializeParams,
@@ -1161,12 +1181,12 @@ client_request_definitions! {
         response: v2::ModelListResponse,
     },
     GatewayOAuthRead => "account/gatewayOAuth/read" {
-        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        params: #[ts(optional, as = "Option<GatewayOAuthReadParamsTypeScript>", inline)] #[serde(default, skip_serializing_if = "Option::is_none")] v2::NullableGatewayOAuthReadParams,
         serialization: None,
         response: v2::GatewayOAuthReadResponse,
     },
     GatewayOAuthLogin => "account/gatewayOAuth/login" {
-        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        params: #[ts(optional, as = "Option<GatewayOAuthLoginParamsTypeScript>", inline)] #[serde(default, skip_serializing_if = "Option::is_none")] v2::NullableGatewayOAuthLoginParams,
         serialization: None,
         response: v2::GatewayOAuthLoginResponse,
     },

codex-rs/app-server-protocol/src/protocol/v2/account.rs

@@ -652,6 +652,30 @@ impl std::fmt::Debug for GatewayOAuthChangedNotification {
     }
 }
 
+/// Read credential readiness for a configured provider without starting browser login.
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct GatewayOAuthReadParams {
+    /// Defaults to the current provider when omitted.
+    #[ts(optional = nullable)]
+    pub model_provider: Option<String>,
+}
+
+pub type NullableGatewayOAuthReadParams = Option<GatewayOAuthReadParams>;
+
+/// Authorize a configured provider without changing the default or any thread's provider.
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct GatewayOAuthLoginParams {
+    /// Defaults to the current provider when omitted.
+    #[ts(optional = nullable)]
+    pub model_provider: Option<String>,
+}
+
+pub type NullableGatewayOAuthLoginParams = Option<GatewayOAuthLoginParams>;
+
 /// Current effective gateway policy and credential readiness; never contains credentials.
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]