feat: Add OAuth authentication for Claude Pro/Max and Gemini subscriptions

[Copilot]

Enables users to authenticate with Claude Pro/Max and Google Gemini subscription credentials instead of pay-per-request API keys, leveraging subscription quotas for fixed monthly costs.

Changes

• Config: Added AnthropicOAuthConfig and GeminiOAuthConfig structs with access_token, refresh_token, and optional project_id (Gemini enterprise) fields
• Providers: Implemented AnthropicOAuthProvider and GeminiOAuthProvider using Bearer token authentication
  • Auto-preferred when OAuth config present alongside API key config
  • Full tool use and multimodal support
  • gemini-* prefix routing added
• Docs: Created docs/oauth-setup.md with PKCE flow instructions, token exchange curl examples, and troubleshooting guide

Configuration

# Claude Pro/Max - automatically preferred over [providers.anthropic]
[providers.anthropic_oauth]
access_token = "${ANTHROPIC_OAUTH_TOKEN}"
refresh_token = "${ANTHROPIC_OAUTH_REFRESH_TOKEN}"

# Gemini subscription
[providers.gemini_oauth]
access_token = "${GEMINI_OAUTH_TOKEN}"
project_id = "${GOOGLE_CLOUD_PROJECT}"  # optional, enterprise plans

Usage

export ANTHROPIC_OAUTH_TOKEN="..."
localgpt ask "Hello" --model opus  # uses OAuth provider

export GEMINI_OAUTH_TOKEN="..."
localgpt ask "Hello" --model gemini-2.0-flash

Notes

Token refresh not implemented - users must manually refresh using curl examples in docs. refresh_token fields are placeholders for future enhancement.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cdn.pyke.io
  • Triggering command: /home/REDACTED/work/localgpt/localgpt/target/debug/build/ort-sys-032f84643275bd6f/build-script-main /home/REDACTED/work/localgpt/localgpt/target/debug/build/ort-sys-032f84643275bd6f/build-script-main -std=c11 -I /home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.3--64 -I /home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.3/home/REDACTED/work/localgpt/localgpt/target/debug/build/aws-lc-sys-6eadcc74fa823f83/out/30a9a10d3f98970e-refcount_c11.o -I /home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.37.1/aws-lc/include -I /home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.37.1/�� -I /home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.37.1/aws-lc/third_party/s2n-bignum/s2n-bignum-imported/include k/lo�� f/aws-lc-sys-0.3-g 7.1/generated-include f/aws-lc-sys-0.3-fno-omit-frame-pointer 7.1/include f/aws-lc-sys-0.3-quiet 7.1/aws-lc/include f/aws-lc-sys-0.3/home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.3/home/REDACTED/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aws-lc-sys-0.37.1/aws-lc/include (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Claude and Gemini subscriptions credentials</issue_title>
<issue_description>allow authenticating with and using subscription plan oauth credentials from Gemini and Claude instead of pay per request</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Claude and Gemini subscriptions credentials #7

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.