feat: bill runs to a ChatGPT subscription via an openai_codex provider #1194

Problem

A full run fans out across analysts, two debates and a portfolio manager, so it burns a fair number of tokens. Users who already pay for a ChatGPT subscription currently cannot put that quota to work here — every OpenAI-family path in the repo bills API credits.

Why openai_compatible does not cover it

The natural first attempt is llm_provider: "openai_compatible" with backend_url pointed at the Codex endpoint. That fails, because the endpoint breaks three assumptions the shared OpenAI client makes:

1. Auth is not an API key. Credentials live in the OAuth token the official Codex app/CLI writes to ~/.codex/auth.json. The token also has to be refreshed near expiry, and the refresh token rotates — writing the new one back is required, or the Codex client itself gets logged out.
2. stream: false and store: true are rejected outright, and temperature is not accepted.
3. Input items with role system return 400. Every agent prompt in this repo is a ChatPromptTemplate whose first message is a system message, so the first analyst node fails on its first call and the run stalls before any agent completes. The fix is to relabel those items developer (the Responses-API name for the same role) on the way out; adding instructions does not make system acceptable.

Points 1 and 3 in particular cannot be expressed through config — they need a provider entry and a small ChatOpenAI subclass.

Proposal

Add an openai_codex provider to the existing registry:

• ProviderSpec.credentials_fn resolves (and refreshes/rotates) the token from ~/.codex/auth.json, overridable with TRADINGAGENTS_CODEX_AUTH_PATH.
• A CodexChatOpenAI subclass pins the payload constraints above and relabels system messages.
• CLI picker entry plus a login preflight, so an unauthenticated user gets "run codex login first" instead of a 401 mid-run.
• No behaviour changes anywhere unless the provider is selected.

Caveat worth your call

This endpoint is undocumented and unversioned — OpenAI can change it without notice — and driving subscription credentials from a third-party tool is not clearly sanctioned by OpenAI's terms. I documented both points in the README next to the provider so users choose with open eyes, but whether TradingAgents wants to ship it at all is a maintainer decision, and I would rather ask than assume.

If you would prefer this to live outside the repo, or to be gated behind an extra opt-in, I am happy to rework it.

Status

Implementation is ready and linked below: 15 files, pytest -q at 614 passed / 5 skipped, ruff check . clean.