feat: add OpenAI OAuth, strict model overrides, and Gmail pull mode

src/daemon/models.ts

@@ -18,6 +18,23 @@ function requireApiKey(cfg: ModelConfig, envVar: string): string {
   return key;
 }
 
+function resolveAuthCredential(cfg: ModelConfig, apiKeyEnvVar: string, authTokenEnvVar?: string): string {
+  const raw = cfg.api_key
+    ?? cfg.auth_token
+    ?? process.env[apiKeyEnvVar]
+    ?? (authTokenEnvVar ? process.env[authTokenEnvVar] : undefined);
+
+  if (!raw) {
+    const envHint = authTokenEnvVar ? `${apiKeyEnvVar} or ${authTokenEnvVar}` : apiKeyEnvVar;
+    throw new Error(
+      `Credential required for ${cfg.provider}. ` +
+      `Set ${envHint} environment variable or provide api_key/auth_token in config.`,
+    );
+  }
+
+  return raw.startsWith('Bearer ') ? raw.slice('Bearer '.length) : raw;
+}
+
 /**
  * Create a ModelClient from a provider config entry.
  * Dispatches on the `provider` field so all tiers and fallback entries
@@ -35,6 +52,7 @@ export function createClientFromConfig(cfg: ModelConfig): ModelClient {
       return new OpenAIClient({
         model: cfg.model,
         apiKey: cfg.api_key,
+        useOAuth: Boolean(cfg.use_oauth),
       });
     case 'ollama':
       return new OllamaClient({
@@ -62,7 +80,7 @@ export function createClientFromConfig(cfg: ModelConfig): ModelClient {
     case 'zhipuai':
       return new OpenAIClient({
         model: cfg.model,
-        apiKey: requireApiKey(cfg, 'ZHIPUAI_API_KEY'),
+        apiKey: resolveAuthCredential(cfg, 'ZHIPUAI_API_KEY', 'ZHIPUAI_AUTH_TOKEN'),
         baseURL: cfg.endpoint ?? 'https://api.z.ai/api/paas/v4',
       });
     case 'xai':