yyjeqhc · yyjeqhc · Aug 25, 2026 · Aug 25, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -54,6 +54,7 @@ url = "2"
 sha2 = "0.10"
 tempfile = "3"
 zstd = "0.13"
+zip = { version = "2", default-features = false, features = ["deflate"] }
 # Custom QUIC agent transport. Quinn reuses the
 # rustls 0.23 + aws-lc-rs provider already present transitively (via
 # tokio-tungstenite / salvo). `rustls-pemfile` loads PEM cert/key on the

diff --git a/README.md b/README.md
@@ -74,6 +74,24 @@ A default `share` URL and credential are temporary and stop working when the
 command exits. `webcodex share --tunnel none` is available for local-only MCP
 debugging and does not require `cloudflared`.
 
+### Optional: OpenAI Secure MCP Tunnel
+
+If the repository should be reachable only from a supported OpenAI product, use
+`webcodex share --tunnel openai`. Create/select a Secure MCP Tunnel in the OpenAI
+Platform first, then export `CONTROL_PLANE_TUNNEL_ID` and a Restricted
+`CONTROL_PLANE_API_KEY` with **Tunnels Read + Use**. WebCodex reuses a matching
+`tunnel-client` from `WEBCODEX_TUNNEL_CLIENT_BIN` or `PATH`, or downloads and
+verifies pinned OpenAI `tunnel-client` v0.0.12 for Linux/macOS amd64/arm64.
+
+This provider keeps the temporary WebCodex Bearer credential in private local
+share state and gives `tunnel-client` a file-backed `Authorization` header for
+the loopback MCP hop. In ChatGPT choose **Connection: Tunnel**, select/paste the
+Tunnel ID, and choose **No authentication**; do not paste the local WebCodex
+credential into ChatGPT. `--tunnel openai` currently supports the default
+`--auth bearer` path only. Ctrl-C stops the local runtime and `tunnel-client` and
+removes the temporary WebCodex credential; the Platform Tunnel identity remains
+operator-managed for later reuse.
+
 ## What happens after the first connection
 
 WebCodex can read/search files, prepare guarded edits, run commands and focused

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -63,6 +63,22 @@ credential，以 CLI 成功输出为准。
 默认 `share` 的 URL 与 credential 都是临时的，命令退出后失效。仅做本地 MCP 调试时可用
 `webcodex share --tunnel none`，此模式不需要 `cloudflared`。
 
+### 可选：OpenAI Secure MCP Tunnel
+
+如果只希望受支持的 OpenAI 产品访问本机仓库，可以使用
+`webcodex share --tunnel openai`。先在 OpenAI Platform 创建/选择 Secure MCP Tunnel，
+然后导出 `CONTROL_PLANE_TUNNEL_ID` 与只授予 **Tunnels Read + Use** 的 Restricted
+`CONTROL_PLANE_API_KEY`。WebCodex 会依次复用 `WEBCODEX_TUNNEL_CLIENT_BIN`、`PATH`
+中匹配的 `tunnel-client`，否则为 Linux/macOS amd64/arm64 下载并校验固定的 OpenAI
+`tunnel-client` v0.0.12。
+
+这条路径把临时 WebCodex Bearer credential 留在私有本地 share state，只通过 file-backed
+`Authorization` header 交给 `tunnel-client` 访问 loopback MCP。在 ChatGPT 里选择
+**Connection: Tunnel**，选择/粘贴 Tunnel ID，并把认证选择为 **No authentication**；不要把
+本地 WebCodex credential 粘贴到 ChatGPT。`--tunnel openai` 当前只支持默认的
+`--auth bearer`。Ctrl-C 会停止本地 runtime 与 `tunnel-client` 并删除临时 WebCodex
+credential；Platform Tunnel identity 仍由 operator 管理，可以以后继续复用。
+
 ## 第一次连接以后
 
 WebCodex 可以读取/搜索文件、准备受保护的修改、运行命令与聚焦校验、查看 Git，并让长时间

diff --git a/docs/AI_ONBOARDING.md b/docs/AI_ONBOARDING.md
@@ -30,9 +30,9 @@ Do not invent `https://your-server.example` as a prerequisite for a new user.
 
 ## First-time ChatGPT path: `share`
 
-Verify Git and the target repository, then verify that `cloudflared` is installed
-for the default public share. If it is absent, point the user to Cloudflare's
-official downloads rather than installing third-party executables silently.
+Verify Git and the target repository. For the default public share, WebCodex
+reuses `WEBCODEX_CLOUDFLARED_BIN` / `PATH` or automatically downloads its pinned,
+verified managed `cloudflared`; do not ask a first-time user to install it first.
 
 ```bash
 npm install -g @yyjeqhc/webcodex
@@ -59,6 +59,14 @@ client-side permissions are separate from WebCodex authorization:
 For local-only debugging, `webcodex share --tunnel none` avoids the Cloudflare
 Quick Tunnel and does not require `cloudflared`.
 
+When the user explicitly wants OpenAI-only private reachability and already has
+an OpenAI Secure MCP Tunnel, use `webcodex share --tunnel openai`. Require
+`CONTROL_PLANE_TUNNEL_ID` and a Restricted `CONTROL_PLANE_API_KEY` with Tunnels
+Read + Use. In ChatGPT choose Connection: Tunnel and No authentication; WebCodex
+keeps its temporary Bearer local and injects it through `tunnel-client`. Do not
+ask the human to paste that local credential into ChatGPT. Keep Cloudflare Quick
+as the ordinary zero-Platform-setup default.
+
 ## Existing shared-key Server path: `connect`
 
 Use this path only when a hosted Server is already configured for shared-key

diff --git a/docs/AI_ONBOARDING.zh-CN.md b/docs/AI_ONBOARDING.zh-CN.md
@@ -28,8 +28,8 @@ Server。不要在 Windows 上推荐 `share`。
 
 ## 第一次 ChatGPT 接入：`share`
 
-先确认 Git 和目标仓库；默认公网 share 还要确认 `cloudflared` 已安装。如果缺少它，告诉用户
-使用 Cloudflare 官方下载，不要静默增加“自动下载第三方 executable”的行为。
+先确认 Git 和目标仓库。默认公网 share 会复用 `WEBCODEX_CLOUDFLARED_BIN` / `PATH`，
+没有时由 WebCodex 自动下载并校验固定的 managed `cloudflared`；不要要求第一次用户先手动安装。
 
 ```bash
 npm install -g @yyjeqhc/webcodex
@@ -55,6 +55,12 @@ ChatGPT 套餐、workspace 和管理员设置控制，这些客户端侧权限
 仅做本地调试时可用 `webcodex share --tunnel none`，不启动 Cloudflare Quick Tunnel，也不
 需要 `cloudflared`。
 
+如果用户明确只需要 OpenAI 产品的私有可达性，并且已经创建 OpenAI Secure MCP Tunnel，
+使用 `webcodex share --tunnel openai`。要求 `CONTROL_PLANE_TUNNEL_ID` 和只授予 Tunnels
+Read + Use 的 Restricted `CONTROL_PLANE_API_KEY`。ChatGPT 侧选择 Connection: Tunnel +
+No authentication；WebCodex 临时 Bearer 留在本机，由 `tunnel-client` 注入，不要让人类把它
+粘贴到 ChatGPT。普通零 Platform 配置的 first-run 默认仍然是 Cloudflare Quick。
+
 ## 已有 shared-key Server：`connect`
 
 只有 hosted Server 已明确配置 shared-key client，并且 operator 已提供该 client credential

diff --git a/docs/CLI.md b/docs/CLI.md
@@ -50,6 +50,8 @@ These commands work on the current Git project.
 
 Quick Tunnel origins remain temporary. For an operator-managed stable HTTPS origin, use `--tunnel none --public-url https://share.example` and route that origin to the loopback WebCodex Server yourself; `--public-url` advertises the external origin/issuer and does not create a proxy or tunnel.
 
+`webcodex share --tunnel openai` is the explicit OpenAI Secure MCP Tunnel provider. It requires `CONTROL_PLANE_TUNNEL_ID` plus a Restricted `CONTROL_PLANE_API_KEY` with Tunnels Read + Use and currently supports only `--auth bearer`. WebCodex resolves pinned OpenAI `tunnel-client` v0.0.12 from `WEBCODEX_TUNNEL_CLIENT_BIN`, `PATH`, or a verified managed download; it runs `doctor` before the daemon and waits for `/readyz`. The temporary WebCodex Bearer is written only to the private share directory and referenced by `tunnel-client` through a file-backed MCP `Authorization` header. ChatGPT therefore uses Connection: Tunnel + No authentication. `OPENAI_ADMIN_KEY` and `OPENAI_API_KEY` are explicitly removed from the long-lived daemon environment; the Runtime API key remains the control-plane authority.
+
 For public `share`, WebCodex best-effort copies only the MCP URL to the clipboard; it never copies the temporary credential. Interactive Linux/macOS terminals also offer an Enter shortcut to open ChatGPT App settings. Clipboard/browser integration is convenience-only and never gates runtime readiness. Use `--no-copy-url` to suppress clipboard access.
 
 `webcodex connect <server> --auth oauth --oauth-redirect-uri <exact-callback>` is the ordinary ChatGPT OAuth path for hosted connect. It uses the same `wck_*` shared-key identity as the Runner and keeps the direct shared-key baseline unchanged: `runtime:read`, `project:read`, `project:write`, `job:run`, `computer:read`, and `computer:control`. A fresh OAuth client starts with that full baseline, while an existing protected client may carry a valid narrower baseline subset. Adding `--oauth-computer-permissions` is an explicit client-ceiling opt-in that appends only `computer:launch`, `computer:display_read`, `computer:pointer_control`, `computer:clipboard_read`, and `computer:clipboard_write` to the existing baseline subset; it never restores baseline scopes that were previously absent and does not grant the optional scopes by itself. The WebCodex authorize page presents eligible additional Computer permissions unchecked, and only the selected permissions enter the authorization code/access/refresh grant. Launch consent requires the OAuth request to contain both `computer:read` and `computer:launch`; missing prerequisites are disabled rather than filled in by WebCodex. A real ceiling expansion revokes existing grants and requires reauthorization; ordinary reconnect never widens a baseline client. `account:manage`, `admin`, `job:detach`, every `agent:*` scope, and future scopes are never part of this picker. Runner capability shown on the consent page is current backend availability, not a guarantee that native/OS permission will succeed; runtime calls recheck current capability and native preflight. OAuth access tokens remain invalid on Agent transport.

diff --git a/docs/CLI.zh-CN.md b/docs/CLI.zh-CN.md
@@ -45,6 +45,8 @@ MCP endpoint。默认 Quick Tunnel 会依次优先使用 `WEBCODEX_CLOUDFLARED_B
 
 Cloudflare Quick Tunnel 的公网 origin 仍然是临时的。如需稳定 HTTPS origin，可使用 `--tunnel none --public-url https://share.example`，并由 operator 自己把该 origin 反向代理/隧道到 loopback WebCodex Server；`--public-url` 只声明外部 origin/issuer，不会创建代理或 tunnel。
 
+`webcodex share --tunnel openai` 是显式 opt-in 的 OpenAI Secure MCP Tunnel provider。它要求 `CONTROL_PLANE_TUNNEL_ID` 与只授予 Tunnels Read + Use 的 Restricted `CONTROL_PLANE_API_KEY`，当前只支持 `--auth bearer`。WebCodex 会从 `WEBCODEX_TUNNEL_CLIENT_BIN`、`PATH` 或经过校验的 managed 下载解析固定 OpenAI `tunnel-client` v0.0.12；启动 daemon 前运行 `doctor`，并等待 `/readyz`。临时 WebCodex Bearer 只写入私有 share 目录，通过 file-backed MCP `Authorization` header 交给 `tunnel-client`，因此 ChatGPT 使用 Connection: Tunnel + No authentication。长驻 daemon 环境会显式移除 `OPENAI_ADMIN_KEY` 与 `OPENAI_API_KEY`；Runtime API key 仍只承担 control-plane authority。
+
 公网 `share` 会 best-effort 只把 MCP URL 复制到剪贴板，绝不会自动复制临时 credential；Linux/macOS 交互式终端还会提供按 Enter 打开 ChatGPT App 设置的快捷入口。剪贴板/浏览器集成都只是 convenience，失败不会影响已经 ready 的 runtime。使用 `--no-copy-url` 可关闭剪贴板访问。
 
 `webcodex connect <server> --auth oauth --oauth-redirect-uri <精确回调地址>` 是普通 hosted connect 面向 ChatGPT 的 OAuth 路径。它继续使用 Runner 的同一个 `wck_*` shared-key 身份，并保持 direct shared-key baseline 不变：`runtime:read`、`project:read`、`project:write`、`job:run`、`computer:read`、`computer:control`。fresh OAuth client 从完整 baseline 开始，但已有受保护 client 可以合法持有更窄的 baseline subset。只有显式增加 `--oauth-computer-permissions`，client ceiling 才在**现有 baseline subset**上追加固定的 `computer:launch`、`computer:display_read`、`computer:pointer_control`、`computer:clipboard_read`、`computer:clipboard_write`；不会恢复此前缺失的 baseline scope，该 flag 本身也不会 grant optional scope。WebCodex authorize 页面只把当前合法且可用的 Additional Computer permissions 以默认未勾选 checkbox 展示，真正进入 authorization code/access/refresh grant 的只有用户选择项。Launch consent 要求本次 OAuth request 同时包含 `computer:read` 与 `computer:launch`；缺失 prerequisite 时页面会禁用，而不是由 Server 偷偷补 scope。client ceiling 真正扩大时会撤销旧 grant 并要求重新授权；普通 reconnect 不会静默扩大 baseline client。`account:manage`、`admin`、`job:detach`、任何 `agent:*` 与未来新增 scope 永远不进入 picker。授权页显示的 Runner capability 只表示当前 backend support，不保证 OS/native permission 一定成功；runtime 调用仍会实时重新检查 capability 与 native preflight。OAuth access token 仍不能用于 Agent transport。

diff --git a/docs/MCP.md b/docs/MCP.md
@@ -13,8 +13,8 @@ The self-contained `share` path below requires a local WebCodex Server and is
 supported on Linux/macOS. Windows users should connect the Runner to an existing
 remote Linux Server with `webcodex connect <server-url>` instead.
 
-For the default temporary public path, install
-[`cloudflared`](https://developers.cloudflare.com/tunnel/downloads/) and run:
+For the default temporary public path, WebCodex reuses an explicit/PATH
+`cloudflared` or downloads its pinned verified managed copy automatically, then run:
 
 ```bash
 npm install -g @yyjeqhc/webcodex
@@ -47,6 +47,12 @@ with the same endpoint and the authentication mechanism reported by the CLI.
 For local-only clients, `webcodex share --tunnel none` exposes the loopback MCP
 endpoint without `cloudflared`.
 
+For an OpenAI-only private transport, create/select a Secure MCP Tunnel, export
+`CONTROL_PLANE_TUNNEL_ID` plus a Restricted `CONTROL_PLANE_API_KEY` with Tunnels
+Read + Use, and run `webcodex share --tunnel openai`. ChatGPT uses Connection:
+Tunnel + No authentication; the temporary WebCodex Bearer stays local and is
+injected by the pinned verified OpenAI `tunnel-client`.
+
 ## Existing Server
 
 For an existing hosted Server intentionally configured for shared-key clients,

diff --git a/docs/MCP.zh-CN.md b/docs/MCP.zh-CN.md
@@ -12,8 +12,8 @@ reference，不是 onboarding 前置知识。
 Windows 用户应改用 `webcodex connect <server-url>`，把 Runner 连接到已有的远程
 Linux Server。
 
-默认临时公网路径先安装
-[`cloudflared`](https://developers.cloudflare.com/tunnel/downloads/)，然后执行：
+默认临时公网路径会复用显式指定/`PATH` 中的 `cloudflared`，否则由 WebCodex 自动下载并校验
+固定的 managed 副本，然后执行：
 
 ```bash
 npm install -g @yyjeqhc/webcodex
@@ -42,6 +42,12 @@ WebCodex scope 不会扩大这些客户端侧权限。
 其他 MCP client 同样使用 CLI 报告的 endpoint 与认证方式。仅本地 client 可用
 `webcodex share --tunnel none`，不需要 `cloudflared`。
 
+如果只需要 OpenAI 产品的私有 transport，创建/选择 Secure MCP Tunnel，导出
+`CONTROL_PLANE_TUNNEL_ID` 与只授予 Tunnels Read + Use 的 Restricted
+`CONTROL_PLANE_API_KEY`，然后运行 `webcodex share --tunnel openai`。ChatGPT 使用
+Connection: Tunnel + No authentication；临时 WebCodex Bearer 留在本机，由固定且经过校验的
+OpenAI `tunnel-client` 注入。
+
 ## 已有 Server
 
 对于已经明确配置为 shared-key client 接入的 hosted Server，使用 operator 提供的 credential

diff --git a/docs/QUICK_START.md b/docs/QUICK_START.md
@@ -85,6 +85,20 @@ terminal, press Enter to open ChatGPT App settings. Then:
 
 Use `webcodex share --no-copy-url` to suppress the clipboard attempt.
 
+For the opt-in OpenAI-only transport, configure an OpenAI Secure MCP Tunnel and
+a Restricted Runtime API key with Tunnels Read + Use, export
+`CONTROL_PLANE_TUNNEL_ID` and `CONTROL_PLANE_API_KEY`, then run:
+
+```bash
+webcodex share --tunnel openai
+```
+
+WebCodex auto-resolves pinned verified OpenAI `tunnel-client` v0.0.12 (or a
+matching `WEBCODEX_TUNNEL_CLIENT_BIN` / `PATH` binary), runs its doctor/readiness
+checks, and keeps the temporary WebCodex Bearer credential local. In ChatGPT use
+**Connection: Tunnel** and **No authentication**. The default Cloudflare Quick
+Tunnel path remains unchanged and client-agnostic.
+
 The Console intentionally does not display that credential. If you later open
 `/console`, get connection credentials from the successful CLI output, not from
 the browser page. ChatGPT Developer Mode, custom MCP apps, and write/modify

diff --git a/docs/QUICK_START.zh-CN.md b/docs/QUICK_START.zh-CN.md
@@ -75,6 +75,19 @@ Enter 打开 ChatGPT App 设置。然后：
 
 如不希望访问剪贴板，使用 `webcodex share --no-copy-url`。
 
+如果只需要 OpenAI 产品访问，可以先创建 OpenAI Secure MCP Tunnel 与仅授予 Tunnels
+Read + Use 的 Restricted Runtime API key，导出 `CONTROL_PLANE_TUNNEL_ID` 和
+`CONTROL_PLANE_API_KEY`，然后运行：
+
+```bash
+webcodex share --tunnel openai
+```
+
+WebCodex 会自动解析固定且经过校验的 OpenAI `tunnel-client` v0.0.12（也可使用匹配的
+`WEBCODEX_TUNNEL_CLIENT_BIN` / `PATH` binary），运行 doctor/readiness，并把临时
+WebCodex Bearer credential 留在本机。ChatGPT 侧使用 **Connection: Tunnel** 与
+**No authentication**。默认 Cloudflare Quick Tunnel 路径保持不变，仍然不绑定特定 MCP client。
+
 Console 故意不显示 credential。以后即使打开 `/console`，认证值也应来自成功的 CLI 首次
 输出，而不是浏览器页面。ChatGPT Developer Mode、custom MCP app 与 write/modify action
 还分别受 ChatGPT 套餐、workspace 和管理员设置控制；客户端 workspace 没有允许的 action，