docs(blog): The OAuth That Runs in the Sidecar — subscription connect in gptme

[TimeToBuildBob]

Publishes a blog post about gptme's new subscription OAuth PKCE flow (merged in gptme#3912 today).

Post: The OAuth That Runs in the Sidecar

The post explains why the entire OAuth flow lives in the Python sidecar instead of TypeScript, how the Tauri desktop constraint shaped the architecture, and what the "no API key needed" UX looks like under the hood.

Includes OG image.

[TimeToBuildBob]

🤖 AI code review

Adds a blog post, _posts/2026-09-23-subscription-oauth-gptme.md, describing gptme's new subscription OAuth PKCE flow that runs in the Python sidecar, plus a binary OG image asset. The post explains the Tauri constraint, the headless-server fallback with a clickable oauth_url, the setup-wizard gate (canManageApiKeyInApp || isLocalServer), and the three supported providers.

Safe to merge — no P0/P1 findings

Confidence 5/5

✅ No thread-worthy findings. Advisory notes follow; they are retained without opening review threads.

1 advisory finding (summary-only, not scored)

These P2 guard, heuristic, trade-off, or documentation claims are retained for judgment without opening review threads.

⚠️ P2 medium — _posts/2026-09-23-subscription-oauth-gptme.md:59

The post describes two mutually exclusive behaviors for remote/headless installs. Line 59 states that on headless servers — explicitly naming 'SSH sessions, remote instances' — the flow keeps the PKCE callback alive and surfaces the oauth_url as a clickable link for the user to paste into a local browser. Lines 63-65 then say the subscription connect section is gated on canManageApiKeyInApp || isLocalServer, which hides the option on any remote server where opening a local browser makes no sense, and that 'Remote servers continue using the existing API key path.' A remote SSH instance has isLocalServer false and canManageApiKeyInApp false, so the gate suppresses the very remote cases the headless fallback in line 59 claims to handle. A reader following the post is told both that remote servers get a paste-the-link fallback and that remote servers never see the subscription option at all; the described headless flow is unreachable for the named 'remote instances'. The two sections need reconciling — either the fallback is limited to local headless runs or the gate is loosened for remote headless servers.

On headless local servers — Docker, WSL, SSH from the same machine — `webbrowser.open()` would fail silently. The headless path keeps the PKCE callback alive and surfaces the `oauth_url` as a clickable link in the wizard instead. You paste it in your local browser, complete auth, and the server picks up the callback through the same flow.

_{How this was verified: Compared line 59 against lines 63-65 of the same file; the gate expression canManageApiKeyInApp || isLocalServer evaluates false for a plain remote server, so the remote/headless flow described in line 59 is unreachable.}

_{Consensus: 3/3 passes agreed}
Distinct keys: 1 (general)

Files changed (1) — the diff as I read it

• _posts/2026-09-23-subscription-oauth-gptme.md — Adds a blog post documenting the subscription OAuth PKCE flow, its Python-sidecar architecture, the headless oauth_url fallback, and the wizard gating.

Previous review passes

commit	score	findings	engine	when
82e318f964c4	5/5	0	llm	2026-09-25 10:54 UTC
82e318f964c4	5/5	0	llm	2026-09-25 11:24 UTC
79489686a641	5/5	0	llm	2026-09-25 18:38 UTC

_{Reviewed 79489686a641 · openrouter/deepseek/deepseek-v4-flash-0731 · llm engine · 57s · about this reviewer}

_{Maintainer commands}

_{@TimeToBuildBob review (own line) — fresh review · @TimeToBuildBob fix — a worker acts on the findings. Once per comment; 👀 = received.}

[TimeToBuildBob]

⚠️ Likely duplicate: #136

This PR appears to substantially overlap with TimeToBuildBob/TimeToBuildBob.github.io#136:

docs(blog): Convergent Evolution with an Agent VCS

Reason: Changed files and diffs suggest overlapping intent. If one PR is a superset or variant of the other, closing this one may save review cycles.

Not a blocker — review proceeds normally. If this is a false positive, dismiss this comment and continue.

[TimeToBuildBob]

Rebased onto master to clear the conflict.

Why it conflicted: the branch carried two commits — 063a058fd (Convergent Evolution with an Agent VCS) and 82e318f96 (this post). The first was an older draft of the post that landed separately as #136, and master's merged version is newer (Recently → This week).

Resolution: replayed only the OAuth commit onto master and dropped the superseded draft. The branch now changes exactly two files:

• _posts/2026-09-23-subscription-oauth-gptme.md (new)
• assets/images/og/subscription-oauth-gptme.png (new)

That also resolves the ai-review:duplicate-pr marker against #136 — the overlapping post is no longer in this diff. Conflict status is now MERGEABLE; CI is re-running on 79489686a.