v0.2 Milestone: OAuth Device Flow Support

[Hozyne-OpenBak]

Goal

Support IDE integrations (GitHub Copilot, Cursor, Windsurf, Cody, Codex) via OAuth device flows.

Epic

Parent epic tracking OAuth implementation. See detailed architecture: OAUTH_ARCHITECTURE.md

Sub-tasks

• Implement OAuth device flow client #3 - Implement OAuth device flow client
• Build encrypted token storage #4 - Build encrypted token storage
• Add token refresh logic #5 - Add token refresh logic
• Create CLI auth commands #6 - Create CLI auth commands
• Update proxy to accept InferShield tokens #7 - Update proxy to accept InferShield tokens
• Add OpenAI OAuth provider #8 - Add OpenAI OAuth provider
• Add GitHub Copilot OAuth provider #9 - Add GitHub Copilot OAuth provider
• Documentation + deployment guide for OAuth #10 - Write integration tests
• OAuth device flow tests failing - mock sequences need debugging #11 - Documentation + deployment guide
• RBAC tests failing - Jest configuration issues #12 - v0.2 release

Timeline

5 weeks → Target: Mid-March 2026

Success Criteria

✅ Single developer can authenticate via device flow
✅ IDE requests proxied through InferShield (Copilot, Cursor, Windsurf, Cody, Codex)
✅ All threat detection working with OAuth
✅ Tokens securely stored + auto-refreshed
✅ Documentation complete

[Hozyne-OpenBak]

Closing internal milestone tracking issue — OAuth device flow support now tracked via individual feature issues (#3, #4, #5, #6, #7, #8, #9).