diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json index 74c0a984b7..999cf232ca 100644 --- a/codex-rs/core/config.schema.json +++ b/codex-rs/core/config.schema.json @@ -643,7 +643,7 @@ "type": "string" }, { - "description": "Keyring when available, otherwise fail.", + "description": "Keyring when available, otherwise fail. This is the default storage mode.", "enum": [ "keyring" ], @@ -1283,7 +1283,7 @@ } ], "default": null, - "description": "Preferred backend for storing CLI auth credentials. file (default on non-macOS): Use a file in the Codex home directory. keyring (default on macOS): Use an OS-specific keyring service. auto: Use the keyring if available, otherwise use a file." + "description": "Preferred backend for storing CLI auth credentials. file: Use a file in the Codex home directory. keyring (default): Use an OS-specific keyring service. auto: Use the keyring if available, otherwise use a file." }, "compact_prompt": { "description": "Compact prompt used for history compaction.", @@ -1514,7 +1514,7 @@ } ], "default": null, - "description": "Preferred backend for storing MCP OAuth credentials. keyring: Use an OS-specific keyring service. https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs#L2 file: Use a file in the Codex home directory. auto (default): Use the OS-specific keyring service if available, otherwise use a file." + "description": "Preferred backend for storing MCP OAuth credentials. keyring (default): Use an OS-specific keyring service. https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs#L2 file: Use a file in the Codex home directory. auto: Use the OS-specific keyring service if available, otherwise use a file." }, "mcp_servers": { "additionalProperties": { diff --git a/codex-rs/core/src/auth/storage.rs b/codex-rs/core/src/auth/storage.rs index 6792fb5c20..e7117109fd 100644 --- a/codex-rs/core/src/auth/storage.rs +++ b/codex-rs/core/src/auth/storage.rs @@ -26,12 +26,13 @@ use codex_keyring_store::KeyringStore; use once_cell::sync::Lazy; /// Determine where Codex should store CLI auth credentials. -#[derive(Debug, Copy, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)] +#[derive(Debug, Default, Copy, Clone, PartialEq, Eq, Serialize, Deserialize, JsonSchema)] #[serde(rename_all = "lowercase")] pub enum AuthCredentialsStoreMode { /// Persist credentials in CODEX_HOME/auth.json. File, /// Persist credentials in the keyring. Fail if unavailable. + #[default] Keyring, /// Use keyring when available; otherwise, fall back to a file in CODEX_HOME. Auto, @@ -39,19 +40,6 @@ pub enum AuthCredentialsStoreMode { Ephemeral, } -impl Default for AuthCredentialsStoreMode { - fn default() -> Self { - #[cfg(target_os = "macos")] - { - Self::Keyring - } - #[cfg(not(target_os = "macos"))] - { - Self::File - } - } -} - /// Expected structure for $CODEX_HOME/auth.json. #[derive(Deserialize, Serialize, Clone, Debug, PartialEq)] pub struct AuthDotJson { diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs index 6169a81c0f..ceaaeaaeb5 100644 --- a/codex-rs/core/src/config/mod.rs +++ b/codex-rs/core/src/config/mod.rs @@ -261,8 +261,8 @@ pub struct Config { pub cwd: PathBuf, /// Preferred store for CLI auth credentials. - /// file (default on non-macOS): Use a file in the Codex home directory. - /// keyring (default on macOS): Use an OS-specific keyring service. + /// file: Use a file in the Codex home directory. + /// keyring (default): Use an OS-specific keyring service. /// auto: Use the OS-specific keyring service if available, otherwise use a file. pub cli_auth_credentials_store_mode: AuthCredentialsStoreMode, @@ -270,12 +270,12 @@ pub struct Config { pub mcp_servers: Constrained>, /// Preferred store for MCP OAuth credentials. - /// keyring: Use an OS-specific keyring service. + /// keyring (default): Use an OS-specific keyring service. /// Credentials stored in the keyring will only be readable by Codex unless the user explicitly grants access via OS-level keyring access. /// https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs#L2 /// file: CODEX_HOME/.credentials.json /// This file will be readable to Codex and other applications running as the same user. - /// auto (default): keyring if available, otherwise file. + /// auto: keyring if available, otherwise file. pub mcp_oauth_credentials_store_mode: OAuthCredentialsStoreMode, /// Optional fixed port to use for the local HTTP callback server used during MCP OAuth login. @@ -923,8 +923,8 @@ pub struct ConfigToml { pub forced_login_method: Option, /// Preferred backend for storing CLI auth credentials. - /// file (default on non-macOS): Use a file in the Codex home directory. - /// keyring (default on macOS): Use an OS-specific keyring service. + /// file: Use a file in the Codex home directory. + /// keyring (default): Use an OS-specific keyring service. /// auto: Use the keyring if available, otherwise use a file. #[serde(default)] pub cli_auth_credentials_store: Option, @@ -936,10 +936,10 @@ pub struct ConfigToml { pub mcp_servers: HashMap, /// Preferred backend for storing MCP OAuth credentials. - /// keyring: Use an OS-specific keyring service. + /// keyring (default): Use an OS-specific keyring service. /// https://github.com/openai/codex/blob/main/codex-rs/rmcp-client/src/oauth.rs#L2 /// file: Use a file in the Codex home directory. - /// auto (default): Use the OS-specific keyring service if available, otherwise use a file. + /// auto: Use the OS-specific keyring service if available, otherwise use a file. #[serde(default)] pub mcp_oauth_credentials_store: Option, @@ -2465,22 +2465,19 @@ trust_level = "trusted" } #[test] - fn config_defaults_to_platform_cli_auth_store_mode() -> std::io::Result<()> { + fn config_defaults_to_keyring_cli_auth_store_mode() -> std::io::Result<()> { let codex_home = TempDir::new()?; let cfg = ConfigToml::default(); - let expected_store_mode = if cfg!(target_os = "macos") { - AuthCredentialsStoreMode::Keyring - } else { - AuthCredentialsStoreMode::File - }; - let config = Config::load_from_base_config_with_overrides( cfg, ConfigOverrides::default(), codex_home.path().to_path_buf(), )?; - assert_eq!(config.cli_auth_credentials_store_mode, expected_store_mode,); + assert_eq!( + config.cli_auth_credentials_store_mode, + AuthCredentialsStoreMode::Keyring, + ); Ok(()) } @@ -2508,7 +2505,7 @@ trust_level = "trusted" } #[test] - fn config_defaults_to_auto_oauth_store_mode() -> std::io::Result<()> { + fn config_defaults_to_keyring_oauth_store_mode() -> std::io::Result<()> { let codex_home = TempDir::new()?; let cfg = ConfigToml::default(); @@ -2520,7 +2517,7 @@ trust_level = "trusted" assert_eq!( config.mcp_oauth_credentials_store_mode, - OAuthCredentialsStoreMode::Auto, + OAuthCredentialsStoreMode::Keyring, ); Ok(()) diff --git a/codex-rs/rmcp-client/src/oauth.rs b/codex-rs/rmcp-client/src/oauth.rs index cdb64ff151..d435bd6d84 100644 --- a/codex-rs/rmcp-client/src/oauth.rs +++ b/codex-rs/rmcp-client/src/oauth.rs @@ -69,12 +69,13 @@ pub struct StoredOAuthTokens { pub enum OAuthCredentialsStoreMode { /// `Keyring` when available; otherwise, `File`. /// Credentials stored in the keyring will only be readable by Codex unless the user explicitly grants access via OS-level keyring access. - #[default] Auto, /// CODEX_HOME/.credentials.json /// This file will be readable to Codex and other applications running as the same user. File, /// Keyring when available, otherwise fail. + /// This is the default storage mode. + #[default] Keyring, }