Extend runtime auth to account, plugin, and file requests (#59564)

## What changed

- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.

## Testing

Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.

GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805

codex-rs/cli/src/marketplace_cmd.rs

@@ -5,7 +5,7 @@ use clap::Parser;
 use codex_core::config::Config;
 use codex_core::config::ConfigOverrides;
 use codex_core::config::LoaderOverrides;
-use codex_core::plugins_manager_for_config;
+use codex_core::plugins_manager_for_config_with_runtime;
 use codex_core_plugins::PluginMarketplaceUpgradeOutcome;
 use codex_core_plugins::PluginsConfigInput;
 use codex_core_plugins::installed_marketplaces::marketplace_install_root;
@@ -211,7 +211,9 @@ impl JsonMarketplaceAddOutput {
 }
 
 async fn run_list(config: Config, args: ListMarketplaceArgs) -> Result<()> {
-    let manager = plugins_manager_for_config(&config, load_cli_auth_manager(&config).await?);
+    let manager =
+        plugins_manager_for_config_with_runtime(&config, load_cli_auth_manager(&config).await?)
+            .await?;
     let plugins_input = config.plugins_config_input();
     let marketplace_listing = manager
         .discover_marketplaces_for_config(&plugins_input, &[])
@@ -373,7 +375,9 @@ async fn run_upgrade(
         marketplace_name,
         json,
     } = args;
-    let manager = plugins_manager_for_config(&config, load_cli_auth_manager(&config).await?);
+    let manager =
+        plugins_manager_for_config_with_runtime(&config, load_cli_auth_manager(&config).await?)
+            .await?;
     let plugins_input = config.plugins_config_input();
     let runtime = tokio::runtime::Handle::current();
     let reload_config: codex_core_plugins::ConfigLayerReload = std::sync::Arc::new(move || {

codex-rs/cli/src/mcp_cmd.rs

@@ -19,7 +19,7 @@ use codex_core::config::LoaderOverrides;
 use codex_core::config::edit::ConfigEditsBuilder;
 use codex_core::config::find_codex_home;
 use codex_core::config::load_global_mcp_servers;
-use codex_core::plugins_manager_for_config;
+use codex_core::plugins_manager_for_config_with_runtime;
 use codex_exec_server::EnvironmentManager;
 use codex_exec_server::HttpClient;
 use codex_exec_server::RouteAwareHttpClient;
@@ -533,10 +533,10 @@ async fn run_remove(config_overrides: &CliConfigOverrides, remove_args: RemoveAr
 }
 
 async fn load_mcp_manager(config: &Config) -> Result<McpManager> {
-    let plugins_manager = Arc::new(plugins_manager_for_config(
-        config,
-        load_cli_auth_manager(config).await?,
-    ));
+    let plugins_manager = Arc::new(
+        plugins_manager_for_config_with_runtime(config, load_cli_auth_manager(config).await?)
+            .await?,
+    );
     Ok(McpManager::new(plugins_manager))
 }
 

codex-rs/cli/src/plugin_cmd.rs

@@ -7,7 +7,7 @@ use codex_app_server_protocol::PluginAuthPolicy;
 use codex_app_server_protocol::PluginInstallPolicy;
 use codex_core::config::Config;
 use codex_core::config::find_codex_home;
-use codex_core::plugins_manager_for_config;
+use codex_core::plugins_manager_for_config_with_runtime;
 use codex_core_plugins::ConfiguredMarketplace;
 use codex_core_plugins::OPENAI_BUNDLED_MARKETPLACE_NAME;
 use codex_core_plugins::PluginInstallOutcome;
@@ -773,10 +773,9 @@ async fn load_plugin_command_context(
         .context("failed to load configuration")?;
     let plugins_input = config.plugins_config_input();
     let auth_manager = load_cli_auth_manager(&config).await?;
-    let manager = Arc::new(plugins_manager_for_config(
-        &config,
-        Arc::clone(&auth_manager),
-    ));
+    let manager = Arc::new(
+        plugins_manager_for_config_with_runtime(&config, Arc::clone(&auth_manager)).await?,
+    );
     Ok(PluginCommandContext {
         codex_home: codex_home.to_path_buf(),
         plugins_input,
@@ -861,7 +860,9 @@ async fn fetch_remote_marketplaces(
         );
         return Ok(RemoteMarketplaceListing::default());
     }
-    let service = context.plugins_input.remote_plugin_service_config();
+    let service = context
+        .manager
+        .remote_plugin_service_config(&context.plugins_input);
     let result = if context.plugins_input.remote_plugin_enabled {
         remote::fetch_remote_marketplaces(
             &service,