openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-25 18:28:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fail closed when workload identity initialization fails (#38424)

Browse Source 
## What changed

- Treat workload identity environment markers as an explicit authentication selection, even when another process credential is present.
- Return initialization errors from `AuthManager` and propagate them through commands and services instead of continuing with an unusable authentication state.
- Make `codex login status` validate workload identity, keep the TUI on an embedded app server for local workload identity, and reject workload identity in `codex mcp-server`, where it is unsupported.

## Testing

- Cover workload identity precedence and partial configuration errors.
- Verify login status reports an unreadable identity assertion and app-server routing enforces the supported workload identity topology.

GitOrigin-RevId: efc6b6b4cd4d61652617de82aaa3d7ffc75d6618
This commit is contained in:
cooper-oai
2026-08-13 19:35:22 +00:00
committed by copyberry
parent 781445f7c6
commit 990218bbbd
33 changed files with 368 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/cli/src/mcp_cmd.rs
+8 -8
View File
@@ -523,14 +523,14 @@ async fn run_remove(config_overrides: &CliConfigOverrides, remove_args: RemoveAr
Ok(())
}
async fn load_mcp_manager(config: &Config) -> McpManager {
async fn load_mcp_manager(config: &Config) -> Result<McpManager> {
let plugins_manager = Arc::new(plugins_manager_for_config(config));
plugins_manager.set_auth_mode(load_cli_auth_mode(config).await);
McpManager::new(plugins_manager)
plugins_manager.set_auth_mode(load_cli_auth_mode(config).await?);
Ok(McpManager::new(plugins_manager))
}
async fn run_login(config: &Config, login_args: LoginArgs) -> Result<()> {
let mcp_manager = load_mcp_manager(config).await;
let mcp_manager = load_mcp_manager(config).await?;
let mcp_servers = mcp_manager.configured_servers(config).await;
let LoginArgs {
@@ -599,7 +599,7 @@ async fn run_login(config: &Config, login_args: LoginArgs) -> Result<()> {
}
async fn run_logout(config: &Config, logout_args: LogoutArgs) -> Result<()> {
let mcp_manager = load_mcp_manager(config).await;
let mcp_manager = load_mcp_manager(config).await?;
let mcp_servers = mcp_manager.configured_servers(config).await;
let LogoutArgs { name } = logout_args;
@@ -629,9 +629,9 @@ async fn run_logout(config: &Config, logout_args: LogoutArgs) -> Result<()> {
}
async fn run_list(config: &Config, list_args: ListArgs) -> Result<()> {
let mcp_manager = load_mcp_manager(config).await;
let mcp_manager = load_mcp_manager(config).await?;
let auth_manager =
AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await;
AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await?;
let auth = auth_manager.auth().await;
let mcp_servers = mcp_manager.configured_servers(config).await;
let effective_mcp_servers = mcp_manager.effective_servers(config, auth.as_ref()).await;
@@ -894,7 +894,7 @@ async fn run_list(config: &Config, list_args: ListArgs) -> Result<()> {
}
async fn run_get(config: &Config, get_args: GetArgs) -> Result<()> {
let mcp_manager = load_mcp_manager(config).await;
let mcp_manager = load_mcp_manager(config).await?;
let mcp_servers = mcp_manager.configured_servers(config).await;
let Some(server) = mcp_servers.get(&get_args.name) else {