diff --git a/codex-rs/cli/src/main.rs b/codex-rs/cli/src/main.rs index d6f7474e49..f8af1c07ae 100644 --- a/codex-rs/cli/src/main.rs +++ b/codex-rs/cli/src/main.rs @@ -74,6 +74,8 @@ use codex_features::FEATURES; use codex_features::Stage; use codex_features::is_known_feature_key; use codex_login::AuthManager; +use codex_login::CodexAuth; +use codex_login::read_codex_access_token_from_env; use codex_memories_write::clear_memory_roots_contents; use codex_models_manager::bundled_models_response; use codex_models_manager::manager::RefreshStrategy; @@ -1539,40 +1541,29 @@ async fn load_exec_server_remote_auth_provider( config_profile: Option, allow_agent_identity_auth: bool, ) -> anyhow::Result { - if !allow_agent_identity_auth { - return load_chatgpt_exec_server_remote_auth_provider( - root_config_overrides, - config_profile, - ) - .await; + let config = load_exec_server_remote_config(root_config_overrides, config_profile).await?; + if allow_agent_identity_auth + && let Some(agent_identity_jwt) = read_codex_access_token_from_env() + { + let auth = + CodexAuth::from_agent_identity_jwt(&agent_identity_jwt, Some(&config.chatgpt_base_url)) + .await?; + return Ok(codex_model_provider::auth_provider_from_auth(&auth)); } let auth = load_exec_server_remote_auth( - root_config_overrides, - config_profile, - /*allow_agent_identity_auth*/ true, - "remote exec-server registration requires ChatGPT authentication or Agent Identity auth from CODEX_ACCESS_TOKEN", + &config, + if allow_agent_identity_auth { + "remote exec-server registration requires ChatGPT authentication or Agent Identity auth from CODEX_ACCESS_TOKEN" + } else { + "remote exec-server registration requires ChatGPT authentication; run `codex login` first" + }, ) .await?; - validate_agent_identity_enabled_exec_server_remote_auth_mode(auth.auth_mode())?; - - Ok(codex_model_provider::auth_provider_from_auth(&auth)) -} - -async fn load_chatgpt_exec_server_remote_auth_provider( - root_config_overrides: &CliConfigOverrides, - config_profile: Option, -) -> anyhow::Result { - let auth = load_exec_server_remote_auth( - root_config_overrides, - config_profile, - /*allow_agent_identity_auth*/ false, - "remote exec-server registration requires ChatGPT authentication; run `codex login` first", - ) - .await?; - - if !auth.is_chatgpt_auth() { + if allow_agent_identity_auth { + validate_agent_identity_enabled_exec_server_remote_auth_mode(auth.auth_mode())?; + } else if !auth.is_chatgpt_auth() { anyhow::bail!( "remote exec-server registration requires ChatGPT authentication; API key and Agent Identity auth are not supported" ); @@ -1581,29 +1572,29 @@ async fn load_chatgpt_exec_server_remote_auth_provider( Ok(codex_model_provider::auth_provider_from_auth(&auth)) } -async fn load_exec_server_remote_auth( +async fn load_exec_server_remote_config( root_config_overrides: &CliConfigOverrides, config_profile: Option, - allow_agent_identity_auth: bool, - missing_auth_error: &'static str, -) -> anyhow::Result { +) -> anyhow::Result { let cli_kv_overrides = root_config_overrides .parse_overrides() .map_err(anyhow::Error::msg)?; - let config = ConfigBuilder::default() + Ok(ConfigBuilder::default() .cli_overrides(cli_kv_overrides) .harness_overrides(ConfigOverrides { config_profile, ..Default::default() }) .build() - .await?; - let auth_manager = AuthManager::shared_from_config_with_env( - &config, - /*enable_codex_api_key_env*/ false, - /*enable_codex_access_token_env*/ allow_agent_identity_auth, - ) - .await; + .await?) +} + +async fn load_exec_server_remote_auth( + config: &codex_core::config::Config, + missing_auth_error: &'static str, +) -> anyhow::Result { + let auth_manager = + AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await; let auth = match auth_manager.auth().await { Some(auth) => auth, diff --git a/codex-rs/login/src/auth/manager.rs b/codex-rs/login/src/auth/manager.rs index 7fe37f13b0..a2e4e8e0d8 100644 --- a/codex-rs/login/src/auth/manager.rs +++ b/codex-rs/login/src/auth/manager.rs @@ -733,23 +733,6 @@ async fn load_auth( enable_codex_api_key_env: bool, auth_credentials_store_mode: AuthCredentialsStoreMode, chatgpt_base_url: Option<&str>, -) -> std::io::Result> { - load_auth_with_env( - codex_home, - enable_codex_api_key_env, - /*enable_codex_access_token_env*/ true, - auth_credentials_store_mode, - chatgpt_base_url, - ) - .await -} - -async fn load_auth_with_env( - codex_home: &Path, - enable_codex_api_key_env: bool, - enable_codex_access_token_env: bool, - auth_credentials_store_mode: AuthCredentialsStoreMode, - chatgpt_base_url: Option<&str>, ) -> std::io::Result> { // API key via env var takes precedence over any other auth method. if enable_codex_api_key_env && let Some(api_key) = read_codex_api_key_from_env() { @@ -778,9 +761,7 @@ async fn load_auth_with_env( return Ok(None); } - if enable_codex_access_token_env - && let Some(agent_identity) = read_codex_access_token_from_env() - { + if let Some(agent_identity) = read_codex_access_token_from_env() { return CodexAuth::from_agent_identity_jwt(&agent_identity, chatgpt_base_url) .await .map(Some); @@ -1272,7 +1253,6 @@ pub struct AuthManager { codex_home: PathBuf, inner: RwLock, enable_codex_api_key_env: bool, - enable_codex_access_token_env: bool, auth_credentials_store_mode: AuthCredentialsStoreMode, forced_chatgpt_workspace_id: RwLock>>, chatgpt_base_url: Option, @@ -1331,27 +1311,9 @@ impl AuthManager { auth_credentials_store_mode: AuthCredentialsStoreMode, chatgpt_base_url: Option, ) -> Self { - Self::new_with_env( - codex_home, - enable_codex_api_key_env, - /*enable_codex_access_token_env*/ true, - auth_credentials_store_mode, - chatgpt_base_url, - ) - .await - } - - async fn new_with_env( - codex_home: PathBuf, - enable_codex_api_key_env: bool, - enable_codex_access_token_env: bool, - auth_credentials_store_mode: AuthCredentialsStoreMode, - chatgpt_base_url: Option, - ) -> Self { - let managed_auth = load_auth_with_env( + let managed_auth = load_auth( &codex_home, enable_codex_api_key_env, - enable_codex_access_token_env, auth_credentials_store_mode, chatgpt_base_url.as_deref(), ) @@ -1365,7 +1327,6 @@ impl AuthManager { permanent_refresh_failure: None, }), enable_codex_api_key_env, - enable_codex_access_token_env, auth_credentials_store_mode, forced_chatgpt_workspace_id: RwLock::new(None), chatgpt_base_url, @@ -1385,7 +1346,6 @@ impl AuthManager { codex_home: PathBuf::from("non-existent"), inner: RwLock::new(cached), enable_codex_api_key_env: false, - enable_codex_access_token_env: false, auth_credentials_store_mode: AuthCredentialsStoreMode::File, forced_chatgpt_workspace_id: RwLock::new(None), chatgpt_base_url: None, @@ -1404,7 +1364,6 @@ impl AuthManager { codex_home, inner: RwLock::new(cached), enable_codex_api_key_env: false, - enable_codex_access_token_env: false, auth_credentials_store_mode: AuthCredentialsStoreMode::File, forced_chatgpt_workspace_id: RwLock::new(None), chatgpt_base_url: None, @@ -1421,7 +1380,6 @@ impl AuthManager { permanent_refresh_failure: None, }), enable_codex_api_key_env: false, - enable_codex_access_token_env: false, auth_credentials_store_mode: AuthCredentialsStoreMode::File, forced_chatgpt_workspace_id: RwLock::new(None), chatgpt_base_url: None, @@ -1557,10 +1515,9 @@ impl AuthManager { } async fn load_auth_from_storage(&self) -> Option { - load_auth_with_env( + load_auth( &self.codex_home, self.enable_codex_api_key_env, - self.enable_codex_access_token_env, self.auth_credentials_store_mode, self.chatgpt_base_url.as_deref(), ) @@ -1650,31 +1607,13 @@ impl AuthManager { config: &impl AuthManagerConfig, enable_codex_api_key_env: bool, ) -> Arc { - Self::shared_from_config_with_env( - config, + let auth_manager = Self::shared( + config.codex_home(), enable_codex_api_key_env, - /*enable_codex_access_token_env*/ true, + config.cli_auth_credentials_store_mode(), + Some(config.chatgpt_base_url()), ) - .await - } - - /// Convenience constructor returning an `Arc` wrapper from resolved config, - /// with explicit control over environment-backed auth. - pub async fn shared_from_config_with_env( - config: &impl AuthManagerConfig, - enable_codex_api_key_env: bool, - enable_codex_access_token_env: bool, - ) -> Arc { - let auth_manager = Arc::new( - Self::new_with_env( - config.codex_home(), - enable_codex_api_key_env, - enable_codex_access_token_env, - config.cli_auth_credentials_store_mode(), - Some(config.chatgpt_base_url()), - ) - .await, - ); + .await; auth_manager.set_forced_chatgpt_workspace_id(config.forced_chatgpt_workspace_id()); auth_manager }