From eca79b000c48bace74eaef474ec4c5d1ae5ba34a Mon Sep 17 00:00:00 2001
From: "Adam Perry @ OpenAI" <anp@openai.com>
Date: Thu, 22 Oct 2026 23:23:49 +0000
Subject: [PATCH] Use fixed-token auth fixtures in Vertex tests (#56293)

## Why

The sequential token fixture rewrites shared files when resolving credentials. Concurrent credential resolution needs a fixture that can return the same token independently for each caller.

## What changed

Add `ProviderAuthCommandFixture::fixed_token`, which reads a token file using `cat` on Unix or `cmd.exe` on Windows without modifying it. Use it in the Vertex command-auth and guardian-request tests.

GitOrigin-RevId: 5bf5134f113b546a643a47012281fb960e885b15
---
 codex-rs/core/tests/suite/client.rs | 16 ++++++++++++++++
 codex-rs/core/tests/suite/gcp.rs    |  6 ++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/codex-rs/core/tests/suite/client.rs b/codex-rs/core/tests/suite/client.rs
index ebdcb7a42d..2c01fcb17d 100644
--- a/codex-rs/core/tests/suite/client.rs
+++ b/codex-rs/core/tests/suite/client.rs
@@ -878,6 +878,22 @@ pub(super) struct ProviderAuthCommandFixture {
 }
 
 impl ProviderAuthCommandFixture {
+    /// Each thread can resolve credentials independently, including at the same time.
+    pub(super) fn fixed_token(token: &str) -> std::io::Result<Self> {
+        let tempdir = tempfile::tempdir()?;
+        std::fs::write(tempdir.path().join("token.txt"), token)?;
+        let (command, args): (&str, &[&str]) = if cfg!(windows) {
+            ("cmd.exe", &["/D", "/C", "type", "token.txt"])
+        } else {
+            ("cat", &["token.txt"])
+        };
+        Ok(Self {
+            tempdir,
+            command: command.to_owned(),
+            args: args.iter().copied().map(str::to_owned).collect(),
+        })
+    }
+
     pub(super) fn new(tokens: &[&str]) -> std::io::Result<Self> {
         let tempdir = tempfile::tempdir()?;
         let tokens_file = tempdir.path().join("tokens.txt");
diff --git a/codex-rs/core/tests/suite/gcp.rs b/codex-rs/core/tests/suite/gcp.rs
index bcbde46ac7..098d59513f 100644
--- a/codex-rs/core/tests/suite/gcp.rs
+++ b/codex-rs/core/tests/suite/gcp.rs
@@ -44,8 +44,7 @@ async fn vertex_requests_use_command_auth_with_namespaces_and_tool_search() -> R
         ]),
     )
     .await;
-    let auth_fixture =
-        ProviderAuthCommandFixture::new(&["vertex-access-token", "vertex-access-token"])?;
+    let auth_fixture = ProviderAuthCommandFixture::fixed_token("vertex-access-token")?;
     let mut provider = ModelProviderInfo::create_gcp_provider();
     provider.base_url = Some(format!(
         "{}/v1/projects/example-project/locations/global/publishers/openai/v1",
@@ -305,8 +304,7 @@ async fn vertex_guardian_requests_use_luna() -> Result<()> {
         ],
     )
     .await;
-    let auth_fixture =
-        ProviderAuthCommandFixture::new(&["vertex-access-token", "vertex-access-token"])?;
+    let auth_fixture = ProviderAuthCommandFixture::fixed_token("vertex-access-token")?;
     let mut provider = ModelProviderInfo::create_gcp_provider();
     provider.base_url = Some(format!("{}/v1", server.uri()));
     provider.auth = Some(auth_fixture.auth());