## Why
Reusable clients need fresh authentication for each request while preserving the credential source and transport policy selected when the client was created.
## What changed
- Add runtime-aware backend client construction and per-request authentication. Allow token refresh within the original credential source, reject credential replacement, and validate destination and account/organization selectors.
- Let runtime authentication finish persisting rotated tokens when the requesting task is cancelled.
- Apply asynchronous authentication to file creation and finalization requests, generating fresh assertions while keeping credentials off blob uploads.
- Preserve direct sandbox routing without enabling legacy custom-CA fallback for protected clients that reject redirects.
- Exclude login account metadata from model cache identities when provider bearer credentials override the login, and record authentication selection outcomes and duration.
## Testing
Add regression coverage for credential refresh and replacement, organization selection, destination restrictions, transport policy preservation, cancellation during token rotation, credential stripping on redirects, and file upload authentication in both runtime authentication modes.
GitOrigin-RevId: d045595e869dfcdfd9f705a6228cf0eb4c2d2c12
## What changed
- Rename ChatGPT-specific bundle loaders to `chatgpt_config_bundle_loader*` and use managed-config terminology for shared loader plumbing.
- Pass `Config` directly when updating the app-server's managed configuration loader.
- Share configuration loading, logging setup, and result handling between browser and device-code login.
- Expose the CLI cloud-config helpers and `provider_uses_first_party_auth_path` through their library APIs.
## Testing
Extend CLI login coverage to verify that `forced_login_method="api"` rejects both `login` and `login --device-auth` while preserving saved API-key credentials.
GitOrigin-RevId: 9e8fa6110dc80882ba365e550b48ac77da604940
## What changed
- Add loaders that select `config_server` when configured and otherwise use the existing ChatGPT bundle source. Fetch custom bundles from `<base_url>/codex/config/bundle` without redirects or request logging.
- Support optional OAuth sessions without interactive login during bundle fetches, recover credentials after a `401`, and scope cached bundles to the endpoint and authorization identity.
- Restrict bootstrap network access to configuration and OAuth endpoints using local administrator rules when available.
- Return generic bundle validation errors so invalid TOML, requirements, and provider settings do not expose configuration contents.
## Testing
Add tests for missing configuration-server sign-in, replacement OAuth credentials, endpoint-specific cache reuse, and validation errors that omit sensitive values while preserving cached bundles.
GitOrigin-RevId: 56590a9e66340540666ca21590bef46c495e0e33
cooper-oai