## Why
Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.
## What changed
- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.
## Testing
Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.
GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
## Why
Tests need to distinguish slow subprocess startup from operation timeouts and wait for asynchronous work before asserting results or cleaning up fixtures.
## What changed
- Synchronize subprocess readiness, queued-turn completion, and matching UI events; allow more time for cold startup and separate startup from shutdown deadlines.
- Adapt Windows fixtures and permission expectations, provide the voice-host test runtime DLL path, and normalize platform paths and animated status snapshots.
- Use current configuration permissions when changing directories in embedded TUI sessions, while retaining saved permissions for remote sessions.
- Allow the release prompt-prefix comparison to accept the exact image-tool description update that removes image detail options, and refresh the corresponding tool snapshot.
## Testing
Extend inherited-session metadata coverage to both legacy and paginated thread history, including persisted history mode and revision-aware resume.
GitOrigin-RevId: 0afb38403fc0adb0d83175344749584f0cdf9979
## Why
Reusable clients need fresh authentication for each request while preserving the credential source and transport policy selected when the client was created.
## What changed
- Add runtime-aware backend client construction and per-request authentication. Allow token refresh within the original credential source, reject credential replacement, and validate destination and account/organization selectors.
- Let runtime authentication finish persisting rotated tokens when the requesting task is cancelled.
- Apply asynchronous authentication to file creation and finalization requests, generating fresh assertions while keeping credentials off blob uploads.
- Preserve direct sandbox routing without enabling legacy custom-CA fallback for protected clients that reject redirects.
- Exclude login account metadata from model cache identities when provider bearer credentials override the login, and record authentication selection outcomes and duration.
## Testing
Add regression coverage for credential refresh and replacement, organization selection, destination restrictions, transport policy preservation, cancellation during token rotation, credential stripping on redirects, and file upload authentication in both runtime authentication modes.
GitOrigin-RevId: d045595e869dfcdfd9f705a6228cf0eb4c2d2c12
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## What changed
Move inline tests for authentication, bearer auth, model endpoints, and providers into dedicated `*_tests.rs` files. Register workspace-routing tests under the `workspace_routing` module and keep test-only imports with the tests.
GitOrigin-RevId: 9ba043c82814e27be63432a0e13a4929dc3ea372
## Why
Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.
## What changed
- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.
## Testing
Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.
GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad
cooper-oai