## What changed
Introduce a `BundleSource` interface for authentication, cache identity, bundle fetching, and unauthorized-request recovery. Move ChatGPT plan eligibility and credential recovery into `ChatGptSource`, while keeping validation, caching, and retry orchestration in the shared service.
Support source-specific cache namespaces while preserving the existing ChatGPT cache location. Retain one authentication recovery context across all retries of a bundle fetch.
## Testing
Extend the external authentication test to verify that recovery happens only once per bundle fetch, including when an intervening request failure triggers a retry.
GitOrigin-RevId: f5009f72dc4479f96d4ed1da9232f250988444a5
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## What changed
- Recognize `sci` and `sci_plus` in authentication, account responses, rate limits, and generated client schemas.
- Treat both plans as workspace accounts eligible for cloud configuration, and use business analytics routes.
- Display “Academic Researchers” and “Academic Researchers Plus” in the TUI and direct users to their admin when usage limits are reached.
## Testing
Add coverage for plan parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, analytics routing, TUI labels, and usage-limit guidance. Exercise installed-app refresh and listing with `sci_plus` authentication.
GitOrigin-RevId: b51c5df03029b8bc249d44f11b353a7755e7dd04
## Why
Reloads can reject a valid thread configuration when the host configuration references a missing model provider that thread overrides replace. Concurrent cloud refreshes can also leave older policy snapshots or staged cache writes eligible for publication.
## What changed
- Compose preserved session layers before materializing refreshed configuration, retaining source-aware validation errors.
- Carry cloud policy revision bindings through config loading and role overrides. Reject stale MCP refreshes and disable enterprise MCP authorization when the policy is suspended. Retire the old policy when replacing or clearing its loader.
- Stage cloud cache writes in temporary files and publish them atomically only while their policy revision remains current.
- Route file reloads through the shared runtime refresh path, resolve paths relative to each config file, and preserve session settings. Restore host defaults for `secret_auth_storage` and `mcp_oauth_refresh_coordination` when explicit overrides are removed.
## Testing
Add regressions for thread-provided model providers, managed plugin and feature requirement refreshes, stale and suspended policy snapshots, superseded and retired cache writes, and file reloads preserving runtime settings and restoring feature defaults.
GitOrigin-RevId: 3280a2445eeb7074a142f720690bb0e4f01d174b
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Login and enterprise configuration bootstrap can fail when their endpoints are reachable only through the system proxy, before cloud configuration can enable `respect_system_proxy`.
## What changed
- Enable `features.system_proxy_fallback` by default, honor managed feature requirements, and prevent project configuration from changing it.
- Retry account discovery and cloud configuration GETs through the system proxy after connection failures or timeouts, bounding the initial request and body read to five seconds.
- Retry OAuth authorization-code exchange only on connection failures before any redirect, with a ten-second connection timeout. Reuse the successful client for the subsequent API-key exchange to avoid changing routes.
- Increase workspace discovery and cloud configuration timeouts to 15 and 20 seconds, respectively, to accommodate fallback.
## Testing
Add coverage for proxy-only browser login through the first completed turn, including cloud configuration enabling `respect_system_proxy` without a restart. Cover stalled GET bodies, preserved request headers, disabled fallback, managed requirements, and project configuration restrictions. Verify that OAuth HTTP errors, redirects followed by connection failures, and failures after sending the POST do not trigger proxy retries, while successful redirects remain supported.
GitOrigin-RevId: 854eeeac186bb4865218ce645019c1e4bff85425
Move the exponential backoff helper into `codex-async-utils` so
`codex-cloud-config` can use it without a runtime dependency on `codex-core`.
Keep `codex-core` as a development dependency for cloud-config tests.
Preserve the existing retry delays and jitter, and re-export `backoff` from
`codex_core::util` for existing callers.
GitOrigin-RevId: 338f3194e166e77003da532310ff5be78a0eac9e
## What changed
- Add a Windows sandbox service validator that loads managed configuration while impersonating the provisioning client.
- Reject elevated sandbox or network settings that conflict with managed requirements, including local binding and HTTP or SOCKS proxy-port restrictions.
- Add a one-shot cloud configuration loader that bypasses the disk cache so policy checks use a fresh backend response without modifying cached configuration.
- Keep the provisioning integration disabled until authenticated transport can supply the policy inputs.
## Testing
- Cover elevated sandbox restrictions, disabled networking, local binding, proxy-port classification, malformed policy, impersonation failure, and cache bypass behavior.
GitOrigin-RevId: b76aa8959c515c6507c2eaf61af768efa1305253
## Why
A startup timeout leaves the cloud config loader with a cached error, while the
normal background refresh interval delays recovery for 15 minutes.
## What changed
- Retry timed-out cloud config bundle loads after 5 seconds through the existing
background worker.
- Keep serving the cached snapshot to concurrent readers instead of triggering
additional fetches.
- Restore the normal 15-minute refresh interval after a successful retry or a
non-timeout error.
## Testing
Added paused-time tests covering repeated startup timeouts, successful recovery,
application of the recovered bundle to later config loads, and restoration of
the normal refresh interval after both success and validation failure.
GitOrigin-RevId: da62abbae9be7f40af61f4c4adaf4ea5c337ec88
## What changed
- Recognize `edu_plus` and `edu_pro` as distinct education workspace plans across authentication, backend rate-limit mapping, and app-server account schemas.
- Include both plans in cloud configuration eligibility and use the education usage-limit behavior.
- Display the plans as `Edu Plus` and `Edu Pro` in the TUI status view.
## Testing
- Cover parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, usage-limit messages, and TUI display names for the new variants.
GitOrigin-RevId: bf8add780ae03a3c6d10c4f4afa0da262c37928e
## Why
Background refreshes previously warmed only the on-disk cache, so new sessions in the same process continued using the startup snapshot.
## What changed
- Make `CloudConfigBundleLoader` retrieve the latest shared bundle on each configuration load.
- Update the in-memory bundle after successful refreshes while preserving the last successful bundle when a refresh fails.
- Stop refresh work when its loader is replaced or its final clone is dropped.
## Testing
- Cover refreshed requirements and managed configuration in later sessions.
- Cover concurrent initial loads, refresh failures and recovery, bundle clearing, and refresh-task cancellation.
GitOrigin-RevId: ae3d79b575bad71a1eed370cee6dc66dc022ffa8
## Summary
- Increase the cloud config bundle background refresh interval from 5
minutes to 15 minutes.
- Increase the local cloud config bundle cache TTL from 30 minutes to 1
hour.
## Why
- Reduce background cloud config fetch frequency while keeping cached
workspace-managed policies available longer between refreshes.
## Validation
- `just fmt`
- `cargo test -p codex-cloud-config`
## Summary
Allow EDU ChatGPT workspaces to fetch cloud config bundles. The existing
cloud config eligibility gate only allowed business-like and enterprise
plans, which meant EDU admins could configure managed policies in the UI
but the Codex client would skip fetching them.
This keeps individual/pro and team-like usage-based plans excluded, and
adds service-level coverage for both `edu` and `education` plan aliases.
## Validation
- `just fmt`
- `just test -p codex-cloud-config`
- Built the Codex app locally, created a new EDU ChatGPT workspace, and
verified config bundles can be fetched and are properly applied.
## Summary
- Splits the monolithic `codex-cloud-config` implementation into focused
modules.
- Keeps behavior unchanged from the preceding config bundle runtime
switch.
## Details
This is the reviewability follow-up after the lineage-preserving
migration PRs. The split separates backend transport, loader
construction, cache handling, metrics, validation, service
orchestration, and focused tests into named files.
Verification: `just fmt`; `just test -p codex-cloud-config`.
smurching-oai