mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
e60af81b4f
## Summary External auth had two paths: provider-command credentials were resolved through `ExternalAuth`, while app-provided ChatGPT credentials were installed separately and only used the provider for refresh. `ExternalAuth` also declared an auth mode independently from the `CodexAuth` value it returned, so the declaration and credentials could disagree. This change makes the provider-owned `CodexAuth` authoritative for initial resolution, credential kind, and refresh. - remove `ExternalAuth::auth_mode` and require providers to return their current auth from `resolve` - route external auth registration, resolution, and unauthorized refresh through `AuthManager::set_external_auth` - keep the last resolved credential with its provider so synchronous consumers and unauthorized recovery observe the credential's actual mode - make the app-server bridge own both initial and refreshed ChatGPT credentials, and detach it on logout - keep model listing free of auth-refresh side effects, including in offline mode Provider-command auth still follows its configured cache interval. App-provided ChatGPT auth still asks the parent app once after a `401` and retries the request once. Stacked on #31355. ## Testing - `just test -p codex-login` - `just test -p codex-models-manager` - focused `codex-app-server` tests for external login/logout, unauthorized refresh, and workspace mismatch