Won Park 3ae4225b17 Restrict cloud task credentials to trusted origins (#41403) ...

## Why

Cloud task requests can use saved ChatGPT credentials, so their destination must be constrained before authentication is loaded or any request is made.

## What changed

- Validate `CODEX_CLOUD_TASKS_BASE_URL` against trusted ChatGPT HTTPS origins on port 443 and reject URLs containing user information, queries, or fragments.
- Disable redirects for cloud task backend and environment-discovery clients so credentials are never forwarded to a redirect destination.
- Normalize the validated base URL before configuring authentication and HTTP clients.

## Testing

Add a CLI integration test that verifies a custom cloud backend is rejected without receiving a request, while the staging origin continues to use explicit token authentication.

GitOrigin-RevId: f0dddf363b4e44ea3530f81d9a817e978c15ead2

2026-08-28 19:44:50 +00:00

..

src

Restrict cloud task credentials to trusted origins (#41403)

2026-08-28 19:44:50 +00:00

tests/fixtures

Add cloud tasks (#3197)

2025-09-30 10:10:33 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Add backend client support for Codex user settings (#34559)

2026-07-21 15:00:18 +00:00