mirror of
https://github.com/openai/codex.git
synced 2026-09-08 15:50:34 +00:00
936f5eb3ee
## What changed - Add the `codex-workload-identity` crate for exchanging a file-backed JWT assertion and federation rule ID for short-lived ChatGPT credentials. - Cache valid access tokens, refresh them before expiry or after rejection, and coalesce concurrent exchanges. Continue using a still-valid cached token when a proactive refresh fails transiently. - Validate assertion files, token endpoints, and exchange responses; honor outbound proxy policy for HTTPS endpoints and redact access tokens from debug output. ## Testing - Cover request encoding, assertion rotation, caching, concurrent refreshes, transient-failure fallback, configuration validation, and malformed inputs and responses. GitOrigin-RevId: 5496851683c2dcf6aaad6840053b97f7c0be076e