mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
cooper-oai
faeb379646
## Why Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources. ## What changed - Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials. - Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring. - Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials. - Reject requests whose production or staging environment differs from runtime registration, including model catalog requests. ## Testing Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches. GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
36 lines
1.2 KiB
Rust
36 lines
1.2 KiB
Rust
//! Ephemeral OpenAI runtimes: composite registration and per-request assertions.
|
|
|
|
mod actor;
|
|
mod auth;
|
|
mod binding;
|
|
mod bootstrap;
|
|
mod manager;
|
|
mod registration;
|
|
mod runtime;
|
|
|
|
pub use actor::AgentHost;
|
|
pub use actor::AuthenticatedActor;
|
|
pub use bootstrap::ActorInfo;
|
|
pub use bootstrap::AgentHostAuthorization;
|
|
pub use bootstrap::AuthenticatedActorAuthorization;
|
|
pub use bootstrap::PlatformResourceSelection;
|
|
pub use bootstrap::RuntimeRegistrationMetadata;
|
|
pub use bootstrap::RuntimeRegistrationRequest;
|
|
pub use bootstrap::RuntimeRegistrationResponse;
|
|
pub use bootstrap::RuntimeRole;
|
|
pub use codex_http_client::is_openai_api_url;
|
|
|
|
pub use auth::RuntimeAuth;
|
|
pub use binding::RuntimeAuthBinding;
|
|
pub use binding::RuntimeAuthError;
|
|
pub use manager::RuntimeAuthManager;
|
|
pub use registration::DEFAULT_REGISTRATION_URL;
|
|
pub use registration::RegistrationError;
|
|
pub use registration::RegistrationErrorCode;
|
|
pub use registration::RuntimeRegistrationClient;
|
|
pub use runtime::RuntimeAgentInstance;
|
|
pub use runtime::RuntimeRegistration;
|
|
|
|
/// Harness-owned lazy runtime, shared before any request requires registration.
|
|
pub type RuntimeAuthSlot = std::sync::Arc<std::sync::OnceLock<std::sync::Arc<RuntimeAuthManager>>>;
|