mirror of https://github.com/openai/codex.git synced 2026-10-22 17:58:46 +00:00

Files

T

Anton Panasenko bd5a836567 Refresh remote exec-server credentials after unauthorized responses (#55987 )

## Why

Remote registry requests need to recover when credentials are rejected or rotated while `exec-server` is running. Concurrent requests should reuse refreshed credentials rather than refresh the replacement token again.

## What changed

- Add an `AuthProvider` recovery hook and retry registry registration, connection, and harness-key validation once after a `401` when the provider supplies replacement credentials.
- Use live ChatGPT authentication for remote `exec-server` and guard proactive and unauthorized refreshes so concurrent callers share the completed refresh.
- Allow executor credentials to retry when the parent has already supplied a valid replacement.
- Keep connection authentication, refresh, and retry within the original connection deadline.

## Testing

Add coverage for concurrent refreshes, stored and parent-supplied credential rotation, refresh failures, retry limits, and connection deadlines, plus a CLI integration test for refresh and credential reload in a running executor.

GitOrigin-RevId: 9ed533e410762c7ac8b7c0c30bb93fd20d96778b

2026-10-21 21:05:08 +00:00

src

Refresh remote exec-server credentials after unauthorized responses (#55987 )

2026-10-21 21:05:08 +00:00

tests

Propagate authentication header failures before sending requests (#55607 )

2026-10-20 15:43:19 +00:00

BUILD.bazel

feat: add support for building with Bazel (#8875 )

2026-01-09 11:09:43 -08:00

Cargo.toml

Honor Retry-After and preserve server retry deadlines (#47641 )

2026-09-23 19:53:11 +00:00

README.md

Normalize formatting in docs, web assets, and sample scripts (#52256 )

2026-10-08 20:11:43 +00:00

README.md

codex-api

Typed clients for Codex/OpenAI APIs built on top of the generic transport in codex-client.

Hosts the request/response models and request builders for Responses and related Codex APIs.
Owns provider configuration (base URLs, headers, query params), auth header injection, retry tuning, and stream idle settings.
Parses SSE streams into ResponseEvent/ResponseStream, including rate-limit snapshots and API-specific error mapping.
Serves as the wire-level layer consumed by codex-core; higher layers handle auth refresh and business logic.

Core interface

The public interface of this crate is intentionally small and uniform:

Responses endpoint
- Input:
  - ResponsesApiRequest for the request body (model, input, tools, parallel_tool_calls, reasoning/text controls).
  - ResponsesOptions for transport/header concerns (conversation_id, session_source, extra_headers, compression, turn_state).
- Output: a ResponseStream of ResponseEvent (both re-exported from common).
Memory summarize endpoint
- Input: MemorySummarizeInput (re-exported as codex_api::MemorySummarizeInput):
  - model: String.
  - raw_memories: Vec<RawMemory> (serialized as traces for wire compatibility).
    - RawMemory includes id, metadata.source_path, and normalized items.
  - reasoning: Option<Reasoning>.
- Output: Vec<MemorySummarizeOutput>.
- MemoriesClient::summarize_input(&MemorySummarizeInput, extra_headers) wraps JSON encoding and retry/telemetry wiring.

All HTTP details (URLs, headers, retry/backoff policies, SSE framing) are encapsulated in codex-api and codex-client. Callers construct prompts/inputs using protocol types and work with typed streams of ResponseEvent or other endpoint-specific response values.