Files
codex/codex-rs
jif f57966695f Validate implicit API keys for Guardian Decisions (#59905)
## Why

Decisions uses a commercial endpoint, so implicitly inherited credentials must exclude FedRAMP API keys.

## What changed

Reject empty, whitespace-padded, and FedRAMP keys selected from cached authentication or `OPENAI_API_KEY`, returning a credentials error without rewriting the key. Explicit `CODEX_GUARDIAN_DECISIONS_API_KEY` overrides retain their existing behavior.

## Testing

Extend the cached-key precedence test to verify that FedRAMP project and service-account keys, including a whitespace-padded key, are rejected even when `OPENAI_API_KEY` provides a fallback.

GitOrigin-RevId: 8904b0e5b30662aaf7eb7535309b01c254bcbb82
2026-11-06 13:06:00 +00:00
..
…
…
…
…