mirror of
https://github.com/openai/codex.git
synced 2026-11-07 20:30:33 +00:00
cooper-oai
1c414e0d65
## Why Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context. ## What changed - Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings. - Select the staging Decisions endpoint when the ChatGPT environment is staging. - Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication. - Keep custom destinations independent of runtime assertions. ## Testing Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations. GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db
52 lines
1.6 KiB
TOML
52 lines
1.6 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-memories-write"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
name = "codex_memories_write"
|
|
path = "src/lib.rs"
|
|
doctest = false
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
chrono = { workspace = true }
|
|
codex-backend-client = { workspace = true }
|
|
codex-core = { workspace = true }
|
|
codex-config = { workspace = true }
|
|
codex-features = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-login = { workspace = true }
|
|
codex-model-provider = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-rollout = { workspace = true }
|
|
codex-rollout-trace = { workspace = true }
|
|
codex-secrets = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-terminal-detection = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-output-truncation = { workspace = true }
|
|
codex-utils-template = { workspace = true }
|
|
futures = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "rt", "sync", "time"] }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
uuid = { workspace = true, features = ["v4", "v5"] }
|
|
|
|
[dev-dependencies]
|
|
base64 = { workspace = true }
|
|
codex-runtime-agent-instance = { workspace = true }
|
|
codex-model-provider-info = { workspace = true }
|
|
codex-models-manager = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio = { workspace = true, features = ["fs", "macros"] }
|
|
wiremock = { workspace = true }
|