alexsong-oai

Add explicit gateway OAuth sign-in to app-server (#47207) ## Why Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests. ## What changed - Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in. - Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect. - Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed. - Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle. ## Testing Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks. GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594

Add OAuth credential management for model provider gateways (#46318) ## What changed - Export `GatewayAuthConfig` and `GatewayAuthManager` with PKCE browser sign-in, loopback callbacks, cached token resolution, and refresh after expiry or rejection. - Store gateway credentials in a dedicated encrypted namespace with an independent keyring key. Serialize token exchanges and persistence across processes, preserve refresh rotations after caller cancellation, and retain pending credentials when saving fails. - Validate OAuth endpoints and token responses, disable token-request redirects and logging, and redact sensitive error details. ## Testing Add tests covering browser authorization, callback state validation and cleanup, concurrent refreshes, cancellation, failed-save recovery, storage isolation, endpoint validation, and credential redaction. GitOrigin-RevId: e0c17f1eab7acca378a14b2d00b80940d8542e47

Allow choosing the default provider for new chats in the TUI (#59722) ## What changed - Add Space to set the default provider from Model providers settings, persisting `model_provider` on the connected server. Keep provider details available and disable selection when server configuration or client launch settings fix the provider. - Apply the choice to `/new` while preserving the current chat. Refresh account details for new chats and reject account data that does not match the started provider. - Block stale `/model` choices during saves and after confirmed or uncertain provider changes, including across reconnects. Tell users to restart the app server and TUI to refresh the model list, and discard queued picker actions from another backend or chat. ## Testing Add coverage for provider saves, retry after disconnection, concurrent-save prevention, stale model choices, and account/provider matching, with updated provider-picker snapshots. GitOrigin-RevId: af6d149f7de7a2eaa09a31935f7088faa64d6a59

Add AWS credential export commands for Amazon Bedrock (#44028) ## What changed Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects. Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts. Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials. ## Testing Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers. GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81

Support managed AWS access keys for Amazon Bedrock (#40481) ## What changed - Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests. - Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup. - Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched. - Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect. ## Testing - Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup. GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723

Enforce managed model provider selection and definitions (#44650) ## What changed - Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers. - Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides. - Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots. ## Testing Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds. GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54

Add custom gateway selection to TUI sign-in (#60009) ## What changed - Add the disabled-by-default `gateway_setup_wizard` feature to let users choose a saved custom gateway during eligible local sign-in onboarding. - Save the selection as `model_provider`, restart the embedded app server with that provider, and complete required primary authentication and gateway OAuth before starting the first chat. - Show gateway loading and configuration errors, browser sign-in links, and an OAuth retry action. Respect provider policy and launch overrides. ## Testing Add coverage for onboarding eligibility, saved gateway selection and persistence, and gateway error and OAuth screens. Add a terminal integration test verifying that the selected gateway receives the first chat with authentication. GitOrigin-RevId: 92bd2da3abd28d6c2274c91b2d7561bf359f0ca0

Enforce managed provider requirements on existing app-server threads (#44944) ## Why Existing threads retain their model provider configuration, which can stop matching managed requirements after those requirements change. ## What changed - Check retained providers against current managed `model_provider` and `model_providers` requirements before turn start/steer, review, compaction, manual queue start, and active goal updates. Reject requests when requirements cannot be loaded or no longer match; provider mismatches prompt users to restart Codex. - Load managed requirements independently of user, project, system defaults, and thread configuration, and resolve Bedrock provider overrides before comparison. - Keep interrupt, realtime stop, and goal pause/clear available. Realtime connections use separate routing and are outside these checks. - Make detached reviews inherit their parent thread's configuration. ## Testing Add unit and integration coverage for provider selection and definition changes, Bedrock overrides, requirement load failures, unchanged queue and goal state after rejection, and continued operation after local configuration changes. Extend detached review coverage to verify inheritance of the parent's provider route. GitOrigin-RevId: 21abf08ad2bcc2ea4698209fa33a17485eed4740

Add Google Cloud Vertex AI setup to TUI onboarding (#57857) ## What changed - Add a sign-in wizard behind `features.gcp_setup_wizard`, disabled by default, to collect a project ID, optional location, and optional credential file. Users can leave the credential file blank to use Application Default Credentials. - Delegate credential validation and configuration persistence to the app-server, showing progress and allowing retries after errors. - Share editable single-line fields with Bedrock setup and compact the sign-in menu when terminal height is limited. ## Testing Add onboarding tests and snapshots covering feature gating, field editing, navigation, validation failures, successful configuration persistence, and compact menu rendering. GitOrigin-RevId: 96eb31e847aa1c2d503176be68ff2e2efe4722fa

Centralize OAuth login and refresh handling with safer diagnostics (#46300) ## Why Login and token refresh have separate OAuth request and error handling. Token endpoint errors can echo credentials, and JSON decoding errors can expose token values in diagnostics. ## What changed - Extract authorization URL construction, callback validation, PKCE, token grants, and error handling into a shared `oauth` module in `codex-rs/login`. - Route authorization-code exchange and ChatGPT refresh through `OAuthClient`, retaining form and JSON encoding respectively and caller-owned HTTP and credential recovery policies. - Redact echoed request secrets from rejection details and request IDs, redact sensitive transport URL fields, and replace token decoding errors with a generic error. Preserve original error codes for refresh failure classification. - Keep callback state validation ahead of codes and provider errors, with the existing onboarding suffix handled by the login server. ## Testing Add coverage for PKCE binding, request encoding and headers, callback state rejection, credential redaction, oversized or unreadable error bodies, and preservation of stored and cached credentials after transient refresh failures. GitOrigin-RevId: d0a9583b99e24f5aafb751acd1e7200e2261a0e4