alexsong-oai

Add explicit gateway OAuth sign-in to app-server (#47207) ## Why Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests. ## What changed - Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in. - Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect. - Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed. - Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle. ## Testing Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks. GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594

Add OAuth credential management for model provider gateways (#46318) ## What changed - Export `GatewayAuthConfig` and `GatewayAuthManager` with PKCE browser sign-in, loopback callbacks, cached token resolution, and refresh after expiry or rejection. - Store gateway credentials in a dedicated encrypted namespace with an independent keyring key. Serialize token exchanges and persistence across processes, preserve refresh rotations after caller cancellation, and retain pending credentials when saving fails. - Validate OAuth endpoints and token responses, disable token-request redirects and logging, and redact sensitive error details. ## Testing Add tests covering browser authorization, callback state validation and cleanup, concurrent refreshes, cancellation, failed-save recovery, storage isolation, endpoint validation, and credential redaction. GitOrigin-RevId: e0c17f1eab7acca378a14b2d00b80940d8542e47

Add AWS credential export commands for Amazon Bedrock (#44028) ## What changed Support `model_providers.amazon-bedrock.aws.credential_export` with `command`, `args`, and `timeout_ms` to supply SigV4 signing credentials from a command's JSON output. Accept both flat credential-process output and nested STS `Credentials` objects. Cache credentials in memory, refresh before expiration, and share exports across sessions with matching AWS configuration. On recoverable authentication failures, run the optional `aws.auth_refresh` command before exporting fresh credentials, coalescing concurrent recovery attempts. Bound command execution time and output size, and keep credential values out of errors. Reject combining `aws.credential_export` with `aws.profile`. Bedrock setup and login reject changes while an exporter is configured, preserving configuration and saved credentials. ## Testing Add coverage for output formats, expiration, credential precedence, caching, concurrent recovery, command failures, and secret redaction. Integration tests verify request signing with rotated credentials, bounded recovery attempts, and setup/login rejection across configuration layers. GitOrigin-RevId: 4ef799f88ab5e3b2578f8f41a5e56e4f30e2cd81

Support managed AWS access keys for Amazon Bedrock (#40481) ## What changed - Add the experimental `amazonBedrockAccessKeys` app-server login flow, persist its credentials in the configured auth store, and use them for SigV4-signed Bedrock requests. - Report `bedrockAccessKeys` as a distinct auth mode and document access-key login alongside AWS profile and environment credential setup. - Clear the selected Bedrock provider, AWS settings, and Bedrock-specific model on logout while leaving external AWS credentials and `.env` untouched. - Reject managed access-key login when higher-precedence configuration would prevent its region or profile settings from taking effect. ## Testing - Cover access-key login, storage, request signing, configuration conflicts, status reporting, and logout cleanup. GitOrigin-RevId: bbf297887c6503d3651ceb2aad85c4d626e32723

Enforce managed model provider selection and definitions (#44650) ## What changed - Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers. - Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides. - Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots. ## Testing Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds. GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54

Enforce managed provider requirements on existing app-server threads (#44944) ## Why Existing threads retain their model provider configuration, which can stop matching managed requirements after those requirements change. ## What changed - Check retained providers against current managed `model_provider` and `model_providers` requirements before turn start/steer, review, compaction, manual queue start, and active goal updates. Reject requests when requirements cannot be loaded or no longer match; provider mismatches prompt users to restart Codex. - Load managed requirements independently of user, project, system defaults, and thread configuration, and resolve Bedrock provider overrides before comparison. - Keep interrupt, realtime stop, and goal pause/clear available. Realtime connections use separate routing and are outside these checks. - Make detached reviews inherit their parent thread's configuration. ## Testing Add unit and integration coverage for provider selection and definition changes, Bedrock overrides, requirement load failures, unchanged queue and goal state after rejection, and continued operation after local configuration changes. Extend detached review coverage to verify inheritance of the parent's provider route. GitOrigin-RevId: 21abf08ad2bcc2ea4698209fa33a17485eed4740

Centralize OAuth login and refresh handling with safer diagnostics (#46300) ## Why Login and token refresh have separate OAuth request and error handling. Token endpoint errors can echo credentials, and JSON decoding errors can expose token values in diagnostics. ## What changed - Extract authorization URL construction, callback validation, PKCE, token grants, and error handling into a shared `oauth` module in `codex-rs/login`. - Route authorization-code exchange and ChatGPT refresh through `OAuthClient`, retaining form and JSON encoding respectively and caller-owned HTTP and credential recovery policies. - Redact echoed request secrets from rejection details and request IDs, redact sensitive transport URL fields, and replace token decoding errors with a generic error. Preserve original error codes for refresh failure classification. - Keep callback state validation ahead of codes and provider errors, with the existing onboarding suffix handled by the login server. ## Testing Add coverage for PKCE binding, request encoding and headers, callback state rejection, credential redaction, oversized or unreadable error bodies, and preservation of stored and cached credentials after transient refresh failures. GitOrigin-RevId: d0a9583b99e24f5aafb751acd1e7200e2261a0e4

Add explicit gateway login control and authentication status (#47170) ## What changed - Add `GatewayLoginControl` so hosts can require caller-initiated browser authorization while retaining automatic login by default. - Expose passive readiness checks, scoped status subscriptions, and cancellable browser login that reports success after credentials are persisted. - Return non-retryable request errors for `LoginRequired` and `LoginInProgress`, while preserving retries for transient authentication failures. - Keep rejected credentials unready until replaced, and prevent slow readiness reads from blocking cached requests or overwriting newer credentials. ## Testing Add coverage for login cancellation, status notifications, external credential recovery, concurrent credential I/O, legacy automatic login, and request retry behavior. GitOrigin-RevId: e236d203998ceb6eeaca9704cc05d20ad45f2931

Add Amazon Bedrock setup to TUI onboarding (#40679) ## What changed - Add a feature-gated Amazon Bedrock option to eligible TUI sign-in flows. - Discover existing AWS profiles and environment credentials, with manual setup for profiles, access keys, environment variables, and Bedrock API keys. - Collect the AWS Region, mask secrets during entry, persist the selected Bedrock configuration through the app server, and restart the embedded server when the provider changes. ## Testing - Cover wizard eligibility, sign-in option rendering, credential discovery ordering, region entry, and secret masking. GitOrigin-RevId: 0a49afb6aca442b88e8448efa80336777848f4ac

Compose gateway OAuth with primary provider authentication (#46490) ## Why Providers configured with `gateway_oauth` need gateway credentials alongside primary authentication for inference and model discovery. ## What changed - Attach gateway tokens through the configured header or cookie while preserving primary authentication, including WebSocket handshake headers. - Share gateway credential managers across matching provider instances and model discovery so they observe refreshed tokens. - Reject authentication on gateway setup or token failures, invalid token values, and conflicting auth headers. Mark gateway headers sensitive and avoid exposing issuer error details. - Include gateway OAuth configuration in model catalog cache identity to prevent reuse across different gateway configurations. ## Testing Add provider and core integration tests covering combined credentials, header and cookie delivery, token refresh, shared credential state, cache isolation, and request blocking on gateway token or HTTP client initialization failures. GitOrigin-RevId: cb74125cf7e87660967d49edacf14646cf0b99c4