mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Adrian
51864b0b4b
## Stack This is PR 3 of the simplified HAI single-run-task stack: - [#19047](https://github.com/openai/codex/pull/19047) Agent Identity assertion and task-registration primitives, including the shared run-task helper used by existing Agent Identity JWT auth. - [#19049](https://github.com/openai/codex/pull/19049) Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted Agent Identity runtime auth and its single run task. - [#19051](https://github.com/openai/codex/pull/19051) Run-scoped provider auth that uses one backend-owned task id for first-party inference and compaction requests. [#19054](https://github.com/openai/codex/pull/19054) collapsed out of the active stack because the simplified design no longer needs a separate background/control-plane task helper. ## Summary This PR moves Agent Identity usage into provider auth resolution. That keeps `AgentAssertion` auth tied to first-party OpenAI provider requests instead of applying a late session-wide override that could affect local, custom, Bedrock, API-key, or external-bearer providers. What changed: - adds a small `ProviderAuthScope` struct carrying the run auth policy and session source needed by provider-scoped auth resolution - lets `Session` opt the existing `ModelClient` into `ChatGptAuth` policy when `use_agent_identity` is enabled, without adding a second model-client constructor - resolves Agent Identity only for first-party OpenAI provider auth paths - uses the persisted run task id from the `AgentIdentityAuth` record to build `AgentAssertion` auth for Responses requests - routes shared request setup through scoped provider auth so unary compact requests use the same run-task assertion path as inference turns - keeps local/custom/Bedrock/env-key/external-bearer provider auth unchanged - lets missing run-task state surface through the existing model-request error path instead of silently falling back to bearer auth This PR intentionally does not create thread-scoped, target-scoped, or background-scoped task identities. The run task is the only task Codex registers in this POC shape. ## Testing - `just test -p codex-model-provider` - `just test -p codex-core client::tests::provider_auth_scope_uses` - `just test -p codex-core remote_compact_uses_agent_identity_assertion`
114 lines
4.4 KiB
Rust
114 lines
4.4 KiB
Rust
pub(crate) mod api_bridge;
|
|
pub(crate) mod auth;
|
|
pub(crate) mod common;
|
|
pub(crate) mod endpoint;
|
|
pub(crate) mod error;
|
|
pub(crate) mod files;
|
|
pub(crate) mod images;
|
|
pub(crate) mod provider;
|
|
pub(crate) mod rate_limits;
|
|
pub(crate) mod requests;
|
|
pub(crate) mod safety_buffering;
|
|
pub(crate) mod search;
|
|
pub(crate) mod sse;
|
|
pub(crate) mod telemetry;
|
|
|
|
pub use crate::requests::headers::build_session_headers;
|
|
pub use codex_client::RequestTelemetry;
|
|
pub use codex_client::ReqwestTransport;
|
|
pub use codex_client::TransportError;
|
|
|
|
pub use crate::api_bridge::map_api_error;
|
|
pub use crate::auth::AgentIdentityTelemetry;
|
|
pub use crate::auth::AuthError;
|
|
pub use crate::auth::AuthHeaderTelemetry;
|
|
pub use crate::auth::AuthProvider;
|
|
pub use crate::auth::AuthProviderFuture;
|
|
pub use crate::auth::SharedAuthProvider;
|
|
pub use crate::auth::auth_header_telemetry;
|
|
pub use crate::common::CompactionInput;
|
|
pub use crate::common::MemorySummarizeInput;
|
|
pub use crate::common::MemorySummarizeOutput;
|
|
pub use crate::common::OpenAiVerbosity;
|
|
pub use crate::common::RawMemory;
|
|
pub use crate::common::RawMemoryMetadata;
|
|
pub use crate::common::Reasoning;
|
|
pub use crate::common::ReasoningContext;
|
|
pub use crate::common::ResponseCreateWsRequest;
|
|
pub use crate::common::ResponseEvent;
|
|
pub use crate::common::ResponseStream;
|
|
pub use crate::common::ResponsesApiRequest;
|
|
pub use crate::common::ResponsesWsRequest;
|
|
pub use crate::common::TextControls;
|
|
pub use crate::common::WS_REQUEST_HEADER_TRACEPARENT_CLIENT_METADATA_KEY;
|
|
pub use crate::common::WS_REQUEST_HEADER_TRACESTATE_CLIENT_METADATA_KEY;
|
|
pub use crate::common::create_text_param_for_request;
|
|
pub use crate::common::response_create_client_metadata;
|
|
pub use crate::endpoint::CompactClient;
|
|
pub use crate::endpoint::ImagesClient;
|
|
pub use crate::endpoint::MemoriesClient;
|
|
pub use crate::endpoint::ModelsClient;
|
|
pub use crate::endpoint::RealtimeCallClient;
|
|
pub use crate::endpoint::RealtimeCallResponse;
|
|
pub use crate::endpoint::RealtimeEventParser;
|
|
pub use crate::endpoint::RealtimeOutputModality;
|
|
pub use crate::endpoint::RealtimeSessionConfig;
|
|
pub use crate::endpoint::RealtimeSessionMode;
|
|
pub use crate::endpoint::RealtimeWebsocketClient;
|
|
pub use crate::endpoint::RealtimeWebsocketConnection;
|
|
pub use crate::endpoint::RealtimeWebsocketEvents;
|
|
pub use crate::endpoint::RealtimeWebsocketWriter;
|
|
pub use crate::endpoint::ResponsesClient;
|
|
pub use crate::endpoint::ResponsesOptions;
|
|
pub use crate::endpoint::ResponsesWebsocketClient;
|
|
pub use crate::endpoint::ResponsesWebsocketClose;
|
|
pub use crate::endpoint::ResponsesWebsocketConnection;
|
|
pub use crate::endpoint::ResponsesWebsocketProbe;
|
|
pub use crate::endpoint::SearchClient;
|
|
pub use crate::endpoint::session_update_session_json;
|
|
pub use crate::error::ApiError;
|
|
pub use crate::files::OPENAI_FILE_UPLOAD_LIMIT_BYTES;
|
|
pub use crate::files::upload_openai_file;
|
|
pub use crate::images::ImageBackground;
|
|
pub use crate::images::ImageData;
|
|
pub use crate::images::ImageEditRequest;
|
|
pub use crate::images::ImageGenerationRequest;
|
|
pub use crate::images::ImageQuality;
|
|
pub use crate::images::ImageResponse;
|
|
pub use crate::images::ImageUrl;
|
|
pub use crate::provider::Provider;
|
|
pub use crate::provider::RetryConfig;
|
|
pub use crate::provider::is_azure_responses_provider;
|
|
pub use crate::requests::Compression;
|
|
pub use crate::search::AllowedCaller;
|
|
pub use crate::search::ApproximateLocation;
|
|
pub use crate::search::ClickOperation;
|
|
pub use crate::search::ExternalWebAccess;
|
|
pub use crate::search::ExternalWebAccessMode;
|
|
pub use crate::search::FinanceAssetType;
|
|
pub use crate::search::FinanceOperation;
|
|
pub use crate::search::FindOperation;
|
|
pub use crate::search::LocationType;
|
|
pub use crate::search::OpenOperation;
|
|
pub use crate::search::ScreenshotOperation;
|
|
pub use crate::search::SearchCommands;
|
|
pub use crate::search::SearchContextSize;
|
|
pub use crate::search::SearchFilters;
|
|
pub use crate::search::SearchImageSettings;
|
|
pub use crate::search::SearchInput;
|
|
pub use crate::search::SearchQuery;
|
|
pub use crate::search::SearchRequest;
|
|
pub use crate::search::SearchResponse;
|
|
pub use crate::search::SearchResponseLength;
|
|
pub use crate::search::SearchSettings;
|
|
pub use crate::search::SportsFunction;
|
|
pub use crate::search::SportsLeague;
|
|
pub use crate::search::SportsOperation;
|
|
pub use crate::search::SportsToolName;
|
|
pub use crate::search::TimeOperation;
|
|
pub use crate::search::WeatherOperation;
|
|
pub use crate::telemetry::SseTelemetry;
|
|
pub use crate::telemetry::WebsocketTelemetry;
|
|
pub use codex_protocol::protocol::RealtimeAudioFrame;
|
|
pub use codex_protocol::protocol::RealtimeEvent;
|