cooper-oai b5f1bb75d4 [codex-rs] enforce PAT workspace restrictions (#27450) ...

## Summary

- validate a hydrated personal access token's workspace against
`forced_chatgpt_workspace_id` before persisting `codex login
--with-access-token`
- apply the same PAT-only check when restricted auth managers load
environment, ephemeral, or persisted credentials
- enforce PAT workspace restrictions in the existing central
login-restriction path
- leave Agent Identity and cloud bootstrap behavior unchanged

## Scope

This is intentionally the small PAT-only change. It does not attempt the
broader auth-manager/bootstrap unification; that needs separate design
work.

## Validation

- `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just test
-p codex-login -p codex-cli` (410 passed)
- `CARGO_INCREMENTAL=0 CARGO_TARGET_DIR=/tmp/codex-pat-target just fix
-p codex-login -p codex-cli`
- `just fmt`
- `git diff --check`

Context: https://openai.slack.com/archives/D0AUPLV03RQ/p1781138331548269

b5f1bb75d4 · 2026-06-11 14:17:37 -07:00

History

..

src

[codex-rs] enforce PAT workspace restrictions (#27450)

2026-06-11 14:17:37 -07:00

tests

Add session delete commands in CLI and TUI (#27476)

2026-06-10 18:04:02 -07:00

BUILD.bazel

[codex] Move release platform rules into bazel package (#27321)

2026-06-10 19:45:29 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

[codex] Load user instructions through an injected provider (#27101)

2026-06-11 19:28:47 +00:00