Celia Chen b724f5966e feat: add secret auth storage configuration (#27504) ...

## Why

Windows Credential Manager limits generic credential blobs to 2,560
bytes. The encrypted local secrets backend avoids storing large
serialized auth payloads directly in the OS keyring, but selecting that
backend needs an independently reviewable feature/config layer before
the auth and secrets implementation is wired in.

## What Changed

- Added the stable `secret_auth_storage` feature, enabled by default on
Windows and disabled by default elsewhere.
- Added `AuthKeyringBackendKind` and config resolution for full and
bootstrap config loading.
- Applied managed feature requirements when resolving the bootstrap auth
backend.
- Updated the generated config schema and added focused tests.

This is the base PR for #17931. The auth, secrets, MCP, CLI, TUI, and
app-server implementation remains in that follow-up PR.

## Validation

- `just test -p codex-features`
- `just test -p codex-config`
- `just test -p codex-core
resolve_bootstrap_auth_keyring_backend_kind_uses_secret_auth_storage_feature`
- `just write-config-schema`
- `just fix -p codex-core`

The full `just test -p codex-core` run compiled successfully and ran
2,690 tests; 2,589 passed, one was flaky, and 101 environment-sensitive
tests failed because this shell injects a `pyenv` rehash warning into
command output or because sandboxed subprocesses timed out.

b724f5966e · 2026-06-12 19:15:21 +00:00

History

..

examples

Add remote thread config loader protos (#18892)

2026-04-23 10:06:05 -07:00

scripts

Add remote thread config loader protos (#18892)

2026-04-23 10:06:05 -07:00

src

feat: add secret auth storage configuration (#27504)

2026-06-12 19:15:21 +00:00

BUILD.bazel

Extract codex-config from codex-core (#11389)

2026-02-11 10:02:49 -08:00

Cargo.toml

[codex] Remove async_trait from first-party code (#27475)

2026-06-11 18:16:39 -07:00