feat: add explicit AgentIdentity auth mode by efrazer-oai · Pull Request #18785 · openai/codex

efrazer-oai · 2026-04-21T01:41:33Z

Summary

This PR adds CodexAuth::AgentIdentity as an explicit auth mode.

An AgentIdentity auth record is a standalone auth.json mode. When AuthManager::auth().await loads that mode, it registers one process-scoped task and stores it in runtime-only state on the auth value. Header creation stays synchronous after that because the task is initialized before callers receive the auth object.

This PR also removes the old feature flag path. AgentIdentity is selected by explicit auth mode, not by a hidden flag or lazy mutation of ChatGPT auth records.

Reference old stack: https://github.com/openai/codex/pull/17387/changes

Design Decisions

AgentIdentity is a real auth enum variant because it can be the only credential in auth.json.
The process task is ephemeral runtime state. It is not serialized and is not stored in rollout/session data.
Account/user metadata needed by existing Codex backend checks lives on the AgentIdentity record for now.
is_chatgpt_auth() remains token-specific.
uses_codex_backend() is the broader predicate for ChatGPT-token auth and AgentIdentity auth.

Stack

fix: fully revert agent identity runtime wiring #18757: full revert
refactor: add agent identity crate #18871: isolated Agent Identity crate
This PR: explicit AgentIdentity auth mode and startup task allocation
refactor: route Codex auth through AuthProvider #18811: migrate Codex backend auth callsites through AuthProvider
feat: load AgentIdentity from JWT login/env #18904: accept AgentIdentity JWTs and load CODEX_AGENT_IDENTITY

Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

chatgpt-codex-connector

💡 Codex Review

https://github.com/openai/codex/blob/0b61c82df7664dc0a9a51e18b7a83dcf207ff167/codex-rs/login/src/auth/manager.rs#L1571-L1572
Return AgentIdentity auth header from ChatGPT auth helper

chatgpt_authorization_header_for_auth immediately returns None when is_chatgpt_auth() is false, which excludes CodexAuth::AgentIdentity. Existing backend callers still use this helper for authorization, so Agent Identity sessions fail to attach any auth header and behave as unauthenticated.

https://github.com/openai/codex/blob/0b61c82df7664dc0a9a51e18b7a83dcf207ff167/codex-rs/core/src/client.rs#L677
Route AgentIdentity through auth-manager auth path in client setup

current_client_setup only uses auth-manager header injection when auth.is_chatgpt_auth() is true. AgentIdentity fails that check, so execution falls back to provider.api_auth(), which calls get_token() and errors for Agent Identity. Result: normal model requests fail before dispatch when AgentIdentity is active.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

efrazer-oai · 2026-04-21T07:56:41Z

Codex review comments resolved.

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/models-manager/src/manager.rs

Line 415 in b23a44f

    
           if auth_mode != Some(AuthMode::Chatgpt) && !self.provider.info().has_command_auth() {

Treat AgentIdentity as ChatGPT auth for model refresh

refresh_available_models exits unless auth_mode == Some(AuthMode::Chatgpt). After introducing explicit AgentIdentity, authenticated AgentIdentity users take this early-return path and skip remote model-catalog refresh (unless command auth is configured), leaving stale or missing model availability.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

## Summary This PR fully reverts the previously merged Agent Identity runtime integration from the old stack: https://github.com/openai/codex/pull/17387/changes It removes the Codex-side task lifecycle wiring, rollout/session persistence, feature flag plumbing, lazy `auth.json` mutation, background task auth paths, and request callsite changes introduced by that stack. This leaves the repo in a clean pre-AgentIdentity integration state so the follow-up PRs can reintroduce the pieces in smaller reviewable layers. ## Stack 1. This PR: full revert 2. #18871: move Agent Identity business logic into a crate 3. #18785: add explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate auth callsites through AuthProvider ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

pakrym-oai · 2026-04-21T22:48:53Z

            config.cli_auth_credentials_store_mode(),
        );
        auth_manager.set_forced_chatgpt_workspace_id(config.forced_chatgpt_workspace_id());
+        auth_manager.set_chatgpt_backend_base_url(Some(config.chatgpt_base_url()));


Why don't we construct the manager with correct values and avoid RwLock?

pakrym-oai · 2026-04-21T22:50:42Z

+        self.chatgpt_authorization_header_for_auth(&auth).await
+    }
+
+    pub async fn chatgpt_authorization_header_for_auth(


do we still need this? I thought we are doing headers via AuthProvider ?

Removed -> these were unused after PR after this, but no point having them here.

pakrym-oai · 2026-04-21T22:51:08Z

+        }
+    }
+
+    pub fn chatgpt_base_url(&self) -> Option<String> {


we shouldn't expose this publicly

pakrym-oai · 2026-04-21T22:51:20Z

+    /// Sets the ChatGPT backend URL override for future auth runtime initialization.
+    /// Passing `None` clears the override and returns future initialization to the
+    /// default backend URL.
+    pub fn set_chatgpt_backend_base_url(&self, chatgpt_base_url: Option<String>) {


should just be set in ctor

pakrym-oai · 2026-04-21T23:00:05Z

+        Self::chatgpt_bearer_token_for_auth(auth).map(|token| format!("Bearer {token}"))
+    }
+
+    pub fn subscribe_auth_state(&self) -> watch::Receiver<()> {


Do we need this subscribe?

No, was used for syncing chatgpt_url but we're passing in top level now, removed.

pakrym-oai · 2026-04-21T23:01:06Z

 impl PartialEq for CodexAuth {
    fn eq(&self, other: &Self) -> bool {
-        self.api_auth_mode() == other.api_auth_mode()
+        match (self, other) {


do we care about this implemenation?

## Summary This PR adds `codex-agent-identity` as an isolated crate for Agent Identity business logic. The crate owns: - AgentAssertion construction. - Agent task registration. - private-key assertion signing. - bounded blocking HTTP for task registration. It does not wire AgentIdentity into `auth.json`, `AuthManager`, rollout state, or request callsites. That integration happens in later PRs. Reference old stack: https://github.com/openai/codex/pull/17387/changes ## Stack 1. #18757: full revert 2. This PR: isolated Agent Identity crate 3. #18785: explicit AgentIdentity auth mode and startup task allocation 4. #18811: migrate Codex backend auth callsites through AuthProvider 5. #18904: accept AgentIdentity JWTs and load `CODEX_AGENT_IDENTITY` ## Testing Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

adrian-openai

Had a few items to consider

adrian-openai · 2026-04-22T04:19:24Z

@@ -1287,7 +1353,12 @@ impl AuthManager {
            tracing::error!("Failed to refresh token: {}", err);
            return Some(auth);
        }
-        self.auth_cached()
+        let auth = self.auth_cached()?;
+        if let Err(err) = auth.initialize_runtime(self.chatgpt_base_url.clone()).await {


AuthManager::auth() loads the cached AgentIdentity record and then returns None if initialize_runtime() fails. That makes valid pre-registered identity material indistinguishable from no auth whenever task registration has a transient network/TLS/proxy/backend failure or the task state is rejected. I wonder if we should keep the cached identity/account metadata visible and surface a distinct runtime-init/header error for request paths instead of flattening this into signed-out state.

adrian-openai · 2026-04-22T04:22:17Z

+        timestamp,
+    };
+
+    let response = reqwest::Client::builder()


By using this bare reqwest::Client with only a timeout, this startup-critical call misses the standard Codex client behavior used by ordinary backend traffic, including custom CA handling, default originator/user-agent headers, sandbox proxy policy, and future centralized transport behavior. I think we should use an injected/prepared client or move the HTTP call into codex-login so task registration uses the same transport path as other first-party backend calls.

Changing this!

efrazer-oai force-pushed the dev/efrazer/agent-identity-minimal-auth branch from 5259e6a to 375d41a Compare April 21, 2026 03:08

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from 1e23097 to 97f8580 Compare April 21, 2026 03:29

efrazer-oai changed the title ~~refactor: add explicit agent identity auth mode~~ Add explicit AgentIdentity auth mode Apr 21, 2026

efrazer-oai changed the base branch from dev/efrazer/agent-identity-minimal-auth to dev/efrazer/agent-identity-crate April 21, 2026 03:29

This was referenced Apr 21, 2026

refactor: simplify agent identity auth #18758

Closed

fix: fully revert agent identity runtime wiring #18757

Merged

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from 117d4ac to b647fd7 Compare April 21, 2026 04:11

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from e8525b0 to 742bf2d Compare April 21, 2026 04:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from b647fd7 to 5acde03 Compare April 21, 2026 04:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 742bf2d to 86413e2 Compare April 21, 2026 05:24

efrazer-oai mentioned this pull request Apr 21, 2026

refactor: route Codex auth through AuthProvider #18811

Merged

efrazer-oai assigned pakrym-oai, shijie-oai and adrian-openai Apr 21, 2026

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 86413e2 to 0b61c82 Compare April 21, 2026 05:50

efrazer-oai marked this pull request as ready for review April 21, 2026 05:50

efrazer-oai requested a review from a team as a April 21, 2026 05:50

efrazer-oai force-pushed the dev/efrazer/agent-identity-crate branch from 5acde03 to 342ad35 Compare April 21, 2026 05:53

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0b61c82 to 52e547c Compare April 21, 2026 05:53

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs

efrazer-oai marked this pull request as draft April 21, 2026 07:13

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from b718d3e to b23a44f Compare April 21, 2026 07:44

efrazer-oai marked this pull request as ready for review April 21, 2026 08:01

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread codex-rs/login/src/auth/manager.rs

Comment thread codex-rs/login/src/auth/manager.rs Outdated

efrazer-oai requested review from pakrym-oai and shijie-oai April 21, 2026 15:32

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 0f90a02 to 8bca584 Compare April 21, 2026 21:36

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from 5f85536 to 52fc527 Compare April 21, 2026 21:36

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai mentioned this pull request Apr 21, 2026

feat: load AgentIdentity from JWT login/env #18904

Merged

pakrym-oai reviewed Apr 21, 2026

View reviewed changes

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch 2 times, most recently from 9679412 to c9e8046 Compare April 21, 2026 23:47

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from 52fc527 to f68e579 Compare April 22, 2026 01:10

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from c9e8046 to 31ac76b Compare April 22, 2026 01:10

efrazer-oai force-pushed the dev/efrazer/agent-identity-lib branch from f68e579 to d593930 Compare April 22, 2026 01:12

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 31ac76b to 9360a3a Compare April 22, 2026 01:13

github-actions Bot mentioned this pull request Apr 22, 2026

📊 AI CLI 工具社区动态日报 2026-04-22 gsscsd/big_model_radar#225

Open

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from 9360a3a to ce246ec Compare April 22, 2026 01:19

pakrym-oai approved these changes Apr 22, 2026

View reviewed changes

Base automatically changed from dev/efrazer/agent-identity-lib to main April 22, 2026 02:57

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from ce246ec to cb93ab0 Compare April 22, 2026 03:32

adrian-openai reviewed Apr 22, 2026

View reviewed changes

efrazer-oai added 3 commits April 21, 2026 22:00

feat: add agent identity auth mode

a1f5281

fix: plumb ChatGPT backend URL into auth manager

872e54d

refactor: remove redundant agent key serde rename

316a875

efrazer-oai force-pushed the dev/efrazer/agent-identity-auth-runtime branch from cb93ab0 to 316a875 Compare April 22, 2026 05:00

efrazer-oai merged commit 69c8913 into main Apr 22, 2026
28 checks passed

efrazer-oai deleted the dev/efrazer/agent-identity-auth-runtime branch April 22, 2026 05:33

github-actions Bot locked and limited conversation to collaborators Apr 22, 2026

Conversation

efrazer-oai commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Design Decisions

Stack

Testing

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

efrazer-oai commented Apr 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adrian-openai left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

efrazer-oai commented Apr 21, 2026 •

edited

Loading