mirror of
https://github.com/openai/codex.git
synced 2026-05-17 01:32:32 +00:00
fed0a8f4fa
## Summary This PR lets programmatic AgentIdentity users provide one token through either stdin login or environment auth. `codex login --with-agent-identity` reads an Agent Identity JWT from stdin, validates that it has the required claims, and stores that token as the `agent_identity` value in `auth.json`. The file format is token-only; the decoded account and key fields are runtime state, not hand-authored auth.json fields. The Agent Identity JWT claim shape and decoder live in `codex-agent-identity`; `codex-login` only owns env/storage precedence and conversion into `CodexAuth::AgentIdentity`. When env auth is enabled, `CODEX_AGENT_IDENTITY` can provide the same JWT without writing auth state to disk. `CODEX_API_KEY` still wins if both env vars are set. Reference old stack: https://github.com/openai/codex/pull/17387/changes Reference JWT/env stack: https://github.com/openai/codex/pull/18176 ## Stack 1. https://github.com/openai/codex/pull/18757: full revert 2. https://github.com/openai/codex/pull/18871: isolated Agent Identity crate 3. https://github.com/openai/codex/pull/18785: explicit AgentIdentity auth mode and startup task allocation 4. https://github.com/openai/codex/pull/18811: migrate Codex backend auth callsites through AuthProvider 5. This PR: accept AgentIdentity JWTs through login/env ## Testing Tests: targeted login and Agent Identity crate tests, CLI checks, scoped formatter/linter cleanup, and CI. --------- Co-authored-by: Shijie Rao <shijie.rao@openai.com>
76 lines
2.7 KiB
Rust
76 lines
2.7 KiB
Rust
pub(crate) mod debug_sandbox;
|
|
mod exit_status;
|
|
pub(crate) mod login;
|
|
|
|
use clap::Parser;
|
|
use codex_utils_absolute_path::AbsolutePathBuf;
|
|
use codex_utils_cli::CliConfigOverrides;
|
|
|
|
pub use debug_sandbox::run_command_under_landlock;
|
|
pub use debug_sandbox::run_command_under_seatbelt;
|
|
pub use debug_sandbox::run_command_under_windows;
|
|
pub use login::read_agent_identity_from_stdin;
|
|
pub use login::read_api_key_from_stdin;
|
|
pub use login::run_login_status;
|
|
pub use login::run_login_with_agent_identity;
|
|
pub use login::run_login_with_api_key;
|
|
pub use login::run_login_with_chatgpt;
|
|
pub use login::run_login_with_device_code;
|
|
pub use login::run_login_with_device_code_fallback_to_browser;
|
|
pub use login::run_logout;
|
|
|
|
#[derive(Debug, Parser)]
|
|
pub struct SeatbeltCommand {
|
|
/// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR)
|
|
#[arg(long = "full-auto", default_value_t = false)]
|
|
pub full_auto: bool,
|
|
|
|
/// Allow the sandboxed command to bind/connect AF_UNIX sockets rooted at this path. Relative paths are resolved against the current directory. Repeat to allow multiple paths.
|
|
#[arg(long = "allow-unix-socket", value_parser = parse_allow_unix_socket_path)]
|
|
pub allow_unix_sockets: Vec<AbsolutePathBuf>,
|
|
|
|
/// While the command runs, capture macOS sandbox denials via `log stream` and print them after exit
|
|
#[arg(long = "log-denials", default_value_t = false)]
|
|
pub log_denials: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under seatbelt.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|
|
|
|
fn parse_allow_unix_socket_path(raw: &str) -> Result<AbsolutePathBuf, String> {
|
|
AbsolutePathBuf::relative_to_current_dir(raw)
|
|
.map_err(|err| format!("invalid path {raw}: {err}"))
|
|
}
|
|
|
|
#[derive(Debug, Parser)]
|
|
pub struct LandlockCommand {
|
|
/// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR)
|
|
#[arg(long = "full-auto", default_value_t = false)]
|
|
pub full_auto: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under the Linux sandbox.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|
|
|
|
#[derive(Debug, Parser)]
|
|
pub struct WindowsCommand {
|
|
/// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR)
|
|
#[arg(long = "full-auto", default_value_t = false)]
|
|
pub full_auto: bool,
|
|
|
|
#[clap(skip)]
|
|
pub config_overrides: CliConfigOverrides,
|
|
|
|
/// Full command args to run under Windows restricted token sandbox.
|
|
#[arg(trailing_var_arg = true)]
|
|
pub command: Vec<String>,
|
|
}
|