Eric Traut 1ff39b6fa8 Wire remote app-server auth through the client (#14853) ...

For app-server websocket auth, support the two server-side mechanisms
from
PR #14847:

- `--ws-auth capability-token --ws-token-file /abs/path`
- `--ws-auth signed-bearer-token --ws-shared-secret-file /abs/path`
  with optional `--ws-issuer`, `--ws-audience`, and
  `--ws-max-clock-skew-seconds`

On the client side, add interactive remote support via:

- `--remote ws://host:port` or `--remote wss://host:port`
- `--remote-auth-token-env <ENV_VAR>`

Codex reads the bearer token from the named environment variable and
sends it
as `Authorization: Bearer <token>` during the websocket handshake.
Remote auth
tokens are only allowed for `wss://` URLs or loopback `ws://` URLs.

Testing:
- tested both auth methods manually to confirm connection success and
rejection for both auth types

2026-03-25 22:17:03 -06:00

..

src

Wire remote app-server auth through the client (#14853)

2026-03-25 22:17:03 -06:00

tests

feat: simplify DB further (#13771)

2026-03-07 03:48:36 -08:00

BUILD.bazel

feat: add support for building with Bazel (#8875)

2026-01-09 11:09:43 -08:00

Cargo.toml

Extract landlock helpers into codex-sandboxing (#15592)

2026-03-23 20:56:15 -07:00