core: support dynamic auth tokens for model providers

[bolinfest]

Summary

Fixes #15189.

Custom model providers that set requires_openai_auth = false could only use static credentials via env_key or experimental_bearer_token. That is not enough for providers that mint short-lived bearer tokens, because Codex had no way to resolve a provider token dynamically, cache it briefly in memory, and refresh it after a 401.

This PR adds command-backed provider auth on top of #16277 and #16275. The key design point is that request paths still do not get a second auth abstraction: provider traffic uses a provider-scoped AuthManager, so both token resolution and 401 recovery continue to flow through AuthManager.auth() and UnauthorizedRecovery.

Example usage

model_provider = "corp-openai"

[model_providers.corp-openai]
name = "Corp OpenAI"
base_url = "https://gateway.example.com/openai"
requires_openai_auth = false

[model_providers.corp-openai.auth]
command = "gcloud"
args = ["auth", "print-access-token"]
timeout_ms = 5000
refresh_interval_ms = 300000

The command contract is intentionally small:

• write the bearer token to stdout
• exit 0
• any leading or trailing whitespace is trimmed before the token is used

What changed

• add ModelProviderAuthInfo and model_providers.<id>.auth to the config model and generated schema
• validate that command-backed provider auth is mutually exclusive with env_key, experimental_bearer_token, and requires_openai_auth
• add core/src/provider_auth.rs, which implements a command-backed ExternalAuthRefresher with in-memory TTL caching, timeout handling, and cwd support
• wrap the request-facing AuthManager instances used by ModelClient and ModelsManager when a provider configures auth, so provider requests use the external bearer source without affecting the base session auth manager
• let /models refresh online for command-auth providers and retry once after 401 through UnauthorizedRecovery
• route realtime auth through the model client's scoped auth manager so websocket connects use the same provider token source as normal requests
• keep auth.cwd available as an advanced escape hatch and include it in the generated config schema

Testing

• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth cargo check -p codex-core
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core provider_auth::tests::
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core provider_auth_command_supplies_bearer_token
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core provider_auth_command_refreshes_after_401
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core refresh_available_models_refreshes_provider_auth_after_401
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core test_deserialize_provider_auth_config_defaults
• CARGO_TARGET_DIR=/tmp/codex-core-provider-auth-tests cargo test -p codex-core rejects_provider_auth_with_env_key

Docs

• developers.openai.com/codex should document the new [model_providers.<id>.auth] block and the token-command contract

---

Stack created with Sapling. Best reviewed with ReviewStack.

• -> core: support dynamic auth tokens for model providers #16267
• auth: let AuthManager own external bearer auth #16275
• auth: generalize external auth tokens for bearer-only sources #16277

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be08ad0e4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Expose auth.cwd in schema or stop serializing it

ModelProviderAuthInfo marks cwd with #[schemars(skip)], but the type is still deserialized/serialized and ModelProviderAuthInfo uses additionalProperties: false in the generated schema. This creates a mismatch where valid runtime config (or config emitted by serialization that includes auth.cwd) is treated as invalid by schema-based tooling and editors, which can block users from persisting or validating working provider auth configs.

Useful? React with 👍 / 👎.

[bolinfest]

Closing in favor of #16288.