feat: implement managed Bedrock logout by celia-oai · Pull Request #31325 · openai/codex

celia-oai · 2026-07-07T00:29:13Z

Why

account/logout normally removes Codex's primary stored authentication. That behavior needs an ownership check when Amazon Bedrock is active:

A Codex-managed Bedrock API key is primary CodexAuth state, so logout should remove it through the normal auth lifecycle.
AWS credential-chain authentication is managed outside Codex. In that case, logout must be a no-op so it does not delete an unrelated stored OpenAI or ChatGPT login that happens to be masked by the active Bedrock provider.

Managed Bedrock login also persists model_provider = "amazon-bedrock". Logout should undo that selection only if it is still the user-level value, without overwriting a provider change made before or concurrently with logout.

What changed

Detect Codex-managed Bedrock auth from the cached primary CodexAuth::BedrockApiKey value.
Route managed Bedrock credentials through the existing AuthManager::logout_with_revoke path.
Treat logout as a no-op when Bedrock is active through the external AWS credential chain, preserving both primary Codex auth and provider configuration.
Add a version-guarded ConfigManager::clear_user_value_if_matches operation and use it to remove the user-level model_provider only while it remains "amazon-bedrock".
Reload configuration after cleanup and report account updates from the resulting primary auth state.
Document the ownership-specific logout behavior in the app-server API reference.
Add focused coverage for conditional config cleanup, managed logout, AWS-managed no-op behavior, unrelated auth/config preservation, and logout without the experimental login capability.

Validation

just test -p codex-app-server -E 'test(/suite::v2::account/)' — 40 passed
Real end-to-end logout using cargo run -p codex-app-server-test-client -- --codex-bin ./target/debug/codex test-logout: account/logout returned successfully, account/updated reported authMode: null and planType: null, ~/.codex/auth.json was cleared, and the persisted model_provider = "amazon-bedrock" setting was removed from ~/.codex/config.toml.

Stack

feat: add managed Bedrock login API #31327 Managed Bedrock experimental API — base: main
feat: add managed Amazon Bedrock login #31326 Managed Bedrock login — base: codex/managed-bedrock-api
feat: implement managed Bedrock logout #31325 Managed Bedrock logout — base: codex/managed-bedrock-login-v2

celia-oai · 2026-07-09T00:47:08Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cb27132d0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15994f2071

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-09T23:37:17Z

        }

+        if managed_bedrock_auth {
+            clear_user_model_provider_if_bedrock(&self.config_manager).await?;


Make Bedrock config cleanup best-effort

When managed Bedrock auth is cached and config.toml becomes invalid after startup, logout_with_revoke() has already deleted auth.json before this cleanup reloads config via clear_user_value_if_matches; that error makes account/logout return a JSON-RPC error and skip account/updated even though the credential was removed. The fresh evidence is this post-removal cleanup call, so make provider cleanup best-effort (as with version conflicts) or run it before destructive auth removal.

AGENTS.md reference: AGENTS.md:L102-L110

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-09T23:37:17Z

+        if config.model_provider.is_amazon_bedrock() && !managed_bedrock_auth {
+            return Err(invalid_request(
+                "cannot log out while Amazon Bedrock is using AWS-managed credentials; manage those credentials through AWS or switch model providers before logging out Codex authentication",
+            ));
+        }


Cancel pending logins before rejecting Bedrock logout

When a ChatGPT browser/device-code login is pending and the current config resolves to Amazon Bedrock with AWS-managed credentials, this early return runs before the existing active_login cancellation block. That leaves the pending login alive after the user asked to log out, so its callback/poll can still complete later and persist ChatGPT auth plus success notifications; cancel the active login before this provider guard or explicitly cancel on this error path.

AGENTS.md reference: AGENTS.md:L102-L110

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-07-09T23:37:17Z

+            .load_thread_agnostic_config()
+            .await
+            .map_err(|err| ConfigManagerError::io("failed to load configuration", err))?;
+        let Some(user_layer) = layers.get_active_user_layer() else {


Clear Bedrock provider from the layer that set it

When logout runs with profile-v2 selected after managed Bedrock login wrote model_provider = "amazon-bedrock" to the base user config, this only inspects the active profile overlay. If that profile does not set model_provider, cleanup no-ops after the Bedrock API key has been deleted, so the effective config still selects Amazon Bedrock and subsequent account/read/model requests see AWS-managed Bedrock instead of returning to the default provider; clear the matching user layer (or effective user value) rather than only the active layer.

AGENTS.md reference: AGENTS.md:L102-L110

Useful? React with 👍 / 👎.

## Why App-server clients can report whether Amazon Bedrock is using AWS-managed credentials or a Codex-managed API key, but they do not have a matching API for creating the managed login. This PR defines that experimental wire contract independently from its implementation. Managed Bedrock API keys are already a primary `CodexAuth` mode. The API therefore describes a normal Codex login that replaces the current stored auth rather than introducing provider-scoped credential storage. ## What changed - Add the experimental `amazonBedrock` variant to `account/login/start`. - Accept an API key and AWS region and return a matching discriminated response. - Gate the request behind the app-server `experimentalApi` capability. - Regenerate the JSON and TypeScript protocol schemas. - Document the login contract, notifications, primary-auth replacement semantics, restart boundary, and non-transactional durable writes. ## Impact This PR defines the API shape but does not implement login behavior. The next PR adds validation, persistence through the existing Codex auth lifecycle, provider selection, and notifications. ## Validation - `just test -p codex-app-server-protocol` ## Stack 1. **#31327 Managed Bedrock experimental API** — base: `main` 2. #31326 Managed Bedrock login — base: `codex/managed-bedrock-api` 3. #31325 Managed Bedrock logout — base: `codex/managed-bedrock-login-v2`

This was referenced Jul 7, 2026

[codex] Scope managed Bedrock auth cache by provider #31324

Closed

feat: add managed Amazon Bedrock login #31326

Closed

feat: add managed Bedrock login API #31327

Merged

celia-oai force-pushed the codex/managed-bedrock-login-v2 branch from 4e95e46 to fc7cbe0 Compare July 7, 2026 19:17

celia-oai force-pushed the codex/managed-bedrock-logout branch from c0be3ad to c9d1ab6 Compare July 7, 2026 19:17

celia-oai force-pushed the codex/managed-bedrock-login-v2 branch from fc7cbe0 to fa240d8 Compare July 8, 2026 00:16

celia-oai force-pushed the codex/managed-bedrock-logout branch 2 times, most recently from ff533e5 to 99691ca Compare July 8, 2026 22:43

celia-oai changed the title ~~[codex] Implement managed Bedrock logout~~ feat: Implement managed Bedrock logout Jul 8, 2026

celia-oai changed the title ~~feat: Implement managed Bedrock logout~~ [codex] Implement managed Bedrock logout Jul 8, 2026

celia-oai changed the title ~~[codex] Implement managed Bedrock logout~~ feat: implement managed Bedrock logout Jul 8, 2026

celia-oai force-pushed the codex/managed-bedrock-login-v2 branch from 677ef6f to 6702939 Compare July 8, 2026 23:49

celia-oai force-pushed the codex/managed-bedrock-logout branch from 4b27932 to 3df78d4 Compare July 8, 2026 23:49

celia-oai force-pushed the codex/managed-bedrock-login-v2 branch from 6702939 to 01f9bf1 Compare July 9, 2026 00:33

celia-oai force-pushed the codex/managed-bedrock-logout branch from 3df78d4 to cb27132 Compare July 9, 2026 00:42

chatgpt-codex-connector Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread codex-rs/app-server/src/request_processors/account_processor.rs

Comment thread codex-rs/app-server/src/request_processors/account_processor.rs Outdated

Comment thread codex-rs/app-server/src/request_processors/account_processor.rs Outdated

celia-oai force-pushed the codex/managed-bedrock-logout branch 2 times, most recently from f63bc0c to 634ab59 Compare July 9, 2026 22:52

celia-oai marked this pull request as ready for review July 9, 2026 23:32

celia-oai requested a review from pakrym-oai July 9, 2026 23:35

chatgpt-codex-connector Bot reviewed Jul 9, 2026

View reviewed changes

celia-oai force-pushed the codex/managed-bedrock-login-v2 branch from f554c58 to c31ae26 Compare July 10, 2026 00:06

celia-oai added 6 commits July 9, 2026 17:07

app-server: add managed Bedrock logout

9f6bee5

Simplify managed Bedrock provider cleanup

20d4ae6

changes

af9874e

app-server: reload config after Bedrock logout

742f86f

app-server-test-client: add logout command

c758d88

app-server: migrate Bedrock logout tests to builder

ed835a1

celia-oai added 4 commits July 9, 2026 17:07

app-server: keep logout working after config reload errors

7391f65

app-server: reject AWS-managed Bedrock logout

63ac6b8

app-server: tolerate Bedrock logout config conflicts

cef7631

docs: simplify Bedrock logout guidance

b8bf56b

celia-oai force-pushed the codex/managed-bedrock-logout branch from d2029a1 to b8bf56b Compare July 10, 2026 00:07

celia-oai closed this Jul 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: implement managed Bedrock logout#31325

feat: implement managed Bedrock logout#31325
celia-oai wants to merge 10 commits into
codex/managed-bedrock-login-v2from
codex/managed-bedrock-logout

celia-oai commented Jul 7, 2026 •

edited

Loading

Uh oh!

celia-oai commented Jul 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

celia-oai commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Validation

Stack

Uh oh!

celia-oai commented Jul 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

celia-oai commented Jul 7, 2026 •

edited

Loading