feat: add managed Amazon Bedrock login

[celia-oai]

Why

The app-server protocol can describe a Codex-managed Amazon Bedrock login, but clients still need the server-side implementation to onboard users without manipulating auth.json or config.toml themselves.

Because a managed Bedrock API key is primary CodexAuth state, login should use the existing auth persistence and reload lifecycle. This keeps credential replacement, account reporting, and login notifications consistent with the other supported login methods instead of introducing a separate provider-specific credential cache.

What changed

• Implement the experimental amazonBedrock branch of account/login/start.
• Trim and validate the API key and region, using the model provider's shared list of Bedrock Mantle regions.
• Reject login when external ChatGPT auth is active or ChatGPT login is forced, while continuing to allow the existing API-login policy.
• Cancel any pending ChatGPT login, persist the Bedrock key as primary Codex auth, and set the user-level model_provider to amazon-bedrock without overriding a command-line provider selection.
• Reload the shared AuthManager, and reload config for account reads so account/read and auth-status responses immediately reflect the selected Bedrock provider.
• Emit the standard account/login/completed and account/updated notifications.
• Add integration coverage for capability gating, validation, auth replacement, policy enforcement, provider overrides, persistence, notifications, and active Bedrock account reporting.

Operational notes

Managed Bedrock login replaces the currently stored primary Codex login. Existing loaded sessions retain their provider selection, so clients should restart the app-server before sending further model requests. This will be fixed in a followup.

Validation

• just test -p codex-app-server -E 'test(/suite::v2::account/)' — 40 passed
• Manual end-to-end test against Amazon Bedrock in us-east-2: ran target/debug/codex-app-server-test-client with test-login --amazon-bedrock, observed successful account/login/start, account/login/completed, and account/updated responses, confirmed config.toml selected amazon-bedrock, confirmed auth.json persisted only the managed Bedrock API-key auth and region with no OpenAI API key, and successfully completed a model request through a fresh target/debug/codex process. real events log:

> {
>   "id": "0a464d89-409f-49ab-9a4d-6979ebb26bc2",
>   "method": "account/login/start",
>   "params": {
>     "apiKey": "<redacted>",
>     "region": "us-east-2",
>     "type": "amazonBedrock"
>   },
>   "trace": {
>     "traceparent": "00-00b281562d823eca87c80aa12d40a3c0-b801b56390c177e9-01",
>     "tracestate": "dd=s:2;t.oai_ft:1"
>   }
> }
< {
<   "method": "remoteControl/status/changed",
<   "params": {
<     "environmentId": null,
<     "installationId": "55297f82-9485-4db0-8792-f903c50ab831",
<     "serverName": "com-92114",
<     "status": "disabled"
<   }
< }
< {
<   "id": "0a464d89-409f-49ab-9a4d-6979ebb26bc2",
<   "result": {
<     "type": "amazonBedrock"
<   }
< }
< account/login/start response: AmazonBedrock
< {
<   "method": "account/login/completed",
<   "params": {
<     "error": null,
<     "loginId": null,
<     "success": true
<   }
< }
< account/login/completed notification: AccountLoginCompletedNotification { login_id: None, success: true, error: None }
< {
<   "method": "account/updated",
<   "params": {
<     "authMode": "bedrockApiKey",
<     "planType": null
<   }
< }

Stack

1. feat: add managed Bedrock login API #31327 — managed Bedrock experimental API (base: main)
2. feat: add managed Amazon Bedrock login #31326 — managed Bedrock login (base: codex/managed-bedrock-api)
3. feat: implement managed Bedrock logout #31325 — managed Bedrock logout (base: codex/managed-bedrock-login-v2)

[celia-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a228c77c7b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a74bbdc5b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".