Ruslan Nigmatullin 2210190435 Add opt-in WebSocket authentication to exec-server (#47601) ...

## What changed

Expose the shared `--ws-auth` options on `codex exec-server` for direct WebSocket listeners. Support capability tokens configured by token file or SHA-256 digest, and signed JWT bearer tokens. Validate `Authorization: Bearer TOKEN` before each WebSocket upgrade, rejecting missing or invalid credentials with HTTP 401 when authentication is enabled.

Reject listener authentication with stdio, `--remote`, or `forward`. Document the options and connection-time authentication behavior.

## Testing

Add CLI integration tests for all three credential configurations, unauthorized upgrade rejection, authenticated RPC initialization and reconnects, invalid configuration, and incompatible transports.

GitOrigin-RevId: 941fbd3d43e732c910d29b6f8137077b7c332835

2026-09-23 17:56:46 +00:00

..

e2e_benches

bench: add codex help e2e macrobenchmark (#31295)

2026-07-09 17:23:44 -07:00

src

Add opt-in WebSocket authentication to exec-server (#47601)

2026-09-23 17:56:46 +00:00

tests

Add opt-in WebSocket authentication to exec-server (#47601)

2026-09-23 17:56:46 +00:00

BUILD.bazel

Isolate Bazel build commit metadata from Rust compilation inputs (#43304)

2026-09-06 23:49:46 +00:00

build.rs

Add WebRTC media transport to realtime TUI (#17058)

2026-04-08 10:26:55 -07:00

Cargo.toml

Add opt-in WebSocket authentication to exec-server (#47601)

2026-09-23 17:56:46 +00:00