From c04c3aff511cbd1c5bffaa2b944b3d7de896ce7a Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 23 Aug 2026 16:03:24 +0200 Subject: [PATCH] Collapse redundant auth re-export crate --- Cargo.lock | 10 +------ Cargo.toml | 1 - epiphany-openai-auth-spine/Cargo.toml | 12 -------- epiphany-openai-auth-spine/src/lib.rs | 41 -------------------------- epiphany-openai-codex-spine/Cargo.toml | 2 +- epiphany-openai-codex-spine/src/lib.rs | 10 +++---- notes/codex-auth-spine-inventory.md | 35 ++++++++++------------ 7 files changed, 22 insertions(+), 89 deletions(-) delete mode 100644 epiphany-openai-auth-spine/Cargo.toml delete mode 100644 epiphany-openai-auth-spine/src/lib.rs diff --git a/Cargo.lock b/Cargo.lock index 726a10bf..58378a96 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2029,22 +2029,14 @@ dependencies = [ "serde", ] -[[package]] -name = "epiphany-openai-auth-spine" -version = "0.1.0" -dependencies = [ - "codex-login", - "serde_json", -] - [[package]] name = "epiphany-openai-codex-spine" version = "0.1.0" dependencies = [ "anyhow", "codex-client", + "codex-login", "epiphany-openai-adapter", - "epiphany-openai-auth-spine", "futures", "http", "serde", diff --git a/Cargo.toml b/Cargo.toml index dea29dca..f61c8266 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,7 +3,6 @@ members = [ "epiphany-core", "epiphany-model-adapter", "epiphany-openai-adapter", - "epiphany-openai-auth-spine", "epiphany-openai-codex-spine", "epiphany-openai-runtime", "epiphany-release-construction", diff --git a/epiphany-openai-auth-spine/Cargo.toml b/epiphany-openai-auth-spine/Cargo.toml deleted file mode 100644 index 38201f0c..00000000 --- a/epiphany-openai-auth-spine/Cargo.toml +++ /dev/null @@ -1,12 +0,0 @@ -[package] -name = "epiphany-openai-auth-spine" -version = "0.1.0" -edition = "2024" - -[lib] -name = "epiphany_openai_auth_spine" -path = "src/lib.rs" - -[dependencies] -codex-login = { path = "../vendor/codex/codex-rs/login" } -serde_json = "1" diff --git a/epiphany-openai-auth-spine/src/lib.rs b/epiphany-openai-auth-spine/src/lib.rs deleted file mode 100644 index dc54d076..00000000 --- a/epiphany-openai-auth-spine/src/lib.rs +++ /dev/null @@ -1,41 +0,0 @@ -//! Epiphany's named boundary to the retained Codex-compatible auth organ. -//! -//! This crate intentionally does not clone Codex login behavior. Subscription auth, -//! token refresh, keyring/file storage, originator headers, and model-provider auth -//! identity remain owned by vendored `codex-login` so Epiphany stays a modified -//! Codex-derived backend instead of a clean-room impersonator. -//! -//! Keep this export surface deliberately smaller than `codex-login`. The vendored -//! crate remains intact for clean upstream merges; this bridge exposes only what -//! Epiphany's subscription transport currently consumes. - -pub use codex_login::AuthCredentialsStoreMode; -pub use codex_login::AuthManager; -pub use codex_login::AuthMode; -pub use codex_login::CodexAuth; -pub use codex_login::default_client::build_reqwest_client; - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn api_key_auth_exposes_openai_token_through_codex_login() { - let auth = CodexAuth::from_api_key("sk-test"); - assert!(auth.is_api_key_auth()); - assert_eq!(auth.get_token().unwrap(), "sk-test"); - assert!(!auth.uses_codex_backend()); - } - - #[test] - fn parses_codex_auth_store_modes() { - assert_eq!( - serde_json::from_str::(r#""auto""#).unwrap(), - AuthCredentialsStoreMode::Auto - ); - assert_eq!( - serde_json::from_str::(r#""keyring""#).unwrap(), - AuthCredentialsStoreMode::Keyring - ); - } -} diff --git a/epiphany-openai-codex-spine/Cargo.toml b/epiphany-openai-codex-spine/Cargo.toml index 1025729b..a8708abd 100644 --- a/epiphany-openai-codex-spine/Cargo.toml +++ b/epiphany-openai-codex-spine/Cargo.toml @@ -12,8 +12,8 @@ path = "src/lib.rs" [dependencies] anyhow = "1" codex-client = { path = "../vendor/codex/codex-rs/codex-client" } +codex-login = { path = "../vendor/codex/codex-rs/login" } epiphany-openai-adapter = { path = "../epiphany-openai-adapter" } -epiphany-openai-auth-spine = { path = "../epiphany-openai-auth-spine" } futures = "0.3" http = "1" serde = "1" diff --git a/epiphany-openai-codex-spine/src/lib.rs b/epiphany-openai-codex-spine/src/lib.rs index c56b5bc2..435be7ba 100644 --- a/epiphany-openai-codex-spine/src/lib.rs +++ b/epiphany-openai-codex-spine/src/lib.rs @@ -18,11 +18,11 @@ use epiphany_openai_adapter::EpiphanyOpenAiStreamEvent; use epiphany_openai_adapter::EpiphanyOpenAiStreamPayload; use epiphany_openai_adapter::EpiphanyOpenAiWireDialect; use epiphany_openai_adapter::OPENAI_ADAPTER_STATUS_SCHEMA_ID; -use epiphany_openai_auth_spine::AuthCredentialsStoreMode; -use epiphany_openai_auth_spine::AuthManager; -use epiphany_openai_auth_spine::AuthMode; -use epiphany_openai_auth_spine::CodexAuth; -use epiphany_openai_auth_spine::build_reqwest_client; +use codex_login::AuthCredentialsStoreMode; +use codex_login::AuthManager; +use codex_login::AuthMode; +use codex_login::CodexAuth; +use codex_login::default_client::build_reqwest_client; use serde::Deserialize; use serde::Serialize; use serde_json::Value; diff --git a/notes/codex-auth-spine-inventory.md b/notes/codex-auth-spine-inventory.md index 255c60dc..2b281e5a 100644 --- a/notes/codex-auth-spine-inventory.md +++ b/notes/codex-auth-spine-inventory.md @@ -45,9 +45,9 @@ clean-room client pretending to be Codex. ### Transformations -- `epiphany-openai-auth-spine` is now a thin Epiphany-named boundary over - vendored `codex-login`. It re-exports Codex auth types and default-client - construction instead of cloning env/file/keyring/token-refresh behavior. +- `epiphany-openai-codex-spine` imports the narrow auth types and default-client + construction it needs directly from vendored `codex-login`, without cloning + env/file/keyring/token-refresh behavior or wrapping re-exports in another crate. Subscription credential authority remains in retained Codex-compatible machinery; Epiphany owns only the typed status/request/event/runtime surfaces around it. @@ -72,10 +72,8 @@ clean-room client pretending to be Codex. ## Keep -- `epiphany-openai-auth-spine`: keep only as a typed Epiphany wrapper/status - surface around Codex-compatible auth. It should not pretend to be the legal - authority for subscription credentials by cloning the auth behavior outside - vendored Codex. +- `codex-login`: keep as the legal authority for Codex-compatible subscription + credentials. The Epiphany transport imports only its required auth surface. - `codex-client`: keep only as a plain HTTP/SSE transport helper for now. It does not own Epiphany request shape, model policy, stream semantics, or durable state. @@ -116,8 +114,8 @@ EpiphanyOpenAIModelTransport -> emit typed stream events / receipts ``` -The adapter may depend on `epiphany-openai-auth-spine`, retained Codex auth -machinery, and `codex-client` while the reliquary survives. It must not depend +The adapter may depend on retained `codex-login` auth machinery and +`codex-client` while the reliquary survives. It must not depend on `codex-app-server`, `codex_message_processor`, plugin/app/skill/marketplace modules, broad Codex provider/request construction, or Epiphany state ownership. @@ -146,15 +144,14 @@ pure document crate depend on Codex. The transport wrapper is now also in that spine. It maps typed `EpiphanyOpenAiModelRequest` documents into a local serializable Responses -request body, resolves credentials through `epiphany-openai-auth-spine`, chooses the +request body, resolves credentials through vendored `codex-login`, chooses the ChatGPT/OpenAI base URL from auth mode, opens an HTTP Responses SSE stream with `codex-client`, and converts stream deltas/completion into typed `EpiphanyOpenAiStreamEvent` / `EpiphanyOpenAiModelReceipt` documents. It no longer imports Codex `ResponsesApiRequest`, `ResponsesClient`, `ResponseEvent`, provider config, model-provider, or broad app-server -workflow. It intentionally reaches vendored `codex-login` only through -`epiphany-openai-auth-spine` so auth identity remains Codex-compatible without -letting Codex own Epiphany request/state shape. +workflow. Its narrow direct imports preserve Codex-compatible auth identity +without letting Codex own Epiphany request/state shape. The CultNet paperwork is now public too. `schemas/cultnet/` contains typed schemas for OpenAI adapter status, model request, stream event, and terminal @@ -195,13 +192,11 @@ application. `codex-core` re-exports the contract only as a compatibility alias, and `CodexThread` now calls native state-update functions around its remaining revision check, persistence validation, and rollout/session writeback. -The credential extraction overcut has been corrected. The native clone of -Codex file/keyring/auto auth, env API key handling, ChatGPT token refresh, -account metadata parsing, and header-client setup was deleted from -`epiphany-openai-auth-spine`; the crate now depends on vendored `codex-login` -and carries the Codex workspace `tokio-tungstenite` / `tungstenite` patches -needed for standalone builds. The remaining simplification target is not auth -purity; it is the next Epiphany-in-vendor evacuation surface. +The credential extraction overcut has been corrected. Codex file/keyring/auto +auth, env API key handling, ChatGPT token refresh, account metadata parsing, +and header-client setup remain in vendored `codex-login`. The redundant +Epiphany re-export crate is gone; the root workspace carries the Codex +`tokio-tungstenite` / `tungstenite` patches required for standalone builds. The point is ownership: Epiphany calls a model adapter; it does not live inside the Codex host brain.