extract models manager and related ownership from core (#16508)

## Summary
- split `models-manager` out of `core` and add `ModelsManagerConfig`
plus `Config::to_models_manager_config()` so model metadata paths stop
depending on `core::Config`
- move login-owned/auth-owned code out of `core` into `codex-login`,
move model provider config into `codex-model-provider-info`, move API
bridge mapping into `codex-api`, move protocol-owned types/impls into
`codex-protocol`, and move response debug helpers into a dedicated
`response-debug-context` crate
- move feedback tag emission into `codex-feedback`, relocate tests to
the crates that now own the code, and keep broad temporary re-exports so
this PR avoids a giant import-only rewrite

## Major moves and decisions
- created `codex-models-manager` as the owner for model
cache/catalog/config/model info logic, including the new
`ModelsManagerConfig` struct
- created `codex-model-provider-info` as the owner for provider config
parsing/defaults and kept temporary `codex-login`/`codex-core`
re-exports for old import paths
- moved `api_bridge` error mapping + `CoreAuthProvider` into
`codex-api`, while `codex-login::api_bridge` temporarily re-exports
those symbols and keeps the `auth_provider_from_auth` wrapper
- moved `auth_env_telemetry` and `provider_auth` ownership to
`codex-login`
- moved `CodexErr` ownership to `codex-protocol::error`, plus
`StreamOutput`, `bytes_to_string_smart`, and network policy helpers to
protocol-owned modules
- created `codex-response-debug-context` for
`extract_response_debug_context`, `telemetry_transport_error_message`,
and related response-debug plumbing instead of leaving that behavior in
`core`
- moved `FeedbackRequestTags`, `emit_feedback_request_tags`, and
`emit_feedback_request_tags_with_auth_env` to `codex-feedback`
- deferred removal of temporary re-exports and the mechanical import
rewrites to a stacked follow-up PR so this PR stays reviewable

## Test moves
- moved auth refresh coverage from `core/tests/suite/auth_refresh.rs` to
`login/tests/suite/auth_refresh.rs`
- moved text encoding coverage from
`core/tests/suite/text_encoding_fix.rs` to
`protocol/src/exec_output_tests.rs`
- moved model info override coverage from
`core/tests/suite/model_info_overrides.rs` to
`models-manager/src/model_info_overrides_tests.rs`

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/login/src/api_bridge.rs

@@ -0,0 +1,38 @@
+use codex_model_provider_info::ModelProviderInfo;
+
+pub use codex_api::api_bridge::CoreAuthProvider;
+pub use codex_api::api_bridge::map_api_error;
+
+use crate::CodexAuth;
+
+pub fn auth_provider_from_auth(
+    auth: Option<CodexAuth>,
+    provider: &ModelProviderInfo,
+) -> codex_protocol::error::Result<CoreAuthProvider> {
+    if let Some(api_key) = provider.api_key()? {
+        return Ok(CoreAuthProvider {
+            token: Some(api_key),
+            account_id: None,
+        });
+    }
+
+    if let Some(token) = provider.experimental_bearer_token.clone() {
+        return Ok(CoreAuthProvider {
+            token: Some(token),
+            account_id: None,
+        });
+    }
+
+    if let Some(auth) = auth {
+        let token = auth.get_token()?;
+        Ok(CoreAuthProvider {
+            token: Some(token),
+            account_id: auth.get_account_id(),
+        })
+    } else {
+        Ok(CoreAuthProvider {
+            token: None,
+            account_id: None,
+        })
+    }
+}

codex-rs/login/src/auth/auth_tests.rs

@@ -2,9 +2,9 @@ use super::*;
 use crate::auth::storage::FileAuthStorage;
 use crate::auth::storage::get_auth_file;
 use crate::token_data::IdTokenInfo;
-use crate::token_data::KnownPlan as InternalKnownPlan;
-use crate::token_data::PlanType as InternalPlanType;
 use codex_protocol::account::PlanType as AccountPlanType;
+use codex_protocol::auth::KnownPlan as InternalKnownPlan;
+use codex_protocol::auth::PlanType as InternalPlanType;
 
 use base64::Engine;
 use codex_protocol::config_types::ForcedLoginMethod;

codex-rs/login/src/auth/error.rs

@@ -1,25 +1,2 @@
-use thiserror::Error;
-
-#[derive(Debug, Clone, PartialEq, Eq, Error)]
-#[error("{message}")]
-pub struct RefreshTokenFailedError {
-    pub reason: RefreshTokenFailedReason,
-    pub message: String,
-}
-
-impl RefreshTokenFailedError {
-    pub fn new(reason: RefreshTokenFailedReason, message: impl Into<String>) -> Self {
-        Self {
-            reason,
-            message: message.into(),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum RefreshTokenFailedReason {
-    Expired,
-    Exhausted,
-    Revoked,
-    Other,
-}
+pub use codex_protocol::auth::RefreshTokenFailedError;
+pub use codex_protocol::auth::RefreshTokenFailedReason;

codex-rs/login/src/auth/manager.rs

@@ -19,21 +19,21 @@ use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::ModelProviderAuthInfo;
 
 use super::external_bearer::BearerTokenRefresher;
-use crate::auth::error::RefreshTokenFailedError;
-use crate::auth::error::RefreshTokenFailedReason;
 pub use crate::auth::storage::AuthCredentialsStoreMode;
 pub use crate::auth::storage::AuthDotJson;
 use crate::auth::storage::AuthStorageBackend;
 use crate::auth::storage::create_auth_storage;
 use crate::auth::util::try_parse_error_message;
 use crate::default_client::create_client;
-use crate::token_data::KnownPlan as InternalKnownPlan;
-use crate::token_data::PlanType as InternalPlanType;
 use crate::token_data::TokenData;
 use crate::token_data::parse_chatgpt_jwt_claims;
 use crate::token_data::parse_jwt_expiration;
 use codex_client::CodexHttpClient;
 use codex_protocol::account::PlanType as AccountPlanType;
+use codex_protocol::auth::KnownPlan as InternalKnownPlan;
+use codex_protocol::auth::PlanType as InternalPlanType;
+use codex_protocol::auth::RefreshTokenFailedError;
+use codex_protocol::auth::RefreshTokenFailedReason;
 use serde_json::Value;
 use thiserror::Error;
 

codex-rs/login/src/auth_env_telemetry.rs

@@ -0,0 +1,88 @@
+use codex_otel::AuthEnvTelemetryMetadata;
+
+use crate::CODEX_API_KEY_ENV_VAR;
+use crate::ModelProviderInfo;
+use crate::OPENAI_API_KEY_ENV_VAR;
+use crate::REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR;
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AuthEnvTelemetry {
+    pub openai_api_key_env_present: bool,
+    pub codex_api_key_env_present: bool,
+    pub codex_api_key_env_enabled: bool,
+    pub provider_env_key_name: Option<String>,
+    pub provider_env_key_present: Option<bool>,
+    pub refresh_token_url_override_present: bool,
+}
+
+impl AuthEnvTelemetry {
+    pub fn to_otel_metadata(&self) -> AuthEnvTelemetryMetadata {
+        AuthEnvTelemetryMetadata {
+            openai_api_key_env_present: self.openai_api_key_env_present,
+            codex_api_key_env_present: self.codex_api_key_env_present,
+            codex_api_key_env_enabled: self.codex_api_key_env_enabled,
+            provider_env_key_name: self.provider_env_key_name.clone(),
+            provider_env_key_present: self.provider_env_key_present,
+            refresh_token_url_override_present: self.refresh_token_url_override_present,
+        }
+    }
+}
+
+pub fn collect_auth_env_telemetry(
+    provider: &ModelProviderInfo,
+    codex_api_key_env_enabled: bool,
+) -> AuthEnvTelemetry {
+    AuthEnvTelemetry {
+        openai_api_key_env_present: env_var_present(OPENAI_API_KEY_ENV_VAR),
+        codex_api_key_env_present: env_var_present(CODEX_API_KEY_ENV_VAR),
+        codex_api_key_env_enabled,
+        provider_env_key_name: provider.env_key.as_ref().map(|_| "configured".to_string()),
+        provider_env_key_present: provider.env_key.as_deref().map(env_var_present),
+        refresh_token_url_override_present: env_var_present(REFRESH_TOKEN_URL_OVERRIDE_ENV_VAR),
+    }
+}
+
+fn env_var_present(name: &str) -> bool {
+    match std::env::var(name) {
+        Ok(value) => !value.trim().is_empty(),
+        Err(std::env::VarError::NotUnicode(_)) => true,
+        Err(std::env::VarError::NotPresent) => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::WireApi;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn collect_auth_env_telemetry_buckets_provider_env_key_name() {
+        let provider = ModelProviderInfo {
+            name: "Custom".to_string(),
+            base_url: None,
+            env_key: Some("sk-should-not-leak".to_string()),
+            env_key_instructions: None,
+            experimental_bearer_token: None,
+            auth: None,
+            wire_api: WireApi::Responses,
+            query_params: None,
+            http_headers: None,
+            env_http_headers: None,
+            request_max_retries: None,
+            stream_max_retries: None,
+            stream_idle_timeout_ms: None,
+            websocket_connect_timeout_ms: None,
+            requires_openai_auth: false,
+            supports_websockets: false,
+        };
+
+        let telemetry =
+            collect_auth_env_telemetry(&provider, /*codex_api_key_env_enabled*/ false);
+
+        assert_eq!(
+            telemetry.provider_env_key_name,
+            Some("configured".to_string())
+        );
+    }
+}

codex-rs/login/src/lib.rs

@@ -1,4 +1,7 @@
+pub mod api_bridge;
 pub mod auth;
+pub mod auth_env_telemetry;
+pub mod provider_auth;
 pub mod token_data;
 
 mod device_code_auth;
@@ -15,6 +18,9 @@ pub use server::ServerOptions;
 pub use server::ShutdownHandle;
 pub use server::run_login_server;
 
+pub use api_bridge::CoreAuthProvider;
+pub use api_bridge::auth_provider_from_auth;
+pub use api_bridge::map_api_error;
 pub use auth::AuthConfig;
 pub use auth::AuthCredentialsStoreMode;
 pub use auth::AuthDotJson;
@@ -38,5 +44,19 @@ pub use auth::login_with_api_key;
 pub use auth::logout;
 pub use auth::read_openai_api_key_from_env;
 pub use auth::save_auth;
+pub use auth_env_telemetry::AuthEnvTelemetry;
+pub use auth_env_telemetry::collect_auth_env_telemetry;
 pub use codex_app_server_protocol::AuthMode;
+pub use codex_model_provider_info as model_provider_info;
+pub use codex_model_provider_info::DEFAULT_LMSTUDIO_PORT;
+pub use codex_model_provider_info::DEFAULT_OLLAMA_PORT;
+pub use codex_model_provider_info::LMSTUDIO_OSS_PROVIDER_ID;
+pub use codex_model_provider_info::ModelProviderInfo;
+pub use codex_model_provider_info::OLLAMA_OSS_PROVIDER_ID;
+pub use codex_model_provider_info::OPENAI_PROVIDER_ID;
+pub use codex_model_provider_info::WireApi;
+pub use codex_model_provider_info::built_in_model_providers;
+pub use codex_model_provider_info::create_oss_provider_with_base_url;
+pub use provider_auth::auth_manager_for_provider;
+pub use provider_auth::required_auth_manager_for_provider;
 pub use token_data::TokenData;

codex-rs/login/src/provider_auth.rs

@@ -0,0 +1,31 @@
+use std::sync::Arc;
+
+use crate::AuthManager;
+use crate::ModelProviderInfo;
+
+/// Returns the provider-scoped auth manager when this provider uses command-backed auth.
+///
+/// Providers without custom auth continue using the caller-supplied base manager.
+pub fn auth_manager_for_provider(
+    auth_manager: Option<Arc<AuthManager>>,
+    provider: &ModelProviderInfo,
+) -> Option<Arc<AuthManager>> {
+    match provider.auth.clone() {
+        Some(config) => Some(AuthManager::external_bearer_only(config)),
+        None => auth_manager,
+    }
+}
+
+/// Returns an auth manager for request paths that always require authentication.
+///
+/// Providers with command-backed auth get a bearer-only manager; otherwise the caller's manager
+/// is reused unchanged.
+pub fn required_auth_manager_for_provider(
+    auth_manager: Arc<AuthManager>,
+    provider: &ModelProviderInfo,
+) -> Arc<AuthManager> {
+    match provider.auth.clone() {
+        Some(config) => AuthManager::external_bearer_only(config),
+        None => auth_manager,
+    }
+}

codex-rs/login/src/token_data.rs

@@ -1,6 +1,7 @@
 use base64::Engine;
 use chrono::DateTime;
 use chrono::Utc;
+use codex_protocol::auth::PlanType;
 use serde::Deserialize;
 use serde::Serialize;
 use serde::de::DeserializeOwned;
@@ -61,95 +62,6 @@ impl IdTokenInfo {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(untagged)]
-pub enum PlanType {
-    Known(KnownPlan),
-    Unknown(String),
-}
-
-impl PlanType {
-    pub fn from_raw_value(raw: &str) -> Self {
-        match raw.to_ascii_lowercase().as_str() {
-            "free" => Self::Known(KnownPlan::Free),
-            "go" => Self::Known(KnownPlan::Go),
-            "plus" => Self::Known(KnownPlan::Plus),
-            "pro" => Self::Known(KnownPlan::Pro),
-            "team" => Self::Known(KnownPlan::Team),
-            "self_serve_business_usage_based" => {
-                Self::Known(KnownPlan::SelfServeBusinessUsageBased)
-            }
-            "business" => Self::Known(KnownPlan::Business),
-            "enterprise_cbp_usage_based" => Self::Known(KnownPlan::EnterpriseCbpUsageBased),
-            "enterprise" | "hc" => Self::Known(KnownPlan::Enterprise),
-            "education" | "edu" => Self::Known(KnownPlan::Edu),
-            _ => Self::Unknown(raw.to_string()),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "lowercase")]
-pub enum KnownPlan {
-    Free,
-    Go,
-    Plus,
-    Pro,
-    Team,
-    #[serde(rename = "self_serve_business_usage_based")]
-    SelfServeBusinessUsageBased,
-    Business,
-    #[serde(rename = "enterprise_cbp_usage_based")]
-    EnterpriseCbpUsageBased,
-    #[serde(alias = "hc")]
-    Enterprise,
-    Edu,
-}
-
-impl KnownPlan {
-    pub fn display_name(self) -> &'static str {
-        match self {
-            Self::Free => "Free",
-            Self::Go => "Go",
-            Self::Plus => "Plus",
-            Self::Pro => "Pro",
-            Self::Team => "Team",
-            Self::SelfServeBusinessUsageBased => "Self Serve Business Usage Based",
-            Self::Business => "Business",
-            Self::EnterpriseCbpUsageBased => "Enterprise CBP Usage Based",
-            Self::Enterprise => "Enterprise",
-            Self::Edu => "Edu",
-        }
-    }
-
-    pub fn raw_value(self) -> &'static str {
-        match self {
-            Self::Free => "free",
-            Self::Go => "go",
-            Self::Plus => "plus",
-            Self::Pro => "pro",
-            Self::Team => "team",
-            Self::SelfServeBusinessUsageBased => "self_serve_business_usage_based",
-            Self::Business => "business",
-            Self::EnterpriseCbpUsageBased => "enterprise_cbp_usage_based",
-            Self::Enterprise => "enterprise",
-            Self::Edu => "edu",
-        }
-    }
-
-    pub fn is_workspace_account(self) -> bool {
-        matches!(
-            self,
-            Self::Team
-                | Self::SelfServeBusinessUsageBased
-                | Self::Business
-                | Self::EnterpriseCbpUsageBased
-                | Self::Enterprise
-                | Self::Edu
-        )
-    }
-}
-
 #[derive(Deserialize)]
 struct IdClaims {
     #[serde(default)]

codex-rs/login/src/token_data_tests.rs

@@ -1,6 +1,7 @@
 use super::*;
 use chrono::TimeZone;
 use chrono::Utc;
+use codex_protocol::auth::KnownPlan;
 use pretty_assertions::assert_eq;
 use serde::Serialize;