Add files using upload-large-folder tool

codex-rs/cloud-config/src/backend.rs

@@ -0,0 +1,136 @@
+use codex_backend_client::Client as BackendClient;
+use codex_backend_client::ConfigBundleResponse;
+use codex_backend_client::DeliveredTomlFragment;
+use codex_config::CloudConfigBundle;
+use codex_config::CloudConfigFragment;
+use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudRequirementsFragment;
+use codex_config::CloudRequirementsTomlBundle;
+use codex_http_client::HttpClientFactory;
+use codex_login::CodexAuth;
+use std::future::Future;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum RetryableFailureKind {
+    Request { status_code: Option<u16> },
+}
+
+impl RetryableFailureKind {
+    pub(crate) fn status_code(self) -> Option<u16> {
+        match self {
+            Self::Request { status_code } => status_code,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) enum BundleRequestError {
+    Retryable(RetryableFailureKind),
+    Unauthorized {
+        status_code: Option<u16>,
+        message: String,
+    },
+}
+
+/// Retrieves one cloud config bundle from the backend.
+///
+/// Implementations should return the backend-selected bundle exactly as delivered and leave
+/// validation, caching, and config/requirements parsing decisions to the service layer.
+pub(crate) trait BundleClient: Send + Sync {
+    fn get_bundle(
+        &self,
+        auth: &CodexAuth,
+    ) -> impl Future<Output = Result<CloudConfigBundle, BundleRequestError>> + Send;
+}
+
+pub(crate) struct BackendBundleClient {
+    base_url: String,
+    http_client_factory: HttpClientFactory,
+}
+
+impl BackendBundleClient {
+    pub(crate) fn new(base_url: String, http_client_factory: HttpClientFactory) -> Self {
+        Self {
+            base_url,
+            http_client_factory,
+        }
+    }
+}
+
+impl BundleClient for BackendBundleClient {
+    async fn get_bundle(&self, auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        let client = BackendClient::from_auth(
+            self.base_url.clone(),
+            auth,
+            self.http_client_factory.clone(),
+        );
+
+        let response = client
+            .get_config_bundle()
+            .await
+            .inspect_err(|err| {
+                tracing::warn!(error = %err, "Failed to fetch cloud config bundle");
+            })
+            .map_err(|err| {
+                let status_code = err.status().map(|status| status.as_u16());
+                if err.is_unauthorized() {
+                    BundleRequestError::Unauthorized {
+                        status_code,
+                        message: err.to_string(),
+                    }
+                } else {
+                    BundleRequestError::Retryable(RetryableFailureKind::Request { status_code })
+                }
+            })?;
+
+        Ok(bundle_from_response(response))
+    }
+}
+
+pub(crate) fn bundle_from_response(response: ConfigBundleResponse) -> CloudConfigBundle {
+    let config_toml = response
+        .config_toml
+        .flatten()
+        .map(|config_toml| *config_toml)
+        .and_then(|config_toml| config_toml.enterprise_managed.flatten())
+        .unwrap_or_default()
+        .into_iter()
+        .map(config_fragment_from_delivered)
+        .collect();
+    let requirements_toml = response
+        .requirements_toml
+        .flatten()
+        .map(|requirements_toml| *requirements_toml)
+        .and_then(|requirements_toml| requirements_toml.enterprise_managed.flatten())
+        .unwrap_or_default()
+        .into_iter()
+        .map(requirements_fragment_from_delivered)
+        .collect();
+
+    CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle {
+            enterprise_managed: config_toml,
+        },
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: requirements_toml,
+        },
+    }
+}
+
+fn config_fragment_from_delivered(fragment: DeliveredTomlFragment) -> CloudConfigFragment {
+    CloudConfigFragment {
+        id: fragment.id,
+        name: fragment.name,
+        contents: fragment.contents,
+    }
+}
+
+fn requirements_fragment_from_delivered(
+    fragment: DeliveredTomlFragment,
+) -> CloudRequirementsFragment {
+    CloudRequirementsFragment {
+        id: fragment.id,
+        name: fragment.name,
+        contents: fragment.contents,
+    }
+}

codex-rs/cloud-config/src/bundle_loader.rs

@@ -0,0 +1,132 @@
+use crate::backend::BackendBundleClient;
+use crate::backend::BundleClient;
+use crate::service::CLOUD_CONFIG_BUNDLE_TIMEOUT;
+use crate::service::CloudConfigBundleService;
+use codex_config::CloudConfigBundleLoader;
+use codex_http_client::HttpClientFactory;
+use codex_login::AuthConfig;
+use codex_login::AuthManager;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::sync::Mutex;
+use std::sync::OnceLock;
+use tokio::task::AbortHandle;
+use tokio::task::JoinHandle;
+
+fn refresher_task_slot() -> &'static Mutex<Option<AbortHandle>> {
+    static REFRESHER_TASK: OnceLock<Mutex<Option<AbortHandle>>> = OnceLock::new();
+    REFRESHER_TASK.get_or_init(|| Mutex::new(None))
+}
+
+pub(crate) fn replace_refresh_task(slot: &Mutex<Option<AbortHandle>>, next: AbortHandle) {
+    let mut guard = slot.lock().unwrap_or_else(|err| {
+        tracing::warn!("cloud config bundle refresher task slot was poisoned");
+        err.into_inner()
+    });
+    if let Some(previous) = guard.replace(next) {
+        previous.abort();
+    }
+}
+
+struct CloudConfigBundleLoaderLifetime<C> {
+    service: Arc<CloudConfigBundleService<C>>,
+    refresh_task: JoinHandle<()>,
+}
+
+impl<C> Drop for CloudConfigBundleLoaderLifetime<C> {
+    fn drop(&mut self) {
+        self.refresh_task.abort();
+    }
+}
+
+pub fn cloud_config_bundle_loader(
+    auth_manager: Arc<AuthManager>,
+    chatgpt_base_url: String,
+    codex_home: PathBuf,
+    http_client_factory: HttpClientFactory,
+) -> CloudConfigBundleLoader {
+    let service = CloudConfigBundleService::new(
+        auth_manager,
+        Arc::new(BackendBundleClient::new(
+            chatgpt_base_url,
+            http_client_factory,
+        )),
+        codex_home,
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (loader, refresh_task) = cloud_config_bundle_loader_for_service(service);
+    replace_refresh_task(refresher_task_slot(), refresh_task);
+    loader
+}
+
+pub(crate) fn cloud_config_bundle_loader_for_service<C>(
+    service: CloudConfigBundleService<C>,
+) -> (CloudConfigBundleLoader, AbortHandle)
+where
+    C: BundleClient + 'static,
+{
+    let service = Arc::new(service);
+    let background_service = Arc::clone(&service);
+    let refresh_task = tokio::spawn(async move {
+        let _ = background_service.get_latest().await;
+        background_service.refresh_cache_in_background().await;
+    });
+    let abort_handle = refresh_task.abort_handle();
+    let lifetime = Arc::new(CloudConfigBundleLoaderLifetime {
+        service,
+        refresh_task,
+    });
+
+    let loader = CloudConfigBundleLoader::from_getter(move || {
+        let lifetime = Arc::clone(&lifetime);
+        async move { lifetime.service.get_latest().await }
+    });
+    (loader, abort_handle)
+}
+
+pub async fn cloud_config_bundle_loader_for_storage(
+    auth_config: AuthConfig,
+    enable_codex_api_key_env: bool,
+) -> std::io::Result<CloudConfigBundleLoader> {
+    let service =
+        cloud_config_bundle_service_for_storage(auth_config, enable_codex_api_key_env).await?;
+    let (loader, refresh_task) = cloud_config_bundle_loader_for_service(service);
+    replace_refresh_task(refresher_task_slot(), refresh_task);
+    Ok(loader)
+}
+
+/// Fetches directly from the network on each load, without reading or writing
+/// the disk cache or starting a background refresher.
+pub async fn cloud_config_bundle_loader_for_storage_without_cache(
+    auth_config: AuthConfig,
+    enable_codex_api_key_env: bool,
+) -> std::io::Result<CloudConfigBundleLoader> {
+    let service = Arc::new(
+        cloud_config_bundle_service_for_storage(auth_config, enable_codex_api_key_env)
+            .await?
+            .without_cache(),
+    );
+    Ok(CloudConfigBundleLoader::from_getter(move || {
+        let service = Arc::clone(&service);
+        async move { service.load_startup_bundle_with_timeout().await }
+    }))
+}
+
+async fn cloud_config_bundle_service_for_storage(
+    auth_config: AuthConfig,
+    enable_codex_api_key_env: bool,
+) -> std::io::Result<CloudConfigBundleService<BackendBundleClient>> {
+    let auth_manager =
+        AuthManager::shared_from_auth_config(auth_config.clone(), enable_codex_api_key_env).await?;
+    Ok(CloudConfigBundleService::new(
+        auth_manager,
+        Arc::new(BackendBundleClient::new(
+            auth_config
+                .chatgpt_base_url
+                .unwrap_or_else(|| "https://chatgpt.com/backend-api/".to_string()),
+            auth_config.auth_route_config.http_client_factory().clone(),
+        )),
+        auth_config.codex_home,
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    ))
+}

codex-rs/cloud-config/src/cache.rs

@@ -0,0 +1,253 @@
+//! Signed on-disk cache for cloud config bundles.
+//!
+//! The cache is scoped to the authenticated ChatGPT user and account, has a
+//! short TTL, and is HMAC-signed so malformed or edited files fail closed.
+
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
+use chrono::DateTime;
+use chrono::Duration as ChronoDuration;
+use chrono::Utc;
+use codex_config::AbsolutePathBuf;
+use codex_config::CloudConfigBundle;
+use hmac::Hmac;
+use hmac::Mac;
+use serde::Deserialize;
+use serde::Serialize;
+use sha2::Sha256;
+use std::path::Path;
+use std::time::Duration;
+use thiserror::Error;
+use tokio::fs;
+
+const CLOUD_CONFIG_BUNDLE_CACHE_VERSION: u32 = 1;
+pub(super) const CLOUD_CONFIG_BUNDLE_CACHE_FILENAME: &str = "cloud-config-bundle-cache.json";
+const CLOUD_CONFIG_BUNDLE_CACHE_TTL: Duration = Duration::from_secs(60 * 60);
+const CLOUD_CONFIG_BUNDLE_CACHE_WRITE_HMAC_KEY: &[u8] =
+    b"codex-cloud-config-bundle-cache-v1-6160ae70-bcfd-4ca8-a99b-40f73b3b072e";
+const CLOUD_CONFIG_BUNDLE_CACHE_READ_HMAC_KEYS: &[&[u8]] =
+    &[CLOUD_CONFIG_BUNDLE_CACHE_WRITE_HMAC_KEY];
+
+type HmacSha256 = Hmac<Sha256>;
+
+#[derive(Clone)]
+pub(super) struct CloudConfigBundleCache {
+    path: AbsolutePathBuf,
+}
+
+impl CloudConfigBundleCache {
+    pub(super) fn new(codex_home: AbsolutePathBuf) -> Self {
+        Self {
+            path: codex_home.join(CLOUD_CONFIG_BUNDLE_CACHE_FILENAME),
+        }
+    }
+
+    pub(super) fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub(super) async fn load(
+        &self,
+        chatgpt_user_id: Option<&str>,
+        account_id: Option<&str>,
+    ) -> Result<CloudConfigBundleCacheSignedPayload, CacheLoadStatus> {
+        let (Some(chatgpt_user_id), Some(account_id)) = (chatgpt_user_id, account_id) else {
+            return Err(CacheLoadStatus::AuthIdentityIncomplete);
+        };
+
+        let bytes = match fs::read(&self.path).await {
+            Ok(bytes) => bytes,
+            Err(err) => {
+                if err.kind() != std::io::ErrorKind::NotFound {
+                    return Err(CacheLoadStatus::CacheReadFailed(err.to_string()));
+                }
+                return Err(CacheLoadStatus::CacheFileNotFound);
+            }
+        };
+
+        let cache_file: CloudConfigBundleCacheFile = match serde_json::from_slice(&bytes) {
+            Ok(cache_file) => cache_file,
+            Err(err) => {
+                return Err(CacheLoadStatus::CacheParseFailed(err.to_string()));
+            }
+        };
+        let payload_bytes = match cache_payload_bytes(&cache_file.signed_payload) {
+            Some(payload_bytes) => payload_bytes,
+            None => {
+                return Err(CacheLoadStatus::CacheParseFailed(
+                    "failed to serialize cache payload".to_string(),
+                ));
+            }
+        };
+        if !verify_cache_signature(&payload_bytes, &cache_file.signature) {
+            return Err(CacheLoadStatus::CacheSignatureInvalid);
+        }
+        if cache_file.signed_payload.version != CLOUD_CONFIG_BUNDLE_CACHE_VERSION {
+            return Err(CacheLoadStatus::CacheVersionUnsupported(
+                cache_file.signed_payload.version,
+            ));
+        }
+
+        let (Some(cached_chatgpt_user_id), Some(cached_account_id)) = (
+            cache_file.signed_payload.chatgpt_user_id.as_deref(),
+            cache_file.signed_payload.account_id.as_deref(),
+        ) else {
+            return Err(CacheLoadStatus::CacheIdentityIncomplete);
+        };
+
+        if cached_chatgpt_user_id != chatgpt_user_id || cached_account_id != account_id {
+            return Err(CacheLoadStatus::CacheIdentityMismatch);
+        }
+
+        if cache_file.signed_payload.expires_at <= Utc::now() {
+            return Err(CacheLoadStatus::CacheExpired);
+        }
+
+        Ok(cache_file.signed_payload)
+    }
+
+    pub(super) fn log_load_status(&self, status: &CacheLoadStatus) {
+        if matches!(status, CacheLoadStatus::CacheFileNotFound) {
+            return;
+        }
+
+        let warn = matches!(
+            status,
+            CacheLoadStatus::CacheReadFailed(_)
+                | CacheLoadStatus::CacheParseFailed(_)
+                | CacheLoadStatus::CacheSignatureInvalid
+        );
+
+        if warn {
+            tracing::warn!(path = %self.path.display(), "{status}");
+        } else {
+            tracing::info!(path = %self.path.display(), "{status}");
+        }
+    }
+
+    pub(super) async fn save(
+        &self,
+        chatgpt_user_id: Option<String>,
+        account_id: Option<String>,
+        bundle: CloudConfigBundle,
+    ) -> Result<(), CloudConfigBundleCacheError> {
+        let now = Utc::now();
+        let expires_at = now
+            .checked_add_signed(
+                ChronoDuration::from_std(CLOUD_CONFIG_BUNDLE_CACHE_TTL)
+                    .map_err(|_| CloudConfigBundleCacheError)?,
+            )
+            .ok_or(CloudConfigBundleCacheError)?;
+        let signed_payload = CloudConfigBundleCacheSignedPayload {
+            version: CLOUD_CONFIG_BUNDLE_CACHE_VERSION,
+            cached_at: now,
+            expires_at,
+            chatgpt_user_id,
+            account_id,
+            bundle,
+        };
+        let payload_bytes =
+            cache_payload_bytes(&signed_payload).ok_or(CloudConfigBundleCacheError)?;
+        let serialized = serde_json::to_vec_pretty(&CloudConfigBundleCacheFile {
+            signature: sign_cache_payload(&payload_bytes).ok_or(CloudConfigBundleCacheError)?,
+            signed_payload,
+        })
+        .map_err(|_| CloudConfigBundleCacheError)?;
+
+        if let Some(parent) = self.path.parent() {
+            fs::create_dir_all(parent)
+                .await
+                .map_err(|_| CloudConfigBundleCacheError)?;
+        }
+
+        fs::write(&self.path, serialized)
+            .await
+            .map_err(|_| CloudConfigBundleCacheError)?;
+        Ok(())
+    }
+}
+
+#[derive(Clone, Debug, Eq, Error, PartialEq)]
+pub(super) enum CacheLoadStatus {
+    #[error("Skipping cloud config bundle cache read because auth identity is incomplete.")]
+    AuthIdentityIncomplete,
+    #[error("Cloud config bundle cache file not found.")]
+    CacheFileNotFound,
+    #[error("Failed to read cloud config bundle cache: {0}.")]
+    CacheReadFailed(String),
+    #[error("Failed to parse cloud config bundle cache: {0}.")]
+    CacheParseFailed(String),
+    #[error("Cloud config bundle cache failed signature verification.")]
+    CacheSignatureInvalid,
+    #[error("Ignoring cloud config bundle cache because cached identity is incomplete.")]
+    CacheIdentityIncomplete,
+    #[error("Ignoring cloud config bundle cache for different auth identity.")]
+    CacheIdentityMismatch,
+    #[error("Ignoring cloud config bundle cache with unsupported version {0}.")]
+    CacheVersionUnsupported(u32),
+    #[error("Cloud config bundle cache expired.")]
+    CacheExpired,
+    #[error("Ignoring cloud config bundle cache because the cached bundle is invalid.")]
+    CacheInvalidBundle,
+}
+
+#[derive(Debug, Error)]
+#[error("failed to write cloud config bundle cache")]
+pub(super) struct CloudConfigBundleCacheError;
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub(super) struct CloudConfigBundleCacheFile {
+    pub(super) signed_payload: CloudConfigBundleCacheSignedPayload,
+    pub(super) signature: String,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub(super) struct CloudConfigBundleCacheSignedPayload {
+    pub(super) version: u32,
+    pub(super) cached_at: DateTime<Utc>,
+    pub(super) expires_at: DateTime<Utc>,
+    pub(super) chatgpt_user_id: Option<String>,
+    pub(super) account_id: Option<String>,
+    pub(super) bundle: CloudConfigBundle,
+}
+
+pub(super) fn cache_payload_bytes(
+    payload: &CloudConfigBundleCacheSignedPayload,
+) -> Option<Vec<u8>> {
+    serde_json::to_vec(&payload).ok()
+}
+
+pub(super) fn sign_cache_payload(payload_bytes: &[u8]) -> Option<String> {
+    let mut mac = HmacSha256::new_from_slice(CLOUD_CONFIG_BUNDLE_CACHE_WRITE_HMAC_KEY).ok()?;
+    mac.update(payload_bytes);
+    let signature = mac.finalize().into_bytes();
+    Some(BASE64_STANDARD.encode(signature))
+}
+
+pub(super) fn verify_cache_signature(payload_bytes: &[u8], signature: &str) -> bool {
+    let signature_bytes = match BASE64_STANDARD.decode(signature) {
+        Ok(signature_bytes) => signature_bytes,
+        Err(_) => return false,
+    };
+
+    CLOUD_CONFIG_BUNDLE_CACHE_READ_HMAC_KEYS
+        .iter()
+        .any(|key| verify_cache_signature_with_key(payload_bytes, &signature_bytes, key))
+}
+
+fn verify_cache_signature_with_key(
+    payload_bytes: &[u8],
+    signature_bytes: &[u8],
+    key: &[u8],
+) -> bool {
+    let mut mac = match HmacSha256::new_from_slice(key) {
+        Ok(mac) => mac,
+        Err(_) => return false,
+    };
+    mac.update(payload_bytes);
+    mac.verify_slice(signature_bytes).is_ok()
+}
+
+#[cfg(test)]
+#[path = "cache_tests.rs"]
+mod tests;

codex-rs/cloud-config/src/cache_tests.rs

@@ -0,0 +1,206 @@
+use super::*;
+use codex_config::AbsolutePathBuf;
+use codex_config::CloudConfigFragment;
+use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudRequirementsFragment;
+use codex_config::CloudRequirementsTomlBundle;
+use pretty_assertions::assert_eq;
+use std::path::Path;
+use tempfile::tempdir;
+
+fn test_bundle() -> CloudConfigBundle {
+    CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle {
+            enterprise_managed: vec![CloudConfigFragment {
+                id: "cfg_1".to_string(),
+                name: "Base config".to_string(),
+                contents: "model = \"gpt-5\"".to_string(),
+            }],
+        },
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: vec![CloudRequirementsFragment {
+                id: "req_1".to_string(),
+                name: "Base requirements".to_string(),
+                contents: "allowed_approval_policies = [\"never\"]".to_string(),
+            }],
+        },
+    }
+}
+
+fn signed_cache_file(
+    signed_payload: CloudConfigBundleCacheSignedPayload,
+) -> CloudConfigBundleCacheFile {
+    let payload_bytes = cache_payload_bytes(&signed_payload).expect("payload bytes");
+    CloudConfigBundleCacheFile {
+        signature: sign_cache_payload(&payload_bytes).expect("signature"),
+        signed_payload,
+    }
+}
+
+fn valid_signed_payload() -> CloudConfigBundleCacheSignedPayload {
+    let cached_at = Utc::now();
+    CloudConfigBundleCacheSignedPayload {
+        version: CLOUD_CONFIG_BUNDLE_CACHE_VERSION,
+        cached_at,
+        expires_at: cached_at + ChronoDuration::minutes(30),
+        chatgpt_user_id: Some("user-12345".to_string()),
+        account_id: Some("account-12345".to_string()),
+        bundle: test_bundle(),
+    }
+}
+
+fn write_cache_file(cache: &CloudConfigBundleCache, cache_file: &CloudConfigBundleCacheFile) {
+    std::fs::write(
+        cache.path(),
+        serde_json::to_vec_pretty(cache_file).expect("serialize cache"),
+    )
+    .expect("write cache");
+}
+
+fn create_test_cache(codex_home: &Path) -> CloudConfigBundleCache {
+    CloudConfigBundleCache::new(AbsolutePathBuf::resolve_path_against_base(codex_home, "/"))
+}
+
+#[tokio::test]
+async fn save_writes_signed_payload_and_loads_for_matching_identity() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let bundle = test_bundle();
+
+    cache
+        .save(
+            Some("user-12345".to_string()),
+            Some("account-12345".to_string()),
+            bundle.clone(),
+        )
+        .await
+        .expect("save cache");
+
+    let cache_file: CloudConfigBundleCacheFile =
+        serde_json::from_slice(&std::fs::read(cache.path()).expect("read cache"))
+            .expect("parse cache");
+    assert!(
+        cache_file.signed_payload.expires_at
+            <= cache_file.signed_payload.cached_at + ChronoDuration::minutes(60)
+    );
+    assert!(cache_file.signed_payload.expires_at > cache_file.signed_payload.cached_at);
+    assert_eq!(
+        cache_file,
+        signed_cache_file(CloudConfigBundleCacheSignedPayload {
+            version: CLOUD_CONFIG_BUNDLE_CACHE_VERSION,
+            cached_at: cache_file.signed_payload.cached_at,
+            expires_at: cache_file.signed_payload.expires_at,
+            chatgpt_user_id: Some("user-12345".to_string()),
+            account_id: Some("account-12345".to_string()),
+            bundle,
+        })
+    );
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Ok(cache_file.signed_payload)
+    );
+}
+
+#[tokio::test]
+async fn load_rejects_missing_request_identity_before_reading_cache_file() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+
+    assert_eq!(
+        cache
+            .load(/*chatgpt_user_id*/ None, Some("account-12345"))
+            .await,
+        Err(CacheLoadStatus::AuthIdentityIncomplete)
+    );
+    assert_eq!(
+        cache.load(Some("user-12345"), /*account_id*/ None).await,
+        Err(CacheLoadStatus::AuthIdentityIncomplete)
+    );
+}
+
+#[tokio::test]
+async fn load_reports_missing_and_malformed_cache_files() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheFileNotFound)
+    );
+
+    std::fs::write(cache.path(), "{").expect("write malformed cache");
+    assert!(matches!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheParseFailed(_))
+    ));
+}
+
+#[tokio::test]
+async fn load_rejects_tampered_payload() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let mut cache_file = signed_cache_file(valid_signed_payload());
+    cache_file
+        .signed_payload
+        .bundle
+        .requirements_toml
+        .enterprise_managed[0]
+        .contents = "allowed_approval_policies = [\"on-request\"]".to_string();
+    write_cache_file(&cache, &cache_file);
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheSignatureInvalid)
+    );
+}
+
+#[tokio::test]
+async fn load_rejects_cache_for_incomplete_or_different_identity() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let cache_file = signed_cache_file(valid_signed_payload());
+    write_cache_file(&cache, &cache_file);
+
+    assert_eq!(
+        cache.load(Some("user-99999"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheIdentityMismatch)
+    );
+
+    let mut signed_payload = valid_signed_payload();
+    signed_payload.chatgpt_user_id = None;
+    write_cache_file(&cache, &signed_cache_file(signed_payload));
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheIdentityIncomplete)
+    );
+}
+
+#[tokio::test]
+async fn load_rejects_expired_cache() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let mut signed_payload = valid_signed_payload();
+    signed_payload.expires_at = Utc::now() - ChronoDuration::seconds(1);
+    write_cache_file(&cache, &signed_cache_file(signed_payload));
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheExpired)
+    );
+}
+
+#[tokio::test]
+async fn load_rejects_unsupported_cache_version() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let mut signed_payload = valid_signed_payload();
+    signed_payload.version = 2;
+    write_cache_file(&cache, &signed_cache_file(signed_payload));
+
+    assert_eq!(
+        cache.load(Some("user-12345"), Some("account-12345")).await,
+        Err(CacheLoadStatus::CacheVersionUnsupported(2))
+    );
+}

codex-rs/cloud-config/src/lib.rs

@@ -0,0 +1,15 @@
+//! Cloud-hosted configuration data for Codex.
+//!
+//! This crate owns transport, caching, and refresh behavior for cloud-delivered
+//! config data. Parsing and composition remain in `codex-config`.
+
+mod backend;
+mod bundle_loader;
+mod cache;
+mod metrics;
+mod service;
+mod validation;
+
+pub use bundle_loader::cloud_config_bundle_loader;
+pub use bundle_loader::cloud_config_bundle_loader_for_storage;
+pub use bundle_loader::cloud_config_bundle_loader_for_storage_without_cache;

codex-rs/cloud-config/src/metrics.rs

@@ -0,0 +1,95 @@
+use codex_config::CloudConfigBundle;
+
+const CLOUD_CONFIG_BUNDLE_FETCH_ATTEMPT_METRIC: &str = "codex.cloud_config_bundle.fetch_attempt";
+const CLOUD_CONFIG_BUNDLE_FETCH_FINAL_METRIC: &str = "codex.cloud_config_bundle.fetch_final";
+const CLOUD_CONFIG_BUNDLE_LOAD_METRIC: &str = "codex.cloud_config_bundle.load";
+
+pub(crate) fn emit_fetch_attempt_metric(
+    trigger: &str,
+    attempt: usize,
+    outcome: &str,
+    status_code: Option<u16>,
+) {
+    let attempt_tag = attempt.to_string();
+    let status_code_tag = status_code_tag(status_code);
+    emit_metric(
+        CLOUD_CONFIG_BUNDLE_FETCH_ATTEMPT_METRIC,
+        vec![
+            ("trigger", trigger.to_string()),
+            ("attempt", attempt_tag),
+            ("outcome", outcome.to_string()),
+            ("status_code", status_code_tag),
+        ],
+    );
+}
+
+pub(crate) fn emit_fetch_final_metric(
+    trigger: &str,
+    outcome: &str,
+    reason: &str,
+    attempt_count: usize,
+    status_code: Option<u16>,
+    bundle: Option<&CloudConfigBundle>,
+) {
+    let attempt_count_tag = attempt_count.to_string();
+    let status_code_tag = status_code_tag(status_code);
+    emit_metric(
+        CLOUD_CONFIG_BUNDLE_FETCH_FINAL_METRIC,
+        vec![
+            ("trigger", trigger.to_string()),
+            ("outcome", outcome.to_string()),
+            ("reason", reason.to_string()),
+            ("attempt_count", attempt_count_tag),
+            ("status_code", status_code_tag),
+            ("bundle_shape", bundle_shape_tag(bundle)),
+        ],
+    );
+}
+
+pub(crate) fn emit_load_metric(trigger: &str, outcome: &str, bundle: Option<&CloudConfigBundle>) {
+    emit_metric(
+        CLOUD_CONFIG_BUNDLE_LOAD_METRIC,
+        vec![
+            ("trigger", trigger.to_string()),
+            ("outcome", outcome.to_string()),
+            ("bundle_shape", bundle_shape_tag(bundle)),
+        ],
+    );
+}
+
+pub(crate) fn bundle_shape_tag(bundle: Option<&CloudConfigBundle>) -> String {
+    let Some(bundle) = bundle else {
+        return "none".to_string();
+    };
+
+    let mut sources = Vec::new();
+    if !bundle.config_toml.enterprise_managed.is_empty() {
+        sources.push("enterprise_config");
+    }
+    if !bundle.requirements_toml.enterprise_managed.is_empty() {
+        sources.push("enterprise_requirements");
+    }
+
+    if sources.is_empty() {
+        "empty".to_string()
+    } else {
+        sources.sort_unstable();
+        sources.join(",")
+    }
+}
+
+fn status_code_tag(status_code: Option<u16>) -> String {
+    status_code
+        .map(|status_code| status_code.to_string())
+        .unwrap_or_else(|| "none".to_string())
+}
+
+fn emit_metric(metric_name: &str, tags: Vec<(&str, String)>) {
+    if let Some(metrics) = codex_otel::global() {
+        let tag_refs = tags
+            .iter()
+            .map(|(key, value)| (*key, value.as_str()))
+            .collect::<Vec<_>>();
+        let _ = metrics.counter(metric_name, /*inc*/ 1, &tag_refs);
+    }
+}

codex-rs/cloud-config/src/service.rs

@@ -0,0 +1,538 @@
+//! Cloud config bundle lifecycle orchestration.
+//!
+//! Startup loads a shared bundle from cache or backend, and background refresh
+//! updates both the on-disk cache and the bundle observed by future config loads.
+//! One-shot network loads can disable disk-cache reads and writes.
+
+use crate::backend::BundleClient;
+use crate::backend::BundleRequestError;
+use crate::backend::RetryableFailureKind;
+use crate::cache::CacheLoadStatus;
+use crate::cache::CloudConfigBundleCache;
+use crate::metrics::emit_fetch_attempt_metric;
+use crate::metrics::emit_fetch_final_metric;
+use crate::metrics::emit_load_metric;
+use crate::validation::validate_bundle;
+use codex_config::AbsolutePathBuf;
+use codex_config::CloudConfigBundle;
+use codex_config::CloudConfigBundleLoadError;
+use codex_config::CloudConfigBundleLoadErrorCode;
+use codex_core::util::backoff;
+use codex_login::AuthManager;
+use codex_login::CodexAuth;
+use codex_login::RefreshTokenError;
+use codex_login::UnauthorizedRecovery;
+use codex_protocol::account::PlanType;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Duration;
+use std::time::Instant;
+use tokio::sync::Mutex;
+use tokio::sync::OnceCell;
+use tokio::time::sleep;
+use tokio::time::timeout;
+
+pub(crate) const CLOUD_CONFIG_BUNDLE_TIMEOUT: Duration = Duration::from_secs(15);
+const CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS: usize = 5;
+const CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL: Duration = Duration::from_secs(15 * 60);
+const CLOUD_CONFIG_BUNDLE_TIMEOUT_RETRY_INTERVAL: Duration = Duration::from_secs(5);
+const CLOUD_CONFIG_BUNDLE_LOAD_FAILED_MESSAGE: &str =
+    "Failed to load cloud config bundle (workspace-managed policies).";
+const CLOUD_CONFIG_BUNDLE_AUTH_RECOVERY_FAILED_MESSAGE: &str = concat!(
+    "Your authentication session could not be refreshed automatically. ",
+    "Please log out and sign in again."
+);
+
+fn auth_identity(auth: &CodexAuth) -> (Option<String>, Option<String>) {
+    (auth.get_chatgpt_user_id(), auth.get_account_id())
+}
+
+fn cloud_config_eligible_auth(auth: &CodexAuth) -> bool {
+    let Some(plan_type) = auth.account_plan_type() else {
+        return false;
+    };
+    auth.uses_codex_backend()
+        && (plan_type.is_business_like()
+            || plan_type.is_education_like()
+            || plan_type == PlanType::Enterprise)
+}
+
+fn optional_bundle(bundle: CloudConfigBundle) -> Option<CloudConfigBundle> {
+    if bundle.is_empty() {
+        None
+    } else {
+        Some(bundle)
+    }
+}
+
+enum CachedBundleLookup {
+    Hit(Option<CloudConfigBundle>),
+    Miss,
+}
+
+enum UnauthorizedRecoveryAction {
+    RetrySameAttempt,
+    RetryNextAttempt,
+}
+
+pub(crate) struct CloudConfigBundleService<C> {
+    auth_manager: Arc<AuthManager>,
+    client: Arc<C>,
+    cache: CloudConfigBundleCache,
+    cache_enabled: bool,
+    codex_home: AbsolutePathBuf,
+    timeout: Duration,
+    latest_bundle: OnceCell<Mutex<Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError>>>,
+}
+
+impl<C> CloudConfigBundleService<C>
+where
+    C: BundleClient + 'static,
+{
+    pub(crate) fn new(
+        auth_manager: Arc<AuthManager>,
+        client: Arc<C>,
+        codex_home: PathBuf,
+        timeout: Duration,
+    ) -> Self {
+        let codex_home = AbsolutePathBuf::resolve_path_against_base(codex_home, "/");
+        Self {
+            auth_manager,
+            client,
+            cache: CloudConfigBundleCache::new(codex_home.clone()),
+            cache_enabled: true,
+            codex_home,
+            timeout,
+            latest_bundle: OnceCell::new(),
+        }
+    }
+
+    pub(crate) fn without_cache(mut self) -> Self {
+        self.cache_enabled = false;
+        self
+    }
+
+    pub(crate) async fn get_latest(
+        &self,
+    ) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        self.latest_bundle
+            .get_or_init(|| async { Mutex::new(self.load_startup_bundle_with_timeout().await) })
+            .await
+            .lock()
+            .await
+            .clone()
+    }
+
+    pub(crate) async fn load_startup_bundle_with_timeout(
+        &self,
+    ) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        let _timer =
+            codex_otel::start_global_timer("codex.cloud_config_bundle.fetch.duration_ms", &[]);
+        let started_at = Instant::now();
+        let load_result = timeout(self.timeout, self.load_startup_bundle())
+            .await
+            .inspect_err(|_| {
+                let message = format!(
+                    "Timed out waiting for cloud config bundle after {}s",
+                    self.timeout.as_secs()
+                );
+                tracing::error!("{message}");
+                emit_load_metric("startup", "error", /*bundle*/ None);
+            })
+            .map_err(|_| {
+                CloudConfigBundleLoadError::new(
+                    CloudConfigBundleLoadErrorCode::Timeout,
+                    /*status_code*/ None,
+                    format!(
+                        "timed out waiting for cloud config bundle after {}s",
+                        self.timeout.as_secs()
+                    ),
+                )
+            })?;
+
+        let result = match load_result {
+            Ok(result) => result,
+            Err(err) => {
+                emit_load_metric("startup", "error", /*bundle*/ None);
+                return Err(err);
+            }
+        };
+
+        match result.as_ref() {
+            Some(bundle) => {
+                tracing::info!(
+                    elapsed_ms = started_at.elapsed().as_millis(),
+                    config_fragments = bundle.config_toml.enterprise_managed.len(),
+                    requirements_fragments = bundle.requirements_toml.enterprise_managed.len(),
+                    "Cloud config bundle load completed"
+                );
+                emit_load_metric("startup", "success", Some(bundle));
+            }
+            None => {
+                tracing::info!(
+                    elapsed_ms = started_at.elapsed().as_millis(),
+                    "Cloud config bundle load completed (none)"
+                );
+                emit_load_metric("startup", "success", /*bundle*/ None);
+            }
+        }
+
+        Ok(result)
+    }
+
+    async fn load_startup_bundle(
+        &self,
+    ) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        let Some(auth) = self.auth_manager.auth().await else {
+            return Ok(None);
+        };
+        if !cloud_config_eligible_auth(&auth) {
+            return Ok(None);
+        }
+
+        if self.cache_enabled {
+            // Startup prefers a valid, identity-matched cache entry. The backend is
+            // only consulted on cache miss or invalid cache contents.
+            let (chatgpt_user_id, account_id) = auth_identity(&auth);
+            match self
+                .load_valid_cached_bundle(chatgpt_user_id.as_deref(), account_id.as_deref())
+                .await
+            {
+                CachedBundleLookup::Hit(bundle) => return Ok(bundle),
+                CachedBundleLookup::Miss => {}
+            }
+        }
+
+        self.fetch_remote_bundle_and_update_cache_with_retries(auth, "startup")
+            .await
+    }
+
+    async fn load_valid_cached_bundle(
+        &self,
+        chatgpt_user_id: Option<&str>,
+        account_id: Option<&str>,
+    ) -> CachedBundleLookup {
+        match self.cache.load(chatgpt_user_id, account_id).await {
+            Ok(signed_payload) => {
+                if let Err(err) = validate_bundle(&signed_payload.bundle, &self.codex_home) {
+                    tracing::warn!(
+                        path = %self.cache.path().display(),
+                        error = %err,
+                        "Ignoring invalid cached cloud config bundle"
+                    );
+                    self.cache
+                        .log_load_status(&CacheLoadStatus::CacheInvalidBundle);
+                    CachedBundleLookup::Miss
+                } else {
+                    tracing::info!(
+                        path = %self.cache.path().display(),
+                        "Using cached cloud config bundle"
+                    );
+                    CachedBundleLookup::Hit(optional_bundle(signed_payload.bundle))
+                }
+            }
+            Err(cache_load_status) => {
+                self.cache.log_load_status(&cache_load_status);
+                CachedBundleLookup::Miss
+            }
+        }
+    }
+
+    async fn fetch_remote_bundle_and_update_cache_with_retries(
+        &self,
+        mut auth: CodexAuth,
+        trigger: &'static str,
+    ) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        let mut attempt = 1;
+        let mut last_status_code: Option<u16> = None;
+        let mut auth_recovery = self.auth_manager.unauthorized_recovery();
+
+        while attempt <= CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS {
+            match self.client.get_bundle(&auth).await {
+                Ok(bundle) => {
+                    return self
+                        .validate_and_cache_remote_bundle(&auth, trigger, attempt, bundle)
+                        .await;
+                }
+                Err(BundleRequestError::Retryable(status)) => {
+                    last_status_code = status.status_code();
+                    if self
+                        .retry_after_request_failure(trigger, attempt, status)
+                        .await
+                    {
+                        attempt += 1;
+                        continue;
+                    }
+                }
+                Err(BundleRequestError::Unauthorized {
+                    status_code,
+                    message,
+                }) => {
+                    last_status_code = status_code;
+                    match self
+                        .handle_unauthorized(
+                            &mut auth,
+                            &mut auth_recovery,
+                            trigger,
+                            attempt,
+                            status_code,
+                            &message,
+                        )
+                        .await?
+                    {
+                        UnauthorizedRecoveryAction::RetrySameAttempt => continue,
+                        UnauthorizedRecoveryAction::RetryNextAttempt => {
+                            attempt += 1;
+                            continue;
+                        }
+                    }
+                }
+            }
+
+            break;
+        }
+
+        emit_fetch_final_metric(
+            trigger,
+            "error",
+            "request_retry_exhausted",
+            CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS,
+            last_status_code,
+            /*bundle*/ None,
+        );
+        tracing::error!(
+            path = %self.cache.path().display(),
+            "{CLOUD_CONFIG_BUNDLE_LOAD_FAILED_MESSAGE}"
+        );
+        Err(CloudConfigBundleLoadError::new(
+            CloudConfigBundleLoadErrorCode::RequestFailed,
+            last_status_code,
+            CLOUD_CONFIG_BUNDLE_LOAD_FAILED_MESSAGE,
+        ))
+    }
+
+    async fn validate_and_cache_remote_bundle(
+        &self,
+        auth: &CodexAuth,
+        trigger: &'static str,
+        attempt: usize,
+        bundle: CloudConfigBundle,
+    ) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        emit_fetch_attempt_metric(trigger, attempt, "success", /*status_code*/ None);
+        if let Err(err) = validate_bundle(&bundle, &self.codex_home) {
+            emit_fetch_final_metric(
+                trigger,
+                "error",
+                "invalid_bundle",
+                attempt,
+                /*status_code*/ None,
+                /*bundle*/ None,
+            );
+            return Err(err);
+        }
+
+        let (chatgpt_user_id, account_id) = auth_identity(auth);
+        if self.cache_enabled
+            && let Err(err) = self
+                .cache
+                .save(chatgpt_user_id, account_id, bundle.clone())
+                .await
+        {
+            tracing::warn!(
+                error = %err,
+                "Failed to write cloud config bundle cache"
+            );
+        }
+
+        emit_fetch_final_metric(
+            trigger,
+            "success",
+            "none",
+            attempt,
+            /*status_code*/ None,
+            Some(&bundle),
+        );
+        Ok(optional_bundle(bundle))
+    }
+
+    async fn retry_after_request_failure(
+        &self,
+        trigger: &'static str,
+        attempt: usize,
+        status: RetryableFailureKind,
+    ) -> bool {
+        let status_code = status.status_code();
+        emit_fetch_attempt_metric(trigger, attempt, "error", status_code);
+        if attempt < CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS {
+            tracing::warn!(
+                status = ?status,
+                attempt,
+                max_attempts = CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS,
+                "Failed to fetch cloud config bundle; retrying"
+            );
+            sleep(backoff(attempt as u64)).await;
+            true
+        } else {
+            false
+        }
+    }
+
+    async fn handle_unauthorized(
+        &self,
+        auth: &mut CodexAuth,
+        auth_recovery: &mut UnauthorizedRecovery,
+        trigger: &'static str,
+        attempt: usize,
+        status_code: Option<u16>,
+        message: &str,
+    ) -> Result<UnauthorizedRecoveryAction, CloudConfigBundleLoadError> {
+        emit_fetch_attempt_metric(trigger, attempt, "unauthorized", status_code);
+        if auth_recovery.has_next() {
+            tracing::warn!(
+                attempt,
+                max_attempts = CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS,
+                "Cloud config bundle request was unauthorized; attempting auth recovery"
+            );
+            match auth_recovery.next().await {
+                Ok(_) => {
+                    let Some(refreshed_auth) = self.auth_manager.auth().await else {
+                        tracing::error!(
+                            "Auth recovery succeeded but no auth is available for cloud config bundle"
+                        );
+                        emit_fetch_final_metric(
+                            trigger,
+                            "error",
+                            "auth_recovery_missing_auth",
+                            attempt,
+                            status_code,
+                            /*bundle*/ None,
+                        );
+                        return Err(CloudConfigBundleLoadError::new(
+                            CloudConfigBundleLoadErrorCode::Auth,
+                            status_code,
+                            CLOUD_CONFIG_BUNDLE_AUTH_RECOVERY_FAILED_MESSAGE,
+                        ));
+                    };
+                    *auth = refreshed_auth;
+                    return Ok(UnauthorizedRecoveryAction::RetrySameAttempt);
+                }
+                Err(RefreshTokenError::Permanent(failed)) => {
+                    tracing::warn!(
+                        error = %failed,
+                        "Failed to recover from unauthorized cloud config bundle request"
+                    );
+                    emit_fetch_final_metric(
+                        trigger,
+                        "error",
+                        "auth_recovery_unrecoverable",
+                        attempt,
+                        status_code,
+                        /*bundle*/ None,
+                    );
+                    return Err(CloudConfigBundleLoadError::new(
+                        CloudConfigBundleLoadErrorCode::Auth,
+                        status_code,
+                        failed.message,
+                    ));
+                }
+                Err(RefreshTokenError::Transient(recovery_err)) => {
+                    if attempt < CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS {
+                        tracing::warn!(
+                            error = %recovery_err,
+                            attempt,
+                            max_attempts = CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS,
+                            "Failed to recover from unauthorized cloud config bundle request; retrying"
+                        );
+                        sleep(backoff(attempt as u64)).await;
+                    }
+                    return Ok(UnauthorizedRecoveryAction::RetryNextAttempt);
+                }
+            }
+        }
+
+        tracing::warn!(
+            error = %message,
+            "Cloud config bundle request was unauthorized and no auth recovery is available"
+        );
+        emit_fetch_final_metric(
+            trigger,
+            "error",
+            "auth_recovery_unavailable",
+            attempt,
+            status_code,
+            /*bundle*/ None,
+        );
+        Err(CloudConfigBundleLoadError::new(
+            CloudConfigBundleLoadErrorCode::Auth,
+            status_code,
+            CLOUD_CONFIG_BUNDLE_AUTH_RECOVERY_FAILED_MESSAGE,
+        ))
+    }
+
+    pub(crate) async fn refresh_cache_in_background(&self) {
+        loop {
+            let mut refresh_interval = CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL;
+            if let Some(latest_bundle) = self.latest_bundle.get()
+                && matches!(
+                    &*latest_bundle.lock().await,
+                    Err(error) if error.code() == CloudConfigBundleLoadErrorCode::Timeout
+                )
+            {
+                // Recover startup timeouts through this worker without making
+                // readers fetch concurrently or extending the startup deadline.
+                refresh_interval = CLOUD_CONFIG_BUNDLE_TIMEOUT_RETRY_INTERVAL;
+            }
+            sleep(refresh_interval).await;
+            match timeout(self.timeout, self.refresh_cache_once()).await {
+                Ok(true) => {}
+                Ok(false) => break,
+                Err(_) => {
+                    tracing::error!(
+                        "Timed out refreshing cloud config bundle cache from remote; keeping existing cache"
+                    );
+                    emit_load_metric("refresh", "error", /*bundle*/ None);
+                }
+            }
+        }
+    }
+
+    async fn refresh_cache_once(&self) -> bool {
+        let Some(auth) = self.auth_manager.auth().await else {
+            return false;
+        };
+        if !cloud_config_eligible_auth(&auth) {
+            return false;
+        }
+
+        match self
+            .fetch_remote_bundle_and_update_cache_with_retries(auth, "refresh")
+            .await
+        {
+            Ok(bundle) => {
+                emit_load_metric("refresh", "success", bundle.as_ref());
+                if let Some(latest_bundle) = self.latest_bundle.get() {
+                    *latest_bundle.lock().await = Ok(bundle);
+                }
+            }
+            Err(err) => {
+                tracing::error!(
+                    path = %self.cache.path().display(),
+                    error = %err,
+                    "Failed to refresh cloud config bundle cache from remote"
+                );
+                emit_load_metric("refresh", "error", /*bundle*/ None);
+                if let Some(latest_bundle) = self.latest_bundle.get() {
+                    let mut latest_bundle = latest_bundle.lock().await;
+                    if latest_bundle.is_err() {
+                        *latest_bundle = Err(err);
+                    }
+                }
+            }
+        }
+        true
+    }
+}
+
+#[cfg(test)]
+#[path = "service_tests.rs"]
+mod tests;

codex-rs/cloud-config/src/service_tests.rs

@@ -0,0 +1,1658 @@
+use super::*;
+use crate::backend::BundleClient;
+use crate::backend::BundleRequestError;
+use crate::backend::RetryableFailureKind;
+use crate::backend::bundle_from_response;
+use crate::cache::CLOUD_CONFIG_BUNDLE_CACHE_FILENAME;
+use crate::cache::CloudConfigBundleCache;
+use crate::metrics::bundle_shape_tag;
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
+use codex_backend_client::ConfigBundleResponse;
+use codex_backend_client::DeliveredTomlFragment;
+use codex_config::AbsolutePathBuf;
+use codex_config::CloudConfigFragment;
+use codex_config::CloudConfigTomlBundle;
+use codex_config::CloudRequirementsFragment;
+use codex_config::CloudRequirementsTomlBundle;
+use codex_config::types::AuthCredentialsStoreMode;
+use codex_core::config::ConfigBuilder;
+use codex_login::AuthKeyringBackendKind;
+use codex_login::auth::AgentIdentityAuth;
+use codex_login::auth::AgentIdentityAuthRecord;
+use codex_login::auth::ExternalAuth;
+use codex_login::auth::ExternalAuthRefreshContext;
+use pretty_assertions::assert_eq;
+use serde_json::json;
+use std::collections::VecDeque;
+use std::future::pending;
+use std::path::Path;
+use std::sync::RwLock;
+use std::sync::atomic::AtomicUsize;
+use std::sync::atomic::Ordering;
+use tempfile::tempdir;
+
+fn write_auth_json(codex_home: &Path, value: serde_json::Value) -> std::io::Result<()> {
+    std::fs::write(codex_home.join("auth.json"), serde_json::to_string(&value)?)?;
+    Ok(())
+}
+
+fn create_test_cache(codex_home: &Path) -> CloudConfigBundleCache {
+    CloudConfigBundleCache::new(AbsolutePathBuf::resolve_path_against_base(codex_home, "/"))
+}
+
+async fn auth_manager_with_api_key() -> Arc<AuthManager> {
+    let tmp = tempdir().expect("tempdir");
+    let auth_json = json!({
+        "OPENAI_API_KEY": "sk-test-key",
+        "tokens": null,
+        "last_refresh": null,
+    });
+    write_auth_json(tmp.path(), auth_json).expect("write auth");
+    Arc::new(
+        AuthManager::new(
+            tmp.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    )
+}
+
+async fn auth_manager_with_plan_and_identity(
+    plan_type: &str,
+    chatgpt_user_id: Option<&str>,
+    account_id: Option<&str>,
+) -> Arc<AuthManager> {
+    let tmp = tempdir().expect("tempdir");
+    write_auth_json(
+        tmp.path(),
+        chatgpt_auth_json(
+            plan_type,
+            chatgpt_user_id,
+            account_id,
+            "test-access-token",
+            "test-refresh-token",
+        ),
+    )
+    .expect("write auth");
+    Arc::new(
+        AuthManager::new(
+            tmp.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    )
+}
+
+async fn auth_manager_with_plan(plan_type: &str) -> Arc<AuthManager> {
+    auth_manager_with_plan_and_identity(plan_type, Some("user-12345"), Some("account-12345")).await
+}
+
+async fn auth_manager_with_agent_identity_business_plan() -> Arc<AuthManager> {
+    let key_material =
+        codex_agent_identity::generate_agent_key_material().expect("generate agent key material");
+    AuthManager::from_auth_for_testing(CodexAuth::AgentIdentity(
+        AgentIdentityAuth::from_record(
+            AgentIdentityAuthRecord {
+                agent_runtime_id: "agent-runtime-123".to_string(),
+                agent_private_key: key_material.private_key_pkcs8_base64,
+                account_id: "account-12345".to_string(),
+                chatgpt_user_id: "user-12345".to_string(),
+                email: Some("user@example.com".to_string()),
+                plan_type: PlanType::Business,
+                chatgpt_account_is_fedramp: false,
+                task_id: Some("task-123".to_string()),
+            },
+            "https://auth.openai.com/api/accounts",
+            &codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await
+        .expect("agent identity record should be complete"),
+    ))
+}
+
+fn chatgpt_auth_json(
+    plan_type: &str,
+    chatgpt_user_id: Option<&str>,
+    account_id: Option<&str>,
+    access_token: &str,
+    refresh_token: &str,
+) -> serde_json::Value {
+    chatgpt_auth_json_with_last_refresh(
+        plan_type,
+        chatgpt_user_id,
+        account_id,
+        access_token,
+        refresh_token,
+        "2025-01-01T00:00:00Z",
+    )
+}
+
+fn chatgpt_auth_json_with_last_refresh(
+    plan_type: &str,
+    chatgpt_user_id: Option<&str>,
+    account_id: Option<&str>,
+    access_token: &str,
+    refresh_token: &str,
+    last_refresh: &str,
+) -> serde_json::Value {
+    let fake_jwt = fake_chatgpt_jwt(plan_type, chatgpt_user_id, b"sig");
+    json!({
+        "OPENAI_API_KEY": null,
+        "tokens": {
+            "id_token": fake_jwt,
+            "access_token": access_token,
+            "refresh_token": refresh_token,
+            "account_id": account_id,
+        },
+        "last_refresh": last_refresh,
+    })
+}
+
+fn fake_chatgpt_jwt(plan_type: &str, chatgpt_user_id: Option<&str>, signature: &[u8]) -> String {
+    let header = json!({ "alg": "none", "typ": "JWT" });
+    let auth_payload = json!({
+        "chatgpt_plan_type": plan_type,
+        "chatgpt_user_id": chatgpt_user_id,
+        "user_id": chatgpt_user_id,
+    });
+    let payload = json!({
+        "email": "user@example.com",
+        "https://api.openai.com/auth": auth_payload,
+    });
+    let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).expect("header"));
+    let payload_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&payload).expect("payload"));
+    let signature_b64 = URL_SAFE_NO_PAD.encode(signature);
+    format!("{header_b64}.{payload_b64}.{signature_b64}")
+}
+
+fn test_bundle() -> CloudConfigBundle {
+    CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle {
+            enterprise_managed: vec![test_config_fragment()],
+        },
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: vec![test_requirements_fragment()],
+        },
+    }
+}
+
+fn test_config_fragment() -> CloudConfigFragment {
+    CloudConfigFragment {
+        id: "cfg_1".to_string(),
+        name: "Base config".to_string(),
+        contents: "model = \"gpt-5\"".to_string(),
+    }
+}
+
+fn test_requirements_fragment() -> CloudRequirementsFragment {
+    CloudRequirementsFragment {
+        id: "req_1".to_string(),
+        name: "Base requirements".to_string(),
+        contents: "allowed_approval_policies = [\"never\"]".to_string(),
+    }
+}
+
+fn invalid_config_bundle() -> CloudConfigBundle {
+    CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle {
+            enterprise_managed: vec![CloudConfigFragment {
+                id: "cfg_invalid".to_string(),
+                name: "Invalid config".to_string(),
+                contents: "model = [".to_string(),
+            }],
+        },
+        requirements_toml: CloudRequirementsTomlBundle::default(),
+    }
+}
+
+fn request_error() -> BundleRequestError {
+    BundleRequestError::Retryable(RetryableFailureKind::Request { status_code: None })
+}
+
+struct StaticBundleClient {
+    bundle: CloudConfigBundle,
+    request_count: AtomicUsize,
+}
+
+impl StaticBundleClient {
+    fn new(bundle: CloudConfigBundle) -> Self {
+        Self {
+            bundle,
+            request_count: AtomicUsize::new(0),
+        }
+    }
+}
+
+impl BundleClient for StaticBundleClient {
+    async fn get_bundle(&self, _auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        self.request_count.fetch_add(1, Ordering::SeqCst);
+        Ok(self.bundle.clone())
+    }
+}
+
+struct PendingBundleClient;
+
+impl BundleClient for PendingBundleClient {
+    async fn get_bundle(&self, _auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        pending::<()>().await;
+        Ok(CloudConfigBundle::default())
+    }
+}
+
+struct NotifyingPendingBundleClient {
+    request_started: Arc<tokio::sync::Notify>,
+    request_cancelled: Arc<tokio::sync::Notify>,
+}
+
+impl Drop for NotifyingPendingBundleClient {
+    fn drop(&mut self) {
+        self.request_cancelled.notify_one();
+    }
+}
+
+impl BundleClient for NotifyingPendingBundleClient {
+    async fn get_bundle(&self, _auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        self.request_started.notify_one();
+        pending::<()>().await;
+        Ok(CloudConfigBundle::default())
+    }
+}
+
+struct SequenceBundleClient {
+    responses: tokio::sync::Mutex<VecDeque<Result<CloudConfigBundle, BundleRequestError>>>,
+    request_count: AtomicUsize,
+    request_started: tokio::sync::Notify,
+    timeout_attempts: usize,
+}
+
+impl SequenceBundleClient {
+    fn new(responses: Vec<Result<CloudConfigBundle, BundleRequestError>>) -> Self {
+        Self {
+            responses: tokio::sync::Mutex::new(VecDeque::from(responses)),
+            request_count: AtomicUsize::new(0),
+            request_started: tokio::sync::Notify::new(),
+            timeout_attempts: 0,
+        }
+    }
+}
+
+impl BundleClient for SequenceBundleClient {
+    async fn get_bundle(&self, _auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        let attempt = self.request_count.fetch_add(1, Ordering::SeqCst);
+        self.request_started.notify_one();
+        if attempt < self.timeout_attempts {
+            pending::<()>().await;
+        }
+        let mut responses = self.responses.lock().await;
+        responses
+            .pop_front()
+            .unwrap_or_else(|| Ok(CloudConfigBundle::default()))
+    }
+}
+
+struct TokenBundleClient {
+    expected_token: String,
+    bundle: CloudConfigBundle,
+    request_count: AtomicUsize,
+}
+
+impl BundleClient for TokenBundleClient {
+    async fn get_bundle(&self, auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        self.request_count.fetch_add(1, Ordering::SeqCst);
+        if matches!(
+            auth.get_token().as_deref(),
+            Ok(token) if token == self.expected_token.as_str()
+        ) {
+            Ok(self.bundle.clone())
+        } else {
+            Err(BundleRequestError::Unauthorized {
+                status_code: Some(401),
+                message: "GET /config/bundle failed: 401".to_string(),
+            })
+        }
+    }
+}
+
+struct UnauthorizedBundleClient {
+    message: String,
+    request_count: AtomicUsize,
+}
+
+struct TestExternalChatgptAuth {
+    current: RwLock<CodexAuth>,
+    refreshed: CodexAuth,
+    refresh_count: AtomicUsize,
+}
+
+impl ExternalAuth for TestExternalChatgptAuth {
+    fn resolve(&self) -> codex_login::ExternalAuthFuture<'_, CodexAuth> {
+        Box::pin(async {
+            self.current
+                .read()
+                .map(|auth| auth.clone())
+                .map_err(|_| std::io::Error::other("external auth lock is poisoned"))
+        })
+    }
+
+    fn refresh(
+        &self,
+        _context: ExternalAuthRefreshContext,
+    ) -> codex_login::ExternalAuthFuture<'_, CodexAuth> {
+        Box::pin(async {
+            let refreshed = self.refreshed.clone();
+            *self
+                .current
+                .write()
+                .map_err(|_| std::io::Error::other("external auth lock is poisoned"))? =
+                refreshed.clone();
+            self.refresh_count.fetch_add(1, Ordering::SeqCst);
+            Ok(refreshed)
+        })
+    }
+}
+
+impl BundleClient for UnauthorizedBundleClient {
+    async fn get_bundle(&self, _auth: &CodexAuth) -> Result<CloudConfigBundle, BundleRequestError> {
+        self.request_count.fetch_add(1, Ordering::SeqCst);
+        Err(BundleRequestError::Unauthorized {
+            status_code: Some(401),
+            message: self.message.clone(),
+        })
+    }
+}
+
+#[test]
+fn bundle_shape_tag_describes_sorted_enterprise_sources() {
+    assert_eq!(bundle_shape_tag(/*bundle*/ None), "none");
+    assert_eq!(
+        bundle_shape_tag(Some(&CloudConfigBundle::default())),
+        "empty"
+    );
+    assert_eq!(
+        bundle_shape_tag(Some(&CloudConfigBundle {
+            config_toml: CloudConfigTomlBundle {
+                enterprise_managed: vec![test_config_fragment()],
+            },
+            requirements_toml: CloudRequirementsTomlBundle::default(),
+        })),
+        "enterprise_config"
+    );
+    assert_eq!(
+        bundle_shape_tag(Some(&CloudConfigBundle {
+            config_toml: CloudConfigTomlBundle::default(),
+            requirements_toml: CloudRequirementsTomlBundle {
+                enterprise_managed: vec![test_requirements_fragment()],
+            },
+        })),
+        "enterprise_requirements"
+    );
+    assert_eq!(
+        bundle_shape_tag(Some(&CloudConfigBundle {
+            config_toml: CloudConfigTomlBundle {
+                enterprise_managed: vec![test_config_fragment()],
+            },
+            requirements_toml: CloudRequirementsTomlBundle {
+                enterprise_managed: vec![test_requirements_fragment()],
+            },
+        })),
+        "enterprise_config,enterprise_requirements"
+    );
+}
+
+#[tokio::test]
+async fn get_bundle_skips_non_chatgpt_auth() {
+    let fetcher = Arc::new(StaticBundleClient::new(test_bundle()));
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_api_key().await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(None));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn get_bundle_skips_individual_plan() {
+    let fetcher = Arc::new(StaticBundleClient::new(test_bundle()));
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("pro").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(None));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn get_bundle_allows_eligible_workspace_plans_and_writes_cache() {
+    for plan_type in [
+        "business",
+        "ent26",
+        "enterprise_cbp_automation",
+        "enterprise_cbp_usage_based",
+        "enterprise",
+        "hc",
+        "edu",
+        "education",
+        "edu_plus",
+        "edu_pro",
+    ] {
+        let bundle = test_bundle();
+        let fetcher = Arc::new(StaticBundleClient::new(bundle.clone()));
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudConfigBundleService::new(
+            auth_manager_with_plan(plan_type).await,
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_CONFIG_BUNDLE_TIMEOUT,
+        );
+
+        assert_eq!(
+            service.load_startup_bundle().await,
+            Ok(Some(bundle)),
+            "plan_type: {plan_type}"
+        );
+        assert_eq!(
+            fetcher.request_count.load(Ordering::SeqCst),
+            1,
+            "plan_type: {plan_type}"
+        );
+        assert!(
+            codex_home
+                .path()
+                .join(CLOUD_CONFIG_BUNDLE_CACHE_FILENAME)
+                .exists(),
+            "plan_type: {plan_type}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn get_bundle_allows_agent_identity_business_plan() {
+    let bundle = test_bundle();
+    let fetcher = Arc::new(StaticBundleClient::new(bundle.clone()));
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_agent_identity_business_plan().await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(Some(bundle)));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    assert!(
+        codex_home
+            .path()
+            .join(CLOUD_CONFIG_BUNDLE_CACHE_FILENAME)
+            .exists()
+    );
+}
+
+#[tokio::test]
+async fn get_bundle_skips_team_like_business_plans() {
+    for plan_type in [
+        "self_serve_business_prolite",
+        "self_serve_business_usage_based",
+    ] {
+        let fetcher = Arc::new(StaticBundleClient::new(test_bundle()));
+        let codex_home = tempdir().expect("tempdir");
+        let service = CloudConfigBundleService::new(
+            auth_manager_with_plan(plan_type).await,
+            fetcher.clone(),
+            codex_home.path().to_path_buf(),
+            CLOUD_CONFIG_BUNDLE_TIMEOUT,
+        );
+
+        assert_eq!(service.load_startup_bundle().await, Ok(None));
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 0);
+    }
+}
+
+#[tokio::test]
+async fn get_bundle_rejects_invalid_remote_bundle_before_cache_write() {
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(StaticBundleClient::new(invalid_config_bundle()));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    let err = service
+        .load_startup_bundle()
+        .await
+        .expect_err("invalid remote bundle should fail closed");
+
+    assert_eq!(err.code(), CloudConfigBundleLoadErrorCode::InvalidBundle);
+    assert!(err.to_string().contains("invalid cloud config bundle"));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    assert!(
+        !codex_home
+            .path()
+            .join(CLOUD_CONFIG_BUNDLE_CACHE_FILENAME)
+            .exists()
+    );
+}
+
+#[tokio::test]
+async fn invalid_cloud_provider_does_not_replace_cached_bundle() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    let previous = test_bundle();
+    cache
+        .save(
+            Some("user-12345".to_string()),
+            Some("account-12345".to_string()),
+            previous.clone(),
+        )
+        .await
+        .expect("cache valid bundle");
+
+    for contents in [
+        "[model_providers.openai]\nname = 'Reserved'",
+        "[model_providers.gateway]\nname = '   '",
+        "[model_providers.gateway]\nbase_url = 'https://gateway.example/v1'",
+        "[model_providers.amazon-bedrock]\nname = 'Managed Bedrock'",
+        "[model_providers.amazon-bedrock-runtime]\nname = 'Managed Bedrock Runtime'",
+        "[model_providers.amazon-bedrock]\nrequest_max_retries = 3",
+        "[model_providers.gateway]\nname = 'Gateway'\n[model_providers.gateway.auth]\ntimeout_ms = 10000",
+    ] {
+        let mut invalid = test_bundle();
+        invalid.requirements_toml.enterprise_managed[0].contents = contents.to_string();
+        let auth_manager = auth_manager_with_plan("business").await;
+        let auth = auth_manager.auth().await.expect("business auth");
+        let service = CloudConfigBundleService::new(
+            auth_manager,
+            Arc::new(StaticBundleClient::new(invalid.clone())),
+            codex_home.path().to_path_buf(),
+            CLOUD_CONFIG_BUNDLE_TIMEOUT,
+        );
+        let error = service
+            .validate_and_cache_remote_bundle(&auth, "refresh", /*attempt*/ 1, invalid)
+            .await
+            .expect_err("invalid provider must fail before cache write");
+        assert_eq!(error.code(), CloudConfigBundleLoadErrorCode::InvalidBundle);
+        assert_eq!(
+            cache
+                .load(Some("user-12345"), Some("account-12345"))
+                .await
+                .expect("retain previous cache")
+                .bundle,
+            previous
+        );
+    }
+}
+
+#[tokio::test]
+async fn get_bundle_ignores_invalid_cache_and_refetches() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    cache
+        .save(
+            Some("user-12345".to_string()),
+            Some("account-12345".to_string()),
+            invalid_config_bundle(),
+        )
+        .await
+        .expect("write invalid cache");
+    let replacement_bundle = test_bundle();
+    let fetcher = Arc::new(StaticBundleClient::new(replacement_bundle.clone()));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(
+        service.load_startup_bundle().await,
+        Ok(Some(replacement_bundle.clone()))
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    assert_eq!(
+        cache
+            .load(Some("user-12345"), Some("account-12345"))
+            .await
+            .expect("load refreshed cache")
+            .bundle,
+        replacement_bundle
+    );
+}
+
+#[tokio::test]
+async fn get_bundle_empty_response_is_success_and_cached() {
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(StaticBundleClient::new(CloudConfigBundle::default()));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("enterprise").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(None));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    assert!(
+        codex_home
+            .path()
+            .join(CLOUD_CONFIG_BUNDLE_CACHE_FILENAME)
+            .exists()
+    );
+}
+
+#[tokio::test]
+async fn get_bundle_uses_cache_when_valid() {
+    let bundle = test_bundle();
+    let codex_home = tempdir().expect("tempdir");
+    let prime_service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::new(StaticBundleClient::new(bundle.clone())),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let _ = prime_service.load_startup_bundle().await;
+
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![Err(request_error())]));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(Some(bundle)));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn get_bundle_without_cache_ignores_and_preserves_valid_cache() {
+    let codex_home = tempdir().expect("tempdir");
+    let cache = create_test_cache(codex_home.path());
+    cache
+        .save(
+            Some("user-12345".to_string()),
+            Some("account-12345".to_string()),
+            CloudConfigBundle::default(),
+        )
+        .await
+        .expect("write empty cache");
+    let cached_bytes = std::fs::read(cache.path()).expect("read cache");
+    let bundle = test_bundle();
+    let fetcher = Arc::new(StaticBundleClient::new(bundle.clone()));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    )
+    .without_cache();
+
+    assert_eq!(
+        service.load_startup_bundle_with_timeout().await,
+        Ok(Some(bundle))
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    assert_eq!(
+        std::fs::read(cache.path()).expect("read unchanged cache"),
+        cached_bytes
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn get_bundle_without_cache_fails_closed_on_request_failure() {
+    let codex_home = tempdir().expect("tempdir");
+    create_test_cache(codex_home.path())
+        .save(
+            Some("user-12345".to_string()),
+            Some("account-12345".to_string()),
+            test_bundle(),
+        )
+        .await
+        .expect("write valid cache");
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![
+        Err(request_error());
+        CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS
+    ]));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    )
+    .without_cache();
+
+    let err = service
+        .load_startup_bundle_with_timeout()
+        .await
+        .expect_err("request failure must not fall back to the cache");
+    assert_eq!(err.code(), CloudConfigBundleLoadErrorCode::RequestFailed);
+    assert_eq!(
+        fetcher.request_count.load(Ordering::SeqCst),
+        CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS
+    );
+}
+
+#[tokio::test]
+async fn get_bundle_ignores_cache_for_different_auth_identity() {
+    let codex_home = tempdir().expect("tempdir");
+    let prime_service = CloudConfigBundleService::new(
+        auth_manager_with_plan_and_identity("business", Some("user-12345"), Some("account-12345"))
+            .await,
+        Arc::new(StaticBundleClient::new(test_bundle())),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let _ = prime_service.load_startup_bundle().await;
+
+    let replacement_bundle = CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle::default(),
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: vec![CloudRequirementsFragment {
+                id: "req_2".to_string(),
+                name: "Replacement requirements".to_string(),
+                contents: "allowed_approval_policies = [\"on-request\"]".to_string(),
+            }],
+        },
+    };
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![Ok(
+        replacement_bundle.clone()
+    )]));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan_and_identity("business", Some("user-99999"), Some("account-12345"))
+            .await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(
+        service.load_startup_bundle().await,
+        Ok(Some(replacement_bundle))
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+}
+
+#[tokio::test(start_paused = true)]
+async fn get_bundle_times_out() {
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("enterprise").await,
+        Arc::new(PendingBundleClient),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let handle = tokio::spawn(async move { service.load_startup_bundle_with_timeout().await });
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_TIMEOUT + Duration::from_millis(1)).await;
+
+    let result = handle.await.expect("cloud config bundle task");
+    let err = result.expect_err("cloud config bundle timeout should fail closed");
+    assert!(
+        err.to_string()
+            .contains("timed out waiting for cloud config bundle")
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn get_bundle_retries_until_success() {
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![
+        Err(request_error()),
+        Ok(test_bundle()),
+    ]));
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    let handle = tokio::spawn(async move { service.load_startup_bundle().await });
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(1)).await;
+
+    assert_eq!(handle.await.expect("bundle task"), Ok(Some(test_bundle())));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+}
+
+#[tokio::test]
+async fn get_bundle_recovers_after_unauthorized_reload() {
+    let auth_home = tempdir().expect("tempdir");
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json_with_last_refresh(
+            "business",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+            // Keep auth "fresh" so the first request hits unauthorized recovery
+            // instead of AuthManager::auth() proactively reloading from disk.
+            "3025-01-01T00:00:00Z",
+        ),
+    )
+    .expect("write initial auth");
+    let auth_manager = Arc::new(
+        AuthManager::new(
+            auth_home.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    );
+
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json_with_last_refresh(
+            "business",
+            Some("user-12345"),
+            Some("account-12345"),
+            "fresh-access-token",
+            "test-refresh-token",
+            "3025-01-01T00:00:00Z",
+        ),
+    )
+    .expect("write refreshed auth");
+    let fetcher = Arc::new(TokenBundleClient {
+        expected_token: "fresh-access-token".to_string(),
+        bundle: test_bundle(),
+        request_count: AtomicUsize::new(0),
+    });
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(Some(test_bundle())));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+}
+
+#[tokio::test]
+async fn get_bundle_recovers_after_unauthorized_reload_updates_cache_identity() {
+    let auth_home = tempdir().expect("tempdir");
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json_with_last_refresh(
+            "business",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+            "3025-01-01T00:00:00Z",
+        ),
+    )
+    .expect("write initial auth");
+    let auth_manager = Arc::new(
+        AuthManager::new(
+            auth_home.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    );
+
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json_with_last_refresh(
+            "business",
+            Some("user-99999"),
+            Some("account-12345"),
+            "fresh-access-token",
+            "test-refresh-token",
+            "3025-01-01T00:00:00Z",
+        ),
+    )
+    .expect("write refreshed auth");
+    let fetcher = Arc::new(TokenBundleClient {
+        expected_token: "fresh-access-token".to_string(),
+        bundle: test_bundle(),
+        request_count: AtomicUsize::new(0),
+    });
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(Some(test_bundle())));
+    let cache = create_test_cache(codex_home.path());
+    assert_eq!(
+        cache
+            .load(Some("user-99999"), Some("account-12345"))
+            .await
+            .expect("load cache")
+            .bundle,
+        test_bundle()
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+}
+
+#[tokio::test]
+async fn get_bundle_surfaces_auth_recovery_message() {
+    let auth_home = tempdir().expect("tempdir");
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json(
+            "enterprise",
+            Some("user-12345"),
+            Some("account-12345"),
+            "stale-access-token",
+            "test-refresh-token",
+        ),
+    )
+    .expect("write auth");
+    let auth_manager = Arc::new(
+        AuthManager::new(
+            auth_home.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    );
+
+    write_auth_json(
+        auth_home.path(),
+        chatgpt_auth_json(
+            "enterprise",
+            Some("user-12345"),
+            Some("account-99999"),
+            "fresh-access-token",
+            "test-refresh-token",
+        ),
+    )
+    .expect("write mismatched auth");
+    let fetcher = Arc::new(UnauthorizedBundleClient {
+        message: "GET /config/bundle failed: 401".to_string(),
+        request_count: AtomicUsize::new(0),
+    });
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    let err = service
+        .load_startup_bundle()
+        .await
+        .expect_err("cloud config bundle should surface auth recovery errors");
+    assert_eq!(
+        err,
+        CloudConfigBundleLoadError::new(
+            CloudConfigBundleLoadErrorCode::Auth,
+            Some(401),
+            "Your access token could not be refreshed because you have since logged out or signed in to another account. Please sign in again.",
+        )
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+}
+
+#[tokio::test]
+async fn get_bundle_refreshes_external_auth_after_unauthorized() {
+    let auth_home = tempdir().expect("tempdir");
+    let auth_manager = Arc::new(
+        AuthManager::new(
+            auth_home.path().to_path_buf(),
+            /*enable_codex_api_key_env*/ false,
+            AuthCredentialsStoreMode::Ephemeral,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            AuthKeyringBackendKind::default(),
+            codex_login::test_support::transport_default_auth_route_config(),
+        )
+        .await,
+    );
+    let initial_auth = CodexAuth::from_external_chatgpt_tokens(
+        &fake_chatgpt_jwt("enterprise", Some("user-12345"), b"initial"),
+        "account-12345",
+        Some("enterprise"),
+    )
+    .expect("initial external auth");
+    let refreshed_token = fake_chatgpt_jwt("enterprise", Some("user-12345"), b"refreshed");
+    let refreshed_auth = CodexAuth::from_external_chatgpt_tokens(
+        &refreshed_token,
+        "account-12345",
+        Some("enterprise"),
+    )
+    .expect("refreshed external auth");
+    let external_auth = Arc::new(TestExternalChatgptAuth {
+        current: RwLock::new(initial_auth),
+        refreshed: refreshed_auth,
+        refresh_count: AtomicUsize::new(0),
+    });
+    auth_manager
+        .set_external_auth(external_auth.clone())
+        .await
+        .expect("set external auth");
+
+    let fetcher = Arc::new(TokenBundleClient {
+        expected_token: refreshed_token,
+        bundle: test_bundle(),
+        request_count: AtomicUsize::new(0),
+    });
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.load_startup_bundle().await, Ok(Some(test_bundle())));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+    assert_eq!(external_auth.refresh_count.load(Ordering::SeqCst), 1);
+}
+
+#[tokio::test]
+async fn get_bundle_does_not_use_cache_when_auth_identity_is_incomplete() {
+    let codex_home = tempdir().expect("tempdir");
+    let prime_service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::new(StaticBundleClient::new(test_bundle())),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let _ = prime_service.load_startup_bundle().await;
+
+    let replacement_bundle = CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle::default(),
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: vec![CloudRequirementsFragment {
+                id: "req_2".to_string(),
+                name: "Replacement requirements".to_string(),
+                contents: "allowed_approval_policies = [\"on-request\"]".to_string(),
+            }],
+        },
+    };
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![Ok(
+        replacement_bundle.clone()
+    )]));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan_and_identity(
+            "business",
+            /*chatgpt_user_id*/ None,
+            Some("account-12345"),
+        )
+        .await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(
+        service.load_startup_bundle().await,
+        Ok(Some(replacement_bundle))
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+}
+
+#[tokio::test(start_paused = true)]
+async fn get_bundle_stops_after_max_retries() {
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![
+        Err(request_error());
+        CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS
+    ]));
+    let codex_home = tempdir().expect("tempdir");
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("enterprise").await,
+        fetcher.clone(),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    let handle = tokio::spawn(async move { service.load_startup_bundle().await });
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(5)).await;
+    tokio::task::yield_now().await;
+
+    let err = handle
+        .await
+        .expect("cloud config bundle task")
+        .expect_err("cloud config bundle retry exhaustion should fail closed");
+    assert_eq!(err.to_string(), CLOUD_CONFIG_BUNDLE_LOAD_FAILED_MESSAGE);
+    assert_eq!(err.code(), CloudConfigBundleLoadErrorCode::RequestFailed);
+    assert_eq!(
+        fetcher.request_count.load(Ordering::SeqCst),
+        CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS
+    );
+}
+
+#[tokio::test]
+async fn refresh_from_remote_updates_cached_bundle() {
+    let replacement_bundle = CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle::default(),
+        requirements_toml: CloudRequirementsTomlBundle {
+            enterprise_managed: vec![CloudRequirementsFragment {
+                id: "req_2".to_string(),
+                name: "Replacement requirements".to_string(),
+                contents: "allowed_approval_policies = [\"on-request\"]".to_string(),
+            }],
+        },
+    };
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(SequenceBundleClient::new(vec![
+        Ok(test_bundle()),
+        Ok(replacement_bundle.clone()),
+    ]));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        fetcher,
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+
+    assert_eq!(service.get_latest().await, Ok(Some(test_bundle())));
+    assert!(service.refresh_cache_once().await);
+    assert_eq!(
+        service.get_latest().await,
+        Ok(Some(replacement_bundle.clone()))
+    );
+
+    let cache = create_test_cache(codex_home.path());
+    let signed_payload = cache
+        .load(Some("user-12345"), Some("account-12345"))
+        .await
+        .expect("load cache");
+    assert_eq!(signed_payload.bundle, replacement_bundle);
+}
+
+#[tokio::test(start_paused = true)]
+async fn production_loader_recovers_startup_timeouts_in_background() {
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(SequenceBundleClient {
+        timeout_attempts: 2,
+        ..SequenceBundleClient::new(vec![Ok(test_bundle())])
+    });
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::clone(&fetcher),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (loader, _) = crate::bundle_loader::cloud_config_bundle_loader_for_service(service);
+    let (initial, ()) = tokio::join!(loader.get(), async {
+        fetcher.request_started.notified().await;
+        tokio::time::advance(CLOUD_CONFIG_BUNDLE_TIMEOUT + Duration::from_millis(1)).await;
+    });
+    assert_eq!(
+        initial
+            .as_ref()
+            .expect_err("startup should time out")
+            .code(),
+        CloudConfigBundleLoadErrorCode::Timeout
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+
+    for attempt in 2..=3 {
+        tokio::time::timeout(
+            CLOUD_CONFIG_BUNDLE_TIMEOUT_RETRY_INTERVAL + Duration::from_millis(1),
+            fetcher.request_started.notified(),
+        )
+        .await
+        .expect("the worker should retry before the normal refresh interval");
+        assert_eq!(fetcher.request_count.load(Ordering::SeqCst), attempt);
+        if attempt == 2 {
+            // Readers keep returning the snapshot while the worker's retry is pending.
+            let (first, second) = tokio::join!(loader.get(), loader.get());
+            assert_eq!((first, second), (initial.clone(), initial.clone()));
+            assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+            tokio::time::advance(CLOUD_CONFIG_BUNDLE_TIMEOUT + Duration::from_millis(1)).await;
+        }
+    }
+
+    let recovery_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while loader.get().await != Ok(Some(test_bundle())) {
+        assert!(
+            std::time::Instant::now() < recovery_deadline,
+            "the worker should publish the recovered bundle"
+        );
+        tokio::task::yield_now().await;
+    }
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .cloud_config_bundle(loader.clone())
+        .build()
+        .await
+        .expect("later configuration loads should apply the recovered bundle");
+    assert_eq!(config.model.as_deref(), Some("gpt-5"));
+    assert_eq!(
+        config.permissions.approval_policy.value(),
+        codex_protocol::protocol::AskForApproval::Never
+    );
+
+    tokio::time::timeout(
+        CLOUD_CONFIG_BUNDLE_TIMEOUT_RETRY_INTERVAL + Duration::from_millis(1),
+        fetcher.request_started.notified(),
+    )
+    .await
+    .expect_err("successful recovery should restore the normal refresh interval");
+    tokio::time::timeout(
+        CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL,
+        fetcher.request_started.notified(),
+    )
+    .await
+    .expect("normal background refresh should continue after recovery");
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 4);
+}
+
+#[tokio::test(start_paused = true)]
+async fn production_loader_restores_normal_refresh_interval_after_non_timeout_error() {
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(SequenceBundleClient {
+        timeout_attempts: 1,
+        ..SequenceBundleClient::new(vec![Ok(invalid_config_bundle()), Ok(test_bundle())])
+    });
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::clone(&fetcher),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (loader, _) = crate::bundle_loader::cloud_config_bundle_loader_for_service(service);
+    let (initial, ()) = tokio::join!(loader.get(), async {
+        fetcher.request_started.notified().await;
+        tokio::time::advance(CLOUD_CONFIG_BUNDLE_TIMEOUT + Duration::from_millis(1)).await;
+    });
+    assert_eq!(
+        initial.expect_err("startup should time out").code(),
+        CloudConfigBundleLoadErrorCode::Timeout
+    );
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+
+    tokio::time::timeout(
+        CLOUD_CONFIG_BUNDLE_TIMEOUT_RETRY_INTERVAL + Duration::from_millis(1),
+        fetcher.request_started.notified(),
+    )
+    .await
+    .expect("the worker should retry the startup timeout promptly");
+    let refresh_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    loop {
+        let error = loader
+            .get()
+            .await
+            .expect_err("the invalid bundle should fail closed");
+        if error.code() == CloudConfigBundleLoadErrorCode::InvalidBundle {
+            break;
+        }
+        assert!(
+            std::time::Instant::now() < refresh_deadline,
+            "the retry should replace the cached timeout with the validation error"
+        );
+        tokio::task::yield_now().await;
+    }
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+
+    tokio::time::timeout(
+        CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL - Duration::from_secs(1),
+        fetcher.request_started.notified(),
+    )
+    .await
+    .expect_err("the non-timeout error should stop fast retries");
+    tokio::time::timeout(
+        Duration::from_secs(1) + Duration::from_millis(1),
+        fetcher.request_started.notified(),
+    )
+    .await
+    .expect("refresh should resume at the normal interval");
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 3);
+}
+
+#[tokio::test(start_paused = true)]
+async fn production_loader_refreshes_later_configs_and_preserves_failed_refreshes() {
+    let codex_home = tempdir().expect("tempdir");
+    let initial_bundle = test_bundle();
+    let refreshed_bundle = CloudConfigBundle {
+        config_toml: CloudConfigTomlBundle {
+            enterprise_managed: vec![CloudConfigFragment {
+                id: "cfg_refreshed".to_string(),
+                name: "Refreshed config".to_string(),
+                contents: "model = \"gpt-5-refreshed\"".to_string(),
+            }],
+        },
+        requirements_toml: initial_bundle.requirements_toml.clone(),
+    };
+    let mut responses = vec![Ok(initial_bundle.clone()), Ok(refreshed_bundle.clone())];
+    responses.extend(vec![Err(request_error()); CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS]);
+    let fetcher = Arc::new(SequenceBundleClient::new(responses));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::clone(&fetcher),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (loader, _) = crate::bundle_loader::cloud_config_bundle_loader_for_service(service);
+
+    let (first, second) = tokio::join!(loader.get(), loader.get());
+    assert_eq!(first, Ok(Some(initial_bundle.clone())));
+    assert_eq!(second, Ok(Some(initial_bundle)));
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 1);
+    tokio::task::yield_now().await;
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL + Duration::from_millis(1))
+        .await;
+    let refresh_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while loader.get().await != Ok(Some(refreshed_bundle.clone())) {
+        assert!(
+            std::time::Instant::now() < refresh_deadline,
+            "the production refresh task should update the latest bundle"
+        );
+        tokio::task::yield_now().await;
+    }
+    let refreshed_config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .cloud_config_bundle(loader.clone())
+        .build()
+        .await
+        .expect("later session config should load the refreshed bundle");
+    assert_eq!(refreshed_config.model.as_deref(), Some("gpt-5-refreshed"));
+
+    tokio::task::yield_now().await;
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL + Duration::from_millis(1))
+        .await;
+    let failed_refresh_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    for expected_request_count in 3..=2 + CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS {
+        if expected_request_count > 3 {
+            tokio::task::yield_now().await;
+            tokio::time::advance(Duration::from_secs(2)).await;
+        }
+        while fetcher.request_count.load(Ordering::SeqCst) < expected_request_count {
+            assert!(
+                std::time::Instant::now() < failed_refresh_deadline,
+                "the production refresh task should retry the failed bundle request"
+            );
+            tokio::task::yield_now().await;
+        }
+    }
+
+    assert_eq!(loader.get().await, Ok(Some(refreshed_bundle)));
+}
+
+#[tokio::test(start_paused = true)]
+async fn refresh_stops_on_replacement_or_after_the_last_loader_clone() {
+    let codex_home = tempdir().expect("tempdir");
+    let fetcher = Arc::new(StaticBundleClient::new(test_bundle()));
+    let service = CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::clone(&fetcher),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (loader, abort_handle) =
+        crate::bundle_loader::cloud_config_bundle_loader_for_service(service);
+    let task_slot = std::sync::Mutex::new(None);
+    crate::bundle_loader::replace_refresh_task(&task_slot, abort_handle);
+    let cloned_loader = loader.clone();
+    assert_eq!(loader.get().await, Ok(Some(test_bundle())));
+    tokio::task::yield_now().await;
+
+    drop(loader);
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL + Duration::from_millis(1))
+        .await;
+    let refresh_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while fetcher.request_count.load(Ordering::SeqCst) < 2 {
+        assert!(
+            std::time::Instant::now() < refresh_deadline,
+            "the refresh should remain active while another loader clone exists"
+        );
+        tokio::task::yield_now().await;
+    }
+
+    let replacement_fetcher = Arc::new(StaticBundleClient::new(test_bundle()));
+    let replacement_service = CloudConfigBundleService::new(
+        auth_manager_with_plan_and_identity(
+            "business",
+            Some("user-replacement"),
+            Some("account-replacement"),
+        )
+        .await,
+        Arc::clone(&replacement_fetcher),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    );
+    let (replacement_loader, replacement_handle) =
+        crate::bundle_loader::cloud_config_bundle_loader_for_service(replacement_service);
+    let replacement_task = replacement_handle.clone();
+    crate::bundle_loader::replace_refresh_task(&task_slot, replacement_handle);
+    assert_eq!(replacement_loader.get().await, Ok(Some(test_bundle())));
+
+    tokio::task::yield_now().await;
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL + Duration::from_millis(1))
+        .await;
+    let refresh_deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while replacement_fetcher.request_count.load(Ordering::SeqCst) < 2 {
+        assert!(
+            std::time::Instant::now() < refresh_deadline,
+            "the replacement refresher should stay active"
+        );
+        tokio::task::yield_now().await;
+    }
+    assert_eq!(fetcher.request_count.load(Ordering::SeqCst), 2);
+
+    drop(cloned_loader);
+    tokio::task::yield_now().await;
+    assert!(!replacement_task.is_finished());
+
+    drop(replacement_loader);
+    tokio::task::yield_now().await;
+    assert!(replacement_task.is_finished());
+    tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL + Duration::from_secs(1)).await;
+    tokio::task::yield_now().await;
+    assert_eq!(replacement_fetcher.request_count.load(Ordering::SeqCst), 2);
+}
+
+#[tokio::test(start_paused = true)]
+async fn dropping_loader_cancels_in_flight_startup_and_refresh() {
+    for starts_from_cache in [false, true] {
+        let codex_home = tempdir().expect("tempdir");
+        if starts_from_cache {
+            create_test_cache(codex_home.path())
+                .save(
+                    Some("user-12345".to_string()),
+                    Some("account-12345".to_string()),
+                    test_bundle(),
+                )
+                .await
+                .expect("write initial cache");
+        }
+        let request_started = Arc::new(tokio::sync::Notify::new());
+        let request_cancelled = Arc::new(tokio::sync::Notify::new());
+        let service = CloudConfigBundleService::new(
+            auth_manager_with_plan("business").await,
+            Arc::new(NotifyingPendingBundleClient {
+                request_started: Arc::clone(&request_started),
+                request_cancelled: Arc::clone(&request_cancelled),
+            }),
+            codex_home.path().to_path_buf(),
+            CLOUD_CONFIG_BUNDLE_TIMEOUT,
+        );
+        let (loader, _) = crate::bundle_loader::cloud_config_bundle_loader_for_service(service);
+        if starts_from_cache {
+            assert_eq!(loader.get().await, Ok(Some(test_bundle())));
+            tokio::task::yield_now().await;
+            tokio::time::advance(CLOUD_CONFIG_BUNDLE_CACHE_REFRESH_INTERVAL).await;
+        }
+        request_started.notified().await;
+
+        drop(loader);
+
+        tokio::time::timeout(Duration::from_secs(1), request_cancelled.notified())
+            .await
+            .expect("loader drop should cancel the in-flight fetch");
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn refresh_can_clear_preserve_and_restore_the_latest_bundle() {
+    let codex_home = tempdir().expect("tempdir");
+    let mut responses = vec![Ok(test_bundle()), Ok(CloudConfigBundle::default())];
+    responses.extend(vec![Err(request_error()); CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS]);
+    responses.push(Ok(test_bundle()));
+    let service = Arc::new(CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::new(SequenceBundleClient::new(responses)),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    ));
+
+    assert_eq!(service.get_latest().await, Ok(Some(test_bundle())));
+    assert!(service.refresh_cache_once().await);
+    assert_eq!(service.get_latest().await, Ok(None));
+
+    let refresh_service = Arc::clone(&service);
+    let refresh = tokio::spawn(async move { refresh_service.refresh_cache_once().await });
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(5)).await;
+    tokio::task::yield_now().await;
+    assert!(refresh.await.expect("failed refresh task"));
+    assert_eq!(service.get_latest().await, Ok(None));
+
+    assert!(service.refresh_cache_once().await);
+    assert_eq!(service.get_latest().await, Ok(Some(test_bundle())));
+}
+
+#[tokio::test(start_paused = true)]
+async fn refresh_replaces_initial_errors_and_recovers_with_success() {
+    let codex_home = tempdir().expect("tempdir");
+    let initial_error = BundleRequestError::Retryable(RetryableFailureKind::Request {
+        status_code: Some(500),
+    });
+    let refresh_error = BundleRequestError::Retryable(RetryableFailureKind::Request {
+        status_code: Some(503),
+    });
+    let mut responses = vec![Err(initial_error); CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS];
+    responses.extend(vec![Err(refresh_error); CLOUD_CONFIG_BUNDLE_MAX_ATTEMPTS]);
+    responses.push(Ok(test_bundle()));
+    let service = Arc::new(CloudConfigBundleService::new(
+        auth_manager_with_plan("business").await,
+        Arc::new(SequenceBundleClient::new(responses)),
+        codex_home.path().to_path_buf(),
+        CLOUD_CONFIG_BUNDLE_TIMEOUT,
+    ));
+
+    let initial_service = Arc::clone(&service);
+    let initial = tokio::spawn(async move { initial_service.get_latest().await });
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(5)).await;
+    tokio::task::yield_now().await;
+    let initial_error = initial
+        .await
+        .expect("initial task")
+        .expect_err("initial fetch should fail");
+    assert_eq!(initial_error.status_code(), Some(500));
+
+    let refresh_service = Arc::clone(&service);
+    let refresh = tokio::spawn(async move { refresh_service.refresh_cache_once().await });
+    tokio::task::yield_now().await;
+    tokio::time::advance(Duration::from_secs(5)).await;
+    tokio::task::yield_now().await;
+    assert!(refresh.await.expect("failed refresh task"));
+    let latest_error = service
+        .get_latest()
+        .await
+        .expect_err("latest failed refresh should replace the initial error");
+    assert_eq!(latest_error.status_code(), Some(503));
+
+    assert!(service.refresh_cache_once().await);
+    assert_eq!(service.get_latest().await, Ok(Some(test_bundle())));
+}
+
+#[test]
+fn bundle_response_conversion_preserves_fragment_order() {
+    let response = ConfigBundleResponse {
+        config_toml: Some(Some(Box::new(codex_backend_client::DeliveredConfigToml {
+            enterprise_managed: Some(Some(vec![
+                DeliveredTomlFragment::new(
+                    "cfg_high".to_string(),
+                    "High config".to_string(),
+                    "model = \"high\"".to_string(),
+                ),
+                DeliveredTomlFragment::new(
+                    "cfg_low".to_string(),
+                    "Low config".to_string(),
+                    "model = \"low\"".to_string(),
+                ),
+            ])),
+            managed_layers: None,
+        }))),
+        requirements_toml: Some(Some(Box::new(
+            codex_backend_client::DeliveredRequirementsToml {
+                enterprise_managed: Some(Some(vec![DeliveredTomlFragment::new(
+                    "req_high".to_string(),
+                    "High requirements".to_string(),
+                    "allowed_approval_policies = [\"never\"]".to_string(),
+                )])),
+                managed_layers: None,
+            },
+        ))),
+    };
+
+    assert_eq!(
+        bundle_from_response(response),
+        CloudConfigBundle {
+            config_toml: CloudConfigTomlBundle {
+                enterprise_managed: vec![
+                    CloudConfigFragment {
+                        id: "cfg_high".to_string(),
+                        name: "High config".to_string(),
+                        contents: "model = \"high\"".to_string(),
+                    },
+                    CloudConfigFragment {
+                        id: "cfg_low".to_string(),
+                        name: "Low config".to_string(),
+                        contents: "model = \"low\"".to_string(),
+                    },
+                ],
+            },
+            requirements_toml: CloudRequirementsTomlBundle {
+                enterprise_managed: vec![CloudRequirementsFragment {
+                    id: "req_high".to_string(),
+                    name: "High requirements".to_string(),
+                    contents: "allowed_approval_policies = [\"never\"]".to_string(),
+                }],
+            },
+        }
+    );
+}
+
+#[test]
+fn bundle_response_conversion_treats_missing_sections_as_empty() {
+    assert_eq!(
+        bundle_from_response(ConfigBundleResponse::new()),
+        CloudConfigBundle::default()
+    );
+}

codex-rs/cloud-config/src/validation.rs

@@ -0,0 +1,48 @@
+use codex_config::AbsolutePathBuf;
+use codex_config::CloudConfigBundle;
+use codex_config::CloudConfigBundleLayers;
+use codex_config::CloudConfigBundleLoadError;
+use codex_config::CloudConfigBundleLoadErrorCode;
+use codex_config::compose_requirements;
+use codex_config::config_toml::validate_model_providers;
+
+pub(crate) fn validate_bundle(
+    bundle: &CloudConfigBundle,
+    base_dir: &AbsolutePathBuf,
+) -> Result<(), CloudConfigBundleLoadError> {
+    let bundle_layers =
+        CloudConfigBundleLayers::from_bundle(bundle.clone(), base_dir).map_err(|err| {
+            CloudConfigBundleLoadError::new(
+                CloudConfigBundleLoadErrorCode::InvalidBundle,
+                /*status_code*/ None,
+                format!("invalid cloud config bundle: {err}"),
+            )
+        })?;
+    let CloudConfigBundleLayers {
+        enterprise_managed_config: _,
+        enterprise_managed_requirements,
+    } = bundle_layers;
+
+    let requirements = compose_requirements(enterprise_managed_requirements).map_err(|err| {
+        CloudConfigBundleLoadError::new(
+            CloudConfigBundleLoadErrorCode::InvalidBundle,
+            /*status_code*/ None,
+            format!("invalid cloud config bundle: {err}"),
+        )
+    })?;
+    if let Some(providers) = requirements.and_then(|requirements| requirements.model_providers) {
+        validate_model_providers(&providers).map_err(|err| {
+            CloudConfigBundleLoadError::new(
+                CloudConfigBundleLoadErrorCode::InvalidBundle,
+                /*status_code*/ None,
+                format!("invalid cloud config bundle: {err}"),
+            )
+        })?;
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+#[path = "validation_tests.rs"]
+mod tests;

codex-rs/cloud-config/src/validation_tests.rs

@@ -0,0 +1,51 @@
+use super::*;
+use codex_config::CloudRequirementsFragment;
+use pretty_assertions::assert_eq;
+use tempfile::tempdir;
+
+#[test]
+fn cloud_fragments_combine_before_provider_validation() {
+    let home = tempdir().expect("tempdir");
+    let base_dir = AbsolutePathBuf::from_absolute_path(home.path()).expect("absolute path");
+    let mut bundle = CloudConfigBundle::default();
+    // Cloud fragments arrive highest-priority first.
+    bundle.requirements_toml.enterprise_managed = vec![
+        CloudRequirementsFragment {
+            id: "high".to_string(),
+            name: "URL".to_string(),
+            contents: "[model_providers.gateway]\nbase_url = 'https://gateway.example/v1'\n[model_providers.gateway.auth]\ntimeout_ms = 10000\ncwd = 'auth'"
+                .to_string(),
+        },
+        CloudRequirementsFragment {
+            id: "low".to_string(),
+            name: "Name".to_string(),
+            contents: "[model_providers.gateway]\nname = 'Gateway'\n[model_providers.gateway.auth]\ncommand = 'get-token'".to_string(),
+        },
+    ];
+    assert_eq!(validate_bundle(&bundle, &base_dir), Ok(()));
+}
+
+#[test]
+fn cloud_bedrock_overrides_accept_supported_fields() {
+    let home = tempdir().expect("tempdir");
+    let base_dir = AbsolutePathBuf::from_absolute_path(home.path()).expect("absolute path");
+    for provider in ["amazon-bedrock", "amazon-bedrock-runtime"] {
+        let mut bundle = CloudConfigBundle::default();
+        bundle.requirements_toml.enterprise_managed = vec![CloudRequirementsFragment {
+            id: "bedrock".to_string(),
+            name: "Bedrock".to_string(),
+            contents: format!(
+                r#"
+[model_providers.{provider}]
+base_url = "https://bedrock.example"
+[model_providers.{provider}.http_headers]
+X-Managed = "required"
+[model_providers.{provider}.aws]
+profile = "managed"
+region = "us-east-1"
+"#
+            ),
+        }];
+        assert_eq!(validate_bundle(&bundle, &base_dir), Ok(()));
+    }
+}

codex-rs/codex-backend-openapi-models/src/lib.rs

@@ -0,0 +1,6 @@
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+// Re-export generated OpenAPI models.
+// The regen script populates `src/models/*.rs` and writes `src/models/mod.rs`.
+// This module intentionally contains no hand-written types.
+pub mod models;

codex-rs/codex-backend-openapi-models/src/models/additional_rate_limit_details.rs

@@ -0,0 +1,38 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct AdditionalRateLimitDetails {
+    #[serde(rename = "limit_name")]
+    pub limit_name: String,
+    #[serde(rename = "metered_feature")]
+    pub metered_feature: String,
+    #[serde(
+        rename = "rate_limit",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub rate_limit: Option<Option<Box<models::RateLimitStatusDetails>>>,
+}
+
+impl AdditionalRateLimitDetails {
+    pub fn new(limit_name: String, metered_feature: String) -> AdditionalRateLimitDetails {
+        AdditionalRateLimitDetails {
+            limit_name,
+            metered_feature,
+            rate_limit: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/analytics.rs

@@ -0,0 +1,230 @@
+// Generated by scripts/generate_analytics_models.py; do not edit.
+// Selected backend schema SHA-256: 8dad4dcab85a89fd8091236929727587118dcaad334e10148ae8cf95dd640cc8
+// String enums remain open for forward compatibility.
+
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ActiveUsersSummary {
+    pub total_users: i64,
+    pub clients: Vec<ClientActiveUsersCount>,
+    pub models: Option<Vec<ModelActivitySummary>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ClientActiveUsersCount {
+    pub client_id: String,
+    pub users: i64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ClientWorkspaceUsageCount {
+    pub client_id: String,
+    pub users: i64,
+    pub threads: i64,
+    pub turns: i64,
+    pub credits: f64,
+    pub cost_usd: Option<String>,
+    pub on_demand_credits: Option<f64>,
+    pub uncached_text_input_tokens: Option<i64>,
+    pub cached_text_input_tokens: Option<i64>,
+    pub text_output_tokens: Option<i64>,
+    pub text_total_tokens: Option<i64>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ConsumptionUsageGroup {
+    pub dimensions: std::collections::BTreeMap<String, String>,
+    pub is_other: Option<bool>,
+    pub credits: f64,
+    pub on_demand_credits: Option<f64>,
+    pub uncached_text_input_tokens: Option<i64>,
+    pub cached_text_input_tokens: Option<i64>,
+    pub text_output_tokens: Option<i64>,
+    pub text_total_tokens: Option<i64>,
+    pub total_tokens: Option<i64>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CreditUsageEventBySurface {
+    pub date: String,
+    pub product_surface: String,
+    pub credit_amount: f64,
+    pub usage_id: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CreditUsageEventsResponse {
+    pub data: Vec<CreditUsageEventBySurface>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CurrentUserCreditUsageDatum {
+    pub date: String,
+    pub values: std::collections::BTreeMap<String, f64>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CurrentUserCreditUsageResponse {
+    pub breakdown: String,
+    pub data: Vec<CurrentUserCreditUsageDatum>,
+    pub series: Vec<CurrentUserCreditUsageSeries>,
+    pub unit: Option<String>,
+    pub data_freshness_ts: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct CurrentUserCreditUsageSeries {
+    pub key: String,
+    pub label: String,
+    pub total: f64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailyProductSurfaceUsage {
+    pub attribution: Option<Vec<PersonalUsageAttribution>>,
+    pub date: String,
+    pub product_surface_usage_values: std::collections::BTreeMap<String, f64>,
+    pub premium_usage_values: Option<ProductSurfacePremiumUsageValues>,
+    pub models: Option<Vec<ModelUsage>>,
+    pub groups: Option<Vec<ConsumptionUsageGroup>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailyProductSurfaceUsageResponse {
+    pub data: Vec<DailyProductSurfaceUsage>,
+    pub units: Option<String>,
+    pub data_freshness_ts: Option<String>,
+    pub group_by: Option<String>,
+    pub breakdown_by: Option<Vec<String>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailySkillUsageMetricsResponse {
+    pub data: Vec<DailySkillUsageOverview>,
+    pub data_freshness_ts: Option<String>,
+    pub group_by: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailySkillUsageOverview {
+    pub date: String,
+    pub skill_usage_overviews: Vec<SkillUsageOverview>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailyWorkspaceUsageCount {
+    pub date: String,
+    pub totals: WorkspaceUsageCount,
+    pub clients: Vec<ClientWorkspaceUsageCount>,
+    pub models: Option<Vec<ModelUsage>>,
+    pub groups: Option<Vec<WorkspaceUsageGroup>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct DailyWorkspaceUsageCountResponse {
+    pub data: Vec<DailyWorkspaceUsageCount>,
+    pub balance_unit: Option<String>,
+    pub active_users_summary: Option<ActiveUsersSummary>,
+    pub group_by: Option<String>,
+    pub breakdown_by: Option<Vec<String>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ModelActivitySummary {
+    pub model: String,
+    pub users: i64,
+    pub threads: i64,
+    pub turns: i64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ModelUsage {
+    pub model: String,
+    pub speed: Option<String>,
+    pub credits: f64,
+    pub cost_usd: Option<String>,
+    pub users: Option<i64>,
+    pub threads: Option<i64>,
+    pub turns: Option<i64>,
+    pub on_demand_credits: Option<f64>,
+    pub uncached_text_input_tokens: Option<i64>,
+    pub cached_text_input_tokens: Option<i64>,
+    pub text_output_tokens: Option<i64>,
+    pub text_total_tokens: Option<i64>,
+    pub total_tokens: Option<i64>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PersonalUsageAttribution {
+    pub thread_source: String,
+    pub turn_trigger: String,
+    pub model: String,
+    pub surface: String,
+    pub value: f64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PluginUsageBucket {
+    pub date: String,
+    pub plugin_usage_overviews: Vec<PluginUsageOverview>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PluginUsageMetricsResponse {
+    pub data: Vec<PluginUsageBucket>,
+    pub data_freshness_ts: Option<String>,
+    pub group_by: Option<String>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct PluginUsageOverview {
+    pub plugin_id: Option<String>,
+    pub plugin_name: String,
+    pub display_name: String,
+    pub marketplace: Option<String>,
+    pub invocation_counts: i64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct ProductSurfacePremiumUsageValues {
+    pub total_usage_credits: std::collections::BTreeMap<String, f64>,
+    pub credit_usage_credits: std::collections::BTreeMap<String, f64>,
+    pub uncached_text_input_tokens_by_surface: std::collections::BTreeMap<String, i64>,
+    pub cached_text_input_tokens_by_surface: std::collections::BTreeMap<String, i64>,
+    pub text_output_tokens_by_surface: std::collections::BTreeMap<String, i64>,
+    pub text_total_tokens_by_surface: std::collections::BTreeMap<String, i64>,
+    pub total_tokens_by_surface: Option<std::collections::BTreeMap<String, i64>>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct SkillUsageOverview {
+    pub skill_name: String,
+    pub display_name: String,
+    pub skill_ids: Vec<String>,
+    pub invocation_counts: i64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct WorkspaceUsageCount {
+    pub users: i64,
+    pub threads: i64,
+    pub turns: i64,
+    pub credits: f64,
+    pub cost_usd: Option<String>,
+    pub on_demand_credits: Option<f64>,
+    pub uncached_text_input_tokens: Option<i64>,
+    pub cached_text_input_tokens: Option<i64>,
+    pub text_output_tokens: Option<i64>,
+    pub text_total_tokens: Option<i64>,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct WorkspaceUsageGroup {
+    pub dimensions: std::collections::BTreeMap<String, String>,
+    pub is_other: Option<bool>,
+    pub users: i64,
+    pub turns: i64,
+    pub cost_usd: Option<String>,
+}

codex-rs/codex-backend-openapi-models/src/models/code_task_details_response.rs

@@ -0,0 +1,42 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct CodeTaskDetailsResponse {
+    #[serde(rename = "task")]
+    pub task: Box<models::TaskResponse>,
+    #[serde(rename = "current_user_turn", skip_serializing_if = "Option::is_none")]
+    pub current_user_turn: Option<std::collections::HashMap<String, serde_json::Value>>,
+    #[serde(
+        rename = "current_assistant_turn",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub current_assistant_turn: Option<std::collections::HashMap<String, serde_json::Value>>,
+    #[serde(
+        rename = "current_diff_task_turn",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub current_diff_task_turn: Option<std::collections::HashMap<String, serde_json::Value>>,
+}
+
+impl CodeTaskDetailsResponse {
+    pub fn new(task: models::TaskResponse) -> CodeTaskDetailsResponse {
+        CodeTaskDetailsResponse {
+            task: Box::new(task),
+            current_user_turn: None,
+            current_assistant_turn: None,
+            current_diff_task_turn: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/config_bundle_response.rs

@@ -0,0 +1,40 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ConfigBundleResponse {
+    #[serde(
+        rename = "config_toml",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub config_toml: Option<Option<Box<models::DeliveredConfigToml>>>,
+    #[serde(
+        rename = "requirements_toml",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub requirements_toml: Option<Option<Box<models::DeliveredRequirementsToml>>>,
+}
+
+impl ConfigBundleResponse {
+    pub fn new() -> ConfigBundleResponse {
+        ConfigBundleResponse {
+            config_toml: None,
+            requirements_toml: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/config_file_response.rs

@@ -0,0 +1,40 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ConfigFileResponse {
+    #[serde(rename = "contents", skip_serializing_if = "Option::is_none")]
+    pub contents: Option<String>,
+    #[serde(rename = "sha256", skip_serializing_if = "Option::is_none")]
+    pub sha256: Option<String>,
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<String>,
+    #[serde(rename = "updated_by_user_id", skip_serializing_if = "Option::is_none")]
+    pub updated_by_user_id: Option<String>,
+}
+
+impl ConfigFileResponse {
+    pub fn new(
+        contents: Option<String>,
+        sha256: Option<String>,
+        updated_at: Option<String>,
+        updated_by_user_id: Option<String>,
+    ) -> ConfigFileResponse {
+        ConfigFileResponse {
+            contents,
+            sha256,
+            updated_at,
+            updated_by_user_id,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/credit_status_details.rs

@@ -0,0 +1,52 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct CreditStatusDetails {
+    #[serde(rename = "has_credits")]
+    pub has_credits: bool,
+    #[serde(rename = "unlimited")]
+    pub unlimited: bool,
+    #[serde(
+        rename = "balance",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub balance: Option<Option<String>>,
+    #[serde(
+        rename = "approx_local_messages",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub approx_local_messages: Option<Option<Vec<serde_json::Value>>>,
+    #[serde(
+        rename = "approx_cloud_messages",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub approx_cloud_messages: Option<Option<Vec<serde_json::Value>>>,
+}
+
+impl CreditStatusDetails {
+    pub fn new(has_credits: bool, unlimited: bool) -> CreditStatusDetails {
+        CreditStatusDetails {
+            has_credits,
+            unlimited,
+            balance: None,
+            approx_local_messages: None,
+            approx_cloud_messages: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/delivered_config_toml.rs

@@ -0,0 +1,40 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct DeliveredConfigToml {
+    #[serde(
+        rename = "enterprise_managed",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub enterprise_managed: Option<Option<Vec<models::DeliveredTomlFragment>>>,
+    #[serde(
+        rename = "managed_layers",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub managed_layers: Option<Option<Box<models::DeliveredManagedLayers>>>,
+}
+
+impl DeliveredConfigToml {
+    pub fn new() -> DeliveredConfigToml {
+        DeliveredConfigToml {
+            enterprise_managed: None,
+            managed_layers: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/delivered_managed_layers.rs

@@ -0,0 +1,33 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct DeliveredManagedLayers {
+    #[serde(rename = "baseline")]
+    pub baseline: Vec<models::DeliveredTomlFragment>,
+    #[serde(rename = "system_overlay")]
+    pub system_overlay: Vec<models::DeliveredTomlFragment>,
+}
+
+impl DeliveredManagedLayers {
+    pub fn new(
+        baseline: Vec<models::DeliveredTomlFragment>,
+        system_overlay: Vec<models::DeliveredTomlFragment>,
+    ) -> DeliveredManagedLayers {
+        DeliveredManagedLayers {
+            baseline,
+            system_overlay,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/delivered_requirements_toml.rs

@@ -0,0 +1,40 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct DeliveredRequirementsToml {
+    #[serde(
+        rename = "enterprise_managed",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub enterprise_managed: Option<Option<Vec<models::DeliveredTomlFragment>>>,
+    #[serde(
+        rename = "managed_layers",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub managed_layers: Option<Option<Box<models::DeliveredManagedLayers>>>,
+}
+
+impl DeliveredRequirementsToml {
+    pub fn new() -> DeliveredRequirementsToml {
+        DeliveredRequirementsToml {
+            enterprise_managed: None,
+            managed_layers: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/delivered_toml_fragment.rs

@@ -0,0 +1,28 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct DeliveredTomlFragment {
+    #[serde(rename = "id")]
+    pub id: String,
+    #[serde(rename = "name")]
+    pub name: String,
+    #[serde(rename = "contents")]
+    pub contents: String,
+}
+
+impl DeliveredTomlFragment {
+    pub fn new(id: String, name: String, contents: String) -> DeliveredTomlFragment {
+        DeliveredTomlFragment { id, name, contents }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/external_pull_request_response.rs

@@ -0,0 +1,40 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ExternalPullRequestResponse {
+    #[serde(rename = "id")]
+    pub id: String,
+    #[serde(rename = "assistant_turn_id")]
+    pub assistant_turn_id: String,
+    #[serde(rename = "pull_request")]
+    pub pull_request: Box<models::GitPullRequest>,
+    #[serde(rename = "codex_updated_sha", skip_serializing_if = "Option::is_none")]
+    pub codex_updated_sha: Option<String>,
+}
+
+impl ExternalPullRequestResponse {
+    pub fn new(
+        id: String,
+        assistant_turn_id: String,
+        pull_request: models::GitPullRequest,
+    ) -> ExternalPullRequestResponse {
+        ExternalPullRequestResponse {
+            id,
+            assistant_turn_id,
+            pull_request: Box::new(pull_request),
+            codex_updated_sha: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/git_pull_request.rs

@@ -0,0 +1,77 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct GitPullRequest {
+    #[serde(rename = "number")]
+    pub number: i32,
+    #[serde(rename = "url")]
+    pub url: String,
+    #[serde(rename = "state")]
+    pub state: String,
+    #[serde(rename = "merged")]
+    pub merged: bool,
+    #[serde(rename = "mergeable")]
+    pub mergeable: bool,
+    #[serde(rename = "draft", skip_serializing_if = "Option::is_none")]
+    pub draft: Option<bool>,
+    #[serde(rename = "title", skip_serializing_if = "Option::is_none")]
+    pub title: Option<String>,
+    #[serde(rename = "body", skip_serializing_if = "Option::is_none")]
+    pub body: Option<String>,
+    #[serde(rename = "base", skip_serializing_if = "Option::is_none")]
+    pub base: Option<String>,
+    #[serde(rename = "head", skip_serializing_if = "Option::is_none")]
+    pub head: Option<String>,
+    #[serde(rename = "base_sha", skip_serializing_if = "Option::is_none")]
+    pub base_sha: Option<String>,
+    #[serde(rename = "head_sha", skip_serializing_if = "Option::is_none")]
+    pub head_sha: Option<String>,
+    #[serde(rename = "merge_commit_sha", skip_serializing_if = "Option::is_none")]
+    pub merge_commit_sha: Option<String>,
+    #[serde(rename = "comments", skip_serializing_if = "Option::is_none")]
+    pub comments: Option<serde_json::Value>,
+    #[serde(rename = "diff", skip_serializing_if = "Option::is_none")]
+    pub diff: Option<serde_json::Value>,
+    #[serde(rename = "user", skip_serializing_if = "Option::is_none")]
+    pub user: Option<serde_json::Value>,
+}
+
+impl GitPullRequest {
+    pub fn new(
+        number: i32,
+        url: String,
+        state: String,
+        merged: bool,
+        mergeable: bool,
+    ) -> GitPullRequest {
+        GitPullRequest {
+            number,
+            url,
+            state,
+            merged,
+            mergeable,
+            draft: None,
+            title: None,
+            body: None,
+            base: None,
+            head: None,
+            base_sha: None,
+            head_sha: None,
+            merge_commit_sha: None,
+            comments: None,
+            diff: None,
+            user: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/mod.rs

@@ -0,0 +1,68 @@
+pub mod analytics;
+// Curated minimal export list for current workspace usage.
+// NOTE: This file was previously auto-generated by the OpenAPI generator.
+// Currently export only the types referenced by the workspace
+// The process for this will change
+
+// Config
+pub(crate) mod config_bundle_response;
+pub use self::config_bundle_response::ConfigBundleResponse;
+
+pub(crate) mod config_file_response;
+pub use self::config_file_response::ConfigFileResponse;
+
+pub(crate) mod delivered_config_toml;
+pub use self::delivered_config_toml::DeliveredConfigToml;
+
+pub(crate) mod delivered_managed_layers;
+pub use self::delivered_managed_layers::DeliveredManagedLayers;
+
+pub(crate) mod delivered_requirements_toml;
+pub use self::delivered_requirements_toml::DeliveredRequirementsToml;
+
+pub(crate) mod delivered_toml_fragment;
+pub use self::delivered_toml_fragment::DeliveredTomlFragment;
+
+// Cloud Tasks
+pub(crate) mod code_task_details_response;
+pub use self::code_task_details_response::CodeTaskDetailsResponse;
+
+pub(crate) mod task_response;
+pub use self::task_response::TaskResponse;
+
+pub(crate) mod external_pull_request_response;
+pub use self::external_pull_request_response::ExternalPullRequestResponse;
+
+pub(crate) mod git_pull_request;
+pub use self::git_pull_request::GitPullRequest;
+
+pub(crate) mod task_list_item;
+pub use self::task_list_item::TaskListItem;
+
+pub(crate) mod paginated_list_task_list_item_;
+pub use self::paginated_list_task_list_item_::PaginatedListTaskListItem;
+
+// Rate Limits
+pub(crate) mod additional_rate_limit_details;
+pub use self::additional_rate_limit_details::AdditionalRateLimitDetails;
+
+pub(crate) mod rate_limit_status_payload;
+pub use self::rate_limit_status_payload::PlanType;
+pub use self::rate_limit_status_payload::RateLimitReachedKind;
+pub use self::rate_limit_status_payload::RateLimitReachedType;
+pub use self::rate_limit_status_payload::RateLimitStatusPayload;
+
+pub(crate) mod rate_limit_status_details;
+pub use self::rate_limit_status_details::RateLimitStatusDetails;
+
+pub(crate) mod rate_limit_window_snapshot;
+pub use self::rate_limit_window_snapshot::RateLimitWindowSnapshot;
+
+pub(crate) mod credit_status_details;
+pub use self::credit_status_details::CreditStatusDetails;
+
+pub(crate) mod spend_control_limit_details;
+pub use self::spend_control_limit_details::SpendControlLimitDetails;
+
+pub(crate) mod spend_control_status_details;
+pub use self::spend_control_status_details::SpendControlStatusDetails;

codex-rs/codex-backend-openapi-models/src/models/paginated_list_task_list_item_.rs

@@ -0,0 +1,30 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct PaginatedListTaskListItem {
+    #[serde(rename = "items")]
+    pub items: Vec<models::TaskListItem>,
+    #[serde(rename = "cursor", skip_serializing_if = "Option::is_none")]
+    pub cursor: Option<String>,
+}
+
+impl PaginatedListTaskListItem {
+    pub fn new(items: Vec<models::TaskListItem>) -> PaginatedListTaskListItem {
+        PaginatedListTaskListItem {
+            items,
+            cursor: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/rate_limit_status_details.rs

@@ -0,0 +1,46 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RateLimitStatusDetails {
+    #[serde(rename = "allowed")]
+    pub allowed: bool,
+    #[serde(rename = "limit_reached")]
+    pub limit_reached: bool,
+    #[serde(
+        rename = "primary_window",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub primary_window: Option<Option<Box<models::RateLimitWindowSnapshot>>>,
+    #[serde(
+        rename = "secondary_window",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub secondary_window: Option<Option<Box<models::RateLimitWindowSnapshot>>>,
+}
+
+impl RateLimitStatusDetails {
+    pub fn new(allowed: bool, limit_reached: bool) -> RateLimitStatusDetails {
+        RateLimitStatusDetails {
+            allowed,
+            limit_reached,
+            primary_window: None,
+            secondary_window: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/rate_limit_status_payload.rs

@@ -0,0 +1,143 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RateLimitStatusPayload {
+    #[serde(rename = "plan_type")]
+    pub plan_type: PlanType,
+    #[serde(
+        rename = "rate_limit",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub rate_limit: Option<Option<Box<models::RateLimitStatusDetails>>>,
+    #[serde(
+        rename = "credits",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub credits: Option<Option<Box<models::CreditStatusDetails>>>,
+    #[serde(
+        rename = "spend_control",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub spend_control: Option<Option<Box<models::SpendControlStatusDetails>>>,
+    #[serde(
+        rename = "additional_rate_limits",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub additional_rate_limits: Option<Option<Vec<models::AdditionalRateLimitDetails>>>,
+    #[serde(
+        rename = "rate_limit_reached_type",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub rate_limit_reached_type: Option<Option<RateLimitReachedType>>,
+}
+
+impl RateLimitStatusPayload {
+    pub fn new(plan_type: PlanType) -> RateLimitStatusPayload {
+        RateLimitStatusPayload {
+            plan_type,
+            rate_limit: None,
+            credits: None,
+            spend_control: None,
+            additional_rate_limits: None,
+            rate_limit_reached_type: None,
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RateLimitReachedType {
+    #[serde(rename = "type")]
+    pub kind: RateLimitReachedKind,
+}
+
+#[derive(
+    Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize, Default,
+)]
+pub enum RateLimitReachedKind {
+    #[serde(rename = "rate_limit_reached")]
+    RateLimitReached,
+    #[serde(rename = "workspace_owner_credits_depleted")]
+    WorkspaceOwnerCreditsDepleted,
+    #[serde(rename = "workspace_member_credits_depleted")]
+    WorkspaceMemberCreditsDepleted,
+    #[serde(rename = "workspace_owner_usage_limit_reached")]
+    WorkspaceOwnerUsageLimitReached,
+    #[serde(rename = "workspace_member_usage_limit_reached")]
+    WorkspaceMemberUsageLimitReached,
+    #[serde(rename = "unknown", other)]
+    #[default]
+    Unknown,
+}
+
+#[derive(
+    Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Hash, Serialize, Deserialize, Default,
+)]
+pub enum PlanType {
+    #[serde(rename = "guest")]
+    #[default]
+    Guest,
+    #[serde(rename = "free")]
+    Free,
+    #[serde(rename = "go")]
+    Go,
+    #[serde(rename = "plus")]
+    Plus,
+    #[serde(rename = "pro")]
+    Pro,
+    #[serde(rename = "prolite")]
+    ProLite,
+    #[serde(rename = "free_workspace")]
+    FreeWorkspace,
+    #[serde(rename = "team")]
+    Team,
+    #[serde(rename = "self_serve_business_prolite")]
+    SelfServeBusinessProLite,
+    #[serde(rename = "self_serve_business_usage_based")]
+    SelfServeBusinessUsageBased,
+    #[serde(rename = "business")]
+    Business,
+    #[serde(rename = "ent26")]
+    Ent26,
+    #[serde(rename = "enterprise_cbp_automation")]
+    EnterpriseCbpAutomation,
+    #[serde(rename = "enterprise_cbp_usage_based")]
+    EnterpriseCbpUsageBased,
+    #[serde(rename = "education")]
+    Education,
+    #[serde(rename = "quorum")]
+    Quorum,
+    #[serde(rename = "k12")]
+    K12,
+    #[serde(rename = "enterprise")]
+    Enterprise,
+    #[serde(rename = "edu")]
+    Edu,
+    #[serde(rename = "edu_plus")]
+    EduPlus,
+    #[serde(rename = "edu_pro")]
+    EduPro,
+    #[serde(rename = "unknown", other)]
+    Unknown,
+}

codex-rs/codex-backend-openapi-models/src/models/rate_limit_window_snapshot.rs

@@ -0,0 +1,39 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RateLimitWindowSnapshot {
+    #[serde(rename = "used_percent")]
+    pub used_percent: i32,
+    #[serde(rename = "limit_window_seconds")]
+    pub limit_window_seconds: i32,
+    #[serde(rename = "reset_after_seconds")]
+    pub reset_after_seconds: i32,
+    #[serde(rename = "reset_at")]
+    pub reset_at: i32,
+}
+
+impl RateLimitWindowSnapshot {
+    pub fn new(
+        used_percent: i32,
+        limit_window_seconds: i32,
+        reset_after_seconds: i32,
+        reset_at: i32,
+    ) -> RateLimitWindowSnapshot {
+        RateLimitWindowSnapshot {
+            used_percent,
+            limit_window_seconds,
+            reset_after_seconds,
+            reset_at,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/spend_control_limit_details.rs

@@ -0,0 +1,60 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SpendControlLimitDetails {
+    #[serde(
+        rename = "source",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub source: Option<Option<String>>,
+    #[serde(rename = "limit")]
+    pub limit: String,
+    #[serde(rename = "used")]
+    pub used: String,
+    #[serde(rename = "remaining")]
+    pub remaining: String,
+    #[serde(rename = "used_percent")]
+    pub used_percent: i32,
+    #[serde(rename = "remaining_percent")]
+    pub remaining_percent: i32,
+    #[serde(rename = "reset_after_seconds")]
+    pub reset_after_seconds: i32,
+    #[serde(rename = "reset_at")]
+    pub reset_at: i32,
+}
+
+impl SpendControlLimitDetails {
+    pub fn new(
+        limit: String,
+        used: String,
+        remaining: String,
+        used_percent: i32,
+        remaining_percent: i32,
+        reset_after_seconds: i32,
+        reset_at: i32,
+    ) -> SpendControlLimitDetails {
+        SpendControlLimitDetails {
+            source: None,
+            limit,
+            used,
+            remaining,
+            used_percent,
+            remaining_percent,
+            reset_after_seconds,
+            reset_at,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/spend_control_status_details.rs

@@ -0,0 +1,35 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SpendControlStatusDetails {
+    #[serde(rename = "reached")]
+    pub reached: bool,
+    #[serde(
+        rename = "individual_limit",
+        default,
+        with = "::serde_with::rust::double_option",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub individual_limit: Option<Option<Box<models::SpendControlLimitDetails>>>,
+}
+
+impl SpendControlStatusDetails {
+    pub fn new(reached: bool) -> SpendControlStatusDetails {
+        SpendControlStatusDetails {
+            reached,
+            individual_limit: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/task_list_item.rs

@@ -0,0 +1,63 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct TaskListItem {
+    #[serde(rename = "id")]
+    pub id: String,
+    #[serde(rename = "title")]
+    pub title: String,
+    #[serde(
+        rename = "has_generated_title",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub has_generated_title: Option<bool>,
+    #[serde(rename = "updated_at", skip_serializing_if = "Option::is_none")]
+    pub updated_at: Option<f64>,
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<f64>,
+    #[serde(
+        rename = "task_status_display",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub task_status_display: Option<std::collections::HashMap<String, serde_json::Value>>,
+    #[serde(rename = "archived")]
+    pub archived: bool,
+    #[serde(rename = "has_unread_turn")]
+    pub has_unread_turn: bool,
+    #[serde(rename = "pull_requests", skip_serializing_if = "Option::is_none")]
+    pub pull_requests: Option<Vec<models::ExternalPullRequestResponse>>,
+}
+
+impl TaskListItem {
+    pub fn new(
+        id: String,
+        title: String,
+        has_generated_title: Option<bool>,
+        archived: bool,
+        has_unread_turn: bool,
+    ) -> TaskListItem {
+        TaskListItem {
+            id,
+            title,
+            has_generated_title,
+            updated_at: None,
+            created_at: None,
+            task_status_display: None,
+            archived,
+            has_unread_turn,
+            pull_requests: None,
+        }
+    }
+}

codex-rs/codex-backend-openapi-models/src/models/task_response.rs

@@ -0,0 +1,62 @@
+/*
+ * codex-backend
+ *
+ * codex-backend
+ *
+ * The version of the OpenAPI document: 0.0.1
+ *
+ * Generated by: https://openapi-generator.tech
+ */
+
+use crate::models;
+use serde::Deserialize;
+use serde::Serialize;
+
+#[derive(Clone, Default, Debug, PartialEq, Serialize, Deserialize)]
+pub struct TaskResponse {
+    #[serde(rename = "id")]
+    pub id: String,
+    #[serde(rename = "created_at", skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<f64>,
+    #[serde(rename = "title")]
+    pub title: String,
+    #[serde(
+        rename = "has_generated_title",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub has_generated_title: Option<bool>,
+    #[serde(rename = "current_turn_id", skip_serializing_if = "Option::is_none")]
+    pub current_turn_id: Option<String>,
+    #[serde(rename = "has_unread_turn", skip_serializing_if = "Option::is_none")]
+    pub has_unread_turn: Option<bool>,
+    #[serde(
+        rename = "denormalized_metadata",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub denormalized_metadata: Option<std::collections::HashMap<String, serde_json::Value>>,
+    #[serde(rename = "archived")]
+    pub archived: bool,
+    #[serde(rename = "external_pull_requests")]
+    pub external_pull_requests: Vec<models::ExternalPullRequestResponse>,
+}
+
+impl TaskResponse {
+    pub fn new(
+        id: String,
+        title: String,
+        archived: bool,
+        external_pull_requests: Vec<models::ExternalPullRequestResponse>,
+    ) -> TaskResponse {
+        TaskResponse {
+            id,
+            created_at: None,
+            title,
+            has_generated_title: None,
+            current_turn_id: None,
+            has_unread_turn: None,
+            denormalized_metadata: None,
+            archived,
+            external_pull_requests,
+        }
+    }
+}

codex-rs/config-schema/src/main.rs

@@ -0,0 +1,22 @@
+//! Generates the canonical config schema fixture for development and releases.
+
+use anyhow::Result;
+use clap::Parser;
+use std::path::PathBuf;
+
+/// Generate the JSON Schema for `config.toml` and write it to `config.schema.json`.
+#[derive(Parser)]
+#[command(name = "codex-write-config-schema")]
+struct Args {
+    #[arg(short, long, value_name = "PATH")]
+    out: Option<PathBuf>,
+}
+
+fn main() -> Result<()> {
+    let args = Args::parse();
+    let out_path = args.out.unwrap_or_else(|| {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../core/config.schema.json")
+    });
+    codex_config::schema::write_config_schema(&out_path)?;
+    Ok(())
+}

codex-rs/config/src/application_requirements.rs

@@ -0,0 +1,71 @@
+//! Managed application destinations are independent of agent network permissions.
+//! Enabled policies deny unlisted domains and use normal managed TOML precedence.
+
+use crate::NetworkDomainPermissionToml;
+use serde::Deserialize;
+use serde::de::Error;
+use std::collections::BTreeMap;
+
+#[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
+pub struct ApplicationRequirementsToml {
+    pub network: Option<ApplicationNetworkRequirementsToml>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ApplicationNetworkRequirementsToml {
+    pub enabled: bool,
+    pub domains: BTreeMap<String, NetworkDomainPermissionToml>,
+}
+
+impl<'de> Deserialize<'de> for ApplicationNetworkRequirementsToml {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(deny_unknown_fields)]
+        struct Network {
+            enabled: Option<bool>,
+            #[serde(default)]
+            domains: BTreeMap<String, NetworkDomainPermissionToml>,
+        }
+
+        let raw = Network::deserialize(deserializer)?;
+        let mut domains = BTreeMap::new();
+        for (domain, permission) in raw.domains {
+            let normalized = domain
+                .strip_suffix('.')
+                .unwrap_or(&domain)
+                .to_ascii_lowercase();
+            if normalized.len() > 253
+                || normalized.split('.').any(|label| {
+                    label.is_empty()
+                        || label.len() > 63
+                        || !label.starts_with(|c: char| c.is_ascii_alphanumeric())
+                        || !label.ends_with(|c: char| c.is_ascii_alphanumeric())
+                        || !label
+                            .bytes()
+                            .all(|c| c.is_ascii_alphanumeric() || c == b'-')
+                })
+            {
+                return Err(D::Error::custom(
+                    "application.network.domains requires exact ASCII domain names without URLs, ports, or wildcards",
+                ));
+            }
+            if domains.insert(normalized, permission).is_some() {
+                return Err(D::Error::custom(format!(
+                    "duplicate application.network domain after normalization: {domain:?}"
+                )));
+            }
+        }
+        Ok(Self {
+            enabled: raw.enabled.unwrap_or(true),
+            domains,
+        })
+    }
+}
+
+#[cfg(test)]
+#[path = "application_requirements_tests.rs"]
+mod tests;

codex-rs/config/src/bedrock_runtime_tests.rs

@@ -0,0 +1,48 @@
+use codex_model_provider_info::AMAZON_BEDROCK_RUNTIME_PROVIDER_ID;
+use codex_model_provider_info::ModelProviderAwsAuthInfo;
+use pretty_assertions::assert_eq;
+
+use super::ConfigToml;
+
+#[test]
+fn runtime_provider_accepts_aws_profile_and_region_overrides() {
+    let config = toml::from_str::<ConfigToml>(
+        r#"
+[model_providers.amazon-bedrock-runtime.aws]
+profile = "runtime-profile"
+region = "us-west-2"
+"#,
+    )
+    .expect("Bedrock Runtime AWS overrides should deserialize");
+
+    assert_eq!(
+        config
+            .model_providers
+            .get(AMAZON_BEDROCK_RUNTIME_PROVIDER_ID)
+            .and_then(|provider| provider.aws.clone()),
+        Some(ModelProviderAwsAuthInfo {
+            profile: Some("runtime-profile".to_string()),
+            region: Some("us-west-2".to_string()),
+            credential_export: None,
+            auth_refresh: None,
+        })
+    );
+}
+
+#[test]
+fn custom_provider_still_rejects_aws_auth() {
+    let error = toml::from_str::<ConfigToml>(
+        r#"
+[model_providers.custom]
+name = "Custom"
+
+[model_providers.custom.aws]
+region = "us-west-2"
+"#,
+    )
+    .expect_err("custom providers must not accept AWS auth");
+
+    assert!(error.to_string().contains(
+        "provider aws is only supported for `amazon-bedrock` or `amazon-bedrock-runtime`"
+    ));
+}

codex-rs/config/src/browser_computer_use_requirements_tests.rs

@@ -0,0 +1,45 @@
+use crate::BrowserUseRequirementsToml;
+use crate::ConfigRequirementsToml;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn webmcp_requirements_preserve_explicit_values_and_omission() {
+    for (contents, expected_browser_use, expected_empty) in [
+        ("", None, true),
+        ("[browser_use]", Some(None), true),
+        (
+            "[browser_use]\nallow_webmcp = true",
+            Some(Some(true)),
+            false,
+        ),
+        (
+            "[browser_use]\nallow_webmcp = false",
+            Some(Some(false)),
+            false,
+        ),
+    ] {
+        let requirements: ConfigRequirementsToml =
+            toml::from_str(contents).expect("parse managed WebMCP policy");
+        assert_eq!(
+            requirements,
+            ConfigRequirementsToml {
+                browser_use: expected_browser_use.map(|allow_webmcp| BrowserUseRequirementsToml {
+                    allow_webmcp,
+                    ..Default::default()
+                }),
+                ..Default::default()
+            },
+        );
+        assert_eq!(requirements.is_empty(), expected_empty, "{contents}");
+    }
+}
+
+#[test]
+fn webmcp_requirements_reject_non_booleans() {
+    for value in ["\"true\"", "1", "[]"] {
+        let contents = format!("[browser_use]\nallow_webmcp = {value}");
+        let error = toml::from_str::<ConfigRequirementsToml>(&contents)
+            .expect_err("WebMCP policy must be a boolean");
+        assert!(error.to_string().contains("allow_webmcp"));
+    }
+}

codex-rs/config/src/browser_use.rs

@@ -0,0 +1,26 @@
+use crate::AllowDenyRequirementToml;
+use schemars::JsonSchema;
+use serde::Deserialize;
+use serde::Serialize;
+use std::collections::BTreeMap;
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct BrowserUseConfigToml {
+    pub allow_history_access: Option<bool>,
+    pub default_origin_policy: Option<BrowserUseOriginPolicyConfigToml>,
+    pub origins: Option<BTreeMap<String, BrowserUseOriginPolicyConfigToml>>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct BrowserUseOriginPolicyConfigToml {
+    pub access: Option<AllowDenyRequirementToml>,
+    pub downloads: Option<AllowDenyRequirementToml>,
+    pub uploads: Option<AllowDenyRequirementToml>,
+    pub full_cdp_access: Option<AllowDenyRequirementToml>,
+}
+
+#[cfg(test)]
+#[path = "browser_use_tests.rs"]
+mod tests;

codex-rs/config/src/cloud_config_bundle.rs

@@ -0,0 +1,237 @@
+//! Cloud config bundle domain model and shared in-memory loader.
+//!
+//! The backend bundle groups cloud-delivered config and requirements fragments
+//! by source bucket. `CloudConfigBundleLayers` converts those raw buckets into
+//! layer entries while preserving each bucket's insertion semantics.
+
+use crate::CloudConfigFragment;
+use crate::ConfigLayerEntry;
+use crate::RequirementSource;
+use crate::RequirementsLayerEntry;
+use crate::cloud_config_layers::CloudConfigLayerError;
+use crate::cloud_config_layers::cloud_config_layers_from_fragments_strict;
+use crate::cloud_config_layers_from_fragments;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use futures::future::BoxFuture;
+use futures::future::FutureExt;
+use serde::Deserialize;
+use serde::Serialize;
+use std::fmt;
+use std::future::Future;
+use std::sync::Arc;
+use thiserror::Error;
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct CloudConfigBundle {
+    pub config_toml: CloudConfigTomlBundle,
+    pub requirements_toml: CloudRequirementsTomlBundle,
+}
+
+impl CloudConfigBundle {
+    pub fn is_empty(&self) -> bool {
+        let CloudConfigBundle {
+            config_toml,
+            requirements_toml,
+        } = self;
+        let CloudConfigTomlBundle {
+            enterprise_managed: config_enterprise_managed,
+        } = config_toml;
+        let CloudRequirementsTomlBundle {
+            enterprise_managed: requirements_enterprise_managed,
+        } = requirements_toml;
+
+        config_enterprise_managed.is_empty() && requirements_enterprise_managed.is_empty()
+    }
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct CloudConfigTomlBundle {
+    pub enterprise_managed: Vec<CloudConfigFragment>,
+}
+
+#[derive(Clone, Debug, Default, Deserialize, Eq, PartialEq, Serialize)]
+pub struct CloudRequirementsTomlBundle {
+    pub enterprise_managed: Vec<CloudRequirementsFragment>,
+}
+
+impl CloudRequirementsTomlBundle {
+    pub(crate) fn into_layers(self, base_dir: &AbsolutePathBuf) -> Vec<RequirementsLayerEntry> {
+        let Self { enterprise_managed } = self;
+        let mut layers = enterprise_managed
+            .into_iter()
+            .map(|fragment| {
+                RequirementsLayerEntry::from_toml(
+                    RequirementSource::EnterpriseManaged {
+                        id: fragment.id,
+                        name: fragment.name,
+                    },
+                    fragment.contents,
+                )
+                .with_base_dir(base_dir.clone())
+            })
+            .collect::<Vec<_>>();
+        // Bundle fragments arrive highest-priority first, while requirements
+        // layers are merged lowest-priority to highest-priority.
+        layers.reverse();
+        layers
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct CloudRequirementsFragment {
+    pub id: String,
+    pub name: String,
+    pub contents: String,
+}
+
+/// Cloud config bundle converted into semantic layer buckets.
+///
+/// This is not a final config stack. Callers still decide where each bucket is
+/// inserted relative to local/system/user layers.
+#[derive(Clone, Debug)]
+pub struct CloudConfigBundleLayers {
+    /// Enterprise-managed config layers in `ConfigLayerStack` order.
+    pub enterprise_managed_config: Vec<ConfigLayerEntry>,
+    /// Enterprise-managed requirements layers in requirements layer merge order.
+    pub enterprise_managed_requirements: Vec<RequirementsLayerEntry>,
+}
+
+impl CloudConfigBundleLayers {
+    pub fn from_bundle(
+        bundle: CloudConfigBundle,
+        base_dir: &AbsolutePathBuf,
+    ) -> Result<Self, CloudConfigLayerError> {
+        Self::from_bundle_impl(bundle, base_dir, /*strict_config*/ false)
+    }
+
+    pub fn from_bundle_strict_config(
+        bundle: CloudConfigBundle,
+        base_dir: &AbsolutePathBuf,
+    ) -> Result<Self, CloudConfigLayerError> {
+        Self::from_bundle_impl(bundle, base_dir, /*strict_config*/ true)
+    }
+
+    fn from_bundle_impl(
+        bundle: CloudConfigBundle,
+        base_dir: &AbsolutePathBuf,
+        strict_config: bool,
+    ) -> Result<Self, CloudConfigLayerError> {
+        // Keep this destructuring exhaustive so adding a new bundle bucket forces
+        // an explicit choice about how it becomes layer data.
+        let CloudConfigBundle {
+            config_toml:
+                CloudConfigTomlBundle {
+                    enterprise_managed: config_enterprise_managed,
+                },
+            requirements_toml,
+        } = bundle;
+
+        let enterprise_managed_config = if strict_config {
+            cloud_config_layers_from_fragments_strict(config_enterprise_managed, base_dir)?
+        } else {
+            cloud_config_layers_from_fragments(config_enterprise_managed, base_dir)?
+        };
+
+        let enterprise_managed_requirements = requirements_toml.into_layers(base_dir);
+
+        Ok(Self {
+            enterprise_managed_config,
+            enterprise_managed_requirements,
+        })
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum CloudConfigBundleLoadErrorCode {
+    Auth,
+    Timeout,
+    RequestFailed,
+    InvalidBundle,
+    Internal,
+}
+
+#[derive(Clone, Debug, Eq, Error, PartialEq)]
+#[error("{message}")]
+pub struct CloudConfigBundleLoadError {
+    code: CloudConfigBundleLoadErrorCode,
+    message: String,
+    status_code: Option<u16>,
+}
+
+impl CloudConfigBundleLoadError {
+    pub fn new(
+        code: CloudConfigBundleLoadErrorCode,
+        status_code: Option<u16>,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            code,
+            message: message.into(),
+            status_code,
+        }
+    }
+
+    pub fn code(&self) -> CloudConfigBundleLoadErrorCode {
+        self.code
+    }
+
+    pub fn status_code(&self) -> Option<u16> {
+        self.status_code
+    }
+}
+
+#[derive(Clone)]
+pub struct CloudConfigBundleLoader {
+    getter: Arc<
+        dyn Fn()
+                -> BoxFuture<'static, Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError>>
+            + Send
+            + Sync,
+    >,
+}
+
+impl CloudConfigBundleLoader {
+    pub fn new<F>(fut: F) -> Self
+    where
+        F: Future<Output = Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError>>
+            + Send
+            + 'static,
+    {
+        let fut = fut.boxed().shared();
+        Self::from_getter(move || fut.clone())
+    }
+
+    /// Creates a loader that requests the latest bundle on every call.
+    pub fn from_getter<F, Fut>(getter: F) -> Self
+    where
+        F: Fn() -> Fut + Send + Sync + 'static,
+        Fut: Future<Output = Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError>>
+            + Send
+            + 'static,
+    {
+        Self {
+            getter: Arc::new(move || getter().boxed()),
+        }
+    }
+
+    /// Returns the current bundle snapshot.
+    pub async fn get(&self) -> Result<Option<CloudConfigBundle>, CloudConfigBundleLoadError> {
+        (self.getter)().await
+    }
+}
+
+impl fmt::Debug for CloudConfigBundleLoader {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("CloudConfigBundleLoader").finish()
+    }
+}
+
+impl Default for CloudConfigBundleLoader {
+    fn default() -> Self {
+        Self::new(async { Ok(None) })
+    }
+}
+
+#[cfg(test)]
+#[path = "cloud_config_bundle_tests.rs"]
+mod tests;

codex-rs/config/src/cloud_config_layers_tests.rs

@@ -0,0 +1,226 @@
+use super::*;
+use crate::CONFIG_TOML_FILE;
+use crate::ConfigLayerStack;
+use crate::ConfigRequirements;
+use crate::ConfigRequirementsToml;
+use crate::config_toml::ConfigToml;
+use crate::first_layer_config_error_from_entries;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::test_support::PathBufExt;
+use codex_utils_absolute_path::test_support::test_path_buf;
+use pretty_assertions::assert_eq;
+use std::path::Path;
+
+fn fragment(id: &str, name: &str, contents: &str) -> CloudConfigFragment {
+    CloudConfigFragment {
+        id: id.to_string(),
+        name: name.to_string(),
+        contents: contents.to_string(),
+    }
+}
+
+fn toml(contents: &str) -> TomlValue {
+    toml::from_str(contents).expect("test TOML should parse")
+}
+
+fn base_dir() -> AbsolutePathBuf {
+    test_path_buf("/var/lib/codex").abs()
+}
+
+#[test]
+fn layers_are_returned_in_stack_order() {
+    let base_dir = base_dir();
+    let layers = cloud_config_layers_from_fragments(
+        vec![
+            fragment("high", "High priority", "model = \"cloud-high\""),
+            fragment("low", "Low priority", "model_provider = \"cloud-low\""),
+        ],
+        &base_dir,
+    )
+    .expect("cloud config layers should compose");
+
+    assert_eq!(
+        layers
+            .iter()
+            .map(|layer| layer.name.clone())
+            .collect::<Vec<_>>(),
+        vec![
+            ConfigLayerSource::EnterpriseManaged {
+                id: "low".to_string(),
+                name: "Low priority".to_string(),
+            },
+            ConfigLayerSource::EnterpriseManaged {
+                id: "high".to_string(),
+                name: "High priority".to_string(),
+            },
+        ]
+    );
+}
+
+#[test]
+fn strict_layers_reject_unknown_config_fields() {
+    let base_dir = base_dir();
+    let err = cloud_config_layers_from_fragments_strict(
+        vec![fragment("strict", "Strict layer", "unknown_key = true")],
+        &base_dir,
+    )
+    .expect_err("strict config should reject unknown fields");
+
+    assert_eq!(
+        err,
+        CloudConfigLayerError::Invalid {
+            fragment: CloudConfigFragmentSource {
+                id: "strict".to_string(),
+                name: "Strict layer".to_string(),
+            },
+            message: "unknown configuration field `unknown_key`".to_string(),
+        }
+    );
+}
+
+#[test]
+fn enterprise_layers_precede_user_and_override_system() {
+    let base_dir = base_dir();
+    let mut layers = vec![ConfigLayerEntry::new(
+        ConfigLayerSource::System {
+            file: test_path_buf("/etc/codex/config.toml").abs(),
+        },
+        toml(
+            r#"
+model = "system"
+model_provider = "system"
+review_model = "system-review"
+"#,
+        ),
+    )];
+    layers.extend(
+        cloud_config_layers_from_fragments(
+            vec![
+                fragment("high", "High priority", "model_provider = \"cloud-high\""),
+                fragment("low", "Low priority", "review_model = \"cloud-low-review\""),
+            ],
+            &base_dir,
+        )
+        .expect("cloud config layers should compose"),
+    );
+    layers.push(ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: test_path_buf("/home/alice/.codex/config.toml").abs(),
+            profile: None,
+        },
+        toml("model = \"user\""),
+    ));
+
+    let stack = ConfigLayerStack::new(
+        layers,
+        ConfigRequirements::default(),
+        ConfigRequirementsToml::default(),
+    )
+    .expect("stack should be ordered");
+
+    assert_eq!(
+        stack
+            .layers_low_to_high()
+            .map(|layer| layer.name.clone())
+            .collect::<Vec<_>>(),
+        vec![
+            ConfigLayerSource::System {
+                file: test_path_buf("/etc/codex/config.toml").abs(),
+            },
+            ConfigLayerSource::EnterpriseManaged {
+                id: "low".to_string(),
+                name: "Low priority".to_string(),
+            },
+            ConfigLayerSource::EnterpriseManaged {
+                id: "high".to_string(),
+                name: "High priority".to_string(),
+            },
+            ConfigLayerSource::User {
+                file: test_path_buf("/home/alice/.codex/config.toml").abs(),
+                profile: None,
+            },
+        ]
+    );
+    assert_eq!(
+        stack.effective_config(),
+        toml(
+            r#"
+model = "user"
+model_provider = "cloud-high"
+review_model = "cloud-low-review"
+"#,
+        )
+    );
+}
+
+#[test]
+fn relative_absolute_path_fields_resolve_against_base_dir() {
+    let base_dir = base_dir();
+    let layers = cloud_config_layers_from_fragments(
+        vec![fragment(
+            "cfg_123",
+            "Base policy",
+            "model_instructions_file = \"instructions.md\"",
+        )],
+        &base_dir,
+    )
+    .expect("relative paths should match existing MDM semantics");
+
+    let path = layers[0]
+        .config
+        .get("model_instructions_file")
+        .and_then(TomlValue::as_str)
+        .expect("path should be present");
+    let expected =
+        AbsolutePathBuf::resolve_path_against_base("instructions.md", base_dir.as_path());
+    assert_eq!(path, expected.to_string_lossy());
+}
+
+#[test]
+fn home_relative_path_fields_are_allowed_and_resolved() {
+    let base_dir = base_dir();
+    let layers = cloud_config_layers_from_fragments(
+        vec![fragment(
+            "cfg_123",
+            "Base policy",
+            "model_instructions_file = \"~/instructions.md\"",
+        )],
+        &base_dir,
+    )
+    .expect("home-relative paths should be accepted");
+
+    let path = layers[0]
+        .config
+        .get("model_instructions_file")
+        .and_then(TomlValue::as_str)
+        .expect("path should be present");
+    let expected =
+        AbsolutePathBuf::resolve_path_against_base("~/instructions.md", base_dir.as_path());
+    assert_eq!(path, expected.to_string_lossy());
+}
+
+#[tokio::test]
+async fn raw_toml_diagnostics_use_enterprise_layer_name() {
+    let base_dir = base_dir();
+    let layers = cloud_config_layers_from_fragments(
+        vec![fragment(
+            "cfg_123",
+            "Base policy",
+            "model_instructions_file = \"instructions.md\"\nmodel = 1",
+        )],
+        &base_dir,
+    )
+    .expect("cloud config layers should parse");
+
+    let error = first_layer_config_error_from_entries::<ConfigToml>(&layers, CONFIG_TOML_FILE)
+        .await
+        .expect("invalid raw TOML should produce a layer diagnostic");
+
+    assert_eq!(
+        error.path,
+        Path::new("enterprise-managed (Base policy, cfg_123)").to_path_buf()
+    );
+    assert_eq!(error.range.start.line, 2);
+    assert_eq!(error.range.start.column, 9);
+    assert!(error.message.contains("invalid type: integer `1`"));
+}

codex-rs/config/src/config_layer_source.rs

@@ -0,0 +1,109 @@
+use codex_utils_absolute_path::AbsolutePathBuf;
+use serde_json::Value as JsonValue;
+
+/// Provenance for one layer in the effective Codex configuration.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ConfigLayerSource {
+    /// Default configuration supplied with the installed Codex package.
+    PackagedDefaults { file: AbsolutePathBuf },
+    /// Managed preferences delivered by MDM.
+    Mdm { domain: String, key: String },
+    /// Host-wide configuration loaded from a file.
+    System { file: AbsolutePathBuf },
+    /// Configuration delivered by an enterprise cloud bundle.
+    EnterpriseManaged { id: String, name: String },
+    /// User configuration, optionally augmented by a selected profile.
+    User {
+        file: AbsolutePathBuf,
+        profile: Option<String>,
+    },
+    /// Configuration loaded from a project's `.codex` directory.
+    Project { dot_codex_folder: AbsolutePathBuf },
+    /// Overrides supplied for the current session.
+    SessionFlags,
+    /// Legacy managed configuration loaded from a file.
+    LegacyManagedConfigTomlFromFile { file: AbsolutePathBuf },
+    /// Legacy managed configuration delivered by MDM.
+    LegacyManagedConfigTomlFromMdm,
+}
+
+impl ConfigLayerSource {
+    /// A setting from a layer with a higher precedence overrides a setting
+    /// from a layer with a lower precedence.
+    pub fn precedence(&self) -> i16 {
+        match self {
+            ConfigLayerSource::PackagedDefaults { .. } => -10,
+            ConfigLayerSource::Mdm { .. } => 0,
+            ConfigLayerSource::System { .. } => 10,
+            ConfigLayerSource::EnterpriseManaged { .. } => 15,
+            ConfigLayerSource::User { profile, .. } => {
+                if profile.is_some() {
+                    21
+                } else {
+                    20
+                }
+            }
+            ConfigLayerSource::Project { .. } => 25,
+            ConfigLayerSource::SessionFlags => 30,
+            ConfigLayerSource::LegacyManagedConfigTomlFromFile { .. } => 40,
+            ConfigLayerSource::LegacyManagedConfigTomlFromMdm => 50,
+        }
+    }
+}
+
+/// Compares [`ConfigLayerSource`] by precedence, so `A < B` means settings
+/// from layer `A` will be overridden by settings from layer `B`.
+impl PartialOrd for ConfigLayerSource {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.precedence().cmp(&other.precedence()))
+    }
+}
+
+/// Identity and version information for a configuration layer.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ConfigLayerMetadata {
+    pub name: ConfigLayerSource,
+    pub version: String,
+}
+
+/// A materialized configuration layer and its provenance.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ConfigLayer {
+    pub name: ConfigLayerSource,
+    pub version: String,
+    pub config: JsonValue,
+    pub disabled_reason: Option<String>,
+}
+
+pub fn format_config_layer_source(source: &ConfigLayerSource, config_toml_file: &str) -> String {
+    match source {
+        ConfigLayerSource::PackagedDefaults { file } => {
+            format!("packaged defaults ({})", file.as_path().display())
+        }
+        ConfigLayerSource::Mdm { domain, key } => {
+            format!("MDM ({domain}:{key})")
+        }
+        ConfigLayerSource::System { file } => {
+            format!("system ({})", file.as_path().display())
+        }
+        ConfigLayerSource::EnterpriseManaged { id, name } => {
+            format!("enterprise-managed ({name}, {id})")
+        }
+        ConfigLayerSource::User { file, .. } => {
+            format!("user ({})", file.as_path().display())
+        }
+        ConfigLayerSource::Project { dot_codex_folder } => {
+            format!(
+                "project ({}/{config_toml_file})",
+                dot_codex_folder.as_path().display()
+            )
+        }
+        ConfigLayerSource::SessionFlags => "session-flags".to_string(),
+        ConfigLayerSource::LegacyManagedConfigTomlFromFile { file } => {
+            format!("legacy managed_config.toml ({})", file.as_path().display())
+        }
+        ConfigLayerSource::LegacyManagedConfigTomlFromMdm => {
+            "legacy managed_config.toml (MDM)".to_string()
+        }
+    }
+}

codex-rs/config/src/hooks_tests.rs

@@ -0,0 +1,363 @@
+use pretty_assertions::assert_eq;
+
+use std::collections::BTreeMap;
+
+use super::HookEventsToml;
+use super::HookHandlerConfig;
+use super::HooksFile;
+use super::HooksToml;
+use super::ManagedHooksRequirementsToml;
+use super::MatcherGroup;
+
+#[test]
+fn hooks_file_deserializes_existing_json_shape() {
+    let parsed: HooksFile = serde_json::from_str(
+        r#"{
+  "description": "Optional stop-time review gate for Codex Companion.",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "^Bash$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 /tmp/pre.py",
+            "timeout": 10,
+            "statusMessage": "checking",
+            "additionalContextLimit": 4096
+          }
+        ]
+      }
+    ]
+  }
+}"#,
+    )
+    .expect("hooks.json should deserialize");
+
+    assert_eq!(
+        parsed,
+        HooksFile {
+            description: Some("Optional stop-time review gate for Codex Companion.".to_string()),
+            hooks: HookEventsToml {
+                pre_tool_use: vec![MatcherGroup {
+                    matcher: Some("^Bash$".to_string()),
+                    hooks: vec![HookHandlerConfig::Command {
+                        command: "python3 /tmp/pre.py".to_string(),
+                        command_windows: None,
+                        timeout_sec: Some(10),
+                        r#async: false,
+                        status_message: Some("checking".to_string()),
+                        additional_context_limit: Some(4096),
+                    }],
+                }],
+                ..Default::default()
+            },
+        }
+    );
+}
+
+#[test]
+fn hooks_file_deserializes_mcp_tool_handler_with_json_inputs() {
+    let parsed: HooksFile = serde_json::from_value(serde_json::json!({
+        "hooks": {
+            "PostToolUse": [{
+                "matcher": "Write|Edit",
+                "hooks": [{
+                    "type": "mcp_tool",
+                    "server": "security",
+                    "tool": "scan",
+                    "input": {
+                        "file_path": "${tool_input.file_path}",
+                        "include_ignored": false,
+                    },
+                    "timeout": 30,
+                    "statusMessage": "Scanning file",
+                }],
+            }],
+        },
+    }))
+    .expect("MCP tool hooks should deserialize");
+
+    assert_eq!(
+        parsed.hooks.post_tool_use[0].hooks,
+        vec![HookHandlerConfig::McpTool {
+            server: "security".to_string(),
+            tool: "scan".to_string(),
+            input: serde_json::Map::from_iter([
+                (
+                    "file_path".to_string(),
+                    serde_json::Value::String("${tool_input.file_path}".to_string()),
+                ),
+                (
+                    "include_ignored".to_string(),
+                    serde_json::Value::Bool(false)
+                ),
+            ]),
+            timeout_sec: Some(30),
+            status_message: Some("Scanning file".to_string()),
+        }]
+    );
+}
+
+#[test]
+fn hooks_file_rejects_mcp_tool_handler_with_null_input() {
+    for input in [
+        serde_json::json!({ "optional": null }),
+        serde_json::json!({ "metadata": { "optional": null } }),
+        serde_json::json!({ "values": [null] }),
+    ] {
+        let error = serde_json::from_value::<HooksFile>(serde_json::json!({
+            "hooks": {
+                "PostToolUse": [{
+                    "hooks": [{
+                        "type": "mcp_tool",
+                        "server": "security",
+                        "tool": "scan",
+                        "input": input,
+                    }],
+                }],
+            },
+        }))
+        .expect_err("literal null MCP hook arguments should be rejected");
+
+        assert!(
+            error
+                .to_string()
+                .contains("MCP hook input must be representable as TOML"),
+            "unexpected parse error: {error}"
+        );
+    }
+}
+
+#[test]
+fn hooks_file_rejects_events_outside_hooks_object() {
+    let error = serde_json::from_str::<HooksFile>(
+        r#"{
+  "SessionStart": [
+    {
+      "hooks": [
+        {
+          "type": "command",
+          "command": "python3 /tmp/session_start.py"
+        }
+      ]
+    }
+  ]
+}"#,
+    )
+    .expect_err("root-level hook events should be rejected");
+
+    assert!(
+        error.to_string().contains("unknown field `SessionStart`"),
+        "unexpected parse error: {error}"
+    );
+}
+
+#[test]
+fn hook_events_deserialize_from_toml_arrays_of_tables() {
+    let parsed: HookEventsToml = toml::from_str(
+        r#"
+[[PreToolUse]]
+matcher = "^Bash$"
+
+[[PreToolUse.hooks]]
+type = "command"
+command = "python3 /tmp/pre.py"
+timeout = 10
+statusMessage = "checking"
+additionalContextLimit = 4096
+"#,
+    )
+    .expect("hook events TOML should deserialize");
+
+    assert_eq!(
+        parsed,
+        HookEventsToml {
+            pre_tool_use: vec![MatcherGroup {
+                matcher: Some("^Bash$".to_string()),
+                hooks: vec![HookHandlerConfig::Command {
+                    command: "python3 /tmp/pre.py".to_string(),
+                    command_windows: None,
+                    timeout_sec: Some(10),
+                    r#async: false,
+                    status_message: Some("checking".to_string()),
+                    additional_context_limit: Some(4096),
+                }],
+            }],
+            ..Default::default()
+        }
+    );
+}
+
+#[test]
+fn hooks_toml_deserializes_inline_events_and_state_map() {
+    let parsed: HooksToml = toml::from_str(
+        r#"
+[state."/tmp/hooks.json:pre_tool_use:0:0"]
+enabled = false
+trusted_hash = "sha256:abc123"
+
+[[PreToolUse]]
+matcher = "^Bash$"
+
+[[PreToolUse.hooks]]
+type = "command"
+command = "python3 /tmp/pre.py"
+"#,
+    )
+    .expect("hooks TOML should deserialize");
+
+    assert_eq!(
+        parsed,
+        HooksToml {
+            events: HookEventsToml {
+                pre_tool_use: vec![MatcherGroup {
+                    matcher: Some("^Bash$".to_string()),
+                    hooks: vec![HookHandlerConfig::Command {
+                        command: "python3 /tmp/pre.py".to_string(),
+                        command_windows: None,
+                        timeout_sec: None,
+                        r#async: false,
+                        status_message: None,
+                        additional_context_limit: None,
+                    }],
+                }],
+                ..Default::default()
+            },
+            state: BTreeMap::from([(
+                "/tmp/hooks.json:pre_tool_use:0:0".to_string(),
+                super::HookStateToml {
+                    enabled: Some(false),
+                    trusted_hash: Some("sha256:abc123".to_string()),
+                },
+            )]),
+        }
+    );
+}
+
+#[test]
+fn managed_hooks_requirements_flatten_hook_events() {
+    let parsed: ManagedHooksRequirementsToml = toml::from_str(
+        r#"
+managed_dir = "/enterprise/place"
+
+[[PreToolUse]]
+matcher = "^Bash$"
+
+[[PreToolUse.hooks]]
+type = "command"
+command = "python3 /enterprise/place/pre.py"
+"#,
+    )
+    .expect("requirements hooks TOML should deserialize");
+
+    assert_eq!(
+        parsed,
+        ManagedHooksRequirementsToml {
+            managed_dir: Some(std::path::PathBuf::from("/enterprise/place")),
+            windows_managed_dir: None,
+            hooks: HookEventsToml {
+                pre_tool_use: vec![MatcherGroup {
+                    matcher: Some("^Bash$".to_string()),
+                    hooks: vec![HookHandlerConfig::Command {
+                        command: "python3 /enterprise/place/pre.py".to_string(),
+                        command_windows: None,
+                        timeout_sec: None,
+                        r#async: false,
+                        status_message: None,
+                        additional_context_limit: None,
+                    }],
+                }],
+                ..Default::default()
+            },
+        }
+    );
+}
+
+#[test]
+fn hook_events_deserialize_windows_override_from_toml() {
+    let parsed: HookEventsToml = toml::from_str(
+        r#"
+[[PreToolUse]]
+matcher = "^Bash$"
+
+[[PreToolUse.hooks]]
+type = "command"
+command = "bash /enterprise/hooks/pre.sh"
+command_windows = "powershell -File C:\\enterprise\\hooks\\pre.ps1"
+"#,
+    )
+    .expect("hook command Windows override TOML should deserialize");
+
+    assert_eq!(
+        parsed,
+        HookEventsToml {
+            pre_tool_use: vec![MatcherGroup {
+                matcher: Some("^Bash$".to_string()),
+                hooks: vec![HookHandlerConfig::Command {
+                    command: "bash /enterprise/hooks/pre.sh".to_string(),
+                    command_windows: Some(
+                        r"powershell -File C:\enterprise\hooks\pre.ps1".to_string(),
+                    ),
+                    timeout_sec: None,
+                    r#async: false,
+                    status_message: None,
+                    additional_context_limit: None,
+                }],
+            }],
+            ..Default::default()
+        }
+    );
+}
+
+#[test]
+fn hook_events_deserialize_camel_case_windows_override_from_toml() {
+    let parsed: HookEventsToml = toml::from_str(
+        r#"
+[[PreToolUse]]
+matcher = "^Bash$"
+
+[[PreToolUse.hooks]]
+type = "command"
+command = "bash /enterprise/hooks/pre.sh"
+commandWindows = "powershell -File C:\\enterprise\\hooks\\pre.ps1"
+"#,
+    )
+    .expect("camelCase hook command Windows override TOML should deserialize");
+
+    assert_eq!(
+        parsed,
+        HookEventsToml {
+            pre_tool_use: vec![MatcherGroup {
+                matcher: Some("^Bash$".to_string()),
+                hooks: vec![HookHandlerConfig::Command {
+                    command: "bash /enterprise/hooks/pre.sh".to_string(),
+                    command_windows: Some(
+                        r"powershell -File C:\enterprise\hooks\pre.ps1".to_string(),
+                    ),
+                    timeout_sec: None,
+                    r#async: false,
+                    status_message: None,
+                    additional_context_limit: None,
+                }],
+            }],
+            ..Default::default()
+        }
+    );
+}
+
+#[test]
+fn hook_handler_omits_unset_additional_context_limit() {
+    let handler = HookHandlerConfig::Command {
+        command: "python3 /tmp/pre.py".to_string(),
+        command_windows: None,
+        timeout_sec: None,
+        r#async: false,
+        status_message: None,
+        additional_context_limit: None,
+    };
+
+    let serialized = serde_json::to_value(handler).expect("hook handler should serialize");
+
+    assert_eq!(serialized.get("additionalContextLimit"), None);
+}

codex-rs/config/src/host_name.rs

@@ -0,0 +1,119 @@
+#[cfg(unix)]
+use dns_lookup::AddrInfoHints;
+#[cfg(unix)]
+use dns_lookup::getaddrinfo;
+use std::sync::LazyLock;
+#[cfg(windows)]
+use winapi_util::sysinfo::ComputerNameKind;
+#[cfg(windows)]
+use winapi_util::sysinfo::get_computer_name;
+
+static HOST_NAME: LazyLock<Option<String>> = LazyLock::new(compute_host_name);
+static OS_HOST_NAME: LazyLock<Option<String>> = LazyLock::new(|| {
+    let kernel_hostname = gethostname::gethostname();
+    normalize_host_name(&kernel_hostname.to_string_lossy())
+});
+
+/// Returns a process-cached canonical hostname, falling back to the normalized
+/// kernel hostname. The first call on Unix may perform blocking DNS resolution.
+pub fn host_name() -> Option<String> {
+    HOST_NAME.clone()
+}
+
+/// Returns the process-cached operating-system hostname without DNS resolution.
+pub fn os_host_name() -> Option<String> {
+    OS_HOST_NAME.clone()
+}
+
+fn compute_host_name() -> Option<String> {
+    let kernel_hostname = os_host_name()?;
+
+    // Remote sandbox requirements are meant to target remote hosts by DNS name,
+    // so prefer the canonical FQDN when the local resolver can provide one.
+    // This is best-effort host classification, not authenticated device proof.
+    if let Some(fqdn) = local_fqdn_for_hostname(&kernel_hostname) {
+        return Some(fqdn);
+    }
+
+    // Some machines have only a short local hostname or resolver setup that
+    // does not return AI_CANONNAME. Keep matching behavior best-effort by
+    // falling back to the cleaned kernel hostname instead of returning None.
+    Some(kernel_hostname)
+}
+
+fn normalize_host_name(hostname: &str) -> Option<String> {
+    let hostname = hostname.trim().trim_end_matches('.');
+    (!hostname.is_empty()).then(|| hostname.to_ascii_lowercase())
+}
+
+#[cfg(unix)]
+fn local_fqdn_for_hostname(hostname: &str) -> Option<String> {
+    let hints = AddrInfoHints {
+        flags: libc::AI_CANONNAME,
+        ..AddrInfoHints::default()
+    };
+
+    getaddrinfo(Some(hostname), /*service*/ None, Some(hints))
+        .ok()?
+        .filter_map(Result::ok)
+        .filter_map(|addr| addr.canonname)
+        // getaddrinfo may return the short hostname as canonname when no FQDN
+        // is available. Treat only DNS-qualified names as an FQDN result.
+        .find_map(|hostname| normalize_fqdn_candidate(&hostname))
+}
+
+#[cfg(windows)]
+fn local_fqdn_for_hostname(_hostname: &str) -> Option<String> {
+    get_computer_name(ComputerNameKind::PhysicalDnsFullyQualified)
+        .ok()
+        .and_then(|hostname| hostname.into_string().ok())
+        .and_then(|hostname| normalize_fqdn_candidate(&hostname))
+}
+
+#[cfg(not(any(unix, windows)))]
+fn local_fqdn_for_hostname(_hostname: &str) -> Option<String> {
+    None
+}
+
+fn normalize_fqdn_candidate(hostname: &str) -> Option<String> {
+    normalize_host_name(hostname).filter(|hostname| hostname.contains('.'))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::normalize_fqdn_candidate;
+    use super::normalize_host_name;
+    use super::os_host_name;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn os_host_name_matches_normalized_kernel_hostname() {
+        let kernel_hostname = gethostname::gethostname();
+
+        assert_eq!(
+            os_host_name(),
+            normalize_host_name(&kernel_hostname.to_string_lossy())
+        );
+    }
+
+    #[test]
+    fn normalize_fqdn_candidate_accepts_dns_qualified_name() {
+        assert_eq!(
+            normalize_fqdn_candidate("runner-01.ci.example.com"),
+            Some("runner-01.ci.example.com".to_string())
+        );
+    }
+
+    #[test]
+    fn normalize_fqdn_candidate_rejects_short_name() {
+        assert_eq!(normalize_fqdn_candidate("runner-01"), None);
+    }
+
+    #[test]
+    fn normalize_fqdn_candidate_trims_trailing_dot_and_normalizes_case() {
+        assert_eq!(
+            normalize_fqdn_candidate("RUNNER-01.CI.EXAMPLE.COM."),
+            Some("runner-01.ci.example.com".to_string())
+        );
+    }
+}

codex-rs/config/src/in_app_browser_requirements_tests.rs

@@ -0,0 +1,144 @@
+use super::InAppBrowserRequirementsToml;
+use crate::ConfigRequirementsToml;
+use crate::ConfigRequirementsWithSources;
+use crate::RequirementSource;
+use crate::RequirementsLayerEntry;
+use crate::Sourced;
+use crate::compose_requirements_for_hostname;
+use pretty_assertions::assert_eq;
+
+const EMPTY: &str = "[in_app_browser]";
+const ALLOW: &str = "[in_app_browser]\nallow_external_browser_settings_import = true";
+const DENY: &str = "[in_app_browser]\nallow_external_browser_settings_import = false";
+
+fn parse(contents: &str) -> ConfigRequirementsToml {
+    toml::from_str(contents).expect("parse requirements")
+}
+
+fn source(name: &str) -> RequirementSource {
+    RequirementSource::EnterpriseManaged {
+        id: name.to_string(),
+        name: name.to_string(),
+    }
+}
+
+#[test]
+fn import_requirement_preserves_unset_and_explicit_values() {
+    for (contents, expected_table) in [
+        ("", None),
+        (EMPTY, Some(None)),
+        (ALLOW, Some(Some(true))),
+        (DENY, Some(Some(false))),
+    ] {
+        let requirements = parse(contents);
+        assert_eq!(
+            requirements,
+            ConfigRequirementsToml {
+                in_app_browser: expected_table.map(|value| InAppBrowserRequirementsToml {
+                    allow_external_browser_settings_import: value,
+                }),
+                ..Default::default()
+            },
+        );
+        let configured = requirements
+            .in_app_browser
+            .as_ref()
+            .and_then(|policy| policy.allow_external_browser_settings_import);
+        assert_eq!(requirements.is_empty(), configured.is_none());
+    }
+}
+
+#[test]
+fn import_requirement_uses_normal_managed_toml_precedence() {
+    for (low, high, expected) in [
+        ("", EMPTY, None),
+        (DENY, "", Some(DENY)),
+        (DENY, EMPTY, Some(DENY)),
+        (DENY, ALLOW, Some(ALLOW)),
+        (ALLOW, DENY, Some(DENY)),
+    ] {
+        let composed = compose_requirements_for_hostname(
+            [
+                RequirementsLayerEntry::from_toml(source("low"), low),
+                RequirementsLayerEntry::from_toml(source("high"), high),
+            ],
+            /*hostname*/ None,
+        )
+        .expect("compose managed import policy")
+        .map(ConfigRequirementsWithSources::into_toml);
+        assert_eq!(composed, expected.map(parse));
+    }
+
+    let composed = compose_requirements_for_hostname(
+        [RequirementsLayerEntry::from_toml(source("managed"), DENY)],
+        /*hostname*/ None,
+    )
+    .expect("compose managed denial");
+    assert_eq!(
+        composed,
+        Some(ConfigRequirementsWithSources {
+            in_app_browser: Some(Sourced::new(
+                InAppBrowserRequirementsToml {
+                    allow_external_browser_settings_import: Some(false),
+                },
+                source("managed"),
+            )),
+            ..Default::default()
+        }),
+    );
+}
+
+#[test]
+fn legacy_merge_uses_whole_table_precedence() {
+    for (high, low, expected, expected_source) in [
+        (EMPTY, DENY, EMPTY, "high"),
+        ("", ALLOW, ALLOW, "low"),
+        (DENY, ALLOW, DENY, "high"),
+        (ALLOW, DENY, ALLOW, "high"),
+    ] {
+        let mut composed = ConfigRequirementsWithSources::default();
+        composed.merge_unset_fields(source("high"), parse(high));
+        composed.merge_unset_fields(source("low"), parse(low));
+        assert_eq!(
+            composed,
+            ConfigRequirementsWithSources {
+                in_app_browser: Some(Sourced::new(
+                    parse(expected).in_app_browser.expect("requirements table"),
+                    source(expected_source),
+                )),
+                ..Default::default()
+            },
+        );
+        assert_eq!(composed.into_toml(), parse(expected));
+    }
+}
+
+#[test]
+fn invalid_import_requirement_is_rejected_even_when_overridden() {
+    for invalid in ["\"false\"", "1", "[]", "{}"] {
+        let contents =
+            format!("[in_app_browser]\nallow_external_browser_settings_import = {invalid}");
+        let error = toml::from_str::<ConfigRequirementsToml>(&contents)
+            .expect_err("import requirement must be a boolean");
+        assert!(
+            error
+                .to_string()
+                .contains("allow_external_browser_settings_import"),
+            "{error}",
+        );
+        let error = compose_requirements_for_hostname(
+            [
+                RequirementsLayerEntry::from_toml(source("invalid"), contents),
+                RequirementsLayerEntry::from_toml(source("higher"), ALLOW),
+            ],
+            /*hostname*/ None,
+        )
+        .expect_err("invalid managed layers must not be silently ignored");
+        assert!(
+            error
+                .to_string()
+                .contains("allow_external_browser_settings_import"),
+            "{error}",
+        );
+    }
+}

codex-rs/config/src/loader/README.md

@@ -0,0 +1,90 @@
+# `codex-config` loader
+
+This module is the canonical place to **load and describe Codex configuration layers** (user config, CLI/session overrides, cloud-managed config, managed config, and MDM-managed preferences) and to produce:
+
+- An **effective merged** TOML config.
+- **Per-key origins** metadata (which layer “wins” for a given key).
+- **Per-layer versions** (stable fingerprints) used for optimistic concurrency / conflict detection.
+
+## Public surface
+
+Exported from `codex_config::loader`:
+
+- `load_config_layers_state(fs, codex_home, cwd_opt, cli_overrides, options, thread_config_loader) -> ConfigLayerStack`
+- `ConfigLayerStack`
+  - `effective_config() -> toml::Value`
+  - `origins() -> HashMap<String, ConfigLayerMetadata>`
+  - `layers_high_to_low() -> impl Iterator<Item = &ConfigLayerEntry>`
+  - `with_user_config(user_config) -> ConfigLayerStack`
+- `ConfigLayerEntry` (one layer’s `{name, config, version, disabled_reason}`; `name` carries source metadata)
+- `ConfigLoadOptions` (user-facing load behavior such as strict config validation)
+- `LoaderOverrides` (test/override hooks for managed config sources)
+- `merge_toml_values(base, overlay)` (public helper used elsewhere)
+
+## Layering model
+
+Precedence is **top overrides bottom**:
+
+1. `LegacyManagedConfigTomlFromMdm` (MDM-delivered `managed_config.toml`, while it is being phased out)
+2. `LegacyManagedConfigTomlFromFile` (`managed_config.toml`, while it is being phased out)
+3. `SessionFlags` (CLI overrides, applied as dotted-path TOML writes)
+4. `Project` config (`.codex/config.toml`)
+5. `User` profile config, when present
+6. `User` config (`config.toml`)
+7. `EnterpriseManaged` cloud-managed config bundle layers
+8. `System` config (`/etc/codex/config.toml` or the Windows system config path)
+
+`ConfigLayerStack` stores layers in the opposite order internally: lowest
+precedence first, highest precedence last, so later layers override earlier
+layers when folded. Thread config entries supplied by `thread_config_loader` are
+inserted according to their translated `ConfigLayerSource` precedence.
+
+Project-root discovery and project trust use the applicable non-project layers,
+including legacy managed-file and MDM config at their normal precedence. The
+managed layers remain above project and session layers in the final stack.
+Executor-local reads use their own system, base-user, and legacy managed sources;
+they do not include cloud config, selected profiles, or session flags.
+
+Layers with a `disabled_reason` are still surfaced for UI, but are ignored when
+computing the effective config and origins metadata. This is what
+`ConfigLayerStack::effective_config()` implements.
+
+## Typical usage
+
+Most callers want the effective config plus metadata:
+
+```rust
+use codex_config::LoaderOverrides;
+use codex_config::NoopThreadConfigLoader;
+use codex_config::loader::load_config_layers_state;
+use codex_exec_server::LOCAL_FS;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use toml::Value as TomlValue;
+
+let cli_overrides: Vec<(String, TomlValue)> = Vec::new();
+let cwd = AbsolutePathBuf::current_dir()?;
+let layers = load_config_layers_state(
+    LOCAL_FS.as_ref(),
+    &codex_home,
+    Some(cwd),
+    &cli_overrides,
+    LoaderOverrides::default(),
+    &NoopThreadConfigLoader,
+).await?;
+
+let effective = layers.effective_config();
+let origins = layers.origins();
+let layers_for_ui = layers.layers_high_to_low().collect::<Vec<_>>();
+```
+
+## Internal layout
+
+Implementation is split by concern:
+
+- `state.rs`: public types (`ConfigLayerEntry`, `ConfigLayerStack`) + merge/origins convenience methods.
+- `layer_io.rs`: reading `config.toml`, managed config, and managed preferences inputs.
+- `project_discovery.rs`: shared managed-config composition for project-root and trust discovery.
+- `overrides.rs`: CLI dotted-path overrides → TOML “session flags” layer.
+- `merge.rs`: recursive TOML merge.
+- `fingerprint.rs`: stable per-layer hashing and per-key origins traversal.
+- `macos.rs`: managed preferences integration (macOS only).

codex-rs/config/src/loader/layer_io.rs

@@ -0,0 +1,233 @@
+#[cfg(target_os = "macos")]
+use super::macos::ManagedAdminConfigLayer;
+#[cfg(target_os = "macos")]
+use super::macos::load_managed_admin_config_layer;
+use crate::config_toml::ConfigToml;
+use crate::diagnostics::config_error_from_toml;
+use crate::diagnostics::io_error_from_config_error;
+use crate::state::LoaderOverrides;
+use crate::strict_config::config_error_from_ignored_toml_value_fields;
+use codex_file_system::ExecutorFileSystem;
+#[cfg(windows)]
+use codex_file_system::GetMetadataOptions;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
+use codex_utils_path_uri::PathUri;
+use std::io;
+use std::path::Path;
+use std::path::PathBuf;
+use toml::Value as TomlValue;
+
+#[cfg(unix)]
+const CODEX_MANAGED_CONFIG_SYSTEM_PATH: &str = "/etc/codex/managed_config.toml";
+
+#[derive(Debug, Clone)]
+pub(super) struct MangedConfigFromFile {
+    pub managed_config: TomlValue,
+    pub file: AbsolutePathBuf,
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct ManagedConfigFromMdm {
+    pub managed_config: TomlValue,
+    pub raw_toml: String,
+}
+
+#[derive(Debug, Clone)]
+pub(super) struct LoadedConfigLayers {
+    /// If present, data read from a file such as `/etc/codex/managed_config.toml`.
+    pub managed_config: Option<MangedConfigFromFile>,
+    /// If present, data read from managed preferences (macOS only).
+    pub managed_config_from_mdm: Option<ManagedConfigFromMdm>,
+    /// User-facing warnings discovered while loading managed configuration.
+    pub startup_warnings: Vec<String>,
+}
+
+pub(super) async fn load_config_layers_internal(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    overrides: LoaderOverrides,
+    strict_config: bool,
+) -> io::Result<LoadedConfigLayers> {
+    #[cfg(target_os = "macos")]
+    let LoaderOverrides {
+        managed_config_path,
+        managed_preferences_base64,
+        ..
+    } = overrides;
+
+    #[cfg(not(target_os = "macos"))]
+    let LoaderOverrides {
+        managed_config_path,
+        ..
+    } = overrides;
+
+    #[cfg(windows)]
+    let ignore_default_managed_config = managed_config_path.is_none();
+    #[cfg(not(windows))]
+    let ignore_default_managed_config = false;
+
+    let managed_config_path = AbsolutePathBuf::from_absolute_path(
+        managed_config_path.unwrap_or_else(|| managed_config_default_path(codex_home)),
+    )?;
+
+    #[cfg(windows)]
+    let startup_warnings = if ignore_default_managed_config {
+        let path_uri = PathUri::from_abs_path(&managed_config_path);
+        match fs
+            .get_metadata(
+                &path_uri,
+                GetMetadataOptions::default(),
+                /*sandbox*/ None,
+            )
+            .await
+        {
+            Ok(_) => vec![format!(
+                "Ignoring deprecated managed config file at {}; CODEX_HOME/managed_config.toml is no longer supported on Windows. Use %ProgramData%\\OpenAI\\Codex\\requirements.toml for enforced settings or config.toml for defaults.",
+                managed_config_path.as_path().display()
+            )],
+            Err(err) if err.kind() == io::ErrorKind::NotFound => Vec::new(),
+            Err(err) => {
+                tracing::debug!(
+                    error = %err,
+                    path = %managed_config_path.as_path().display(),
+                    "Failed to check deprecated managed config file"
+                );
+                Vec::new()
+            }
+        }
+    } else {
+        Vec::new()
+    };
+    #[cfg(not(windows))]
+    let startup_warnings = Vec::new();
+
+    let managed_config = if ignore_default_managed_config {
+        None
+    } else {
+        read_config_from_path(
+            fs,
+            &managed_config_path,
+            /*log_missing_as_info*/ false,
+            strict_config,
+        )
+        .await?
+        .map(|loaded| MangedConfigFromFile {
+            managed_config: loaded,
+            file: managed_config_path.clone(),
+        })
+    };
+
+    #[cfg(target_os = "macos")]
+    let managed_preferences = load_managed_admin_config_layer(
+        managed_preferences_base64.as_deref(),
+        strict_config,
+        codex_home,
+    )
+    .await?
+    .map(map_managed_admin_layer);
+
+    #[cfg(not(target_os = "macos"))]
+    let managed_preferences = None;
+
+    Ok(LoadedConfigLayers {
+        managed_config,
+        managed_config_from_mdm: managed_preferences,
+        startup_warnings,
+    })
+}
+
+#[cfg(target_os = "macos")]
+fn map_managed_admin_layer(layer: ManagedAdminConfigLayer) -> ManagedConfigFromMdm {
+    let ManagedAdminConfigLayer { config, raw_toml } = layer;
+    ManagedConfigFromMdm {
+        managed_config: config,
+        raw_toml,
+    }
+}
+
+pub(super) async fn read_config_from_path(
+    fs: &dyn ExecutorFileSystem,
+    path: &AbsolutePathBuf,
+    log_missing_as_info: bool,
+    strict_config: bool,
+) -> io::Result<Option<TomlValue>> {
+    let path_uri = PathUri::from_abs_path(path);
+    match fs
+        .read_file_text(&path_uri, Default::default(), /*sandbox*/ None)
+        .await
+    {
+        Ok(contents) => match toml::from_str::<TomlValue>(&contents) {
+            Ok(value) => {
+                if strict_config {
+                    validate_config_toml_strictly(path, &contents, &value)?;
+                }
+                Ok(Some(value))
+            }
+            Err(err) => {
+                tracing::error!("Failed to parse {}: {err}", path.as_path().display());
+                let config_error = config_error_from_toml(path.as_path(), &contents, err.clone());
+                Err(io_error_from_config_error(
+                    io::ErrorKind::InvalidData,
+                    config_error,
+                    Some(err),
+                ))
+            }
+        },
+        Err(err) if err.kind() == io::ErrorKind::NotFound => {
+            if log_missing_as_info {
+                tracing::info!("{} not found, using defaults", path.as_path().display());
+            } else {
+                tracing::debug!("{} not found", path.as_path().display());
+            }
+            Ok(None)
+        }
+        Err(err) => {
+            tracing::error!("Failed to read {}: {err}", path.as_path().display());
+            Err(err)
+        }
+    }
+}
+
+fn validate_config_toml_strictly(
+    path: &AbsolutePathBuf,
+    contents: &str,
+    value: &TomlValue,
+) -> io::Result<()> {
+    let Some(base_dir) = path.as_path().parent() else {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Config file {} has no parent directory", path.display()),
+        ));
+    };
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields::<ConfigToml>(
+        path.as_path(),
+        contents,
+        value.clone(),
+    ) {
+        return Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ));
+    }
+
+    Ok(())
+}
+
+/// Return the legacy managed config path.
+///
+/// On Windows, the default path is only checked so callers can warn that it is ignored.
+pub(super) fn managed_config_default_path(codex_home: &Path) -> PathBuf {
+    #[cfg(unix)]
+    {
+        let _ = codex_home;
+        PathBuf::from(CODEX_MANAGED_CONFIG_SYSTEM_PATH)
+    }
+
+    #[cfg(not(unix))]
+    {
+        codex_home.join("managed_config.toml")
+    }
+}

codex-rs/config/src/loader/local.rs

@@ -0,0 +1,398 @@
+use super::CredentialBrokerProjectState;
+use super::apply_credential_broker_requirements;
+use super::credential_broker_trusted_config;
+use super::discover_project_layers;
+use super::layer_io;
+use super::load_config_toml_for_required_layer_raw;
+use super::load_requirements_toml;
+use super::load_root_checkout_project_config;
+use super::project_discovery;
+use super::project_root_markers_from_config;
+use super::project_trust_context;
+use super::requirements_layers_from_legacy_scheme;
+use super::system_config_toml_file_with_overrides;
+use super::system_requirements_toml_file_with_overrides;
+use crate::CONFIG_TOML_FILE;
+use crate::ConfigLayerSource;
+use crate::LoaderOverrides;
+use crate::RequirementSource;
+use crate::RequirementsLayerEntry;
+use crate::compose_requirements;
+use crate::default_project_root_markers;
+use crate::merge_toml_values;
+use codex_file_system::ExecutorFileSystem;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use std::collections::BTreeMap;
+use std::io;
+use std::path::Path;
+use toml::Value as TomlValue;
+
+/// Executor-local configuration and requirements layers before schema-specific
+/// path resolution or requirements composition.
+#[derive(Debug, Clone, PartialEq)]
+pub struct LocalConfigLayers {
+    pub config: LocalTomlLayerStack<ConfigLayerSource>,
+    pub requirements: LocalTomlLayerStack<RequirementSource>,
+}
+
+impl LocalConfigLayers {
+    /// Retains only the requested TOML paths and drops empty layers.
+    ///
+    /// An empty path selects the entire document. RPC boundaries should reject
+    /// that form if whole-document reads are not part of their contract.
+    pub fn project(self, config_paths: &[Vec<String>], requirements_paths: &[Vec<String>]) -> Self {
+        Self {
+            config: self.config.project(config_paths),
+            requirements: self.requirements.project(requirements_paths),
+        }
+    }
+}
+
+/// One ordered set of executor-local TOML layers.
+#[derive(Debug, Clone, PartialEq)]
+pub struct LocalTomlLayerStack<S> {
+    /// Layers ordered from lowest to highest precedence.
+    pub layers: Vec<LocalTomlLayer<S>>,
+    /// Position at which a caller should insert cloud-provided layers.
+    pub cloud_insertion_index: usize,
+}
+
+impl<S> LocalTomlLayerStack<S> {
+    fn project(self, paths: &[Vec<String>]) -> Self {
+        let selectors = SelectorNode::from_paths(paths);
+        let mut projected_layers = Vec::new();
+        let mut cloud_insertion_index = 0;
+        for (index, layer) in self.layers.into_iter().enumerate() {
+            let Some(toml) = project_toml(&layer.toml, &selectors) else {
+                continue;
+            };
+            if index < self.cloud_insertion_index {
+                cloud_insertion_index += 1;
+            }
+            projected_layers.push(LocalTomlLayer { toml, ..layer });
+        }
+        Self {
+            layers: projected_layers,
+            cloud_insertion_index,
+        }
+    }
+}
+
+/// One executor-local TOML source with the directory used to interpret its
+/// relative paths.
+#[derive(Debug, Clone, PartialEq)]
+pub struct LocalTomlLayer<S> {
+    pub source: S,
+    pub base_dir: AbsolutePathBuf,
+    pub toml: TomlValue,
+}
+
+/// Loads the fixed executor-local configuration sources used by environment
+/// config reads.
+///
+/// Cloud, selected profiles, session flags, and thread-provided layers are not
+/// included. Project discovery uses the executor's system, base-user, and
+/// legacy managed configuration.
+pub async fn load_local_config_layers(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    cwd: &AbsolutePathBuf,
+) -> io::Result<LocalConfigLayers> {
+    load_local_config_layers_with_overrides(fs, codex_home, cwd, &LoaderOverrides::default()).await
+}
+
+pub(super) async fn load_local_config_layers_with_overrides(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    cwd: &AbsolutePathBuf,
+    overrides: &LoaderOverrides,
+) -> io::Result<LocalConfigLayers> {
+    let codex_home = AbsolutePathBuf::from_absolute_path(codex_home)?;
+    let loaded_managed = layer_io::load_config_layers_internal(
+        fs,
+        codex_home.as_path(),
+        overrides.clone(),
+        /*strict_config*/ false,
+    )
+    .await?;
+
+    let system_file = system_config_toml_file_with_overrides(overrides)?;
+    let system =
+        load_config_toml_for_required_layer_raw(fs, &system_file, /*strict_config*/ false).await?;
+    let user_file = codex_home.join(CONFIG_TOML_FILE);
+    let user =
+        load_config_toml_for_required_layer_raw(fs, &user_file, /*strict_config*/ false).await?;
+
+    let mut discovery_config = TomlValue::Table(toml::map::Map::new());
+    merge_toml_values(&mut discovery_config, &system.toml);
+    merge_toml_values(&mut discovery_config, &user.toml);
+    let trusted_broker_config =
+        credential_broker_trusted_config(&discovery_config, &[], &loaded_managed);
+    // Managed file and MDM values also govern the project boundary and trust.
+    // Only this snapshot is resolved; the returned local layers stay raw.
+    project_discovery::merge_managed_config_for_discovery(
+        &mut discovery_config,
+        &loaded_managed,
+        codex_home.as_path(),
+    )?;
+    let project_root_markers = project_root_markers_from_config(&discovery_config)?
+        .unwrap_or_else(default_project_root_markers);
+    let requirements =
+        local_requirements_layers(fs, codex_home.as_path(), overrides, loaded_managed.clone())
+            .await?;
+    let mut trust_context = project_trust_context(
+        fs,
+        &discovery_config,
+        &trusted_broker_config,
+        cwd,
+        &project_root_markers,
+        codex_home.as_path(),
+        &user_file,
+    )
+    .await?;
+    if trust_context.credential_broker != CredentialBrokerProjectState::Unconfigured {
+        let broker_requirements = requirements.clone().project(&[
+            vec!["features".to_string(), "network_proxy".to_string()],
+            vec![
+                "feature_requirements".to_string(),
+                "network_proxy".to_string(),
+            ],
+            vec!["experimental_network".to_string(), "enabled".to_string()],
+        ]);
+        let effective_requirements =
+            compose_requirements(broker_requirements.layers.into_iter().map(|layer| {
+                RequirementsLayerEntry::from_toml_value(layer.source, layer.toml)
+                    .with_base_dir(layer.base_dir)
+            }))?
+            .unwrap_or_default();
+        apply_credential_broker_requirements(&mut trust_context, &effective_requirements);
+    }
+    let project_layers = discover_project_layers(
+        fs,
+        cwd,
+        &trust_context.project_root,
+        &trust_context,
+        codex_home.as_path(),
+        /*strict_config*/ false,
+    )
+    .await?;
+
+    let mut config_layers = vec![
+        LocalTomlLayer {
+            source: ConfigLayerSource::System { file: system_file },
+            base_dir: system.base_dir,
+            toml: system.toml,
+        },
+        LocalTomlLayer {
+            source: ConfigLayerSource::User {
+                file: user_file,
+                profile: None,
+            },
+            base_dir: user.base_dir,
+            toml: user.toml,
+        },
+    ];
+    append_project_layers(fs, &mut config_layers, project_layers.layers).await?;
+
+    append_legacy_config_layers(&mut config_layers, loaded_managed, &codex_home)?;
+
+    Ok(LocalConfigLayers {
+        config: LocalTomlLayerStack {
+            layers: config_layers,
+            // Cloud config follows the required system layer.
+            cloud_insertion_index: 1,
+        },
+        requirements,
+    })
+}
+
+async fn append_project_layers(
+    fs: &dyn ExecutorFileSystem,
+    output: &mut Vec<LocalTomlLayer<ConfigLayerSource>>,
+    layers: Vec<super::DiscoveredProjectLayer>,
+) -> io::Result<()> {
+    for layer in layers {
+        if layer.disabled_reason.is_some() {
+            continue;
+        }
+        let mut config = layer.config;
+        if layer.hooks_config_folder_override.is_some()
+            && let Some(table) = config.as_table_mut()
+        {
+            table.remove("hooks");
+        }
+        output.push(LocalTomlLayer {
+            source: ConfigLayerSource::Project {
+                dot_codex_folder: layer.dot_codex_folder.clone(),
+            },
+            base_dir: layer.dot_codex_folder,
+            toml: config,
+        });
+
+        let Some(hooks_config_folder) = layer.hooks_config_folder_override else {
+            continue;
+        };
+        let root_config =
+            load_root_checkout_project_config(fs, &hooks_config_folder, /*is_trusted*/ true)
+                .await?;
+        let Some(hooks) = root_config.get("hooks") else {
+            continue;
+        };
+        output.push(LocalTomlLayer {
+            source: ConfigLayerSource::Project {
+                dot_codex_folder: hooks_config_folder.clone(),
+            },
+            base_dir: hooks_config_folder,
+            toml: TomlValue::Table(toml::map::Map::from_iter([(
+                "hooks".to_string(),
+                hooks.clone(),
+            )])),
+        });
+    }
+    Ok(())
+}
+
+fn append_legacy_config_layers(
+    output: &mut Vec<LocalTomlLayer<ConfigLayerSource>>,
+    loaded: layer_io::LoadedConfigLayers,
+    codex_home: &AbsolutePathBuf,
+) -> io::Result<()> {
+    if let Some(config) = loaded.managed_config {
+        let base_dir = config.file.parent().ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "Managed config file {} has no parent directory",
+                    config.file.as_path().display()
+                ),
+            )
+        })?;
+        output.push(LocalTomlLayer {
+            source: ConfigLayerSource::LegacyManagedConfigTomlFromFile { file: config.file },
+            base_dir,
+            toml: config.managed_config,
+        });
+    }
+    if let Some(config) = loaded.managed_config_from_mdm {
+        output.push(LocalTomlLayer {
+            source: ConfigLayerSource::LegacyManagedConfigTomlFromMdm,
+            base_dir: codex_home.clone(),
+            toml: config.managed_config,
+        });
+    }
+    Ok(())
+}
+
+async fn local_requirements_layers(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    overrides: &LoaderOverrides,
+    loaded_managed: layer_io::LoadedConfigLayers,
+) -> io::Result<LocalTomlLayerStack<RequirementSource>> {
+    let system_file = system_requirements_toml_file_with_overrides(overrides)?;
+    let system = load_requirements_toml(fs, &system_file).await?;
+    let cloud_insertion_index = usize::from(system.is_some());
+    let mut entries = Vec::new();
+    entries.extend(system);
+    entries.extend(requirements_layers_from_legacy_scheme(
+        loaded_managed,
+        codex_home,
+    )?);
+
+    #[cfg(target_os = "macos")]
+    {
+        let codex_home = AbsolutePathBuf::from_absolute_path(codex_home)?;
+        entries.extend(
+            super::macos::load_managed_admin_requirements_layer(
+                overrides
+                    .macos_managed_config_requirements_base64
+                    .as_deref(),
+            )
+            .await?
+            .map(|layer| layer.with_base_dir(codex_home)),
+        );
+    }
+
+    let mut layers = Vec::with_capacity(entries.len());
+    for entry in entries {
+        layers.push(local_requirements_layer(entry)?);
+    }
+    Ok(LocalTomlLayerStack {
+        layers,
+        cloud_insertion_index,
+    })
+}
+
+fn local_requirements_layer(
+    entry: RequirementsLayerEntry,
+) -> io::Result<LocalTomlLayer<RequirementSource>> {
+    let (source, toml, base_dir) = entry.into_raw_parts()?;
+    let base_dir = base_dir.ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("requirements layer {source} has no base directory"),
+        )
+    })?;
+    Ok(LocalTomlLayer {
+        source,
+        base_dir,
+        toml,
+    })
+}
+
+#[derive(Default)]
+struct SelectorNode {
+    terminal: bool,
+    children: BTreeMap<String, SelectorNode>,
+}
+
+impl SelectorNode {
+    fn from_paths(paths: &[Vec<String>]) -> Self {
+        let mut root = Self::default();
+        for path in paths {
+            root.insert(path);
+        }
+        root
+    }
+
+    fn insert(&mut self, path: &[String]) {
+        if self.terminal {
+            return;
+        }
+        let Some((segment, remaining)) = path.split_first() else {
+            self.terminal = true;
+            self.children.clear();
+            return;
+        };
+        self.children
+            .entry(segment.clone())
+            .or_default()
+            .insert(remaining);
+    }
+}
+
+fn project_toml(value: &TomlValue, selector: &SelectorNode) -> Option<TomlValue> {
+    let projected = project_toml_value(value, selector);
+    if !selector.terminal && projected.as_table().is_some_and(toml::map::Map::is_empty) {
+        return None;
+    }
+    Some(projected)
+}
+
+fn project_toml_value(value: &TomlValue, selector: &SelectorNode) -> TomlValue {
+    if selector.terminal {
+        return value.clone();
+    }
+    let Some(table) = value.as_table() else {
+        // Preserve a non-table ancestor so it can still override lower layers.
+        return value.clone();
+    };
+    let mut projected = toml::map::Map::new();
+    for (key, value) in table {
+        let Some(child_selector) = selector.children.get(key) else {
+            continue;
+        };
+        projected.insert(key.clone(), project_toml_value(value, child_selector));
+    }
+    TomlValue::Table(projected)
+}

codex-rs/config/src/loader/macos.rs

@@ -0,0 +1,230 @@
+use crate::RequirementsLayerEntry;
+use crate::config_requirements::RequirementSource;
+use crate::config_toml::ConfigToml;
+use crate::diagnostics::ConfigDiagnosticSource;
+use crate::diagnostics::config_error_from_toml_for_source;
+use crate::diagnostics::io_error_from_config_error;
+use crate::strict_config::config_error_from_ignored_toml_value_fields_for_source_name;
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
+use core_foundation::base::TCFType;
+use core_foundation::string::CFString;
+use core_foundation::string::CFStringRef;
+use std::ffi::c_void;
+use std::io;
+use std::path::Path;
+use tokio::task;
+use toml::Value as TomlValue;
+
+const MANAGED_PREFERENCES_APPLICATION_ID: &str = "com.openai.codex";
+const MANAGED_PREFERENCES_CONFIG_KEY: &str = "config_toml_base64";
+const MANAGED_PREFERENCES_REQUIREMENTS_KEY: &str = "requirements_toml_base64";
+
+#[derive(Debug, Clone)]
+pub(super) struct ManagedAdminConfigLayer {
+    pub config: TomlValue,
+    pub raw_toml: String,
+}
+
+pub(super) fn managed_preferences_requirements_source() -> RequirementSource {
+    RequirementSource::MdmManagedPreferences {
+        domain: MANAGED_PREFERENCES_APPLICATION_ID.to_string(),
+        key: MANAGED_PREFERENCES_REQUIREMENTS_KEY.to_string(),
+    }
+}
+
+pub(super) fn has_managed_preferences() -> io::Result<bool> {
+    Ok(
+        load_managed_preference(MANAGED_PREFERENCES_CONFIG_KEY)?.is_some()
+            || load_managed_preference(MANAGED_PREFERENCES_REQUIREMENTS_KEY)?.is_some(),
+    )
+}
+
+pub(crate) async fn load_managed_admin_config_layer(
+    override_base64: Option<&str>,
+    strict_config: bool,
+    base_dir: &Path,
+) -> io::Result<Option<ManagedAdminConfigLayer>> {
+    if let Some(encoded) = override_base64 {
+        let trimmed = encoded.trim();
+        return if trimmed.is_empty() {
+            Ok(None)
+        } else {
+            parse_managed_config_base64(trimmed, strict_config, base_dir).map(Some)
+        };
+    }
+
+    let base_dir = base_dir.to_path_buf();
+    match task::spawn_blocking(move || load_managed_admin_config(strict_config, &base_dir)).await {
+        Ok(result) => result,
+        Err(join_err) => {
+            if join_err.is_cancelled() {
+                tracing::error!("Managed config load task was cancelled");
+            } else {
+                tracing::error!("Managed config load task failed: {join_err}");
+            }
+            Err(io::Error::other("Failed to load managed config"))
+        }
+    }
+}
+
+fn load_managed_admin_config(
+    strict_config: bool,
+    base_dir: &Path,
+) -> io::Result<Option<ManagedAdminConfigLayer>> {
+    load_managed_preference(MANAGED_PREFERENCES_CONFIG_KEY)?
+        .as_deref()
+        .map(str::trim)
+        .map(|encoded| parse_managed_config_base64(encoded, strict_config, base_dir))
+        .transpose()
+}
+
+pub(crate) async fn load_managed_admin_requirements_layer(
+    override_base64: Option<&str>,
+) -> io::Result<Option<RequirementsLayerEntry>> {
+    if let Some(encoded) = override_base64 {
+        let trimmed = encoded.trim();
+        if trimmed.is_empty() {
+            return Ok(None);
+        }
+
+        return parse_managed_requirements_base64(trimmed).map(|contents| {
+            Some(RequirementsLayerEntry::from_toml(
+                managed_preferences_requirements_source(),
+                contents,
+            ))
+        });
+    }
+
+    match task::spawn_blocking(load_managed_admin_requirements).await {
+        Ok(result) => Ok(result?.map(|contents| {
+            RequirementsLayerEntry::from_toml(managed_preferences_requirements_source(), contents)
+        })),
+        Err(join_err) => {
+            if join_err.is_cancelled() {
+                tracing::error!("Managed requirements load task was cancelled");
+            } else {
+                tracing::error!("Managed requirements load task failed: {join_err}");
+            }
+            Err(io::Error::other("Failed to load managed requirements"))
+        }
+    }
+}
+
+fn load_managed_admin_requirements() -> io::Result<Option<String>> {
+    load_managed_preference(MANAGED_PREFERENCES_REQUIREMENTS_KEY)?
+        .as_deref()
+        .map(str::trim)
+        .map(parse_managed_requirements_base64)
+        .transpose()
+}
+
+fn load_managed_preference(key_name: &str) -> io::Result<Option<String>> {
+    #[link(name = "CoreFoundation", kind = "framework")]
+    unsafe extern "C" {
+        fn CFPreferencesCopyAppValue(key: CFStringRef, application_id: CFStringRef) -> *mut c_void;
+    }
+
+    let value_ref = unsafe {
+        CFPreferencesCopyAppValue(
+            CFString::new(key_name).as_concrete_TypeRef(),
+            CFString::new(MANAGED_PREFERENCES_APPLICATION_ID).as_concrete_TypeRef(),
+        )
+    };
+
+    if value_ref.is_null() {
+        tracing::debug!(
+            "Managed preferences for {MANAGED_PREFERENCES_APPLICATION_ID} key {key_name} not found",
+        );
+        return Ok(None);
+    }
+
+    let value = unsafe { CFString::wrap_under_create_rule(value_ref as _) }.to_string();
+    Ok(Some(value))
+}
+
+fn parse_managed_config_base64(
+    encoded: &str,
+    strict_config: bool,
+    base_dir: &Path,
+) -> io::Result<ManagedAdminConfigLayer> {
+    let raw_toml = decode_managed_preferences_base64(encoded)?;
+    let source_name =
+        format!("{MANAGED_PREFERENCES_APPLICATION_ID}:{MANAGED_PREFERENCES_CONFIG_KEY}");
+    let parsed = toml::from_str::<TomlValue>(&raw_toml).map_err(|err| {
+        tracing::error!("Failed to parse managed config TOML: {err}");
+        if strict_config {
+            let config_error = config_error_from_toml_for_source(
+                ConfigDiagnosticSource::DisplayName(&source_name),
+                &raw_toml,
+                err.clone(),
+            );
+            io_error_from_config_error(io::ErrorKind::InvalidData, config_error, Some(err))
+        } else {
+            io::Error::new(io::ErrorKind::InvalidData, err)
+        }
+    })?;
+
+    validate_managed_config_toml_strictly_if_requested(
+        strict_config,
+        &source_name,
+        &raw_toml,
+        &parsed,
+        base_dir,
+    )?;
+    match parsed {
+        TomlValue::Table(parsed) => Ok(ManagedAdminConfigLayer {
+            config: TomlValue::Table(parsed),
+            raw_toml,
+        }),
+        other => {
+            tracing::error!("Managed config TOML must have a table at the root, found {other:?}",);
+            Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "managed config root must be a table",
+            ))
+        }
+    }
+}
+
+fn validate_managed_config_toml_strictly_if_requested(
+    strict_config: bool,
+    source_name: &str,
+    raw_toml: &str,
+    parsed: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    if !strict_config {
+        return Ok(());
+    }
+
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields_for_source_name::<
+        ConfigToml,
+    >(source_name, raw_toml, parsed.clone())
+    {
+        Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn parse_managed_requirements_base64(encoded: &str) -> io::Result<String> {
+    decode_managed_preferences_base64(encoded)
+}
+
+fn decode_managed_preferences_base64(encoded: &str) -> io::Result<String> {
+    String::from_utf8(BASE64_STANDARD.decode(encoded.as_bytes()).map_err(|err| {
+        tracing::error!("Failed to decode managed value as base64: {err}",);
+        io::Error::new(io::ErrorKind::InvalidData, err)
+    })?)
+    .map_err(|err| {
+        tracing::error!("Managed value base64 contents were not valid UTF-8: {err}",);
+        io::Error::new(io::ErrorKind::InvalidData, err)
+    })
+}

codex-rs/config/src/loader/managed_project_discovery_tests.rs

@@ -0,0 +1,348 @@
+use crate::ConfigLayerSource;
+use crate::ConfigLayerStack;
+use crate::LoaderOverrides;
+use crate::NoopThreadConfigLoader;
+use crate::loader::LocalConfigLayers;
+use crate::loader::load_config_layers_state;
+use crate::loader::local::load_local_config_layers_with_overrides;
+use crate::loader::project_trust_key;
+use crate::loader::tests::TestFileSystem;
+use crate::merge_toml_values;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use pretty_assertions::assert_eq;
+use std::path::PathBuf;
+use tempfile::TempDir;
+use toml::Value as TomlValue;
+
+struct Fixture {
+    _temp: TempDir,
+    home: PathBuf,
+    repo: AbsolutePathBuf,
+    project: AbsolutePathBuf,
+    cwd: AbsolutePathBuf,
+    managed: PathBuf,
+    overrides: LoaderOverrides,
+}
+
+impl Fixture {
+    fn new() -> anyhow::Result<Self> {
+        let temp = tempfile::tempdir()?;
+        let home = temp.path().join("home");
+        let repo = AbsolutePathBuf::from_absolute_path(temp.path().join("repo"))?;
+        let project = repo.join("project");
+        let cwd = project.join("child");
+        std::fs::create_dir_all(&home)?;
+        std::fs::create_dir_all(repo.join(".git"))?;
+        std::fs::write(repo.join(".git/HEAD"), "ref: refs/heads/main\n")?;
+        for (dir, model) in [(&repo, "ancestor"), (&project, "project"), (&cwd, "child")] {
+            std::fs::create_dir_all(dir.join(".codex"))?;
+            std::fs::write(
+                dir.join(".codex/config.toml"),
+                format!("model = \"{model}\"\n"),
+            )?;
+        }
+        std::fs::write(project.join(".company-root"), "")?;
+        let managed = temp.path().join("managed_config.toml");
+        let mut overrides = LoaderOverrides::with_managed_config_path_for_tests(managed.clone());
+        overrides.system_config_path = Some(temp.path().join("system.toml"));
+        let fixture = Self {
+            _temp: temp,
+            home,
+            repo,
+            project,
+            cwd,
+            managed,
+            overrides,
+        };
+        std::fs::write(fixture.home.join("config.toml"), fixture.trust("trusted"))?;
+        Ok(fixture)
+    }
+
+    fn trust(&self, level: &str) -> String {
+        let key = TomlValue::String(project_trust_key(self.repo.as_path()));
+        format!("[projects.{key}]\ntrust_level = \"{level}\"\n")
+    }
+
+    async fn load(&self) -> anyhow::Result<(ConfigLayerStack, LocalConfigLayers)> {
+        let canonical = load_config_layers_state(
+            &TestFileSystem,
+            &self.home,
+            Some(self.cwd.clone()),
+            &[
+                (
+                    "project_root_markers".into(),
+                    toml::Value::try_from([".git"])?,
+                ),
+                ("model".into(), TomlValue::String("session".into())),
+            ],
+            self.overrides.clone(),
+            &NoopThreadConfigLoader,
+        )
+        .await?;
+        let local = load_local_config_layers_with_overrides(
+            &TestFileSystem,
+            &self.home,
+            &self.cwd,
+            &self.overrides,
+        )
+        .await?;
+        Ok((canonical, local))
+    }
+}
+
+fn assert_discovery(
+    canonical: &ConfigLayerStack,
+    local: &LocalConfigLayers,
+    expected_dirs: &[&AbsolutePathBuf],
+    markers: &[&str],
+) -> anyhow::Result<()> {
+    let project_dirs = |sources: Vec<&ConfigLayerSource>| {
+        sources
+            .into_iter()
+            .filter_map(|source| match source {
+                ConfigLayerSource::Project { dot_codex_folder } => Some(dot_codex_folder.clone()),
+                _ => None,
+            })
+            .collect::<Vec<_>>()
+    };
+    let expected_dirs = expected_dirs
+        .iter()
+        .map(|dir| dir.join(".codex"))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        (
+            project_dirs(
+                canonical
+                    .layers_low_to_high()
+                    .map(|layer| &layer.name)
+                    .collect()
+            ),
+            project_dirs(
+                local
+                    .config
+                    .layers
+                    .iter()
+                    .map(|layer| &layer.source)
+                    .collect()
+            ),
+        ),
+        (expected_dirs.clone(), expected_dirs)
+    );
+    let effective = canonical.effective_config();
+    let mut local_effective = TomlValue::Table(toml::map::Map::new());
+    for layer in &local.config.layers {
+        merge_toml_values(&mut local_effective, &layer.toml);
+    }
+    let expected_markers = TomlValue::try_from(markers)?;
+    assert_eq!(
+        (
+            effective.get("project_root_markers"),
+            local_effective.get("project_root_markers"),
+        ),
+        (Some(&expected_markers), Some(&expected_markers))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn managed_project_discovery_uses_file_markers_without_changing_precedence()
+-> anyhow::Result<()> {
+    let fixture = Fixture::new()?;
+    for (markers, dirs) in [
+        (
+            vec![".git"],
+            vec![&fixture.repo, &fixture.project, &fixture.cwd],
+        ),
+        (vec![], vec![&fixture.cwd]),
+        (vec![".company-root"], vec![&fixture.project, &fixture.cwd]),
+    ] {
+        let markers_toml = TomlValue::try_from(&markers)?;
+        std::fs::write(
+            &fixture.managed,
+            format!("project_root_markers = {markers_toml}\nmodel = \"managed\"\n"),
+        )?;
+        let (canonical, local) = fixture.load().await?;
+        assert_discovery(&canonical, &local, &dirs, &markers)?;
+        let managed_source = ConfigLayerSource::LegacyManagedConfigTomlFromFile {
+            file: AbsolutePathBuf::from_absolute_path(&fixture.managed)?,
+        };
+        assert_eq!(
+            (
+                canonical.effective_config().get("model").cloned(),
+                &canonical.origins()["model"].name,
+                &local.config.layers.last().expect("managed layer").source,
+            ),
+            (
+                Some(TomlValue::String("managed".into())),
+                &managed_source,
+                &managed_source,
+            )
+        );
+    }
+    Ok(())
+}
+
+#[tokio::test]
+async fn managed_project_discovery_ignores_incomplete_nested_git_directory() -> anyhow::Result<()> {
+    let fixture = Fixture::new()?;
+    std::fs::create_dir(fixture.cwd.join(".git"))?;
+    std::fs::write(&fixture.managed, "project_root_markers = [\".git\"]\n")?;
+
+    let (canonical, local) = fixture.load().await?;
+    assert_discovery(
+        &canonical,
+        &local,
+        &[&fixture.repo, &fixture.project, &fixture.cwd],
+        &[".git"],
+    )?;
+
+    std::fs::write(fixture.home.join("config.toml"), fixture.trust("untrusted"))?;
+    let (canonical, local) = fixture.load().await?;
+    assert_discovery(&canonical, &local, &[], &[".git"])?;
+    let trust_key = project_trust_key(fixture.repo.as_path());
+    assert!(
+        canonical
+            .all_layers_low_to_high()
+            .filter(|layer| matches!(layer.name, ConfigLayerSource::Project { .. }))
+            .all(|layer| layer.disabled_reason.as_deref().is_some_and(
+                |reason| reason.starts_with(&format!("{trust_key} is marked as untrusted"))
+            ))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn managed_project_discovery_uses_managed_project_trust() -> anyhow::Result<()> {
+    let fixture = Fixture::new()?;
+    let trust_key = project_trust_key(fixture.repo.as_path());
+    let user_config = fixture.home.join("config.toml");
+    let untrusted_reason = format!(
+        "{trust_key} is marked as untrusted in the effective configuration. To load project-local config, hooks, and exec policies, update its trust setting. If that setting is managed by your organization, contact your administrator."
+    );
+    let unknown_reason = format!(
+        "To load project-local config, hooks, and exec policies, add {trust_key} as a trusted project in {}.",
+        user_config.display()
+    );
+    for (user, managed, dirs, expected_reason) in [
+        (
+            fixture.trust("trusted"),
+            fixture.trust("untrusted"),
+            vec![],
+            Some(untrusted_reason.as_str()),
+        ),
+        (
+            fixture.trust("untrusted"),
+            fixture.trust("trusted"),
+            vec![&fixture.cwd],
+            None,
+        ),
+        (
+            String::new(),
+            String::new(),
+            vec![],
+            Some(unknown_reason.as_str()),
+        ),
+    ] {
+        std::fs::write(&user_config, user)?;
+        std::fs::write(
+            &fixture.managed,
+            format!("project_root_markers = []\n{managed}"),
+        )?;
+        let (canonical, local) = fixture.load().await?;
+        assert_discovery(&canonical, &local, &dirs, &[])?;
+        assert_eq!(
+            canonical
+                .all_layers_low_to_high()
+                .filter(|layer| matches!(layer.name, ConfigLayerSource::Project { .. }))
+                .map(|layer| layer.disabled_reason.as_deref())
+                .collect::<Vec<_>>(),
+            vec![expected_reason]
+        );
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+#[tokio::test]
+async fn managed_project_discovery_preserves_remapped_provider_bindings() -> anyhow::Result<()> {
+    use base64::Engine;
+    use base64::prelude::BASE64_STANDARD;
+
+    let mut fixture = Fixture::new()?;
+    let providers = "[features.network_proxy.credentials]\n\
+        a = { env = ['A_AUTH'], patterns = ['^pin_[a-z]{8}$'], url_prefixes = ['https://a.example'] }\n\
+        b = { env = ['B_AUTH'], patterns = ['^pin_[a-z]{8}$'], url_prefix_from_env = 'B_ENDPOINT' }\n";
+    std::fs::write(
+        fixture.home.join("config.toml"),
+        format!(
+            "{}\n[features.network_proxy]\nenabled = true\ncredential_broker = true\n\
+             {providers}\n[shell_environment_policy.set]\nB_ENDPOINT = 'https://b.example'\n",
+            fixture.trust("trusted")
+        ),
+    )?;
+    std::fs::write(
+        &fixture.managed,
+        "[features.network_proxy.credentials.a]\nenv = ['A_AUTH']\n",
+    )?;
+    fixture.overrides.managed_preferences_base64 = Some(BASE64_STANDARD.encode(
+        "[features.network_proxy.credentials]\na = { env = ['B_AUTH'] }\nb = { env = ['A_AUTH'] }\n",
+    ));
+    std::fs::write(
+        fixture.cwd.join(".codex/config.toml"),
+        "[shell_environment_policy.set]\nB_ENDPOINT = 'https://attacker.example'\nTOOL_MODE = 'project'\n",
+    )?;
+
+    let (canonical, local) = fixture.load().await?;
+    let mut local_effective = TomlValue::Table(toml::map::Map::new());
+    for layer in local.config.layers {
+        merge_toml_values(&mut local_effective, &layer.toml);
+    }
+    let mut expected: TomlValue = toml::from_str(providers)?;
+    let credentials = &mut expected["features"]["network_proxy"]["credentials"];
+    credentials["a"]["env"] = TomlValue::try_from(["B_AUTH"])?;
+    credentials["b"]["env"] = TomlValue::try_from(["A_AUTH"])?;
+    let expected_policy: TomlValue =
+        toml::from_str("[set]\nB_ENDPOINT = 'https://b.example'\nTOOL_MODE = 'project'\n")?;
+    for effective in [canonical.effective_config(), local_effective] {
+        assert_eq!(
+            &effective["features"]["network_proxy"]["credentials"],
+            &*credentials
+        );
+        assert_eq!(effective["shell_environment_policy"], expected_policy);
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+#[tokio::test]
+async fn managed_project_discovery_mdm_overrides_file_markers() -> anyhow::Result<()> {
+    use base64::Engine;
+    use base64::prelude::BASE64_STANDARD;
+
+    let mut fixture = Fixture::new()?;
+    std::fs::write(&fixture.managed, "project_root_markers = [\".git\"]\n")?;
+    for (markers, dirs) in [
+        (vec![], vec![&fixture.cwd]),
+        (vec![".company-root"], vec![&fixture.project, &fixture.cwd]),
+    ] {
+        let markers_toml = TomlValue::try_from(&markers)?;
+        fixture.overrides.managed_preferences_base64 =
+            Some(BASE64_STANDARD.encode(format!("project_root_markers = {markers_toml}\n")));
+        let (canonical, local) = fixture.load().await?;
+        assert_discovery(&canonical, &local, &dirs, &markers)?;
+        assert_eq!(
+            (
+                canonical
+                    .layers_high_to_low()
+                    .next()
+                    .map(|layer| &layer.name),
+                local.config.layers.last().map(|layer| &layer.source),
+            ),
+            (
+                Some(&ConfigLayerSource::LegacyManagedConfigTomlFromMdm),
+                Some(&ConfigLayerSource::LegacyManagedConfigTomlFromMdm),
+            )
+        );
+    }
+    Ok(())
+}

codex-rs/config/src/loader/managed_requirements.rs

@@ -0,0 +1,121 @@
+//! Loads managed requirements independently of user and project configuration,
+//! retaining source layers for diagnostics during full configuration loads.
+
+use super::layer_io;
+use super::layer_io::LoadedConfigLayers;
+use super::load_requirements_toml;
+#[cfg(target_os = "macos")]
+use super::macos;
+use super::requirements_layers_from_legacy_scheme;
+use super::system_requirements_toml_file_with_overrides;
+use crate::ConfigRequirements;
+use crate::ConfigRequirementsToml;
+use crate::RequirementsLayerEntry;
+use crate::compose_requirements;
+use crate::config_requirements::ConfigRequirementsWithSources;
+use crate::state::ConfigLoadOptions;
+use crate::state::LoaderOverrides;
+use codex_file_system::ExecutorFileSystem;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use std::io;
+use std::path::Path;
+
+/// Loads current managed requirements without reading system defaults, user or
+/// project settings, or thread-provided configuration. Legacy managed config
+/// remains a requirements source.
+pub async fn load_managed_requirements_state(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    options: impl Into<ConfigLoadOptions>,
+) -> io::Result<ConfigRequirementsToml> {
+    let ConfigLoadOptions {
+        loader_overrides: overrides,
+        strict_config,
+        cloud_config_bundle,
+    } = options.into();
+    if overrides.ignore_managed_requirements {
+        return Ok(ConfigRequirementsToml::default());
+    }
+
+    let mut bundle_requirements = Vec::new();
+    if let Some(bundle) = cloud_config_bundle.get().await.map_err(io::Error::other)? {
+        let base_dir = AbsolutePathBuf::from_absolute_path(codex_home)?;
+        bundle_requirements = bundle.requirements_toml.into_layers(&base_dir);
+    }
+    let (requirements, _, _) = load_requirements_from_sources(
+        fs,
+        codex_home,
+        &overrides,
+        strict_config,
+        bundle_requirements,
+    )
+    .await?;
+    let _: ConfigRequirements = requirements.clone().try_into()?;
+    let requirements_toml = requirements.into_toml();
+    // Full config loads also validate required provider definitions when
+    // constructing ConfigLayerStack, including providers not in use by this thread.
+    let _ = crate::model_provider_requirements::to_config(&requirements_toml)?;
+    Ok(requirements_toml)
+}
+
+/// Composes the same requirements for full config loads and policy-only checks.
+/// The loaded legacy config and source layers are also returned for the full
+/// config stack and its ignored-field diagnostics.
+pub(super) async fn load_requirements_from_sources(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    overrides: &LoaderOverrides,
+    strict_config: bool,
+    bundle_requirements: Vec<RequirementsLayerEntry>,
+) -> io::Result<(
+    ConfigRequirementsWithSources,
+    LoadedConfigLayers,
+    Vec<RequirementsLayerEntry>,
+)> {
+    let mut requirements_layers = Vec::new();
+    let mut system_requirements_layer = None;
+    let managed_preferences_requirements_layer;
+    if !overrides.ignore_managed_requirements {
+        #[cfg(target_os = "macos")]
+        {
+            let base_dir = AbsolutePathBuf::from_absolute_path(codex_home)?;
+            managed_preferences_requirements_layer = macos::load_managed_admin_requirements_layer(
+                overrides
+                    .macos_managed_config_requirements_base64
+                    .as_deref(),
+            )
+            .await?
+            .map(|layer| layer.with_base_dir(base_dir));
+        }
+        #[cfg(not(target_os = "macos"))]
+        {
+            managed_preferences_requirements_layer = None;
+        }
+
+        let requirements_file = system_requirements_toml_file_with_overrides(overrides)?;
+        system_requirements_layer = load_requirements_toml(fs, &requirements_file).await?;
+    } else {
+        managed_preferences_requirements_layer = None;
+    }
+
+    let loaded_config_layers =
+        layer_io::load_config_layers_internal(fs, codex_home, overrides.clone(), strict_config)
+            .await?;
+    if !overrides.ignore_managed_requirements {
+        requirements_layers.extend(system_requirements_layer);
+        requirements_layers.extend(bundle_requirements);
+        // Legacy managed_config.toml contributes approval and sandbox requirements.
+        requirements_layers.extend(requirements_layers_from_legacy_scheme(
+            loaded_config_layers.clone(),
+            codex_home,
+        )?);
+        requirements_layers.extend(managed_preferences_requirements_layer);
+    }
+
+    let mut requirements = compose_requirements(requirements_layers.clone())?.unwrap_or_default();
+    if overrides.ignore_login_requirements {
+        requirements.allowed_login_methods = None;
+        requirements.allowed_chatgpt_workspaces = None;
+    }
+    Ok((requirements, loaded_config_layers, requirements_layers))
+}

codex-rs/config/src/loader/mod.rs

@@ -0,0 +1,1982 @@
+mod layer_io;
+mod local;
+#[cfg(target_os = "macos")]
+mod macos;
+mod managed_requirements;
+mod project_discovery;
+#[cfg(test)]
+mod tests;
+#[cfg(windows)]
+mod windows;
+
+use self::layer_io::LoadedConfigLayers;
+use crate::CONFIG_TOML_FILE;
+use crate::CloudConfigBundleLayers;
+use crate::ConfigLayerSource;
+use crate::ProfileV2Name;
+use crate::RequirementsLayerEntry;
+use crate::config_requirements::RequirementSource;
+use crate::config_requirements::SandboxModeRequirement;
+use crate::config_toml::ConfigToml;
+use crate::config_toml::ProjectConfig;
+use crate::diagnostics::ConfigError;
+use crate::diagnostics::config_error_from_toml;
+use crate::diagnostics::first_layer_config_error_from_entries as typed_first_layer_config_error_from_entries;
+use crate::diagnostics::io_error_from_config_error;
+use crate::merge::merge_toml_values;
+use crate::overrides::build_cli_overrides_layer;
+use crate::project_root_markers::default_project_root_markers;
+use crate::project_root_markers::project_root_markers_from_config;
+use crate::shell_environment_policy::ShellEnvironmentPolicyFilterConfigToml;
+use crate::state::ConfigLayerEntry;
+use crate::state::ConfigLayerStack;
+use crate::state::ConfigLoadOptions;
+use crate::state::LoaderOverrides;
+use crate::state::validate_enabled_config_layers;
+use crate::strict_config::config_error_from_ignored_toml_value_fields;
+use crate::strict_config::ignored_config_warning;
+use crate::strict_config::ignored_toml_value_fields;
+use crate::strict_config::unknown_feature_toml_value_field;
+use crate::thread_config::ThreadConfigContext;
+use crate::thread_config::ThreadConfigLoader;
+use codex_file_system::ExecutorFileSystem;
+use codex_git_utils::resolve_root_git_project_for_trust;
+use codex_network_proxy::is_credential_broker_provider_env_key;
+use codex_protocol::config_types::ApprovalsReviewer;
+use codex_protocol::config_types::SandboxMode;
+use codex_protocol::config_types::TrustLevel;
+use codex_protocol::protocol::AskForApproval;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
+use codex_utils_path_uri::PathUri;
+use dunce::canonicalize as normalize_path;
+use serde::Deserialize;
+use std::io;
+use std::path::Path;
+#[cfg(windows)]
+use std::path::PathBuf;
+use toml::Value as TomlValue;
+
+pub use local::LocalConfigLayers;
+pub use local::LocalTomlLayer;
+pub use local::LocalTomlLayerStack;
+pub use local::load_local_config_layers;
+pub use managed_requirements::load_managed_requirements_state;
+#[cfg(windows)]
+pub use windows::WindowsSystemConfigNamespaceProbe;
+#[cfg(windows)]
+pub use windows::probe_windows_system_config_namespace;
+
+#[cfg(unix)]
+const SYSTEM_CONFIG_TOML_FILE_UNIX: &str = "/etc/codex/config.toml";
+
+#[cfg(windows)]
+const DEFAULT_PROGRAM_DATA_DIR_WINDOWS: &str = r"C:\ProgramData";
+
+// Project-local config comes from repository contents, so it should not get to
+// choose where a user's credentials are sent or which local commands are run.
+// These settings are still supported from user, system, managed, and runtime
+// config layers.
+const PROJECT_LOCAL_CONFIG_DENYLIST: &[&str] = &[
+    "openai_base_url",
+    "chatgpt_base_url",
+    "apps_mcp_product_sku",
+    "responses_api_metadata",
+    "model_provider",
+    "model_providers",
+    "notify",
+    "profile",
+    "profiles",
+    "experimental_realtime_webrtc_call_base_url",
+    "experimental_realtime_ws_base_url",
+    "otel",
+];
+
+async fn first_layer_config_error_from_entries(layers: &[ConfigLayerEntry]) -> Option<ConfigError> {
+    typed_first_layer_config_error_from_entries::<ConfigToml>(layers, CONFIG_TOML_FILE).await
+}
+
+/// To build up the set of admin-enforced constraints, requirements layers are
+/// collected in ascending precedence order, matching config layers, and then
+/// composed with config-style TOML merging plus field-specific handling for
+/// hooks, rules, deny-read permissions, and remote sandbox config:
+///
+/// - system    `/etc/codex/requirements.toml` (Unix) or
+///   `%ProgramData%\OpenAI\Codex\requirements.toml` (Windows)
+/// - cloud:    enterprise-managed cloud config bundle requirements
+/// - legacy:   `/etc/codex/managed_config.toml` (Unix) reinterpreted as
+///   requirements.toml
+/// - admin:    managed preferences (*)
+///
+/// For backwards compatibility, Unix continues to load
+/// `/etc/codex/managed_config.toml` and map it to `requirements.toml`.
+///
+/// Configuration is built up from multiple layers in the following order:
+///
+/// - package:  optional default configuration supplied with the Codex package
+/// - admin:    managed preferences (*)
+/// - system    `/etc/codex/config.toml` (Unix) or
+///   `%ProgramData%\OpenAI\Codex\config.toml` (Windows)
+/// - cloud     enterprise-managed cloud config bundle fragments
+/// - user      `${CODEX_HOME}/config.toml`
+/// - profile   `${CODEX_HOME}/<name>.config.toml`, when selected
+/// - cwd       `${PWD}/config.toml` (loaded but disabled when the directory is untrusted)
+/// - tree      parent directories up to root looking for `./.codex/config.toml` (loaded but disabled when untrusted)
+/// - repo      `$(git rev-parse --show-toplevel)/.codex/config.toml` (loaded but disabled when untrusted)
+/// - runtime   e.g., --config flags, model selector in UI
+///
+/// (*) Only available on macOS via managed device profiles.
+///
+/// See https://developers.openai.com/codex/security for details.
+///
+/// When loading the config stack for a thread, there should be a `cwd`
+/// associated with it such that `cwd` should be `Some(...)`. Only for
+/// thread-agnostic config loading (e.g., for the app server's `/config`
+/// endpoint) should `cwd` be `None`.
+#[allow(clippy::too_many_arguments)]
+pub async fn load_config_layers_state(
+    fs: &dyn ExecutorFileSystem,
+    codex_home: &Path,
+    cwd: Option<AbsolutePathBuf>,
+    cli_overrides: &[(String, TomlValue)],
+    options: impl Into<ConfigLoadOptions>,
+    thread_config_loader: &dyn ThreadConfigLoader,
+) -> io::Result<ConfigLayerStack> {
+    let ConfigLoadOptions {
+        loader_overrides: overrides,
+        strict_config,
+        cloud_config_bundle,
+    } = options.into();
+    let packaged_defaults_layer = if let Some(file) = &overrides.packaged_defaults_path {
+        let config = layer_io::read_config_from_path(
+            fs,
+            file,
+            /*log_missing_as_info*/ false,
+            strict_config,
+        )
+        .await?
+        .ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("packaged defaults config file {} not found", file.display()),
+            )
+        })?;
+        let base_dir = file.as_path().parent().ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "packaged defaults config file {} has no parent directory",
+                    file.display()
+                ),
+            )
+        })?;
+        ConfigLayerEntry::new(
+            ConfigLayerSource::PackagedDefaults { file: file.clone() },
+            resolve_relative_paths_in_config_toml(config, base_dir)?,
+        )
+    } else {
+        let file = AbsolutePathBuf::from_absolute_path(std::env::current_exe()?)?;
+        let raw_toml = include_str!("../../defaults.toml");
+        let config = toml::from_str(raw_toml).map_err(|error| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("invalid embedded packaged defaults; this is a Codex build error: {error}"),
+            )
+        })?;
+        ConfigLayerEntry::new_with_raw_toml(
+            ConfigLayerSource::PackagedDefaults { file },
+            config,
+            raw_toml.to_owned(),
+            AbsolutePathBuf::from_absolute_path(codex_home)?,
+        )
+    };
+    let active_user_profile = overrides.user_config_profile.clone();
+    let ignore_user_config = overrides.ignore_user_config;
+    let ignore_project_config = overrides.ignore_project_config;
+    let ignore_user_and_project_exec_policy_rules =
+        overrides.ignore_user_and_project_exec_policy_rules;
+    let mut bundle_requirements_layers = Vec::new();
+    let mut cloud_config_layers = Vec::new();
+
+    if !overrides.ignore_managed_requirements
+        && let Some(bundle) = cloud_config_bundle.get().await.map_err(io::Error::other)?
+    {
+        let cloud_config_base_dir = AbsolutePathBuf::from_absolute_path(codex_home)?;
+        let bundle_layers = if strict_config {
+            CloudConfigBundleLayers::from_bundle_strict_config(bundle, &cloud_config_base_dir)?
+        } else {
+            CloudConfigBundleLayers::from_bundle(bundle, &cloud_config_base_dir)?
+        };
+        let CloudConfigBundleLayers {
+            enterprise_managed_config,
+            enterprise_managed_requirements,
+        } = bundle_layers;
+        bundle_requirements_layers = enterprise_managed_requirements;
+        cloud_config_layers = enterprise_managed_config;
+    }
+
+    let (config_requirements_toml, loaded_config_layers, requirements_layers) =
+        managed_requirements::load_requirements_from_sources(
+            fs,
+            codex_home,
+            &overrides,
+            strict_config,
+            bundle_requirements_layers,
+        )
+        .await?;
+    let mut startup_warnings = loaded_config_layers.startup_warnings.clone();
+
+    let thread_config_context = ThreadConfigContext {
+        thread_id: None,
+        cwd: cwd.clone(),
+    };
+    let thread_config_layers = thread_config_loader
+        .load_config_layers(thread_config_context)
+        .await
+        .map_err(io::Error::other)?;
+
+    let mut layers = Vec::<ConfigLayerEntry>::new();
+    layers.push(packaged_defaults_layer);
+
+    let cli_overrides_layer = if cli_overrides.is_empty() {
+        None
+    } else {
+        let cli_overrides_layer = build_cli_overrides_layer(cli_overrides);
+        let base_dir = cwd
+            .as_ref()
+            .map(AbsolutePathBuf::as_path)
+            .unwrap_or(codex_home);
+        if strict_config {
+            validate_cli_overrides_strictly(&cli_overrides_layer, base_dir)?;
+        }
+        Some(resolve_relative_paths_in_config_toml(
+            cli_overrides_layer,
+            base_dir,
+        )?)
+    };
+
+    // Include an entry for the "system" config folder, loading its config.toml,
+    // if it exists.
+    let system_config_toml_file = system_config_toml_file_with_overrides(&overrides)?;
+    let system_layer = load_config_toml_for_required_layer(
+        fs,
+        &system_config_toml_file,
+        strict_config,
+        |config_toml| {
+            ConfigLayerEntry::new(
+                ConfigLayerSource::System {
+                    file: system_config_toml_file.clone(),
+                },
+                config_toml,
+            )
+        },
+    )
+    .await?;
+    layers.push(system_layer);
+    layers.extend(cloud_config_layers);
+
+    // Add the base user config layer. When profile-v2 is selected, add the
+    // profile config as a second user layer on top so the profile only needs to
+    // contain overrides.
+    let active_user_file = overrides.user_config_path(codex_home)?;
+    let base_user_file = AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, codex_home);
+    let base_user_layer = load_user_config_layer(
+        fs,
+        &base_user_file,
+        /*profile*/ None,
+        ignore_user_config,
+        strict_config,
+    )
+    .await?;
+    if let Some(active_user_profile) = active_user_profile.as_ref()
+        && let Some(base_user_config) = base_user_layer.config.as_table()
+    {
+        let legacy_profile_is_selected = base_user_config
+            .get("profile")
+            .and_then(TomlValue::as_str)
+            .is_some_and(|profile| profile == active_user_profile.as_str());
+        let legacy_profile_table_exists = base_user_config
+            .get("profiles")
+            .and_then(TomlValue::as_table)
+            .is_some_and(|profiles| profiles.contains_key(active_user_profile.as_str()));
+        if legacy_profile_is_selected || legacy_profile_table_exists {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "--profile `{active_user_profile}` cannot be used while {} contains legacy `profile = \"{active_user_profile}\"` or `[profiles.{active_user_profile}]` config; move those settings into {} and remove the legacy profile selector/table. See https://developers.openai.com/codex/config-advanced#profiles for more information.",
+                    base_user_file.as_path().display(),
+                    active_user_file.as_path().display()
+                ),
+            ));
+        }
+    }
+    layers.push(base_user_layer);
+
+    if active_user_file != base_user_file {
+        layers.push(
+            load_user_config_layer(
+                fs,
+                &active_user_file,
+                active_user_profile.as_ref(),
+                ignore_user_config,
+                strict_config,
+            )
+            .await?,
+        );
+    }
+
+    if !ignore_project_config && let Some(cwd) = cwd {
+        let mut merged_so_far = TomlValue::Table(toml::map::Map::new());
+        for layer in &layers {
+            merge_toml_values(&mut merged_so_far, &layer.config);
+        }
+        if let Some(cli_overrides_layer) = cli_overrides_layer.as_ref() {
+            merge_toml_values(&mut merged_so_far, cli_overrides_layer);
+        }
+        let trusted_broker_config = credential_broker_trusted_config(
+            &merged_so_far,
+            &thread_config_layers,
+            &loaded_config_layers,
+        );
+        // Managed config wins over CLI config. Apply it before choosing the
+        // project root and trust, but keep its final layers above project config.
+        project_discovery::merge_managed_config_for_discovery(
+            &mut merged_so_far,
+            &loaded_config_layers,
+            codex_home,
+        )?;
+
+        let project_root_markers = match project_root_markers_from_config(&merged_so_far) {
+            Ok(markers) => markers.unwrap_or_else(default_project_root_markers),
+            Err(err) => {
+                if let Some(config_error) = first_layer_config_error_from_entries(&layers).await {
+                    return Err(io_error_from_config_error(
+                        io::ErrorKind::InvalidData,
+                        config_error,
+                        /*source*/ None,
+                    ));
+                }
+                return Err(err);
+            }
+        };
+        let mut project_trust_context = match project_trust_context(
+            fs,
+            &merged_so_far,
+            &trusted_broker_config,
+            &cwd,
+            &project_root_markers,
+            codex_home,
+            &active_user_file,
+        )
+        .await
+        {
+            Ok(context) => context,
+            Err(err) => {
+                let source = err
+                    .get_ref()
+                    .and_then(|err| err.downcast_ref::<toml::de::Error>())
+                    .cloned();
+                if let Some(config_error) = first_layer_config_error_from_entries(&layers).await {
+                    return Err(io_error_from_config_error(
+                        io::ErrorKind::InvalidData,
+                        config_error,
+                        source,
+                    ));
+                }
+                return Err(err);
+            }
+        };
+        apply_credential_broker_requirements(&mut project_trust_context, &config_requirements_toml);
+        let project_layers = load_project_layers(
+            fs,
+            &cwd,
+            &project_trust_context.project_root,
+            &project_trust_context,
+            codex_home,
+            strict_config,
+        )
+        .await?;
+        layers.extend(project_layers.layers);
+        startup_warnings.extend(project_layers.startup_warnings);
+    }
+
+    // Add a layer for runtime overrides from the CLI or UI, if any exist.
+    if let Some(cli_overrides_layer) = cli_overrides_layer {
+        layers.push(ConfigLayerEntry::new(
+            ConfigLayerSource::SessionFlags,
+            cli_overrides_layer,
+        ));
+    }
+
+    for thread_config_layer in thread_config_layers {
+        insert_layer_by_precedence(&mut layers, thread_config_layer);
+    }
+
+    // Make a best-effort to support the legacy `managed_config.toml` as a
+    // config layer on top of everything else. For fields in
+    // `managed_config.toml` that do not have an equivalent in
+    // `ConfigRequirements`, note users can still override these values on a
+    // per-turn basis in the TUI and VS Code.
+    let LoadedConfigLayers {
+        managed_config,
+        managed_config_from_mdm,
+        ..
+    } = loaded_config_layers;
+    if let Some(config) = managed_config {
+        let managed_parent = config.file.as_path().parent().ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "Managed config file {} has no parent directory",
+                    config.file.as_path().display()
+                ),
+            )
+        })?;
+        let managed_config =
+            resolve_relative_paths_in_config_toml(config.managed_config, managed_parent)?;
+        layers.push(ConfigLayerEntry::new(
+            ConfigLayerSource::LegacyManagedConfigTomlFromFile { file: config.file },
+            managed_config,
+        ));
+    }
+    if let Some(config) = managed_config_from_mdm {
+        // As a general rule, config from MDM should _not_ include relative
+        // paths, starting with `./`, but a path starting with `~/` _is_ a
+        // supported use case. Because resolve_relative_paths_in_config_toml()
+        // relies on AbsolutePathBufGuard to resolve `~/`, we must supply a
+        // value for base_dir. Preserve that same base on the layer so later
+        // raw-TOML diagnostics parse with the same path semantics.
+        let raw_toml_base_dir = AbsolutePathBuf::from_absolute_path(codex_home)?;
+        let managed_config = resolve_relative_paths_in_config_toml(
+            config.managed_config,
+            raw_toml_base_dir.as_path(),
+        )?;
+        layers.push(ConfigLayerEntry::new_with_raw_toml(
+            ConfigLayerSource::LegacyManagedConfigTomlFromMdm,
+            managed_config,
+            config.raw_toml,
+            raw_toml_base_dir,
+        ));
+    }
+
+    if let Err(err) = validate_enabled_config_layers(&layers) {
+        if let Some(config_error) = typed_first_layer_config_error_from_entries::<
+            ShellEnvironmentPolicyFilterConfigToml,
+        >(&layers, CONFIG_TOML_FILE)
+        .await
+        {
+            return Err(io_error_from_config_error(
+                io::ErrorKind::InvalidData,
+                config_error,
+                /*source*/ None,
+            ));
+        }
+        return Err(err);
+    }
+
+    let config_layer_stack = ConfigLayerStack::new(
+        layers,
+        config_requirements_toml.clone().try_into()?,
+        config_requirements_toml.into_toml(),
+    )?
+    .with_user_and_project_exec_policy_rules_ignored(ignore_user_and_project_exec_policy_rules);
+    startup_warnings.extend(ignored_config_warning(
+        &config_layer_stack,
+        &requirements_layers,
+    ));
+    Ok(config_layer_stack.with_startup_warnings(startup_warnings))
+}
+
+async fn load_user_config_layer(
+    fs: &dyn ExecutorFileSystem,
+    user_file: &AbsolutePathBuf,
+    profile: Option<&ProfileV2Name>,
+    ignore_user_config: bool,
+    strict_config: bool,
+) -> io::Result<ConfigLayerEntry> {
+    let profile = profile.map(ToString::to_string);
+    if ignore_user_config {
+        return Ok(ConfigLayerEntry::new(
+            ConfigLayerSource::User {
+                file: user_file.clone(),
+                profile,
+            },
+            TomlValue::Table(toml::map::Map::new()),
+        ));
+    }
+
+    load_config_toml_for_required_layer(fs, user_file, strict_config, |config_toml| {
+        ConfigLayerEntry::new(
+            ConfigLayerSource::User {
+                file: user_file.clone(),
+                profile: profile.clone(),
+            },
+            config_toml,
+        )
+    })
+    .await
+}
+
+fn insert_layer_by_precedence(layers: &mut Vec<ConfigLayerEntry>, layer: ConfigLayerEntry) {
+    match layers
+        .iter()
+        .position(|existing| existing.name.precedence() > layer.name.precedence())
+    {
+        Some(index) => layers.insert(index, layer),
+        None => layers.push(layer),
+    }
+}
+
+/// Attempts to load a config.toml file from `config_toml`.
+/// - If the file exists and is valid TOML, passes the parsed `toml::Value` to
+///   `create_entry` and returns the resulting layer entry.
+/// - If the file does not exist, uses an empty `Table` with `create_entry` and
+///   returns the resulting layer entry.
+/// - If there is an error reading the file or parsing the TOML, returns an
+///   error.
+async fn load_config_toml_for_required_layer(
+    fs: &dyn ExecutorFileSystem,
+    toml_file: &AbsolutePathBuf,
+    strict_config: bool,
+    create_entry: impl FnOnce(TomlValue) -> ConfigLayerEntry,
+) -> io::Result<ConfigLayerEntry> {
+    let loaded = load_config_toml_for_required_layer_raw(fs, toml_file, strict_config).await?;
+    let toml_value = resolve_relative_paths_in_config_toml(loaded.toml, loaded.base_dir.as_path())?;
+
+    Ok(create_entry(toml_value))
+}
+
+#[derive(Debug, Clone)]
+struct LoadedTomlFile {
+    toml: TomlValue,
+    base_dir: AbsolutePathBuf,
+}
+
+async fn load_config_toml_for_required_layer_raw(
+    fs: &dyn ExecutorFileSystem,
+    toml_file: &AbsolutePathBuf,
+    strict_config: bool,
+) -> io::Result<LoadedTomlFile> {
+    let config_parent = toml_file.as_path().parent().ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "Config file {} has no parent directory",
+                toml_file.as_path().display()
+            ),
+        )
+    })?;
+    let base_dir = AbsolutePathBuf::from_absolute_path(config_parent)?;
+    let toml_file_uri = PathUri::from_abs_path(toml_file);
+    let toml_value = match fs
+        .read_file_text(&toml_file_uri, Default::default(), /*sandbox*/ None)
+        .await
+    {
+        Ok(contents) => {
+            let config: TomlValue = toml::from_str(&contents).map_err(|err| {
+                let config_error =
+                    config_error_from_toml(toml_file.as_path(), &contents, err.clone());
+                io_error_from_config_error(io::ErrorKind::InvalidData, config_error, Some(err))
+            })?;
+            if strict_config {
+                validate_config_toml_strictly(
+                    toml_file.as_path(),
+                    &contents,
+                    &config,
+                    config_parent,
+                )?;
+            }
+            Ok(config)
+        }
+        Err(e) => {
+            if e.kind() == io::ErrorKind::NotFound {
+                Ok(TomlValue::Table(toml::map::Map::new()))
+            } else {
+                Err(io::Error::new(
+                    e.kind(),
+                    format!(
+                        "Failed to read config file {}: {e}",
+                        toml_file.as_path().display()
+                    ),
+                ))
+            }
+        }
+    }?;
+
+    Ok(LoadedTomlFile {
+        toml: toml_value,
+        base_dir,
+    })
+}
+
+fn validate_config_toml_strictly(
+    toml_file: &Path,
+    contents: &str,
+    value: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields::<ConfigToml>(
+        toml_file,
+        contents,
+        value.clone(),
+    ) {
+        Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_cli_overrides_strictly(
+    cli_overrides_layer: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(path) = ignored_toml_value_fields::<ConfigToml>(cli_overrides_layer.clone()).first()
+    {
+        let ignored_path = path.join(".");
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("unknown configuration field `{ignored_path}` in -c/--config override"),
+        ));
+    }
+
+    if let Some(ignored_path) = unknown_feature_toml_value_field(cli_overrides_layer) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("unknown configuration field `{ignored_path}` in -c/--config override"),
+        ));
+    }
+
+    Ok(())
+}
+
+/// If available, load requirements from the platform's system `requirements.toml`
+/// location as a requirements layer.
+pub async fn load_requirements_toml(
+    fs: &dyn ExecutorFileSystem,
+    requirements_toml_file: &AbsolutePathBuf,
+) -> io::Result<Option<RequirementsLayerEntry>> {
+    let requirements_toml_file_uri = PathUri::from_abs_path(requirements_toml_file);
+    match fs
+        .read_file_text(
+            &requirements_toml_file_uri,
+            Default::default(),
+            /*sandbox*/ None,
+        )
+        .await
+    {
+        Ok(contents) => {
+            let requirements_parent = requirements_toml_file.parent().ok_or_else(|| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!(
+                        "Requirements file {} has no parent directory",
+                        requirements_toml_file.as_ref().display()
+                    ),
+                )
+            })?;
+            let base_dir = AbsolutePathBuf::from_absolute_path(requirements_parent)?;
+            Ok(Some(
+                RequirementsLayerEntry::from_toml(
+                    RequirementSource::SystemRequirementsToml {
+                        file: requirements_toml_file.clone(),
+                    },
+                    contents,
+                )
+                .with_base_dir(base_dir),
+            ))
+        }
+        Err(e) => {
+            if e.kind() != io::ErrorKind::NotFound {
+                Err(io::Error::new(
+                    e.kind(),
+                    format!(
+                        "Failed to read requirements file {}: {e}",
+                        requirements_toml_file.as_path().display(),
+                    ),
+                ))
+            } else {
+                Ok(None)
+            }
+        }
+    }
+}
+
+#[cfg(unix)]
+fn system_requirements_toml_file() -> io::Result<AbsolutePathBuf> {
+    AbsolutePathBuf::from_absolute_path(Path::new("/etc/codex/requirements.toml"))
+}
+
+#[cfg(windows)]
+fn system_requirements_toml_file() -> io::Result<AbsolutePathBuf> {
+    windows_system_requirements_toml_file()
+}
+
+fn system_requirements_toml_file_with_overrides(
+    overrides: &LoaderOverrides,
+) -> io::Result<AbsolutePathBuf> {
+    match &overrides.system_requirements_path {
+        Some(path) => AbsolutePathBuf::from_absolute_path(path),
+        None => system_requirements_toml_file(),
+    }
+}
+
+/// Check local managed configuration sources without loading or parsing configuration.
+///
+/// Filesystem or managed-preference errors are returned so callers can conservatively avoid
+/// assuming that administrator-controlled configuration is absent.
+pub fn has_local_managed_configuration(codex_home: &Path) -> io::Result<bool> {
+    let system_requirements_file = system_requirements_toml_file()?;
+    has_local_managed_configuration_with_system_requirements_path(
+        codex_home,
+        system_requirements_file.as_path(),
+    )
+}
+
+fn has_local_managed_configuration_with_system_requirements_path(
+    codex_home: &Path,
+    system_requirements_path: &Path,
+) -> io::Result<bool> {
+    #[cfg(windows)]
+    let _ = codex_home;
+
+    #[cfg(not(windows))]
+    if layer_io::managed_config_default_path(codex_home).try_exists()? {
+        return Ok(true);
+    }
+
+    if system_requirements_path.try_exists()? {
+        return Ok(true);
+    }
+
+    #[cfg(target_os = "macos")]
+    if macos::has_managed_preferences()? {
+        return Ok(true);
+    }
+
+    Ok(false)
+}
+
+#[cfg(unix)]
+pub fn system_config_toml_file() -> io::Result<AbsolutePathBuf> {
+    AbsolutePathBuf::from_absolute_path(Path::new(SYSTEM_CONFIG_TOML_FILE_UNIX))
+}
+
+#[cfg(windows)]
+pub fn system_config_toml_file() -> io::Result<AbsolutePathBuf> {
+    windows_system_config_toml_file()
+}
+
+fn system_config_toml_file_with_overrides(
+    overrides: &LoaderOverrides,
+) -> io::Result<AbsolutePathBuf> {
+    match &overrides.system_config_path {
+        Some(path) => AbsolutePathBuf::from_absolute_path(path),
+        None => system_config_toml_file(),
+    }
+}
+
+#[cfg(windows)]
+fn windows_codex_system_dir() -> PathBuf {
+    let program_data = windows_program_data_dir_from_known_folder().unwrap_or_else(|err| {
+        tracing::warn!(
+            error = %err,
+            "Failed to resolve ProgramData known folder; using default path"
+        );
+        PathBuf::from(DEFAULT_PROGRAM_DATA_DIR_WINDOWS)
+    });
+    program_data.join("OpenAI").join("Codex")
+}
+
+#[cfg(windows)]
+fn windows_system_requirements_toml_file() -> io::Result<AbsolutePathBuf> {
+    let requirements_toml_file = windows_codex_system_dir().join("requirements.toml");
+    AbsolutePathBuf::try_from(requirements_toml_file)
+}
+
+#[cfg(windows)]
+fn windows_system_config_toml_file() -> io::Result<AbsolutePathBuf> {
+    let config_toml_file = windows_codex_system_dir().join("config.toml");
+    AbsolutePathBuf::try_from(config_toml_file)
+}
+
+#[cfg(windows)]
+fn windows_program_data_dir_from_known_folder() -> io::Result<PathBuf> {
+    use std::ffi::OsString;
+    use std::os::windows::ffi::OsStringExt;
+    use windows_sys::Win32::System::Com::CoTaskMemFree;
+    use windows_sys::Win32::UI::Shell::FOLDERID_ProgramData;
+    use windows_sys::Win32::UI::Shell::KF_FLAG_DEFAULT;
+    use windows_sys::Win32::UI::Shell::SHGetKnownFolderPath;
+
+    let mut path_ptr = std::ptr::null_mut::<u16>();
+    let known_folder_flags = u32::try_from(KF_FLAG_DEFAULT).map_err(|_| {
+        io::Error::other(format!(
+            "KF_FLAG_DEFAULT did not fit in u32: {KF_FLAG_DEFAULT}"
+        ))
+    })?;
+    // Known folder IDs reference:
+    // https://learn.microsoft.com/en-us/windows/win32/shell/knownfolderid
+    // SAFETY: SHGetKnownFolderPath initializes path_ptr with a CoTaskMem-allocated,
+    // null-terminated UTF-16 string on success.
+    let hr = unsafe {
+        SHGetKnownFolderPath(&FOLDERID_ProgramData, known_folder_flags, 0, &mut path_ptr)
+    };
+    if hr != 0 {
+        return Err(io::Error::other(format!(
+            "SHGetKnownFolderPath(FOLDERID_ProgramData) failed with HRESULT {hr:#010x}"
+        )));
+    }
+    if path_ptr.is_null() {
+        return Err(io::Error::other(
+            "SHGetKnownFolderPath(FOLDERID_ProgramData) returned a null pointer",
+        ));
+    }
+
+    // SAFETY: path_ptr is a valid null-terminated UTF-16 string allocated by
+    // SHGetKnownFolderPath and must be freed with CoTaskMemFree.
+    let path = unsafe {
+        let mut len = 0usize;
+        while *path_ptr.add(len) != 0 {
+            len += 1;
+        }
+        let wide = std::slice::from_raw_parts(path_ptr, len);
+        let path = PathBuf::from(OsString::from_wide(wide));
+        CoTaskMemFree(path_ptr.cast());
+        path
+    };
+
+    Ok(path)
+}
+
+fn requirements_layers_from_legacy_scheme(
+    loaded_config_layers: LoadedConfigLayers,
+    codex_home: &Path,
+) -> io::Result<Vec<RequirementsLayerEntry>> {
+    // List the file-backed legacy layer first because requirements layers are
+    // composed lowest-precedence to highest-precedence, and MDM has higher
+    // precedence than the legacy managed_config.toml file.
+    let LoadedConfigLayers {
+        managed_config,
+        managed_config_from_mdm,
+        ..
+    } = loaded_config_layers;
+
+    let layer_count =
+        usize::from(managed_config.is_some()) + usize::from(managed_config_from_mdm.is_some());
+    let mut layers = Vec::with_capacity(layer_count);
+    let codex_home = AbsolutePathBuf::from_absolute_path(codex_home)?;
+    for (source, config, base_dir) in managed_config
+        .map(|c| {
+            let base_dir = c.file.parent().ok_or_else(|| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!(
+                        "Managed config file {} has no parent directory",
+                        c.file.as_path().display()
+                    ),
+                )
+            })?;
+            Ok::<_, io::Error>((
+                RequirementSource::LegacyManagedConfigTomlFromFile { file: c.file },
+                c.managed_config,
+                base_dir,
+            ))
+        })
+        .transpose()?
+        .into_iter()
+        .chain(managed_config_from_mdm.map(|config| {
+            (
+                RequirementSource::LegacyManagedConfigTomlFromMdm,
+                config.managed_config,
+                codex_home.clone(),
+            )
+        }))
+    {
+        let legacy_config: LegacyManagedConfigToml =
+            config.try_into().map_err(|err: toml::de::Error| {
+                io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("Failed to parse config requirements as TOML: {err}"),
+                )
+            })?;
+
+        layers.push(
+            RequirementsLayerEntry::from_toml_value(
+                source,
+                legacy_requirements_to_toml_value(legacy_config)?,
+            )
+            .with_base_dir(base_dir),
+        );
+    }
+
+    Ok(layers)
+}
+
+fn legacy_requirements_to_toml_value(legacy: LegacyManagedConfigToml) -> io::Result<TomlValue> {
+    let LegacyManagedConfigToml {
+        approval_policy,
+        approvals_reviewer,
+        sandbox_mode,
+    } = legacy;
+    let mut table = toml::map::Map::new();
+    if let Some(approval_policy) = approval_policy {
+        table.insert(
+            "allowed_approval_policies".to_string(),
+            toml_value_from_serializable(vec![approval_policy])?,
+        );
+    }
+    if let Some(approvals_reviewer) = approvals_reviewer {
+        let mut allowed_reviewers = vec![approvals_reviewer];
+        if approvals_reviewer == ApprovalsReviewer::AutoReview {
+            allowed_reviewers.push(ApprovalsReviewer::User);
+        }
+        table.insert(
+            "allowed_approvals_reviewers".to_string(),
+            toml_value_from_serializable(allowed_reviewers)?,
+        );
+    }
+    if let Some(sandbox_mode) = sandbox_mode {
+        let required_mode: SandboxModeRequirement = sandbox_mode.into();
+        // Allowing read-only is a requirement for Codex to function correctly.
+        // So in this backfill path, we append read-only if it's not already specified.
+        let mut allowed_modes = vec![SandboxModeRequirement::ReadOnly];
+        if required_mode != SandboxModeRequirement::ReadOnly {
+            allowed_modes.push(required_mode);
+        }
+        table.insert(
+            "allowed_sandbox_modes".to_string(),
+            toml_value_from_serializable(allowed_modes)?,
+        );
+    }
+    Ok(TomlValue::Table(table))
+}
+
+fn toml_value_from_serializable<T: serde::Serialize>(value: T) -> io::Result<TomlValue> {
+    TomlValue::try_from(value).map_err(|err| io::Error::new(io::ErrorKind::InvalidData, err))
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum CredentialBrokerProjectState {
+    Unconfigured,
+    Disabled,
+    Enabled,
+}
+
+fn apply_credential_broker_requirements(
+    context: &mut ProjectTrustContext,
+    requirements: &crate::ConfigRequirementsWithSources,
+) {
+    if context.credential_broker == CredentialBrokerProjectState::Unconfigured {
+        return;
+    }
+    let enabled = requirements
+        .feature_requirements
+        .as_ref()
+        .and_then(|requirements| requirements.entries.get("network_proxy"))
+        .copied()
+        .unwrap_or(context.credential_broker == CredentialBrokerProjectState::Enabled);
+    context.credential_broker = if enabled
+        && requirements
+            .network
+            .as_ref()
+            .is_none_or(|network| network.enabled != Some(false))
+    {
+        CredentialBrokerProjectState::Enabled
+    } else {
+        CredentialBrokerProjectState::Disabled
+    };
+}
+
+struct ProjectTrustContext {
+    project_root: AbsolutePathBuf,
+    project_root_key: String,
+    project_root_lookup_keys: Vec<String>,
+    checkout_root: Option<AbsolutePathBuf>,
+    repo_root: Option<AbsolutePathBuf>,
+    repo_root_key: Option<String>,
+    repo_root_lookup_keys: Option<Vec<String>>,
+    projects_trust: std::collections::HashMap<String, TrustLevel>,
+    user_config_file: AbsolutePathBuf,
+    credential_broker: CredentialBrokerProjectState,
+    credential_broker_provider_env_keys: Vec<String>,
+}
+
+#[derive(Deserialize)]
+struct ProjectTrustConfigToml {
+    projects: Option<std::collections::HashMap<String, ProjectConfig>>,
+}
+
+struct ProjectTrustDecision {
+    trust_level: Option<TrustLevel>,
+    trust_key: String,
+}
+
+impl ProjectTrustDecision {
+    fn is_trusted(&self) -> bool {
+        matches!(self.trust_level, Some(TrustLevel::Trusted))
+    }
+}
+
+impl ProjectTrustContext {
+    fn decision_for_dir(&self, dir: &AbsolutePathBuf) -> ProjectTrustDecision {
+        for dir_key in normalized_project_trust_keys(dir.as_path()) {
+            if let Some((trust_key, trust_level)) =
+                project_trust_for_lookup_key(&self.projects_trust, &dir_key)
+            {
+                return ProjectTrustDecision {
+                    trust_level: Some(trust_level),
+                    trust_key,
+                };
+            }
+        }
+
+        for project_root_key in &self.project_root_lookup_keys {
+            if let Some((trust_key, trust_level)) =
+                project_trust_for_lookup_key(&self.projects_trust, project_root_key)
+            {
+                return ProjectTrustDecision {
+                    trust_level: Some(trust_level),
+                    trust_key,
+                };
+            }
+        }
+
+        if let Some(repo_root_lookup_keys) = self.repo_root_lookup_keys.as_ref() {
+            for repo_root_key in repo_root_lookup_keys {
+                if let Some((trust_key, trust_level)) =
+                    project_trust_for_lookup_key(&self.projects_trust, repo_root_key)
+                {
+                    return ProjectTrustDecision {
+                        trust_level: Some(trust_level),
+                        trust_key,
+                    };
+                }
+            }
+        }
+
+        ProjectTrustDecision {
+            trust_level: None,
+            trust_key: self
+                .repo_root_key
+                .clone()
+                .unwrap_or_else(|| self.project_root_key.clone()),
+        }
+    }
+
+    fn disabled_reason_for_decision(&self, decision: &ProjectTrustDecision) -> Option<String> {
+        if decision.is_trusted() {
+            return None;
+        }
+
+        let gated_features = "project-local config, hooks, and exec policies";
+        let trust_key = decision.trust_key.as_str();
+        let user_config_file = self.user_config_file.as_path().display();
+        // Trust may come from managed config. Keep the explicit-untrusted prefix
+        // stable because the remote TUI uses it to recognize existing decisions.
+        match decision.trust_level {
+            Some(TrustLevel::Untrusted) => Some(format!(
+                "{trust_key} is marked as untrusted in the effective configuration. To load {gated_features}, update its trust setting. If that setting is managed by your organization, contact your administrator."
+            )),
+            _ => Some(format!(
+                "To load {gated_features}, add {trust_key} as a trusted project in {user_config_file}."
+            )),
+        }
+    }
+
+    fn root_checkout_hooks_folder_for_dir(&self, dir: &AbsolutePathBuf) -> Option<AbsolutePathBuf> {
+        let checkout_root = self.checkout_root.as_ref()?;
+        let repo_root = self.repo_root.as_ref()?;
+        // Regular checkouts resolve both paths to the same root; linked worktrees do not.
+        if checkout_root == repo_root {
+            return None;
+        }
+
+        let relative_dir = dir.as_path().strip_prefix(checkout_root.as_path()).ok()?;
+        Some(repo_root.join(relative_dir).join(".codex"))
+    }
+}
+
+fn project_layer_entry(
+    dot_codex_folder: &AbsolutePathBuf,
+    config: TomlValue,
+    disabled_reason: Option<String>,
+    hooks_config_folder_override: Option<AbsolutePathBuf>,
+) -> ConfigLayerEntry {
+    let source = ConfigLayerSource::Project {
+        dot_codex_folder: dot_codex_folder.clone(),
+    };
+
+    let entry = if let Some(reason) = disabled_reason {
+        ConfigLayerEntry::new_disabled(source, config, reason)
+    } else {
+        ConfigLayerEntry::new(source, config)
+    };
+    entry.with_hooks_config_folder_override(hooks_config_folder_override)
+}
+
+fn sanitize_project_config(
+    config: &mut TomlValue,
+    credential_broker: CredentialBrokerProjectState,
+    trusted_provider_env_keys: &[String],
+) -> Vec<String> {
+    let Some(table) = config.as_table_mut() else {
+        return Vec::new();
+    };
+
+    let credential_broker_configured =
+        credential_broker != CredentialBrokerProjectState::Unconfigured;
+    let mut ignored_keys = Vec::new();
+    for key in PROJECT_LOCAL_CONFIG_DENYLIST {
+        if table.remove(*key).is_some() {
+            ignored_keys.push((*key).to_string());
+        }
+    }
+    if let Some(features) = table.get_mut("features").and_then(TomlValue::as_table_mut) {
+        if credential_broker == CredentialBrokerProjectState::Enabled
+            && features.remove("shell_snapshot").is_some()
+        {
+            ignored_keys.push("features.shell_snapshot".to_string());
+        }
+        if features.remove("respect_system_proxy").is_some() {
+            ignored_keys.push("features.respect_system_proxy".to_string());
+        }
+        if credential_broker_configured
+            && features
+                .get("network_proxy")
+                .is_some_and(|network_proxy| network_proxy.as_bool().is_some())
+        {
+            features.remove("network_proxy");
+            ignored_keys.push("features.network_proxy".to_string());
+        } else if let Some(network_proxy) = features
+            .get_mut("network_proxy")
+            .and_then(TomlValue::as_table_mut)
+        {
+            if network_proxy.remove("credential_broker").is_some() {
+                ignored_keys.push("features.network_proxy.credential_broker".to_string());
+            }
+            if network_proxy.remove("credentials").is_some() {
+                ignored_keys.push("features.network_proxy.credentials".to_string());
+            }
+            if credential_broker_configured && network_proxy.remove("enabled").is_some() {
+                ignored_keys.push("features.network_proxy.enabled".to_string());
+            }
+        }
+    }
+    if credential_broker == CredentialBrokerProjectState::Enabled
+        && let Some(policy) = table
+            .get_mut("shell_environment_policy")
+            .and_then(TomlValue::as_table_mut)
+    {
+        if policy.remove("experimental_use_profile").is_some() {
+            ignored_keys.push("shell_environment_policy.experimental_use_profile".to_string());
+        }
+        let environment_keys_match = |left: &str, right: &str| {
+            left == right || cfg!(windows) && left.eq_ignore_ascii_case(right)
+        };
+        if let Some(overrides) = policy.get_mut("set").and_then(TomlValue::as_table_mut) {
+            overrides.retain(|key, _| {
+                if key.eq_ignore_ascii_case("ZDOTDIR")
+                    || key.eq_ignore_ascii_case("BASH_ENV")
+                    || is_credential_broker_provider_env_key(key)
+                    || trusted_provider_env_keys
+                        .iter()
+                        .any(|provider_key| environment_keys_match(key, provider_key))
+                {
+                    ignored_keys.push(format!("shell_environment_policy.set.{key}"));
+                    false
+                } else {
+                    true
+                }
+            });
+        }
+    }
+    // Repository contents must not turn an ordinary key into a permission increase.
+    if let Some(chat) = table
+        .get_mut("tui")
+        .and_then(|tui| tui.get_mut("keymap"))
+        .and_then(|keymap| keymap.get_mut("chat"))
+        .and_then(TomlValue::as_table_mut)
+    {
+        for key in ["previous_permission_mode", "next_permission_mode"] {
+            if chat.remove(key).is_some() {
+                ignored_keys.push(format!("tui.keymap.chat.{key}"));
+            }
+        }
+    }
+
+    ignored_keys
+}
+
+fn project_ignored_config_keys_warning(
+    dot_codex_folder: &AbsolutePathBuf,
+    ignored_keys: &[String],
+) -> String {
+    let config_path = dot_codex_folder.join(CONFIG_TOML_FILE);
+    let ignored_keys = ignored_keys.join(", ");
+    format!(
+        concat!(
+            "Ignored unsupported project-local config keys in {config_path}: {ignored_keys}. ",
+            "If you want these settings to apply, manually set them in your ",
+            "user-level config.toml."
+        ),
+        config_path = config_path.display(),
+        ignored_keys = ignored_keys,
+    )
+}
+
+async fn project_trust_context(
+    fs: &dyn ExecutorFileSystem,
+    merged_config: &TomlValue,
+    trusted_broker_config: &TomlValue,
+    cwd: &AbsolutePathBuf,
+    project_root_markers: &[String],
+    config_base_dir: &Path,
+    user_config_file: &AbsolutePathBuf,
+) -> io::Result<ProjectTrustContext> {
+    let project_trust_config: ProjectTrustConfigToml = {
+        let _guard = AbsolutePathBufGuard::new(config_base_dir);
+        merged_config
+            .clone()
+            .try_into()
+            .map_err(|err| std::io::Error::new(std::io::ErrorKind::InvalidData, err))?
+    };
+
+    let project_root = find_project_root(fs, cwd, project_root_markers).await?;
+    let projects = project_trust_config.projects.unwrap_or_default();
+
+    let project_root_lookup_keys = normalized_project_trust_keys(project_root.as_path());
+    let project_root_key = project_root_lookup_keys
+        .first()
+        .cloned()
+        .unwrap_or_else(|| project_trust_key(project_root.as_path()));
+    let checkout_root = find_git_checkout_root(fs, cwd).await;
+    let repo_root = resolve_root_git_project_for_trust(fs, cwd).await;
+    let repo_root_lookup_keys = repo_root
+        .as_ref()
+        .map(|root| normalized_project_trust_keys(root.as_path()));
+    let repo_root_key = repo_root_lookup_keys
+        .as_ref()
+        .and_then(|keys| keys.first().cloned());
+
+    let projects_trust = projects
+        .into_iter()
+        .filter_map(|(key, project)| project.trust_level.map(|trust_level| (key, trust_level)))
+        .collect();
+    let network_proxy = trusted_broker_config
+        .get("features")
+        .and_then(|features| features.get("network_proxy"))
+        .and_then(TomlValue::as_table);
+    let credential_broker_configured = network_proxy.is_some_and(|network_proxy| {
+        network_proxy.get("credential_broker") == Some(&TomlValue::Boolean(true))
+    });
+    let credential_broker = if credential_broker_configured {
+        if network_proxy
+            .and_then(|network_proxy| network_proxy.get("enabled"))
+            .and_then(TomlValue::as_bool)
+            .unwrap_or(false)
+        {
+            CredentialBrokerProjectState::Enabled
+        } else {
+            CredentialBrokerProjectState::Disabled
+        }
+    } else {
+        CredentialBrokerProjectState::Unconfigured
+    };
+    let configured_providers = network_proxy
+        .and_then(|network_proxy| network_proxy.get("credentials"))
+        .and_then(TomlValue::as_table);
+    let credential_broker_provider_env_keys = configured_providers
+        .into_iter()
+        .flat_map(|providers| providers.values())
+        .flat_map(|provider| {
+            provider
+                .get("env")
+                .and_then(TomlValue::as_array)
+                .into_iter()
+                .flatten()
+                .filter_map(TomlValue::as_str)
+                .chain(
+                    provider
+                        .get("url_prefix_from_env")
+                        .and_then(TomlValue::as_str),
+                )
+                .map(str::to_string)
+        })
+        .collect::<Vec<_>>();
+
+    Ok(ProjectTrustContext {
+        project_root,
+        project_root_key,
+        project_root_lookup_keys,
+        checkout_root,
+        repo_root,
+        repo_root_key,
+        repo_root_lookup_keys,
+        projects_trust,
+        user_config_file: user_config_file.clone(),
+        credential_broker,
+        credential_broker_provider_env_keys,
+    })
+}
+
+// Start before managed layers are merged: replaying credential source remaps
+// can discard provider fields needed to protect their environment bindings.
+fn credential_broker_trusted_config(
+    merged_config: &TomlValue,
+    thread_config_layers: &[ConfigLayerEntry],
+    loaded_config_layers: &LoadedConfigLayers,
+) -> TomlValue {
+    let mut trusted_config = merged_config.clone();
+    for layer in thread_config_layers {
+        merge_toml_values(&mut trusted_config, &layer.config);
+    }
+    if let Some(config) = loaded_config_layers.managed_config.as_ref() {
+        merge_toml_values(&mut trusted_config, &config.managed_config);
+    }
+    if let Some(config) = loaded_config_layers.managed_config_from_mdm.as_ref() {
+        merge_toml_values(&mut trusted_config, &config.managed_config);
+    }
+    trusted_config
+}
+
+/// Canonicalize the path and convert it to a string to be used as a key in the
+/// projects trust map. On Windows, strips UNC, when possible, to try to ensure
+/// that different paths that point to the same location have the same key.
+pub fn project_trust_key(path: &Path) -> String {
+    normalized_project_trust_keys(path)
+        .into_iter()
+        .next()
+        .unwrap_or_else(|| normalize_project_trust_lookup_key(path.to_string_lossy().to_string()))
+}
+
+/// Returns canonical and original path spellings in trust-lookup precedence order.
+pub fn normalized_project_trust_keys(path: &Path) -> Vec<String> {
+    let normalized_path = normalize_project_trust_lookup_key(path.to_string_lossy().to_string());
+    let normalized_canonical_path = normalize_project_trust_lookup_key(
+        normalize_path(path)
+            .unwrap_or_else(|_| path.to_path_buf())
+            .to_string_lossy()
+            .to_string(),
+    );
+    if normalized_path == normalized_canonical_path {
+        vec![normalized_canonical_path]
+    } else {
+        vec![normalized_canonical_path, normalized_path]
+    }
+}
+
+fn normalize_project_trust_lookup_key(key: String) -> String {
+    if cfg!(windows) {
+        key.to_ascii_lowercase()
+    } else {
+        key
+    }
+}
+fn project_trust_for_lookup_key(
+    projects_trust: &std::collections::HashMap<String, TrustLevel>,
+    lookup_key: &str,
+) -> Option<(String, TrustLevel)> {
+    if let Some(trust_level) = projects_trust.get(lookup_key).copied() {
+        return Some((lookup_key.to_string(), trust_level));
+    }
+
+    let mut normalized_matches: Vec<_> = projects_trust
+        .iter()
+        .filter(|(key, _)| normalize_project_trust_lookup_key((*key).clone()) == lookup_key)
+        .collect();
+    normalized_matches.sort_by_key(|(key, _)| *key);
+    normalized_matches
+        .first()
+        .map(|(key, trust_level)| ((**key).clone(), **trust_level))
+}
+/// Takes a `toml::Value` parsed from a config.toml file and walks through it,
+/// resolving any `AbsolutePathBuf` fields against `base_dir`, returning a new
+/// `toml::Value` with the same shape but with paths resolved.
+///
+/// This ensures that multiple config layers can be merged together correctly
+/// even if they were loaded from different directories.
+#[doc(hidden)]
+pub fn resolve_relative_paths_in_config_toml(
+    value_from_config_toml: TomlValue,
+    base_dir: &Path,
+) -> io::Result<TomlValue> {
+    // Use the serialize/deserialize round-trip to convert the
+    // `toml::Value` into a `ConfigToml` with `AbsolutePath
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    let Ok(resolved) = value_from_config_toml.clone().try_into::<ConfigToml>() else {
+        return Ok(value_from_config_toml);
+    };
+    drop(_guard);
+
+    let resolved_value = TomlValue::try_from(resolved).map_err(|e| {
+        io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Failed to serialize resolved config: {e}"),
+        )
+    })?;
+
+    Ok(copy_shape_from_original(
+        &value_from_config_toml,
+        &resolved_value,
+    ))
+}
+
+/// Ensure that every field in `original` is present in the returned
+/// `toml::Value`, taking the value from `resolved` where possible. This ensures
+/// the fields that we "removed" during the serialize/deserialize round-trip in
+/// `resolve_config_paths` are preserved, out of an abundance of caution.
+fn copy_shape_from_original(original: &TomlValue, resolved: &TomlValue) -> TomlValue {
+    match (original, resolved) {
+        (TomlValue::Table(original_table), TomlValue::Table(resolved_table)) => {
+            let mut table = toml::map::Map::new();
+            for (key, original_value) in original_table {
+                let resolved_value = resolved_table.get(key).unwrap_or(original_value);
+                table.insert(
+                    key.clone(),
+                    copy_shape_from_original(original_value, resolved_value),
+                );
+            }
+            TomlValue::Table(table)
+        }
+        (TomlValue::Array(original_array), TomlValue::Array(resolved_array)) => {
+            let mut items = Vec::new();
+            for (index, original_value) in original_array.iter().enumerate() {
+                let resolved_value = resolved_array.get(index).unwrap_or(original_value);
+                items.push(copy_shape_from_original(original_value, resolved_value));
+            }
+            TomlValue::Array(items)
+        }
+        (_, resolved_value) => resolved_value.clone(),
+    }
+}
+
+/// Finds the nearest ancestor with a configured project marker, or returns `cwd`.
+/// Callers must use markers from configuration loaded before project layers.
+pub async fn find_project_root(
+    fs: &dyn ExecutorFileSystem,
+    cwd: &AbsolutePathBuf,
+    project_root_markers: &[String],
+) -> io::Result<AbsolutePathBuf> {
+    if project_root_markers.is_empty() {
+        return Ok(cwd.clone());
+    }
+
+    for ancestor in cwd.ancestors() {
+        for marker in project_root_markers {
+            let marker_path = ancestor.join(marker);
+            let marker_path_uri = PathUri::from_abs_path(&marker_path);
+            let Ok(metadata) = fs
+                .get_metadata(&marker_path_uri, Default::default(), /*sandbox*/ None)
+                .await
+            else {
+                continue;
+            };
+            if marker == ".git"
+                && metadata.is_directory
+                && fs
+                    .get_metadata(
+                        &PathUri::from_abs_path(&marker_path.join("HEAD")),
+                        Default::default(),
+                        /*sandbox*/ None,
+                    )
+                    .await
+                    .is_err()
+            {
+                continue;
+            }
+            return Ok(ancestor);
+        }
+    }
+    Ok(cwd.clone())
+}
+
+async fn find_git_checkout_root(
+    fs: &dyn ExecutorFileSystem,
+    cwd: &AbsolutePathBuf,
+) -> Option<AbsolutePathBuf> {
+    let cwd_uri = PathUri::from_abs_path(cwd);
+    let base = match fs
+        .get_metadata(&cwd_uri, Default::default(), /*sandbox*/ None)
+        .await
+    {
+        Ok(metadata) if metadata.is_directory => cwd.clone(),
+        _ => cwd.parent()?,
+    };
+
+    for dir in base.ancestors() {
+        let dot_git = dir.join(".git");
+        let dot_git_uri = PathUri::from_abs_path(&dot_git);
+        let Ok(metadata) = fs
+            .get_metadata(&dot_git_uri, Default::default(), /*sandbox*/ None)
+            .await
+        else {
+            continue;
+        };
+        if metadata.is_directory
+            && fs
+                .get_metadata(
+                    &PathUri::from_abs_path(&dot_git.join("HEAD")),
+                    Default::default(),
+                    /*sandbox*/ None,
+                )
+                .await
+                .is_err()
+        {
+            continue;
+        }
+        return Some(dir);
+    }
+    None
+}
+
+struct LoadedProjectLayers {
+    layers: Vec<ConfigLayerEntry>,
+    startup_warnings: Vec<String>,
+}
+
+#[derive(Debug, Clone)]
+struct DiscoveredProjectLayer {
+    dot_codex_folder: AbsolutePathBuf,
+    config: TomlValue,
+    disabled_reason: Option<String>,
+    hooks_config_folder_override: Option<AbsolutePathBuf>,
+    load_root_checkout_hooks: bool,
+}
+
+struct DiscoveredProjectLayers {
+    layers: Vec<DiscoveredProjectLayer>,
+    startup_warnings: Vec<String>,
+}
+
+/// Return the appropriate list of layers (each with
+/// [ConfigLayerSource::Project] as the source) between `cwd` and
+/// `project_root`, inclusive. The list is ordered in _increasing_ precdence,
+/// starting from folders closest to `project_root` (which is the lowest
+/// precedence) to those closest to `cwd` (which is the highest precedence).
+/// Any warnings are stack-level startup messages, not additional config layers.
+async fn load_project_layers(
+    fs: &dyn ExecutorFileSystem,
+    cwd: &AbsolutePathBuf,
+    project_root: &AbsolutePathBuf,
+    trust_context: &ProjectTrustContext,
+    codex_home: &Path,
+    strict_config: bool,
+) -> io::Result<LoadedProjectLayers> {
+    let discovered = discover_project_layers(
+        fs,
+        cwd,
+        project_root,
+        trust_context,
+        codex_home,
+        strict_config,
+    )
+    .await?;
+    let mut layers = Vec::with_capacity(discovered.layers.len());
+    for layer in discovered.layers {
+        let config =
+            resolve_relative_paths_in_config_toml(layer.config, layer.dot_codex_folder.as_path())?;
+        let config = if layer.load_root_checkout_hooks {
+            merge_root_checkout_project_hooks(
+                fs,
+                config,
+                layer.hooks_config_folder_override.as_ref(),
+                layer.disabled_reason.is_none(),
+            )
+            .await?
+        } else {
+            config
+        };
+        layers.push(project_layer_entry(
+            &layer.dot_codex_folder,
+            config,
+            layer.disabled_reason,
+            layer.hooks_config_folder_override,
+        ));
+    }
+
+    Ok(LoadedProjectLayers {
+        layers,
+        startup_warnings: discovered.startup_warnings,
+    })
+}
+
+async fn discover_project_layers(
+    fs: &dyn ExecutorFileSystem,
+    cwd: &AbsolutePathBuf,
+    project_root: &AbsolutePathBuf,
+    trust_context: &ProjectTrustContext,
+    codex_home: &Path,
+    strict_config: bool,
+) -> io::Result<DiscoveredProjectLayers> {
+    let codex_home_abs = AbsolutePathBuf::from_absolute_path(codex_home)?;
+    let codex_home_normalized =
+        normalize_path(codex_home_abs.as_path()).unwrap_or_else(|_| codex_home_abs.to_path_buf());
+    let mut dirs = cwd
+        .ancestors()
+        .scan(false, |done, a| {
+            if *done {
+                None
+            } else {
+                if &a == project_root {
+                    *done = true;
+                }
+                Some(a)
+            }
+        })
+        .collect::<Vec<_>>();
+    dirs.reverse();
+
+    let mut layers = Vec::new();
+    let mut startup_warnings = Vec::new();
+    for dir in dirs {
+        let dot_codex_abs = dir.join(".codex");
+        let dot_codex_uri = PathUri::from_abs_path(&dot_codex_abs);
+        if !fs
+            .get_metadata(&dot_codex_uri, Default::default(), /*sandbox*/ None)
+            .await
+            .map(|metadata| metadata.is_directory)
+            .unwrap_or(false)
+        {
+            continue;
+        }
+
+        let decision = trust_context.decision_for_dir(&dir);
+        let disabled_reason = trust_context.disabled_reason_for_decision(&decision);
+        let hooks_config_folder_override = trust_context.root_checkout_hooks_folder_for_dir(&dir);
+        let dot_codex_normalized =
+            normalize_path(dot_codex_abs.as_path()).unwrap_or_else(|_| dot_codex_abs.to_path_buf());
+        if dot_codex_abs == codex_home_abs || dot_codex_normalized == codex_home_normalized {
+            continue;
+        }
+        let config_file = dot_codex_abs.join(CONFIG_TOML_FILE);
+        let config_file_uri = PathUri::from_abs_path(&config_file);
+        match fs
+            .read_file_text(&config_file_uri, Default::default(), /*sandbox*/ None)
+            .await
+        {
+            Ok(contents) => {
+                let config: TomlValue = match toml::from_str(&contents) {
+                    Ok(config) => config,
+                    Err(e) => {
+                        if decision.is_trusted() {
+                            let config_file_display = config_file.as_path().display();
+                            return Err(io::Error::new(
+                                io::ErrorKind::InvalidData,
+                                format!(
+                                    "Error parsing project config file {config_file_display}: {e}"
+                                ),
+                            ));
+                        }
+                        layers.push(DiscoveredProjectLayer {
+                            dot_codex_folder: dot_codex_abs,
+                            config: TomlValue::Table(toml::map::Map::new()),
+                            disabled_reason,
+                            hooks_config_folder_override,
+                            load_root_checkout_hooks: false,
+                        });
+                        continue;
+                    }
+                };
+                let mut config = config;
+                if disabled_reason.is_none() && strict_config {
+                    validate_config_toml_strictly(
+                        config_file.as_path(),
+                        &contents,
+                        &config,
+                        dot_codex_abs.as_path(),
+                    )?;
+                }
+                let ignored_project_config_keys = sanitize_project_config(
+                    &mut config,
+                    trust_context.credential_broker,
+                    &trust_context.credential_broker_provider_env_keys,
+                );
+                if disabled_reason.is_none() && !ignored_project_config_keys.is_empty() {
+                    startup_warnings.push(project_ignored_config_keys_warning(
+                        &dot_codex_abs,
+                        &ignored_project_config_keys,
+                    ));
+                }
+                layers.push(DiscoveredProjectLayer {
+                    dot_codex_folder: dot_codex_abs,
+                    config,
+                    disabled_reason,
+                    hooks_config_folder_override,
+                    load_root_checkout_hooks: true,
+                });
+            }
+            Err(err) => {
+                if err.kind() == io::ErrorKind::NotFound {
+                    // If there is no config.toml file, record an empty entry
+                    // for this project layer, as this may still have subfolders
+                    // that are significant in the overall ConfigLayerStack.
+                    layers.push(DiscoveredProjectLayer {
+                        dot_codex_folder: dot_codex_abs,
+                        config: TomlValue::Table(toml::map::Map::new()),
+                        disabled_reason,
+                        hooks_config_folder_override,
+                        load_root_checkout_hooks: true,
+                    });
+                } else {
+                    let config_file_display = config_file.as_path().display();
+                    return Err(io::Error::new(
+                        err.kind(),
+                        format!("Failed to read project config file {config_file_display}: {err}"),
+                    ));
+                }
+            }
+        }
+    }
+
+    Ok(DiscoveredProjectLayers {
+        layers,
+        startup_warnings,
+    })
+}
+
+/// For linked worktrees, preserve ordinary worktree-local project config while
+/// replacing only hook declarations with the matching root-checkout layer.
+async fn merge_root_checkout_project_hooks(
+    fs: &dyn ExecutorFileSystem,
+    mut config: TomlValue,
+    hooks_config_folder_override: Option<&AbsolutePathBuf>,
+    is_trusted: bool,
+) -> io::Result<TomlValue> {
+    let Some(hooks_config_folder) = hooks_config_folder_override else {
+        return Ok(config);
+    };
+    let root_config =
+        load_root_checkout_project_config(fs, hooks_config_folder, is_trusted).await?;
+    let root_config =
+        resolve_relative_paths_in_config_toml(root_config, hooks_config_folder.as_path())?;
+
+    let Some(config_table) = config.as_table_mut() else {
+        return Ok(config);
+    };
+    config_table.remove("hooks");
+    if let Some(hooks) = root_config.get("hooks") {
+        config_table.insert("hooks".to_string(), hooks.clone());
+    }
+    Ok(config)
+}
+
+async fn load_root_checkout_project_config(
+    fs: &dyn ExecutorFileSystem,
+    hooks_config_folder: &AbsolutePathBuf,
+    is_trusted: bool,
+) -> io::Result<TomlValue> {
+    let hooks_config_file = hooks_config_folder.join(CONFIG_TOML_FILE);
+    let hooks_config_file_uri = PathUri::from_abs_path(&hooks_config_file);
+    Ok(
+        match fs
+            .read_file_text(
+                &hooks_config_file_uri,
+                Default::default(),
+                /*sandbox*/ None,
+            )
+            .await
+        {
+            Ok(contents) => {
+                let parsed: TomlValue = match toml::from_str(&contents) {
+                    Ok(parsed) => parsed,
+                    Err(err) => {
+                        if is_trusted {
+                            return Err(io::Error::new(
+                                io::ErrorKind::InvalidData,
+                                format!(
+                                    "Error parsing project hooks config file {}: {err}",
+                                    hooks_config_file.as_path().display()
+                                ),
+                            ));
+                        }
+                        TomlValue::Table(toml::map::Map::new())
+                    }
+                };
+                parsed
+            }
+            Err(err) if err.kind() == io::ErrorKind::NotFound => {
+                TomlValue::Table(toml::map::Map::new())
+            }
+            Err(err) => {
+                return Err(io::Error::new(
+                    err.kind(),
+                    format!(
+                        "Failed to read project hooks config file {}: {err}",
+                        hooks_config_file.as_path().display()
+                    ),
+                ));
+            }
+        },
+    )
+}
+/// The legacy mechanism for specifying admin-enforced configuration is to read
+/// from a file like `/etc/codex/managed_config.toml` that has the same
+/// structure as `config.toml` where fields like `approval_policy` can specify
+/// exactly one value rather than a list of allowed values.
+///
+/// If present, re-interpret `managed_config.toml` as a `requirements.toml`
+/// where each specified field is treated as a constraint. Most fields allow
+/// only the specified value. `approvals_reviewer = "auto_review"` also allows
+/// `user` so people can opt out of the auto-reviewer.
+#[derive(Deserialize, Debug, Clone, Default, PartialEq)]
+struct LegacyManagedConfigToml {
+    approval_policy: Option<AskForApproval>,
+    approvals_reviewer: Option<ApprovalsReviewer>,
+    sandbox_mode: Option<SandboxMode>,
+}
+
+// Cannot name this `mod tests` because of tests.rs in this folder.
+#[cfg(test)]
+mod unit_tests {
+    use super::*;
+    #[cfg(windows)]
+    use std::path::Path;
+    use tempfile::tempdir;
+
+    #[test]
+    fn ensure_resolve_relative_paths_in_config_toml_preserves_all_fields() -> anyhow::Result<()> {
+        let tmp = tempdir()?;
+        let base_dir = tmp.path();
+        let contents = r#"
+# This is a field recognized by config.toml that is an AbsolutePathBuf in
+# the ConfigToml struct.
+model_instructions_file = "./some_file.md"
+
+# This is a field recognized by config.toml.
+model = "gpt-1000"
+
+# This is a field not recognized by config.toml.
+foo = "xyzzy"
+"#;
+        let user_config: TomlValue = toml::from_str(contents)?;
+
+        let normalized_toml_value = resolve_relative_paths_in_config_toml(user_config, base_dir)?;
+        let mut expected_toml_value = toml::map::Map::new();
+        expected_toml_value.insert(
+            "model_instructions_file".to_string(),
+            TomlValue::String(
+                AbsolutePathBuf::resolve_path_against_base("./some_file.md", base_dir)
+                    .as_path()
+                    .to_string_lossy()
+                    .to_string(),
+            ),
+        );
+        expected_toml_value.insert(
+            "model".to_string(),
+            TomlValue::String("gpt-1000".to_string()),
+        );
+        expected_toml_value.insert("foo".to_string(), TomlValue::String("xyzzy".to_string()));
+        assert_eq!(normalized_toml_value, TomlValue::Table(expected_toml_value));
+        Ok(())
+    }
+
+    #[test]
+    fn legacy_managed_config_backfill_includes_read_only_sandbox_mode() -> io::Result<()> {
+        let legacy = LegacyManagedConfigToml {
+            approval_policy: None,
+            approvals_reviewer: None,
+            sandbox_mode: Some(SandboxMode::WorkspaceWrite),
+        };
+
+        assert_eq!(
+            legacy_requirements_to_toml_value(legacy)?,
+            TomlValue::Table(toml::map::Map::from_iter([(
+                "allowed_sandbox_modes".to_string(),
+                TomlValue::Array(vec![
+                    TomlValue::String("read-only".to_string()),
+                    TomlValue::String("workspace-write".to_string()),
+                ]),
+            )]))
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn legacy_managed_config_backfill_allows_user_when_guardian_is_required() -> io::Result<()> {
+        let legacy = LegacyManagedConfigToml {
+            approval_policy: None,
+            approvals_reviewer: Some(ApprovalsReviewer::AutoReview),
+            sandbox_mode: None,
+        };
+
+        assert_eq!(
+            legacy_requirements_to_toml_value(legacy)?,
+            TomlValue::Table(toml::map::Map::from_iter([(
+                "allowed_approvals_reviewers".to_string(),
+                TomlValue::Array(vec![
+                    TomlValue::String("auto_review".to_string()),
+                    TomlValue::String("user".to_string()),
+                ]),
+            )]))
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn legacy_managed_config_backfill_preserves_user_only_approvals_reviewer() -> io::Result<()> {
+        let legacy = LegacyManagedConfigToml {
+            approval_policy: None,
+            approvals_reviewer: Some(ApprovalsReviewer::User),
+            sandbox_mode: None,
+        };
+
+        assert_eq!(
+            legacy_requirements_to_toml_value(legacy)?,
+            TomlValue::Table(toml::map::Map::from_iter([(
+                "allowed_approvals_reviewers".to_string(),
+                TomlValue::Array(vec![TomlValue::String("user".to_string())]),
+            )]))
+        );
+        Ok(())
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn windows_system_requirements_toml_file_uses_expected_suffix() {
+        let expected = windows_program_data_dir_from_known_folder()
+            .unwrap_or_else(|_| PathBuf::from(DEFAULT_PROGRAM_DATA_DIR_WINDOWS))
+            .join("OpenAI")
+            .join("Codex")
+            .join("requirements.toml");
+        assert_eq!(
+            windows_system_requirements_toml_file()
+                .expect("requirements.toml path")
+                .as_path(),
+            expected.as_path()
+        );
+        assert!(
+            windows_system_requirements_toml_file()
+                .expect("requirements.toml path")
+                .as_path()
+                .ends_with(Path::new("OpenAI").join("Codex").join("requirements.toml"))
+        );
+    }
+
+    #[cfg(windows)]
+    #[test]
+    fn windows_system_config_toml_file_uses_expected_suffix() {
+        let expected = windows_program_data_dir_from_known_folder()
+            .unwrap_or_else(|_| PathBuf::from(DEFAULT_PROGRAM_DATA_DIR_WINDOWS))
+            .join("OpenAI")
+            .join("Codex")
+            .join("config.toml");
+        assert_eq!(
+            windows_system_config_toml_file()
+                .expect("config.toml path")
+                .as_path(),
+            expected.as_path()
+        );
+        assert!(
+            windows_system_config_toml_file()
+                .expect("config.toml path")
+                .as_path()
+                .ends_with(Path::new("OpenAI").join("Codex").join("config.toml"))
+        );
+    }
+}