feat: use encrypted local secrets for CLI auth

[celia-oai]

Why

Windows Credential Manager limits generic credential blobs to 2,560 bytes. Large serialized ChatGPT auth payloads can exceed that limit, so keyring-mode CLI auth needs a backend that keeps only the encryption key in the OS keyring and stores the payload in Codex's encrypted local-secrets file.

This is the third PR in the encrypted-auth stack:

1. feat: add secret auth storage configuration #27504 — feature and config selection
2. feat: add auth-specific encrypted secret namespaces #27535 — auth-specific local-secrets namespaces
3. This PR — CLI auth implementation and activation
4. MCP OAuth implementation and activation

What Changed

• Added encrypted CLI-auth storage using the CliAuth secrets namespace.
• Preserved direct keyring storage for platforms/configurations where it remains selected.
• Selected the backend consistently for login, logout, refresh, device-code login, auth loading, and login restrictions.
• Threaded resolved bootstrap/full config through CLI, exec, TUI, app-server account handling, cloud config, and cloud tasks.
• Removed stale auth.json fallback data after successful encrypted saves and removed encrypted, direct-keyring, and fallback data during logout.
• Added storage and integration coverage for both direct and encrypted keyring modes.

MCP OAuth persistence is intentionally left to the next PR.

Validation

• just test -p codex-login — 131 passed
• just test -p codex-cli — 280 passed
• just test -p codex-app-server v2::account — 25 passed
• just test -p codex-cloud-config service — 21 passed, 7 skipped
• just fix -p codex-login
• just fix -p codex-cli
• just fmt

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/core/src/config/mod.rs

Lines 1694 to 1698 in 4775dc3

	.feature_requirements
	.clone(),
	)?;
	Ok(auth_keyring_backend_kind_from_secret_auth_storage(
	managed_features.enabled(Feature::SecretAuthStorage),

Resolve cloud-managed secret auth before selecting Direct

When secret_auth_storage is only in the cloud bundle, this bootstrap stack lacks that requirement, so restart selects Direct before auth can fetch the bundle. Auth saved in encrypted Secrets by a prior full-config run is then invisible and users resume unauthenticated. guidance

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".