[mldangelo-oai]

Summary

When device auth is disabled, the missing-credentials message points users to login help for browser login over SSH. Help and docs show the local SSH command and the remote login command.

Changes

• Explain that device auth needs workspace permission, including in container examples.
• Show where to run the SSH and login commands, then open the sign-in URL in a local browser.
• Check that help keeps SSH and login commands intact on narrow terminals.

Testing

• Focused auth/help tests: 202 passed, 0 failed (seed 1168579403). SDK types, format, and build:ci passed.
• Earlier full SDK runs (seeds 12345 and 2698542794): each had 3,544 passed, 53 skipped, and 26 failed. All 26 passed targeted reruns: 25 with umask 022, one from the package directory. Representative failures also reproduced on an unmodified baseline. The full suite has not been rerun for the final copy cleanup.

Risk and rollout

This updates guidance for Codex's existing browser login. You need a local browser and SSH access to the remote machine.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T16:44:43.749484Z	d007953	New commits
🔒 Security Review	✅ Completed 2026-10-05T16:45:40.267423Z	d007953	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the complete actual PR contribution and changed tests with three independent passes, followed by targeted synthesis. Static review only; product tests were not executed.

No supported introduced correctness or security finding remained in this contribution. Source approval does not establish CI, merge readiness, integration or deployment.