Module auth_local 

Best-effort local auth status read — private-contract territory.

The sanctioned way to read account state is protocol-native (AsyncClient::account_read), which requires standing up an app-server connection. For cheap status probes (dashboards, launcher matrices) this module reads what the codex CLI itself persists at $CODEX_HOME/auth.json (default ~/.codex/auth.json) and decodes the display-only identity claims from the stored id_token.

Caveats, deliberately loud:

• auth.json is codex’s internal storage, not a published interface. Its layout can change in any CLI release. This crate owns that risk so consumers don’t have to: the shape is unit-tested against a captured fixture and exercised against the real file by the live integration suite, so a layout change becomes a crate patch, not a silent downstream break.
• The JWT payload is base64-decoded without signature verification — the values come from a file the user’s own CLI wrote, and they are fit for display labels only. Never use them for authorization decisions.
• A logged_in: true here means “credentials are stored”, not “they still work” — tokens expire and get refreshed by the CLI. For a liveness answer use account_read or codex login status.

Structs

LocalAuthStatus

Serde-shaped local auth snapshot, fit for relaying to UIs.

Functions

auth_json_path

$CODEX_HOME/auth.json, defaulting to ~/.codex/auth.json.

auth_status_from_json

Parse a snapshot out of auth.json contents.

auth_status_local

Read the local auth snapshot from the default location.