feat(codex): support agent identity accounts

crates/aether-provider/pool/src/lib.rs

@@ -160,6 +160,30 @@ mod tests {
         );
     }
 
+    #[test]
+    fn codex_agent_identity_quota_request_prefers_dynamic_assertion() {
+        let spec = build_codex_pool_quota_request(
+            "key-1",
+            Some((
+                "authorization".to_string(),
+                "AgentAssertion signed-at-request-time".to_string(),
+            )),
+            None,
+            Some(&json!({
+                "auth_mode": "agentIdentity",
+                "headers": {
+                    "authorization": "Bearer stale-imported-session"
+                }
+            })),
+        )
+        .expect("spec should build");
+
+        assert_eq!(
+            spec.headers.get("authorization").map(String::as_str),
+            Some("AgentAssertion signed-at-request-time")
+        );
+    }
+
     #[test]
     fn gemini_cli_quota_request_uses_v1internal_retrieve_user_quota() {
         let spec = build_gemini_cli_pool_quota_request(

crates/aether-provider/pool/src/providers/codex.rs

@@ -92,7 +92,22 @@ fn build_codex_wham_headers(
         .map(str::trim)
         .filter(|value| !value.is_empty());
 
-    if let Some(authorization) = auth_config_authorization {
+    let is_agent_identity = auth_config
+        .and_then(Value::as_object)
+        .and_then(|object| {
+            object
+                .get("auth_mode")
+                .or_else(|| object.get("authMode"))
+                .and_then(Value::as_str)
+        })
+        .is_some_and(|value| value.trim().eq_ignore_ascii_case("agentIdentity"));
+
+    if is_agent_identity {
+        let Some((name, value)) = resolved_oauth_auth else {
+            return Err("缺少 Agent Identity 认证信息，请先注册任务".to_string());
+        };
+        headers.insert(name.to_ascii_lowercase(), value);
+    } else if let Some(authorization) = auth_config_authorization {
         headers.insert("authorization".to_string(), authorization.to_string());
     } else if let Some((name, value)) = resolved_oauth_auth {
         headers.insert(name.to_ascii_lowercase(), value);