fix: Codex OAuth (BYO auth.json) crashes with missing OPENAI_API_KEY#1087
Merged
simple-agent-manager[bot] merged 3 commits intoMay 20, 2026
Merged
Conversation
Two-sided fix for Codex users who bring their own OAuth token (auth.json): API side: The passthrough proxy exclusion on runtime.ts:133 only checked for Claude Code + OAuth, allowing Codex + OAuth users to receive an inferenceConfig with provider "openai-passthrough" they shouldn't get. Extended the condition to also exclude Codex OAuth credentials. VM agent side: Belt-and-suspenders guard in codexProxyProviderConfigFromCredential — when the credential kind is "oauth-token" (auth-file injection), skip generating a proxy provider config that would write env_key = "OPENAI_API_KEY" to config.toml. That env var is never set in auth-file mode, causing Codex to crash. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a production bug where Codex users with BYO OAuth tokens (auth.json) crash immediately with
Missing environment variable: OPENAI_API_KEY.Root cause: Two-sided bug introduced by the unified billing passthrough proxy work:
runtime.ts:133): The OAuth exclusion from the passthrough proxy path only checked for Claude Code, not Codex. Codex OAuth users received aninferenceConfigwithprovider: "openai-passthrough"they shouldn't get.gateway.go):codexProxyProviderConfigFromCredentialgenerated a proxy provider config withenv_key = "OPENAI_API_KEY"even when the credential was an OAuth token using auth-file injection. That env var is never set in auth-file mode.Fix:
(isClaudeCode || isCodex) && credentialKind === 'oauth-token'codexProxyProviderConfigFromCredentialwhencredentialKind == "oauth-token"(belt-and-suspenders)Agent Preflight (Required)
Classification
External References
N/A: Bug fix for existing conditional logic in runtime.ts and gateway.go. No new external APIs or documentation needed.
Codebase Impact Analysis
Affected components:
apps/api/src/routes/workspaces/runtime.ts(line 133 OAuth exclusion condition) andpackages/vm-agent/internal/acp/gateway.go(codexProxyProviderConfigFromCredential early return). Cross-component trace: API runtime.ts controls whether inferenceConfig is included in credential response, VM agent gateway.go reads inferenceConfig to generate config.toml proxy provider entry, Codex reads config.toml and expects OPENAI_API_KEY env var. Only Codex + OAuth path affected; Claude Code + OAuth and env-var credential paths are unaffected.Documentation & Specs
N/A: Bug fix restoring correct conditional logic. No spec or doc changes needed.
Constitution & Risk Check
Principle XI (No Hardcoded Values): No hardcoded values introduced. Fix restores correct conditional logic by extending an existing exclusion to also cover Codex OAuth credentials. No new URLs, timeouts, or limits added.
Specialist Review Evidence
Staging Verification
Test plan
🤖 Generated with Claude Code