From 9042b8d04217b851690176e6ba6589c7897295c9 Mon Sep 17 00:00:00 2001 From: Devin Foley Date: Tue, 5 May 2026 08:00:27 -0700 Subject: [PATCH] Write apikey-mode auth.json so Codex CLI 0.122+ can authenticate via OPENAI_API_KEY (#5276) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Thinking Path > - Paperclip orchestrates AI agents for zero-human companies > - The Codex adapter spawns the OpenAI Codex CLI to drive the model > - Codex CLI 0.122 changed how it reads credentials: it ignores `OPENAI_API_KEY` from the environment and reads only `$CODEX_HOME/auth.json` > - Without auth.json, Codex 0.122+ returns 401 "Missing bearer or basic authentication" on `/v1/responses` even when `OPENAI_API_KEY` is forwarded into the sandbox or remote shell > - This pull request materializes an apikey-mode `auth.json` in the managed Codex home (or per-run for the test probe) when an `OPENAI_API_KEY` is configured > - The benefit is configured Codex API keys authenticate correctly with current Codex CLI versions across local, SSH, and sandbox targets ## What Changed - `codex-home.ts`: add `writeApiKeyAuthJson()` and let `prepareManagedCodexHome` accept an `apiKey` override that replaces the symlinked host auth.json with an apikey-mode file - `execute.ts`: pass `envConfig.OPENAI_API_KEY` into `prepareManagedCodexHome` so the managed (and synced-to-remote) Codex home authenticates via the configured key - `test.ts`: when `OPENAI_API_KEY` is available, wrap the hello probe with a small shell that materializes a per-run `$CODEX_HOME/auth.json` before exec'ing codex; key content rides through env to avoid leaking into process listings - Update the `codex_hello_probe_auth_required` hint to explain Codex CLI does not read `OPENAI_API_KEY` from env ## Verification - `pnpm vitest run --no-coverage --project @paperclipai/adapter-codex-local` - `pnpm typecheck` clean - Manual: Codex 0.122.0 with empty `CODEX_HOME` returns 401 with env-only auth; with this change it authenticates cleanly ## Risks Low risk — when no API key is configured, behavior is unchanged (no auth.json written, existing chatgpt-mode flow preserved). Apikey-mode `auth.json` is the upstream-supported format. ## Model Used Claude Opus 4.7 (1M context) ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] If this change affects the UI, I have included before/after screenshots — N/A (no UI) - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --- .../codex-local/src/server/codex-home.ts | 64 +++++++++++++++---- .../codex-local/src/server/execute.ts | 10 ++- .../adapters/codex-local/src/server/test.ts | 42 ++++++++++-- 3 files changed, 98 insertions(+), 18 deletions(-) diff --git a/packages/adapters/codex-local/src/server/codex-home.ts b/packages/adapters/codex-local/src/server/codex-home.ts index c032fd24..10b3ae96 100644 --- a/packages/adapters/codex-local/src/server/codex-home.ts +++ b/packages/adapters/codex-local/src/server/codex-home.ts @@ -71,33 +71,71 @@ async function ensureCopiedFile(target: string, source: string): Promise { await fs.copyFile(source, target); } +/** + * Writes an `auth.json` containing only `OPENAI_API_KEY` so the codex CLI can + * authenticate via API key. Overwrites any existing file or symlink at that + * path. Required because the codex CLI (>= 0.122) ignores the `OPENAI_API_KEY` + * environment variable and only reads credentials from `$CODEX_HOME/auth.json`. + */ +export async function writeApiKeyAuthJson(home: string, apiKey: string): Promise { + await fs.mkdir(home, { recursive: true }); + const target = path.join(home, "auth.json"); + await fs.rm(target, { force: true }); + await fs.writeFile(target, JSON.stringify({ OPENAI_API_KEY: apiKey }), { mode: 0o600 }); +} + export async function prepareManagedCodexHome( env: NodeJS.ProcessEnv, onLog: AdapterExecutionContext["onLog"], companyId?: string, + options: { apiKey?: string | null } = {}, ): Promise { const targetHome = resolveManagedCodexHomeDir(env, companyId); + const apiKey = nonEmpty(options.apiKey ?? undefined); const sourceHome = resolveSharedCodexHomeDir(env); - if (path.resolve(sourceHome) === path.resolve(targetHome)) return targetHome; + const seedFromShared = path.resolve(sourceHome) !== path.resolve(targetHome); await fs.mkdir(targetHome, { recursive: true }); - for (const name of SYMLINKED_SHARED_FILES) { - const source = path.join(sourceHome, name); - if (!(await pathExists(source))) continue; - await ensureSymlink(path.join(targetHome, name), source); + // If a previous run wrote an apikey-mode auth.json (regular file) and this + // run has no apiKey, remove it so the chatgpt-mode symlink can be restored. + // Without this cleanup, ensureSymlink bails on a non-symlink and Codex keeps + // authenticating with the stale key after it is removed from configuration. + if (!apiKey && seedFromShared) { + const authPath = path.join(targetHome, "auth.json"); + const existing = await fs.lstat(authPath).catch(() => null); + if (existing && !existing.isSymbolicLink()) { + await fs.rm(authPath, { force: true }); + } } - for (const name of COPIED_SHARED_FILES) { - const source = path.join(sourceHome, name); - if (!(await pathExists(source))) continue; - await ensureCopiedFile(path.join(targetHome, name), source); + if (seedFromShared) { + for (const name of SYMLINKED_SHARED_FILES) { + const source = path.join(sourceHome, name); + if (!(await pathExists(source))) continue; + await ensureSymlink(path.join(targetHome, name), source); + } + + for (const name of COPIED_SHARED_FILES) { + const source = path.join(sourceHome, name); + if (!(await pathExists(source))) continue; + await ensureCopiedFile(path.join(targetHome, name), source); + } + + await onLog( + "stdout", + `[paperclip] Using ${isWorktreeMode(env) ? "worktree-isolated" : "Paperclip-managed"} Codex home "${targetHome}" (seeded from "${sourceHome}").\n`, + ); + } + + if (apiKey) { + await writeApiKeyAuthJson(targetHome, apiKey); + await onLog( + "stdout", + `[paperclip] Wrote API-key auth.json into Codex home "${targetHome}" from configured OPENAI_API_KEY.\n`, + ); } - await onLog( - "stdout", - `[paperclip] Using ${isWorktreeMode(env) ? "worktree-isolated" : "Paperclip-managed"} Codex home "${targetHome}" (seeded from "${sourceHome}").\n`, - ); return targetHome; } diff --git a/packages/adapters/codex-local/src/server/execute.ts b/packages/adapters/codex-local/src/server/execute.ts index 6dcb0e58..67c7633d 100644 --- a/packages/adapters/codex-local/src/server/execute.ts +++ b/packages/adapters/codex-local/src/server/execute.ts @@ -332,8 +332,16 @@ export async function execute(ctx: AdapterExecutionContext): Promise 0 + ? envConfig.OPENAI_API_KEY.trim() + : null; const preparedManagedCodexHome = - configuredCodexHome ? null : await prepareManagedCodexHome(process.env, onLog, agent.companyId); + configuredCodexHome + ? null + : await prepareManagedCodexHome(process.env, onLog, agent.companyId, { + apiKey: configuredOpenAiApiKey, + }); const defaultCodexHome = resolveManagedCodexHomeDir(process.env, agent.companyId); const effectiveCodexHome = configuredCodexHome ?? preparedManagedCodexHome ?? defaultCodexHome; await fs.mkdir(effectiveCodexHome, { recursive: true }); diff --git a/packages/adapters/codex-local/src/server/test.ts b/packages/adapters/codex-local/src/server/test.ts index 50ff56d5..98078d57 100644 --- a/packages/adapters/codex-local/src/server/test.ts +++ b/packages/adapters/codex-local/src/server/test.ts @@ -16,6 +16,7 @@ import { resolveAdapterExecutionTargetCwd, } from "@paperclipai/adapter-utils/execution-target"; import path from "node:path"; +import os from "node:os"; import { parseCodexJsonl } from "./parse.js"; import { codexHomeDir, readCodexAuthInfo } from "./quota.js"; import { buildCodexExecArgs } from "./codex-args.js"; @@ -174,14 +175,45 @@ export async function testEnvironment( }); } + // Codex CLI (>= 0.122) ignores the OPENAI_API_KEY env var and only reads + // credentials from $CODEX_HOME/auth.json. When we have a key available, + // wrap the probe with a shell that materializes a per-run auth.json so + // the CLI can authenticate. The key content is passed via env (not on + // the command line) to avoid leaking it into process listings. + const probeApiKey = isNonEmpty(configOpenAiKey) + ? configOpenAiKey + : isNonEmpty(hostOpenAiKey) + ? hostOpenAiKey + : null; + let probeCommand = command; + let probeArgs = args; + const probeEnv: Record = { ...env }; + if (probeApiKey) { + const probeHome = targetIsRemote + ? `/tmp/paperclip-codex-probe-${runId}` + : path.join(os.tmpdir(), `paperclip-codex-probe-${runId}`); + probeEnv.CODEX_HOME = probeHome; + probeEnv._PAPERCLIP_CODEX_AUTH_JSON = JSON.stringify({ OPENAI_API_KEY: probeApiKey }); + probeCommand = "sh"; + // Trap on EXIT removes the probe home (with the API-key auth.json) on + // any exit path; we drop `exec` so the wrapper shell stays alive long + // enough for the trap to fire after the child returns. + probeArgs = [ + "-c", + 'set -e; mkdir -p "$CODEX_HOME"; umask 077; printf "%s" "$_PAPERCLIP_CODEX_AUTH_JSON" > "$CODEX_HOME/auth.json"; unset _PAPERCLIP_CODEX_AUTH_JSON; trap \'rm -rf "$CODEX_HOME"\' EXIT INT TERM; "$0" "$@"', + command, + ...args, + ]; + } + const probe = await runAdapterExecutionTargetProcess( runId, target, - command, - args, + probeCommand, + probeArgs, { cwd, - env, + env: probeEnv, timeoutSec: 45, graceSec: 5, stdin: "Respond with hello.", @@ -221,7 +253,9 @@ export async function testEnvironment( level: "warn", message: "Codex CLI is installed, but authentication is not ready.", ...(detail ? { detail } : {}), - hint: "Configure OPENAI_API_KEY in adapter env/shell or run `codex login`, then retry the probe.", + hint: probeApiKey + ? "OPENAI_API_KEY was provided but Codex still rejected the request. Verify the key is valid for the OpenAI Responses API (e.g. `curl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models`), or run `codex login` and seed `~/.codex/auth.json`." + : "Codex CLI does not read OPENAI_API_KEY from the environment; set OPENAI_API_KEY in this adapter's config (so Paperclip writes it to `$CODEX_HOME/auth.json`) or run `codex login` on the host first.", }); } else { checks.push({