fix(worker): codex prepareAuth skips auth.json for api_key profiles

apps/agent-worker/src/runtime/codex-adapter.ts

@@ -13,7 +13,11 @@ import {
   streamExecInContainer,
 } from './docker';
 import type { AdapterWorkspace } from './provider';
-import { codexModelArgs, providerEnvironment } from './provider';
+import {
+  codexModelArgs,
+  isCodexLoginProfile,
+  providerEnvironment,
+} from './provider';
 
 // Reused verbatim from the worker: normalize + pretty-print an auth JSON blob
 // before writing it with owner-only permissions.
@@ -41,6 +45,11 @@ export const createCodexAdapter: AdapterFactory = (deps) => {
   const execStream = deps?.execStream ?? streamExecInContainer;
 
   const prepareAuth = async (workspace: AdapterWorkspace) => {
+    // API-key profiles (e.g. OpenAI api_key) authenticate purely via
+    // OPENAI_API_KEY from providerEnvironment; only ChatGPT-login/JSON-snapshot
+    // profiles need a Codex `auth.json` on disk. Mirror the Claude adapter,
+    // which early-returns for non-OAuth profiles.
+    if (!isCodexLoginProfile(workspace.claim)) return;
     const secret = workspace.claim.aiProviderProfile?.secret;
     if (!secret) {
       throw new Error('Codex auth profile is missing auth.json contents.');