[mldangelo-oai]

Summary

Make standalone validation, patch, and fix-verification commands honor custom provider authentication and explicit ChatGPT selection.

Changes

• Resolve provider authentication from the applicable Codex profile and explicit overrides. Reuse the effective overrides for CLI serialization and authentication, preserving unspecified provider fields.
• Honor configured env_key precedence under auto and api-key, including providers that also support OpenAI account authentication.
• For explicit --auth chatgpt with a custom env_key or experimental_bearer_token, select stored account authentication in the child environment and native runtime configuration, including when requires_openai_auth is false or omitted. Preserve the original environment, configuration objects, and ambient config file.
• Keep ambient provider configuration in the protected credential home, including header credentials, and forward only explicit provider overrides in process arguments.
• Preserve command authentication, native built-in provider behavior, and explicit provider selection by existing direct helper callers.
• Merge current main and extend fresh, resumed, and concurrent discovery/reducer worker tests with both key presence and absence. No new commands, flags, environment variables, or defaults.

Testing

• Authentication, skill, and patch suites: 275 tests passed. The custom ChatGPT regression covers 42 combinations of command, setting source, native auth flag, and credential type. The 21 bearer-only cases failed before the final fix; five auto-mode bearer cases confirm existing authentication is preserved.
• Deep worker launch regression passed, including fresh/resumed discovery and reducer workers and concurrent key isolation.
• All five portable plugin checks passed with pinned Ruff 0.16.9: lint, formatting, SDK build:ci, plugin source compatibility, and its 9 regression tests.
• SDK/MCP types, SDK formatting, and git diff --check passed.
• Native Codex 0.162.0-alpha.7 configuration inspection confirmed the cleaned credential home and final provider override omit provider API-key and bearer-token configuration and enable stored authentication. No inference request was made.
• Three native review passes and fresh independent verification completed with no blocking findings.
• Full SDK baseline at the prior integrated commit c9c6c07, seed 12345 (120s test timeout): 3,512 passed, 53 skipped, 0 failed. The final bearer-only fix has the 275 focused passing checks above.

Risk and rollout

Changes affect skill-command provider authentication. Explicit ChatGPT selection uses stored account credentials for custom API-key providers. Credential storage and path protections remain enforced; per-command settings do not mutate shared environment or ambient configuration. A CLI release is needed for users to receive the fix.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T02:36:18.694246Z	e384968	New commits
🔒 Security Review	✅ Completed 2026-10-03T02:37:14.329354Z	e384968	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 42362911a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kmbroai]

Reviewed provider configuration merging and authentication selection. All 40 added provider-authentication cases pass locally; the broader authentication suite's failures reproduce unchanged on the base. Full hosted CI passed on this head. No new blocking findings.

[soyeon-oai]

Source review focused on simplification; no tests were run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9c6c0779a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".