feat: load AgentIdentity from JWT env

[efrazer-oai]

Summary

This PR lets programmatic AgentIdentity users paste one token into the environment or auth.json.

auth.json.agent_identity now accepts either the normal object form or a JWT string. The JWT is decoded into the same AgentIdentityAuthRecord used by the explicit CodexAuth::AgentIdentity mode.

When env auth is enabled, CODEX_AGENT_IDENTITY can provide that same JWT without writing auth state to disk. CODEX_API_KEY still wins if both env vars are set.

Reference old stack: https://github.com/openai/codex/pull/17387/changes
Reference JWT/env stack: #18176

Stack

1. fix: fully revert agent identity runtime wiring #18757: full revert
2. refactor: add agent identity crate #18871: isolated Agent Identity crate
3. feat: add explicit AgentIdentity auth mode #18785: explicit AgentIdentity auth mode and startup task allocation
4. refactor: route Codex auth through AuthProvider #18811: migrate Codex backend auth callsites through AuthProvider
5. This PR: accept AgentIdentity JWTs and load CODEX_AGENT_IDENTITY

Testing

Tests: targeted Rust checks for AgentIdentity JWT/env loading and CI.

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/login/src/auth/manager.rs

Lines 1023 to 1030 in ca0aeac

	fn resolved_mode(&self) -> ApiAuthMode {
	if let Some(mode) = self.auth_mode {
	return mode;
	}
	if self.openai_api_key.is_some() {
	return ApiAuthMode::ApiKey;
	}
	ApiAuthMode::Chatgpt

Infer AgentIdentity mode when agent_identity is present

The new JWT/object deserialization for auth.json.agent_identity is ineffective unless auth_mode is also set, because resolved_mode() ignores agent_identity. A JWT-only auth.json falls back to Chatgpt mode and later behaves as missing token auth, which contradicts the “paste one token into auth.json” flow introduced here.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[efrazer-oai]

💡 Codex Review

codex/codex-rs/login/src/auth/manager.rs

Lines 1023 to 1030 in ca0aeac

	fn resolved_mode(&self) -> ApiAuthMode {
	if let Some(mode) = self.auth_mode {
	return mode;
	}
	if self.openai_api_key.is_some() {
	return ApiAuthMode::ApiKey;
	}
	ApiAuthMode::Chatgpt

Infer AgentIdentity mode when agent_identity is present
The new JWT/object deserialization for auth.json.agent_identity is ineffective unless auth_mode is also set, because resolved_mode() ignores agent_identity. A JWT-only auth.json falls back to Chatgpt mode and later behaves as missing token auth, which contradicts the “paste one token into auth.json” flow introduced here.

ℹ️ About Codex in GitHub

Disagree here, we should absolutely set auth_mode if we're copy-pasting in auth.json as the structure is tagged. If we're doing env variable, we don't break.

[pakrym-oai]

why are we not storing in a consistent format?

[pakrym-oai]

can this go into agent identity crate?