fix: configure Codex provider authentication

tests/fixtures/fake_codex_app_server.py

@@ -20,9 +20,13 @@ EXTRA_MCP_NAME = next(
     None,
 )
 INVALID_MCP_CONFIG = "--fake-invalid-mcp-config" in sys.argv[1:]
+UNAUTHENTICATED = "--fake-unauthenticated" in sys.argv[1:]
+LOGIN_FAILURE = "--fake-login-failure" in sys.argv[1:]
+NO_OPENAI_AUTH_REQUIRED = "--fake-no-openai-auth-required" in sys.argv[1:]
 thread_number = 0
 turn_number = 0
 waiting_turns: dict[str, str] = {}
+account_present = not UNAUTHENTICATED
 
 ENVIRONMENT_PATH.write_text(
     json.dumps(sorted(os.environ), ensure_ascii=True),
@@ -35,8 +39,14 @@ def emit(message: dict[str, object]) -> None:
 
 
 def trace(message: dict[str, object]) -> None:
+    recorded = message
+    if message.get("method") == "account/login/start":
+        recorded = dict(message)
+        params = message.get("params")
+        if isinstance(params, dict):
+            recorded["params"] = {**params, "apiKey": "<redacted>"}
     with TRACE_PATH.open("a", encoding="utf-8") as stream:
-        stream.write(json.dumps(message, ensure_ascii=False) + "\n")
+        stream.write(json.dumps(recorded, ensure_ascii=False) + "\n")
 
 
 for raw_line in sys.stdin:
@@ -58,6 +68,38 @@ for raw_line in sys.stdin:
         )
     elif method == "initialized":
         continue
+    elif method == "account/read":
+        emit(
+            {
+                "id": request_id,
+                "result": {
+                    "account": ({"type": "apiKey"} if account_present else None),
+                    "requiresOpenaiAuth": not NO_OPENAI_AUTH_REQUIRED,
+                },
+            }
+        )
+    elif method == "account/login/start":
+        if LOGIN_FAILURE:
+            emit(
+                {
+                    "id": request_id,
+                    "error": {
+                        "code": -32000,
+                        "message": f"authentication rejected: {params.get('apiKey', '')}",
+                    },
+                }
+            )
+            continue
+        if params.get("type") != "apiKey" or not isinstance(params.get("apiKey"), str):
+            emit(
+                {
+                    "id": request_id,
+                    "error": {"code": -32602, "message": "invalid login request"},
+                }
+            )
+            continue
+        account_present = True
+        emit({"id": request_id, "result": {"type": "apiKey"}})
     elif method == "config/read":
         mcp_override = next(
             (