CodexAgent logs in with OPENAI_API_KEY automatically

Agno's CodexAgent now logs the Codex app-server in with OPENAI_API_KEY before it starts or resumes a thread, and before compact(). Earlier releases passed the key through the environment without a login, and the app-server answered HTTP 401.

Agno asks the app-server for its current account first. It logs in when there is no account or the account is an API key, and it leaves a ChatGPT or other login untouched. The Codex app-server writes the login to auth.json in CODEX_HOME.

We ran the real Codex app-server with an empty CODEX_HOME, a fake key and the network blocked (real output).

# Earlier releases
account after connect: None
auth.json: absent
 
# This release
account after connect: apiKey
auth.json: OPENAI_API_KEY = sk-fake-agno-demo | auth_mode = apikey

Reading a ChatGPT account makes the app-server call OpenAI, so that case ran on FakeAsyncCodex, the stand-in SDK from the release's own test suite.

# Earlier releases, key set, any login
thread_start
 
# This release, key set
no login:      account -> login -> thread_start
ChatGPT login: account -> thread_start

The key comes from the agent's env, then client_options.env, then the process environment. When the login fails, CodexAgent closes the client and raises a RuntimeError that shows [redacted] in place of the key.

See the cookbook, and learn more about running Claude and Codex as services in the documentation.