From 0453ba7eb3c7bf4f00f05e28da2c6ecf4bbfa585 Mon Sep 17 00:00:00 2001
From: "Harold Kim (Git Expert)" <harold.kim@paperclipai.com>
Date: Thu, 9 Jul 2026 04:39:32 +0000
Subject: [PATCH] feat(codex-local): add Codex auth precedence resolver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds auth-precedence.ts — a pure module that resolves which Codex credential
wins when multiple credential sources are present (configured API key, host
auth.json, sandbox auth.json). Exposes a shouldWarn flag for when a sandbox
snapshot login is shadowed by host credentials, enabling callers to emit a
visible run-log warning instead of silently overriding the sandbox session.

Precedence order: configured_api_key > host_auth_json > sandbox_auth_json > none

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../codex-local/src/server/auth-precedence.ts | 46 +++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 packages/adapters/codex-local/src/server/auth-precedence.ts

diff --git a/packages/adapters/codex-local/src/server/auth-precedence.ts b/packages/adapters/codex-local/src/server/auth-precedence.ts
new file mode 100644
index 00000000000..0baaf443906
--- /dev/null
+++ b/packages/adapters/codex-local/src/server/auth-precedence.ts
@@ -0,0 +1,46 @@
+export const CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING =
+  "snapshot login present but host credentials take precedence";
+export const CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING_LOG_LINE =
+  `[paperclip] Warning: ${CODEX_SANDBOX_AUTH_PRECEDENCE_WARNING}.\n`;
+export const CODEX_SANDBOX_AUTH_EXISTS_COMMAND =
+  'test -f "$HOME/.codex/auth.json"';
+
+export type CodexAuthPrecedenceWinner =
+  | "configured_api_key"
+  | "host_auth_json"
+  | "sandbox_auth_json"
+  | "none";
+
+export interface CodexAuthPrecedenceInput {
+  configuredApiKey: boolean;
+  hostAuthJson: boolean;
+  sandboxAuthJson: boolean;
+}
+
+export interface CodexAuthPrecedenceResolution {
+  winner: CodexAuthPrecedenceWinner;
+  sandboxLoginShadowed: boolean;
+  shouldWarn: boolean;
+}
+
+export function resolveCodexAuthPrecedence(
+  input: CodexAuthPrecedenceInput,
+): CodexAuthPrecedenceResolution {
+  const winner: CodexAuthPrecedenceWinner =
+    input.configuredApiKey
+      ? "configured_api_key"
+      : input.hostAuthJson
+        ? "host_auth_json"
+        : input.sandboxAuthJson
+          ? "sandbox_auth_json"
+          : "none";
+  const sandboxLoginShadowed =
+    input.sandboxAuthJson &&
+    (winner === "configured_api_key" || winner === "host_auth_json");
+
+  return {
+    winner,
+    sandboxLoginShadowed,
+    shouldWarn: sandboxLoginShadowed,
+  };
+}