Merge branch 'dev/winston/mitm-child-env-snapshots' into dev/winston/mitm-command-ca-bundles-restack-20260618

codex-rs/cli/src/doctor.rs

@@ -1399,8 +1399,8 @@ fn stored_auth_issues(
         codex_app_server_protocol::AuthMode::AgentIdentity => {
             if auth
                 .agent_identity
-                .as_deref()
-                .is_none_or(|token| token.trim().is_empty())
+                .as_ref()
+                .is_none_or(|agent_identity| !agent_identity.has_auth_material())
             {
                 issues.push("agent identity auth is missing an agent identity token");
             }

codex-rs/cli/src/main.rs

@@ -1738,12 +1738,9 @@ async fn load_exec_server_remote_auth_provider(
         let agent_identity_jwt = read_codex_access_token_from_env().ok_or_else(|| {
             anyhow::anyhow!("CODEX_ACCESS_TOKEN is required when --use-agent-identity-auth is set")
         })?;
-        let auth = CodexAuth::from_agent_identity_jwt(
-            &agent_identity_jwt,
-            Some(&config.chatgpt_base_url),
-            /*agent_identity_authapi_base_url_override*/ None,
-        )
-        .await?;
+        let auth =
+            CodexAuth::from_agent_identity_jwt(&agent_identity_jwt, Some(&config.chatgpt_base_url))
+                .await?;
         return Ok(codex_model_provider::auth_provider_from_auth(&auth));
     }