From e2c466a3a8705f127380525d201789440a7c69c0 Mon Sep 17 00:00:00 2001
From: Liang-Ting Jiang <lt@openai.com>
Date: Sat, 27 Jun 2026 08:47:21 +0000
Subject: [PATCH] [codex] gate external account reporting

---
 codex-rs/model-provider/src/provider.rs | 29 +++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/codex-rs/model-provider/src/provider.rs b/codex-rs/model-provider/src/provider.rs
index 13e93be724..c15e228994 100644
--- a/codex-rs/model-provider/src/provider.rs
+++ b/codex-rs/model-provider/src/provider.rs
@@ -277,6 +277,9 @@ impl ModelProvider for ConfiguredModelProvider {
                     if auth_manager.refresh_failure_for_auth(&auth).is_some() {
                         return None;
                     }
+                    if matches!(&auth, CodexAuth::ExternalProvided(_)) && !auth.is_chatgpt_auth() {
+                        return None;
+                    }
                     Some(auth)
                 })
                 .map(|auth| match &auth {
@@ -337,6 +340,8 @@ impl ModelProvider for ConfiguredModelProvider {
 mod tests {
     use std::num::NonZeroU64;
 
+    use codex_login::ExternalProvidedAuth;
+    use codex_login::ExternalProvidedAuthCapabilities;
     use codex_login::auth::AgentIdentityAuthPolicy;
     use codex_login::auth::BedrockApiKeyAuth;
     use codex_model_provider_info::ModelProviderAwsAuthInfo;
@@ -590,6 +595,30 @@ mod tests {
         );
     }
 
+    #[test]
+    fn openai_provider_does_not_report_backend_only_external_auth_as_chatgpt() {
+        let auth = ExternalProvidedAuth::new([], "user-123").with_capabilities(
+            ExternalProvidedAuthCapabilities {
+                uses_codex_backend: true,
+                ..Default::default()
+            },
+        );
+        let provider = create_model_provider(
+            ModelProviderInfo::create_openai_provider(/*base_url*/ None),
+            Some(AuthManager::from_auth_for_testing(
+                CodexAuth::ExternalProvided(auth),
+            )),
+        );
+
+        assert_eq!(
+            provider.account_state(),
+            Ok(ProviderAccountState {
+                account: None,
+                requires_openai_auth: true,
+            })
+        );
+    }
+
     #[test]
     fn openai_provider_rejects_bedrock_api_key_account_state() {
         let provider = create_model_provider(