[tob-scott-a]

Codex calls currently discard CODEX_API_KEY when building the isolated child environment. Codex 0.162.1 uses that variable as its non-interactive API-key override, so forwarding only OPENAI_API_KEY does not preserve that authentication path.

Preserve CODEX_API_KEY in the environment allowlist. When its value is nonblank, skip stored-credential lookup and staging, matching Codex's override precedence. This also lets an explicit API key work when the configured keyring is locked. Empty and whitespace-only values retain stored-login behavior. The child still uses its private temporary configuration home.

Neither reported authentication case was fixed in v0.2.0. The file/keyring ChatGPT-login fix is already on main through #26; this PR addresses the remaining API-key gap.

Validation:

• gmake verify on Python 3.13, including whole-recipe compiler dry runs with stub agents and synthesized inputs.
• 144 focused provider/authentication tests pass. New regressions cover forwarding both API-key variable names, override precedence across file/keyring/auto storage, blank overrides, environment filtering, source credential preservation, and temporary-home cleanup.
• Built sdist and wheel; artifact verification, Twine checks, and clean wheel installation/import/CLI smoke test pass.
• Full serial Python 3.14 suite: 2,915 passed and 4 skipped; 95% statement/branch coverage, including 100% for codex_auth.py.

Tests use stub providers/keyring backends; no live provider acceptance or local mutation testing was run.

[kz-tob]

works