fix: Codex CLI OAuth device flow fails in headless/SSH environments

[PhilippWu]

Problem

When ENABLE_AGENT_CODEX=true is set, the provisioning script attempts to authenticate Codex CLI via OpenAI's OAuth device flow. In a headless server environment (SSH, no browser), this flow silently fails or hangs because:

• The device flow URL is not printed as a clickable link
• There is no mechanism to provide the auth code non-interactively
• The CODEX_OPENAI_AUTH_CODE env variable is present in the config but not currently wired up in infra/agents.sh

Expected Behavior

The provisioning script should:

1. Print the OAuth device activation URL as a plain clickable link (e.g. https://auth.openai.com/device?user_code=XXXX-XXXX) so it is visible in the cloud-init log
2. Accept a pre-obtained auth code via CODEX_OPENAI_AUTH_CODE in /etc/dev-server/env to perform authentication non-interactively during provisioning
3. Fall back gracefully (warn + skip) if neither an API key nor an auth code is provided, instead of hanging

Steps to Reproduce

1. Set ENABLE_AGENT_CODEX=true and leave OPENAI_API_KEY empty in cloud-init config
2. Deploy server — observe that Codex auth hangs or fails silently in /var/log/dev-server-provision.log

Acceptance Criteria

• infra/agents.sh: if CODEX_OPENAI_AUTH_CODE is set, pass it to codex --auth-code (or equivalent) for non-interactive auth
• If CODEX_OPENAI_AUTH_CODE is empty and OPENAI_API_KEY is empty, print a clear warning and skip Codex setup (do not fail the whole provisioning)
• Device flow URL printed as plain text to the log when interactive auth is required
• Configurator: add a note in the Codex section explaining how to obtain the auth code and set CODEX_OPENAI_AUTH_CODE
• Docs: add a "Codex CLI authentication" section to docs/oauth-setup.md

Notes

• The CODEX_OPENAI_AUTH_CODE field already exists in the env file template — it just needs to be consumed
• This also affects ENABLE_AGENT_OPENCODE if it shares the same OAuth flow

---

Labels: bug, agents, codex