#3769 agent-runner: let the Codex provider use a custom model provider (base URL + auth command)

The Codex provider runs codex exec --ephemeral --ignore-user-config --ignore-rules, and requires CODEX_API_KEY. That keeps runs hermetic, which we want. But it leaves no way to send Codex through an OpenAI-compatible gateway (a self-hosted proxy or router), because the model provider normally lives in the ignored ~/.codex/config.toml.

Codex accepts the provider as -c overrides, and they work together with --ignore-user-config. We tested this with codex-cli 0.160.1: the hermetic flags alone get 401 from [HOST-1], and the same flags plus these overrides succeed through the gateway:

-c model_provider=<id>
-c model_providers.<id>.name="<name>"
-c model_providers.<id>.base_url="<https://gateway/v1>"
-c model_providers.<id>.wire_api="responses"
-c model_providers.<id>.auth.command="<token helper>"   # and auth.args

Request:

1. A codex provider-config option, for example modelProvider: {id, name, baseUrl, wireApi, authCommand, authArgs}, or a generic configOverrides: string[], appended as -c arguments.
2. When a model provider with its own auth is set, skip the CODEX_API_KEY requirement (resolveAuthKey), or allow auth: cli for Codex.

Related: the provider always passes --ask-for-approval. Current codex-cli exec (0.160.1) rejects that flag, while -c approval_policy=never works. Could you also say why --ignore-user-config was chosen? We assume hermetic CI runs, and we'd like to keep it.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/agent-runner@2026.10.17.3
• swamp: 20261022.021804.0-sha.983e2929
• OS: linux (x86_64)
• Deno: 2.9.8
• Shell: /usr/bin/zsh