fix(auth): make login status recognize existing Codex authentication

[Ultron09]

Summary

Fixes #670. When a user with an existing ambient Codex authentication session (e.g. in ~/.codex/auth.json or $CODEX_HOME/auth.json) ran codex-security login status or invoked security.account() on a fresh state directory, Codex Security reported "Not logged in".

Ambient credentials were only imported during scan execution (via initialCredentialsAvailable), creating an inconsistency where login status reported not logged in immediately before a scan succeeded using ChatGPT authentication.

Changes

• In sdk/typescript/src/cli.ts: When args.action === "status" and credentialHome exists, invoke initialCredentialsAvailable(dependencies.environment, ambientHome, credentialHome) before executing Codex login status.
• In sdk/typescript/src/api.ts: In CodexSecurity.prototype.account(), invoke initialCredentialsAvailable(...) on authentication.codexHome prior to querying accountStatus().
• Preserves explicit logout marker: initialCredentialsAvailable() continues to enforce codexSecurityCredentialAllowsAmbientImport(isolatedHome), ensuring ambient credentials are never re-imported if the user previously logged out.
• Added regression tests in sdk/typescript/tests-ts/cli-authentication.test.ts and sdk/typescript/tests-ts/api-credentials.test.ts.

Testing

Ran the following checks locally:

• pnpm --dir sdk/typescript run types -> passed with 0 errors
• bun test ./tests-ts/cli-authentication.test.ts ./tests-ts/auth.test.ts ./tests-ts/api-credentials.test.ts -> 43 passed, 2 skipped (platform-specific), 0 failed
• pnpm --dir sdk/typescript run format -> passed (all matched files use Prettier style)
• python .github/scripts/check_plugin_source_compatibility.py -> passed

Risk and rollout

• Low risk: only imports ambient Codex authentication if ambient import is allowed (no logout marker) and no overriding environment API keys are present.
• Fully backwards-compatible with existing Codex Security credential management; no public CLI flags or arguments changed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the refreshed head 681d3b005d80eaf5395ae6edfa3b2764ecfaac1c against main at f714a6582ec0b7fe32fc06894a3eb9cdd768b48f before merge. Test-isolation improvements and credential-import error coverage are tracked separately in #759.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T17:49:30.025594Z	681d3b0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex security review

Please review head 681d3b005d80eaf5395ae6edfa3b2764ecfaac1c against f714a6582ec0b7fe32fc06894a3eb9cdd768b48f, focusing on ambient credential import, API-key precedence, and explicit logout behavior.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 681d3b005d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Thanks for fixing this and adding regression coverage! Having login status recognize an existing Codex session makes the first-run experience much clearer. I appreciate the contribution. We’ll handle the concurrent logout case in follow-up #759.