before SSO migration

bin/codex-devops-auth.sh

@@ -17,6 +17,9 @@ OCI_PROFILE_SYNC_PYTHON="${OCI_PROFILE_SYNC_PYTHON:-python3}"
 OCI_SESSION_VALIDATE_TIMEOUT_SECONDS="${OCI_SESSION_VALIDATE_TIMEOUT_SECONDS:-2}"
 RESET_AGENT="${RESET_AGENT:-0}"
 CODEX_DEVOPS_AUTH_ENV_OUT="${CODEX_DEVOPS_AUTH_ENV_OUT:-}"
+CODEX_DEVOPS_AUTH_CODEX_BIN="${CODEX_DEVOPS_AUTH_CODEX_BIN:-/opt/homebrew/bin/codex}"
+CODEX_DEVOPS_AUTH_CODEX_PROFILE="${CODEX_DEVOPS_AUTH_CODEX_PROFILE:-}"
+CODEX_DEVOPS_AUTH_DEFAULT_CODEX_PROFILE="${CODEX_DEVOPS_AUTH_DEFAULT_CODEX_PROFILE:-gpt-5-5}"
 DEDICATED_AGENT_PID=""
 DEDICATED_AGENT_SOCK=""
 PRESERVE_DEDICATED_AGENT="0"
@@ -35,6 +38,59 @@ run_oci() {
   "${OCI_BIN}" --profile "${OCI_PROFILE_NAME}" "$@"
 }
 
+codex_home() {
+  print -r -- "${CODEX_HOME:-${HOME}/.codex}"
+}
+
+codex_profile_file_exists() {
+  local profile="$1"
+  [[ -r "$(codex_home)/${profile}.config.toml" ]]
+}
+
+resolve_codex_profile() {
+  if [[ -n "${CODEX_DEVOPS_AUTH_CODEX_PROFILE}" ]]; then
+    print -r -- "${CODEX_DEVOPS_AUTH_CODEX_PROFILE}"
+    return 0
+  fi
+
+  if codex_profile_file_exists "${CODEX_DEVOPS_AUTH_DEFAULT_CODEX_PROFILE}"; then
+    print -r -- "${CODEX_DEVOPS_AUTH_DEFAULT_CODEX_PROFILE}"
+  fi
+
+  return 0
+}
+
+args_include_codex_profile() {
+  local arg
+
+  for arg in "$@"; do
+    case "${arg}" in
+      --profile|-p|--profile=*|-p=*|--profile-v2|--profile-v2=*)
+        return 0
+        ;;
+    esac
+  done
+
+  return 1
+}
+
+codex_profile_flag() {
+  local version_output version major minor rest
+
+  version_output="$("${CODEX_DEVOPS_AUTH_CODEX_BIN}" --version 2>/dev/null || true)"
+  version="${version_output##* }"
+  major="${version%%.*}"
+  rest="${version#*.}"
+  minor="${rest%%.*}"
+
+  if [[ "${major}" == "0" && "${minor}" =~ '^[0-9]+$' && "${minor}" -lt 134 ]]; then
+    print -r -- "--profile-v2"
+    return 0
+  fi
+
+  print -r -- "--profile"
+}
+
 resolve_timeout_bin() {
   local candidate
 
@@ -568,4 +624,12 @@ if [[ -n "${CODEX_DEVOPS_AUTH_ENV_OUT}" ]]; then
   exit 0
 fi
 
-/opt/homebrew/bin/codex "$@"
+codex_args=()
+if ! args_include_codex_profile "$@"; then
+  resolved_codex_profile="$(resolve_codex_profile)"
+  if [[ -n "${resolved_codex_profile}" ]]; then
+    codex_args+=("$(codex_profile_flag)" "${resolved_codex_profile}")
+  fi
+fi
+codex_args+=("$@")
+"${CODEX_DEVOPS_AUTH_CODEX_BIN}" "${codex_args[@]}"