refactor(runtime): finalize codex native-only config contract

src/main/ipc/configValidation.ts

@@ -525,25 +525,7 @@ function validateProviderConnectionsSection(
     const codexUpdate: Partial<ProviderConnectionsConfig['codex']> = {};
 
     for (const [connectionKey, connectionValue] of Object.entries(value)) {
-      if (connectionKey === 'apiKeyBetaEnabled') {
-        if (typeof connectionValue !== 'boolean') {
-          return {
-            valid: false,
-            error: 'providerConnections.codex.apiKeyBetaEnabled must be a boolean',
-          };
-        }
-        codexUpdate.apiKeyBetaEnabled = connectionValue;
-        continue;
-      }
-
-      if (connectionKey === 'authMode') {
-        if (connectionValue !== 'oauth' && connectionValue !== 'api_key') {
-          return {
-            valid: false,
-            error: 'providerConnections.codex.authMode must be one of: oauth, api_key',
-          };
-        }
-        codexUpdate.authMode = connectionValue;
+      if (connectionKey === 'apiKeyBetaEnabled' || connectionKey === 'authMode') {
         continue;
       }
 

src/main/services/infrastructure/ConfigManager.ts

@@ -232,16 +232,12 @@ export interface RuntimeConfig {
 }
 
 export type ProviderConnectionAuthMode = 'auto' | 'oauth' | 'api_key';
-export type CodexProviderConnectionAuthMode = Exclude<ProviderConnectionAuthMode, 'auto'>;
 
 export interface ProviderConnectionsConfig {
   anthropic: {
     authMode: ProviderConnectionAuthMode;
   };
-  codex: {
-    apiKeyBetaEnabled: boolean;
-    authMode: CodexProviderConnectionAuthMode;
-  };
+  codex: Record<string, never>;
 }
 
 export interface DisplayConfig {
@@ -335,10 +331,7 @@ const DEFAULT_CONFIG: AppConfig = {
     anthropic: {
       authMode: 'auto',
     },
-    codex: {
-      apiKeyBetaEnabled: false,
-      authMode: 'oauth',
-    },
+    codex: {},
   },
   runtime: {
     providerBackends: {
@@ -567,10 +560,7 @@ export class ConfigManager {
           ...DEFAULT_CONFIG.providerConnections.anthropic,
           ...(loaded.providerConnections?.anthropic ?? {}),
         },
-        codex: {
-          ...DEFAULT_CONFIG.providerConnections.codex,
-          ...(loaded.providerConnections?.codex ?? {}),
-        },
+        codex: {},
       },
       runtime: {
         providerBackends: {

src/main/services/runtime/ProviderConnectionService.ts

@@ -290,8 +290,6 @@ export class ProviderConnectionService {
       ...capabilities,
       configurableAuthModes,
       configuredAuthMode,
-      apiKeyBetaAvailable: providerId === 'codex' ? undefined : undefined,
-      apiKeyBetaEnabled: providerId === 'codex' ? undefined : undefined,
       apiKeyConfigured: Boolean(storedApiKey?.value.trim() || externalCredential?.value.trim()),
       apiKeySource: storedApiKey?.value.trim()
         ? 'stored'

src/renderer/components/settings/hooks/useSettingsHandlers.ts

@@ -332,10 +332,7 @@ export function useSettingsHandlers({
           anthropic: {
             authMode: 'auto',
           },
-          codex: {
-            apiKeyBetaEnabled: false,
-            authMode: 'oauth',
-          },
+          codex: {},
         },
         runtime: {
           providerBackends: {

src/shared/types/cliInstaller.ts

@@ -31,8 +31,6 @@ export interface CliProviderConnectionInfo {
   supportsApiKey: boolean;
   configurableAuthModes: CliProviderAuthMode[];
   configuredAuthMode: CliProviderAuthMode | null;
-  apiKeyBetaAvailable?: boolean;
-  apiKeyBetaEnabled?: boolean;
   apiKeyConfigured: boolean;
   apiKeySource: 'stored' | 'environment' | null;
   apiKeySourceLabel?: string | null;

src/shared/types/notifications.ts

@@ -328,10 +328,7 @@ export interface AppConfig {
     anthropic: {
       authMode: 'auto' | 'oauth' | 'api_key';
     };
-    codex: {
-      apiKeyBetaEnabled: boolean;
-      authMode: 'oauth' | 'api_key';
-    };
+    codex: Record<string, never>;
   };
   /** Runtime backend preferences for app-launched agent_teams_orchestrator sessions */
   runtime: {

test/main/ipc/configValidation.test.ts

@@ -208,7 +208,7 @@ describe('configValidation', () => {
     }
   });
 
-  it('accepts Codex provider connection beta updates', () => {
+  it('normalizes legacy Codex provider connection updates to the native-only config shape', () => {
     const result = validateConfigUpdatePayload('providerConnections', {
       codex: {
         apiKeyBetaEnabled: true,
@@ -219,24 +219,23 @@ describe('configValidation', () => {
     expect(result.valid).toBe(true);
     if (result.valid) {
       expect(result.data).toEqual({
-        codex: {
-          apiKeyBetaEnabled: true,
-          authMode: 'api_key',
-        },
+        codex: {},
       });
     }
   });
 
-  it('rejects invalid Codex auth modes in providerConnections', () => {
+  it('drops unsupported legacy Codex auth modes during providerConnections migration', () => {
     const result = validateConfigUpdatePayload('providerConnections', {
       codex: {
         authMode: 'auto',
       },
     });
 
-    expect(result.valid).toBe(false);
-    if (!result.valid) {
-      expect(result.error).toContain('providerConnections.codex.authMode');
+    expect(result.valid).toBe(true);
+    if (result.valid) {
+      expect(result.data).toEqual({
+        codex: {},
+      });
     }
   });
 

test/main/services/runtime/ProviderConnectionService.test.ts

@@ -17,10 +17,7 @@ describe('ProviderConnectionService', () => {
         anthropic: {
           authMode,
         },
-        codex: {
-          apiKeyBetaEnabled: false,
-          authMode: 'oauth' as const,
-        },
+        codex: {},
       },
       runtime: {
         providerBackends: {
@@ -183,8 +180,6 @@ describe('ProviderConnectionService', () => {
       apiKeySource: null,
       apiKeySourceLabel: null,
     });
-    expect(info.apiKeyBetaAvailable).toBeUndefined();
-    expect(info.apiKeyBetaEnabled).toBeUndefined();
   });
 
   it('mirrors a stored OpenAI key into CODEX_API_KEY for native Codex launches', async () => {

test/renderer/components/cli/CliStatusVisibility.test.ts

@@ -179,8 +179,6 @@ function createApiKeyMisconfiguredProvider(
       configurableAuthModes:
         providerId === 'anthropic' ? ['auto', 'oauth', 'api_key'] : [],
       configuredAuthMode: providerId === 'anthropic' ? 'api_key' : null,
-      apiKeyBetaAvailable: undefined,
-      apiKeyBetaEnabled: undefined,
       apiKeyConfigured: false,
       apiKeySource: null,
       apiKeySourceLabel: null,

test/renderer/components/runtime/ProviderRuntimeSettingsDialog.test.ts

@@ -10,10 +10,7 @@ interface StoreState {
       anthropic: {
         authMode: 'auto' | 'oauth' | 'api_key';
       };
-      codex: {
-        apiKeyBetaEnabled: boolean;
-        authMode: 'oauth' | 'api_key';
-      };
+      codex: Record<string, never>;
     };
   };
   apiKeys: {
@@ -205,8 +202,6 @@ function createCodexProvider(
       supportsApiKey: true,
       configurableAuthModes: [],
       configuredAuthMode: null,
-      apiKeyBetaAvailable: undefined,
-      apiKeyBetaEnabled: undefined,
       apiKeyConfigured: overrides?.apiKeyConfigured ?? false,
       apiKeySource: overrides?.apiKeySource ?? null,
       apiKeySourceLabel: overrides?.apiKeySourceLabel ?? null,
@@ -323,10 +318,7 @@ describe('ProviderRuntimeSettingsDialog', () => {
         anthropic: {
           authMode: 'auto',
         },
-        codex: {
-          apiKeyBetaEnabled: false,
-          authMode: 'oauth',
-        },
+        codex: {},
       },
     };
     storeState.apiKeys = [];
@@ -348,10 +340,7 @@ describe('ProviderRuntimeSettingsDialog', () => {
               ...storeState.appConfig.providerConnections.anthropic,
               ...(nextProviderConnections.anthropic ?? {}),
             },
-            codex: {
-              ...storeState.appConfig.providerConnections.codex,
-              ...(nextProviderConnections.codex ?? {}),
-            },
+            codex: {},
           },
         };
       }