[Bug]: Codex configured for Google Vertex AI fails account discovery #35852

#!/bin/sh
set -u
repo=$(CDPATH= cd -- "$1" && pwd) || exit 2
scratch=$(mktemp -d /tmp/codex-gcp-repro.XXXXXX) || exit 2
trap 'rm -rf "$scratch"' EXIT HUP INT TERM
export HOME="$scratch/home" CODEX_HOME="$scratch/codex"
export XDG_CONFIG_HOME="$scratch/config" XDG_DATA_HOME="$scratch/data" XDG_CACHE_HOME="$scratch/cache"
export T3CODE_HOME="$scratch/t3" TMPDIR="$scratch/tmp"
mkdir -p "$HOME" "$CODEX_HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_CACHE_HOME" "$T3CODE_HOME" "$TMPDIR" "$scratch/workspace"
unset OPENAI_API_KEY OPENAI_BASE_URL CODEX_API_KEY CHATGPT_ACCESS_TOKEN GOOGLE_APPLICATION_CREDENTIALS
node --version
npm --version
codex --version
git -C "$repo" rev-parse HEAD
if ! npm install --prefix "$scratch" --no-save --no-package-lock --ignore-scripts --no-audit --no-fund effect@4.1.3 > "$scratch/install.log" 2>&1; then
  cat "$scratch/install.log"
  echo "RESULT: inconclusive"
  exit 2
fi
printf 'model_provider = "gcp"\ncli_auth_credentials_store = "file"\n' > "$CODEX_HOME/config.toml"
cat > "$scratch/check.mjs" <<'JS'
import { registerHooks, createRequire } from "node:module";
import { pathToFileURL } from "node:url";
import { spawn } from "node:child_process";
import { createInterface } from "node:readline";
import { resolve } from "node:path";
const [repo, scratch] = process.argv.slice(2);
const require = createRequire(import.meta.url);
const effectRoot = resolve(scratch, "node_modules/effect/dist");
registerHooks({ resolve(specifier, context, nextResolve) {
  if (specifier.startsWith("effect/")) {
    return nextResolve(pathToFileURL(resolve(effectRoot, specifier.slice(7) + ".js")).href, context);
  }
  return nextResolve(specifier, context);
}});
const Schema = await import("effect/Schema");
const Effect = await import("effect/Effect");
const Exit = await import("effect/Exit");
const CodexSchema = await import(pathToFileURL(resolve(repo, "packages/effect-codex-app-server/src/_generated/schema.gen.ts")));
const { decodeOptionalPayload } = await import(pathToFileURL(resolve(repo, "packages/effect-codex-app-server/src/_internal/shared.ts")));
console.log("effect " + require("./node_modules/effect/package.json").version);
const control = { account: { type: "amazonBedrock", usesCodexManagedCredentials: false }, requiresOpenaiAuth: false, workspaceRouting: null };
if (!Schema.is(CodexSchema.V2GetAccountResponse)(control)) throw new Error("Bedrock control failed");
console.log("CONTROL: no-OpenAI-auth Bedrock account accepted");
const env = {};
for (const key of ["PATH", "HOME", "CODEX_HOME", "XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_CACHE_HOME", "T3CODE_HOME", "TMPDIR"]) env[key] = process.env[key];
const child = spawn("codex", ["app-server"], { cwd: resolve(scratch, "workspace"), env, stdio: ["pipe", "pipe", "pipe"] });
child.stderr.resume();
const pending = new Map();
const lines = createInterface({ input: child.stdout });
lines.on("line", line => {
  let message;
  try { message = JSON.parse(line); } catch { return; }
  const waiter = pending.get(message.id);
  if (!waiter) return;
  pending.delete(message.id);
  if (message.error) waiter.reject(new Error(JSON.stringify(message.error))); else waiter.resolve(message.result);
});
child.on("error", error => { for (const waiter of pending.values()) waiter.reject(error); });
child.on("exit", () => { for (const waiter of pending.values()) waiter.reject(new Error("app-server exited")); });
let id = 0;
const request = (method, params) => new Promise((resolve, reject) => {
  const requestId = ++id; pending.set(requestId, { resolve, reject });
  child.stdin.write(JSON.stringify({ id: requestId, method, params }) + "\n");
});
const timeout = setTimeout(() => {
  for (const waiter of pending.values()) waiter.reject(new Error("app-server response timed out"));
}, 15000);
try {
  const init = await request("initialize", { clientInfo: { name: "gcp-repro", version: "1" }, capabilities: { experimentalApi: true } });
  child.stdin.write(JSON.stringify({ method: "initialized" }) + "\n");
  const account = await request("account/read", {});
  console.log("WIRE: " + JSON.stringify(account));
  if (account.account?.type !== "gcp" || account.requiresOpenaiAuth !== false) throw new Error("Unexpected GCP response");
  const decoded = await Effect.runPromiseExit(decodeOptionalPayload("account/read", CodexSchema.V2GetAccountResponse, account));
  const accepted = Exit.isSuccess(decoded);
  console.log("T3 account/read decoder: " + (accepted ? "accepted" : "rejected"));
  console.log(accepted ? "RESULT: expected behavior" : "RESULT: defect reproduced");
  process.exitCode = accepted ? 0 : 1;
} catch (error) {
  console.log("SETUP: " + error.message);
  console.log("RESULT: inconclusive");
  process.exitCode = 2;
} finally {
  clearTimeout(timeout);
  lines.close();
  child.kill("SIGKILL");
}
JS
node "$scratch/check.mjs" "$repo" "$scratch"