Tags: cgwalters/opencode

fix(codex): Avoid persisted auth in broker mode

Broker mode must not expose a local OpenCode credential to the agent process. Use a
synthetic OAuth identity solely to select the Codex protocol while the sidecar owns all
credentials and upstream authentication.

Assisted-by: OpenCode