[Bug]: Custom Codex providers show a false unverified-auth warning after successful requests

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. Add a Codex provider instance in T3 Code.
2. Set its CODEX_HOME to a config that uses a custom provider, such as model_provider = "azure".
3. Add the provider key through T3 Code's sensitive environment variable field. The Codex config names that variable with env_key.
4. Refresh the provider status.
5. Start a new thread with that provider and send a request.
6. Confirm that the request returns a valid response, then return to Settings > Providers.

Expected behavior

T3 Code should not describe a ready, working custom provider as an authentication problem.

For example, it could show:

• Ready · External authentication
• Credentials are managed by the configured Codex provider and checked when a request runs.

It should not mark the provider as authenticated solely because requiresOpenaiAuth is false. A missing environment key can still fail when a request starts. An explicit external or not_required auth state, a connection test, or a last-success signal would give a more exact status.

Actual behavior

The provider works and the request succeeds, but the card still shows:

Available — Installed and ready, but authentication could not be verified.

The current code path appears to explain the result:

• accountProbeStatus() maps account: null plus requiresOpenaiAuth: false to provider ready with auth unknown.
• getProviderSummary() renders that state with the generic unverified-auth text.

This is the normal account response for a custom Codex provider that gets its key from its configured environment variable, so the text reads as a failed auth check even after a successful request.

Related: #644 and #649 fixed the older hard failure for custom Codex provider auth. This report covers the status text that remains after that fix.

Impact

Minor bug or occasional failure

Version or commit

T3 Code Nightly 0.0.29-nightly.20260727.915

Environment

macOS 26.5.2; T3 Code desktop; Codex CLI 0.145.0; custom Azure provider; model gpt-5.6-sol; reasoning xhigh

Logs or stack traces

A request from the same T3 provider completed successfully with:
modelProvider: "azure"
model: "gpt-5.6-sol"
reasoning effort: "xhigh"
model context window: 997500
response: OK

Screenshots, recordings, or supporting files

Not included because the current provider card contains account data. The exact text appears above.

Workaround

Send a real request to check the key and provider. There is no known way to make the provider card record that success.

Start with accountProbeStatus() in apps/server/src/provider/Layers/CodexProvider.ts and getProviderSummary() in apps/web/src/components/settings/providerStatus.ts. Reproduce a successful request through a custom Codex provider, then trace how its status is rendered. Done means a working external provider no longer shows the generic unverified-auth warning while missing credentials can still be detected when a request runs.