codex exec fails with ChatGPT auth when API key env vars are present

Summary

codex exec fails with ChatGPT auth when OPENAI_API_KEY and CODEX_API_KEY are present in the environment, even though stored auth is configured as chatgpt.

Environment

• Codex CLI: v0.139.0
• Platform: Linux
• Auth mode: ChatGPT / SIWC
• Install path: ~/.local/bin

Repro

1. Log in with ChatGPT auth.
2. Have both env vars present:

OPENAI_API_KEY=...
CODEX_API_KEY=...

1. Run:

codex exec "hi"

Actual behavior

codex exec fails with:

ERROR codex_api::endpoint::responses_websocket: failed to connect to websocket: HTTP error: 401 Unauthorized, url: wss://api.openai.com/v1/responses

codex doctor --json reports:

"auth.credentials": {
  "status": "warning",
  "summary": "auth is configured, but multiple auth env vars are present",
  "details": {
    "auth env vars present": "OPENAI_API_KEY, CODEX_API_KEY",
    "stored API key": "false",
    "stored ChatGPT tokens": "true",
    "stored auth mode": "chatgpt"
  }
}

Workaround

This works:

unset OPENAI_API_KEY CODEX_API_KEY
codex exec "hi"

Expected behavior

If stored auth mode is chatgpt, codex exec should either use the stored ChatGPT credentials or clearly report that env API-key auth is taking precedence. The current behavior is surprising because the normal Codex CLI flow works, but headless codex exec breaks in environments that also have API keys configured.

Impact

This affects automated/headless flows that call codex exec.