Applies proven patterns from the free-claude-code reference adapters:
launch (Claude Code):
- always set ANTHROPIC_AUTH_TOKEN — a no-auth sentinel when none is resolved —
so newer Claude Code doesn't stop at its local login gate before contacting
OmniRoute (an open backend ignores the value; ANTHROPIC_API_KEY stays stripped).
launch-codex:
- remote-aware: resolves the root base URL + auth from --remote/--api-key, the
active context, then localhost (was localhost/--remote only).
- inject the `omniroute` provider via `-c` flags (model_provider + base_url +
env_key + wire_api=responses + requires_openai_auth=false) so it works WITHOUT
a pre-existing ~/.codex/config.toml.
- strip OPENAI_*/CODEX_* from the child env (defense-in-depth) and set
OMNIROUTE_API_KEY to the token or a sentinel. (Honest note: this does NOT
silence codex's refresh_token log noise — that comes from ~/.codex/auth.json,
is cosmetic, and does not block requests.)
- replace a hard-coded Tailscale IP in --remote help with a placeholder.
Tests: buildCodexEnv (strip + sentinel + no-mutate), buildCodexProviderArgs
(inline provider def), resolveCodexTarget; updated buildClaudeEnv sentinel test.
Validated remotely vs VPS v3.8.30: `launch-codex --remote ... exec` → "OK".
19 unit tests pass; check:cli-i18n green.
