feat(cloud): inject the ChatGPT subscription credential into serve container

Verified end-to-end in the live container BEFORE wiring (temp /__diag probe):
vendored codex read a dropped ~/.codex/auth.json, `codex login status` =
'Logged in using ChatGPT', container egressed, real turn completed (gpt-5.5,
HELLO_FROM_CLOUD). Subscription path works headless — no API key.

- index.ts: pass CODEX_AUTH_JSON through startProcess env to the container.
- start-serve.sh: write it to $CODEX_HOME/auth.json (0600) before serve starts,
  so Helmor's sidecar-spawned codex authenticates as the user's subscription.

Phase-1 will swap the whole-credential passthrough for a control-plane token
broker (mint per-turn access_token via auth.openai.com/oauth/token public
client; inject a ChatgptAuthTokens auth.json), keeping the rotating refresh
token in the durable control plane, never the ephemeral container.

Author: dohooo

cloud/scripts/start-serve.sh

@@ -40,6 +40,19 @@ if pgrep -f "${HELMOR_HOME}/helmor serve" >/dev/null 2>&1; then
 	exit 0
 fi
 
+# Cloud run identity (subscription): the Worker injects the ChatGPT auth.json via
+# CODEX_AUTH_JSON; drop it where codex looks (CODEX_HOME, default ~/.codex) so the
+# agent authenticates as the user's subscription. Verified end-to-end in-container
+# (codex login status = "Logged in using ChatGPT", real turn completed). Phase-1
+# will inject a per-turn short-lived token from the control-plane broker instead.
+if [ -n "${CODEX_AUTH_JSON:-}" ]; then
+	codex_dir="${CODEX_HOME:-${HOME:-/root}/.codex}"
+	mkdir -p "$codex_dir"
+	printf '%s' "$CODEX_AUTH_JSON" >"$codex_dir/auth.json"
+	chmod 600 "$codex_dir/auth.json"
+	echo "helmor-start-serve: wrote $codex_dir/auth.json ($(wc -c <"$codex_dir/auth.json") bytes)"
+fi
+
 # 1. Independent Xvfb daemon (idempotent — skip if one is already running).
 if ! pgrep -x Xvfb >/dev/null 2>&1; then
 	Xvfb "$DISPLAY" -screen 0 1280x800x24 -nolisten tcp >/tmp/xvfb.log 2>&1 &

cloud/src/index.ts

@@ -21,6 +21,11 @@ interface Env {
 	HELMOR_COMPANION_TOKEN: string;
 	/** PAT for PR6 clone / push, injected into the serve process env (secret). */
 	GITHUB_TOKEN?: string;
+	/** Cloud run identity: ChatGPT auth.json (the user's subscription), written to
+	 *  the container's ~/.codex/auth.json so the agent authenticates as that
+	 *  subscription. Phase-0 passes the whole credential through; Phase-1 will have
+	 *  the control-plane broker mint a per-turn short-lived token instead. */
+	CODEX_AUTH_JSON?: string;
 }
 
 /** Boot script staged in the image (Xvfb daemon → readiness → `helmor serve`). */
@@ -78,6 +83,7 @@ async function ensureServe(
 			HELMOR_COMPANION_TOKEN: env.HELMOR_COMPANION_TOKEN,
 			HELMOR_SERVE_PORT: String(port),
 			...(env.GITHUB_TOKEN ? { GITHUB_TOKEN: env.GITHUB_TOKEN } : {}),
+			...(env.CODEX_AUTH_JSON ? { CODEX_AUTH_JSON: env.CODEX_AUTH_JSON } : {}),
 		},
 	});