fix(models): degrade a non-object Codex auth file to no credential - #5584

Why

load_codex_cli_credential reads ~/.codex/auth.json (or $CODEX_AUTH_PATH) through _load_json_file, which returns whatever json.loads produced — any valid JSON value, not only an object. The loader then called data.get("tokens", {}) on it directly (backend/packages/harness/deerflow/models/credential_loader.py:229-232).

A syntactically valid auth file whose top level is not an object (an array, a string, a number) therefore raised AttributeError: 'list' object has no attribute 'get' from load_codex_cli_credential. Nothing catches it, so it propagated out of CodexChatModel.model_post_init (openai_codex_provider.py:95), aborting model construction before the provider could raise its documented ValueError("Codex CLI credential not found. Expected ~/.codex/auth.json or CODEX_AUTH_PATH."). That is the opposite of the module's degrade-gracefully behaviour.

The nested tokens value already carries this guard (credential_loader.py:233-235), and the sibling Claude loader got the equivalent top-level guard in #5494 — the Codex top level was the one spot left uncovered.

What changed

• A Codex auth file whose top level is not a JSON object is now treated as "no credential from this source": one debug log and return None, so the loader falls through and CodexChatModel reaches its existing documented "Codex CLI credential not found" error instead of an AttributeError.
• Regression tests in backend/tests/test_credential_loader.py:
  • test_load_codex_cli_credential_ignores_non_object_auth_file — parametrized over array / string / number payloads, asserts load_codex_cli_credential() is None.
  • test_codex_chat_model_reports_missing_credential_for_non_object_auth_file — asserts CodexChatModel construction raises the documented ValueError.

Surface area

• Agents / LangGraph — model construction path (CodexChatModel / credential loading); no prompt-layer data channels affected.

Bug fix verification

• Test path that reproduces the bug: backend/tests/test_credential_loader.py::test_load_codex_cli_credential_ignores_non_object_auth_file and ::test_codex_chat_model_reports_missing_credential_for_non_object_auth_file
• Did it go red on main and green on this branch? yes.
  • On main (unpatched): 4 failed, 19 deselected in 0.97s — AttributeError: 'list' object has no attribute 'get' at credential_loader.py:232.
  • On this branch: 23 passed.

Validation

• cd backend && uv run pytest tests/test_credential_loader.py -q → 23 passed
• cd backend && uv run pytest -m "not live" --ignore=tests/blocking_io tests/ -q → 17551 passed, 199 skipped, 3 deselected
• cd backend && uv run ruff check . → All checks passed; uv run ruff format --check . → 1545 files already formatted

AI assistance

Tool(s) used: Claude Code

How you used it: The assistant located the unguarded call, wrote the regression tests, and ran the verification commands quoted above. I reviewed the diff and understand every line.

• I've read and understand every line of this change and take responsibility for it — it's not unreviewed AI output.