Allow Codex Work desktop agent task recovery

[jakemcallister]

Summary

• allow the current Codex Work desktop originator, codex_work_desktop, through the opt-in encrypted agent-task recovery path
• keep the recovery allowlist exact; non-Codex originators, opaque credentials, non-loopback binds, and invalid native OAuth tokens remain rejected
• add a regression test proving the desktop originator is forwarded to the fixed ChatGPT recovery endpoint

This fixes the desktop variant of the encrypted routed-worker failure tracked in #92. OpenAI's current Codex source emits codex_work_desktop, while the recovery allowlist currently recognizes only the older desktop labels.

Verification

• /Users/jakemcallister/.nvm/versions/node/v24.13.0/lib/node_modules/@bitkyc08/opencodex/node_modules/bun/bin/bun.exe test tests/agent-task-recovery-security.test.ts — 13 passed
• /Users/jakemcallister/.nvm/versions/node/v24.13.0/lib/node_modules/@bitkyc08/opencodex/node_modules/bun/bin/bun.exe run typecheck — passed
• live local proxy check: the desktop request advanced from the encrypted V2 rejection into configured provider routing; Gemini 3.7 Flash then completed a direct Antigravity request successfully

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No user-facing configuration changes.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 596db718-6f17-4d3a-9e31-17131a76c9b7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.