Replace config.responses_originator_header_internal_override with CODEX_INTERNAL_ORIGINATOR_OVERRIDE_ENV_VAR (#3388)

The previous config approach had a few issues:
1. It is part of the config but not designed to be used externally
2. It had to be wired through many places (look at the +/- on this PR
3. It wasn't guaranteed to be set consistently everywhere because we
don't have a super well defined way that configs stack. For example, the
extension would configure during newConversation but anything that
happened outside of that (like login) wouldn't get it.

This env var approach is cleaner and also creates one less thing we have
to deal with when coming up with a better holistic story around configs.

One downside is that I removed the unit test testing for the override
because I don't want to deal with setting the global env or spawning
child processes and figuring out how to introspect their originator
header. The new code is sufficiently simple and I tested it e2e that I
feel as if this is still worth it.

codex-rs/tui/src/lib.rs

@@ -312,11 +312,7 @@ async fn run_ratatui_app(
         ..
     } = cli;
 
-    let auth_manager = AuthManager::shared(
-        config.codex_home.clone(),
-        config.preferred_auth_method,
-        config.responses_originator_header.clone(),
-    );
+    let auth_manager = AuthManager::shared(config.codex_home.clone(), config.preferred_auth_method);
     let login_status = get_login_status(&config);
     let should_show_onboarding =
         should_show_onboarding(login_status, &config, should_show_trust_screen);
@@ -400,11 +396,7 @@ fn get_login_status(config: &Config) -> LoginStatus {
         // Reading the OpenAI API key is an async operation because it may need
         // to refresh the token. Block on it.
         let codex_home = config.codex_home.clone();
-        match CodexAuth::from_codex_home(
-            &codex_home,
-            config.preferred_auth_method,
-            &config.responses_originator_header,
-        ) {
+        match CodexAuth::from_codex_home(&codex_home, config.preferred_auth_method) {
             Ok(Some(auth)) => LoginStatus::AuthMode(auth.mode),
             Ok(None) => LoginStatus::NotAuthenticated,
             Err(err) => {

codex-rs/tui/src/onboarding/auth.rs

@@ -2,7 +2,6 @@
 
 use codex_core::AuthManager;
 use codex_core::auth::CLIENT_ID;
-use codex_core::config::Config;
 use codex_login::ServerOptions;
 use codex_login::ShutdownHandle;
 use codex_login::run_login_server;
@@ -114,7 +113,6 @@ pub(crate) struct AuthModeWidget {
     pub login_status: LoginStatus,
     pub preferred_auth_method: AuthMode,
     pub auth_manager: Arc<AuthManager>,
-    pub config: Config,
 }
 
 impl AuthModeWidget {
@@ -316,11 +314,7 @@ impl AuthModeWidget {
         }
 
         self.error = None;
-        let opts = ServerOptions::new(
-            self.codex_home.clone(),
-            CLIENT_ID.to_string(),
-            self.config.responses_originator_header.clone(),
-        );
+        let opts = ServerOptions::new(self.codex_home.clone(), CLIENT_ID.to_string());
         match run_login_server(opts) {
             Ok(child) => {
                 let sign_in_state = self.sign_in_state.clone();

codex-rs/tui/src/onboarding/onboarding_screen.rs

@@ -85,7 +85,6 @@ impl OnboardingScreen {
                 login_status,
                 auth_manager,
                 preferred_auth_method,
-                config,
             }))
         }
         let is_git_repo = get_git_repo_root(&cwd).is_some();

codex-rs/tui/src/updates.rs

@@ -24,9 +24,8 @@ pub fn get_upgrade_version(config: &Config) -> Option<String> {
         // Refresh the cached latest version in the background so TUI startup
         // isn’t blocked by a network call. The UI reads the previously cached
         // value (if any) for this run; the next run shows the banner if needed.
-        let originator = config.responses_originator_header.clone();
         tokio::spawn(async move {
-            check_for_update(&version_file, &originator)
+            check_for_update(&version_file)
                 .await
                 .inspect_err(|e| tracing::error!("Failed to update version: {e}"))
         });
@@ -65,10 +64,10 @@ fn read_version_info(version_file: &Path) -> anyhow::Result<VersionInfo> {
     Ok(serde_json::from_str(&contents)?)
 }
 
-async fn check_for_update(version_file: &Path, originator: &str) -> anyhow::Result<()> {
+async fn check_for_update(version_file: &Path) -> anyhow::Result<()> {
     let ReleaseInfo {
         tag_name: latest_tag_name,
-    } = create_client(originator)
+    } = create_client()
         .get(LATEST_RELEASE_URL)
         .send()
         .await?