[apps] Fix apps enablement condition. (#14011)

- [x] Fix apps enablement condition to check both the feature flag and
that the user is not an API key user.

codex-rs/core/tests/suite/client.rs

@@ -921,7 +921,7 @@ async fn includes_user_instructions_message_in_request() {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn includes_apps_guidance_as_developer_message_when_enabled() {
+async fn includes_apps_guidance_as_developer_message_for_chatgpt_auth() {
     skip_if_no_network!();
     let server = MockServer::start().await;
     let apps_server = AppsTestServer::mount(&server)
@@ -936,7 +936,7 @@ async fn includes_apps_guidance_as_developer_message_when_enabled() {
     .await;
 
     let mut builder = test_codex()
-        .with_auth(CodexAuth::from_api_key("Test API Key"))
+        .with_auth(create_dummy_codex_auth())
         .with_config(move |config| {
             config
                 .features
@@ -1011,6 +1011,76 @@ async fn includes_apps_guidance_as_developer_message_when_enabled() {
     );
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn omits_apps_guidance_for_api_key_auth_even_when_feature_enabled() {
+    skip_if_no_network!();
+    let server = MockServer::start().await;
+    let apps_server = AppsTestServer::mount(&server)
+        .await
+        .expect("mount apps MCP mock");
+    let apps_base_url = apps_server.chatgpt_base_url.clone();
+
+    let resp_mock = mount_sse_once(
+        &server,
+        sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
+    )
+    .await;
+
+    let mut builder = test_codex()
+        .with_auth(CodexAuth::from_api_key("Test API Key"))
+        .with_config(move |config| {
+            config
+                .features
+                .enable(Feature::Apps)
+                .expect("test config should allow feature update");
+            config
+                .features
+                .disable(Feature::AppsMcpGateway)
+                .expect("test config should allow feature update");
+            config.chatgpt_base_url = apps_base_url;
+        });
+    let codex = builder
+        .build(&server)
+        .await
+        .expect("create new conversation")
+        .codex;
+
+    codex
+        .submit(Op::UserInput {
+            items: vec![UserInput::Text {
+                text: "hello".into(),
+                text_elements: Vec::new(),
+            }],
+            final_output_json_schema: None,
+        })
+        .await
+        .unwrap();
+
+    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
+
+    let request = resp_mock.single_request();
+    let request_body = request.body_json();
+    let input = request_body["input"].as_array().expect("input array");
+    let apps_snippet = "Apps are mentioned in the prompt in the format";
+
+    let has_apps_guidance = input.iter().any(|item| {
+        item.get("content")
+            .and_then(|value| value.as_array())
+            .is_some_and(|content| {
+                content.iter().any(|entry| {
+                    entry
+                        .get("text")
+                        .and_then(|value| value.as_str())
+                        .is_some_and(|text| text.contains(apps_snippet))
+                })
+            })
+    });
+    assert!(
+        !has_apps_guidance,
+        "did not expect apps guidance for API key auth, got {input:#?}"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn skills_append_to_instructions() {
     skip_if_no_network!();

codex-rs/core/tests/suite/plugins.rs

@@ -114,7 +114,7 @@ async fn build_apps_enabled_plugin_test_codex(
 ) -> Result<Arc<codex_core::CodexThread>> {
     let mut builder = test_codex()
         .with_home(codex_home)
-        .with_auth(CodexAuth::from_api_key("Test API Key"))
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
         .with_config(move |config| {
             config
                 .features

codex-rs/core/tests/suite/search_tool.rs

@@ -5,6 +5,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use anyhow::Result;
+use codex_core::CodexAuth;
 use codex_core::CodexThread;
 use codex_core::NewThread;
 use codex_core::config::Config;
@@ -163,9 +164,11 @@ fn configure_apps_with_optional_rmcp(
 }
 
 fn configured_builder(apps_base_url: String, rmcp_server_bin: Option<String>) -> TestCodexBuilder {
-    test_codex().with_config(move |config| {
-        configure_apps_with_optional_rmcp(config, apps_base_url.as_str(), rmcp_server_bin);
-    })
+    test_codex()
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+        .with_config(move |config| {
+            configure_apps_with_optional_rmcp(config, apps_base_url.as_str(), rmcp_server_bin);
+        })
 }
 
 async fn submit_user_input(thread: &Arc<CodexThread>, text: &str) -> Result<()> {
@@ -218,6 +221,46 @@ async fn search_tool_flag_adds_tool() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn search_tool_flag_adds_tool_for_api_key_auth() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let apps_server = AppsTestServer::mount(&server).await?;
+    let mock = mount_sse_once(
+        &server,
+        sse(vec![
+            ev_response_created("resp-1"),
+            ev_assistant_message("msg-1", "done"),
+            ev_completed("resp-1"),
+        ]),
+    )
+    .await;
+
+    let mut builder = test_codex()
+        .with_auth(CodexAuth::from_api_key("Test API Key"))
+        .with_config(move |config| {
+            configure_apps_with_optional_rmcp(config, apps_server.chatgpt_base_url.as_str(), None);
+        });
+    let test = builder.build(&server).await?;
+
+    test.submit_turn_with_policies(
+        "list tools",
+        AskForApproval::Never,
+        SandboxPolicy::DangerFullAccess,
+    )
+    .await?;
+
+    let body = mock.single_request().body_json();
+    let tools = tool_names(&body);
+    assert!(
+        tools.iter().any(|name| name == SEARCH_TOOL_BM25_TOOL_NAME),
+        "tools list should include {SEARCH_TOOL_BM25_TOOL_NAME} for API key auth when Apps is enabled: {tools:?}"
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn search_tool_adds_discovery_instructions_to_tool_description() -> Result<()> {
     skip_if_no_network!(Ok(()));