fix: preserve Codex reset windows across account refresh

[steipete]

Summary

• Preserve Codex account reset-window history across managed-account auth refreshes and dashboard identity cleanup.
• Hydrate startup account snapshots from live managed auth state so cached reset windows do not disappear after auth.json rotates.
• Stabilize the login-shell cache retry regression test that became flaky in the full suite.

Fixes #1283.

Proof

• make check
• swift test --filter PathBuilderTests
• swift test
• /Users/steipete/Projects/agent-scripts/skills/autoreview/scripts/autoreview --mode branch --base origin/main

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 7, 2026, 8:36 AM ET / 12:36 UTC.

Summary
The branch adds Codex auth-fingerprint-aware refresh guards, preserves/reset-backfills Codex reset-window state across account refreshes, hydrates startup account snapshots from fresh managed auth state, and stabilizes the login-shell cache retry test.

Reproducibility: Source-reproducible but not live-reproduced here: current main keys reset backfill to the last Codex guard without the PR's fresh auth-fingerprint guard matrix, and the PR adds tests that model token/fingerprint rotation.

Review metrics: 2 noteworthy metrics.

• Diff surface: 14 files: 7 source, 7 test. The source changes are matched by a similarly sized test surface, which matters because this is auth/account-state logic.
• New regression files: 3 added test files. The branch adds dedicated coverage for auth fingerprint application, email-only history backfill, and account refresh projection.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] This PR changes Codex auth-fingerprint guard matching and stale-result application for usage, credits, dashboard, and stacked account refresh; a bad match would suppress or mis-associate state in multi-account setups even if ordinary tests pass.

Maintainer options:

1. Merge after auth-state checks (recommended)
   Accept the remaining provider/session-state risk if the required checks and listed Codex account-state test coverage stay green for this head.
2. Ask for live rotation proof
   Pause for a short redacted local run only if maintainers want runtime confidence across real managed-account token rotation before merging.

Next step before merge

• No ClawSweeper repair lane is needed because no narrow actionable patch defect was found; this should continue through normal maintainer review and checks.

Security
Cleared: No concrete security or supply-chain concern was found; the diff changes local Codex account-state guards and tests without adding dependencies, scripts, permissions, or raw secret persistence.

Review details

Best possible solution:

Land the auth-fingerprint-aware guard and reset-backfill fix once the focused Codex account-state tests and required checks are green, preserving provider data isolation across token rotations.

Do we have a high-confidence way to reproduce the issue?

Source-reproducible but not live-reproduced here: current main keys reset backfill to the last Codex guard without the PR's fresh auth-fingerprint guard matrix, and the PR adds tests that model token/fingerprint rotation.

Is this the best way to solve the issue?

Yes. The proposed path is a narrow maintainable fix around existing Codex guard and backfill seams, with focused tests for the auth-rotation cases rather than a new setting or provider mode.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against b44218352c43.

Label changes

Label changes:

• add P2: The PR addresses a normal-priority Codex multi-account reset-window correctness issue with limited provider scope.
• add merge-risk: 🚨 session-state: The diff changes how cached Codex reset-window and selected-account state survives or is discarded during account refresh.
• add merge-risk: 🚨 auth-provider: The diff changes Codex auth-fingerprint matching and refresh-guard application for managed and live Codex accounts.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is authored by the repository owner, so the external-contributor real behavior proof gate does not apply.

Label justifications:

• P2: The PR addresses a normal-priority Codex multi-account reset-window correctness issue with limited provider scope.
• merge-risk: 🚨 auth-provider: The diff changes Codex auth-fingerprint matching and refresh-guard application for managed and live Codex accounts.
• merge-risk: 🚨 session-state: The diff changes how cached Codex reset-window and selected-account state survives or is discarded during account refresh.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is authored by the repository owner, so the external-contributor real behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully and its Codex provider/test guidance applies: prefer focused parser/provider tests and avoid live provider or Keychain-prompt validation during review. (AGENTS.md:1, b44218352c43)
• Protected maintainer authorship: The GitHub context reports the PR author association as OWNER, which means ClawSweeper cleanup should keep this PR open for explicit maintainer handling.
• Guard implementation: The PR head adds auth fingerprints to CodexAccountScopedRefreshGuard and introduces fresh guard helpers that invalidate the reconciliation cache before account-scoped decisions. (Sources/CodexBar/Providers/Codex/UsageStore+CodexAccountState.swift:12, ca5ebd8d68ec)
• Reset backfill path: The PR head changes provider refresh to backfill Codex reset times only from a last-known reset snapshot matching the captured Codex guard. (Sources/CodexBar/UsageStore+Refresh.swift:108, ca5ebd8d68ec)
• Current-main provenance: Current main already has recent Codex reset-backfill/auth-fingerprint work in the same area, showing this PR is follow-up hardening rather than unrelated churn. (Sources/CodexBar/UsageStore+TokenAccounts.swift:468, 52d09da38bfe)
• Feature history: The core Codex account refresh guard was introduced in the latest release commit and recently extended by the same area work. (Sources/CodexBar/Providers/Codex/UsageStore+CodexAccountState.swift:12, 723734ef3422)

Likely related people:

• steipete: Git blame/log show Peter Steinberger introduced the Codex account refresh guard and carried the recent reset-backfill/auth-fingerprint work across the central files. (role: feature-history owner and recent area contributor; confidence: high; commits: 723734ef3422, fa8d8f636266, 52d09da38bfe; files: Sources/CodexBar/Providers/Codex/UsageStore+CodexAccountState.swift, Sources/CodexBar/UsageStore+TokenAccounts.swift, Sources/CodexBar/UsageStore+Refresh.swift)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed in db184430bc4bc7869f597ff7a46236db54126d52.

Validation:

• Local make check: SwiftFormat clean, SwiftLint 0 violations across 1017 files.
• Local swift test --filter PathBuilderTests: 37 tests passed.
• Local full swift test: 3369 tests in 389 suites passed.
• Autoreview: /Users/steipete/Projects/agent-scripts/skills/autoreview/scripts/autoreview --mode branch --base origin/main reported no accepted/actionable findings.
• GitHub PR CI run 27092650010: lint-build-test, build-linux-cli (linux-x64, ubuntu-24.04), build-linux-cli (linux-arm64, ubuntu-24.04-arm), and GitGuardian all passed before merge.

Caveat: the duplicate push-triggered macOS lint-build-test was still running when GitHub allowed the PR merge; the PR-triggered required run was green.