fix(codex): preserve pre-provenance auth refreshes

src/main/codex-accounts/runtime-home-service.test.ts

@@ -3765,7 +3765,7 @@ describe('CodexRuntimeHomeService', () => {
     ).toEqual({ authJson: refreshedAuth })
   })
 
-  it('reads back system-default token refreshes after restart when the snapshot proves the baseline', async () => {
+  it('reads back system-default token refreshes after a pre-provenance restart', async () => {
     const runtimeAuthPath = getRuntimeCodexAuthPath()
     const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system-old')
     const refreshedAuth = createCodexAuthJson(
@@ -3780,6 +3780,7 @@ describe('CodexRuntimeHomeService', () => {
     new CodexRuntimeHomeService(store as never)
 
     writeFileSync(runtimeAuthPath, refreshedAuth, 'utf-8')
+    rmSync(getSharedRuntimeAuthProvenancePath())
     const restartedService = new CodexRuntimeHomeService(store as never)
     restartedService.syncForCurrentSelection()
 
@@ -3917,6 +3918,24 @@ describe('CodexRuntimeHomeService', () => {
     ).toBe(true)
   })
 
+  it('clears refreshed runtime auth after a pre-provenance external logout', async () => {
+    const runtimeAuthPath = getRuntimeCodexAuthPath()
+    const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system')
+    const refreshedAuth = createCodexAuthJson('system@example.com', 'acct-system', 'refreshed')
+    writeFileSync(getSystemCodexAuthPath(), systemAuth, 'utf-8')
+    const store = createStore(createSettings())
+
+    const { CodexRuntimeHomeService } = await import('./runtime-home-service')
+    new CodexRuntimeHomeService(store as never)
+
+    writeFileSync(runtimeAuthPath, refreshedAuth, 'utf-8')
+    rmSync(getSharedRuntimeAuthProvenancePath())
+    rmSync(getSystemCodexAuthPath())
+    new CodexRuntimeHomeService(store as never)
+
+    expect(existsSync(runtimeAuthPath)).toBe(false)
+  })
+
   it('persists runtime auth refreshes after returning to system default', async () => {
     const runtimeAuthPath = getRuntimeCodexAuthPath()
     const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system')

src/main/codex-accounts/runtime-home-service.ts

@@ -1593,6 +1593,9 @@ export class CodexRuntimeHomeService {
         return
       }
       const snapshot = this.readSystemDefaultSnapshot(this.getSystemDefaultSnapshotPath())
+      const systemDefaultOwnershipProven =
+        provenance?.owner === 'system-default' ||
+        (provenanceStatus.kind === 'missing' && snapshot !== null)
       const mirroredSystemDefaultAuth =
         provenance?.owner === 'system-default'
           ? provenance.authJson
@@ -1605,7 +1608,7 @@ export class CodexRuntimeHomeService {
           return
         }
         if (
-          provenance?.owner === 'system-default' &&
+          systemDefaultOwnershipProven &&
           mirroredSystemDefaultAuth !== null &&
           this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, mirroredSystemDefaultAuth)
         ) {
@@ -1619,7 +1622,7 @@ export class CodexRuntimeHomeService {
         return
       }
       if (
-        provenance?.owner === 'system-default' &&
+        systemDefaultOwnershipProven &&
         mirroredSystemDefaultAuth !== null &&
         systemDefaultAuth === mirroredSystemDefaultAuth &&
         this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, mirroredSystemDefaultAuth)