From 6cbed727a59eb91db6e2a2d6734e7aa76f44a601 Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:11:19 -0700
Subject: [PATCH] fix(codex): preserve pre-provenance auth refreshes

---
 .../runtime-home-service.test.ts              | 21 ++++++++++++++++++-
 .../codex-accounts/runtime-home-service.ts    |  7 +++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/main/codex-accounts/runtime-home-service.test.ts b/src/main/codex-accounts/runtime-home-service.test.ts
index e669fc94413..222e0d176e2 100644
--- a/src/main/codex-accounts/runtime-home-service.test.ts
+++ b/src/main/codex-accounts/runtime-home-service.test.ts
@@ -3765,7 +3765,7 @@ describe('CodexRuntimeHomeService', () => {
     ).toEqual({ authJson: refreshedAuth })
   })
 
-  it('reads back system-default token refreshes after restart when the snapshot proves the baseline', async () => {
+  it('reads back system-default token refreshes after a pre-provenance restart', async () => {
     const runtimeAuthPath = getRuntimeCodexAuthPath()
     const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system-old')
     const refreshedAuth = createCodexAuthJson(
@@ -3780,6 +3780,7 @@ describe('CodexRuntimeHomeService', () => {
     new CodexRuntimeHomeService(store as never)
 
     writeFileSync(runtimeAuthPath, refreshedAuth, 'utf-8')
+    rmSync(getSharedRuntimeAuthProvenancePath())
     const restartedService = new CodexRuntimeHomeService(store as never)
     restartedService.syncForCurrentSelection()
 
@@ -3917,6 +3918,24 @@ describe('CodexRuntimeHomeService', () => {
     ).toBe(true)
   })
 
+  it('clears refreshed runtime auth after a pre-provenance external logout', async () => {
+    const runtimeAuthPath = getRuntimeCodexAuthPath()
+    const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system')
+    const refreshedAuth = createCodexAuthJson('system@example.com', 'acct-system', 'refreshed')
+    writeFileSync(getSystemCodexAuthPath(), systemAuth, 'utf-8')
+    const store = createStore(createSettings())
+
+    const { CodexRuntimeHomeService } = await import('./runtime-home-service')
+    new CodexRuntimeHomeService(store as never)
+
+    writeFileSync(runtimeAuthPath, refreshedAuth, 'utf-8')
+    rmSync(getSharedRuntimeAuthProvenancePath())
+    rmSync(getSystemCodexAuthPath())
+    new CodexRuntimeHomeService(store as never)
+
+    expect(existsSync(runtimeAuthPath)).toBe(false)
+  })
+
   it('persists runtime auth refreshes after returning to system default', async () => {
     const runtimeAuthPath = getRuntimeCodexAuthPath()
     const systemAuth = createCodexAuthJson('system@example.com', 'acct-system', 'system')
diff --git a/src/main/codex-accounts/runtime-home-service.ts b/src/main/codex-accounts/runtime-home-service.ts
index 1b44ef33689..2e7df680619 100644
--- a/src/main/codex-accounts/runtime-home-service.ts
+++ b/src/main/codex-accounts/runtime-home-service.ts
@@ -1593,6 +1593,9 @@ export class CodexRuntimeHomeService {
         return
       }
       const snapshot = this.readSystemDefaultSnapshot(this.getSystemDefaultSnapshotPath())
+      const systemDefaultOwnershipProven =
+        provenance?.owner === 'system-default' ||
+        (provenanceStatus.kind === 'missing' && snapshot !== null)
       const mirroredSystemDefaultAuth =
         provenance?.owner === 'system-default'
           ? provenance.authJson
@@ -1605,7 +1608,7 @@ export class CodexRuntimeHomeService {
           return
         }
         if (
-          provenance?.owner === 'system-default' &&
+          systemDefaultOwnershipProven &&
           mirroredSystemDefaultAuth !== null &&
           this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, mirroredSystemDefaultAuth)
         ) {
@@ -1619,7 +1622,7 @@ export class CodexRuntimeHomeService {
         return
       }
       if (
-        provenance?.owner === 'system-default' &&
+        systemDefaultOwnershipProven &&
         mirroredSystemDefaultAuth !== null &&
         systemDefaultAuth === mirroredSystemDefaultAuth &&
         this.runtimeAuthMatchesSystemDefaultIdentity(runtimeAuth, mirroredSystemDefaultAuth)