From b56cf80d186e6bd2176fec1554f1dc61626bf1d0 Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 17 Jul 2026 14:52:36 -0700
Subject: [PATCH] test(codex): fingerprint system auth in validation reports

---
 config/scripts/run-codex-real-account-validation.mjs  |  1 +
 .../run-codex-real-account-validation.test.mjs        | 11 +++++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/config/scripts/run-codex-real-account-validation.mjs b/config/scripts/run-codex-real-account-validation.mjs
index 65248e008e3..3b69b29e1fb 100644
--- a/config/scripts/run-codex-real-account-validation.mjs
+++ b/config/scripts/run-codex-real-account-validation.mjs
@@ -213,6 +213,7 @@ export async function snapshotValidationState(layout) {
   return {
     capturedAt: new Date().toISOString(),
     throwawayCodex: {
+      auth: await fingerprintFile(path.join(throwawayCodexHome, 'auth.json')),
       config: await fingerprintFile(path.join(throwawayCodexHome, 'config.toml')),
       hooks: await fingerprintFile(path.join(throwawayCodexHome, 'hooks.json'))
     },
diff --git a/config/scripts/run-codex-real-account-validation.test.mjs b/config/scripts/run-codex-real-account-validation.test.mjs
index 088faf9a3c8..429fe6125f8 100644
--- a/config/scripts/run-codex-real-account-validation.test.mjs
+++ b/config/scripts/run-codex-real-account-validation.test.mjs
@@ -42,18 +42,25 @@ describe('Codex real-account validation harness', () => {
     expect(env.SAFE_VALUE).toBe('preserved')
   })
 
-  it('records only a fingerprint for managed auth', async () => {
+  it('records only fingerprints for system-default and managed auth', async () => {
     const layout = await createValidationLayout({
       primaryHome: path.join(os.tmpdir(), 'orca-primary-home-sentinel')
     })
     cleanupPaths.push(layout.tempRoot)
+    const systemHome = path.join(layout.homeDir, '.codex')
     const managedHome = path.join(layout.userDataDir, 'codex-accounts', 'account-1', 'home')
-    await mkdir(managedHome, { recursive: true })
+    await Promise.all([
+      mkdir(systemHome, { recursive: true }),
+      mkdir(managedHome, { recursive: true })
+    ])
+    await writeFile(path.join(systemHome, 'auth.json'), '{"refresh_token":"system-secret"}\n')
     await writeFile(path.join(managedHome, 'auth.json'), '{"refresh_token":"never-report-me"}\n')
 
     const snapshot = await snapshotValidationState(layout)
 
+    expect(snapshot.throwawayCodex.auth.sha256).toMatch(/^[a-f0-9]{64}$/)
     expect(snapshot.managedHomes[0].auth.sha256).toMatch(/^[a-f0-9]{64}$/)
+    expect(JSON.stringify(snapshot)).not.toContain('system-secret')
     expect(JSON.stringify(snapshot)).not.toContain('never-report-me')
   })
 })