fix(codex): correct managed auth checks and browser login completion

[morluto]

Summary

Fixes #479.

Corrects RepoPrompt's Codex managed-auth state handling so connection checks no longer invalidate otherwise usable sessions, and browser login cannot report success before OAuth actually completes.

Changes

• Use passive account/read(refreshToken: false) for Test Connection and cached connection-status checks.
• Preserve forced token refresh for genuine authentication recovery.
• Keep passive checks and forced refreshes in separate single-flight tasks.
• Require browser login to receive a successful account/login/completed notification matching the returned loginId.
• Verify the account passively after the matching completion notification.
• Ignore missing, stale, or mismatched login-completion notifications.
• Remove the implicit account/logout fallback when external authentication is active.
• Add focused regression coverage for the managed-auth state machine.
• Stabilize two existing prompt preassembly synchronization tests discovered during PR-ready validation.
• Reconcile the affected test contract ledger entries.

User impact

Previously, a user could see this sequence:

1. Codex CLI remained usable with its current access token.
2. RepoPrompt's Test Connection forced refresh.
3. A stale or reused refresh token failed with 401 refresh_token_reused.
4. RepoPrompt incorrectly appeared disconnected.
5. Login with ChatGPT opened a browser flow.
6. RepoPrompt saw the pre-existing account and reported success before the new OAuth flow completed.

After this change:

• status checks do not force token rotation;
• refresh failures are not confused with passive account presence;
• browser login only succeeds after the correlated OAuth completion;
• RepoPrompt does not silently logout shared terminal Codex authentication.

Validation

• CodexManagedAuthRecoveryServiceTests: 7 passed
• PromptContextPreAssemblyServiceTests: 16 passed
• Full coordinated root test suite: passed
• SwiftFormat and SwiftLint strict: passed
• RepoPrompt product build: passed
• Test contract ledger verification: 3,155 tests reconciled
• Repository guardrails and secret scans: passed

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[baron]

Exact head 5530d1de92cd2357a5c47dda15ffabe9b20acd8c conflicts with the current managed-auth authority. The PR's plain recovered/authenticated results and three-task model predate current account projection, logout, device-code, mutation-generation fencing, and richer cancellation state. Please deliberately port the passive account/read(refreshToken:false) and correlated login-completion behavior while preserving those current semantics, drop obsolete ledger edits, update call sites, and rerun focused auth plus exact-head CI.

[baron]

Blocking on rewritten head 2af1613d9a0726061e4b0bc2797281347c876a58.

The passive account-read direction has merit, but the exact head does not compile: CodexManagedAuthRecoveryServiceTests.swift:674 places await inside XCTAssertEqual's non-async autoclosure. Style also fails. Please evaluate the async value before the assertion, cover interaction between the new inFlightCheck and login/refresh ownership, then rerun the full exact-head lanes.

[morluto]

Audit disposition — authentication concurrency blocker (2026-08-14)

Passive account checks and forced refreshes use separate in-flight tasks. Because the actor is reentrant across awaits, they can overlap and publish in completion order rather than authority order; a slower passive check can overwrite the result of a successful forced refresh.

Please place both operations behind one publication generation/authentication lane and add deterministic tests for both completion orders. Also distinguish a transient passive transport failure from an authenticated-state transition: “unable to determine” should not clear a known-good account or automatically become “user must log in.” The OAuth completion correlation work is good, but I would not merge with this remaining state race.

[morluto]

Deep-review assessment — 2026-08-14

Disposition: block pending unified auth publication fencing. Separating passive checks from forced refresh is correct at the RPC level, but the two operations have independent in-flight tasks. Because the actor is reentrant across await, a passive check and forced refresh can overlap; whichever completes last calls applyRefreshResult and can overwrite a newer successful refresh with stale/weaker state.

Please put check/refresh/login/logout behind one authentication operation generation or one publication lane, and test both completion orders for simultaneous passive check + forced refresh. Also distinguish transient passive transport failure from confirmed sign-out: an inability to determine account state should not clear a known-good snapshot or automatically become “user must log in.”