fix(codex-auth): surface registry corruption

tests/unit/codex-auth/codex-auth-dashboard-service.test.ts

@@ -115,6 +115,16 @@ describe('getCodexAuthProfilesSummary', () => {
     expect(result.default).toBeNull();
   });
 
+  it('throws instead of returning an empty list when registry YAML is malformed', async () => {
+    const { getCodexAuthProfilesSummary, invalidateCodexAuthProfilesCache } = await importService();
+    invalidateCodexAuthProfilesCache();
+
+    const registryPath = path.join(ccsDir, 'codex-profiles.yaml');
+    fs.writeFileSync(registryPath, '{ invalid: yaml: [', { mode: 0o600 });
+
+    await expect(getCodexAuthProfilesSummary()).rejects.toThrow(/could not be read safely/i);
+  });
+
   it('returns decoded email, plan, accountId for valid registry with 2 profiles', async () => {
     const { getCodexAuthProfilesSummary, invalidateCodexAuthProfilesCache } = await importService();
     invalidateCodexAuthProfilesCache();

tests/unit/codex-auth/codex-profile-registry.test.ts

@@ -127,6 +127,18 @@ describe('CodexProfileRegistry — remove', () => {
     reg.removeProfile('work');
     expect(reg.getDefault()).toBeNull();
   });
+
+  it('does not promote another profile when the default profile is removed', () => {
+    const reg = new CodexProfileRegistry(registryPath);
+    reg.createProfile('work');
+    reg.createProfile('personal');
+    reg.setDefault('work');
+
+    reg.removeProfile('work');
+
+    expect(reg.listProfiles()).toEqual(['personal']);
+    expect(reg.getDefault()).toBeNull();
+  });
 });
 
 describe('CodexProfileRegistry — default pointer', () => {