fix(codex-auth): harden profile review findings

tests/unit/codex-auth/commands/create-command.test.ts

@@ -34,6 +34,12 @@ async function makeCtx() {
   return { registry: reg, version: '0.0.0-test' };
 }
 
+function buildToken(payload: Record<string, unknown>): string {
+  const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+  const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+  return `${header}.${body}.fakesig`;
+}
+
 /** Suppress console output during test. */
 function silenceConsole(): () => void {
   const origLog = console.log;
@@ -306,4 +312,54 @@ describe('handleCreateCodex — auto-spawn login (D11)', () => {
     expect(fs.existsSync(profileDir)).toBe(true);
     expect(ctx.registry.hasProfile('faillogin')).toBe(true);
   });
+
+  it('persists last_used and account_id when login token has account_id only', async () => {
+    const detectorMod = await import('../../../../src/targets/codex-detector');
+    spyOn(detectorMod, 'detectCodexCli').mockReturnValue('/usr/bin/codex');
+
+    spyOn(childProcess, 'spawn').mockImplementation(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (_cmd: string, _args: string[], opts: any) => {
+        const dir = (opts?.env?.CODEX_HOME as string) ?? '';
+        if (dir) {
+          fs.mkdirSync(dir, { recursive: true });
+          fs.writeFileSync(
+            path.join(dir, 'auth.json'),
+            JSON.stringify({
+              tokens: {
+                id_token: buildToken({
+                  'https://api.openai.com/auth': {
+                    chatgpt_account_id: 'acct-account-only',
+                  },
+                }),
+              },
+            })
+          );
+        }
+        const ee = {
+          on: (evt: string, cb: (n: number) => void) => {
+            if (evt === 'exit') setImmediate(() => cb(0));
+            return ee;
+          },
+        };
+        return ee as ReturnType<typeof childProcess.spawn>;
+      }
+    );
+
+    const { handleCreateCodex } = await import(
+      '../../../../src/codex-auth/commands/create-command'
+    );
+    const ctx = await makeCtx();
+
+    const restore = silenceConsole();
+    try {
+      await handleCreateCodex(ctx, ['accountonly']);
+    } finally {
+      restore();
+    }
+
+    const meta = ctx.registry.getProfile('accountonly');
+    expect(meta.last_used).toBeTruthy();
+    expect(meta.account_id).toBe('acct-account-only');
+  });
 });

tests/unit/codex-auth/commands/import-default-command.test.ts

@@ -327,6 +327,64 @@ describe('import-default — torn-write retry', () => {
     expect(exitCalled).toBe(true);
     expect(ctx.registry.hasProfile('torntest')).toBe(false);
   });
+
+  it('rejects a malformed 3-segment id_token payload', async () => {
+    const authPath = path.join(legacyCodexHome, 'auth.json');
+    fs.writeFileSync(authPath, JSON.stringify({ tokens: { id_token: 'header.not-json.sig' } }));
+
+    const { handleImportDefaultCodex } = await import(
+      '../../../../src/codex-auth/commands/import-default-command'
+    );
+    const ctx = await makeCtx();
+
+    let exitCalled = false;
+    const origExit = process.exit;
+    process.exit = () => {
+      exitCalled = true;
+      throw new Error('exit');
+    };
+    const restore = silenceConsole();
+    try {
+      await handleImportDefaultCodex(ctx, ['badjwt']);
+    } catch {
+      /* expected */
+    } finally {
+      restore();
+      process.exit = origExit;
+    }
+
+    expect(exitCalled).toBe(true);
+    expect(ctx.registry.hasProfile('badjwt')).toBe(false);
+  });
+
+  it('rejects an id_token payload with invalid base64url characters', async () => {
+    const authPath = path.join(legacyCodexHome, 'auth.json');
+    fs.writeFileSync(authPath, JSON.stringify({ tokens: { id_token: 'h.e30$.s' } }));
+
+    const { handleImportDefaultCodex } = await import(
+      '../../../../src/codex-auth/commands/import-default-command'
+    );
+    const ctx = await makeCtx();
+
+    let exitCalled = false;
+    const origExit = process.exit;
+    process.exit = () => {
+      exitCalled = true;
+      throw new Error('exit');
+    };
+    const restore = silenceConsole();
+    try {
+      await handleImportDefaultCodex(ctx, ['bad-base64url']);
+    } catch {
+      /* expected */
+    } finally {
+      restore();
+      process.exit = origExit;
+    }
+
+    expect(exitCalled).toBe(true);
+    expect(ctx.registry.hasProfile('bad-base64url')).toBe(false);
+  });
 });
 
 describe('import-default — Codex running detection', () => {

tests/unit/codex-auth/commands/remove-command.test.ts

@@ -191,4 +191,82 @@ describe('handleRemoveCodex — confirmation', () => {
     expect(promptCalled).toBe(false);
     expect(ctx.registry.hasProfile('skipconfirm')).toBe(false);
   });
+
+  it('preserves profile data when registry removal fails', async () => {
+    const { handleRemoveCodex } = await import(
+      '../../../../src/codex-auth/commands/remove-command'
+    );
+    const ctx = await makeCtx('preserveme');
+    const profileDir = path.join(ccsHome, '.ccs', 'codex-instances', 'preserveme');
+    const authJsonPath = path.join(profileDir, 'auth.json');
+    fs.writeFileSync(authJsonPath, JSON.stringify({ tokens: { id_token: 'h.e30K.s' } }));
+
+    spyOn(ctx.registry, 'removeProfile').mockImplementation(() => {
+      throw new Error('registry write denied');
+    });
+
+    let exitCode = -1;
+    const origExit = process.exit;
+    const origErr = console.error;
+    process.exit = (code?: number) => {
+      exitCode = code ?? 0;
+      throw new Error('exit');
+    };
+    console.error = () => {};
+
+    try {
+      await handleRemoveCodex(ctx, ['preserveme', '--yes']);
+    } catch {
+      /* process.exit */
+    } finally {
+      process.exit = origExit;
+      console.error = origErr;
+    }
+
+    expect(exitCode).toBeGreaterThan(0);
+    expect(fs.existsSync(authJsonPath)).toBe(true);
+    expect(ctx.registry.hasProfile('preserveme')).toBe(true);
+  });
+
+  it('restores profile data and registry when final deletion fails', async () => {
+    const { handleRemoveCodex } = await import(
+      '../../../../src/codex-auth/commands/remove-command'
+    );
+    const ctx = await makeCtx('restoreme');
+    ctx.registry.setDefault('restoreme');
+    const profileDir = path.join(ccsHome, '.ccs', 'codex-instances', 'restoreme');
+    const authJsonPath = path.join(profileDir, 'auth.json');
+    fs.writeFileSync(authJsonPath, JSON.stringify({ tokens: { id_token: 'h.e30K.s' } }));
+
+    const realRmSync = fs.rmSync;
+    spyOn(fs, 'rmSync').mockImplementation((target, options) => {
+      if (typeof target === 'string' && target.includes('.deleting.')) {
+        throw new Error('delete denied');
+      }
+      return realRmSync(target, options);
+    });
+
+    let exitCode = -1;
+    const origExit = process.exit;
+    const origErr = console.error;
+    process.exit = (code?: number) => {
+      exitCode = code ?? 0;
+      throw new Error('exit');
+    };
+    console.error = () => {};
+
+    try {
+      await handleRemoveCodex(ctx, ['restoreme', '--yes']);
+    } catch {
+      /* process.exit */
+    } finally {
+      process.exit = origExit;
+      console.error = origErr;
+    }
+
+    expect(exitCode).toBeGreaterThan(0);
+    expect(fs.existsSync(authJsonPath)).toBe(true);
+    expect(ctx.registry.hasProfile('restoreme')).toBe(true);
+    expect(ctx.registry.getDefault()).toBe('restoreme');
+  });
 });

tests/unit/codex-auth/commands/use-command.test.ts

@@ -143,12 +143,12 @@ describe('handleUseCodex — shell syntax', () => {
     expect(stdout).toContain('$env:CCS_CODEX_PROFILE');
   });
 
-  it('cmd: set KEY=value (no quotes)', async () => {
+  it('cmd: quoted set assignment syntax', async () => {
     const { handleUseCodex } = await import('../../../../src/codex-auth/commands/use-command');
     const ctx = await makeCtxWithProfile('work');
     const { stdout } = await captureStreams(() => handleUseCodex(ctx, ['work', '--shell', 'cmd']));
-    expect(stdout).toContain('set CODEX_HOME=');
-    expect(stdout).toContain('set CCS_CODEX_PROFILE=work');
+    expect(stdout).toContain('set "CODEX_HOME=');
+    expect(stdout).toContain('set "CCS_CODEX_PROFILE=work"');
   });
 
   it('invalid --shell value → stderr error, empty stdout', async () => {