fix(codex): prefer ambient account after reauthentication

[Finesssee]

Canonical same-repository rehost of #475 from stephanus-tantiono/Win-CodexBar.

This branch carries the repaired Codex ambient reauthentication flow at 867422f. The persisted Ambient record is selected before identity-only fallback, including when Managed and Ambient records share an identity; regression coverage protects that precedence.

Original PR: #475
Original repaired head: eaaa752
Canonical head: 867422f

Summary by CodeRabbit

• New Features

  • Added a “Refresh login” action for the ambient Codex account in provider settings.
  • Refreshing login now updates the account details and usage information.
  • Added guidance that running sessions may need to be restarted after switching accounts.

• Bug Fixes

  • Improved credential refresh reliability when reauthenticating an account.

• Tests

  • Added coverage for the refresh-login control and updated account usage data.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 751ad83d-db07-46c9-a9b3-a7f9f91f3fa4

📥 Commits

Reviewing files that changed from the base of the PR and between f650147 and 867422f.

📒 Files selected for processing (9)

• apps/desktop-tauri/src-tauri/src/commands/codex_accounts.rs
• apps/desktop-tauri/src-tauri/src/main.rs
• apps/desktop-tauri/src/i18n/keys.ts
• apps/desktop-tauri/src/lib/tauri.ts
• apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.test.tsx
• apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.tsx
• rust/src/codex_accounts/account_manager.rs
• rust/src/locale.rs
• rust/src/locale/en-US.ftl

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

Adds ambient Codex account reauthentication. The flow updates persisted account data, refreshes provider usage, exposes a settings button, registers a Tauri command, and adds locale support and tests.

Changes

Codex account reauthentication

Layer / File(s)	Summary
Backend reauthentication and account reconciliation apps/desktop-tauri/src-tauri/src/commands/codex_accounts.rs, apps/desktop-tauri/src-tauri/src/main.rs, rust/src/codex_accounts/account_manager.rs	The new command reauthenticates the ambient account, reconciles persisted accounts, returns the canonical record, invalidates usage, emits provider updates, and starts a provider refresh. Credential replacement now uses the shared write lock. Tests cover ambient selection and canonical account reconciliation.
Settings control and locale integration apps/desktop-tauri/src/lib/tauri.ts, apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/*, apps/desktop-tauri/src/i18n/keys.ts, rust/src/locale.rs, rust/src/locale/en-US.ftl	The settings UI adds a reauthentication action for the ambient account. The bridge, locale keys, English strings, and component tests support the new action and refreshed account usage state.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant SettingsUI
  participant TauriBridge
  participant codex_account_reauthenticate
  participant AccountManager
  SettingsUI->>TauriBridge: invoke codexAccountReauthenticate
  TauriBridge->>codex_account_reauthenticate: invoke command
  codex_account_reauthenticate->>AccountManager: reauthenticate ambient account
  AccountManager-->>codex_account_reauthenticate: authenticated account
  codex_account_reauthenticate->>codex_account_reauthenticate: refresh persisted accounts
  codex_account_reauthenticate-->>TauriBridge: canonical persisted account
  TauriBridge-->>SettingsUI: reload account and usage state

Loading

Suggested reviewers: xuelongmu

Merge Risk: ⚪ Minimal · up to 86742

Ambient Codex login refresh is wired through the desktop app and preserves the reconciled persisted account selection. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 78.26% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 8 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preferring the ambient account after Codex reauthentication.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 78.26% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 8 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codex-ambient-reauth-button

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}