fix(daemon): update codex auth.json parsing to match actual file format

[AnnatarHe]

Summary

• Updated codexAuthJSON and token struct field mappings to match the actual Codex CLI auth.json format (tokens.access_token, tokens.account_id instead of tokenData.accessToken, tokenData.idTokenClaims.accountId)
• Removed the unnecessary codexIDTokenClaims struct since account_id is now a direct field in tokens
• Simplified loadCodexAuth() by removing the nested nil check for ID token claims

Test plan

• go test -run TestCodex ./daemon/ passes
• go vet ./daemon/ clean

🤖 Generated with Claude Code

---

[AnnatarHe]

@claude review it

[codecov]

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
daemon/codex_ratelimit.go	0.00%	3 Missing ⚠️

Flag	Coverage Δ
unittests	40.18% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
daemon/codex_ratelimit.go	28.30% <0.00%> (+0.77%)	⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request refactors the codexAuthJSON and codexTokenData structures to align with a new authentication schema and updates the loadCodexAuth function accordingly. Review feedback suggests removing unused fields such as LastRefresh and RefreshToken to improve robustness against format changes. Additionally, it is recommended to implement a fallback to the OpenAIAPIKey when tokens are missing to ensure the daemon remains functional regardless of the authentication method used.

[gemini-code-assist]

The LastRefresh field is currently unused and its string type is a potential point of failure if the JSON value is a number (e.g., a Unix timestamp), which is common for such fields. Similarly, IDToken and RefreshToken in codexTokenData are unused. It is generally safer to omit unused fields to make the parsing more robust against format changes or unexpected types.

[gemini-code-assist]

The current implementation returns errCodexAuthInvalid if tokens is missing, even if a valid OPENAI_API_KEY is present. Since the OpenAIAPIKey field was added to the struct, you can improve robustness by falling back to it when tokens are unavailable. This ensures the daemon works correctly regardless of whether the user authenticated via the web flow or an API key.

	if auth.Tokens != nil && auth.Tokens.AccessToken != "" {
		return &codexAuthData{
			AccessToken: auth.Tokens.AccessToken,
			AccountID:   auth.Tokens.AccountID,
		}, nil
	}

	if auth.OpenAIAPIKey != nil && *auth.OpenAIAPIKey != "" {
		return &codexAuthData{
			AccessToken: *auth.OpenAIAPIKey,
			AccountID:   "",
		}, nil
	}

	return nil, errCodexAuthInvalid

[claude]

Claude finished @AnnatarHe's task in 44s —— View job

---

Code Review

• Read changed file and gather context
• Review code changes
• Post review feedback

---

The core change — updating struct field mappings from tokenData.accessToken / tokenData.idTokenClaims.accountId to tokens.access_token / tokens.account_id — looks correct and simplifies the code nicely by removing the nested codexIDTokenClaims struct.

Issues / Suggestions:

1. Unused fields in structs (daemon/codex_ratelimit.go:62-70)
   LastRefresh, IDToken, and RefreshToken are declared but never read. They add surface area for parse failures (e.g. if last_refresh is a number instead of a string). I'd drop them unless you plan to use them soon.
   Fix this →

2. OpenAIAPIKey fallback (daemon/codex_ratelimit.go:153-155)
   loadCodexAuth returns errCodexAuthInvalid when tokens is nil, even if a valid OPENAI_API_KEY is present in the JSON. Since the struct already declares OpenAIAPIKey, consider falling back to it:

   if auth.Tokens != nil && auth.Tokens.AccessToken != "" {
       return &codexAuthData{
           AccessToken: auth.Tokens.AccessToken,
           AccountID:   auth.Tokens.AccountID,
       }, nil
   }
   if auth.OpenAIAPIKey != nil && *auth.OpenAIAPIKey != "" {
       return &codexAuthData{
           AccessToken: *auth.OpenAIAPIKey,
       }, nil
   }
   return nil, errCodexAuthInvalid

   This matches how Codex CLI itself supports both auth methods. If intentionally out of scope for this PR, a // TODO would be helpful.

3. No unit test for loadCodexAuth itself
   The existing tests mock loadCodexAuthFunc entirely. A test that writes a temp auth.json and calls the real loadCodexAuth would catch JSON tag mismatches — which is exactly the kind of bug this PR fixes. Consider adding one for both the tokens-based and OPENAI_API_KEY-based paths.

Looks good otherwise — the simplification is clean and the remaining logic is straightforward. The suggestions above are non-blocking improvements. Approving from a code quality perspective.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.