fix(codex): restart daemon after system account promotion

[steipete]

Switching CodexBar's System Account replaces auth.json, but an already-running Codex app-server daemon can retain the previous account. After a successful promotion, CodexBar now verifies the destination home's daemon PID, native app-server command, and home-scoped daemon version response, then runs codex app-server daemon restart with that home's CODEX_HOME.

Restart failures and older CLIs without daemon commands preserve the successful account switch and show a one-line recovery note in the menu/settings. No running daemon means no CLI invocation. Profile-home usage selection remains read-only. Nearby promotion cleanup removes redundant adapters, result wrappers, unused state, and duplicate auth preparation; production code decreases by 3 lines (161 added, 164 removed).

Thanks @massdo for isolating the persistent-daemon behavior. The installed CLI's read-only help reports 0.156.1; the PID/command/socket contract was also checked against upstream Codex 0.157.0 source. Verification used temporary homes and injected runners, with no real daemon restart or running-app relaunch.

Validation:

# Red before connecting the post-swap restart: 5 tests, 8 failed expectations.
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 swift test --jobs 4 --filter CodexAppServerDaemonTests

# Green: 448 tests in 23 suites passed, including daemon regressions,
# Codex account suites, ProviderArchitectureGatekeeperTests,
# and ProviderSettingsDescriptorTests.
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 swift test --jobs 4 --filter 'CodexAccount|CodexSystemPromotionUI|CodexSystemAccountPrivacyTests|CodexProfileHomeAccount|ManagedCodex|CodexVisibleAccount|CodexActiveSource|CodexAppServerDaemon|ProviderArchitectureGatekeeper|ProviderSettingsDescriptor'

make check
# Passed; SwiftLint: 0 violations, 0 serious in 2662 files.

git diff --check
# Passed.

The regression verifies both daemon PID filenames, exactly one restart for the correct home after auth publication, no command for absent/stale processes, rejection of another home or unmanaged server, and successful promotion plus a visible menu note for unsupported/failing commands. UI note publication is verified through the synthetic menu descriptor. Independent Codex review: scoped-clean at P0–P2.

Fixes #3990

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 25, 2026, 4:47 PM ET / 20:47 UTC.

ClawSweeper review

What this changes

After switching the Codex System Account, the branch checks for a managed background app-server in that Codex home, restarts it to reload authentication, and adds a recovery note when the command fails.

Merge readiness

⛔ Needs changes before merge - 2 items remain

This PR addresses a reproduced stale-daemon account mismatch that current main and v0.66.0 do not fix. One blocking edge remains: a stuck restart command can leave promotion waiting indefinitely, without showing the promised recovery note.

Priority: P1
Reviewed head: 501ea10ddd8ff17a9516d60ba2faa570fa41650e

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The repair is focused and has substantial tests, but the unbounded UI wait is a correctness blocker and the branch has no real after-fix daemon run.
Proof confidence	🦐 gold shrimp (3/6)	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate. The linked reporter proved that a manual daemon restart corrected the live mismatch, while this branch’s after-fix integration was exercised with synthetic homes and injected runners, not a real daemon; no stored data-model contract changes.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This owner-authored PR is exempt from the external-contributor proof gate. The linked reporter proved that a manual daemon restart corrected the live mismatch, while this branch’s after-fix integration was exercised with synthetic homes and injected runners, not a real daemon; no stored data-model contract changes.
Evidence reviewed	8 items	Current-main gap: The main-branch promotion path publishes live auth and refreshes CodexBar state without reconciling an existing app-server; the latest v0.66.0 release has the same reported behavior. Linked live reproduction: In #3990, the reporter observed Account A limits after switching to B and relaunching the CLI, then Account B limits after a manual daemon restart; the daemon also reported A while the credential file held B. Introduced restart path: The pinned PR delta awaits daemon verification and restart after publishing auth, then passes a recovery note to the menu and settings.
Findings	1 actionable finding	[P2] Bound the daemon restart wait before completing promotion
Security	None	None.

How this fits together

CodexBar copies a selected managed account’s credentials into the live Codex home when the user switches the System Account. A persistent Codex app-server can keep its earlier authentication state, which then affects CLI sessions that reconnect to it.

flowchart LR
A[System Account selection] --> B[Publish selected credentials]
B --> C[Check home daemon PID and process]
C --> D[Verify daemon socket and status]
D --> E[Restart managed daemon]
E --> F[CLI sessions use refreshed account]
D --> G[Show recovery note on failure]

Loading

Before merge

• Bound the daemon restart wait before completing promotion (P2) - runToCompletion waits for the CLI with an infinite timeout. If codex app-server daemon restart stalls, this awaited call never returns, so the System Account operation stays busy and the promised recovery note cannot appear. Bound the UI wait without cancelling a restart that has already launched, and cover that outcome with a hanging-runner test.
• Complete next step (P2) - Bound the awaited daemon restart and verify that a stuck CLI command leaves promotion with truthful, visible guidance before merge.

Findings

• [P2] Bound the daemon restart wait before completing promotion — Sources/CodexBar/CodexAppServerDaemon.swift:59-60

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Code size	production -3 lines, tests +125 lines	The branch offsets its new daemon integration with promotion cleanup and adds focused regression coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3990
Summary: The branch explicitly targets the linked, open stale-daemon account-switch report.

Members:

• canonical: Codex: System Account switch leaves /status showing previous account's limits after CLI restart (0.157.0) #3990 - The reporter reproduced persistent daemon authentication and confirmed that a manual daemon restart loads the selected account.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep the home-scoped daemon refresh, but give the menu operation a bounded, truthful pending or failure state while allowing an already-launched restart to finish safely.

Do we have a high-confidence way to reproduce the issue?

Yes. The linked reporter supplied a controlled A/B account-switch sequence and observed that restarting the persistent daemon corrected the mismatch; current main still has the auth-swap path without daemon handling.

Is this the best way to solve the issue?

Yes, a verified home-scoped refresh addresses the observed stale managed daemon. The awaited restart needs a bounded UI completion path.

Full review comments:

• [P2] Bound the daemon restart wait before completing promotion — Sources/CodexBar/CodexAppServerDaemon.swift:59-60
runToCompletion waits for the CLI with an infinite timeout. If codex app-server daemon restart stalls, this awaited call never returns, so the System Account operation stays busy and the promised recovery note cannot appear. Bound the UI wait without cancelling a restart that has already launched, and cover that outcome with a hanging-runner test.
  Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.87

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ce1b80863e4b.

Labels

Label changes:

• add P1: A reproduced multi-account workflow can leave reconnecting Codex CLI sessions on the prior account after a System Account switch.
• add merge-risk: 🚨 availability: The new awaited restart has no subprocess timeout and can leave the promotion UI pending; the documented shared-daemon restart can also interrupt active work.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This owner-authored PR is exempt from the external-contributor proof gate. The linked reporter proved that a manual daemon restart corrected the live mismatch, while this branch’s after-fix integration was exercised with synthetic homes and injected runners, not a real daemon; no stored data-model contract changes.

Label justifications:

• P1: A reproduced multi-account workflow can leave reconnecting Codex CLI sessions on the prior account after a System Account switch.
• merge-risk: 🚨 availability: The new awaited restart has no subprocess timeout and can leave the promotion UI pending; the documented shared-daemon restart can also interrupt active work.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This owner-authored PR is exempt from the external-contributor proof gate. The linked reporter proved that a manual daemon restart corrected the live mismatch, while this branch’s after-fix integration was exercised with synthetic homes and injected runners, not a real daemon; no stored data-model contract changes.

Evidence

Acceptance criteria:

• [P1] CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 swift test --jobs 4 --filter CodexAppServerDaemonTests.
• [P1] make test.
• [P1] make check.

What I checked:

• Current-main gap: The main-branch promotion path publishes live auth and refreshes CodexBar state without reconciling an existing app-server; the latest v0.66.0 release has the same reported behavior. (Sources/CodexBar/CodexAccountPromotionService.swift:217, ce1b80863e4b)
• Linked live reproduction: In Codex: System Account switch leaves /status showing previous account's limits after CLI restart (0.157.0) #3990, the reporter observed Account A limits after switching to B and relaunching the CLI, then Account B limits after a manual daemon restart; the daemon also reported A while the credential file held B.
• Introduced restart path: The pinned PR delta awaits daemon verification and restart after publishing auth, then passes a recovery note to the menu and settings. (Sources/CodexBar/CodexAccountPromotionService.swift:200, 501ea10ddd8f)
• Upstream daemon contract: Codex 0.157.0 defines both PID filenames, the home-scoped socket, and the app-server command with separate --listen and unix:// arguments. Its version path probes that socket and reports the running backend. Source: https://github.com/openai/codex/blob/rust-v0.157.0/codex-rs/app-server-daemon/src/lib.rs. (codex-rs/app-server-daemon/src/lib.rs:45, 00c972ed5d6f)
• Unbounded wait: The new restart call uses runToCompletion, whose existing implementation starts a detached subprocess with an infinite timeout and awaits its result. A subprocess that never exits therefore prevents the promotion result and recovery note from completing. (Sources/CodexBar/CodexAppServerDaemon.swift:59, 501ea10ddd8f)
• Focused validation supplied: The PR reports synthetic-home and injected-runner tests, including failure-note and home-mismatch cases, and explicitly says it did not run a real daemon restart or relaunch the app. (Tests/CodexBarTests/CodexAppServerDaemonTests.swift:12, 501ea10ddd8f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Ratul Sarna: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• leezhuuuuu: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Bound the menu’s wait for a stuck restart and test that promotion exits its busy state with accurate guidance.
• If available, capture a redacted real System Account A/B switch showing the CLI’s account state after CodexBar performs the refresh.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.