codex-multi-auth 2.7.1 → 2.8.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-multi-auth",
-  "version": "2.7.1",
+  "version": "2.8.1",
   "description": "Install and operate codex-multi-auth for the official @openai/codex CLI with multi-account OAuth rotation, switching, health checks, and recovery tools.",
   "interface": {
     "composerIcon": "./assets/codex-multi-auth-icon.svg"

package/README.md

@@ -391,7 +391,8 @@ codex-multi-auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md) — install via `npm i -g codex-multi-auth`
+- Current stable: [docs/releases/v2.8.0.md](docs/releases/v2.8.0.md) — install via `npm i -g codex-multi-auth`
+- Previous stable: [docs/releases/v2.7.1.md](docs/releases/v2.7.1.md)
 - Previous stable: [docs/releases/v2.7.0.md](docs/releases/v2.7.0.md)
 - Previous stable: [docs/releases/v2.6.0.md](docs/releases/v2.6.0.md)
 - Previous stable: [docs/releases/v2.5.0.md](docs/releases/v2.5.0.md)

package/dist/lib/codex-cli/writer.d.ts

@@ -6,6 +6,57 @@ interface ActiveSelection {
     expiresAt?: number;
     idToken?: string;
 }
+/**
+ * Whether `config.toml` may be rewritten to pin the credential store.
+ *
+ * Exported so callers that only *plan* a rewrite — `doctor --fix --dry-run` —
+ * can report the same outcome the real run would produce, instead of promising
+ * a change the opt-out would suppress.
+ */
+export declare function shouldEnforceCodexCliFileAuthStore(): boolean;
+/**
+ * Reads the top-level `cli_auth_credentials_store` value out of a raw
+ * `config.toml`.
+ *
+ * Mirrors the scoping rules of {@link ensureCodexCliFileAuthStore}: assignments
+ * inside a `[table]` belong to that table, so only lines before the first table
+ * header describe the official CLI's default credential store. Reporting a
+ * profile-scoped value as the effective one would let `doctor` call a config
+ * healthy while the CLI still reaches for the keychain.
+ *
+ * Both TOML string forms count. A literal string (`'file'`) is as valid as a
+ * basic string (`"file"`), so treating only the latter as real would make
+ * `doctor` warn about a perfectly healthy config. Literal strings have no
+ * escape sequences, and the values in play here are bare identifiers, so a
+ * non-greedy character class is an exact match for both forms.
+ *
+ * @param rawConfig - Full text of `config.toml`.
+ * @returns The declared mode, or `null` when no top-level assignment exists.
+ */
+export declare function readTopLevelCodexCliAuthStoreMode(rawConfig: string): string | null;
+/**
+ * Persists `cli_auth_credentials_store = "file"` as a top-level key in the
+ * official Codex CLI `config.toml`.
+ *
+ * The wrapper already appends `-c cli_auth_credentials_store="file"` to every
+ * command it forwards, but that only covers processes it launches itself.
+ * Third-party front-ends (menu-bar apps such as CodexBar, editor extensions)
+ * exec the official binary directly, so the *persisted* value is what decides
+ * whether the official CLI reaches into the macOS login keychain. Leaving it on
+ * `"keychain"` is what produces the repeated "Always Allow" prompts reported in
+ * issue #641.
+ *
+ * Only top-level assignments are rewritten. A `cli_auth_credentials_store`
+ * inside a `[profiles.*]` table must be left alone: rewriting it in place would
+ * mangle a scoped setting while still leaving the top-level default pointed at
+ * the keychain, so the prompts would continue.
+ *
+ * @param configPath - Config file to reconcile; defaults to the resolved Codex
+ * CLI `config.toml`.
+ * @returns `true` when the file was rewritten, `false` when it was already
+ * correct or enforcement is disabled.
+ */
+export declare function ensureCodexCliFileAuthStore(configPath?: string): Promise<boolean>;
 export declare function setCodexCliActiveSelection(selection: ActiveSelection): Promise<boolean>;
 export declare function getLastCodexCliSelectionWriteTimestamp(): number;
 export {};

package/dist/lib/codex-cli/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA2XD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAqMlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../lib/codex-cli/writer.ts"],"names":[],"mappings":"AAoBA,UAAU,eAAe;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AA8ND;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,OAAO,CAG5D;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,CAChD,UAAU,GAAE,MAAgC,GAC1C,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAmHD,wBAAsB,0BAA0B,CAC/C,SAAS,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC,CAqMlB;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAE/D"}

package/dist/lib/codex-cli/writer.js

@@ -199,30 +199,111 @@ async function atomicWriteText(path, content) {
 async function atomicWriteJson(path, payload) {
     return atomicWriteText(path, JSON.stringify(payload, null, 2));
 }
-function shouldEnforceCodexCliFileAuthStore() {
+/**
+ * Whether `config.toml` may be rewritten to pin the credential store.
+ *
+ * Exported so callers that only *plan* a rewrite — `doctor --fix --dry-run` —
+ * can report the same outcome the real run would produce, instead of promising
+ * a change the opt-out would suppress.
+ */
+export function shouldEnforceCodexCliFileAuthStore() {
     const override = (process.env.CODEX_MULTI_AUTH_ENFORCE_CLI_FILE_AUTH_STORE ?? "1").trim();
     return override !== "0";
 }
-function ensureTrailingNewline(value) {
-    return value.endsWith("\n") ? value : `${value}\n`;
+/**
+ * Matches a complete TOML table header, mirroring `readTomlTableName` in
+ * `lib/runtime/config-toml.ts` (plus an optional trailing comment).
+ *
+ * A loose `/^\s*\[/` would also match a continuation line of a multi-line array
+ * such as `[1, 2],`, cutting the top-level scan short. The writer would then
+ * miss a real top-level assignment below it and insert a second one — a
+ * duplicate key, which is invalid TOML and stops the official CLI from starting.
+ */
+const TOML_TABLE_HEADER_PATTERN = /^\s*\[{1,2}\s*[^\]]+?\s*\]{1,2}\s*(?:#.*)?$/;
+function ensureTrailingNewline(value, lineEnding = "\n") {
+    return value.endsWith("\n") ? value : `${value}${lineEnding}`;
 }
-async function ensureCodexCliFileAuthStore(configPath) {
+/**
+ * Reads the top-level `cli_auth_credentials_store` value out of a raw
+ * `config.toml`.
+ *
+ * Mirrors the scoping rules of {@link ensureCodexCliFileAuthStore}: assignments
+ * inside a `[table]` belong to that table, so only lines before the first table
+ * header describe the official CLI's default credential store. Reporting a
+ * profile-scoped value as the effective one would let `doctor` call a config
+ * healthy while the CLI still reaches for the keychain.
+ *
+ * Both TOML string forms count. A literal string (`'file'`) is as valid as a
+ * basic string (`"file"`), so treating only the latter as real would make
+ * `doctor` warn about a perfectly healthy config. Literal strings have no
+ * escape sequences, and the values in play here are bare identifiers, so a
+ * non-greedy character class is an exact match for both forms.
+ *
+ * @param rawConfig - Full text of `config.toml`.
+ * @returns The declared mode, or `null` when no top-level assignment exists.
+ */
+export function readTopLevelCodexCliAuthStoreMode(rawConfig) {
+    for (const line of rawConfig.split(/\r?\n/)) {
+        if (TOML_TABLE_HEADER_PATTERN.test(line))
+            break;
+        const match = line.match(/^\s*cli_auth_credentials_store\s*=\s*(?:"([^"]*)"|'([^']*)')\s*(?:#.*)?$/);
+        if (match)
+            return (match[1] ?? match[2] ?? "").trim() || null;
+    }
+    return null;
+}
+/**
+ * Persists `cli_auth_credentials_store = "file"` as a top-level key in the
+ * official Codex CLI `config.toml`.
+ *
+ * The wrapper already appends `-c cli_auth_credentials_store="file"` to every
+ * command it forwards, but that only covers processes it launches itself.
+ * Third-party front-ends (menu-bar apps such as CodexBar, editor extensions)
+ * exec the official binary directly, so the *persisted* value is what decides
+ * whether the official CLI reaches into the macOS login keychain. Leaving it on
+ * `"keychain"` is what produces the repeated "Always Allow" prompts reported in
+ * issue #641.
+ *
+ * Only top-level assignments are rewritten. A `cli_auth_credentials_store`
+ * inside a `[profiles.*]` table must be left alone: rewriting it in place would
+ * mangle a scoped setting while still leaving the top-level default pointed at
+ * the keychain, so the prompts would continue.
+ *
+ * @param configPath - Config file to reconcile; defaults to the resolved Codex
+ * CLI `config.toml`.
+ * @returns `true` when the file was rewritten, `false` when it was already
+ * correct or enforcement is disabled.
+ */
+export async function ensureCodexCliFileAuthStore(configPath = getCodexCliConfigPath()) {
     if (!shouldEnforceCodexCliFileAuthStore())
         return false;
     const desired = 'cli_auth_credentials_store = "file"';
     const raw = existsSync(configPath) ? await fs.readFile(configPath, "utf-8") : "";
+    // Quote style is not ours to normalize: a literal-string `'file'` already
+    // keeps the CLI off the keychain, so rewriting it to `"file"` would churn a
+    // healthy config on every wrapper startup for no behavioral gain.
+    if (readTopLevelCodexCliAuthStoreMode(raw) === "file")
+        return false;
+    // Preserve the file's existing line endings, as the runtime config rewriter
+    // does. Splitting on /\r?\n/ and rejoining with "\n" would silently convert a
+    // CRLF config.toml to LF -- an edit the user never asked for, and one this
+    // code now risks on every wrapper startup rather than only on account switch.
+    const lineEnding = raw.includes("\r\n") ? "\r\n" : "\n";
     const lines = raw.length > 0 ? raw.split(/\r?\n/) : [];
     const assignmentRegex = /^\s*cli_auth_credentials_store\s*=/;
     let replaced = false;
+    let inTopLevelTable = true;
     const nextLines = lines.map((line) => {
-        if (!replaced && assignmentRegex.test(line)) {
+        if (TOML_TABLE_HEADER_PATTERN.test(line))
+            inTopLevelTable = false;
+        if (inTopLevelTable && !replaced && assignmentRegex.test(line)) {
             replaced = true;
             return desired;
         }
         return line;
     });
     if (!replaced) {
-        let insertAt = nextLines.findIndex((line) => /^\s*\[/.test(line));
+        let insertAt = nextLines.findIndex((line) => TOML_TABLE_HEADER_PATTERN.test(line));
         if (insertAt < 0)
             insertAt = nextLines.length;
         nextLines.splice(insertAt, 0, desired);
@@ -230,8 +311,8 @@ async function ensureCodexCliFileAuthStore(configPath) {
             nextLines.splice(insertAt + 1, 0, "");
         }
     }
-    const nextRaw = ensureTrailingNewline(nextLines.join("\n"));
-    if (nextRaw === ensureTrailingNewline(raw)) {
+    const nextRaw = ensureTrailingNewline(nextLines.join(lineEnding), lineEnding);
+    if (nextRaw === ensureTrailingNewline(raw, lineEnding)) {
         return false;
     }
     await atomicWriteText(configPath, nextRaw);

package/dist/lib/codex-manager/repair-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAOvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;CACb;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AAkjBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA2cjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAinBjB"}
+{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;CACb;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AAkjBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA2cjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA0qBjB"}

package/dist/lib/codex-manager/repair-commands.js

@@ -9,7 +9,7 @@ import { isCodexUnavailableError } from "../errors.js";
 import { queuedRefresh } from "../refresh-queue.js";
 import { findMatchingAccountIndex, getStoragePath, loadAccounts, loadFlaggedAccounts, setStoragePath, withAccountStorageTransaction, withAccountAndFlaggedStorageTransaction, withFlaggedStorageTransaction, } from "../storage.js";
 import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "../codex-cli/state.js";
-import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
+import { ensureCodexCliFileAuthStore, readTopLevelCodexCliAuthStoreMode, setCodexCliActiveSelection, shouldEnforceCodexCliFileAuthStore, } from "../codex-cli/writer.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { DEFAULT_PROBE_MODEL, resolveNormalizedModel } from "../request/helpers/model-map.js";
 import { loadPersistedRuntimeObservabilitySnapshot } from "../runtime/runtime-observability.js";
@@ -1300,14 +1300,16 @@ export async function runDoctor(args, deps) {
             : "Codex config file does not exist",
         details: codexConfigPath,
     });
+    const supplementalFixActions = [];
+    // Tracked separately from account storage: pinning the auth store is a real
+    // remediation even on a machine with no accounts yet, which is exactly the
+    // state a user hitting repeated keychain prompts tends to be in.
+    let authStoreFixChanged = false;
     let codexAuthStoreMode;
     if (codexConfigFileExists) {
         try {
             const configRaw = await fs.readFile(codexConfigPath, "utf-8");
-            const match = configRaw.match(/^\s*cli_auth_credentials_store\s*=\s*"([^"]+)"\s*$/m);
-            if (match?.[1]) {
-                codexAuthStoreMode = match[1].trim();
-            }
+            codexAuthStoreMode = readTopLevelCodexCliAuthStoreMode(configRaw) ?? undefined;
         }
         catch (error) {
             addCheck({
@@ -1319,13 +1321,59 @@ export async function runDoctor(args, deps) {
         }
     }
     if (!checks.some((check) => check.key === "codex-auth-store")) {
+        // A config that is not pinned to "file" is what makes the official CLI
+        // reach into the macOS login keychain, so `--fix` repairs it directly
+        // instead of waiting for the incidental `pendingCodexActiveSync` path
+        // below, which only fires when there is an active account to mirror.
+        if (options.fix &&
+            codexAuthStoreMode !== "file" &&
+            shouldEnforceCodexCliFileAuthStore()) {
+            if (options.dryRun) {
+                authStoreFixChanged = true;
+                supplementalFixActions.push({
+                    key: "codex-auth-store",
+                    message: "Prepared Codex CLI credential store pin to file in config.toml (dry-run)",
+                });
+            }
+            else {
+                try {
+                    if (await ensureCodexCliFileAuthStore(codexConfigPath)) {
+                        codexAuthStoreMode = "file";
+                        authStoreFixChanged = true;
+                        supplementalFixActions.push({
+                            key: "codex-auth-store",
+                            message: "Pinned Codex CLI credential store to file in config.toml",
+                        });
+                    }
+                }
+                catch (error) {
+                    addCheck({
+                        key: "codex-auth-store-fix",
+                        severity: "warn",
+                        message: "Failed to pin Codex CLI credential store to file",
+                        details: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
+        const authStoreDetails = [
+            codexAuthStoreMode ? `mode=${codexAuthStoreMode}` : "mode=unset",
+        ];
+        if (codexAuthStoreMode !== "file" && !options.fix) {
+            authStoreDetails.push("run `codex-multi-auth doctor --fix` to pin it to file");
+        }
+        if (process.platform === "darwin" && codexAuthStoreMode === "file") {
+            // Purely informational: reading or deleting keychain items would
+            // itself raise the prompt this check exists to eliminate.
+            authStoreDetails.push("credentials saved by an earlier official `codex login` may still sit in the login keychain; they are no longer read and can be removed manually via Keychain Access");
+        }
         addCheck({
             key: "codex-auth-store",
             severity: codexAuthStoreMode === "file" ? "ok" : "warn",
             message: codexAuthStoreMode === "file"
                 ? "Codex auth storage is set to file"
                 : "Codex auth storage is not explicitly set to file",
-            details: codexAuthStoreMode ? `mode=${codexAuthStoreMode}` : "mode=unset",
+            details: authStoreDetails.join("; "),
         });
     }
     const codexCliState = await loadCodexCliState({ forceRefresh: true });
@@ -1343,7 +1391,6 @@ export async function runDoctor(args, deps) {
     let fixChanged = false;
     let storageFixChanged = false;
     let structuralFixActions = [];
-    const supplementalFixActions = [];
     let doctorRefreshMutation = null;
     let pendingCodexActiveSync = null;
     if (options.fix && storageForChecks && storageForChecks.accounts.length > 0) {
@@ -1677,7 +1724,9 @@ export async function runDoctor(args, deps) {
         }
     }
     const fixActions = [...structuralFixActions, ...supplementalFixActions];
-    if (options.fix && storageForChecks && storageForChecks.accounts.length > 0) {
+    if (options.fix &&
+        ((storageForChecks && storageForChecks.accounts.length > 0) ||
+            authStoreFixChanged)) {
         fixChanged = storageFixChanged || fixActions.length > 0;
         addCheck({
             key: "auto-fix",

package/dist/lib/runtime/first-run.d.ts

@@ -1,13 +1,18 @@
-export declare const FIRST_RUN_MARKER_VERSION = 1;
-type FirstRunStepStatus = "completed" | "skipped" | "failed";
+export declare const FIRST_RUN_MARKER_VERSION = 2;
+export type FirstRunStepStatus = "completed" | "skipped" | "failed";
 interface FirstRunSetupOutcome {
     appBind: FirstRunStepStatus;
     launcher: FirstRunStepStatus;
+    authStore: FirstRunStepStatus;
 }
 type FirstRunSkipReason = "ci" | "not-installed" | "already-done" | "claim-race" | "error";
 export type FirstRunResult = {
     ran: false;
     reason: FirstRunSkipReason;
+} | {
+    ran: false;
+    reason: "migrated";
+    authStore: FirstRunStepStatus;
 } | ({
     ran: true;
 } & FirstRunSetupOutcome);
@@ -19,6 +24,7 @@ export interface FirstRunSetupDeps {
     resolveRotation?: () => boolean;
     bindCodexApp?: () => Promise<FirstRunStepStatus>;
     installLauncher?: () => Promise<FirstRunStepStatus>;
+    enforceAuthStore?: () => Promise<FirstRunStepStatus>;
     notify?: (message: string) => void;
     now?: () => number;
 }
@@ -68,10 +74,10 @@ type LauncherInstallFn = (options: {
  */
 export declare function loadLauncherInstall(candidateOverride?: readonly string[]): Promise<LauncherInstallFn | null>;
 /**
- * Runs the lazily deferred install setup (Codex app bind + launcher routing)
- * exactly once per runtime root. Never throws and never blocks a command on
- * failure: every error path resolves with a skip/failed status and only
- * debug-logs sanitized messages.
+ * Runs the lazily deferred install setup (Codex auth-store enforcement + app
+ * bind + launcher routing) exactly once per runtime root. Never throws and
+ * never blocks a command on failure: every error path resolves with a
+ * skip/failed status and only debug-logs sanitized messages.
  */
 export declare function ensureFirstRunSetup(deps?: FirstRunSetupDeps): Promise<FirstRunResult>;
 export {};

package/dist/lib/runtime/first-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"first-run.d.ts","sourceRoot":"","sources":["../../../lib/runtime/first-run.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAkB1C,KAAK,kBAAkB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7D,UAAU,oBAAoB;IAC7B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,CAAC;CAC7B;AAED,KAAK,kBAAkB,GACpB,IAAI,GACJ,eAAe,GACf,cAAc,GACd,YAAY,GACZ,OAAO,CAAC;AAEX,MAAM,MAAM,cAAc,GACvB;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC1C,CAAC;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAgBD,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG7E;AAeD,MAAM,WAAW,0BAA0B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CACjC,OAAO,GAAE,0BAA+B,GACtC,OAAO,CA8BT;AAED,wBAAgB,sBAAsB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,kBAAkB,GAAE,MAAM,OACgC,GACxD,OAAO,CAWT;AAED,MAAM,WAAW,uBAAuB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAcT;AAED,MAAM,WAAW,2BAA2B;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,uCAAuC,CACtD,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAUT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,GAAE,MAAuC,EACnD,GAAG,GAAE,MAAsB,GACzB,OAAO,CAST;AAkGD,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE;IAClC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAenC;AAkCD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,GAAE,iBAAsB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAoDzB"}
+{"version":3,"file":"first-run.d.ts","sourceRoot":"","sources":["../../../lib/runtime/first-run.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAkB1C,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEpE,UAAU,oBAAoB;IAC7B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,kBAAkB,CAAC;CAC9B;AAED,KAAK,kBAAkB,GACpB,IAAI,GACJ,eAAe,GACf,cAAc,GACd,YAAY,GACZ,OAAO,CAAC;AAEX,MAAM,MAAM,cAAc,GACvB;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC1C;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,GACjE,CAAC;IAAE,GAAG,EAAE,IAAI,CAAA;CAAE,GAAG,oBAAoB,CAAC,CAAC;AAW1C,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjD,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpD,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAgBD,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAG7E;AAeD,MAAM,WAAW,0BAA0B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,kBAAkB,CACjC,OAAO,GAAE,0BAA+B,GACtC,OAAO,CA8BT;AAED,wBAAgB,sBAAsB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,kBAAkB,GAAE,MAAM,OACgC,GACxD,OAAO,CAWT;AAED,MAAM,WAAW,uBAAuB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAcT;AAED,MAAM,WAAW,2BAA2B;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,uCAAuC,CACtD,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAUT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,GAAE,MAAuC,EACnD,GAAG,GAAE,MAAsB,GACzB,OAAO,CAST;AAsGD,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE;IAClC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GACnC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAenC;AAuJD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,GAAE,iBAAsB,GAC1B,OAAO,CAAC,cAAc,CAAC,CA8EzB"}

package/dist/lib/runtime/first-run.js

@@ -9,12 +9,13 @@
 // a failure is debug-logged (messages only — never tokens or emails) and the
 // command proceeds normally.
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
 import { open, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
 import process from "node:process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { ensureCodexCliFileAuthStore } from "../codex-cli/writer.js";
 import { getCodexRuntimeRotationProxy, loadPluginConfig } from "../config.js";
 import { withFileOperationRetry } from "../fs-retry.js";
 import { createLogger } from "../logger.js";
@@ -22,7 +23,8 @@ import { getCodexMultiAuthDir } from "../runtime-paths.js";
 import { bindCodexAppRuntimeRotation, getAppBindStatus } from "./app-bind.js";
 const log = createLogger("first-run");
 const FIRST_RUN_MARKER_FILE = "first-run-setup.json";
-export const FIRST_RUN_MARKER_VERSION = 1;
+// v2 adds the `authStore` step to the marker payload.
+export const FIRST_RUN_MARKER_VERSION = 2;
 const TRUE_VALUES = new Set(["1", "true", "yes"]);
 const FALSE_VALUES = new Set(["0", "false", "no"]);
 const CI_ENV_KEYS = [
@@ -202,12 +204,16 @@ async function atomicWriteMarker(target, content) {
     });
 }
 async function finalizeFirstRunMarker(markerPath, startedAt, outcome, now) {
+    // A failed auth-store step records a pre-v2 version so the next invocation
+    // replays it through the migration path — which reruns only that step, never
+    // app bind or launcher install.
     const payload = `${JSON.stringify({
-        version: FIRST_RUN_MARKER_VERSION,
+        version: markerVersionFor(outcome.authStore, undefined),
         startedAt,
         completedAt: now(),
         appBind: outcome.appBind,
         launcher: outcome.launcher,
+        authStore: outcome.authStore,
     }, null, "\t")}\n`;
     try {
         await atomicWriteMarker(markerPath, payload);
@@ -254,6 +260,110 @@ async function defaultBindCodexApp(env, rotationEnabled, detectDesktopApp, notif
     }
     return "completed";
 }
+/**
+ * Pins the official Codex CLI to the file-backed credential store.
+ *
+ * Enforcement used to be lazy — it only happened when something called
+ * `setCodexCliActiveSelection` (switch, login, health check, repair). A user who
+ * installed the package and drove Codex through a third-party front-end could
+ * therefore stay on `cli_auth_credentials_store = "keychain"` indefinitely and
+ * keep getting macOS login-keychain prompts (issue #641). Doing it at first run
+ * closes that window before the official CLI ever reads its store.
+ *
+ * Deliberately not gated on `isCodexCliSyncEnabled()`: turning CLI sync off is a
+ * statement about account mirroring, not a request to re-enable keychain
+ * prompts. The `CODEX_MULTI_AUTH_ENFORCE_CLI_FILE_AUTH_STORE=0` opt-out is
+ * honored inside `ensureCodexCliFileAuthStore` itself.
+ */
+async function defaultEnforceAuthStore() {
+    return (await ensureCodexCliFileAuthStore()) ? "completed" : "skipped";
+}
+/**
+ * Decides the version to persist after an auth-store attempt.
+ *
+ * Recording the current version after a *failed* step would strand the user:
+ * `ensureFirstRunSetup` short-circuits on version alone, so a single transient
+ * Windows `EPERM`/`EBUSY` on a locked `config.toml` would leave the CLI on
+ * keychain mode permanently — the exact symptom this whole change exists to
+ * remove. Staying pre-v2 costs one extra marker read per invocation and
+ * self-heals as soon as the write succeeds, because the step is idempotent.
+ *
+ * `"skipped"` deliberately does bump. It is the normal outcome for a config
+ * already pinned to `"file"`, so treating it as unfinished would mean the
+ * marker never reaches the current version for healthy installs. It also covers
+ * an explicit `CODEX_MULTI_AUTH_ENFORCE_CLI_FILE_AUTH_STORE=0` opt-out — a user
+ * choice, not a failure — and if that opt-out is later removed, the
+ * wrapper-startup guard and `doctor --fix` both still reconcile the config.
+ */
+function markerVersionFor(authStore, previousVersion) {
+    if (authStore === "failed")
+        return previousVersion ?? 1;
+    return FIRST_RUN_MARKER_VERSION;
+}
+function readFirstRunMarker(markerPath) {
+    try {
+        const parsed = JSON.parse(readFileSync(markerPath, "utf8"));
+        return typeof parsed === "object" && parsed !== null
+            ? parsed
+            : null;
+    }
+    catch {
+        // An unreadable or truncated marker is treated as pre-v2 and migrated;
+        // the migration only replays the idempotent auth-store step.
+        return null;
+    }
+}
+/**
+ * Brings a marker written before the auth-store step existed up to the current
+ * version.
+ *
+ * `ensureFirstRunSetup` short-circuits on marker existence, so bumping
+ * `FIRST_RUN_MARKER_VERSION` on its own would leave every already-installed
+ * user — precisely the population reporting repeated keychain prompts — without
+ * the enforcement step forever.
+ *
+ * Only the auth-store step is replayed. Rerunning app bind or launcher install
+ * would reinstall shortcuts and rebind the desktop app, which the user may have
+ * deliberately removed since.
+ *
+ * No exclusive claim is taken, unlike the initial setup. Both operations here
+ * are idempotent and atomic — `ensureCodexCliFileAuthStore` skips a config
+ * already on `"file"`, and `atomicWriteMarker` renames into place — so
+ * concurrent invocations converge on the same result instead of racing.
+ */
+async function migrateFirstRunMarker(markerPath, marker, deps, now) {
+    let authStore;
+    try {
+        authStore = await (deps.enforceAuthStore
+            ? deps.enforceAuthStore()
+            : defaultEnforceAuthStore());
+    }
+    catch (error) {
+        authStore = "failed";
+        log.debug("first-run marker migration auth store step skipped", {
+            error: errorMessage(error),
+        });
+    }
+    const payload = `${JSON.stringify({
+        version: markerVersionFor(authStore, marker.version),
+        startedAt: marker.startedAt ?? now(),
+        completedAt: marker.completedAt ?? now(),
+        appBind: marker.appBind ?? "skipped",
+        launcher: marker.launcher ?? "skipped",
+        authStore,
+    }, null, "\t")}\n`;
+    try {
+        await atomicWriteMarker(markerPath, payload);
+    }
+    catch (error) {
+        // Leaving the marker at v1 just means the idempotent step runs again on
+        // the next invocation, so this is safe to swallow.
+        log.debug("first-run marker migration write failed", {
+            error: errorMessage(error),
+        });
+    }
+    return authStore;
+}
 async function defaultInstallLauncher(env, rotationEnabled, notify) {
     if (!shouldInstallCodexAppLauncherOnFirstRun({ env, rotationEnabled })) {
         return "skipped";
@@ -265,10 +375,10 @@ async function defaultInstallLauncher(env, rotationEnabled, notify) {
     return "completed";
 }
 /**
- * Runs the lazily deferred install setup (Codex app bind + launcher routing)
- * exactly once per runtime root. Never throws and never blocks a command on
- * failure: every error path resolves with a skip/failed status and only
- * debug-logs sanitized messages.
+ * Runs the lazily deferred install setup (Codex auth-store enforcement + app
+ * bind + launcher routing) exactly once per runtime root. Never throws and
+ * never blocks a command on failure: every error path resolves with a
+ * skip/failed status and only debug-logs sanitized messages.
  */
 export async function ensureFirstRunSetup(deps = {}) {
     try {
@@ -279,9 +389,18 @@ export async function ensureFirstRunSetup(deps = {}) {
         if (!installed)
             return { ran: false, reason: "not-installed" };
         const markerPath = deps.markerPath ?? getFirstRunMarkerPath();
-        if (existsSync(markerPath))
-            return { ran: false, reason: "already-done" };
         const now = deps.now ?? Date.now;
+        if (existsSync(markerPath)) {
+            const marker = readFirstRunMarker(markerPath);
+            if ((marker?.version ?? 1) >= FIRST_RUN_MARKER_VERSION) {
+                return { ran: false, reason: "already-done" };
+            }
+            return {
+                ran: false,
+                reason: "migrated",
+                authStore: await migrateFirstRunMarker(markerPath, marker ?? {}, deps, now),
+            };
+        }
         const startedAt = now();
         if (!claimFirstRunMarker(markerPath, startedAt)) {
             return { ran: false, reason: "claim-race" };
@@ -296,7 +415,19 @@ export async function ensureFirstRunSetup(deps = {}) {
         const outcome = {
             appBind: "skipped",
             launcher: "skipped",
+            authStore: "skipped",
         };
+        try {
+            outcome.authStore = await (deps.enforceAuthStore
+                ? deps.enforceAuthStore()
+                : defaultEnforceAuthStore());
+        }
+        catch (error) {
+            outcome.authStore = "failed";
+            log.debug("first-run codex auth store enforcement skipped", {
+                error: errorMessage(error),
+            });
+        }
         try {
             outcome.appBind = await (deps.bindCodexApp
                 ? deps.bindCodexApp()