fix(direct): show the real account email (decode id_token, not access token)

The directRunner showed 'ChatGPT account' because readTokens discarded the
id_token and the account label fell back to the access token — which carries the
chatgpt_account_id claim but NOT email/name (verified against ~/.codex/auth.json:
access has only sub; id_token has email + name). Now we keep the id_token and
decode the label from it, and preserve the known label across refreshes (a
refresh response may omit the id_token). Updated the test to the real token shape
(account-id in access, email in id_token). 114 tests passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: claude

src/backend/direct/directRunner.ts

@@ -64,8 +64,11 @@ export function directRunner(opts: DirectRunnerOptions = {}): CodexRunner {
     if (!s.creds) return null;
     // Refresh slightly before expiry.
     if (s.creds.expires - Date.now() < 60_000) {
+      const prevAccount = s.creds.account;
       try {
-        s.creds = await refreshAccessToken(s.creds.refresh, f);
+        const refreshed = await refreshAccessToken(s.creds.refresh, f);
+        // A refresh response may omit the id_token; keep the known email/name.
+        s.creds = { ...refreshed, account: refreshed.account ?? prevAccount };
       } catch {
         s.creds = undefined;
         return null;

src/backend/direct/oauth.ts

@@ -27,6 +27,8 @@ const JWT_CLAIM = "https://api.openai.com/auth";
 export interface OAuthTokens {
   access: string;
   refresh: string;
+  /** The id_token, when the grant returned one. Carries email/name claims. */
+  idToken?: string;
   /** Absolute epoch-ms expiry of the access token. */
   expires: number;
 }
@@ -67,7 +69,8 @@ function accountIdFrom(accessToken: string): string | null {
   return typeof id === "string" && id.length > 0 ? id : null;
 }
 
-function accountLabelFrom(token: string): string | undefined {
+function accountLabelFrom(token: string | undefined): string | undefined {
+  if (!token) return undefined;
   const c = decodeJwt(token) as { email?: string; name?: string } | null;
   return c?.email ?? c?.name ?? undefined;
 }
@@ -89,17 +92,19 @@ async function readTokens(res: Response, op: string): Promise<OAuthTokens> {
   return {
     access: json.access_token,
     refresh: json.refresh_token,
+    idToken: json.id_token,
     expires: Date.now() + json.expires_in * 1000,
   };
 }
 
-function credentials(tokens: OAuthTokens, idToken?: string): OAuthCredentials {
+function credentials(tokens: OAuthTokens): OAuthCredentials {
   const accountId = accountIdFrom(tokens.access);
   if (!accountId) throw new Error("could not extract chatgpt_account_id from access token");
+  // email/name live in the id_token, NOT the access token — prefer it.
   return {
     ...tokens,
     accountId,
-    account: accountLabelFrom(idToken ?? tokens.access),
+    account: accountLabelFrom(tokens.idToken) ?? accountLabelFrom(tokens.access),
   };
 }
 

tests/directRunner.test.ts

@@ -5,13 +5,18 @@ import { accountIdFrom } from "../src/backend/direct/oauth.js";
 import type { SessionCtx } from "../src/backend/types.js";
 import type { RunStreamEvent } from "../src/core/contract.js";
 
-// Build a fake access token JWT whose claim carries the chatgpt_account_id.
-function fakeAccessToken(accountId: string, email = "me@example.com"): string {
+function jwt(payload: object): string {
   const header = Buffer.from(JSON.stringify({ alg: "none" })).toString("base64url");
-  const payload = Buffer.from(
-    JSON.stringify({ email, "https://api.openai.com/auth": { chatgpt_account_id: accountId } }),
-  ).toString("base64url");
-  return `${header}.${payload}.sig`;
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${header}.${body}.sig`;
+}
+// REAL shape: the access token carries the account-id claim but NO email/name;
+// email/name live in the id_token. (Verified against ~/.codex/auth.json.)
+function fakeAccessToken(accountId: string): string {
+  return jwt({ sub: "user", "https://api.openai.com/auth": { chatgpt_account_id: accountId } });
+}
+function fakeIdToken(email: string): string {
+  return jwt({ email, name: "Test User" });
 }
 
 const json = (status: number, body: unknown, headers: Record<string, string> = {}) =>
@@ -41,7 +46,12 @@ describe("directRunner — device flow over mocked fetch", () => {
   }
 
   const token = fakeAccessToken("acct-9");
-  const tokenBody = { access_token: token, refresh_token: "r1", expires_in: 3600 };
+  const tokenBody = {
+    access_token: token,
+    refresh_token: "r1",
+    id_token: fakeIdToken("me@example.com"),
+    expires_in: 3600,
+  };
 
   it("startDeviceLogin returns a login URL + user code", async () => {
     const f = mockFetch({