fix(login): resolve real codex CLI from live home, not sandbox (#18)

* fix(login): resolve real codex CLI from live home, not sandbox

User report (Windows): clicking the per-card Login button surfaced
\`C:\\Python314\\python.exe: can't open file 'C:\\Users\\32162\\.codex\\
account_backup\\windows\\login_runtime\\account_backup\\windows\\
codex_switch.py': [Errno 2] No such file or directory\`

Root cause: \`build_login_command\` was anchoring \`resolve_real_codex_cli\`
on the *runtime* CODEX_HOME (the sandbox). On Windows the user's
\`codex\` on PATH is a managed cmd shim that does
\`%CODEX_HOME%\\account_backup\\windows\\codex_switch_cli\`. The
managed-shim filter only excluded the shim that lives under the
*runtime* CODEX_HOME — it didn't filter the live shim, so the resolver
returned the live shim. Once invoked with \`CODEX_HOME=runtime_home\`,
the shim looked for \`codex_switch_cli\` (or the legacy
\`codex_switch.py\`) under the empty sandbox and failed.

`run_codex_auth_refresh` already had this split right (\`cli_codex_home\`
for resolution, \`runtime_codex_home\` for the env). Mirror that on
\`run_codex_login\`:

- `PlatformHooks::run_codex_login` now takes
  \`(cli_codex_home, runtime_codex_home)\`. The legacy
  \`login_current_profile\` flow passes the same path for both. The
  per-card login passes the live \`~/.codex\` for resolution and the
  sandbox for the env.
- Both mac and win impls split the args and use \`cli_codex_home\` only
  for \`resolve_real_codex_cli\`.
- \`shared/runtime/login_runtime.rs\` now passes the live \`codex_home\`
  to the hook for resolution.
- Tests updated; 40/40 still pass on mac (the previously-flaky
  \`discover_real_codex_cli_path_falls_back_to_app_bundle_cli\` continues
  to be parallel-only flaky due to a pre-existing PATH env race
  between mac tests and win tests, unrelated to this change).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(login): also update win/switch.rs FakeHooks signature

Linux CI compiles the win runtime path (it's the `not(target_os = "macos")`
branch), so the win switch tests' FakeHooks needed the same trait
signature update as the rest of the impls. Caught by CI on PR #18 only —
the local cargo check passed because mac uses the macos runtime path.

40/40 still pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: Cmochance

src-tauri/mac/runtime/process.rs

@@ -266,8 +266,14 @@ fn build_auth_refresh_command(real_codex_path: &Path, runtime_codex_home: &Path)
     command
 }
 
-fn build_login_command(codex_home: &Path) -> Command {
-    let mut command = if let Some(real_codex_path) = resolve_real_codex_cli(Some(codex_home)) {
+/// Build the `codex login` command. Resolution of the real codex
+/// binary is anchored on `cli_codex_home` (the live `~/.codex`) so the
+/// managed-shim filter works correctly even when `runtime_codex_home`
+/// is a sandboxed sibling that doesn't have its own install state.
+/// `runtime_codex_home` is what the spawned process sees as
+/// `CODEX_HOME` and is where it will write `auth.json`.
+fn build_login_command(cli_codex_home: &Path, runtime_codex_home: &Path) -> Command {
+    let mut command = if let Some(real_codex_path) = resolve_real_codex_cli(Some(cli_codex_home)) {
         let mut command = Command::new(real_codex_path);
         command.arg("login");
         command
@@ -277,8 +283,8 @@ fn build_login_command(codex_home: &Path) -> Command {
         command
     };
 
-    command.current_dir(codex_home);
-    command.env("CODEX_HOME", codex_home);
+    command.current_dir(runtime_codex_home);
+    command.env("CODEX_HOME", runtime_codex_home);
     command
 }
 
@@ -339,8 +345,10 @@ pub fn run_codex_auth_refresh(cli_codex_home: &Path, runtime_codex_home: &Path)
     Err(AppError::new("AUTH_REFRESH_FAILED", message))
 }
 
-pub fn run_codex_login(codex_home: &Path) -> AppResult<()> {
-    let output = build_login_command(codex_home).output().map_err(|error| {
+pub fn run_codex_login(cli_codex_home: &Path, runtime_codex_home: &Path) -> AppResult<()> {
+    let output = build_login_command(cli_codex_home, runtime_codex_home)
+        .output()
+        .map_err(|error| {
         AppError::new(
             "LOGIN_COMMAND_FAILED",
             format!("Failed to start `codex login`: {error}"),
@@ -427,8 +435,12 @@ impl PlatformHooks for MacosPlatformHooks {
         reopen_codex_app_if_needed(app_was_running, codex_home)
     }
 
-    fn run_codex_login(&self, codex_home: &Path) -> AppResult<()> {
-        run_codex_login(codex_home)
+    fn run_codex_login(
+        &self,
+        cli_codex_home: &Path,
+        runtime_codex_home: &Path,
+    ) -> AppResult<()> {
+        run_codex_login(cli_codex_home, runtime_codex_home)
     }
 
     fn run_codex_auth_refresh(

src-tauri/mac/runtime/profile_actions.rs

@@ -69,7 +69,7 @@ pub fn login_current_profile() -> AppResult<String> {
         ));
     }
 
-    platform::run_codex_login(&codex_home)?;
+    platform::run_codex_login(&codex_home, &codex_home)?;
 
     if !codex_home.join("auth.json").is_file() {
         return Err(AppError::new(

src-tauri/shared/platform/hooks.rs

@@ -10,7 +10,17 @@ pub trait PlatformHooks: Send + Sync {
         app_was_running: bool,
         codex_home: Option<&Path>,
     ) -> Vec<String>;
-    fn run_codex_login(&self, codex_home: &Path) -> AppResult<()>;
+    /// Run `codex login`. `cli_codex_home` is the live `~/.codex` and
+    /// drives codex-binary resolution (so the user's managed shim is
+    /// filtered out correctly). `runtime_codex_home` is what the spawned
+    /// codex sees as `CODEX_HOME` — for the legacy "log in as the
+    /// active profile" flow they are the same, but the per-card login
+    /// flow points it at a sandboxed sibling.
+    fn run_codex_login(
+        &self,
+        cli_codex_home: &Path,
+        runtime_codex_home: &Path,
+    ) -> AppResult<()>;
     fn run_codex_auth_refresh(
         &self,
         cli_codex_home: &Path,

src-tauri/shared/platform/mod.rs

@@ -44,8 +44,8 @@ pub fn open_or_activate_codex_app(codex_home: Option<&Path>) -> AppResult<String
     current_hooks().open_or_activate_codex_app(codex_home)
 }
 
-pub fn run_codex_login(codex_home: &Path) -> AppResult<()> {
-    current_hooks().run_codex_login(codex_home)
+pub fn run_codex_login(cli_codex_home: &Path, runtime_codex_home: &Path) -> AppResult<()> {
+    current_hooks().run_codex_login(cli_codex_home, runtime_codex_home)
 }
 
 pub fn run_codex_auth_refresh(cli_codex_home: &Path, runtime_codex_home: &Path) -> AppResult<()> {

src-tauri/shared/runtime/login_runtime.rs

@@ -205,7 +205,13 @@ pub fn login_profile_with_home<H: PlatformHooks + ?Sized>(
         )
     })?;
 
-    hooks.run_codex_login(runtime_home)?;
+    // Resolve the real codex binary against the live `~/.codex` (so the
+    // user's managed-shim filter and install-state cache work), but
+    // point the spawned process's CODEX_HOME at our sandboxed runtime
+    // dir. Without this split, a Windows codex shim that does
+    // `%CODEX_HOME%\\account_backup\\windows\\codex_switch_cli` would
+    // fail to find the script under the empty runtime home.
+    hooks.run_codex_login(&codex_home, runtime_home)?;
 
     let runtime_auth = runtime_home.join(RUNTIME_AUTH_FILENAME);
     if !runtime_auth.is_file() {
@@ -300,9 +306,13 @@ mod tests {
         ) -> Vec<String> {
             unreachable!("not used in login_runtime tests")
         }
-        fn run_codex_login(&self, codex_home: &Path) -> AppResult<()> {
+        fn run_codex_login(
+            &self,
+            _cli_codex_home: &Path,
+            runtime_codex_home: &Path,
+        ) -> AppResult<()> {
             *self.call_count.lock().unwrap() += 1;
-            fs::write(codex_home.join("auth.json"), &self.auth_payload).unwrap();
+            fs::write(runtime_codex_home.join("auth.json"), &self.auth_payload).unwrap();
             Ok(())
         }
         fn run_codex_auth_refresh(
@@ -440,7 +450,7 @@ mod tests {
             fn reopen_codex_app_if_needed(&self, _: bool, _: Option<&Path>) -> Vec<String> {
                 unreachable!()
             }
-            fn run_codex_login(&self, _: &Path) -> AppResult<()> {
+            fn run_codex_login(&self, _: &Path, _: &Path) -> AppResult<()> {
                 Ok(())
             }
             fn run_codex_auth_refresh(&self, _: &Path, _: &Path) -> AppResult<()> {

src-tauri/shared/runtime/switch_core.rs

@@ -149,7 +149,11 @@ mod tests {
             Vec::new()
         }
 
-        fn run_codex_login(&self, _codex_home: &Path) -> AppResult<()> {
+        fn run_codex_login(
+            &self,
+            _cli_codex_home: &Path,
+            _runtime_codex_home: &Path,
+        ) -> AppResult<()> {
             unreachable!("not used in switch_core tests")
         }
 

src-tauri/win/runtime/process.rs

@@ -351,8 +351,14 @@ fn build_auth_refresh_command(real_codex_path: &Path, runtime_codex_home: &Path)
     command
 }
 
-fn build_login_command(codex_home: &Path) -> Command {
-    let mut command = if let Some(real_codex_path) = resolve_real_codex_cli(Some(codex_home)) {
+/// Build the `codex login` command. Resolution of the real codex
+/// binary is anchored on `cli_codex_home` (the live `~/.codex`) so the
+/// managed-shim filter works correctly even when `runtime_codex_home`
+/// is a sandboxed sibling that doesn't have its own install state.
+/// `runtime_codex_home` is what the spawned process sees as
+/// `CODEX_HOME` and is where it will write `auth.json`.
+fn build_login_command(cli_codex_home: &Path, runtime_codex_home: &Path) -> Command {
+    let mut command = if let Some(real_codex_path) = resolve_real_codex_cli(Some(cli_codex_home)) {
         let mut command = Command::new(real_codex_path);
         command.arg("login");
         command
@@ -367,8 +373,8 @@ fn build_login_command(codex_home: &Path) -> Command {
     };
 
     hide_console_window(&mut command);
-    command.current_dir(codex_home);
-    command.env("CODEX_HOME", codex_home);
+    command.current_dir(runtime_codex_home);
+    command.env("CODEX_HOME", runtime_codex_home);
     command
 }
 
@@ -439,8 +445,10 @@ pub fn run_codex_auth_refresh(cli_codex_home: &Path, runtime_codex_home: &Path)
     Err(AppError::new("AUTH_REFRESH_FAILED", message))
 }
 
-pub fn run_codex_login(codex_home: &Path) -> AppResult<()> {
-    let output = build_login_command(codex_home).output().map_err(|error| {
+pub fn run_codex_login(cli_codex_home: &Path, runtime_codex_home: &Path) -> AppResult<()> {
+    let output = build_login_command(cli_codex_home, runtime_codex_home)
+        .output()
+        .map_err(|error| {
         AppError::new(
             "LOGIN_COMMAND_FAILED",
             format!("Failed to start `codex login`: {error}"),
@@ -537,8 +545,12 @@ impl PlatformHooks for WindowsPlatformHooks {
         reopen_codex_app_if_needed(app_was_running, codex_home)
     }
 
-    fn run_codex_login(&self, codex_home: &Path) -> AppResult<()> {
-        run_codex_login(codex_home)
+    fn run_codex_login(
+        &self,
+        cli_codex_home: &Path,
+        runtime_codex_home: &Path,
+    ) -> AppResult<()> {
+        run_codex_login(cli_codex_home, runtime_codex_home)
     }
 
     fn run_codex_auth_refresh(

src-tauri/win/runtime/profile_actions.rs

@@ -67,7 +67,7 @@ pub fn login_current_profile() -> AppResult<String> {
         ));
     }
 
-    platform::run_codex_login(&codex_home)?;
+    platform::run_codex_login(&codex_home, &codex_home)?;
 
     if !codex_home.join("auth.json").is_file() {
         return Err(AppError::new(

src-tauri/win/runtime/switch.rs

@@ -153,7 +153,11 @@ mod tests {
             Vec::new()
         }
 
-        fn run_codex_login(&self, _codex_home: &Path) -> AppResult<()> {
+        fn run_codex_login(
+            &self,
+            _cli_codex_home: &Path,
+            _runtime_codex_home: &Path,
+        ) -> AppResult<()> {
             unreachable!("not used in switch tests")
         }