fix(codex-auth): stop identity-based duplicate blocking

Author: lidge-jun

devlog/_plan/260624_codex-multi-auth-security-implementation/40_phase40-manual-import-disable.md

@@ -219,7 +219,7 @@ Required imports:
 Assertions:
 
 - `checkAccountIdCollision("shared-team-account", "member-b@example.test")` returns no collision when an existing pool account has the same ChatGPT account id but a different email;
-- `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")` returns collision for the same normalized email.
+- Correction 2026-06-27: `checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")` also returns no collision. ChatGPT account id plus email is not an authoritative duplicate key because one user can legitimately hold both personal and business subscriptions. Duplicate prevention remains scoped to local alias/credential lifecycle checks.
 
 ### MODIFY `src/codex-auth-api.ts` OAuth wording
 

src/codex-auth-collision.ts

@@ -1,9 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import os from "node:os";
-import { getCodexAccountCredential, listCodexAccountIds } from "./codex-account-store";
-import { loadConfig } from "./config";
-import { extractAccountId, extractEmail } from "./oauth/chatgpt";
+import { extractAccountId } from "./oauth/chatgpt";
 
 export function readCodexTokens(): { access_token: string; account_id: string; id_token?: string } | null {
   try {
@@ -28,39 +26,11 @@ export function getMainChatgptAccountId(): string | null {
   return extractAccountId(tokens.id_token, tokens.access_token) ?? (tokens.account_id || null);
 }
 
-function getMainChatgptEmail(): string | null {
-  const tokens = readCodexTokens();
-  if (!tokens) return null;
-  return extractEmail(tokens.id_token, tokens.access_token) ?? null;
-}
-
-function normalizedEmail(email: string | undefined | null): string | null {
-  const trimmed = email?.trim().toLowerCase();
-  return trimmed || null;
-}
-
-function poolEmailForId(id: string): string | null {
-  const account = (loadConfig().codexAccounts ?? []).find(a => a.id === id);
-  return normalizedEmail(account?.email);
-}
-
-// Business/Team members can share chatgpt_account_id, so require email match too.
+// ChatGPT account ids and emails are not authoritative duplicate keys:
+// one user can legitimately hold both personal and business subscriptions.
 export function checkAccountIdCollision(
-  chatgptAccountId: string,
-  email?: string | null,
+  _chatgptAccountId: string,
+  _email?: string | null,
 ): { collision: true; reason: string } | { collision: false } {
-  const candidateEmail = normalizedEmail(email);
-  const mainId = getMainChatgptAccountId();
-  const mainEmail = getMainChatgptEmail();
-  if (mainId && mainId === chatgptAccountId && (!candidateEmail || !mainEmail || mainEmail === candidateEmail)) {
-    return { collision: true, reason: "This account is your main Codex login. Use a different account for the pool." };
-  }
-  for (const poolId of listCodexAccountIds()) {
-    const cred = getCodexAccountCredential(poolId);
-    const poolEmail = poolEmailForId(poolId);
-    if (cred && cred.chatgptAccountId === chatgptAccountId && (!candidateEmail || !poolEmail || poolEmail === candidateEmail)) {
-      return { collision: true, reason: `Account is already in the pool (${poolId}).` };
-    }
-  }
   return { collision: false };
 }

tests/codex-auth-collision.test.ts

@@ -54,13 +54,11 @@ describe("codex auth account collision", () => {
     });
   });
 
-  test("rejects the same team member added twice", async () => {
+  test("allows the same email and account id because personal and business subscriptions can coexist", async () => {
     seedAccount("team-member-a", "member-a@example.test", "shared-team-account");
 
-    const result = checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test");
-    expect(result.collision).toBe(true);
-    if (result.collision) {
-      expect(result.reason).toContain("Account is already in the pool");
-    }
+    expect(checkAccountIdCollision("shared-team-account", "MEMBER-A@example.test")).toEqual({
+      collision: false,
+    });
   });
 });