fix: match login fallback variants by identity

Author: ndycode

lib/auth/login-runner.ts

@@ -119,8 +119,19 @@ export function applyAccountSelectionFallbacks(
 	fallbacks: AccountSelectionFallbacks,
 ): AccountSelectionResult {
 	const primary = { ...selection.primary };
+	const primaryAccountId = selection.primary.accountIdOverride?.trim();
+	const primaryOrganizationId = selection.primary.organizationIdOverride?.trim();
+	const shouldReusePrimaryVariant =
+		(primaryAccountId?.length ?? 0) > 0 || (primaryOrganizationId?.length ?? 0) > 0;
+	// Callers may deep-clone `selection.primary`, so reuse the updated primary by
+	// persisted account identity instead of relying on object aliasing.
 	let variantsForPersistence = selection.variantsForPersistence.map((variant) =>
-		variant === selection.primary ? primary : { ...variant },
+		variant === selection.primary ||
+		(shouldReusePrimaryVariant &&
+			(variant.accountIdOverride?.trim() ?? "") === (primaryAccountId ?? "") &&
+			(variant.organizationIdOverride?.trim() ?? "") === (primaryOrganizationId ?? ""))
+			? primary
+			: { ...variant },
 	);
 
 	const accountIdOverride = fallbacks.accountIdOverride?.trim();

test/login-runner.test.ts

@@ -8,6 +8,7 @@ import {
 	persistResolvedAccountSelection,
 	resolveAccountSelection,
 	resolveAndPersistAccountSelection,
+	type AccountSelectionResult,
 	type TokenSuccessWithAccount,
 } from "../lib/auth/login-runner.js";
 import { loadAccounts, setStoragePathDirect } from "../lib/storage.js";
@@ -125,6 +126,34 @@ describe("login-runner selection finalization", () => {
 		expect(updated.variantsForPersistence).toHaveLength(selection.variantsForPersistence.length);
 	});
 
+	it("updates cloned primary variants without relying on object identity", () => {
+		const primary: TokenSuccessWithAccount = {
+			type: "success",
+			access: "access-token",
+			refresh: "refresh-token",
+			expires: Date.now() + 60_000,
+			idToken: "id-token",
+			accountIdOverride: "resolved-account",
+			accountIdSource: "token",
+		};
+		const selection: AccountSelectionResult = {
+			primary,
+			variantsForPersistence: [{ ...primary }],
+		};
+
+		const updated = applyAccountSelectionFallbacks(selection, {
+			organizationIdOverride: "resolved-org",
+			accountLabel: "Resolved label",
+		});
+
+		expect(updated.primary.organizationIdOverride).toBe("resolved-org");
+		expect(updated.primary.accountLabel).toBe("Resolved label");
+		expect(updated.variantsForPersistence).toHaveLength(1);
+		expect(updated.variantsForPersistence[0]).toBe(updated.primary);
+		expect(updated.variantsForPersistence[0]?.organizationIdOverride).toBe("resolved-org");
+		expect(updated.variantsForPersistence[0]?.accountLabel).toBe("Resolved label");
+	});
+
 	it("resolves and persists the selected variants through the shared callback", async () => {
 		const persistSelections = vi.fn(async () => {});
 		const result = await resolveAndPersistAccountSelection(