test: close pr86 greptile follow-ups

Author: ndycode

lib/storage.ts

@@ -943,15 +943,6 @@ function normalizeFlaggedStorage(data: unknown): FlaggedAccountStorageV1 {
 		return { version: 1, accounts: [] };
 	}
 
-	// Flagged storage must keep sibling workspace entries separate when they share an
-	// organization but have different accountIds, so this key is more specific than
-	// the normal account identity collapse used in active storage.
-	const getFlaggedIdentityKey = (account: {
-		organizationId?: string;
-		accountId?: string;
-		refreshToken: string;
-	}): string => getWorkspaceIdentityKey(account);
-
 	const byIdentityKey = new Map<string, FlaggedAccountMetadataV1>();
 	for (const rawAccount of data.accounts) {
 		if (!isRecord(rawAccount)) continue;
@@ -1031,7 +1022,9 @@ function normalizeFlaggedStorage(data: unknown): FlaggedAccountStorageV1 {
 			flaggedReason: typeof rawAccount.flaggedReason === "string" ? rawAccount.flaggedReason : undefined,
 			lastError: typeof rawAccount.lastError === "string" ? rawAccount.lastError : undefined,
 		};
-		byIdentityKey.set(getFlaggedIdentityKey(normalized), normalized);
+		// Keep flagged dedup aligned with active cleanup so sibling workspaces only
+		// collapse when they resolve to the same shared workspace identity.
+		byIdentityKey.set(getWorkspaceIdentityKey(normalized), normalized);
 	}
 
 	return {

test/index.test.ts

@@ -272,7 +272,10 @@ const mockSaveFlaggedAccounts = vi.fn(async (nextStorage: typeof mockFlaggedStor
 	await persistMockFlaggedStorage(nextStorage);
 });
 
-vi.mock("../lib/storage.js", () => ({
+vi.mock("../lib/storage.js", async () => {
+	const actual = await vi.importActual<typeof import("../lib/storage.js")>("../lib/storage.js");
+
+	return {
 	getStoragePath: () => "/mock/path/accounts.json",
 	loadAccounts: vi.fn(async () => cloneMockStorage()),
 	saveAccounts: vi.fn(async (nextStorage: typeof mockStorage) => {
@@ -311,18 +314,7 @@ vi.mock("../lib/storage.js", () => ({
 	previewImportAccounts: vi.fn(async () => ({ imported: 2, skipped: 1, total: 5 })),
 	createTimestampedBackupPath: vi.fn((prefix?: string) => `/tmp/${prefix ?? "codex-backup"}-20260101-000000.json`),
 	loadFlaggedAccounts: vi.fn(async () => cloneMockFlaggedStorage()),
-	getWorkspaceIdentityKey: vi.fn((account: { organizationId?: string; accountId?: string; refreshToken: string }) => {
-		const organizationId = account.organizationId?.trim();
-		const accountId = account.accountId?.trim();
-		const refreshToken = account.refreshToken.trim();
-		if (organizationId) {
-			return accountId
-				? `organizationId:${organizationId}|accountId:${accountId}`
-				: `organizationId:${organizationId}`;
-		}
-		if (accountId) return `accountId:${accountId}`;
-		return `refreshToken:${refreshToken}`;
-	}),
+	getWorkspaceIdentityKey: vi.fn(actual.getWorkspaceIdentityKey),
 	saveFlaggedAccounts: mockSaveFlaggedAccounts,
 	withFlaggedAccountStorageTransaction: vi.fn(
 		async <T>(
@@ -347,7 +339,8 @@ vi.mock("../lib/storage.js", () => ({
 		}
 	},
 	formatStorageErrorHint: () => "Check file permissions",
-}));
+	};
+});
 
 vi.mock("../lib/accounts.js", () => {
 	class MockAccountManager {

test/storage.test.ts

@@ -20,6 +20,7 @@ import {
   importAccounts,
   previewImportAccounts,
   createTimestampedBackupPath,
+  getWorkspaceIdentityKey,
   withAccountStorageTransaction,
   withFlaggedAccountStorageTransaction,
 } from "../lib/storage.js";
@@ -30,6 +31,37 @@ import {
 // But Task 0 says: "Tests should fail initially (RED phase)"
 
 describe("storage", () => {
+  describe("getWorkspaceIdentityKey", () => {
+    it("uses organizationId and accountId when both are present", () => {
+      expect(
+        getWorkspaceIdentityKey({
+          organizationId: " org-shared ",
+          accountId: " workspace-a ",
+          refreshToken: " refresh-a ",
+        }),
+      ).toBe("organizationId:org-shared|accountId:workspace-a");
+    });
+
+    it("falls back to accountId when organizationId is missing", () => {
+      expect(
+        getWorkspaceIdentityKey({
+          accountId: " workspace-only ",
+          refreshToken: " refresh-b ",
+        }),
+      ).toBe("accountId:workspace-only");
+    });
+
+    it("falls back to refreshToken when workspace ids are missing", () => {
+      expect(
+        getWorkspaceIdentityKey({
+          organizationId: "   ",
+          accountId: "",
+          refreshToken: " refresh-c ",
+        }),
+      ).toBe("refreshToken:refresh-c");
+    });
+  });
+
   describe("deduplication", () => {
     it("remaps activeIndex after deduplication using active account key", () => {
       const now = Date.now();