fix(codex): serialize enrichment writes and sync plan into OAuth attributes

- Persist List-path subscription enrichment under the store mutex with a
  re-read+merge of only the subscription keys, so a token refresh/login Save
  racing the enrichment can no longer have its fresh access/refresh tokens
  rolled back by a stale-read rename.
- In the management Codex OAuth flow, mirror the enriched plan_type and expiry
  into record.Attributes before saving, so a Free/Plus/Team account added via
  the management flow is registered with the correct model catalog instead of
  defaulting to Pro until a later file rescan.

Test: persist merges subscription fields without clobbering on-disk tokens.

Author: drwpls

internal/api/handlers/management/auth_files.go

@@ -2299,6 +2299,19 @@ func (h *Handler) RequestCodexToken(c *gin.Context) {
 			Storage:  tokenStorage,
 			Metadata: metadata,
 		}
+		// Mirror the enriched subscription fields into attributes the runtime
+		// reads (sdk/cliproxy/service.go selects the Codex model catalog from
+		// Attributes["plan_type"]); without this a Free/Plus/Team account added
+		// through this flow would be registered as the default plan.
+		if record.Attributes == nil {
+			record.Attributes = make(map[string]string)
+		}
+		if planType, ok := metadata["plan_type"].(string); ok && strings.TrimSpace(planType) != "" {
+			record.Attributes["plan_type"] = strings.TrimSpace(planType)
+		}
+		if expiry, ok := metadata["subscription_active_until"].(string); ok && strings.TrimSpace(expiry) != "" {
+			record.Attributes["subscription_active_until"] = strings.TrimSpace(expiry)
+		}
 		savedPath, errSave := h.saveTokenRecord(ctx, record)
 		if errSave != nil {
 			SetOAuthSessionError(state, "Failed to save authentication tokens")

sdk/auth/filestore.go

@@ -296,7 +296,7 @@ func (s *FileTokenStore) readAuthFile(ctx context.Context, path, baseDir string)
 		changed, _ := codex.EnrichSubscriptionMetadata(enrichCtx, metadata, http.DefaultClient)
 		cancelEnrich()
 		if changed {
-			_ = writeAuthMetadataFile(path, metadata)
+			s.persistCodexSubscriptionFields(path, metadata)
 		}
 	}
 	info, errStat = os.Stat(path)
@@ -343,6 +343,43 @@ func (s *FileTokenStore) readAuthFile(ctx context.Context, path, baseDir string)
 	return auth, nil
 }
 
+// codexSubscriptionMetadataKeys are the only keys the List-path enrichment is
+// allowed to write back, so a concurrent token Save is never rolled back.
+var codexSubscriptionMetadataKeys = []string{
+	"plan_type",
+	"subscription_active_until",
+	"subscription_expired",
+	"chatgpt_account_id",
+	"account_id",
+	"chatgpt_subscription_active_until",
+	"chatgpt_subscription_last_checked",
+}
+
+// persistCodexSubscriptionFields writes the enriched subscription fields back
+// to disk under the store mutex (the same lock Save uses). It re-reads the
+// current file and merges only the subscription keys, so a token refresh/login
+// Save racing the enrichment cannot have its fresh access/refresh tokens
+// clobbered by a stale read taken before the network call.
+func (s *FileTokenStore) persistCodexSubscriptionFields(path string, enriched map[string]any) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	data, errRead := os.ReadFile(path)
+	if errRead != nil || len(data) == 0 {
+		return
+	}
+	current := make(map[string]any)
+	if errUnmarshal := json.Unmarshal(data, &current); errUnmarshal != nil {
+		return
+	}
+	for _, key := range codexSubscriptionMetadataKeys {
+		if value, ok := enriched[key]; ok {
+			current[key] = value
+		}
+	}
+	_ = writeAuthMetadataFile(path, current)
+}
+
 func writeAuthMetadataFile(path string, metadata map[string]any) error {
 	raw, errMarshal := json.Marshal(metadata)
 	if errMarshal != nil {

sdk/auth/filestore_metadata_write_test.go

@@ -98,3 +98,41 @@ func TestList_CopiesCodexPlanTypeIntoAttributes(t *testing.T) {
 		t.Fatalf("Attributes[subscription_active_until] = %q, want %s", got, future)
 	}
 }
+
+func TestPersistCodexSubscriptionFields_DoesNotClobberTokens(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "codex.json")
+	// Simulate the latest on-disk state written by a concurrent token Save.
+	if err := os.WriteFile(path, []byte(`{"type":"codex","access_token":"fresh","refresh_token":"fresh-r"}`), 0o600); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+
+	store := NewFileTokenStore()
+	store.SetBaseDir(dir)
+	// Enrichment built from a STALE read (old tokens) plus new subscription info.
+	enriched := map[string]any{
+		"access_token":              "stale",
+		"refresh_token":             "stale-r",
+		"plan_type":                 "plus",
+		"subscription_active_until": "2030-01-01T00:00:00Z",
+		"subscription_expired":      false,
+	}
+	store.persistCodexSubscriptionFields(path, enriched)
+
+	raw, _ := os.ReadFile(path)
+	var got map[string]any
+	if err := json.Unmarshal(raw, &got); err != nil {
+		t.Fatalf("unmarshal %q: %v", string(raw), err)
+	}
+	// Tokens must remain the fresh on-disk values, not be rolled back.
+	if got["access_token"] != "fresh" || got["refresh_token"] != "fresh-r" {
+		t.Fatalf("tokens were clobbered: %s", string(raw))
+	}
+	// Subscription fields must be written.
+	if got["plan_type"] != "plus" {
+		t.Fatalf("plan_type not persisted: %s", string(raw))
+	}
+	if got["subscription_active_until"] != "2030-01-01T00:00:00Z" {
+		t.Fatalf("expiry not persisted: %s", string(raw))
+	}
+}