fix: always copy fresh auth.json for codex spawn

Previously, auth.json was only copied to the isolated ~/.june/codex/
directory on first run. After `codex auth login` refreshed tokens,
the stale tokens in the isolated directory were never updated,
causing authentication failures.

Now always copies auth.json to pick up refreshed tokens.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: sky-xo

internal/codex/home.go

@@ -21,21 +21,13 @@ func EnsureCodexHome() (string, error) {
 	}
 
 	// Copy auth.json from user's ~/.codex/ if it exists
+	// Always copy to pick up refreshed tokens after re-authentication
 	userCodex := filepath.Join(home, ".codex")
 	authSrc := filepath.Join(userCodex, "auth.json")
 	authDst := filepath.Join(codexHome, "auth.json")
 
-	// Only copy if source exists and destination doesn't
-	// Use O_CREATE|O_EXCL for atomic create-if-not-exists to avoid TOCTOU race
 	if authData, err := os.ReadFile(authSrc); err == nil {
-		// Try to create the file exclusively - fails if it already exists
-		f, err := os.OpenFile(authDst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
-		if err == nil {
-			_, _ = f.Write(authData)
-			f.Close()
-		}
-		// Ignore errors - auth.json is optional (user may not have authenticated yet)
-		// or file already exists (which is fine - don't overwrite)
+		_ = os.WriteFile(authDst, authData, 0600)
 	}
 
 	return codexHome, nil

internal/codex/home_test.go

@@ -81,36 +81,36 @@ func TestEnsureCodexHome_NoAuthJsonOK(t *testing.T) {
 	}
 }
 
-func TestEnsureCodexHome_DoesNotOverwriteExistingAuthJson(t *testing.T) {
+func TestEnsureCodexHome_OverwritesAuthJsonWithFreshTokens(t *testing.T) {
 	tmpDir := t.TempDir()
 	origHome := os.Getenv("HOME")
 	os.Setenv("HOME", tmpDir)
 	defer os.Setenv("HOME", origHome)
 
-	// Create fake user codex with auth.json (source)
+	// Create fake user codex with auth.json (source - fresh tokens)
 	userCodex := filepath.Join(tmpDir, ".codex")
 	os.MkdirAll(userCodex, 0755)
-	newContent := []byte(`{"token":"new-token"}`)
-	os.WriteFile(filepath.Join(userCodex, "auth.json"), newContent, 0600)
+	freshContent := []byte(`{"token":"fresh-token"}`)
+	os.WriteFile(filepath.Join(userCodex, "auth.json"), freshContent, 0600)
 
-	// Pre-create june codex home with existing auth.json (destination)
+	// Pre-create june codex home with stale auth.json (destination)
 	juneCodex := filepath.Join(tmpDir, ".june", "codex")
 	os.MkdirAll(juneCodex, 0755)
-	existingContent := []byte(`{"token":"existing-token"}`)
-	os.WriteFile(filepath.Join(juneCodex, "auth.json"), existingContent, 0600)
+	staleContent := []byte(`{"token":"stale-token"}`)
+	os.WriteFile(filepath.Join(juneCodex, "auth.json"), staleContent, 0600)
 
-	// Call EnsureCodexHome - should NOT overwrite the existing auth.json
+	// Call EnsureCodexHome - should overwrite with fresh tokens
 	codexHome, err := EnsureCodexHome()
 	if err != nil {
 		t.Fatalf("EnsureCodexHome failed: %v", err)
 	}
 
-	// Verify auth.json was NOT overwritten
+	// Verify auth.json WAS overwritten with fresh tokens
 	data, err := os.ReadFile(filepath.Join(codexHome, "auth.json"))
 	if err != nil {
 		t.Fatalf("failed to read auth.json: %v", err)
 	}
-	if string(data) != string(existingContent) {
-		t.Errorf("auth.json was overwritten! got %q, want %q", string(data), string(existingContent))
+	if string(data) != string(freshContent) {
+		t.Errorf("auth.json not updated with fresh tokens: got %q, want %q", string(data), string(freshContent))
 	}
 }