[codejunkienick]

Fixes #162

Summary

Codex CLI sessions attach to a shared app-server daemon that loads auth.json only at startup, so codex-auth switch looks like it does nothing. This PR makes the switch take effect: when the daemon is running, switch restarts it.

$ codex-auth switch beta
Switched to beta(beta@example.com)
Restarted the Codex app-server daemon; open Codex sessions reconnect with this account.

• Detection: <codex_home>/app-server-control/app-server-control.sock resolves. A stale symlink left by a stopped daemon doesn't count.
• Restart: runs <codex_home>/packages/app-server-daemon/current/bin/codex app-server daemon restart, which is the daemon's own managed binary, so there's no PATH lookup or version drift.
• Opt-out: codex-auth config daemon --restart off, stored as top-level codex_daemon_restart in registry.json. Default is on, and the setting is kept across import --purge. When it's off, switch prints a hint instead.
• Failure: a failed restart never fails the switch; a hint is printed instead.
• Modes: --json restarts silently and its output is unchanged. --live is unchanged.
• Refactor: the picker, <query> and - paths shared the same activate → save → print sequence. It's now one finishSwitch helper, so the restart lives in a single place.

Why a restart and not a reload

The app-server protocol has no method to re-read auth.json. The only way to inject tokens (account/login/start with chatgptAuthTokens) is marked "FOR OPENAI INTERNAL USE ONLY". A restart is cheap, though. Against a real 0.158 daemon, an attached codex TUI reconnected on its own ("Reconnected. No input was resent…"), kept its unsent draft, and /status reflected the new auth.json. The one cost is that a turn running at that moment is interrupted. That's why config daemon --restart off exists, and it's noted in docs/commands/switch.md.

The repo only prompts for destructive deletes (remove). A restart deletes nothing and sessions recover on their own, so this restarts without a prompt, similar to the heavier kill approach in #149.

Verification

• zig build test: 442 passed, 5 skipped. New tests: parser tests for config daemon, plus integration tests with a fake daemon for restart on, restart off, restart failed, and config persistence.
• zig build run -- list, and zig fmt --check src tests.
• End to end against a real isolated Codex 0.158 daemon with a throwaway CODEX_HOME:
  • Restart on: daemon PID changed, in 0.27s.
  • --restart off: PID unchanged, hint printed.
  • --json: PID changed, JSON output intact.

(Tested locally with -Dtarget=x86_64-linux-musl, because Zig 0.16's linker rejects the .sframe section in the glibc 2.44 crt1.o on my Arch machine (GCC 16, binutils 2.47). This is unrelated to the change.)

🤖 Generated with Claude Code

[DRanger666]

@codejunkienick, thanks for identifying and integrating the daemon restart here. @mdbaniani's workaround in #162—running codex app-server daemon restart after switching—is also correct. #164 uses that same mechanism; it is not a different underlying fix.

The differences from this PR are:

• Explicit per-command restart: switch <account> --restart-daemon, rather than restart-on-by-default with a persisted opt-out. No registry/schema change; users choose when to interrupt shared sessions.
• Responsive detection: a bounded daemon version probe, rather than endpoint existence alone. Confirmed absence skips restart; an indeterminate probe fails the explicit request without restarting.
• Bounded restart: 120 seconds, including helpers that close output pipes before exiting. Timeout reaps only our helper, preserves selected files, and reports the daemon outcome as unconfirmed.
• Visible failure: a requested restart failure returns exit 1, including JSON mode. Existing selection JSON stays on stdout; restart diagnostics go to stderr.

Real Codex 0.160.0 testing passed: unchanged-file recovery, no restart without the option, and A→B→A account verification through account/read with refreshToken: false. The attached chat reconnected without exit/resume. All 12 CI checks pass.

#164 is an alternative policy and lifecycle implementation for maintainer review; these improvements could also be incorporated here.

[Loongphy]

Closing as duplicate of #164, which implements the same daemon-restart fix and has been merged (plus a two-tier follow-up: non-disruptive auth reload on codex daemons, restart fallback for upstream daemons). Thanks for identifying the shared-daemon root cause — the fix is covered there.