guard cli refresh token hydration

Author: ndycode

lib/accounts.ts

@@ -191,7 +191,7 @@ export class AccountManager {
 			if (
 				cachedAccessUsable &&
 				cached.refreshToken &&
-				cached.refreshToken !== account.refreshToken
+				!account.refreshToken
 			) {
 				account.refreshToken = cached.refreshToken;
 				changed = true;

test/accounts-edge.test.ts

@@ -182,7 +182,7 @@ describe("accounts edge branches", () => {
     const snapshot = manager.getAccountsSnapshot();
     const updated = snapshot[0];
     expect(updated?.access).toBe("refreshed-access");
-    expect(updated?.refreshToken).toBe("refreshed-refresh");
+    expect(updated?.refreshToken).toBe("refresh-1");
     expect(updated?.accountId).toBe("account-from-cache");
     expect(updated?.accountIdSource).toBe("token");
 
@@ -193,6 +193,44 @@ describe("accounts edge branches", () => {
     expect(expired?.accountIdSource).toBe("token");
   });
 
+  it("does not overwrite a local refresh token with a stale usable CLI cache token", async () => {
+    const now = Date.now();
+    const stored = buildStored([
+      buildStoredAccount({
+        refreshToken: "local-refresh-new",
+        email: "match@example.com",
+        accessToken: "local-access",
+        expiresAt: now + 120_000,
+      }),
+    ]);
+
+    const { AccountManager } = await importAccountsModule();
+    const manager = new AccountManager(undefined, stored as never);
+
+    mockLoadCodexCliState.mockResolvedValue({
+      sourceUpdatedAtMs: now - 60_000,
+      accounts: [
+        {
+          email: "match@example.com",
+          accessToken: "cached-access-old",
+          expiresAt: now + 300_000,
+          refreshToken: "cached-refresh-old",
+        },
+      ],
+    });
+
+    const hydrate = getPrivate<() => Promise<void>>(
+      manager as object,
+      "hydrateFromCodexCli",
+    );
+    await hydrate.call(manager);
+
+    const snapshot = manager.getAccountsSnapshot();
+    expect(snapshot[0]?.refreshToken).toBe("local-refresh-new");
+    expect(snapshot[0]?.access).toBe("local-access");
+    expect(mockSaveAccounts).not.toHaveBeenCalled();
+  });
+
   it("returns early when Codex CLI state has no usable cache entries", async () => {
     const stored = buildStored([
       buildStoredAccount({