fix(copilot): keep verified identity ahead of legacy names

[steipete]

A legacy Copilot token account can resolve to a different stable GitHub user ID and still be selected for reauthentication because its login or display label matches. The login flow then updates that saved account with the new token.

Keep resolved stable IDs authoritative. Search all token-resolved legacy accounts before accepting a label fallback, and retain that fallback only for accounts whose identity could not be resolved. The single-pass matcher removes one production line and preserves existing stable-ID and legacy external-login migration paths.

This narrower defect was found while investigating #3341; it does not resolve that PR's Enterprise-host routing scope.

Validation:

• Both baseline cases reproduced wrong account selection: equal login with a different ID, and a different login with a matching display label.
• 12 focused tests passed, including verified matches later in either account order, renamed users, unresolved fallback, stable-ID priority and legacy migration.
• make check passed with zero violations. Isolated P2 autoreview found no actionable findings.
• Full make test passed all 1,028 selections / 86 groups on the first pass without retries or timeouts (1,193.9 seconds). Exact-head CI passed.

Tests use injected synthetic identities and token stores; no real account requests or credentials were used. Changelog and provider documentation describe the identity precedence.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 6, 2026, 11:46 PM ET / September 7, 2026, 03:46 UTC.

ClawSweeper review

What this changes

The PR prevents Copilot reauthentication from replacing a legacy account whose resolved GitHub ID differs, with focused regression tests and documentation.

Merge readiness

✅ Ready for maintainer review

This PR addresses a source-confirmed defect still present on main and in v0.56.7. No introduced correctness defect was found; the related Enterprise-routing PR addresses separate behavior.

Priority: P2
Reviewed head: a8a77804ddd8b8fcda70ee3a616885f307adf218

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, maintainable repair with relevant regression coverage and no identified blocking defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The OWNER-authored PR is exempt from ordinary contributor runtime proof. Synthetic tests exercise the changed matcher; tracing its result into credential persistence found no introduced unresolved authority violation requiring additional final-effect proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The OWNER-authored PR is exempt from ordinary contributor runtime proof. Synthetic tests exercise the changed matcher; tracing its result into credential persistence found no introduced unresolved authority violation requiring additional final-effect proof.
Evidence reviewed	7 items	Introduced matching change: The pinned delta changes only legacy matching: resolved identities must have equal numeric IDs, and unresolved label candidates remain deferred until all eligible accounts are examined. Stable identifiers and legacy external-login matching remain unchanged. Current-main necessity: Main still accepts equal resolved logins despite differing IDs and subsequently permits label matching against successfully resolved accounts. These are the two concrete mismatch paths repaired here. Latest release comparison: The supplied latest release, v0.56.7, contains the same permissive legacy matcher; the requested fix is not already shipped there.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar matches a newly authenticated GitHub identity against saved Copilot accounts before updating credentials or adding an account. The saved token then feeds Copilot usage requests.

flowchart TD
  A[GitHub login and token] --> B[Resolve GitHub identity]
  C[Saved Copilot accounts] --> D[Match account identity]
  B --> D
  D --> E[Update matching account or add account]
  E --> F[Copilot usage requests]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and regression coverage	production -1 net line; tests +34 lines	The repair simplifies the matcher while adding coverage for identity mismatches and fallback ordering.

Technical review

Best possible solution:

Keep verified numeric identity authoritative for token-resolved legacy accounts while preserving unresolved-token recovery and existing identifier migration.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: on main, a legacy account resolving to a different ID can still match by login or display label and be selected for credential replacement. This review did not execute the scenario.

Is this the best way to solve the issue?

Yes. Tightening the existing matcher is a focused repair, preserves established recovery paths, and avoids changing storage or Enterprise routing.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 49f2dc916919.

Labels

Label changes:

• add P2: This is a bounded repair preventing incorrect saved-account replacement during Copilot reauthentication.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from ordinary contributor runtime proof. Synthetic tests exercise the changed matcher; tracing its result into credential persistence found no introduced unresolved authority violation requiring additional final-effect proof.

Label justifications:

• P2: This is a bounded repair preventing incorrect saved-account replacement during Copilot reauthentication.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from ordinary contributor runtime proof. Synthetic tests exercise the changed matcher; tracing its result into credential persistence found no introduced unresolved authority violation requiring additional final-effect proof.

Evidence

What I checked:

• Introduced matching change: The pinned delta changes only legacy matching: resolved identities must have equal numeric IDs, and unresolved label candidates remain deferred until all eligible accounts are examined. Stable identifiers and legacy external-login matching remain unchanged. (Sources/CodexBar/Providers/Copilot/CopilotLoginFlow.swift:188, a8a77804ddd8)
• Current-main necessity: Main still accepts equal resolved logins despite differing IDs and subsequently permits label matching against successfully resolved accounts. These are the two concrete mismatch paths repaired here. (Sources/CodexBar/Providers/Copilot/CopilotLoginFlow.swift:188, 49f2dc916919)
• Latest release comparison: The supplied latest release, v0.56.7, contains the same permissive legacy matcher; the requested fix is not already shipped there. (Sources/CodexBar/Providers/Copilot/CopilotLoginFlow.swift:188, d8f4cec19b82)
• Credential-write boundary: The login flow passes the matched account UUID to updateTokenAccount; a nil match adds a separate account. The settings implementation updates that UUID within Copilot configuration and preserves other accounts. The patch changes selection, not the persisted schema or credential transport. (Sources/CodexBar/SettingsStore+TokenAccounts.swift:106, a8a77804ddd8)
• Regression and compatibility coverage: New tests reject different IDs with matching logins or labels and verify stable matches in either account order plus unresolved fallback. Existing tests cover identifier priority, renamed accounts, legacy decoding, identifier backfill, and persistence. The captured PR body reports 12 focused tests and make check passing, explicitly using synthetic identities; no runtime execution was performed during this read-only review. (Tests/CodexBarTests/CopilotMultiAccountTests.swift:177, a8a77804ddd8)
• Related work remains distinct: The supplied discussion identifies Fix GitHub Enterprise Copilot tracking #3341 as an open Enterprise-host routing change with redacted live Enterprise evidence. This PR explicitly excludes that scope; the current identity fetcher still uses the public GitHub endpoint. (Sources/CodexBarCore/Providers/Copilot/CopilotUsageFetcher.swift:128, a8a77804ddd8)

Likely related people:

• Alasdair McCall: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.