fix: keep Codex account switcher labels private and distinct

[zenibako]

Honors Hide Personal Info in the Codex account switcher’s titles and tooltips. The switcher previously displayed raw identity while the card below it hid the same email.

The maintainer pass also fixes two gaps in the proposal: workspace labels can themselves contain an email, and generated collision suffixes can collide with a real workspace name. Private labels now prefix an account number and reuse the existing email redactor for workspace hints. If a hint still looks like an email, the label uses only its number. Narrow buttons preserve the number instead of truncating away the discriminator. Numbering follows persisted stored-account slots, so promotion to the live CLI role does not renumber the same account. Normal labels and selection callbacks are unchanged.

The view is extracted from the large switcher file, and the existing test accessors are reused. Provider docs are updated. The 0.59.1 changelog records this fix and companion #3548.

Validation:

• Four regression assertions reproduced workspace-email leakage, generated-name collisions and ambiguous shortened labels on the proposal. Four more reproduced account-number drift during live-system promotion; the real projection tests now cover that transition.
• 79 focused tests across four suites passed, including existing workspace/selection and architecture checks.
• The final full suite, including the promotion regression, passed all 1,068 selections across 89 groups on the first attempt, with no retries or timeouts (998.6 seconds).
• make check: zero violations across 2,181 files. Independent P0–P2 review is clean.
• Developer-ID-signed synthetic native before/after tests passed in Light and Dark appearances, with privacy on at 320/150 points and off at 320 points. Actual button titles/tooltips are checked, and 24 selection callbacks per run selected the correct stable IDs. No real credentials or account switching were used.
• Final-head CI passed all checks.

Thanks @zenibako!

Inspected synthetic native before/after proof

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 662ed6534c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 11, 2026, 3:13 AM ET / 07:13 UTC (Revision 2).

ClawSweeper review

What this changes

The PR makes Codex account-switcher titles and tooltips honor Hide Personal Info, preserves distinct account numbers in narrow layouts, and adds regression coverage and documentation.

Merge readiness

⛔ Needs changes before merge - 1 item remains

The fix remains necessary on main. Both previous findings are resolved, and the inspected native proof supports the revised presentation. No blocking patch defect was found.

Priority: P2
Reviewed head: 7e1c6aa64c8b02083298c511cd5a1e1e6495f2a3

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, maintainable repair with resolved prior findings, relevant native evidence, and targeted regression coverage.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (screenshot): The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
Evidence reviewed	8 items	Main still exposes switcher identity: The main switcher assigns menuDisplayName directly to tooltips and uses email-containing titles without accepting the privacy setting. The existing card renderer already applies PersonalInfoRedactor, establishing the expected behavior. Latest release has the same gap: The v0.59.0 switcher also assigns the unredacted menuDisplayName to its tooltip; the requested fix is not already shipped in the supplied latest release. Previous findings repaired: The labeling helper reuses email redaction, rejects remaining @ text, and prefixes every private label with a distinct ordinal. The extracted view preserves that ordinal when shortening titles. Comparing the extracted class with main showed that selection and mouse-handling code were carried forward unchanged.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar builds its account switcher from visible Codex accounts and the existing privacy preference. Display labels identify buttons, while unchanged account IDs and callbacks control selection.

flowchart TD
 A[Visible Codex accounts] --> C[Switcher labeling]
 B[Privacy preference] --> C
 C --> D[Numbered private labels]
 C --> E[Original account labels]
 D --> F[Buttons and tooltips]
 E --> F
 F --> G[Select original account ID]

Loading

Before merge

• Complete next step (P2) - Honor the documented landing order: merge fix(codex): keep pending migration paths ahead of reseeded files #3548 first, since this PR includes its changelog entry.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +63 net lines; tests +335 net lines	Most apparent production additions relocate the existing view; net growth supports private labeling and focused regression/native coverage.
Previous findings	2 resolved; 0 remaining	Embedded workspace emails and generated-label collisions are addressed by the current implementation.

Technical review

Best possible solution:

Keep privacy masking in the presentation layer, reuse the existing redactor, and preserve account identity and selection behavior.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: enable Hide Personal Info and display Codex accounts; main still builds switcher titles and tooltips from unredacted identity fields. This review did not execute the app.

Is this the best way to solve the issue?

Yes. The patch extends the existing privacy preference and redactor to the missing presentation surface without changing stored accounts, authentication, or selection callbacks.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f277e7ee6afd.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: This repairs a bounded privacy-presentation defect in the Codex account switcher.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
• proof: sufficient: Contributor real behavior proof is sufficient. The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The inspected before/after native captures exercise the production switcher with fictional accounts at 320/150 points and privacy on/off; the accompanying signed-run report and harness cover actual tooltip values and unchanged selection callbacks. This is sufficient for the changed presentation path, without requiring real credentials.

Evidence

What I checked:

• Main still exposes switcher identity: The main switcher assigns menuDisplayName directly to tooltips and uses email-containing titles without accepting the privacy setting. The existing card renderer already applies PersonalInfoRedactor, establishing the expected behavior. (Sources/CodexBar/StatusItemController+SwitcherViews.swift:1424, f277e7ee6afd)
• Latest release has the same gap: The v0.59.0 switcher also assigns the unredacted menuDisplayName to its tooltip; the requested fix is not already shipped in the supplied latest release. (Sources/CodexBar/StatusItemController+SwitcherViews.swift:1424, dca9c5f4b7a2)
• Previous findings repaired: The labeling helper reuses email redaction, rejects remaining @ text, and prefixes every private label with a distinct ordinal. The extracted view preserves that ordinal when shortening titles. Comparing the extracted class with main showed that selection and mouse-handling code were carried forward unchanged. (Sources/CodexBar/CodexAccountSwitcherLabeling.swift:31, 7e1c6aa64c8b)
• Stable identity and regression coverage: Regression coverage includes embedded emails, generated-looking workspace names, narrow titles, original labels with privacy disabled, and persisted account-slot numbering through live-system promotion. The production projection preserves storedAccountID during that transition. (Tests/CodexBarTests/CodexWorkspaceDisplayTests.swift:82, 7e1c6aa64c8b)
• Inspected native before/after proof: Inspected all four prepared images from the captured PR body. The native production view shows repaired private labels at 320 points and distinct numbers at 150 points in the Light capture, with original presentation retained when privacy is off. The Dark capture's narrow selected fourth digit is not legible, so that cell alone is not evidence of visibility. The reported signed native run and inspected harness check actual titles/tooltips and 24 selection callbacks per run. Attachments: https://github.com/user-attachments/assets/92f8d917-aa37-41b3-9d8b-6016caccc1e5 and https://github.com/user-attachments/assets/e3a5f16c-9742-4b73-839d-36a3c8d4a50b. (Tests/CodexBarTests/CodexSwitcherPrivacyNativeProofTests.swift:88, 7e1c6aa64c8b)
• Relevant merged history: Current-main history lists Peter Steinberger's workspace disambiguation and subsequent account-ownership changes. The supplied GitHub metadata verifies fix(codex): distinguish same-email workspace labels #3351 as merged; it addresses workspace ambiguity rather than this switcher privacy gap. (Sources/CodexBarCore/Providers/Codex/CodexVisibleAccountProjection.swift, 2ff41951c0e0)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Zihao Qi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-11T03:21:27.301Z sha 662ed65 :: needs real behavior proof before merge. :: [P2] Redact embedded emails before returning workspace labels | [P2] Check uniqueness after adding account suffixes

[steipete]

Landed as 4cfb60692bd. Hide Personal Info now reaches switcher titles and tooltips, including email-like workspace labels. Numbered labels stay distinguishable in narrow buttons, and stored-account identity keeps their numbers stable when an account becomes the live CLI account. Thanks @zenibako.

Verification used isolated model/projection fixtures and a Developer-ID-signed native window:

swift test --filter 'CodexAccountSwitcherRedactionTests|StatusMenuCodexSwitcherTests|CodexWorkspaceDisplayTests|ProviderArchitectureGatekeeperTests'
make check
make test

The commands ran through the credential/session-isolating test wrapper. The original proposal failed four privacy/collision assertions, and the first revision failed four promotion-stability assertions; all are covered by the final regressions. The focused run passed 79 tests. The final full suite passed all 1,068 selections / 89 groups on the first attempt, with no retries or timeouts. Lint reported zero violations, independent P0–P2 review was clean, and exact-head CI passed.

The signed CodexSwitcherPrivacyNativeProofTests fixture verified Light/Dark appearances, privacy on at 320/150 points, privacy off at 320 points, actual titles/tooltips and 24 button-selection callbacks per run. The inspected synthetic before/after captures are embedded in the PR body. No real account or credentials were used. Docs and the 0.59.1 Unreleased changelog include both this fix and #3548.