fix(codex): use access_token.exp instead of id_token.exp for import expiresAt

[anki1kr]

Problem

When a Codex auth.json has an expired id_token but a still-valid access_token (common — the CLI keeps using tokens after export), the importer reads expiry from id_token.exp. This causes:

1. The connection appears expired immediately after import
2. OmniRoute triggers a proactive refresh
3. If the refresh_token was already rotated by the Codex CLI, the refresh returns invalid_grant → refresh_token becomes NULL
4. The connection is permanently broken

Root Cause

extractExpiresAt(idToken) only looked at the id token:

expiresAt: extractExpiresAt(idToken),

The id_token's exp claim carries its own TTL (often shorter), while the access_token.exp is the operationally relevant expiry.

Fix

extractExpiresAt now takes both tokens and selects in order:

1. access_token.exp — preferred (what actually gates API calls)
2. id_token.exp — fallback when access_token carries no exp claim
3. null — if neither has a decodeable exp

refresh_token is preserved exactly as-is; the "do NOT refresh-on-import" invariant from the existing code comment remains intact.

Tests

tests/unit/codex-auth-import-expiry.test.ts — 5 tests:

• uses access_token.exp when id_token.exp is expired
• falls back to id_token.exp when access_token has no exp claim
• returns null expiresAt when neither has exp
• uses access_token.exp when both have future expiries (prefers access)
• preserves refresh_token in all cases

Fixes #6075

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[diegosouzapw]

Merged — thank you, @anki1kr! 🙏 The core fix is exactly right: preferring access_token.exp over id_token.exp (with fallback) stops a valid connection from being marked expired on import and prevents the premature refresh that could invalidate the token family.

I reconstructed the branch on the current release tip to keep the PR scoped to just this fix — the original branch had picked up unrelated stacked/base-drift changes (the Zed OAuth provider from #6078, plus older serve.mjs/models/route.ts versions that predated the release's #5172/#5242/#5899 fixes). The Zed work stays with #6078. I also rewrote your regression test from vitest to node:test so it actually runs under the test-unit CI job (tests/unit/*.test.ts here is the Node native runner, not vitest) — it's a genuine guard: 2/5 cases fail without the fix, all 5 pass with it. Ships in the next release.