From 1af6dad41d43150549def8993b660ea94f9101b5 Mon Sep 17 00:00:00 2001
From: celia-oai <celia@openai.com>
Date: Tue, 9 Jun 2026 13:32:28 -0700
Subject: [PATCH] comment

---
 codex-rs/login/src/auth/storage.rs       |  7 ++++-
 codex-rs/login/src/auth/storage_tests.rs | 36 ++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/codex-rs/login/src/auth/storage.rs b/codex-rs/login/src/auth/storage.rs
index 55a7b843d7..4e20917d50 100644
--- a/codex-rs/login/src/auth/storage.rs
+++ b/codex-rs/login/src/auth/storage.rs
@@ -262,6 +262,7 @@ impl AuthStorageBackend for DirectKeyringAuthStorage {
 #[derive(Clone)]
 struct SecretsKeyringAuthStorage {
     codex_home: PathBuf,
+    direct_storage: DirectKeyringAuthStorage,
     secrets_manager: SecretsManager,
 }
 
@@ -275,6 +276,8 @@ impl Debug for SecretsKeyringAuthStorage {
 
 impl SecretsKeyringAuthStorage {
     fn new(codex_home: PathBuf, keyring_store: Arc<dyn KeyringStore>) -> Self {
+        let direct_storage =
+            DirectKeyringAuthStorage::new(codex_home.clone(), Arc::clone(&keyring_store));
         let secrets_manager = SecretsManager::new_with_keyring_store(
             codex_home.clone(),
             SecretsBackendKind::Local,
@@ -282,6 +285,7 @@ impl SecretsKeyringAuthStorage {
         );
         Self {
             codex_home,
+            direct_storage,
             secrets_manager,
         }
     }
@@ -332,7 +336,8 @@ impl AuthStorageBackend for SecretsKeyringAuthStorage {
                 ))
             })?;
         let file_removed = delete_file_if_exists(&self.codex_home)?;
-        Ok(keyring_removed || file_removed)
+        let direct_removed = self.direct_storage.delete()?;
+        Ok(keyring_removed || file_removed || direct_removed)
     }
 }
 
diff --git a/codex-rs/login/src/auth/storage_tests.rs b/codex-rs/login/src/auth/storage_tests.rs
index 12a78246c8..76ad5e3f72 100644
--- a/codex-rs/login/src/auth/storage_tests.rs
+++ b/codex-rs/login/src/auth/storage_tests.rs
@@ -506,6 +506,42 @@ fn secrets_keyring_auth_storage_delete_removes_keyring_and_file() -> anyhow::Res
     Ok(())
 }
 
+#[test]
+fn secrets_keyring_auth_storage_delete_removes_legacy_direct_keyring_entry() -> anyhow::Result<()> {
+    let codex_home = tempdir()?;
+    let mock_keyring = MockKeyringStore::default();
+    let direct_storage = DirectKeyringAuthStorage::new(
+        codex_home.path().to_path_buf(),
+        Arc::new(mock_keyring.clone()),
+    );
+    direct_storage.save(&auth_with_prefix("legacy-direct"))?;
+    let storage = SecretsKeyringAuthStorage::new(
+        codex_home.path().to_path_buf(),
+        Arc::new(mock_keyring.clone()),
+    );
+    let auth = auth_with_prefix("to-delete");
+    let auth_file = seed_secrets_backend_and_fallback_auth_file_for_delete(
+        &mock_keyring,
+        codex_home.path(),
+        &auth,
+    )?;
+
+    let removed = storage.delete()?;
+
+    assert!(removed, "delete should report removal");
+    assert_eq!(storage.load()?, None, "encrypted auth should be removed");
+    assert_eq!(
+        direct_storage.load()?,
+        None,
+        "legacy direct keyring auth should be removed"
+    );
+    assert!(
+        !auth_file.exists(),
+        "fallback auth.json should be removed after keyring delete"
+    );
+    Ok(())
+}
+
 #[test]
 fn auto_auth_storage_load_prefers_keyring_value() -> anyhow::Result<()> {
     let codex_home = tempdir()?;