codex login removes the existing auth.json before the flow can succeed, so a failed login logs the user out

[Bug] codex login removes the existing auth.json before the flow can succeed, so a failed login logs the user out

Component: Codex CLI (codex login, codex login --device-auth)
Version: tested on codex-cli 0.153.4 (linux-x86_64, musl standalone build)

Summary

codex login appears to delete the existing credentials at the start of the flow
rather than writing new ones atomically on success. If the flow fails at any later step
(browser not reachable, token exchange transport error, expired device code, wrong account
in the browser, …), the user is left logged out even though they were logged in before.

This turns a recoverable, transient failure into a destructive one, and it is especially
painful on headless/remote hosts where the only way to fix it is to re-run a login flow
that just failed.

Steps to reproduce

1. Have a working login: codex login status → Logged in using ChatGPT.

2. Start a new login that will fail late, for example while the token endpoint is
   temporarily unreachable:

   codex login --device-auth
   # complete the browser step
   # -> ERROR: Error logging in with device code: device code exchange failed:
   #    error sending request for url (https://auth.openai.com/oauth/token)
   

3. Check the state:

   ls ~/.codex/auth.json      # No such file or directory
   codex login status         # Not logged in
   

Observed twice in a live environment (a remote Linux host): the previously valid
auth.json was gone after a failed login attempt.

Expected

Either:

• the existing credentials are left untouched until the new ones are successfully
  obtained (write to a temp file, then atomically rename), or
• the old credentials are backed up and restored automatically when the flow fails,
  or at minimum
• the CLI warns that continuing will remove the current login.

Actual

The previous credentials are removed before the flow completes; a failed login means the
user must successfully complete a login (possibly under the same broken network
conditions) before Codex works again.

Impact

• On remote/headless machines, a single transient network error can take a working Codex
  installation offline until an operator can re-authenticate.
• Makes it risky to attempt a login (e.g. to switch accounts) while anything about the
  network path is uncertain.

Suggestion

• Write credentials atomically; only replace the previous file on success.
• On failure, restore the previous credentials and say so in the error output.
• Consider printing the target CODEX_HOME and whether an existing login will be
  replaced, since CODEX_HOME may point at a non-default directory.

Environment

codex-cli 0.153.4
Linux x86_64 (headless server), CODEX_HOME=/<user>/.codex (non-default path)
Reached OpenAI through a local HTTP proxy (HTTP_PROXY/HTTPS_PROXY set for the process)

Related issues

• #40267 — desktop sign-out caused by refresh-token rotation not being persisted
  (different mechanism: the token is invalidated, whereas here the file is removed by the
  login command itself before it can succeed).
• #39199 — two ChatGPT accounts invalidating each other's refresh tokens
  (adjacent symptom: credentials lost on a machine, but again not caused by codex login).

Minimal fix sketch

// pseudo-code: make credential replacement atomic and non-destructive on failure
let tmp = auth_path.with_extension("json.tmp");
write(tmp, &new_credentials)?;          // only after the flow has fully succeeded
fs::rename(tmp, auth_path)?;            // atomic replace
// on any failure path: leave the previous auth.json untouched

Start by tracing the codex login and codex login --device-auth flows, focusing on when ~/.codex/auth.json is removed or written. Reproduce a failed device-code exchange, then verify that the existing credentials remain after failure and are replaced only after a successful login.