fix(codex-auth): address review focus areas

tests/unit/codex-auth/codex-config-symlink.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, it, mock, spyOn } from 'bun:test';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -19,6 +19,7 @@ beforeEach(async () => {
 });
 
 afterEach(() => {
+  mock.restore();
   fs.rmSync(tempDir, { recursive: true, force: true });
 });
 
@@ -104,4 +105,29 @@ describe('ensureSharedConfigSymlink', () => {
     expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
     expect(fs.readlinkSync(linkPath)).toBe(sharedConfigPath);
   });
+
+  it('copies shared config when symlink creation fails', () => {
+    fs.writeFileSync(sharedConfigPath, 'model = "gpt-5.5"\n', { mode: 0o600 });
+    const linkPath = path.join(profileDir, 'config.toml');
+    const symlinkSpy = spyOn(fs, 'symlinkSync').mockImplementation(() => {
+      throw Object.assign(new Error('simulated symlink failure'), { code: 'EPERM' });
+    });
+    const stderrChunks: string[] = [];
+    const origWrite = process.stderr.write.bind(process.stderr);
+    process.stderr.write = (chunk: string | Uint8Array): boolean => {
+      stderrChunks.push(typeof chunk === 'string' ? chunk : chunk.toString());
+      return true;
+    };
+
+    try {
+      ensureSharedConfigSymlink(profileDir, sharedConfigPath);
+    } finally {
+      process.stderr.write = origWrite;
+      symlinkSpy.mockRestore();
+    }
+
+    expect(fs.lstatSync(linkPath).isFile()).toBe(true);
+    expect(fs.readFileSync(linkPath, 'utf8')).toBe('model = "gpt-5.5"\n');
+    expect(stderrChunks.join('')).toContain('symlink unavailable');
+  });
 });

tests/unit/codex-auth/commands/use-command.test.ts

@@ -48,6 +48,8 @@ async function captureStreams(
   const stderrChunks: string[] = [];
   const origOut = process.stdout.write.bind(process.stdout);
   const origErr = process.stderr.write.bind(process.stderr);
+  const origConsoleLog = console.log;
+  const origConsoleError = console.error;
   process.stdout.write = (chunk: string | Uint8Array) => {
     stdoutChunks.push(String(chunk));
     return true;
@@ -56,11 +58,19 @@ async function captureStreams(
     stderrChunks.push(String(chunk));
     return true;
   };
+  console.log = (...args: unknown[]) => {
+    stdoutChunks.push(`${args.map(String).join(' ')}\n`);
+  };
+  console.error = (...args: unknown[]) => {
+    stderrChunks.push(`${args.map(String).join(' ')}\n`);
+  };
   try {
     await fn();
   } finally {
     process.stdout.write = origOut;
     process.stderr.write = origErr;
+    console.log = origConsoleLog;
+    console.error = origConsoleError;
   }
   return { stdout: stdoutChunks.join(''), stderr: stderrChunks.join('') };
 }
@@ -176,6 +186,33 @@ describe('handleUseCodex — shell syntax', () => {
     expect(exitCode).toBeGreaterThan(0);
     expect(stderr).toContain('Unsupported');
   });
+
+  it('unknown option → stderr usage, empty stdout', async () => {
+    const { handleUseCodex } = await import('../../../../src/codex-auth/commands/use-command');
+    const ctx = await makeCtxWithProfile('work');
+
+    let exitCode = -1;
+    const origExit = process.exit;
+    process.exit = (code?: number) => {
+      exitCode = code ?? 0;
+      throw new Error('exit');
+    };
+
+    const { stdout, stderr } = await captureStreams(async () => {
+      try {
+        await handleUseCodex(ctx, ['work', '--bad-flag']);
+      } catch {
+        /* process.exit */
+      }
+    }).finally(() => {
+      process.exit = origExit;
+    });
+
+    expect(stdout).toBe('');
+    expect(exitCode).toBeGreaterThan(0);
+    expect(stderr).toContain('Usage:');
+    expect(stderr).toContain('Unknown options');
+  });
 });
 
 // ── missing profile → stderr only ────────────────────────────────────────────