fix(codex): harden duplicate-email account actions

tests/unit/cliproxy/quota-fetcher-codex.test.ts

@@ -365,14 +365,18 @@ describe('Codex Quota Fetcher', () => {
   });
 
   describe('fetchCodexQuota failure mapping', () => {
-    function createValidCodexAccount(email: string, accountId = `workspace-${email}`): void {
+    function createValidCodexAccount(
+      email: string,
+      accountId = `workspace-${email}`,
+      tokenFile?: string
+    ): void {
       createCodexAccount(email, {
         access_token: 'test-token',
         account_id: accountId,
         expired: '2099-01-01T00:00:00.000Z',
         email,
         type: 'codex',
-      });
+      }, tokenFile);
     }
 
     it('maps deactivated workspace 402 responses to structured metadata', async () => {
@@ -460,6 +464,43 @@ describe('Codex Quota Fetcher', () => {
       expect(headers.get('ChatGPT-Account-Id')).toBe('workspace-free');
     });
 
+    it('does not guess a duplicate-email Codex auth file when the registry entry is missing', async () => {
+      createValidCodexAccount(
+        'kaidu.kd@gmail.com',
+        'workspace-team',
+        'codex-legacy-slot-a.json'
+      );
+      createValidCodexAccount(
+        'kaidu.kd@gmail.com',
+        'workspace-free',
+        'codex-legacy-slot-b.json'
+      );
+
+      const fetchSpy = mock(() =>
+        Promise.resolve(
+          new Response(
+            JSON.stringify({
+              plan_type: 'free',
+              rate_limit: {
+                primary_window: { used_percent: 10, reset_after_seconds: 3600 },
+              },
+            }),
+            {
+              status: 200,
+              headers: { 'Content-Type': 'application/json' },
+            }
+          )
+        )
+      ) as typeof fetch;
+      global.fetch = fetchSpy;
+
+      const result = await fetchCodexQuota('kaidu.kd@gmail.com#04a0f049-team');
+
+      expect(result.success).toBe(false);
+      expect(result.errorCode).toBe('auth_file_missing');
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+
     it('maps 403 responses to forbidden metadata', async () => {
       createValidCodexAccount('forbidden@example.com', 'workspace-forbidden');