port: keep Codex account labels private on Windows - #491

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Thermo-nuclear code-quality review (Oracle-coordinated read-only swarm)

Verdict: PASS for merge readiness; no merge-blocking thermo finding.

The privacy behavior is localized to the Codex account menu and covered in both Rust and React tests. Hidden labels no longer expose email-like metadata, and the opaque ordinal mapping is stable across refresh order.

Two non-blocking maintainability observations are recorded for follow-up: (1) the ordinal policy is implemented in both apps/desktop-tauri/src-tauri/src/tray_accounts.rs:217 and apps/desktop-tauri/src/components/CodexAccountsMenu.tsx:39 with slightly different ID normalization; document or centralize that bridge contract to prevent drift, and (2) the new Account N label is hardcoded in both surfaces rather than using the surrounding localization path. Neither is a merge blocker for this scoped privacy fix.

Superseding thermo verdict — BLOCKED.

Oracle’s final adjudication confirms that the Rust tray path at tray_accounts.rs:204-233 and the React path around CodexAccountsMenu.tsx:47-65 and 165-170 independently implement the privacy-critical UUID-to-ordinal policy and silently manufacture fallback ordinals. Compute the opaque ordinal projection once in the Rust account domain, bridge it to React, reuse it in the native tray, and remove both fallbacks. Hardcoded English Account N is secondary cleanup; the duplicated policy is the merge blocker.

Thermo follow-up: blocker fixed and validated.

Oracle had blocked this PR because Rust tray code and React code each derived privacy-safe account ordinals. Commit 4456f7c9c moves ordinal ownership into rust/src/codex_accounts/models.rs, returns account_ordinals through the bridge, and makes tray/React consume that canonical projection without discovery-order or index fallbacks. Stale bridge fixtures were updated as part of the contract change.

Validation: account Rust ordinal test 1/1; Tauri tray-account tests 4/4; Codex account React tests 15/15; TypeScript --noEmit; Rust and Tauri clippy with -D warnings; and cargo fmt --all -- --check all pass.

Oracle post-fix verdict: PASS. Hosted CI and Windows CUA evidence remain separate process gates.

Windows UI validation note: the repaired source passed TypeScript, Vite, and direct Tauri debug compilation, producing target/debug/codexbar-desktop-tauri.exe. The repository pnpm run tauri:build:debug wrapper could not complete because the local Corepack pnpm worker failed while repairing the isolated dependency directory. The CUA inventory then returned no native apps and its app-selection API was unavailable, so no screenshot/window assertion could be captured. This is a tooling evidence limitation; the code-level thermo verdict remains PASS.