From 668e53dff620d90f04c0547c7803ac705463b42f Mon Sep 17 00:00:00 2001
From: NessZerra <90105158+Finesssee@users.noreply.github.com>
Date: Sat, 19 Sep 2026 02:45:46 +0700
Subject: [PATCH 1/2] Redact Codex System Account labels

---
 .../src-tauri/src/tray_accounts.rs            | 42 +++++++++------
 .../src/components/CodexAccountsMenu.test.tsx | 31 +++++++----
 .../src/components/CodexAccountsMenu.tsx      | 45 +++-------------
 .../components/codexAccountDisplay.test.ts    | 41 +++++++++++++-
 .../src/components/codexAccountDisplay.ts     | 32 +++++++++++
 .../settings/providers/ProviderDetailPane.tsx |  6 ++-
 .../credentials/CodexAccountsSection.test.tsx | 53 +++++++++++++++++++
 .../credentials/CodexAccountsSection.tsx      | 12 +++--
 .../surfaces/settings/tabs/ProvidersTab.tsx   |  1 +
 rust/src/codex_accounts/models.rs             | 46 ++++++++++++++++
 10 files changed, 242 insertions(+), 67 deletions(-)

diff --git a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
index 6c280d7587..aeb51580cf 100644
--- a/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
+++ b/apps/desktop-tauri/src-tauri/src/tray_accounts.rs
@@ -252,10 +252,11 @@ fn codex_account_menu_label(
     hide_personal_info: bool,
     ordinal: usize,
 ) -> String {
-    if hide_personal_info {
-        return format!("{} {ordinal}", locale::get_text(lang, LocaleKey::Account));
-    }
-    account.display_name()
+    account.privacy_safe_display_name(
+        hide_personal_info,
+        ordinal,
+        &locale::get_text(lang, LocaleKey::Account),
+    )
 }
 
 fn claude_accounts_menu(
@@ -444,6 +445,7 @@ mod tests {
         let empty = codex_accounts_menu(&[], None, Language::English, false);
         assert!(menu_contains(&empty.children, "add_codex_account"));
         let mut email_account = second;
+        email_account.source = CodexAccountSource::Ambient;
         email_account.nickname = None;
         email_account.email_hint = Some("private@example.com".into());
         let private = codex_accounts_menu(&[email_account.clone()], None, Language::English, true);
@@ -470,16 +472,18 @@ mod tests {
                 None,
             )
         };
-        let with_nickname = make(
+        let mut with_nickname = make(
             "00000000-0000-0000-0000-000000000002",
             Some("Work"),
             "user@example.com",
         );
-        let without_nickname = make(
+        let mut without_nickname = make(
             "00000000-0000-0000-0000-000000000001",
             None,
             "personal@example.com",
         );
+        with_nickname.source = CodexAccountSource::ManagedByApp;
+        without_nickname.source = CodexAccountSource::Ambient;
 
         let accounts = [with_nickname.clone(), without_nickname.clone()];
         let ordinals = ordinals_by_id(&accounts);
@@ -492,7 +496,7 @@ mod tests {
                 true,
                 ordinals[&with_nickname.id],
             ),
-            "Account 2"
+            "user@example.com — Work"
         );
         assert_eq!(
             codex_account_menu_label(
@@ -504,14 +508,22 @@ mod tests {
             "Account 1"
         );
 
-        let hidden = codex_accounts_menu(&accounts, None, Language::English, true);
-        assert_eq!(hidden.children[0].label, "Account 2");
+        let hidden =
+            codex_accounts_menu(&accounts, Some(&without_nickname), Language::English, true);
+        assert_eq!(hidden.children[0].label, "user@example.com — Work");
         assert_eq!(hidden.children[1].label, "Account 1");
-        for entry in hidden.children.iter().take(2) {
-            assert!(!entry.label.contains('@'));
-            assert!(!entry.label.contains("example.com"));
-            assert!(!entry.label.contains("Work"));
-        }
+        assert_eq!(hidden.children[0].checked, Some(false));
+        assert!(!hidden.children[0].disabled);
+        assert_eq!(hidden.children[1].checked, Some(true));
+        assert!(hidden.children[1].disabled);
+        assert_eq!(
+            hidden.children[1].id.as_deref(),
+            Some(format!("switch_codex_account:{}", without_nickname.id).as_str())
+        );
+        assert!(hidden.children[0].label.contains("Work"));
+        assert!(!hidden.children[1].label.contains('@'));
+        assert!(!hidden.children[1].label.contains("example.com"));
+        assert!(!hidden.children[1].label.contains("personal"));
 
         let reversed = codex_accounts_menu(
             &[without_nickname.clone(), with_nickname.clone()],
@@ -520,7 +532,7 @@ mod tests {
             true,
         );
         assert_eq!(reversed.children[0].label, "Account 1");
-        assert_eq!(reversed.children[1].label, "Account 2");
+        assert_eq!(reversed.children[1].label, "user@example.com — Work");
 
         let visible = codex_accounts_menu(&[with_nickname], None, Language::English, false);
         assert_eq!(visible.children[0].label, "user@example.com — Work");
diff --git a/apps/desktop-tauri/src/components/CodexAccountsMenu.test.tsx b/apps/desktop-tauri/src/components/CodexAccountsMenu.test.tsx
index 737613b299..2cd1c79c0a 100644
--- a/apps/desktop-tauri/src/components/CodexAccountsMenu.test.tsx
+++ b/apps/desktop-tauri/src/components/CodexAccountsMenu.test.tsx
@@ -202,7 +202,7 @@ describe("CodexAccountsMenu", () => {
     expect(tauriMocks.codexAccountSwitch).toHaveBeenCalledWith("2");
     expect(tauriMocks.refreshProviders).toHaveBeenCalledTimes(1);
   });
-  it("uses opaque ordinal labels and matching tooltips while hideEmail is on", async () => {
+  it("uses an opaque ordinal only for the ambient account while hideEmail is on", async () => {
     const { container: hidden } = renderMenu(true, {
       accounts: [account("1", { source: "ambient" }), account("2")],
       accountOrdinals: { "1": 1, "2": 2 },
@@ -213,13 +213,23 @@ describe("CodexAccountsMenu", () => {
         hidden.querySelectorAll(".codex-menu-accounts__email").length,
       ).toBe(2);
     });
-    const hiddenEmail = hidden.querySelectorAll(
+    const ambientLabel = hidden.querySelectorAll(
+      ".codex-menu-accounts__email",
+    )[0] as HTMLElement;
+    expect(ambientLabel.getAttribute("title")).toBe("Account 1");
+    expect(ambientLabel.firstChild?.textContent).toBe("Account 1");
+    expect(ambientLabel.firstChild?.textContent).not.toContain("@");
+    expect(ambientLabel.firstChild?.textContent).not.toContain("example.com");
+
+    const managedEmail = hidden.querySelectorAll(
       ".codex-menu-accounts__email",
     )[1] as HTMLElement;
-    expect(hiddenEmail.getAttribute("title")).toBe(hiddenEmail.textContent);
-    expect(hiddenEmail.textContent).toBe("Account 2");
-    expect(hiddenEmail.textContent).not.toContain("@");
-    expect(hiddenEmail.textContent).not.toContain("example.com");
+    expect(managedEmail.textContent).toBe("user-2@example.com");
+    const switches = hidden.querySelectorAll(
+      ".codex-menu-accounts__switch",
+    ) as NodeListOf<HTMLButtonElement>;
+    expect(switches[0].disabled).toBe(true);
+    expect(switches[1].disabled).toBe(false);
 
     const { container: visible } = renderMenu(false, {
       accounts: [account("1", { source: "ambient" }), account("2")],
@@ -241,6 +251,7 @@ describe("CodexAccountsMenu", () => {
     const first = account("uuid-b", {
       emailHint: "alice@example.com",
       nickname: "team@example.com",
+      source: "ambient",
     });
     const second = account("uuid-a", {
       emailHint: "bob@example.com",
@@ -254,10 +265,10 @@ describe("CodexAccountsMenu", () => {
     });
     await screen.findByText("Account 2");
     const labels = container.querySelectorAll(".codex-menu-accounts__email");
-    expect(labels[0].textContent).toBe("Account 2");
-    expect(labels[1].textContent).toBe("Account 1");
-    expect(labels[0].textContent).not.toContain("@");
-    expect(labels[1].textContent).not.toContain("example.com");
+    expect(labels[0].firstChild?.textContent).toBe("Account 2");
+    expect(labels[1].textContent).toBe("bob@example.com — Private workspace");
+    expect(labels[0].firstChild?.textContent).not.toContain("@");
+    expect(labels[1].textContent).toContain("Private workspace");
   });
 });
 
diff --git a/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx b/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
index e12fa1ea7d..6aee681331 100644
--- a/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
+++ b/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
@@ -7,39 +7,13 @@ import type {
 } from "../types/bridge";
 import { useLocale } from "../hooks/useLocale";
 import { useFormattedResetTime } from "../hooks/useFormattedResetTime";
-import { buildCodexAccountDisplayNames } from "./codexAccountDisplay";
+import { buildCodexAccountSurfaceLabels } from "./codexAccountDisplay";
 import {
   codexAccountSwitch,
   getCodexAccountsState,
   refreshProviders,
 } from "../lib/tauri";
 
-interface PrivateCodexAccountLabel {
-  label: string;
-  tooltip: string;
-}
-
-/**
- * Project a tray account label while keeping the privacy setting scoped to
- * this switcher surface. The shared display-name builder remains unchanged so
- * settings and other account-facing surfaces keep their existing behavior.
- */
-function buildPrivateCodexAccountLabel(
-  account: CodexAccount,
-  displayName: string,
-  ordinal: number,
-  hidePersonalInfo: boolean,
-  accountWord: string,
-): PrivateCodexAccountLabel {
-  if (hidePersonalInfo) {
-    const label = `${accountWord} ${ordinal}`;
-    return { label, tooltip: label };
-  }
-
-  const label = displayName || account.nickname || "Workspace";
-  return { label, tooltip: label };
-}
-
 /**
  * Multi-account lane surface for the Codex tray menu card (ADR 0003,
  * option A). Renders only when more than one Codex account exists, so the
@@ -122,9 +96,12 @@ export default function CodexAccountsMenu({
     return null;
   }
 
-  const accountDisplayNames = buildCodexAccountDisplayNames(
+  const accountDisplayNames = buildCodexAccountSurfaceLabels(
     accounts,
     displayNames,
+    accountOrdinals,
+    hideEmail,
+    t("Account"),
   );
 
   return (
@@ -140,20 +117,14 @@ export default function CodexAccountsMenu({
       )}
       <ul className="codex-menu-accounts__list">
         {accounts.map((account) => {
-          const privateLabel = buildPrivateCodexAccountLabel(
-            account,
-            accountDisplayNames[account.id] ?? "",
-            accountOrdinals[account.id],
-            hideEmail,
-            t("Account"),
-          );
+          const label = accountDisplayNames[account.id] ?? "Workspace";
           return (
             <CodexAccountRow
               key={account.id}
               account={account}
               snapshot={snapshots[account.id]}
-              displayName={privateLabel.label}
-              tooltip={privateLabel.tooltip}
+              displayName={label}
+              tooltip={label}
               resetTimeRelative={resetTimeRelative}
               busy={busy}
               onSwitch={handleSwitch}
diff --git a/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts b/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
index 647558f5c7..34749c2d9a 100644
--- a/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
+++ b/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from "vitest";
 import type { CodexAccount } from "../types/bridge";
-import { buildCodexAccountDisplayNames } from "./codexAccountDisplay";
+import {
+  buildCodexAccountDisplayNames,
+  buildCodexAccountSurfaceLabels,
+} from "./codexAccountDisplay";
 
 function account(id: string, providerAccountId: string): CodexAccount {
   return {
@@ -82,4 +85,40 @@ describe("Codex account display labels", () => {
     expect(label).not.toContain("secret-subject");
     expect(label).not.toContain("C:/private");
   });
+
+  it("redacts only the ambient account while preserving managed labels", () => {
+    const system = account("11111111-1111-1111-1111-111111111111", "system");
+    const managed = account("22222222-2222-2222-2222-222222222222", "managed");
+    const accounts = [
+      { ...system, source: "ambient" as const, nickname: "Private System Name" },
+      { ...managed, nickname: "Work" },
+    ];
+    const hidden = buildCodexAccountSurfaceLabels(
+      accounts,
+      {},
+      { [system.id]: 1, [managed.id]: 2 },
+      true,
+    );
+    expect(hidden[system.id]).toBe("Account 1");
+    expect(hidden[system.id]).not.toContain("@");
+    expect(hidden[system.id]).not.toContain("Private System Name");
+    expect(hidden[managed.id]).toBe("same@example.com — Work");
+
+    const reordered = buildCodexAccountSurfaceLabels(
+      [accounts[1], accounts[0]],
+      {},
+      {},
+      true,
+    );
+    expect(reordered[system.id]).toBe("Account 1");
+
+    const visible = buildCodexAccountSurfaceLabels(
+      accounts,
+      {},
+      { [system.id]: 1, [managed.id]: 2 },
+      false,
+    );
+    expect(visible[system.id]).toBe("same@example.com — Private System Name");
+    expect(visible[managed.id]).toBe("same@example.com — Work");
+  });
 });
diff --git a/apps/desktop-tauri/src/components/codexAccountDisplay.ts b/apps/desktop-tauri/src/components/codexAccountDisplay.ts
index 6e2179c295..14388b4ec1 100644
--- a/apps/desktop-tauri/src/components/codexAccountDisplay.ts
+++ b/apps/desktop-tauri/src/components/codexAccountDisplay.ts
@@ -36,6 +36,38 @@ export function buildCodexAccountDisplayNames(
   return result;
 }
 
+/**
+ * Build the labels rendered by account rows in the tray and Settings.
+ * Privacy mode redacts only the ambient/System account; managed account
+ * labels continue to use the canonical display-name projection.
+ */
+export function buildCodexAccountSurfaceLabels(
+  accounts: readonly CodexAccount[],
+  canonical: Readonly<Record<string, string>> = {},
+  accountOrdinals: Readonly<Record<string, number>> = {},
+  hidePersonalInfo = false,
+  accountWord = "Account",
+): Record<string, string> {
+  const displayNames = buildCodexAccountDisplayNames(accounts, canonical);
+  const stableOrdinals = new Map(
+    [...accounts]
+      .map((account) => account.id)
+      .sort()
+      .map((id, index) => [id, index + 1] as const),
+  );
+  const generic = accountWord.trim() || "Account";
+
+  return Object.fromEntries(
+    accounts.map((account) => {
+      if (hidePersonalInfo && account.source === "ambient") {
+        const ordinal = accountOrdinals[account.id] ?? stableOrdinals.get(account.id) ?? 1;
+        return [account.id, `${generic} ${ordinal}`];
+      }
+      return [account.id, displayNames[account.id] ?? "Workspace"];
+    }),
+  );
+}
+
 export function codexAccountBaseName(account: CodexAccount): string {
   const nickname = account.nickname?.trim();
   const email = account.emailHint?.trim().toLowerCase();
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
index 9da9e5742d..b4b9b6a68e 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
@@ -55,6 +55,7 @@ interface Props {
   /** Per-provider accent color overrides (CLI name → hex color). */
   providerAccentColors: SettingsSnapshot["providerAccentColors"];
   wayfinderGatewayUrl: string;
+  hidePersonalInfo: boolean;
   settingsDisabled: boolean;
   onSettingsChange: (patch: SettingsUpdate) => void;
 }
@@ -73,6 +74,7 @@ export function ProviderDetailPane({
   providerMetrics,
   providerAccentColors,
   wayfinderGatewayUrl,
+  hidePersonalInfo,
   settingsDisabled,
   onSettingsChange,
 }: Props) {
@@ -269,7 +271,9 @@ export function ProviderDetailPane({
     <div className="provider-detail">
       <IdentitySection provider={detail} subtitle={subtitle} t={t} />
 
-      {detail.id === "codex" && <CodexAccountsSection t={t} />}
+      {detail.id === "codex" && (
+        <CodexAccountsSection t={t} hidePersonalInfo={hidePersonalInfo} />
+      )}
       {detail.id === "claude" && <ClaudeAccountsSection t={t} language={language} />}
       {detail.id === "grok" && <GrokAccountsSection t={t} />}
 
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.test.tsx
index 82d4848ca1..50f52d15f9 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.test.tsx
@@ -84,6 +84,59 @@ describe("CodexAccountsSection", () => {
     expect(screen.getAllByText("CodexAccountsReauthenticateButton")).toHaveLength(1);
   });
 
+  it("redacts the ambient row while preserving the managed row when privacy is on", async () => {
+    const ambient = account("ambient", {
+      source: "ambient",
+      nickname: "Private System Name",
+      emailHint: "system@example.com",
+    });
+    const managed = account("managed", {
+      nickname: "Work",
+      emailHint: "work@example.com",
+    });
+    tauriMocks.getCodexAccountsState.mockResolvedValue({
+      accounts: [ambient, managed],
+      accountOrdinals: { ambient: 1, managed: 2 },
+      displayNames: {
+        ambient: "system@example.com — Private System Name",
+        managed: "work@example.com — Work",
+      },
+      snapshots: {},
+    } as CodexAccountsStateBridge);
+
+    render(<CodexAccountsSection t={t} hidePersonalInfo />);
+    await screen.findByText("Account 1");
+    expect(screen.queryByText(/system@example\.com|Private System Name/)).toBeNull();
+    expect(screen.getByText("work@example.com — Work")).toBeDefined();
+    expect(screen.getByText("CodexAccountsSourceAmbient")).toBeDefined();
+    expect(screen.getByText("CodexAccountsSourceManaged")).toBeDefined();
+  });
+
+  it("preserves both current display names when privacy is off", async () => {
+    const ambient = account("ambient", {
+      source: "ambient",
+      nickname: "Private System Name",
+      emailHint: "system@example.com",
+    });
+    const managed = account("managed", {
+      nickname: "Work",
+      emailHint: "work@example.com",
+    });
+    tauriMocks.getCodexAccountsState.mockResolvedValue({
+      accounts: [ambient, managed],
+      accountOrdinals: { ambient: 1, managed: 2 },
+      displayNames: {
+        ambient: "system@example.com — Private System Name",
+        managed: "work@example.com — Work",
+      },
+      snapshots: {},
+    } as CodexAccountsStateBridge);
+
+    render(<CodexAccountsSection t={t} hidePersonalInfo={false} />);
+    await screen.findByText("system@example.com — Private System Name");
+    expect(screen.getByText("work@example.com — Work")).toBeDefined();
+  });
+
   it("shows the usage pill and blocked state from a snapshot", async () => {
     tauriMocks.getCodexAccountsState.mockResolvedValue(
       {
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.tsx
index c16c22e459..c60332826d 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/CodexAccountsSection.tsx
@@ -16,10 +16,11 @@ import {
   codexAccountSwitch,
   getCodexAccountsState,
 } from "../../../../../lib/tauri";
-import { buildCodexAccountDisplayNames } from "../../../../../components/codexAccountDisplay";
+import { buildCodexAccountSurfaceLabels } from "../../../../../components/codexAccountDisplay";
 
 interface Props {
   t: (key: LocaleKey) => string;
+  hidePersonalInfo?: boolean;
 }
 
 /**
@@ -33,12 +34,13 @@ interface Props {
  * ambient identity, and remove managed homes. For MSIX Codex Desktop installs
  * a restart action is offered when a session snapshot is available to restore.
  */
-export function CodexAccountsSection({ t }: Props) {
+export function CodexAccountsSection({ t, hidePersonalInfo = false }: Props) {
   const [accounts, setAccounts] = useState<CodexAccount[]>([]);
   const [snapshots, setSnapshots] = useState<
     Record<string, CodexAccountUsageSnapshot>
   >({});
   const [displayNames, setDisplayNames] = useState<Record<string, string>>({});
+  const [accountOrdinals, setAccountOrdinals] = useState<Record<string, number>>({});
   const [loaded, setLoaded] = useState(false);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -53,6 +55,7 @@ export function CodexAccountsSection({ t }: Props) {
       const next: CodexAccountsStateBridge = await getCodexAccountsState();
       setAccounts(next.accounts);
       setDisplayNames(next.displayNames ?? {});
+      setAccountOrdinals(next.accountOrdinals);
       setSnapshots(next.snapshots);
       setLoaded(true);
     } catch (err: unknown) {
@@ -167,9 +170,12 @@ export function CodexAccountsSection({ t }: Props) {
     return null;
   }
 
-  const accountDisplayNames = buildCodexAccountDisplayNames(
+  const accountDisplayNames = buildCodexAccountSurfaceLabels(
     accounts,
     displayNames,
+    accountOrdinals,
+    hidePersonalInfo,
+    t("Account"),
   );
 
   return (
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
index afa1517431..d272b44d4d 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
@@ -140,6 +140,7 @@ export default function ProvidersTab({
         providerMetrics={settings.providerMetrics}
         providerAccentColors={settings.providerAccentColors}
         wayfinderGatewayUrl={settings.wayfinderGatewayUrl ?? "http://127.0.0.1:8088"}
+        hidePersonalInfo={settings.hidePersonalInfo}
         settingsDisabled={saving}
         onSettingsChange={set}
       />
diff --git a/rust/src/codex_accounts/models.rs b/rust/src/codex_accounts/models.rs
index 8ba4628e27..406586428c 100644
--- a/rust/src/codex_accounts/models.rs
+++ b/rust/src/codex_accounts/models.rs
@@ -153,6 +153,25 @@ impl CodexAccount {
         self.display_label_base()
     }
 
+    /// Return the label used by a user-facing account surface.
+    ///
+    /// Privacy mode applies to the ambient/System account only. Managed
+    /// accounts retain their existing display names so account actions and
+    /// identity siloing continue to address the same account.
+    pub fn privacy_safe_display_name(
+        &self,
+        hide_personal_info: bool,
+        ordinal: usize,
+        generic_label: &str,
+    ) -> String {
+        if hide_personal_info && self.source == CodexAccountSource::Ambient {
+            let label = generic_label.trim();
+            let label = if label.is_empty() { "Account" } else { label };
+            return format!("{label} {ordinal}");
+        }
+        self.display_name()
+    }
+
     /// Return the user-facing account label without falling back to
     /// credentials, provider identifiers, or filesystem paths.
     fn display_label_base(&self) -> String {
@@ -852,6 +871,33 @@ mod tests {
         assert!(!label.contains("C:/private"));
     }
 
+    #[test]
+    fn privacy_safe_display_name_hides_system_identity_but_preserves_managed_labels() {
+        let mut system =
+            display_account("11111111-1111-1111-1111-111111111111", "system-workspace");
+        system.source = CodexAccountSource::Ambient;
+        system.nickname = Some("Private System Name".to_string());
+        let mut managed =
+            display_account("22222222-2222-2222-2222-222222222222", "managed-workspace");
+        managed.nickname = Some("Work".to_string());
+
+        let hidden_system = system.privacy_safe_display_name(true, 1, "Account");
+        let hidden_managed = managed.privacy_safe_display_name(true, 2, "Account");
+        assert_eq!(hidden_system, "Account 1");
+        assert!(!hidden_system.contains("@"));
+        assert!(!hidden_system.contains("Private System Name"));
+        assert_eq!(hidden_managed, "user@example.com — Work");
+
+        assert_eq!(
+            system.privacy_safe_display_name(false, 1, "Account"),
+            "user@example.com — Private System Name"
+        );
+        assert_eq!(
+            managed.privacy_safe_display_name(false, 2, "Account"),
+            "user@example.com — Work"
+        );
+    }
+
     #[test]
     fn ordinals_are_stable_when_account_discovery_order_changes() {
         let first = display_account("22222222-2222-2222-2222-222222222222", "workspace-alpha");

From d0c7befff9f05df389b5b4992cc01a0651cacccd Mon Sep 17 00:00:00 2001
From: NessZerra <90105158+Finesssee@users.noreply.github.com>
Date: Sun, 20 Sep 2026 22:50:32 +0700
Subject: [PATCH 2/2] Split Codex label policy into labels module and drop dead
 TS fallbacks

---
 .../src/components/CodexAccountsMenu.tsx      |   2 +-
 .../components/codexAccountDisplay.test.ts    |   5 +-
 .../src/components/codexAccountDisplay.ts     |  29 +-
 rust/src/codex_accounts/labels.rs             | 252 +++++++++++++++++
 rust/src/codex_accounts/mod.rs                |   4 +-
 rust/src/codex_accounts/models.rs             | 255 +-----------------
 6 files changed, 273 insertions(+), 274 deletions(-)
 create mode 100644 rust/src/codex_accounts/labels.rs

diff --git a/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx b/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
index 6aee681331..228c7692aa 100644
--- a/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
+++ b/apps/desktop-tauri/src/components/CodexAccountsMenu.tsx
@@ -117,7 +117,7 @@ export default function CodexAccountsMenu({
       )}
       <ul className="codex-menu-accounts__list">
         {accounts.map((account) => {
-          const label = accountDisplayNames[account.id] ?? "Workspace";
+          const label = accountDisplayNames[account.id];
           return (
             <CodexAccountRow
               key={account.id}
diff --git a/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts b/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
index 34749c2d9a..8422bc1afe 100644
--- a/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
+++ b/apps/desktop-tauri/src/components/codexAccountDisplay.test.ts
@@ -98,6 +98,7 @@ describe("Codex account display labels", () => {
       {},
       { [system.id]: 1, [managed.id]: 2 },
       true,
+      "Account",
     );
     expect(hidden[system.id]).toBe("Account 1");
     expect(hidden[system.id]).not.toContain("@");
@@ -107,8 +108,9 @@ describe("Codex account display labels", () => {
     const reordered = buildCodexAccountSurfaceLabels(
       [accounts[1], accounts[0]],
       {},
-      {},
+      { [system.id]: 1, [managed.id]: 2 },
       true,
+      "Account",
     );
     expect(reordered[system.id]).toBe("Account 1");
 
@@ -117,6 +119,7 @@ describe("Codex account display labels", () => {
       {},
       { [system.id]: 1, [managed.id]: 2 },
       false,
+      "Account",
     );
     expect(visible[system.id]).toBe("same@example.com — Private System Name");
     expect(visible[managed.id]).toBe("same@example.com — Work");
diff --git a/apps/desktop-tauri/src/components/codexAccountDisplay.ts b/apps/desktop-tauri/src/components/codexAccountDisplay.ts
index 14388b4ec1..3c72eaf036 100644
--- a/apps/desktop-tauri/src/components/codexAccountDisplay.ts
+++ b/apps/desktop-tauri/src/components/codexAccountDisplay.ts
@@ -37,33 +37,28 @@ export function buildCodexAccountDisplayNames(
 }
 
 /**
- * Build the labels rendered by account rows in the tray and Settings.
- * Privacy mode redacts only the ambient/System account; managed account
- * labels continue to use the canonical display-name projection.
+ * Project the labels rendered by account rows in the tray and Settings.
+ * The redaction rule mirrors `CodexAccount::privacy_safe_display_name` in the
+ * Rust model: privacy mode redacts only the ambient/System account; managed
+ * account labels keep the canonical display-name projection. Client-side
+ * projection keeps the relabel reactive when the setting toggles without a
+ * refetch.
  */
 export function buildCodexAccountSurfaceLabels(
   accounts: readonly CodexAccount[],
-  canonical: Readonly<Record<string, string>> = {},
-  accountOrdinals: Readonly<Record<string, number>> = {},
-  hidePersonalInfo = false,
-  accountWord = "Account",
+  canonical: Readonly<Record<string, string>>,
+  accountOrdinals: Readonly<Record<string, number>>,
+  hidePersonalInfo: boolean,
+  accountWord: string,
 ): Record<string, string> {
   const displayNames = buildCodexAccountDisplayNames(accounts, canonical);
-  const stableOrdinals = new Map(
-    [...accounts]
-      .map((account) => account.id)
-      .sort()
-      .map((id, index) => [id, index + 1] as const),
-  );
-  const generic = accountWord.trim() || "Account";
 
   return Object.fromEntries(
     accounts.map((account) => {
       if (hidePersonalInfo && account.source === "ambient") {
-        const ordinal = accountOrdinals[account.id] ?? stableOrdinals.get(account.id) ?? 1;
-        return [account.id, `${generic} ${ordinal}`];
+        return [account.id, `${accountWord.trim()} ${accountOrdinals[account.id]}`];
       }
-      return [account.id, displayNames[account.id] ?? "Workspace"];
+      return [account.id, displayNames[account.id]];
     }),
   );
 }
diff --git a/rust/src/codex_accounts/labels.rs b/rust/src/codex_accounts/labels.rs
new file mode 100644
index 0000000000..7de945638c
--- /dev/null
+++ b/rust/src/codex_accounts/labels.rs
@@ -0,0 +1,252 @@
+//! Display-label policy for Codex account surfaces.
+//!
+//! Labels never fall back to credentials, provider identifiers, or filesystem
+//! paths. Privacy mode applies to the ambient/System account only; managed
+//! accounts retain their existing display names so account actions and
+//! identity siloing continue to address the same account.
+
+use std::collections::HashMap;
+
+use uuid::Uuid;
+
+use super::models::{CodexAccount, CodexAccountSource};
+
+impl CodexAccount {
+    /// The user-facing account label.
+    pub fn display_name(&self) -> String {
+        self.display_label_base()
+    }
+
+    /// The label used by a user-facing account surface.
+    pub fn privacy_safe_display_name(
+        &self,
+        hide_personal_info: bool,
+        ordinal: usize,
+        generic_label: &str,
+    ) -> String {
+        if hide_personal_info && self.source == CodexAccountSource::Ambient {
+            let label = generic_label.trim();
+            let label = if label.is_empty() { "Account" } else { label };
+            return format!("{label} {ordinal}");
+        }
+        self.display_name()
+    }
+
+    /// The user-facing account label without falling back to credentials,
+    /// provider identifiers, or filesystem paths.
+    pub(crate) fn display_label_base(&self) -> String {
+        let nickname = self
+            .nickname
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty());
+        let email = self
+            .email_hint
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(str::to_lowercase);
+
+        match (email, nickname) {
+            (Some(email), Some(nickname)) => format!("{email} — {nickname}"),
+            (Some(email), None) => email,
+            (None, Some(nickname)) => nickname.to_string(),
+            (None, None) => "Workspace".to_string(),
+        }
+    }
+
+    /// The identity a label disambiguates against: the effective workspace id
+    /// when present, otherwise the account UUID in lowercase.
+    pub(crate) fn display_identity(&self) -> String {
+        self.effective_workspace_account_id()
+            .unwrap_or_else(|| self.id.to_string().to_lowercase())
+    }
+}
+
+/// A provider account id is a workspace identity, but it must never be shown
+/// directly. Only accounts whose privacy-safe display labels collide receive
+/// an opaque suffix. The stored account UUID is folded into the hashed
+/// identity when two entries claim the same provider identity, keeping
+/// separate local profiles distinguishable without exposing a home path or
+/// provider id.
+pub fn display_names_by_id(accounts: &[CodexAccount]) -> HashMap<Uuid, String> {
+    let mut groups: HashMap<String, Vec<usize>> = HashMap::new();
+    for (index, account) in accounts.iter().enumerate() {
+        groups
+            .entry(account.display_label_base().to_lowercase())
+            .or_default()
+            .push(index);
+    }
+
+    let mut labels = HashMap::with_capacity(accounts.len());
+    for indexes in groups.into_values() {
+        if indexes.len() == 1 {
+            let index = indexes[0];
+            labels.insert(accounts[index].id, accounts[index].display_label_base());
+            continue;
+        }
+
+        let mut identity_counts: HashMap<String, usize> = HashMap::new();
+        for &index in &indexes {
+            *identity_counts
+                .entry(accounts[index].display_identity())
+                .or_default() += 1;
+        }
+
+        for &index in &indexes {
+            let account = &accounts[index];
+            let identity = account.display_identity();
+            let identity = if identity_counts.get(&identity) == Some(&1) {
+                identity
+            } else {
+                format!("{identity}\0{}", account.id)
+            };
+            let suffix = crate::core::sha256_hex(identity.as_bytes());
+            labels.insert(
+                account.id,
+                format!("{} · {}", account.display_label_base(), &suffix[..8]),
+            );
+        }
+    }
+    labels
+}
+
+/// Assign stable, opaque ordinals for account surfaces that hide personal data.
+///
+/// The account UUID is never displayed. Sorting it here keeps tray and React
+/// consumers consistent even when discovery returns accounts in a different
+/// order.
+pub fn ordinals_by_id(accounts: &[CodexAccount]) -> HashMap<Uuid, usize> {
+    let mut ordered: Vec<(String, usize, Uuid)> = accounts
+        .iter()
+        .enumerate()
+        .map(|(index, account)| (account.id.to_string(), index, account.id))
+        .collect();
+    ordered.sort_by(|left, right| left.0.cmp(&right.0).then_with(|| left.1.cmp(&right.1)));
+
+    ordered
+        .into_iter()
+        .enumerate()
+        .map(|(index, (_, _, id))| (id, index + 1))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::codex_accounts::models::utc_now;
+    use std::path::PathBuf;
+
+    fn display_account(id: &str, provider_account_id: &str) -> CodexAccount {
+        CodexAccount::new(
+            Uuid::parse_str(id).unwrap(),
+            None,
+            Some("user@example.com".to_string()),
+            None,
+            Some(provider_account_id.to_string()),
+            PathBuf::from(format!("C:/private/{provider_account_id}")),
+            CodexAccountSource::ManagedByApp,
+            utc_now(),
+            utc_now(),
+            None,
+        )
+    }
+
+    #[test]
+    fn display_names_disambiguate_same_email_without_exposing_workspace_identity() {
+        let first = display_account("11111111-1111-1111-1111-111111111111", "workspace-alpha");
+        let second = display_account("22222222-2222-2222-2222-222222222222", "workspace-beta");
+
+        let labels = display_names_by_id(&[first.clone(), second.clone()]);
+        let first_label = labels.get(&first.id).unwrap();
+        let second_label = labels.get(&second.id).unwrap();
+        assert_ne!(first_label, second_label);
+        for label in [first_label, second_label] {
+            assert!(label.starts_with("user@example.com · "));
+            assert_eq!(label.rsplit_once(' ').unwrap().1.len(), 8);
+            assert!(!label.contains("workspace-"));
+            assert!(!label.contains("C:/private"));
+            assert!(!label.contains("auth0|"));
+        }
+
+        let reordered = display_names_by_id(&[second, first.clone()]);
+        assert_eq!(reordered.get(&first.id), Some(first_label));
+
+        let mut relaunched_first = first.clone();
+        relaunched_first.codex_home_path = PathBuf::from("C:/different-managed-home");
+        let mut relaunched_second = first.clone();
+        relaunched_second.id = Uuid::parse_str("66666666-6666-6666-6666-666666666666").unwrap();
+        relaunched_second.provider_account_id = Some("workspace-beta".to_string());
+        let relaunched = display_names_by_id(&[relaunched_first, relaunched_second]);
+        assert_eq!(relaunched.get(&first.id), Some(first_label));
+    }
+
+    #[test]
+    fn display_names_keep_duplicate_workspace_profiles_distinct() {
+        let first = display_account("33333333-3333-3333-3333-333333333333", "shared-workspace");
+        let second = display_account("44444444-4444-4444-4444-444444444444", "shared-workspace");
+
+        let labels = display_names_by_id(&[first.clone(), second.clone()]);
+        assert_ne!(labels.get(&first.id), labels.get(&second.id));
+        assert!(labels[&first.id].starts_with("user@example.com · "));
+        assert!(labels[&second.id].starts_with("user@example.com · "));
+        let reordered = display_names_by_id(&[second, first.clone()]);
+        assert_eq!(reordered.get(&first.id), labels.get(&first.id));
+    }
+
+    #[test]
+    fn display_names_use_generic_base_when_identity_fields_are_missing() {
+        let mut account =
+            display_account("55555555-5555-5555-5555-555555555555", "secret-workspace");
+        account.email_hint = None;
+        account.auth_subject = Some("auth0|secret-subject".to_string());
+        account.nickname = None;
+
+        let labels = display_names_by_id(&[account]);
+        let label = labels.values().next().unwrap();
+        assert!(label.starts_with("Workspace"));
+        assert!(!label.contains("secret-workspace"));
+        assert!(!label.contains("secret-subject"));
+        assert!(!label.contains("C:/private"));
+    }
+
+    #[test]
+    fn privacy_safe_display_name_hides_system_identity_but_preserves_managed_labels() {
+        let mut system =
+            display_account("11111111-1111-1111-1111-111111111111", "system-workspace");
+        system.source = CodexAccountSource::Ambient;
+        system.nickname = Some("Private System Name".to_string());
+        let mut managed =
+            display_account("22222222-2222-2222-2222-222222222222", "managed-workspace");
+        managed.nickname = Some("Work".to_string());
+
+        let hidden_system = system.privacy_safe_display_name(true, 1, "Account");
+        let hidden_managed = managed.privacy_safe_display_name(true, 2, "Account");
+        assert_eq!(hidden_system, "Account 1");
+        assert!(!hidden_system.contains("@"));
+        assert!(!hidden_system.contains("Private System Name"));
+        assert_eq!(hidden_managed, "user@example.com — Work");
+
+        assert_eq!(
+            system.privacy_safe_display_name(false, 1, "Account"),
+            "user@example.com — Private System Name"
+        );
+        assert_eq!(
+            managed.privacy_safe_display_name(false, 2, "Account"),
+            "user@example.com — Work"
+        );
+    }
+
+    #[test]
+    fn ordinals_are_stable_when_account_discovery_order_changes() {
+        let first = display_account("22222222-2222-2222-2222-222222222222", "workspace-alpha");
+        let second = display_account("11111111-1111-1111-1111-111111111111", "workspace-beta");
+
+        let forward = ordinals_by_id(&[first.clone(), second.clone()]);
+        let reversed = ordinals_by_id(&[second.clone(), first.clone()]);
+
+        assert_eq!(forward, reversed);
+        assert_eq!(forward[&second.id], 1);
+        assert_eq!(forward[&first.id], 2);
+    }
+}
diff --git a/rust/src/codex_accounts/mod.rs b/rust/src/codex_accounts/mod.rs
index f2c54647ba..f8dfb8edd6 100644
--- a/rust/src/codex_accounts/mod.rs
+++ b/rust/src/codex_accounts/mod.rs
@@ -18,6 +18,7 @@ pub(crate) mod credentials;
 mod extra_usage;
 mod fetch_coordination;
 pub mod file_locations;
+mod labels;
 pub mod login_runner;
 pub mod models;
 pub mod stores;
@@ -35,10 +36,11 @@ pub use codex_desktop::{
     encode_powershell_script, restart_codex_desktop,
 };
 pub use credentials::{AuthBackedIdentity, AuthCredentials, load_identity};
+pub use labels::{display_names_by_id, ordinals_by_id};
 pub use login_runner::{CodexLoginOutcome, CodexLoginResult, ManagedLoginProcess};
 pub use models::{
     AccountUsageSnapshot, CodexAccount, CodexAccountSource, CreditsBalanceSnapshot,
-    RemovedAccountIdentity, UsageWindowSnapshot, display_names_by_id, ordinals_by_id, utc_now,
+    RemovedAccountIdentity, UsageWindowSnapshot, utc_now,
 };
 pub use stores::{AccountStore, SnapshotStore};
 pub use switch_runtime::CodexAccountRuntime;
diff --git a/rust/src/codex_accounts/models.rs b/rust/src/codex_accounts/models.rs
index 406586428c..40c29abb60 100644
--- a/rust/src/codex_accounts/models.rs
+++ b/rust/src/codex_accounts/models.rs
@@ -3,8 +3,7 @@
 //! Field names intentionally mirror CodexControl's `windows/.../models.py` (MIT)
 //! so stored data interops with that project.
 
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
@@ -149,52 +148,6 @@ impl CodexAccount {
         }
     }
 
-    pub fn display_name(&self) -> String {
-        self.display_label_base()
-    }
-
-    /// Return the label used by a user-facing account surface.
-    ///
-    /// Privacy mode applies to the ambient/System account only. Managed
-    /// accounts retain their existing display names so account actions and
-    /// identity siloing continue to address the same account.
-    pub fn privacy_safe_display_name(
-        &self,
-        hide_personal_info: bool,
-        ordinal: usize,
-        generic_label: &str,
-    ) -> String {
-        if hide_personal_info && self.source == CodexAccountSource::Ambient {
-            let label = generic_label.trim();
-            let label = if label.is_empty() { "Account" } else { label };
-            return format!("{label} {ordinal}");
-        }
-        self.display_name()
-    }
-
-    /// Return the user-facing account label without falling back to
-    /// credentials, provider identifiers, or filesystem paths.
-    fn display_label_base(&self) -> String {
-        let nickname = self
-            .nickname
-            .as_deref()
-            .map(str::trim)
-            .filter(|s| !s.is_empty());
-        let email = self
-            .email_hint
-            .as_deref()
-            .map(str::trim)
-            .filter(|s| !s.is_empty())
-            .map(str::to_lowercase);
-
-        match (email, nickname) {
-            (Some(email), Some(nickname)) => format!("{email} — {nickname}"),
-            (Some(email), None) => email,
-            (None, Some(nickname)) => nickname.to_string(),
-            (None, None) => "Workspace".to_string(),
-        }
-    }
-
     pub fn normalized_email_hint(&self) -> Option<String> {
         normalize_identifier(self.email_hint.as_deref())
     }
@@ -243,11 +196,6 @@ impl CodexAccount {
             .to_lowercase()
     }
 
-    fn display_identity(&self) -> String {
-        self.effective_workspace_account_id()
-            .unwrap_or_else(|| self.id.to_string().to_lowercase())
-    }
-
     fn source_priority(&self) -> u8 {
         if self.source.owns_files() { 2 } else { 1 }
     }
@@ -345,76 +293,6 @@ impl CodexAccount {
     }
 }
 
-/// Build the stable labels used by account-facing surfaces.
-///
-/// A provider account id is a workspace identity, but it must never be shown
-/// directly. Only accounts whose privacy-safe display labels collide receive
-/// an opaque suffix. The stored account UUID is folded into the hashed
-/// identity when two entries claim the same provider identity, keeping
-/// separate local profiles distinguishable without exposing a home path or
-/// provider id.
-pub fn display_names_by_id(accounts: &[CodexAccount]) -> HashMap<Uuid, String> {
-    let mut groups: HashMap<String, Vec<usize>> = HashMap::new();
-    for (index, account) in accounts.iter().enumerate() {
-        groups
-            .entry(account.display_label_base().to_lowercase())
-            .or_default()
-            .push(index);
-    }
-
-    let mut labels = HashMap::with_capacity(accounts.len());
-    for indexes in groups.into_values() {
-        if indexes.len() == 1 {
-            let index = indexes[0];
-            labels.insert(accounts[index].id, accounts[index].display_label_base());
-            continue;
-        }
-
-        let mut identity_counts: HashMap<String, usize> = HashMap::new();
-        for &index in &indexes {
-            *identity_counts
-                .entry(accounts[index].display_identity())
-                .or_default() += 1;
-        }
-
-        for &index in &indexes {
-            let account = &accounts[index];
-            let identity = account.display_identity();
-            let identity = if identity_counts.get(&identity) == Some(&1) {
-                identity
-            } else {
-                format!("{identity}\0{}", account.id)
-            };
-            let suffix = crate::core::sha256_hex(identity.as_bytes());
-            labels.insert(
-                account.id,
-                format!("{} · {}", account.display_label_base(), &suffix[..8]),
-            );
-        }
-    }
-    labels
-}
-
-/// Assign stable, opaque ordinals for account surfaces that hide personal data.
-///
-/// The account UUID is never displayed. Sorting it here keeps tray and React
-/// consumers consistent even when discovery returns accounts in a different
-/// order.
-pub fn ordinals_by_id(accounts: &[CodexAccount]) -> HashMap<Uuid, usize> {
-    let mut ordered: Vec<(String, usize, Uuid)> = accounts
-        .iter()
-        .enumerate()
-        .map(|(index, account)| (account.id.to_string(), index, account.id))
-        .collect();
-    ordered.sort_by(|left, right| left.0.cmp(&right.0).then_with(|| left.1.cmp(&right.1)));
-
-    ordered
-        .into_iter()
-        .enumerate()
-        .map(|(index, (_, _, id))| (id, index + 1))
-        .collect()
-}
-
 /// Identity of a previously-removed account, kept to avoid re-adding it.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -637,31 +515,10 @@ pub fn account_sort_priority(snapshot: &AccountUsageSnapshot) -> u8 {
     }
 }
 
-fn _path_is_trailing(path: &Path) -> bool {
-    path.as_os_str()
-        .to_string_lossy()
-        .ends_with(std::path::MAIN_SEPARATOR)
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    fn display_account(id: &str, provider_account_id: &str) -> CodexAccount {
-        CodexAccount::new(
-            Uuid::parse_str(id).unwrap(),
-            None,
-            Some("user@example.com".to_string()),
-            None,
-            Some(provider_account_id.to_string()),
-            PathBuf::from(format!("C:/private/{provider_account_id}")),
-            CodexAccountSource::ManagedByApp,
-            utc_now(),
-            utc_now(),
-            None,
-        )
-    }
-
     fn account(
         id: &str,
         home: &str,
@@ -813,104 +670,6 @@ mod tests {
         assert!(!CodexAccountSource::Ambient.owns_files());
     }
 
-    #[test]
-    fn display_names_disambiguate_same_email_without_exposing_workspace_identity() {
-        let first = display_account("11111111-1111-1111-1111-111111111111", "workspace-alpha");
-        let second = display_account("22222222-2222-2222-2222-222222222222", "workspace-beta");
-
-        let labels = display_names_by_id(&[first.clone(), second.clone()]);
-        let first_label = labels.get(&first.id).unwrap();
-        let second_label = labels.get(&second.id).unwrap();
-        assert_ne!(first_label, second_label);
-        for label in [first_label, second_label] {
-            assert!(label.starts_with("user@example.com · "));
-            assert_eq!(label.rsplit_once(' ').unwrap().1.len(), 8);
-            assert!(!label.contains("workspace-"));
-            assert!(!label.contains("C:/private"));
-            assert!(!label.contains("auth0|"));
-        }
-
-        let reordered = display_names_by_id(&[second, first.clone()]);
-        assert_eq!(reordered.get(&first.id), Some(first_label));
-
-        let mut relaunched_first = first.clone();
-        relaunched_first.codex_home_path = PathBuf::from("C:/different-managed-home");
-        let mut relaunched_second = first.clone();
-        relaunched_second.id = Uuid::parse_str("66666666-6666-6666-6666-666666666666").unwrap();
-        relaunched_second.provider_account_id = Some("workspace-beta".to_string());
-        let relaunched = display_names_by_id(&[relaunched_first, relaunched_second]);
-        assert_eq!(relaunched.get(&first.id), Some(first_label));
-    }
-
-    #[test]
-    fn display_names_keep_duplicate_workspace_profiles_distinct() {
-        let first = display_account("33333333-3333-3333-3333-333333333333", "shared-workspace");
-        let second = display_account("44444444-4444-4444-4444-444444444444", "shared-workspace");
-
-        let labels = display_names_by_id(&[first.clone(), second.clone()]);
-        assert_ne!(labels.get(&first.id), labels.get(&second.id));
-        assert!(labels[&first.id].starts_with("user@example.com · "));
-        assert!(labels[&second.id].starts_with("user@example.com · "));
-        let reordered = display_names_by_id(&[second, first.clone()]);
-        assert_eq!(reordered.get(&first.id), labels.get(&first.id));
-    }
-
-    #[test]
-    fn display_names_use_generic_base_when_identity_fields_are_missing() {
-        let mut account =
-            display_account("55555555-5555-5555-5555-555555555555", "secret-workspace");
-        account.email_hint = None;
-        account.auth_subject = Some("auth0|secret-subject".to_string());
-        account.nickname = None;
-
-        let labels = display_names_by_id(&[account]);
-        let label = labels.values().next().unwrap();
-        assert!(label.starts_with("Workspace"));
-        assert!(!label.contains("secret-workspace"));
-        assert!(!label.contains("secret-subject"));
-        assert!(!label.contains("C:/private"));
-    }
-
-    #[test]
-    fn privacy_safe_display_name_hides_system_identity_but_preserves_managed_labels() {
-        let mut system =
-            display_account("11111111-1111-1111-1111-111111111111", "system-workspace");
-        system.source = CodexAccountSource::Ambient;
-        system.nickname = Some("Private System Name".to_string());
-        let mut managed =
-            display_account("22222222-2222-2222-2222-222222222222", "managed-workspace");
-        managed.nickname = Some("Work".to_string());
-
-        let hidden_system = system.privacy_safe_display_name(true, 1, "Account");
-        let hidden_managed = managed.privacy_safe_display_name(true, 2, "Account");
-        assert_eq!(hidden_system, "Account 1");
-        assert!(!hidden_system.contains("@"));
-        assert!(!hidden_system.contains("Private System Name"));
-        assert_eq!(hidden_managed, "user@example.com — Work");
-
-        assert_eq!(
-            system.privacy_safe_display_name(false, 1, "Account"),
-            "user@example.com — Private System Name"
-        );
-        assert_eq!(
-            managed.privacy_safe_display_name(false, 2, "Account"),
-            "user@example.com — Work"
-        );
-    }
-
-    #[test]
-    fn ordinals_are_stable_when_account_discovery_order_changes() {
-        let first = display_account("22222222-2222-2222-2222-222222222222", "workspace-alpha");
-        let second = display_account("11111111-1111-1111-1111-111111111111", "workspace-beta");
-
-        let forward = ordinals_by_id(&[first.clone(), second.clone()]);
-        let reversed = ordinals_by_id(&[second.clone(), first.clone()]);
-
-        assert_eq!(forward, reversed);
-        assert_eq!(forward[&second.id], 1);
-        assert_eq!(forward[&first.id], 2);
-    }
-
     #[test]
     fn window_role_classification() {
         assert_eq!(
@@ -1017,16 +776,4 @@ mod tests {
         assert_eq!(managed.source, CodexAccountSource::ManagedByApp);
         assert_eq!(managed.display_name(), "My acct");
     }
-
-    #[test]
-    fn display_name_does_not_fall_back_to_home_path() {
-        let acct = account(
-            "11111111-1111-1111-1111-111111111111",
-            "/x/my-home-dir",
-            CodexAccountSource::ManagedByApp,
-            None,
-        );
-        assert_eq!(acct.display_name(), "Workspace");
-        let _ = _path_is_trailing(std::path::Path::new("/x/"));
-    }
 }