[Bug]: imported local CLI credential with invalid expires_at is adopted and never refreshed; ocx status shows "logged in" #1366

Client or integration

Codex CLI

Area

Authentication and account pool

Summary

An imported local CLI credential (Grok ~/.grok/auth.json or Claude .credentials.json) whose expires_at is invalid (e.g. "garbage", "", "1970-01-01") is treated as valid and never refreshed:

1. src/oauth/local-token-detect.ts:27 — new Date(entry.expires_at as string).getTime() returns NaN for any unparseable string.
2. shouldAdoptGrokGeneration() (src/oauth/local-token-detect.ts:52-62) then behaves incorrectly for NaN:
   • disk.expires <= now + refreshSkewMs is always false for NaN → the expired/garbage credential passes the expiry gate;
   • bothExpiriesExist = stored.expires > 0 && disk.expires > 0 is false (NaN > 0 is false) → the function falls through to return true, so the disk credential is adopted as the authoritative generation.
3. authoritative() (src/oauth/index.ts:441) therefore replaces the stored credential with the garbage one, and the refresh path never re-validates it — the stale credential occupies the account slot indefinitely.
4. getLoginStatus() (src/oauth/index.ts:1178) reports loggedIn: !!cred (credential exists), ignoring expires/needsReauth; ocx status then prints ✓ logged in in the "OAuth logins" section for an expired or unparseable credential (the separate health block may flag needsReauth, but the logins section is the misleading first screen).

Same structural issue as a stale/epoch-garbage expires_at (e.g. 1970-01-22) observed in a real CLI credential file: the import is adopted even though it can never be refreshed.

Reproduction

1. Create a fake Grok CLI credential:

   {
     "https://auth.x.ai::1": {
       "key": "xai-stub-access",
       "refresh_token": "xai-stub-refresh",
       "expires_at": "not-a-date"
     }
   }

   at ~/.grok/auth.json (or a Claude .credentials.json with expiresAt: "garbage").
2. Run ocx login xai --import-local (or any flow that reaches detectGrokCliToken/authoritative).
3. Observe: the invalid-expiry credential is adopted (shouldAdoptGrokGeneration returns true); ocx status shows xai ✓ logged in; no refresh is attempted because the expiry comparison is NaN.

Expected: an unparseable/expired expires_at must be treated as unknown → refresh required (or reject the import), never as "valid and never refresh".

Version

2.11.1 (121f1ad9)

Operating system

Cross-platform (Linux/macOS CLI credential paths; Windows unaffected by ~/.grok but the same parsing logic applies)

Provider and model

xai (grok) / anthropic (claude) — local CLI token import

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.