docs: harden cleanup and review assertions

Author: ndycode

docs/privacy.md

@@ -57,21 +57,23 @@ These commands delete local state. Review the resolved paths before running them
 Bash:
 
 ```bash
-rm -f ~/.codex/multi-auth/settings.json
-rm -f ~/.codex/multi-auth/openai-codex-accounts.json
-rm -f ~/.codex/multi-auth/openai-codex-flagged-accounts.json
-rm -f ~/.codex/multi-auth/quota-cache.json
-rm -rf ~/.codex/multi-auth/logs/codex-plugin
-rm -f ~/.codex/multi-auth/logs/audit.log ~/.codex/multi-auth/logs/audit.*.log
-rm -rf ~/.codex/multi-auth/cache
+rm -f -- ~/.codex/multi-auth/settings.json
+rm -f -- ~/.codex/multi-auth/openai-codex-accounts.json
+rm -f -- ~/.codex/multi-auth/openai-codex-flagged-accounts.json
+rm -f -- ~/.codex/multi-auth/quota-cache.json
+rm -rf -- ~/.codex/multi-auth/logs/codex-plugin
+rm -f -- ~/.codex/multi-auth/logs/audit.log ~/.codex/multi-auth/logs/audit.*.log
+rm -rf -- ~/.codex/multi-auth/cache
 # Override-root cleanup examples (if overrides are set):
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -f "$CODEX_MULTI_AUTH_DIR/settings.json"
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -f "$CODEX_MULTI_AUTH_DIR/openai-codex-accounts.json"
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -f "$CODEX_MULTI_AUTH_DIR/openai-codex-flagged-accounts.json"
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -f "$CODEX_MULTI_AUTH_DIR/quota-cache.json"
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -rf "$CODEX_MULTI_AUTH_DIR/logs/codex-plugin"
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -f "$CODEX_MULTI_AUTH_DIR/logs/audit.log" "$CODEX_MULTI_AUTH_DIR/logs/audit."*.log
-[ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && rm -rf "$CODEX_MULTI_AUTH_DIR/cache"
+if [ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && [ -f "$CODEX_MULTI_AUTH_DIR/settings.json" ]; then
+  rm -f -- "$CODEX_MULTI_AUTH_DIR/settings.json"
+  rm -f -- "$CODEX_MULTI_AUTH_DIR/openai-codex-accounts.json"
+  rm -f -- "$CODEX_MULTI_AUTH_DIR/openai-codex-flagged-accounts.json"
+  rm -f -- "$CODEX_MULTI_AUTH_DIR/quota-cache.json"
+  rm -rf -- "$CODEX_MULTI_AUTH_DIR/logs/codex-plugin"
+  rm -f -- "$CODEX_MULTI_AUTH_DIR/logs/audit.log" "$CODEX_MULTI_AUTH_DIR/logs"/audit.*.log
+  rm -rf -- "$CODEX_MULTI_AUTH_DIR/cache"
+fi
 [ -n "${CODEX_MULTI_AUTH_CONFIG_PATH:-}" ] && [ -f "$CODEX_MULTI_AUTH_CONFIG_PATH" ] && rm -f "$CODEX_MULTI_AUTH_CONFIG_PATH"
 ```
 
@@ -87,7 +89,7 @@ Remove-Item "$HOME\.codex\multi-auth\logs\audit.log" -Force -ErrorAction Silentl
 Get-ChildItem "$HOME\.codex\multi-auth\logs" -Filter "audit.*.log" -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue
 Remove-Item "$HOME\.codex\multi-auth\cache" -Recurse -Force -ErrorAction SilentlyContinue
 # Override-root cleanup examples (if overrides are set):
-if ($env:CODEX_MULTI_AUTH_DIR) {
+if ($env:CODEX_MULTI_AUTH_DIR -and (Test-Path (Join-Path $env:CODEX_MULTI_AUTH_DIR "settings.json"))) {
   foreach ($relativePath in @(
     "settings.json",
     "openai-codex-accounts.json",

test/documentation.test.ts

@@ -226,11 +226,11 @@ describe("Documentation Integrity", () => {
 		expect(gettingStarted).toContain(
 			"This installs the local account manager for `codex auth ...`.",
 		);
-		expect(gettingStarted).not.toContain(
-			"Verify that the wrapper is active:\n\n```bash\ncodex --version",
+		expect(gettingStarted).not.toMatch(
+			/Verify that the wrapper is active:\s*```bash\s*codex --version/,
 		);
-		expect(readme).not.toContain(
-			"### Option D: Verify account-manager wiring\n\n```bash\ncodex --version",
+		expect(readme).not.toMatch(
+			/### Option D: Verify account-manager wiring\s*```bash\s*codex --version/,
 		);
 
 		expect(privacy).toContain('$CODEX_MULTI_AUTH_DIR/settings.json');
@@ -243,6 +243,12 @@ describe("Documentation Integrity", () => {
 		expect(privacy).toContain('$CODEX_MULTI_AUTH_DIR/cache');
 		expect(privacy).toContain("foreach ($relativePath in @(");
 		expect(privacy).toContain("Join-Path $env:CODEX_MULTI_AUTH_DIR $relativePath");
+		expect(privacy).toContain(
+			'if [ -n "${CODEX_MULTI_AUTH_DIR:-}" ] && [ -f "$CODEX_MULTI_AUTH_DIR/settings.json" ]; then',
+		);
+		expect(privacy).toContain(
+			'if ($env:CODEX_MULTI_AUTH_DIR -and (Test-Path (Join-Path $env:CODEX_MULTI_AUTH_DIR "settings.json")))',
+		);
 		expect(privacy).toContain('Get-ChildItem "$HOME\\.codex\\multi-auth\\logs" -Filter "audit.*.log"');
 		expect(privacy).toContain('Get-ChildItem (Join-Path $env:CODEX_MULTI_AUTH_DIR "logs") -Filter "audit.*.log"');
 
@@ -282,14 +288,17 @@ describe("Documentation Integrity", () => {
 		expect(readme).toContain("needs non-auth `codex` commands to be forwarded");
 		expect(advancedInstall).toContain("`scripts/install-codex-auth.js` does the following:");
 		expect(advancedInstall).toContain(
-			"> It should be treated as an operator action, not something an LLM agent runs automatically.\n\n> [!NOTE]",
+			"> It should be treated as an operator action, not something an LLM agent runs automatically.",
 		);
+		expect(advancedInstall).toContain("> [!NOTE]");
 		expect(advancedInstall).toContain('Remove-Item "$env:APPDATA\\Codex\\Codex.json.bak-*"');
 		expect(advancedInstall).toContain("rm -f ~/.config/Codex/Codex.json.bak-*");
 		expect(advancedInstall).toContain("see [privacy.md](privacy.md)");
+		expect(upgrade).toContain("1. Rebuild account health baseline:");
 		expect(upgrade).toContain(
-			"1. Rebuild account health baseline:\n\n   > Agents should confirm with the user before running `codex auth login` because it opens a browser OAuth flow and mutates local auth state.\n\n   ```bash",
+			"Agents should confirm with the user before running `codex auth login` because it opens a browser OAuth flow and mutates local auth state.",
 		);
+		expect(upgrade).toContain("codex auth forecast --live --model gpt-5-codex");
 	});
 
 	it("documents public API stability tiers and error contracts", () => {

test/install-codex-auth.test.ts

@@ -49,7 +49,6 @@ describe("install-codex-auth script", () => {
 		});
 
 		expect(result.status).toBe(0);
-		expect(result.stderr).toBe("");
 		expect(result.stdout).toContain("~/.config/Codex/Codex.json");
 		expect(result.stdout).toContain("%APPDATA%\\Codex\\Codex.json");
 		expect(result.stdout).toContain("transient config-file locks are retried automatically");