Module identity_auth_persist 

IdentityAccount persistence on a successful OAuth handshake.

Split out of identity_handlers.rs (module-organization pass, see docs/specs/PLAN_LOGIN_SINGLE_PATH_CONSOLIDATION_2026_07_20.md) — called from identity_auth_spawn’s drain/post-exit success paths (spawn_auth_cli + spawn_auth_cli_pty, two call sites each).

Functions

persist_oauth_direct_account 🔒

Upserts the IdentityAccount (SecretRef::OAuthConfigDir, status “valid”) on a successful OAuth handshake (CLI exited 0 + authCheckCommand confirmed). The actual agent_identity_link write happens later, once the agent exists (the launch-flow write-through reconcile) — this function only makes sure the account itself exists and is ready to be linked.

persist_oauth_success 🔒

Shared by all 4 OAuth-success call sites (pipes drain/post-exit, PTY drain/post-exit) — persists the account and builds the (bundle_id, account_id) pair AuthSessionManager::finish_success expects. bundle_id is always empty now: bundle mode (db_identity_bundles binding) was retired in Phase 4c of SPEC_PRESET_TO_BUNDLE_REFACTOR_2026_07_02.md — confirmed unreachable from the frontend (AuthFlowController hardcodes directAccount: true). _direct_account/_into_bundle_id stay as parameters so the wire request shape and the 4 call sites don’t need touching. dir is the account’s own isolation dir, resolved once at spawn time by compute_and_ensure_*_dir in the auth.start handler.