Expire historical Agent authentication evidence

Only use recent successful runtime verification as current authentication evidence; old chat messages and expired successes no longer imply current credentials.

Checks: Agent catalog and native readiness tests under Node; Agent catalog tests under Electron.

desktop/src/workspace/local-workspace-agent-catalog.cjs

@@ -129,10 +129,7 @@ class LocalWorkspaceAgentCatalog {
         recoveredRuntimeCredential = true
       }
       const runtimeMissing = runtime?.credentialState === 'missing'
-      const verifiedReady = runtime?.credentialState === 'ready'
-        || state.messages.some(message => (
-          message.role === 'agent' && message.agentKind === agent.kind
-        ))
+      const verifiedReady = recentlyVerified(runtime, this.now())
       const nativeReadySource = nativeState === 'ready'
         ? (native.source || 'native-credential')
         : ''

desktop/test/workspace/local-workspace-agent-catalog.test.cjs

@@ -68,6 +68,19 @@ test('WorkBuddy encrypted desktop login blocks standalone invocation with a spec
   assert.equal(agents()[0].availabilitySource, 'workbuddy-desktop-locked')
 })
 
+test('old Agent replies and expired runtime verification do not imply current authentication', async () => {
+  const { catalog, agents, state } = fixture({
+    detectAgents: async () => [{ kind: 'codex', version: '0.146.0', compatibilityState: 'compatible' }],
+    credentialState: async () => ({ state: 'unknown', source: 'native-config-unknown' }),
+  })
+  state.messages.push({ role: 'agent', agentKind: 'codex' })
+  state.agentRuntime.codex = { credentialState: 'ready', checkedAt: '2026-07-01T00:00:00.000Z' }
+  await catalog.refresh()
+  assert.equal(agents()[0].credentialState, 'unknown')
+  assert.equal(agents()[0].recentlyVerified, false)
+  assert.notEqual(agents()[0].availabilitySource, 'verified-run')
+})
+
 test('sidebar visibility preserves a selected WorkBuddy model', async () => {
   const { catalog, state } = fixture({ detectAgents: async () => [{ kind: 'workbuddy' }] })
   state.agentPreferences.workbuddy = { modelId: 'native-text' }