@bitkyc08/opencodex 2.7.41 → 2.7.42

package/src/cli/provider.ts

@@ -265,6 +265,15 @@ function handleRemove(args: string[]): void {
     process.exit(1);
   }
 
+  const dependentCombos = Object.entries(config.combos ?? {})
+    .filter(([, combo]) => combo.targets.some(target => target.provider === name))
+    .map(([id]) => id)
+    .sort();
+  if (dependentCombos.length > 0) {
+    console.error(`Cannot remove "${name}" — combo(s) depend on it: ${dependentCombos.join(", ")}`);
+    process.exit(1);
+  }
+
   delete config.providers[name];
   validateAndSave(config);
 
@@ -374,9 +383,15 @@ const PROVIDER_USAGE = `Usage: ocx provider <subcommand>
 Subcommands:
   list                  List configured and available providers
   add <name>            Add a provider (registry or custom)
+  edit <name>           Edit live provider fields
+  test <name>           Test the provider's upstream model endpoint
   remove <name>         Remove a configured provider
   show <name>           Show provider config details
   set-default <name>    Change the default provider
+  selected <name>       Show or set the provider model allowlist
+  quota                 Show provider quota reports
+  presets               List GUI provider presets
+  account-mode <mode>   Set OpenAI Codex pool/direct mode
 
 Examples:
   ocx provider list
@@ -412,9 +427,16 @@ export async function handleProviderCommand(args: string[]): Promise<void> {
     case "set-default":
       handleSetDefault(subArgs);
       break;
-    default:
+    default: {
+      const { handleProviderRuntimeCommand } = await import("./provider-runtime");
+      const code = await handleProviderRuntimeCommand(sub, subArgs);
+      if (code !== null) {
+        process.exitCode = code;
+        break;
+      }
       console.error(`Unknown provider subcommand: ${sub}`);
       console.error(PROVIDER_USAGE);
       process.exit(1);
+    }
   }
 }

package/src/cli/runtime-api.ts

@@ -0,0 +1,325 @@
+/**
+ * Shared management-plane client for headless CLI commands.
+ *
+ * [Decision Log]
+ * - 목적과 의도: GUI가 사용하는 관리 기능을 CLI에서도 같은 검증과 저장 경로로 제공한다.
+ * - 기존 구현 및 제약 조건: 관리 API에 이미 도메인 검증과 live-config 갱신이 있으나 CLI마다 fetch를 복제했다.
+ * - 검토한 주요 대안: config.json 직접 수정, 각 CLI 모듈별 fetch 구현, 공용 관리 API client.
+ * - 선택한 방식: identity-checked live proxy를 찾은 뒤 공용 client로 관리 API를 호출한다.
+ * - 다른 대안 대신 이 방식을 선택한 이유: GUI/CLI의 검증 규칙이 갈라지지 않고 fallback port도 안전하게 찾는다.
+ * - 장점, 단점 및 영향: 동작 일관성이 높아지는 대신 live 관리 명령은 실행 중인 proxy가 필요하다.
+ */
+import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { runningProxyUpdateHeaders } from "../oauth/login-cli";
+
+export type CliStdin = NodeJS.ReadableStream & { isTTY?: boolean; readableEnded?: boolean };
+
+export interface RuntimeApiDeps {
+  baseUrl?: string;
+  fetchImpl?: typeof fetch;
+  /** Test injection for commands that read a secret from stdin instead of argv. */
+  stdinImpl?: CliStdin;
+  stdinTimeoutMs?: number;
+}
+
+export class CliUsageError extends Error {
+  constructor(message: string, readonly usage?: string) {
+    super(message);
+    this.name = "CliUsageError";
+  }
+}
+
+export class RuntimeApiError extends Error {
+  constructor(
+    message: string,
+    readonly status: number,
+    readonly body: unknown,
+  ) {
+    super(message);
+    this.name = "RuntimeApiError";
+  }
+}
+
+export async function runtimeBaseUrl(deps: RuntimeApiDeps = {}): Promise<string> {
+  if (deps.baseUrl) return deps.baseUrl.replace(/\/$/, "");
+  const live = await findLiveProxy();
+  if (!live) throw new RuntimeApiError("Proxy is not running. Start it with: ocx start", 503, null);
+  return `http://${probeHostname(live.hostname)}:${live.port}`;
+}
+
+function responseMessage(body: unknown, status: number): string {
+  if (body && typeof body === "object") {
+    const record = body as Record<string, unknown>;
+    for (const key of ["error", "message", "detail"]) {
+      if (typeof record[key] === "string" && record[key]) return record[key];
+    }
+  }
+  if (typeof body === "string" && body.trim()) return body.trim().slice(0, 400);
+  return `Management request failed (${status})`;
+}
+
+export async function runtimeRequest<T = unknown>(
+  path: string,
+  init: RequestInit = {},
+  deps: RuntimeApiDeps = {},
+): Promise<T> {
+  const baseUrl = await runtimeBaseUrl(deps);
+  const headers = runningProxyUpdateHeaders();
+  for (const [key, value] of new Headers(init.headers).entries()) headers.set(key, value);
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let response: Response;
+  try {
+    response = await fetchImpl(`${baseUrl}${path.startsWith("/") ? path : `/${path}`}`, { ...init, headers });
+  } catch (error) {
+    throw new RuntimeApiError(
+      `Management API is unreachable: ${error instanceof Error ? error.message : String(error)}`,
+      503,
+      null,
+    );
+  }
+  const text = await response.text();
+  let body: unknown = null;
+  if (text) {
+    try { body = JSON.parse(text); }
+    catch { body = text; }
+  }
+  if (!response.ok) throw new RuntimeApiError(responseMessage(body, response.status), response.status, body);
+  return body as T;
+}
+
+export function takeFlag(args: string[], flag: string): boolean {
+  const index = args.indexOf(flag);
+  if (index === -1) return false;
+  args.splice(index, 1);
+  return true;
+}
+
+export function takeOption(args: string[], flag: string): string | undefined {
+  const index = args.indexOf(flag);
+  if (index === -1) return undefined;
+  const value = args[index + 1];
+  if (value === undefined || value.startsWith("--")) throw new CliUsageError(`${flag} requires a value`);
+  args.splice(index, 2);
+  return value;
+}
+
+export function takeBooleanOption(args: string[], flag: string): boolean | undefined {
+  const raw = takeOption(args, flag);
+  if (raw === undefined) return undefined;
+  if (["on", "true", "yes", "1", "enabled"].includes(raw.toLowerCase())) return true;
+  if (["off", "false", "no", "0", "disabled"].includes(raw.toLowerCase())) return false;
+  throw new CliUsageError(`${flag} must be on or off`);
+}
+
+export function takeIntegerOption(args: string[], flag: string, options: { min?: number } = {}): number | undefined {
+  const raw = takeOption(args, flag);
+  if (raw === undefined) return undefined;
+  const value = Number(raw.replace(/[_,]/g, ""));
+  if (!Number.isInteger(value) || value < (options.min ?? Number.MIN_SAFE_INTEGER)) {
+    throw new CliUsageError(`${flag} must be an integer${options.min !== undefined ? ` >= ${options.min}` : ""}`);
+  }
+  return value;
+}
+
+export function csv(value: string | undefined): string[] | undefined {
+  if (value === undefined) return undefined;
+  return [...new Set(value.split(",").map(item => item.trim()).filter(Boolean))];
+}
+
+/**
+ * Options whose VALUE is a credential, listed here so a parse error never
+ * prints one.
+ *
+ * `takeOption` only understands `--flag value`. `--flag=value` therefore falls
+ * through to `rejectArgs`, which reports the offending argument verbatim — for
+ * `--code=https://…?code=SECRET` that writes the authorization code to stderr,
+ * which is the exact exposure the stdin path exists to avoid.
+ */
+const SECRET_OPTIONS = ["--code"];
+
+/**
+ * Replace credential values before they are reported back.
+ *
+ * Both spellings have to be covered, and the space-separated one spans two
+ * tokens: mistyping `ocx account cancel <p> --code <secret>` on a command that
+ * does not parse `--code` leaves the flag AND its value in the leftovers, and
+ * reporting them verbatim writes the credential to stderr. Repeating the
+ * option does the same with the second value, since the parser takes only the
+ * first occurrence.
+ *
+ * The token after the option is redacted whatever it looks like. Skipping
+ * `--`-prefixed tokens read as "that is a flag, not a value", but the shell
+ * hands over whatever was typed: `--code --SUPERSECRET` and
+ * `--code -- SUPERSECRET` both put the credential straight in the message. A
+ * mistaken `--code --json` now reads `--code <redacted>`, which is worse
+ * diagnostics for a case that already prints the usage text, and better than
+ * printing a credential.
+ *
+ * `redactValues` extends that to bare leftovers, for commands whose positional
+ * argument is itself a credential.
+ */
+function redactSecretArgs(args: string[], redactValues = false): string[] {
+  const out: string[] = [];
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index] as string;
+    const inline = SECRET_OPTIONS.find(option => arg.startsWith(`${option}=`));
+    if (inline) {
+      out.push(`${inline}=<redacted>`);
+      continue;
+    }
+    if (SECRET_OPTIONS.includes(arg)) {
+      out.push(arg);
+      // Swallow the value that belongs to it. `--` is an end-of-options
+      // separator, so the value is the token after it.
+      let valueIndex = index + 1;
+      if (args[valueIndex] === "--") {
+        out.push("--");
+        valueIndex++;
+      }
+      if (args[valueIndex] !== undefined) {
+        out.push("<redacted>");
+        index = valueIndex;
+      }
+      continue;
+    }
+    out.push(redactValues && !arg.startsWith("-") ? "<redacted>" : arg);
+  }
+  return out;
+}
+
+export interface RejectArgsOptions {
+  /**
+   * Report bare leftovers as `<redacted>`. Set by commands where a stray
+   * positional is plausibly the credential itself — `ocx account code <p>`
+   * takes one positional code, so a second one is echoed by the usage error
+   * unless it is hidden. Flag-shaped leftovers stay visible, because a
+   * mistyped flag is the thing the message needs to name.
+   */
+  redactValues?: boolean;
+}
+
+export function rejectArgs(args: string[], usage: string, options?: RejectArgsOptions): void {
+  if (args.length > 0) {
+    const shown = redactSecretArgs(args, options?.redactValues === true);
+    throw new CliUsageError(`Unexpected argument(s): ${shown.join(" ")}`, usage);
+  }
+}
+
+/**
+ * `--flag value` or `--flag=value`, reporting which spelling was used.
+ *
+ * The equals form is accepted rather than rejected: rejecting it routes the
+ * value through `rejectArgs`, and a caller who typed `--code=<secret>` would
+ * see their credential echoed back. Accepting it lets the command warn about
+ * the shell-history exposure without repeating the value.
+ */
+export function takeOptionWithSyntax(
+  args: string[],
+  flag: string,
+): { value: string; inline: boolean } | undefined {
+  const occurrences = args.filter(arg => arg === flag || arg.startsWith(`${flag}=`)).length;
+  // Taking only the first occurrence would leave the second value in the
+  // leftovers for rejectArgs to report. Say what is wrong without repeating
+  // either value.
+  if (occurrences > 1) throw new CliUsageError(`${flag} was given more than once`);
+
+  const inlineIndex = args.findIndex(arg => arg.startsWith(`${flag}=`));
+  if (inlineIndex !== -1) {
+    const [raw] = args.splice(inlineIndex, 1) as [string];
+    const value = raw.slice(flag.length + 1);
+    if (!value) throw new CliUsageError(`${flag} requires a value`);
+    return { value, inline: true };
+  }
+  const value = takeOption(args, flag);
+  return value === undefined ? undefined : { value, inline: false };
+}
+
+/**
+ * Read one line from stdin without it ever reaching argv.
+ *
+ * Same shape as `readStdinLine` in account-extended.ts: resolve on the first
+ * newline, on end-of-stream, or reject on timeout, and always drop the
+ * listeners so a caller that continues running does not leak them.
+ */
+export async function readSecretLine(deps: RuntimeApiDeps, label: string): Promise<string> {
+  const input: CliStdin = deps.stdinImpl ?? process.stdin;
+  const timeoutMs = deps.stdinTimeoutMs ?? 120_000;
+  // A stream that already ended emits nothing more, so attaching listeners
+  // would wait out the full timeout and then blame a slow paste. `echo … |
+  // something-else | ocx account code <p>` reaches here that way.
+  if (input.readableEnded === true) throw new CliUsageError(`${label} input was empty`);
+  const line = await new Promise<string>((resolve, reject) => {
+    let buffer = "";
+    let settled = false;
+    const cleanup = () => {
+      clearTimeout(timer);
+      input.removeListener("data", onData);
+      input.removeListener("end", onEnd);
+      input.removeListener("error", onError);
+    };
+    const finish = (fn: () => void) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      fn();
+    };
+    const onData = (chunk: unknown) => {
+      buffer += Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk);
+      const newline = buffer.search(/[\r\n]/);
+      if (newline >= 0) finish(() => resolve(buffer.slice(0, newline).trim()));
+    };
+    const onEnd = () => finish(() => resolve(buffer.trim()));
+    const onError = (error: Error) => finish(() => reject(error));
+    const timer = setTimeout(
+      () => finish(() => reject(new CliUsageError(`timed out waiting for ${label} on stdin`))),
+      timeoutMs,
+    );
+    input.on("data", onData);
+    input.on("end", onEnd);
+    input.on("error", onError);
+  });
+  if (!line) throw new CliUsageError(`${label} input was empty`);
+  return line;
+}
+
+export function printData(value: unknown, wantsJson: boolean, lines?: string[]): void {
+  if (wantsJson || !lines) console.log(JSON.stringify(value, null, 2));
+  else for (const line of lines) console.log(line);
+}
+
+/** Compact human view for safe management DTOs; JSON remains available for complete fidelity. */
+export function summaryLines(value: unknown, prefix = "", depth = 0): string[] {
+  if (!value || typeof value !== "object" || depth > 1) return [`${prefix || "value"}: ${String(value)}`];
+  const lines: string[] = [];
+  for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
+    const label = prefix ? `${prefix}.${key}` : key;
+    if (Array.isArray(child)) {
+      const scalar = child.every(item => item === null || ["string", "number", "boolean"].includes(typeof item));
+      lines.push(`${label}: ${scalar ? child.join(", ") || "none" : `${child.length} item(s)`}`);
+    } else if (child && typeof child === "object" && depth < 1) {
+      lines.push(...summaryLines(child, label, depth + 1));
+    } else {
+      lines.push(`${label}: ${child === null || child === undefined || child === "" ? "-" : String(child)}`);
+    }
+  }
+  return lines;
+}
+
+export async function runCliAction(action: () => Promise<void>): Promise<number> {
+  try {
+    await action();
+    return 0;
+  } catch (error) {
+    if (error instanceof CliUsageError) {
+      console.error(`Error: ${error.message}`);
+      if (error.usage) console.error(error.usage);
+      return 2;
+    }
+    if (error instanceof RuntimeApiError) {
+      console.error(`Error: ${error.message}`);
+      return error.status === 404 ? 4 : error.status === 409 ? 5 : 1;
+    }
+    console.error(`Error: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+}

package/src/cli/star-prompt.ts

@@ -35,7 +35,7 @@ function starRepo(): { ok: boolean; error?: string } {
 }
 
 /**
- * First interactive `ocx start`: a one-time `[Y/n]` "star on GitHub?" prompt.
+ * First interactive `ocx start`: a one-time `[y/N]` "star on GitHub?" prompt.
  * On yes, stars the repo via the user's `gh` auth. No-op under the background
  * service, for non-TTY/piped runs, when already prompted, or when `gh` is
  * unavailable. Never throws.
@@ -52,8 +52,8 @@ export async function maybeShowStarPrompt(): Promise<void> {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     let yes = false;
     try {
-      const ans = (await rl.question("\n  \x1b[38;5;141m⭐ Enjoying opencodex? Star it on GitHub?\x1b[0m [Y/n] ")).trim().toLowerCase();
-      yes = ans === "" || ans === "y" || ans === "yes";
+      const ans = (await rl.question("\n  \x1b[38;5;141m⭐ Enjoying opencodex? Star it on GitHub?\x1b[0m [y/N] ")).trim().toLowerCase();
+      yes = ans === "y" || ans === "yes";
     } finally {
       rl.close();
     }

package/src/cli/status.ts

@@ -10,6 +10,7 @@ import { diagnoseCodexShim } from "../codex/shim";
 import { displayCodexRuntimePath, effortClampAppliesToRuntime, loadLastEffortClamp, resolveCodexRuntime } from "../codex/runtime";
 import { redactSecretString, redactUserPath } from "../lib/redact";
 import { collectOrcaCodexHomeDiagnostic, type OrcaCodexHomeDiagnostic } from "../codex/home";
+import { grokFenceEndpointDrift, readGrokStatus } from "../grok/status";
 
 type HealthCheck = {
   ok: boolean;
@@ -194,6 +195,22 @@ export async function collectStatus(): Promise<CliStatusView> {
       `Catalog clamp removed: ${lastClamp!.removedEfforts.join(", ")}. Run ocx doctor for diagnosis and recovery.`,
     );
   }
+  // A Grok fence naming a port we are not listening on is invisible everywhere else:
+  // grok retries the refused connection on its own side, so no request — and therefore
+  // no log line — ever reaches us. Surface it here, where the live port is already known.
+  const grokDrift = (() => {
+    try {
+      return grokFenceEndpointDrift(readGrokStatus(), health.ok ? listen.port : undefined);
+    } catch {
+      return null; // reading grok's config must never break `ocx status`
+    }
+  })();
+  if (grokDrift) {
+    warningParts.push(
+      `Grok Build config points at port ${grokDrift.fencePort}, but the proxy is on `
+      + `${grokDrift.livePort}; grok turns will retry against a closed port. Run 'ocx ensure' to repoint it.`,
+    );
+  }
   const codexRuntime = {
     path: displayCodexRuntimePath(resolvedRuntime.runtime.command),
     version: resolvedRuntime.runtime.version,

package/src/cli/system-command.ts

@@ -0,0 +1,112 @@
+import {
+  CliUsageError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  summaryLines,
+  takeBooleanOption,
+  takeFlag,
+  takeOption,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx system [status] [--json]
+  ocx system settings [--auto-start <on|off>] [--stream-mode <auto|legacy-tee|eager-relay>] [--json]
+  ocx system startup <health|install-service|install-shim> [--json]
+  ocx system diagnostics [--json]
+  ocx system sync [--json]
+  ocx system update check [--channel <latest|preview>] [--json]
+  ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
+  ocx system update status <job-id> [--json]`;
+
+async function status(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const [settings, startup, memory] = await Promise.all([
+    runtimeRequest("/api/settings", {}, deps),
+    runtimeRequest("/api/startup-health", {}, deps),
+    runtimeRequest("/api/system/memory", {}, deps),
+  ]);
+  const result = { settings, startup, memory };
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function settings(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const autoStart = takeBooleanOption(args, "--auto-start");
+  const streamMode = takeOption(args, "--stream-mode");
+  rejectArgs(args, USAGE);
+  if (autoStart === undefined && streamMode === undefined) {
+    const result = await runtimeRequest("/api/settings", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+  const body = { ...(autoStart !== undefined ? { codexAutoStart: autoStart } : {}), ...(streamMode !== undefined ? { streamMode } : {}) };
+  const result = await runtimeRequest("/api/settings", { method: "PUT", body: JSON.stringify(body) }, deps);
+  printData(result, wantsJson, ["System settings updated."]);
+}
+
+async function startup(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const action = (args.shift() ?? "health").toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  if (action === "health" || action === "status") {
+    const result = await runtimeRequest("/api/startup-health", {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+  if (action !== "install-service" && action !== "install-shim") throw new CliUsageError("startup action must be health, install-service, or install-shim", USAGE);
+  const result = await runtimeRequest("/api/startup-action", { method: "POST", body: JSON.stringify({ action }) }, deps);
+  printData(result, wantsJson, [String((result as Record<string, unknown>).message ?? `${action} complete.`)]);
+}
+
+async function update(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const action = (args.shift() ?? "check").toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  if (action === "status") {
+    const jobId = args.shift();
+    if (!jobId) throw new CliUsageError("update job id is required", USAGE);
+    rejectArgs(args, USAGE);
+    printData(await runtimeRequest(`/api/update/status?jobId=${encodeURIComponent(jobId)}`, {}, deps), wantsJson);
+    return;
+  }
+  const channel = takeOption(args, "--channel") ?? "latest";
+  if (channel !== "latest" && channel !== "preview") throw new CliUsageError("--channel must be latest or preview", USAGE);
+  if (action === "check") {
+    rejectArgs(args, USAGE);
+    printData(await runtimeRequest(`/api/update/check?tag=${channel}`, {}, deps), wantsJson);
+    return;
+  }
+  if (action !== "run") throw new CliUsageError(`unknown update action ${action}`, USAGE);
+  const restart = takeBooleanOption(args, "--restart") ?? true;
+  const yes = takeFlag(args, "--yes");
+  if (!yes) throw new CliUsageError("update run requires --yes", USAGE);
+  rejectArgs(args, USAGE);
+  const result = await runtimeRequest("/api/update/run", { method: "POST", body: JSON.stringify({ tag: channel, restart }) }, deps);
+  printData(result, wantsJson, [`Update started (${channel}).`]);
+}
+
+export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCliAction(async () => {
+    const [sub = "status", ...rest] = argv;
+    if (sub === "status") await status(rest, deps);
+    else if (sub === "settings") await settings(rest, deps);
+    else if (sub === "startup") await startup(rest, deps);
+    else if (sub === "diagnostics") {
+      const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/diagnostics/project-config", {}, deps), wantsJson);
+    } else if (sub === "sync") {
+      const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
+      printData(await runtimeRequest("/api/sync", { method: "POST" }, deps), wantsJson);
+    } else if (sub === "update") await update(rest, deps);
+    else throw new CliUsageError(`unknown system command ${sub}`, USAGE);
+  });
+}
+
+export const SYSTEM_USAGE = USAGE;

package/src/codex/auth-api.ts

@@ -10,7 +10,7 @@ import {
   TokenRefreshError,
 } from "./account-store";
 import { deleteCodexAccount, reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
-import { clearCodexAccountCooldown } from "./routing";
+import { clearCodexAccountCooldown, resetCodexRoutingForManualSelection } from "./routing";
 import { checkAccountIdCollision, getMainChatgptAccountId, readCodexTokens, readCodexTokensResult } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
 export { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
@@ -607,8 +607,9 @@ export async function handleCodexAuthAPI(
       if (!exists) return jsonResponse({ error: "Account not found" }, 400);
     }
     runtimeConfig.activeCodexAccountId = body.accountId ?? undefined;
+    resetCodexRoutingForManualSelection(body.accountId ?? MAIN_CODEX_ACCOUNT_ID);
     saveRuntimeConfig(config, runtimeConfig);
-    return jsonResponse({ ok: true, activeCodexAccountId: body.accountId });
+    return jsonResponse({ ok: true, activeCodexAccountId: body.accountId, appliesImmediately: true });
   }
 
   if (url.pathname === "/api/codex-auth/active" && req.method === "GET") {