@modelprofile.com/authswitch 6.1.0 → 6.3.0

package/ts/classes.cli.ts

@@ -8,16 +8,17 @@ import { AglAuthSwitchCoordinator, AuthSwitchOperations, authSwitchMutationRepla
 import { readAccountList } from './classes.accountlist.js';
 import { AccountListRenderer } from './classes.listrenderer.js';
 import { accountLimits, activeAccounts, CondensedRenderer } from './classes.limits.js';
-import { consoleTable } from './consoletable.js';
-import { accountName, credentialDriftNote, orderedUsageWindows, readAccountBadges, until, usagePercentText } from './accounts.js';
+import { consoleHeading, consoleTable } from './consoletable.js';
+import { accountName, credentialDriftNote, readAccountBadges, until, usagePercentText } from './accounts.js';
 import { describeHarnessProcesses, describeStopOutcome } from './classes.harnessprocesses.js';
-import { defaultPreusePrompt, PreuseError, validatePreuseOptions } from './preuse.js';
+import { defaultPreusePrompt, preuseAccounts, preuseCountsText, PreuseError, preuseTargets, validatePreuseOptions,
+  type IPreuseRunSummary, type TPreuseAccountResult, type TPreuseOutcome, type TPreuseRunEvent } from './preuse.js';
 import { parseCommandArgs, parseDurationOption, parseIntegerOption, UsageError } from './cliargs.js';
 import { AuthSwitchWatch, watchEventText } from './classes.watch.js';
 import { WatchBusyError, WatchLock } from './classes.watchlock.js';
 import { authSwitchHome } from './classes.credentialstore.js';
 import type { CodexSwitcher } from './classes.codexswitcher.js';
-import type { IAuthHarness, IHarnessAccount, IHarnessOutcome, IHarnessProcess, IHarnessState, IHarnessStopOutcome, IHarnessPreuseResult } from './interfaces.harness.js';
+import type { IAuthHarness, IHarnessAccount, IHarnessOutcome, IHarnessProcess, IHarnessState, IHarnessStopOutcome } from './interfaces.harness.js';
 import { bold, dim, green, orange, plainText, red } from './formatting.js';
 
 const canPrompt = (): boolean =>
@@ -31,9 +32,56 @@ const STOP_COMMANDS = ['use', 'stash'];
 /** Overviews across every registered harness; none of them changes which account is in use, and all support --json. */
 const OVERVIEW_COMMANDS = ['list', 'ls', 'limits', 'active'];
 const WATCH_USAGE = 'Usage: authswitch [harness] watch [harness] [--interval <duration>] [--threshold <percent>] [--dry-run] [--once] [--json]';
+const PREUSE_USAGE = 'Usage: authswitch [harness] preuse <account>|--all [--prompt <text>] [--model <id>]';
+/** How each outcome of a preuse run is titled in its results table. */
+const PREUSE_OUTCOMES: Readonly<Record<TPreuseOutcome, string>> = { completed: 'Completed', skipped: 'Skipped', failed: 'Failed', interrupted: 'Interrupted' };
+/** A cell of a preuse results row that has no value because nothing was sent for that account. */
+const PREUSE_UNSENT = '-';
 const WATCH_INTERVAL = { defaultMs: 120_000, minMs: 60_000, maxMs: 86_400_000 };
 const WATCH_THRESHOLD = { default: 95, min: 50, max: 100 };
 
+/** How one preuse run is asked for and reported; see `AuthSwitchCli.runPreuse`. */
+interface IPreuseRunOptions {
+  prompt: string;
+  model?: string;
+  /** Number each account as it starts and end with the results table, instead of one account's reset schedule. */
+  several: boolean;
+  /** Report a stated refusal as a failure, which is the single named account's own contract. */
+  strict: boolean;
+}
+
+/** One account's row in the results table of a run over several accounts. */
+interface IPreuseSummaryRow {
+  account: string;
+  outcome: string;
+  model: string;
+  tokens: string;
+  reset: string;
+}
+
+/**
+ * One account's results row, from what the run already read.
+ *
+ * An account that sent no prompt has no model, no token count and no deadline of its own, which the row
+ * says rather than filling in a zero. A completed prompt shows the first window of the schedule the run
+ * read afterwards, and says when the provider reported none or the lookup did not answer.
+ */
+const preuseSummaryRow = (resultArg: TPreuseAccountResult, nowArg: number): IPreuseSummaryRow => {
+  const account = accountName(resultArg.account);
+  if (resultArg.outcome !== 'completed') {
+    return { account, outcome: PREUSE_OUTCOMES[resultArg.outcome], model: PREUSE_UNSENT, tokens: PREUSE_UNSENT, reset: PREUSE_UNSENT };
+  }
+  const window = resultArg.schedule.kind === 'reported' ? resultArg.schedule.windows[0] : undefined;
+  return {
+    account,
+    outcome: PREUSE_OUTCOMES.completed,
+    model: plainText(resultArg.result.model),
+    tokens: [resultArg.result.inputTokens, resultArg.result.outputTokens, resultArg.result.totalTokens].map(count => count ?? 'unreported').join('/'),
+    reset: window ? until(window.resetAt, nowArg)
+      : resultArg.schedule.kind === 'reported' ? 'None reported' : resultArg.schedule.kind === 'notRead' ? 'Not read' : 'Unavailable',
+  };
+};
+
 /** The account a command acts on, named as it was offered, with the badge it was offered with. */
 interface IChosenAccount {
   id: string;
@@ -76,8 +124,9 @@ ${bold('Usage')}
   authswitch list --json             print all account information as JSON
   authswitch limits                  one row per account and limit type: used % and reset countdown
   authswitch active                  one row per provider: which account is in use, and since when
-  authswitch <harness> preuse <account> [--prompt <text>] [--model <id>]
-                                    send one prompt through that account without switching
+  authswitch <harness> preuse <account>|--all [--prompt <text>] [--model <id>]
+                                    send one prompt through that account without switching;
+                                    --all does it for every account of the harness, one at a time
   authswitch watch [harness] [--interval <duration>] [--threshold <percent>] [--dry-run] [--once] [--json]
                                     check usage every 2m and switch to a better saved account
                                     when the active one reaches the threshold (95%)
@@ -119,7 +168,10 @@ account is used up, to the one usable again first. No session of yours is stoppe
 a Codex switch restarts Codex' own app-server; --dry-run only reports, --once checks once.
 One watch runs per AUTHSWITCH_HOME.
 
-Preuse consumes the selected account's quota. Its default prompt is:
+Preuse consumes the selected account's quota, and --all consumes every account's. Accounts run
+one at a time, each with one request and no retry; Ctrl+C stops before the next account starts.
+It exits 1 when a prompt failed, 130 when it was interrupted, and 2 on a usage error; --all also
+exits 0 when an account was refused for a stated reason. Its default prompt is:
   "${defaultPreusePrompt}"
 
 ${bold('Environment')}
@@ -321,18 +373,28 @@ ${bold('Environment')}
     }
   }
 
+  /**
+   * Send the preuse prompt through one named account, through an account chosen here, or through every
+   * account of the harness.
+   *
+   * `--all` walks the harness's own account list, one request at a time, and ends with a table of what
+   * each account did; a single named account keeps its own contract, in which anything but a completed
+   * prompt is a failure. Neither form switches, refreshes or writes a login.
+   */
   private async commandPreuse(harnessArg: IAuthHarness | undefined, argsArg: string[]): Promise<number> {
     let reference: string | undefined;
+    let all: boolean;
     let prompt: string;
     let model: string | undefined;
     try {
-      const parsed = parseCommandArgs(argsArg, { values: ['--prompt', '--model'], flags: [], maxPositionals: 1,
-        usage: 'Usage: authswitch [harness] preuse <account> [--prompt <text>] [--model <id>]' });
+      const parsed = parseCommandArgs(argsArg, { values: ['--prompt', '--model'], flags: ['--all'], maxPositionals: 1, usage: PREUSE_USAGE });
       [reference] = parsed.positionals;
+      all = parsed.flags.has('--all');
       prompt = parsed.values.get('--prompt') ?? defaultPreusePrompt;
       model = parsed.values.get('--model');
       validatePreuseOptions({ prompt, model });
-      if (!reference && !canPrompt()) throw new UsageError('preuse requires an account outside an interactive terminal.');
+      if (all && reference !== undefined) throw new UsageError(`--all preuses every account of the harness, so it takes no account. ${PREUSE_USAGE}`);
+      if (!all && !reference && !canPrompt()) throw new UsageError('preuse requires an account or --all outside an interactive terminal.');
     } catch (error) {
       process.stderr.write(`${error instanceof UsageError || error instanceof PreuseError ? error.message : 'Invalid preuse arguments.'}\n`);
       return 2;
@@ -341,63 +403,159 @@ ${bold('Environment')}
     if (!harness) return canPrompt() ? 0 : 2;
     if (!harness.preuseAccount) { process.stderr.write(`Preuse is not supported by ${plainText(harness.label)}.\n`); return 2; }
     const state = await harness.readState();
-    let account: IHarnessAccount | undefined;
-    if (reference) {
-      const matches = state.accounts.filter(item => item.id === reference || item.label === reference);
-      if (matches.length > 1) { process.stderr.write('That account reference is ambiguous; use an exact account ID.\n'); return 1; }
-      account = matches[0];
-      if (!account) {
-        const id = await this.resolveAccount(harness, reference);
-        if (id === null) return 1;
-        account = state.accounts.find(item => item.id === id);
-      }
-    } else {
-      const answer = await this.out.prompts.ask({
-        name: 'preuseAccount', type: 'list', message: `Which ${harness.label} account should receive the preuse prompt? This consumes quota.`,
-        choices: [...state.accounts.map(item => ({ name: plainText(item.label), value: item.id })), { name: 'Back', value: '' }],
-      });
-      if (!answer) return 0;
-      account = state.accounts.find(item => item.id === answer);
+    if (all) {
+      const accounts = preuseTargets(state.accounts);
+      if (!accounts.length) { process.stderr.write(`${plainText(harness.label)} has no accounts to preuse.\n`); return 1; }
+      return await this.runPreuse(harness, accounts, { prompt, model, several: true, strict: false });
+    }
+    if (!reference) return await this.preuseFromPicker(harness, state, { prompt, model });
+    const matches = state.accounts.filter(item => item.id === reference || item.label === reference);
+    if (matches.length > 1) { process.stderr.write('That account reference is ambiguous; use an exact account ID.\n'); return 1; }
+    let account: IHarnessAccount | undefined = matches[0];
+    if (!account) {
+      const id = await this.resolveAccount(harness, reference);
+      if (id === null) return 1;
+      account = state.accounts.find(item => item.id === id);
     }
     if (!account) { process.stderr.write('The selected account is no longer available.\n'); return 1; }
+    return await this.runPreuse(harness, [account], { prompt, model, several: false, strict: true });
+  }
+
+  /**
+   * The account picker `preuse` shows without an account reference: one account, all of them, or Back.
+   *
+   * Choosing one account here is that account's consent, exactly as naming it on the command line is, and
+   * it keeps that command's contract. Choosing all of them spends quota on accounts the chooser did not
+   * name, so that answer is confirmed once and then runs as `--all` does, table and exit status included.
+   */
+  private async preuseFromPicker(harnessArg: IAuthHarness, stateArg: IHarnessState, optionsArg: { prompt: string; model?: string }): Promise<number> {
+    const accounts = preuseTargets(stateArg.accounts);
+    const answer = await this.out.prompts.ask({
+      name: 'preuseAccount', type: 'list', message: `Which ${harnessArg.label} account should receive the preuse prompt? This consumes quota.`,
+      choices: this.preuseChoices(accounts),
+    });
+    if (!answer) return 0;
+    const selected = this.preuseSelection(answer, accounts);
+    if (!selected.length) { process.stderr.write('The selected account is no longer available.\n'); return 1; }
+    const several = selected.length > 1;
+    if (several && !await this.confirmPreuse(selected)) return 0;
+    return await this.runPreuse(harnessArg, selected, { ...optionsArg, several, strict: !several });
+  }
+
+  /**
+   * The choices an interactive preuse offers: every account, one of them, or Back.
+   *
+   * The guide and the bare `preuse` command offer the same list with the same wording. An account id is an
+   * opaque string, so every choice says which kind of answer it carries instead of relying on a sentinel an
+   * id could collide with. A single account is offered alone: "all" of one account is that same account.
+   */
+  private preuseChoices(accountsArg: readonly IHarnessAccount[]): { name: string; value: string }[] {
+    return [
+      ...(accountsArg.length > 1 ? [{ name: `All accounts (${accountsArg.length})`, value: 'all' }] : []),
+      ...accountsArg.map(account => ({ name: accountName(account), value: `one:${account.id}` })),
+      { name: 'Back', value: '' },
+    ];
+  }
+
+  /** The accounts an answer names; empty when the chosen account is no longer there. */
+  private preuseSelection(answerArg: string, accountsArg: readonly IHarnessAccount[]): IHarnessAccount[] {
+    return answerArg === 'all' ? [...accountsArg] : accountsArg.filter(account => `one:${account.id}` === answerArg);
+  }
+
+  /** One confirmation, naming what the prompt goes to and that it consumes quota. */
+  private async confirmPreuse(accountsArg: readonly IHarnessAccount[]): Promise<boolean> {
+    return await this.out.prompts.ask({
+      name: 'confirmPreuse', type: 'confirm', default: false,
+      message: accountsArg.length === 1
+        ? `Send one preuse prompt through ${plainText(accountsArg[0].label)}? This consumes its quota.`
+        : `Send one preuse prompt through each of these ${accountsArg.length} accounts? This consumes quota on every one of them.`,
+    }) === true;
+  }
+
+  /**
+   * One preuse run and its report, for the command line and for the guide.
+   *
+   * Ctrl+C aborts the run: the account in flight is reported as interrupted and no further account is
+   * started, because a prompt that may already have been sent is never repeated. The exit status is 130
+   * for an interrupted run, 1 when an account failed -- and, for a single named account, when it was
+   * refused -- and 0 otherwise. Usage errors return 2 before anything reaches this.
+   */
+  private async runPreuse(harnessArg: IAuthHarness, accountsArg: readonly IHarnessAccount[], optionsArg: IPreuseRunOptions): Promise<number> {
     const controller = new AbortController();
     const cancel = () => controller.abort();
     process.once('SIGINT', cancel);
     process.once('SIGTERM', cancel);
     try {
-      let result: IHarnessPreuseResult;
-      try {
-        process.stdout.write(`Preusing ${plainText(account.label)} (${plainText(harness.label)})…\n`);
-        result = await harness.preuseAccount(account.id, { prompt, model, signal: controller.signal });
-      } catch (error) {
-        process.stderr.write(`${error instanceof PreuseError ? error.message : 'Preuse failed. Tokens may already have been consumed; check account status before trying again.'}\n`);
-        return controller.signal.aborted ? 130 : 1;
-      }
-      // Once inference completes, status or presentation failures must not report it as failed.
-      try {
-        process.stdout.write(`Prompt completed with ${plainText(result.model)}. Tokens: ${result.inputTokens ?? 'unreported'} input, ${result.outputTokens ?? 'unreported'} output, ${result.totalTokens ?? 'unreported'} total.\n`);
-        if (controller.signal.aborted) return 0;
-        const windows = orderedUsageWindows((await harness.readAccountStatus(account.id)).summary?.usageWindows);
-        if (windows?.length) {
-          const now = Date.now();
-          process.stdout.write('Reset schedule reported after the prompt:\n');
-          await consoleTable(this.out, windows, [
-            // The label already names the window by its length, so the column never repeats it.
-            { key: 'window', title: 'Window', value: row => plainText(row.label) },
-            { key: 'usage', title: 'Used', value: row => usagePercentText(row.usedPercent) },
-            { key: 'reset', title: 'Reset in', value: row => until(row.resetAt, now) },
-          ]);
-        } else process.stdout.write('Reset schedule could not be verified; the completed prompt will not be repeated.\n');
-      } catch {
-        process.stderr.write('Prompt completed, but its reset schedule could not be verified or displayed. The prompt will not be repeated.\n');
-      }
-      return 0;
+      const summary = await preuseAccounts(harnessArg, accountsArg, { prompt: optionsArg.prompt, model: optionsArg.model, signal: controller.signal },
+        event => this.writePreuseEvent(harnessArg, event, optionsArg.several));
+      if (optionsArg.several) await this.writePreuseSummary(summary);
+      else if (summary.results[0]) await this.writePreuseSchedule(summary.results[0]);
+      if (summary.counts.interrupted || summary.notRun.length) return 130;
+      return summary.counts.failed || (optionsArg.strict && summary.counts.skipped) ? 1 : 0;
     } finally {
       process.removeListener('SIGINT', cancel);
       process.removeListener('SIGTERM', cancel);
     }
   }
 
+  /** One line per event; a run over several accounts numbers each account as it starts. */
+  private writePreuseEvent(harnessArg: IAuthHarness, eventArg: TPreuseRunEvent, severalArg: boolean): void {
+    if (eventArg.kind === 'started') {
+      const position = severalArg ? `[${eventArg.index + 1}/${eventArg.total}] ` : '';
+      process.stdout.write(`${position}Preusing ${plainText(eventArg.account.label)} (${plainText(harnessArg.label)})…\n`);
+      return;
+    }
+    if (eventArg.result.outcome !== 'completed') { process.stderr.write(`${eventArg.result.reason}\n`); return; }
+    const result = eventArg.result.result;
+    process.stdout.write(`Prompt completed with ${plainText(result.model)}. Tokens: ${result.inputTokens ?? 'unreported'} input, ${result.outputTokens ?? 'unreported'} output, ${result.totalTokens ?? 'unreported'} total.\n`);
+  }
+
+  /**
+   * The reset schedule one completed prompt reported.
+   *
+   * Once inference completes, a schedule that could not be read or displayed is reported as exactly that:
+   * a completed prompt is never repeated over a lookup or presentation failure.
+   */
+  private async writePreuseSchedule(resultArg: TPreuseAccountResult): Promise<void> {
+    if (resultArg.outcome !== 'completed' || resultArg.schedule.kind === 'notRead') return;
+    if (resultArg.schedule.kind === 'reported') {
+      const windows = [...resultArg.schedule.windows];
+      try {
+        if (!windows.length) { process.stdout.write('Reset schedule could not be verified; the completed prompt will not be repeated.\n'); return; }
+        const now = Date.now();
+        process.stdout.write('Reset schedule reported after the prompt:\n');
+        await consoleTable(this.out, windows, [
+          // The label already names the window by its length, so the column never repeats it.
+          { key: 'window', title: 'Window', value: row => plainText(row.label) },
+          { key: 'usage', title: 'Used', value: row => usagePercentText(row.usedPercent) },
+          { key: 'reset', title: 'Reset in', value: row => until(row.resetAt, now) },
+        ]);
+        return;
+      } catch { /* A schedule that could not be displayed is reported below, like one that could not be read. */ }
+    }
+    process.stderr.write('Prompt completed, but its reset schedule could not be verified or displayed. The prompt will not be repeated.\n');
+  }
+
+  /** What every account of a run did, in one table. The rows repeat readings the run already took. */
+  private async writePreuseSummary(summaryArg: IPreuseRunSummary): Promise<void> {
+    const now = Date.now();
+    const rows: IPreuseSummaryRow[] = [
+      ...summaryArg.results.map(result => preuseSummaryRow(result, now)),
+      ...summaryArg.notRun.map((account): IPreuseSummaryRow => ({
+        account: accountName(account), outcome: 'Not run', model: PREUSE_UNSENT, tokens: PREUSE_UNSENT, reset: PREUSE_UNSENT,
+      })),
+    ];
+    consoleHeading('Preuse results');
+    await consoleTable(this.out, rows, [
+      { key: 'account', title: 'Account', value: row => row.account },
+      { key: 'outcome', title: 'Outcome', value: row => row.outcome },
+      { key: 'model', title: 'Model', value: row => row.model },
+      { key: 'tokens', title: 'Tokens in/out/total', value: row => row.tokens },
+      { key: 'reset', title: 'Next reset', value: row => row.reset },
+    ]);
+    process.stdout.write(`${preuseCountsText(summaryArg)}.\n`);
+  }
+
   /**
    * Watch usage and switch automatically; see `AuthSwitchWatch`. SIGINT and SIGTERM end it cleanly with status 0.
    * `--once` runs one check and exits 1 when a switch it attempted did not complete.
@@ -505,6 +663,7 @@ ${bold('Environment')}
           { name: 'Switch to a saved account', value: 'use' },
           { name: 'Save the current login', value: 'stash' },
           ...(harnessArg.beginLogin ? [{ name: 'Log in and save another account', value: 'login' }] : []),
+          ...(harnessArg.preuseAccount ? [{ name: 'Preuse an account or all accounts (consumes quota)', value: 'preuse' }] : []),
           { name: 'List accounts, subscription, usage and resets', value: 'list' },
           { name: harnessArg.diagnosticsLabel, value: 'doctor' },
           { name: 'Remove a saved account', value: 'drop' },
@@ -531,6 +690,7 @@ ${bold('Environment')}
           if (mode === 'keep' || mode === 'clear') code = this.reportOutcome(await this.mutate(harnessArg, { harnessId: harnessArg.id, action: 'save', keepActive: mode === 'keep', accountId: active.id }));
           break;
         }
+        case 'preuse': code = await this.guidePreuse(harnessArg); break;
         case 'list': code = await this.commandList([harnessArg]); break;
         case 'doctor': code = this.reportOutcome(await harnessArg.diagnose()); break;
         case 'drop': {
@@ -550,6 +710,28 @@ ${bold('Environment')}
     }
   }
 
+  /**
+   * Preuse from the guide: one account or all of them, confirmed once before anything is sent.
+   *
+   * The prompt consumes quota, so the confirmation names what it will be sent to, and Back or a declined
+   * confirmation returns to the menu having sent nothing. A refusal an adapter states is not a guide
+   * failure, so the guide stays open; a failed prompt ends it, as every other failed action does.
+   */
+  private async guidePreuse(harnessArg: IAuthHarness): Promise<number> {
+    const accounts = preuseTargets((await harnessArg.readState()).accounts);
+    if (!accounts.length) { process.stderr.write(`${red('no accounts to preuse')} - run \`authswitch ${harnessArg.id} stash\` first\n`); return 0; }
+    const answer = await this.out.prompts.ask({
+      name: 'preuseTarget', type: 'list', message: `Which ${harnessArg.label} account should receive the preuse prompt? This consumes quota.`,
+      choices: this.preuseChoices(accounts),
+    });
+    if (!answer) return 0;
+    const selected = this.preuseSelection(answer, accounts);
+    if (!selected.length) { process.stderr.write('The selected account is no longer available.\n'); return 0; }
+    // The guide confirms either answer: it is a menu one lands in, not a command that named its account.
+    if (!await this.confirmPreuse(selected)) return 0;
+    return await this.runPreuse(harnessArg, selected, { prompt: defaultPreusePrompt, several: selected.length > 1, strict: false });
+  }
+
   private printCurrent(harnessArg: IAuthHarness, stateArg: IHarnessState): void {
     process.stdout.write(`\n${bold(`Current ${harnessArg.label} account`)}\n`);
     const active = stateArg.accounts.filter(account => account.isActive);

package/ts/classes.codexauth.ts

@@ -56,6 +56,90 @@ const findFirstJwt = (valueArg: unknown, depthArg = 0): string | null => {
   return null;
 };
 
+/**
+ * A short, non-reversible label for an API key so two different keys get two
+ * different stashes without the key itself ever being written down.
+ */
+const fingerprint = (secretArg: string): string => {
+  let hash = 0x811c9dc5;
+  for (let index = 0; index < secretArg.length; index++) {
+    hash ^= secretArg.charCodeAt(index);
+    hash = Math.imul(hash, 0x01000193) >>> 0;
+  }
+  return hash.toString(16).padStart(8, '0');
+};
+
+/**
+ * Extracts the account identity from the content of an auth.json.
+ * Returns null when the content holds no recognisable credential.
+ *
+ * It stands outside the class because the stash store keys and guards its entries by the same identity and has
+ * no Codex installation to read: the credential itself is all this derivation needs.
+ */
+export const codexIdentityFromRaw = (rawArg: string): ICodexIdentity | null => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(rawArg);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object') {
+    return null;
+  }
+  const record = parsed as Record<string, unknown>;
+
+  const tokens = (record.tokens ?? null) as Record<string, unknown> | null;
+  const idToken =
+    (tokens ? asString(tokens.id_token) : null) ?? findFirstJwt(record);
+
+  if (idToken) {
+    const claims = decodeJwtPayload(idToken) ?? {};
+    const authClaim = (claims['https://api.openai.com/auth'] ?? {}) as Record<string, unknown>;
+    const profileClaim = (claims['https://api.openai.com/profile'] ?? {}) as Record<string, unknown>;
+    const email =
+      asString(claims.email) ??
+      asString(profileClaim.email) ??
+      asString(authClaim.user_email);
+    const accountId =
+      asString(authClaim.chatgpt_account_id) ??
+      (tokens ? asString(tokens.account_id) : null) ??
+      asString(record.account_id);
+    if (email) {
+      return {
+        kind: 'chatgpt',
+        email: email.toLowerCase(),
+        accountId,
+        planType: asString(authClaim.chatgpt_plan_type),
+        userId: asString(authClaim.user_id) ?? asString(claims.sub),
+      };
+    }
+    if (accountId) {
+      // An OAuth credential we cannot label by email is still worth stashing;
+      // key it by account id so it round-trips instead of being silently dropped.
+      return {
+        kind: 'chatgpt',
+        email: `account:${accountId}`,
+        accountId,
+        planType: asString(authClaim.chatgpt_plan_type),
+        userId: asString(authClaim.user_id) ?? asString(claims.sub),
+      };
+    }
+  }
+
+  const apiKey = asString(record.OPENAI_API_KEY) ?? asString(record.openai_api_key);
+  if (apiKey) {
+    return {
+      kind: 'apikey',
+      email: `apikey:${fingerprint(apiKey)}`,
+      accountId: null,
+      planType: null,
+      userId: null,
+    };
+  }
+
+  return null;
+};
+
 /**
  * Reads, writes and clears the Codex file credential store, and derives the
  * account identity used to key a stash.
@@ -75,81 +159,7 @@ export class CodexAuth {
    * Returns null when the file holds no recognisable credential.
    */
   public identityFromRaw(rawArg: string): ICodexIdentity | null {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(rawArg);
-    } catch {
-      return null;
-    }
-    if (!parsed || typeof parsed !== 'object') {
-      return null;
-    }
-    const record = parsed as Record<string, unknown>;
-
-    const tokens = (record.tokens ?? null) as Record<string, unknown> | null;
-    const idToken =
-      (tokens ? asString(tokens.id_token) : null) ?? findFirstJwt(record);
-
-    if (idToken) {
-      const claims = decodeJwtPayload(idToken) ?? {};
-      const authClaim = (claims['https://api.openai.com/auth'] ?? {}) as Record<string, unknown>;
-      const profileClaim = (claims['https://api.openai.com/profile'] ?? {}) as Record<string, unknown>;
-      const email =
-        asString(claims.email) ??
-        asString(profileClaim.email) ??
-        asString(authClaim.user_email);
-      const accountId =
-        asString(authClaim.chatgpt_account_id) ??
-        (tokens ? asString(tokens.account_id) : null) ??
-        asString(record.account_id);
-      if (email) {
-        return {
-          kind: 'chatgpt',
-          email: email.toLowerCase(),
-          accountId,
-          planType: asString(authClaim.chatgpt_plan_type),
-          userId: asString(authClaim.user_id) ?? asString(claims.sub),
-        };
-      }
-      if (accountId) {
-        // An OAuth credential we cannot label by email is still worth stashing;
-        // key it by account id so it round-trips instead of being silently dropped.
-        return {
-          kind: 'chatgpt',
-          email: `account:${accountId}`,
-          accountId,
-          planType: asString(authClaim.chatgpt_plan_type),
-          userId: asString(authClaim.user_id) ?? asString(claims.sub),
-        };
-      }
-    }
-
-    const apiKey = asString(record.OPENAI_API_KEY) ?? asString(record.openai_api_key);
-    if (apiKey) {
-      const fingerprint = this.fingerprint(apiKey);
-      return {
-        kind: 'apikey',
-        email: `apikey:${fingerprint}`,
-        accountId: null,
-        planType: null,
-        userId: null,
-      };
-    }
-
-    return null;
-  }
-
-  /**
-   * A short, non-reversible label for an API key so two different keys get two
-   * different stashes without the key itself ever being written down.
-   */
-  private fingerprint(secretArg: string): string {
-    let hash = 0x811c9dc5;
-    for (let index = 0; index < secretArg.length; index++) {
-      hash ^= secretArg.charCodeAt(index);
-      hash = Math.imul(hash, 0x01000193) >>> 0;
-    }
-    return hash.toString(16).padStart(8, '0');
+    return codexIdentityFromRaw(rawArg);
   }
 
   /** Reads the active credential, if any. */

package/ts/classes.codexharness.ts

@@ -3,12 +3,21 @@ import { CodexAccountStatus } from './classes.codexstatus.js';
 import { CodexPreuse } from './classes.codexpreuse.js';
 import { PreuseError } from './preuse.js';
 import type { IAuthHarness, IHarnessAccount, IHarnessAccountStatus, IHarnessOutcome, IHarnessState, IHarnessPreuseOptions, IHarnessPreuseResult, IHarnessStatusOptions } from './interfaces.harness.js';
-import type { IStashListing } from './interfaces.js';
+import type { IActiveAuth, ICodexIdentity, IStashEntry, IStashListing } from './interfaces.js';
 import { countPaired, enrollmentState } from './helpers.js';
 import { beginSavedOpenAiLogin } from './classes.login.js';
 import { plainText } from './formatting.js';
 import type { IHarnessLoginOptions, IHarnessLoginProvider } from './interfaces.harness.js';
 
+/**
+ * Why a write into the stash failed, as its system error code. The message of a filesystem error names the path
+ * it was writing, and that path leads to a credential.
+ */
+const writeFailureCause = (errorArg: unknown): string => {
+  const code = (errorArg as { code?: unknown } | null)?.code;
+  return typeof code === 'string' ? code : 'unknown cause';
+};
+
 /** Codex-specific credentials, remote-control handling and service status. */
 export class CodexHarness implements IAuthHarness {
   public readonly id = 'codex';
@@ -43,21 +52,28 @@ export class CodexHarness implements IAuthHarness {
     }, options);
   }
 
+  /**
+   * The harness's accounts, with the saved copy of the active login brought up to date first.
+   *
+   * A saved login is one whose stored credential is readable and belongs to the account its record names. The
+   * exact tokens are not part of that: Codex' app-server refreshes the login it runs on its own schedule, so
+   * comparing bytes reported every saved active login as unsaved from its first refresh on, and the guide then
+   * offered to save what was already saved.
+   */
   public readState(): IHarnessState {
     const active = this.switcher.readActive();
+    const mirrorFailure = this.mirrorActiveLogin(active);
     const accounts: IHarnessAccount[] = this.switcher.list().map((entryArg) => {
       const raw = this.switcher.stashes.readAuth(entryArg.email);
-      const identity = raw === null ? null : this.switcher.auth.identityFromRaw(raw);
-      const valid = identity !== null && identity.email === entryArg.email && identity.accountId === entryArg.accountId && identity.kind === entryArg.kind;
-      const isActive = active.identity !== null && active.identity.email === entryArg.email && active.identity.accountId === entryArg.accountId && active.identity.kind === entryArg.kind;
-      const isStashed = valid && (!isActive || raw === active.raw);
+      const isStashed = this.recordOf(entryArg, raw === null ? null : this.switcher.auth.identityFromRaw(raw));
+      const isActive = this.recordOf(entryArg, active.identity);
       return {
         id: entryArg.email,
         label: entryArg.email,
         isActive,
         isStashed,
         savedAt: entryArg.stashedAt,
-        details: [this.formatRemoteControl(entryArg).trim(), ...(!valid ? ['saved credential missing or does not match its metadata'] : !isStashed ? ['the current login has changed since it was saved'] : [])],
+        details: [this.formatRemoteControl(entryArg).trim(), ...(!isStashed ? ['saved credential missing or does not match its metadata'] : isActive && mirrorFailure !== null ? [mirrorFailure] : [])],
       };
     });
     if (active.identity && !accounts.some((accountArg) => accountArg.isActive)) {
@@ -74,6 +90,42 @@ export class CodexHarness implements IAuthHarness {
     };
   }
 
+  /** Whether a saved record is the record of this identity: same account, same email, same kind of login. */
+  private recordOf(entryArg: IStashEntry, identityArg: ICodexIdentity | null): boolean {
+    return identityArg !== null && entryArg.email === identityArg.email && entryArg.accountId === identityArg.accountId && entryArg.kind === identityArg.kind;
+  }
+
+  /**
+   * Writes the credential Codex is running on into that account's own saved record, and reports why it could
+   * not when the write failed.
+   *
+   * Codex rotates the tokens of the active login, and until now only a switch or a save wrote that rotation
+   * back -- `use()` re-saves the outgoing login, and re-selecting the active account updates its record before
+   * restoring the pairings. Every read now keeps the saved copy on the credential Codex last wrote, so the copy
+   * is one a switch can restore rather than one the service has moved past.
+   *
+   * The write goes only into the stash: Codex' own files are read, nothing is stopped or signalled, no daemon
+   * has to be down for it, and the record keeps its save time and its enrollments. A login with no saved record
+   * of its own is never saved implicitly -- `stash` is what saves a login -- and a record whose credential is
+   * missing or belongs to another account is left for `stash` to repair rather than quietly overwritten.
+   */
+  private mirrorActiveLogin(activeArg: IActiveAuth): string | null {
+    if (activeArg.source !== 'file' || activeArg.identity === null || activeArg.raw === null) return null;
+    const email = activeArg.identity.email;
+    const saved = this.switcher.stashes.readAuth(email);
+    if (saved === null || saved === activeArg.raw) return null;
+    const meta = this.switcher.stashes.readMeta(email);
+    if (meta === null || !this.recordOf(meta, activeArg.identity) || !this.recordOf(meta, this.switcher.auth.identityFromRaw(saved))) return null;
+    try {
+      this.switcher.stashes.replaceAuth(email, activeArg.raw);
+      return null;
+    } catch (errorArg) {
+      // A saved copy that could not be brought up to date is no reason to fail a read: the record still holds a
+      // credential of this account, and the next read tries again.
+      return `the current login could not be copied into its saved record (${writeFailureCause(errorArg)}); the record still holds the credential from the last save`;
+    }
+  }
+
   public async readAccountStatus(accountIdArg: string, optionsArg?: IHarnessStatusOptions): Promise<IHarnessAccountStatus> {
     const credential = this.readAccountCredential(accountIdArg);
     if (!credential) return { facts: [], problems: ['No matching credential is available for status lookup.'] };