@pure01fx/dsh-openai-codex-auth 0.7.3 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.8.0
+
+### Multi-account authentication
+
+- Adds multiple managed ChatGPT OAuth accounts with a global current-account selector, per-account removal, optional email labels, and automatic activation of newly added accounts.
+- Migrates legacy version-1 single-account credential documents atomically to version 2 while keeping DSH credential publication and rollback guarantees.
+- Pins every request/recovery attempt to its starting account so a concurrent account switch cannot replay an authenticated request under another account.
+- Extends the same-origin settings API and Web UI with an account list, explicit switching, and individual logout controls without exposing access or refresh tokens.
+
 ## 0.7.3
 
 ### Client model visibility

package/README.md

@@ -48,6 +48,14 @@ dsh web
 
 设备码登录无需 OAuth callback，适合本机、SSH 隧道和 HTTPS 反向代理场景。
 
+## 多账号切换
+
+- 已登录后继续点击 **用设备码添加账号** 或 **用浏览器添加账号**，可追加 ChatGPT 账号；新登录的账号会自动成为当前账号。
+- 设置页的 **已添加账号** 列表支持设为当前和单独移除。切换是全局的，只影响切换完成后的新 Codex 请求；已开始的请求继续使用启动时绑定的账号。
+- 移除当前账号时，插件按账号列表顺序选择下一个账号；移除最后一个账号后会清除 `DSH_OPENAI_CODEX_TOKEN`。
+- 原有单账号 `version: 1` 凭据会在首次读取时原子迁移为 `version: 2` 多账号文档，无需重新登录。
+- 如果 `DSH_OPENAI_CODEX_TOKEN` 来自只读环境变量或其他外部 authority，插件会拒绝需要改写当前 token 的登录、切换和退出操作，避免界面与实际请求账号不一致。
+
 ## 两种登录方式
 
 ### 设备码登录（推荐）
@@ -82,6 +90,7 @@ http://localhost:1455/auth/callback
 | --- | --- |
 | 设备码登录 | 无本机 callback，支持远程/headless 使用 |
 | 浏览器 OAuth fallback | PKCE + state、端到端 1455 探测、手动 code 回填和临时 callback listener |
+| 多账号管理 | 添加多个 OAuth 账号、全局切换当前账号、单独移除，并自动迁移旧单账号凭据 |
 | Codex 用量面板 | 展示短周期与周用量、剩余额度和重置时间；Native 模式直接接收 Codex 返回的套餐额度，`wham/usage` 仅作初始读取和 fallback |
 | 当前路由状态 | 设置页显示 `openai-codex` 当前由本插件 Native Adapter、外部 Adapter 或无人持有；Native 模式同时显示 WebSocket v2 或 HTTP/SSE |
 | 输入框额度圈 | 登录后显示在输入框右下角；悬停或键盘聚焦显示用量，点击圆圈强制刷新，不做常驻额度轮询 |
@@ -99,9 +108,9 @@ http://localhost:1455/auth/callback
 
 登录成功后：
 
-1. 凭据以 owner-only 权限原子写入 `$DSH_HOME/openai-codex-auth.json`。
-2. access token 通过 DSH credentials 注入 `DSH_OPENAI_CODEX_TOKEN`。
-3. `openai-codex` 模型提供方在请求时读取该凭据。
+1. 多账号凭据以 owner-only 权限原子写入 `$DSH_HOME/openai-codex-auth.json`；文档保存账号列表与全局当前账号指针。
+2. 当前账号的 access token 通过 DSH credentials 注入 `DSH_OPENAI_CODEX_TOKEN`。
+3. `openai-codex` 模型提供方在每个请求开始时读取当前凭据，并把该次尝试固定到同一个账号。
 4. 输入框右下角显示 Codex 额度圈；悬停或键盘聚焦显示当前用量，点击才强制刷新。Native transport 优先消费 WebSocket `codex.rate_limits` 事件或 HTTP `x-codex-*` headers，未收到直接更新时才在 turn 结束后读取 `wham/usage`。
 5. 设置页与额度圈只读取登录状态、账号 ID、过期时间和用量摘要，不接触 token。
 
@@ -111,13 +120,15 @@ http://localhost:1455/auth/callback
 
 | 方法 | 路径 | 用途 |
 | --- | --- | --- |
-| GET | `/openai-codex/status` | 登录、flow、用量和 CSRF 状态 |
+| GET | `/openai-codex/status` | 登录、账号列表、当前账号、flow、用量和 CSRF 状态 |
+| POST | `/openai-codex/accounts/current` | 以 `{ "accountId": "…" }` 设定全局当前账号 |
+| POST | `/openai-codex/accounts/logout` | 以 `{ "accountId": "…" }` 单独移除账号 |
 | POST | `/openai-codex/device/start` | 创建或复用设备码 flow |
 | POST | `/openai-codex/browser/prepare` | 创建浏览器 flow，返回授权 URL 和一次性 1455 探测 URL |
 | POST | `/openai-codex/browser/complete` | 接收用户粘贴的 callback URL 或 authorization code |
 | GET | `/openai-codex/browser/start` | 兼容入口：直接启动并跳转浏览器 OAuth |
 | POST | `/openai-codex/cancel` | 取消当前登录、关闭临时 listener，保留旧凭据 |
-| POST | `/openai-codex/logout` | 取消 flow 并删除本地凭据 |
+| POST | `/openai-codex/logout` | 兼容入口：取消 flow 并移除当前账号 |
 
 1456 已完全退役。1455 平时关闭，仅浏览器 OAuth pending 时绑定 loopback；设备码登录完全不使用它。
 

package/client.js

@@ -665,7 +665,38 @@ window.__ModuleLoader__.load({
         }
       }
 
+      const mutateAccount = async (path, accountId, action) => {
+        if (busy) return
+        setBusy(action + ':' + accountId)
+        setError('')
+        try {
+          await post(path, { accountId })
+          await load(false)
+        } catch (mutationError) {
+          setError(messageOf(mutationError))
+        } finally {
+          setBusy('')
+        }
+      }
+
+      const setCurrentAccount = async (accountId) => {
+        await mutateAccount('/accounts/current', accountId, 'current')
+      }
+
+      const removeAccount = async (accountId) => {
+        const account = accounts.find((candidate) => candidate.accountId === accountId)
+        const label = account && account.email ? account.email : shortAccount(accountId)
+        const isCurrent = account && (account.current === true || account.accountId === currentAccountId)
+        const isLast = accounts.length === 1
+        const consequence = isLast
+          ? '移除后将退出 Codex，重新使用需要再次完成 OAuth 登录。'
+          : isCurrent ? '移除后会自动切换到列表中的下一个账号。' : '该账号的本地 OAuth 凭据会被删除。'
+        if (!window.confirm('确定移除 ' + label + '？\n\n' + consequence)) return
+        await mutateAccount('/accounts/logout', accountId, 'remove')
+      }
+
       const logout = async () => {
+        if (busy) return
         setBusy('logout')
         probeGeneration.current += 1
         try {
@@ -701,6 +732,10 @@ window.__ModuleLoader__.load({
       const usage = status && status.usage
       const loading = status === null && !error
       const connected = Boolean(status && status.loggedIn)
+      const accounts = status && Array.isArray(status.accounts) ? status.accounts : []
+      const currentAccountId = status && status.currentAccountId
+      const currentAccount = accounts.find((account) => account.current === true || account.accountId === currentAccountId)
+      const currentAccountLabel = currentAccount && currentAccount.email ? currentAccount.email : shortAccount(status && status.accountId)
       const pending = Boolean(status && status.loginPending) || watchLogin
       const devicePending = Boolean(status && status.loginMethod === 'device' && status.device)
       const browserPending = Boolean(status && status.loginMethod === 'browser' && status.browser)
@@ -731,7 +766,7 @@ window.__ModuleLoader__.load({
               h('div', { className: 'codexLogo', 'aria-hidden': true }, 'OA'),
               h('div', null,
                 h('h3', { className: 'codexName' }, 'OpenAI Codex 订阅'),
-                h('p', { className: 'codexMeta', title: connected ? status.accountId : '' }, loading ? '正在读取 OpenAI 登录状态' : connected ? shortAccount(status.accountId) : '尚未连接 ChatGPT 账号'),
+                h('p', { className: 'codexMeta', title: connected ? status.accountId : '' }, loading ? '正在读取 OpenAI 登录状态' : connected ? currentAccountLabel : '尚未连接 ChatGPT 账号'),
               ),
             ),
             h('span', { className: 'codexBadge ' + (loading || pending ? 'pending' : connected ? 'connected' : '') },
@@ -751,6 +786,31 @@ window.__ModuleLoader__.load({
                   h('p', { className: 'codexRouteDetail' }, route.detail),
                 )
               : null,
+            !loading && accounts.length > 0
+              ? h('div', { className: 'codexModelVisibility' },
+                  h('div', { className: 'codexModelVisibilityHead' },
+                    h('strong', null, '已添加账号'),
+                    h('span', { className: 'codexMeta' }, accounts.length + ' 个'),
+                  ),
+                  h('p', { className: 'codexModelVisibilityHint' }, '当前账号用于新的 Codex 请求；你可以切换或单独移除任意账号。'),
+                  h('div', { className: 'codexModelVisibilityList' }, accounts.map((account) => {
+                    const isCurrent = account.current === true || account.accountId === currentAccountId
+                    const accountBusy = busy === 'current:' + account.accountId || busy === 'remove:' + account.accountId
+                    return h('div', { className: 'codexModelVisibilityOption', key: account.accountId },
+                      h('span', { title: account.accountId },
+                        h('strong', null, account.email || shortAccount(account.accountId)),
+                        account.email ? h('span', null, ' · ' + shortAccount(account.accountId)) : null,
+                        h('span', null, isCurrent ? ' · 当前账号' : ''),
+                        account.expiresAt ? h('span', null, ' · 到期 ' + new Date(account.expiresAt).toLocaleString()) : null,
+                      ),
+                      h('div', { className: 'codexActions' },
+                        !isCurrent ? h('button', { type: 'button', className: 'codexButton', disabled: Boolean(busy), onClick: () => { void setCurrentAccount(account.accountId) } }, accountBusy && busy.startsWith('current:') ? '切换中…' : '设为当前') : null,
+                        h('button', { type: 'button', className: 'codexButton danger', disabled: Boolean(busy), onClick: () => { void removeAccount(account.accountId) } }, accountBusy && busy.startsWith('remove:') ? '移除中…' : '移除'),
+                      ),
+                    )
+                  })),
+                )
+              : null,
             loading
               ? h('div', { 'aria-label': '加载中' }, h('div', { className: 'codexSkeleton' }), h('div', { className: 'codexSkeleton', style: { width: '72%' } }))
               : connected
@@ -848,11 +908,11 @@ window.__ModuleLoader__.load({
               : null,
             h('div', { className: 'codexActions' },
               h('button', { type: 'button', className: 'codexButton primary', disabled: Boolean(busy) || pending || loading, onClick: () => { void startDevice() } },
-                busy === 'device' ? '正在申请设备码…' : connected ? '用设备码重新登录' : '使用设备码登录'),
+                busy === 'device' ? '正在申请设备码…' : connected ? '用设备码添加账号' : '使用设备码登录'),
               h('button', {
                 type: 'button', className: 'codexButton', disabled: Boolean(busy) || pending || loading || !browserAvailable,
                 title: browserAvailable ? '展开 callback 检测，不会自动弹出窗口' : '仅支持 HTTP 127.0.0.1/localhost 入口', onClick: () => { void startBrowser() },
-              }, busy === 'browser' ? '正在准备浏览器登录…' : connected ? '用浏览器重新登录' : '本机浏览器 OAuth'),
+              }, busy === 'browser' ? '正在准备浏览器登录…' : connected ? '用浏览器添加账号' : '本机浏览器 OAuth'),
               pending && !devicePending && !browserPending ? h('button', { type: 'button', className: 'codexButton danger', disabled: Boolean(busy), onClick: () => { void cancel() } }, busy === 'cancel' ? '取消中…' : '取消登录') : null,
               connected ? h('button', { type: 'button', className: 'codexButton', disabled: Boolean(busy), onClick: refresh }, busy === 'refresh' ? '刷新中…' : '刷新用量') : null,
               connected || (status && status.credentialError) ? h('button', { type: 'button', className: 'codexButton danger', disabled: Boolean(busy), onClick: () => { void logout() } }, busy === 'logout' ? '退出中…' : '退出登录') : null,

package/lib/index.d.ts

@@ -7,12 +7,23 @@ import { CODEX_PROVIDER } from './native-adapter.js';
 export { CODEX_PROVIDER, NATIVE_CODEX_PROVIDER } from './native-adapter.js';
 export { normalizeUsage } from './usage.js';
 export { CODEX_CLIENT_VERSION, TRACKED_CODEX_COMMIT, TRACKED_CODEX_RELEASE, TRACKED_CODEX_REPOSITORY, } from './upstream.js';
-/** Persisted OAuth credential. */
+/** Persisted OAuth credential for one ChatGPT account. */
 export interface OpenAICodexCredential {
     access: string;
     refresh: string;
     expires: number;
     accountId: string;
+    email?: string;
+}
+/** Current multi-account credential document. */
+export interface OpenAICodexCredentialDocument {
+    version: 2;
+    currentAccountId: string | null;
+    accounts: OpenAICodexCredential[];
+}
+interface ParsedCredentialDocument {
+    document: OpenAICodexCredentialDocument;
+    migrated: boolean;
 }
 /** Plugin configuration. */
 export interface Config {
@@ -73,6 +84,8 @@ interface TokenResponse {
     id_token?: unknown;
 }
 declare function parseTokenResponse(value: TokenResponse | null, previous?: OpenAICodexCredential): OpenAICodexCredential;
+declare function parseCredentialDocument(text: string, filename: string): ParsedCredentialDocument;
+declare function currentCredential(document: OpenAICodexCredentialDocument | undefined): OpenAICodexCredential | undefined;
 declare function parseAuthority(authority: string | undefined): URL | undefined;
 declare function isLoopbackHostname(hostname: string): boolean;
 declare function isTrustedHost(authority: string | undefined, trustedHosts: readonly string[]): boolean;
@@ -85,6 +98,8 @@ declare function pollDeviceAuthorization(device: DeviceAuthorization, signal?: A
 declare function resolveCodexRouteStatus(config: NativeRouteConfig, llm: RouteRuntime | undefined): CodexRouteStatus;
 export declare const internals: {
     parseTokenResponse: typeof parseTokenResponse;
+    parseCredentialDocument: typeof parseCredentialDocument;
+    currentCredential: typeof currentCredential;
     parseAuthority: typeof parseAuthority;
     isLoopbackHostname: typeof isLoopbackHostname;
     isTrustedHost: typeof isTrustedHost;
@@ -138,9 +153,11 @@ export declare class OpenAICodexAuth extends Service {
     private restorePublishedCredential;
     private publicationChangedError;
     private failAfterPublicationRollback;
+    private commitDocument;
+    private upsertCurrentCredential;
     private commitCredential;
     private resolveManagedCredentialLocked;
-    /** Return a valid managed bearer token, refreshing and persisting it when near expiry. */
+    /** Return the current managed bearer token, refreshing and migrating it when needed. */
     bearerToken(signal?: AbortSignal): Promise<string | undefined>;
     private externalNativeCredential;
     private resolveNativeCredential;
@@ -154,6 +171,8 @@ export declare class OpenAICodexAuth extends Service {
     private beginBrowserLogin;
     private createBrowserLogin;
     private cancelLogin;
+    private resetCurrentAccountState;
+    private setCurrentAccount;
     private logout;
     private status;
     private fetchUsage;
@@ -169,6 +188,9 @@ export declare class OpenAICodexAuth extends Service {
     private handleBrowserComplete;
     private handleCallback;
     private handleCancel;
+    private accountIdBody;
+    private handleSetCurrentAccount;
+    private handleAccountLogout;
     private handleLogout;
 }
 export default OpenAICodexAuth;

package/lib/index.js

@@ -46,6 +46,8 @@ class LoginConflictError extends Error {
 }
 class CredentialNotWritableError extends Error {
 }
+class AccountNotFoundError extends Error {
+}
 const PERMANENT_REFRESH_CODES = new Set([
     'refresh_token_expired',
     'refresh_token_reused',
@@ -124,28 +126,70 @@ function parseTokenResponse(value, previous) {
         : chatGptAccountId(idToken, 'ID token');
     if (resolvedAccountId === undefined)
         throw new Error('OpenAI token response has no ID token');
-    return { access: value.access_token, refresh, expires, accountId: resolvedAccountId };
+    const emailClaim = idToken === undefined ? undefined : jwtPayload(idToken, 'ID token').email;
+    const email = typeof emailClaim === 'string' && emailClaim.trim() !== ''
+        ? emailClaim.trim()
+        : previous?.email;
+    return {
+        access: value.access_token,
+        refresh,
+        expires,
+        accountId: resolvedAccountId,
+        ...email === undefined ? {} : { email },
+    };
 }
 function isPermanentRefreshError(error) {
     return error instanceof OAuthEndpointError
         && (error.status === 401
             || (error.oauthCode !== undefined && PERMANENT_REFRESH_CODES.has(error.oauthCode.toLowerCase())));
 }
-function parseCredential(text, filename) {
-    const value = JSON.parse(text);
-    const credential = value.credential;
-    if (value.version !== 1 || credential === undefined
+function validateCredential(value, filename) {
+    const credential = value;
+    if (credential === null || typeof credential !== 'object'
         || typeof credential.access !== 'string' || credential.access.length === 0
         || typeof credential.refresh !== 'string' || credential.refresh.length === 0
         || typeof credential.expires !== 'number' || !Number.isFinite(credential.expires)
-        || typeof credential.accountId !== 'string' || credential.accountId.length === 0) {
+        || typeof credential.accountId !== 'string' || credential.accountId.length === 0
+        || credential.accountId.length > 512
+        || (credential.email !== undefined && (typeof credential.email !== 'string' || credential.email.length > 512))) {
         throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
     }
-    return credential;
+    return {
+        access: credential.access,
+        refresh: credential.refresh,
+        expires: credential.expires,
+        accountId: credential.accountId,
+        ...credential.email === undefined ? {} : { email: credential.email },
+    };
 }
-async function readCredential(filename) {
+function parseCredentialDocument(text, filename) {
+    const value = JSON.parse(text);
+    if (value.version === 1) {
+        const credential = validateCredential(value.credential, filename);
+        return {
+            document: { version: 2, currentAccountId: credential.accountId, accounts: [credential] },
+            migrated: true,
+        };
+    }
+    if (value.version !== 2 || !Array.isArray(value.accounts)
+        || (value.currentAccountId !== null && typeof value.currentAccountId !== 'string')) {
+        throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
+    }
+    const accounts = value.accounts.map(account => validateCredential(account, filename));
+    const ids = new Set(accounts.map(account => account.accountId));
+    if (ids.size !== accounts.length
+        || (accounts.length === 0 && value.currentAccountId !== null)
+        || (accounts.length > 0 && (value.currentAccountId === null || !ids.has(value.currentAccountId)))) {
+        throw new Error(`openai-codex-auth: invalid credential document ${filename}`);
+    }
+    return {
+        document: { version: 2, currentAccountId: value.currentAccountId, accounts },
+        migrated: false,
+    };
+}
+async function readCredentialDocument(filename) {
     try {
-        return parseCredential(await readFile(filename, 'utf8'), filename);
+        return parseCredentialDocument(await readFile(filename, 'utf8'), filename);
     }
     catch (error) {
         if (error.code === 'ENOENT')
@@ -153,6 +197,11 @@ async function readCredential(filename) {
         throw error;
     }
 }
+function currentCredential(document) {
+    if (document?.currentAccountId === null || document === undefined)
+        return undefined;
+    return document.accounts.find(account => account.accountId === document.currentAccountId);
+}
 async function responseText(response) {
     return (await response.text().catch(() => '')).slice(0, MAX_ERROR_BODY_LENGTH);
 }
@@ -573,6 +622,8 @@ function resolveCodexRouteStatus(config, llm) {
 }
 export const internals = {
     parseTokenResponse,
+    parseCredentialDocument,
+    currentCredential,
     parseAuthority,
     isLoopbackHostname,
     isTrustedHost,
@@ -703,6 +754,8 @@ export class OpenAICodexAuth extends Service {
                 register('/openai-codex/browser/prepare', (req, res) => this.handleBrowserPrepare(req, res));
                 register('/openai-codex/browser/complete', (req, res) => this.handleBrowserComplete(req, res));
                 register('/openai-codex/cancel', (req, res) => this.handleCancel(req, res));
+                register('/openai-codex/accounts/current', (req, res) => this.handleSetCurrentAccount(req, res));
+                register('/openai-codex/accounts/logout', (req, res) => this.handleAccountLogout(req, res));
                 register('/openai-codex/logout', (req, res) => this.handleLogout(req, res));
             }
             catch (error) {
@@ -802,7 +855,7 @@ export class OpenAICodexAuth extends Service {
     }
     async performUsageRefresh(generation) {
         try {
-            const credential = await readCredential(this.filename);
+            const credential = await withFileLock(this.filename, () => this.resolveManagedCredentialLocked());
             if (credential === undefined) {
                 if (this.usageGeneration === generation) {
                     this.usageCache = undefined;
@@ -900,43 +953,72 @@ export class OpenAICodexAuth extends Service {
         }
         throw failure;
     }
-    async commitCredential(credential) {
+    async commitDocument(document, signal) {
+        const nextToken = currentCredential(document)?.access;
         const previous = await this.ctx.credentials.resolve(TOKEN_REF);
-        try {
-            await this.ctx.credentials.set(TOKEN_REF, credential.access);
-        }
-        catch (error) {
-            let current;
+        throwIfCancelled(signal);
+        if (previous?.value !== nextToken) {
             try {
-                current = await this.ctx.credentials.resolve(TOKEN_REF);
+                if (nextToken === undefined)
+                    await this.ctx.credentials.unset(TOKEN_REF);
+                else
+                    await this.ctx.credentials.set(TOKEN_REF, nextToken);
             }
-            catch {
-                return this.failAfterPublicationRollback(previous, credential.access, error);
-            }
-            if (current?.value === credential.access) {
-                return this.failAfterPublicationRollback(previous, credential.access, error);
+            catch (error) {
+                let current;
+                try {
+                    current = await this.ctx.credentials.resolve(TOKEN_REF);
+                }
+                catch {
+                    return this.failAfterPublicationRollback(previous, nextToken, error);
+                }
+                if (current?.value === nextToken) {
+                    return this.failAfterPublicationRollback(previous, nextToken, error);
+                }
+                if (current?.value !== previous?.value)
+                    throw this.publicationChangedError(error);
+                throw error;
             }
-            if (current?.value !== previous?.value)
-                throw this.publicationChangedError(error);
-            throw error;
         }
         try {
-            await this.write(credential);
+            await this.write(document);
         }
         catch (error) {
-            return this.failAfterPublicationRollback(previous, credential.access, error);
+            if (previous?.value === nextToken)
+                throw error;
+            return this.failAfterPublicationRollback(previous, nextToken, error);
         }
     }
+    upsertCurrentCredential(document, credential, replacedAccountId = credential.accountId) {
+        const existingIndex = document.accounts.findIndex(account => account.accountId === replacedAccountId);
+        const accounts = document.accounts.filter(account => account.accountId !== credential.accountId);
+        const filteredIndex = accounts.findIndex(account => account.accountId === replacedAccountId);
+        if (filteredIndex >= 0)
+            accounts.splice(filteredIndex, 1);
+        const insertion = existingIndex < 0 ? accounts.length : Math.min(existingIndex, accounts.length);
+        accounts.splice(insertion, 0, credential);
+        return { version: 2, currentAccountId: credential.accountId, accounts };
+    }
+    async commitCredential(credential) {
+        const parsed = await readCredentialDocument(this.filename);
+        const document = parsed?.document ?? { version: 2, currentAccountId: null, accounts: [] };
+        await this.commitDocument(this.upsertCurrentCredential(document, credential));
+    }
     async resolveManagedCredentialLocked(signal) {
         throwIfCancelled(signal);
-        const current = await readCredential(this.filename);
+        const parsed = await readCredentialDocument(this.filename);
+        const document = parsed?.document;
+        const current = currentCredential(document);
         throwIfCancelled(signal);
         if (current === undefined) {
             this.setCredentialAccount(undefined);
             return undefined;
         }
         if (current.expires > Date.now() + TOKEN_REFRESH_PREEMPT_MS) {
-            await this.publishCredentialToken(current.access, signal);
+            if (parsed?.migrated)
+                await this.commitDocument(document, signal);
+            else
+                await this.publishCredentialToken(current.access, signal);
             this.setCredentialAccount(current.accountId);
             return current;
         }
@@ -948,18 +1030,24 @@ export class OpenAICodexAuth extends Service {
         catch (error) {
             throwIfCancelled(signal);
             if (!isPermanentRefreshError(error) && current.expires > Date.now()) {
-                await this.publishCredentialToken(current.access, signal);
+                if (parsed?.migrated)
+                    await this.commitDocument(document, signal);
+                else
+                    await this.publishCredentialToken(current.access, signal);
                 this.setCredentialAccount(current.accountId);
                 return current;
             }
             throw error;
         }
         throwIfCancelled(signal);
-        await this.commitCredential(next);
+        if (next.accountId !== current.accountId) {
+            throw new Error('OpenAI refresh changed the ChatGPT account identity');
+        }
+        await this.commitDocument(this.upsertCurrentCredential(document, next, current.accountId), signal);
         this.setCredentialAccount(next.accountId);
         return next;
     }
-    /** Return a valid managed bearer token, refreshing and persisting it when near expiry. */
+    /** Return the current managed bearer token, refreshing and migrating it when needed. */
     async bearerToken(signal) {
         throwIfCancelled(signal);
         return withFileLock(this.filename, async () => {
@@ -1027,7 +1115,9 @@ export class OpenAICodexAuth extends Service {
             throwIfCancelled(signal);
             return await withFileLock(this.filename, async () => {
                 throwIfCancelled(signal);
-                const current = await readCredential(this.filename);
+                const parsed = await readCredentialDocument(this.filename);
+                const document = parsed?.document;
+                const current = currentCredential(document);
                 throwIfCancelled(signal);
                 if (current === undefined) {
                     const external = await this.ctx.credentials.resolve(TOKEN_REF);
@@ -1036,11 +1126,15 @@ export class OpenAICodexAuth extends Service {
                         return false;
                     const credential = this.externalNativeCredential(external.value);
                     throwIfCancelled(signal);
+                    if (credential.accountId !== previous.accountId)
+                        return false;
                     this.setCredentialAccount(credential.accountId);
-                    return credential.accessToken !== previous.accessToken
-                        || credential.accountId !== previous.accountId;
+                    return credential.accessToken !== previous.accessToken;
                 }
-                if (current.access !== previous.accessToken || current.accountId !== previous.accountId) {
+                // A request that started under A must never recover by replaying under B.
+                if (current.accountId !== previous.accountId)
+                    return false;
+                if (current.access !== previous.accessToken) {
                     await this.publishCredentialToken(current.access, signal);
                     throwIfCancelled(signal);
                     this.setCredentialAccount(current.accountId);
@@ -1050,10 +1144,13 @@ export class OpenAICodexAuth extends Service {
                 throwIfCancelled(signal);
                 const next = await refreshToken(current, signal);
                 throwIfCancelled(signal);
-                await this.commitCredential(next);
+                if (next.accountId !== previous.accountId) {
+                    throw new Error('OpenAI refresh changed the ChatGPT account identity');
+                }
+                await this.commitDocument(this.upsertCurrentCredential(document, next, current.accountId), signal);
                 throwIfCancelled(signal);
                 this.setCredentialAccount(next.accountId);
-                return next.access !== previous.accessToken || next.accountId !== previous.accountId;
+                return next.access !== previous.accessToken;
             });
         }
         catch (error) {
@@ -1296,53 +1393,86 @@ export class OpenAICodexAuth extends Service {
         if (clearError)
             this.lastLoginError = undefined;
     }
-    async logout() {
-        await this.cancelLogin(true);
+    resetCurrentAccountState(accountId) {
+        this.setCredentialAccount(accountId);
+        this.usageGeneration += 1;
+        if (this.usageRefresh !== undefined)
+            this.usageRefresh.queued = accountId !== undefined;
+        this.usageCache = undefined;
+        this.usageAccountId = undefined;
+        this.directUsageAccountId = undefined;
+        this.usageHasDirectDefault = false;
+        this.usageError = undefined;
+        this.lastLoginError = undefined;
+    }
+    async setCurrentAccount(accountId) {
+        await withFileLock(this.filename, async () => {
+            const document = (await readCredentialDocument(this.filename))?.document;
+            if (document === undefined || !document.accounts.some(account => account.accountId === accountId)) {
+                throw new AccountNotFoundError('OpenAI Codex account was not found');
+            }
+            if (document.currentAccountId !== accountId) {
+                await this.assertCredentialWritable();
+                await this.commitDocument({ ...document, currentAccountId: accountId });
+            }
+            this.resetCurrentAccountState(accountId);
+        });
+    }
+    async logout(accountId) {
+        if (accountId === undefined)
+            await this.cancelLogin(true);
+        let nextAccountId;
+        let removedCurrent = false;
         await withFileLock(this.filename, async () => {
-            const previous = await this.ctx.credentials.resolve(TOKEN_REF);
+            let parsed;
             try {
-                await this.ctx.credentials.unset(TOKEN_REF);
+                parsed = await readCredentialDocument(this.filename);
             }
             catch (error) {
-                let current;
+                if (accountId !== undefined)
+                    throw error;
+                const previous = await this.ctx.credentials.resolve(TOKEN_REF);
                 try {
-                    current = await this.ctx.credentials.resolve(TOKEN_REF);
+                    if (previous !== undefined)
+                        await this.ctx.credentials.unset(TOKEN_REF);
+                    await unlink(this.filename);
                 }
-                catch {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
+                catch (failure) {
+                    return this.failAfterPublicationRollback(previous, undefined, failure);
                 }
-                if (current === undefined) {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
-                }
-                if (current.value !== previous?.value)
-                    throw this.publicationChangedError(error);
-                throw error;
-            }
-            try {
-                await unlink(this.filename);
+                removedCurrent = true;
+                this.resetCurrentAccountState(undefined);
+                return;
             }
-            catch (error) {
-                if (error.code !== 'ENOENT') {
-                    return this.failAfterPublicationRollback(previous, undefined, error);
-                }
+            const document = parsed?.document;
+            const target = accountId ?? document?.currentAccountId ?? undefined;
+            if (document === undefined || target === undefined
+                || !document.accounts.some(account => account.accountId === target)) {
+                if (accountId !== undefined)
+                    throw new AccountNotFoundError('OpenAI Codex account was not found');
+                return;
             }
+            removedCurrent = document.currentAccountId === target;
+            const targetIndex = document.accounts.findIndex(account => account.accountId === target);
+            const accounts = document.accounts.filter(account => account.accountId !== target);
+            const currentAccountId = removedCurrent
+                ? accounts[targetIndex]?.accountId ?? accounts[0]?.accountId ?? null
+                : document.currentAccountId;
+            if (removedCurrent)
+                await this.assertCredentialWritable();
+            await this.commitDocument({ version: 2, currentAccountId, accounts });
+            nextAccountId = currentAccountId ?? undefined;
+            if (removedCurrent)
+                this.resetCurrentAccountState(nextAccountId);
         });
-        this.setCredentialAccount(undefined);
-        this.usageGeneration += 1;
-        if (this.usageRefresh !== undefined)
-            this.usageRefresh.queued = false;
-        this.usageCache = undefined;
-        this.usageAccountId = undefined;
-        this.directUsageAccountId = undefined;
-        this.usageHasDirectDefault = false;
-        this.usageError = undefined;
-        this.lastLoginError = undefined;
     }
     async status(refresh, callbackUrl) {
+        let document;
         let credential;
         let credentialError;
         try {
-            credential = await readCredential(this.filename);
+            document = (await readCredentialDocument(this.filename))?.document;
+            credential = currentCredential(document);
         }
         catch (error) {
             credentialError = messageOf(error);
@@ -1350,7 +1480,8 @@ export class OpenAICodexAuth extends Service {
         if (credential !== undefined) {
             try {
                 await this.bearerToken();
-                credential = await readCredential(this.filename) ?? credential;
+                document = (await readCredentialDocument(this.filename))?.document ?? document;
+                credential = currentCredential(document) ?? credential;
             }
             catch (error) {
                 this.usageError = messageOf(error);
@@ -1379,6 +1510,13 @@ export class OpenAICodexAuth extends Service {
         return {
             route: resolveCodexRouteStatus(this.routeConfig, this.ctx.get('llm')),
             loggedIn: credential !== undefined,
+            currentAccountId: document?.currentAccountId ?? null,
+            accounts: (document?.accounts ?? []).map(account => ({
+                accountId: account.accountId,
+                ...account.email === undefined ? {} : { email: account.email },
+                expiresAt: account.expires,
+                current: account.accountId === document?.currentAccountId,
+            })),
             loginPending: startingMethod !== undefined || flow !== undefined,
             ...startingMethod !== undefined ? { loginMethod: startingMethod } : flow === undefined ? {} : { loginMethod: flow.kind },
             ...this.lastLoginError === undefined ? {} : { loginError: this.lastLoginError },
@@ -1388,6 +1526,7 @@ export class OpenAICodexAuth extends Service {
             ...browser === undefined ? {} : { browser },
             ...credential === undefined ? {} : {
                 accountId: credential.accountId,
+                ...credential.email === undefined ? {} : { email: credential.email },
                 expiresAt: credential.expires,
                 ...this.usageCache === undefined || this.usageAccountId !== credential.accountId
                     ? {} : { usage: this.usageCache },
@@ -1402,14 +1541,11 @@ export class OpenAICodexAuth extends Service {
         };
     }
     async fetchUsage(credential) {
-        const access = await this.bearerToken();
-        if (access === undefined)
-            throw new Error('OpenAI login is missing');
         const response = await fetch(USAGE_URL, {
             redirect: 'error',
             headers: {
                 accept: 'application/json',
-                authorization: `Bearer ${access}`,
+                authorization: `Bearer ${credential.access}`,
                 'chatgpt-account-id': credential.accountId,
                 'user-agent': 'dsh-openai-codex-auth/0.5.0',
             },
@@ -1418,8 +1554,8 @@ export class OpenAICodexAuth extends Service {
             throw new Error(`Codex usage request failed (HTTP ${response.status})`);
         return normalizeUsage(await response.json());
     }
-    write(credential) {
-        return writeFileAtomic(this.filename, `${JSON.stringify({ version: 1, credential }, null, 2)}\n`, {
+    write(document) {
+        return writeFileAtomic(this.filename, `${JSON.stringify(document, null, 2)}\n`, {
             mode: 0o600, dirMode: 0o700,
         });
     }
@@ -1642,6 +1778,54 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 500, { error: messageOf(error) });
         }
     }
+    async accountIdBody(req) {
+        const body = await readJsonBody(req);
+        if (Object.keys(body).length !== 1 || typeof body.accountId !== 'string'
+            || body.accountId.length === 0 || body.accountId.length > 512) {
+            throw new Error('The accountId field must identify one OpenAI Codex account.');
+        }
+        return body.accountId;
+    }
+    async handleSetCurrentAccount(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        try {
+            await this.setCurrentAccount(await this.accountIdBody(req));
+            this.sendJson(res, 200, { ok: true });
+        }
+        catch (error) {
+            const status = error instanceof AccountNotFoundError
+                ? 404
+                : error instanceof CredentialNotWritableError ? 409 : 400;
+            this.sendJson(res, status, { error: messageOf(error) });
+        }
+    }
+    async handleAccountLogout(req, res) {
+        if (!this.trustedManagementRequest(req, res))
+            return;
+        if (req.method !== 'POST') {
+            this.sendJson(res, 405, { error: 'POST only' }, { allow: 'POST' });
+            return;
+        }
+        if (!this.requireCsrf(req, res))
+            return;
+        try {
+            await this.logout(await this.accountIdBody(req));
+            this.sendJson(res, 200, { ok: true });
+        }
+        catch (error) {
+            const status = error instanceof AccountNotFoundError
+                ? 404
+                : error instanceof CredentialNotWritableError ? 409 : 400;
+            this.sendJson(res, status, { error: messageOf(error) });
+        }
+    }
     async handleLogout(req, res) {
         if (!this.trustedManagementRequest(req, res))
             return;
@@ -1656,7 +1840,7 @@ export class OpenAICodexAuth extends Service {
             this.sendJson(res, 200, { ok: true });
         }
         catch (error) {
-            this.sendJson(res, 500, { error: messageOf(error) });
+            this.sendJson(res, error instanceof CredentialNotWritableError ? 409 : 500, { error: messageOf(error) });
         }
     }
 }

package/lib/native-adapter.d.ts

@@ -24,6 +24,8 @@ export interface NativeCodexTransportMode {
     turnState?: string;
     /** @internal Receives a newly observed bounded turn-state token. */
     captureTurnState?: (state: string) => void;
+    /** @internal Pins WebSocket reconnects and HTTP fallback to one account. */
+    pinnedAccountId?: string;
 }
 export interface NativeCodexTransport {
     stream(options: GenerateOptions, mode?: NativeCodexTransportMode): AsyncIterable<StreamChunk>;

package/lib/native-http.js

@@ -436,6 +436,7 @@ export class NativeCodexHttpTransport {
         let transientRetries = 0;
         let connectionRetryDelayMs = INITIAL_CONNECTION_RETRY_DELAY_MS;
         let recovered = false;
+        let pinnedAccountId = mode.pinnedAccountId;
         while (true) {
             throwIfAborted(generation.signal);
             const watchdog = attemptWatchdog(generation.signal, this.requestTimeoutMs, this.idleTimeoutMs);
@@ -445,6 +446,11 @@ export class NativeCodexHttpTransport {
             try {
                 credential = await this.options.resolveCredential(watchdog.signal);
                 throwIfAborted(watchdog.signal);
+                if (pinnedAccountId === undefined)
+                    pinnedAccountId = credential.accountId;
+                else if (credential.accountId !== pinnedAccountId) {
+                    throw fixedFailure('native Codex account changed during request', 'AUTH');
+                }
                 if (mode.serviceTier !== undefined
                     && (mode.authorityHash === undefined
                         || nativeCodexAuthorityHash(credential.accountId) !== mode.authorityHash)) {

package/lib/native-websocket.js

@@ -500,10 +500,12 @@ export class NativeCodexWebSocketTransport {
                 if (entry.turnState === undefined)
                     entry.turnState = state;
             },
+            ...(pinnedAccountId === undefined ? {} : { pinnedAccountId }),
         });
         let reconnects = 0;
         let connectionRetryDelayMs = INITIAL_CONNECTION_RETRY_DELAY_MS;
         let recovered = false;
+        let pinnedAccountId = mode.pinnedAccountId;
         let requestCompleted = false;
         try {
             if (entry.disabled) {
@@ -518,6 +520,11 @@ export class NativeCodexWebSocketTransport {
                 try {
                     const credential = await this.options.resolveCredential(signal);
                     attemptedCredential = credential;
+                    if (pinnedAccountId === undefined)
+                        pinnedAccountId = credential.accountId;
+                    else if (credential.accountId !== pinnedAccountId) {
+                        throw failure('native Codex account changed during request', 'AUTH');
+                    }
                     this.assertFastAuthority(credential, mode);
                     for await (const chunk of this.attempt(entry, prepared, credential, signal)) {
                         emitted = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pure01fx/dsh-openai-codex-auth",
-  "version": "0.7.3",
+  "version": "0.8.0",
   "description": "Native ChatGPT Codex provider, device-code-first login, and same-origin Web integration for DeepSeek Harness",
   "license": "MIT",
   "publishConfig": {
@@ -69,6 +69,11 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "prepack": "pnpm build"
+  },
   "dsh": {
     "engines": {
       "dsh": "0.1.1-rc.2"
@@ -111,9 +116,5 @@
     "@types/proxy-from-env": "1.0.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8"
-  },
-  "scripts": {
-    "build": "tsc",
-    "test": "vitest run"
   }
-}
+}