codex-multi-auth 0.1.8 → 0.1.9

package/dist/lib/codex-manager.js

@@ -14,7 +14,7 @@ import { MODEL_FAMILIES } from "./prompts/codex.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
 import { queuedRefresh } from "./refresh-queue.js";
 import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
-import { clearAccounts, getStoragePath, loadFlaggedAccounts, loadAccounts, saveFlaggedAccounts, saveAccounts, setStoragePath, } from "./storage.js";
+import { clearAccounts, findMatchingAccountIndex, getStoragePath, loadFlaggedAccounts, loadAccounts, saveFlaggedAccounts, saveAccounts, setStoragePath, withAccountAndFlaggedStorageTransaction, withAccountStorageTransaction, } from "./storage.js";
 import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { ANSI } from "./ui/ansi.js";
@@ -322,6 +322,26 @@ function normalizeQuotaEmail(email) {
     const normalized = sanitizeEmail(email);
     return normalized && normalized.length > 0 ? normalized : null;
 }
+function normalizeQuotaAccountId(accountId) {
+    if (typeof accountId !== "string")
+        return null;
+    const trimmed = accountId.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function hasUniqueQuotaAccountId(accounts, account) {
+    const accountId = normalizeQuotaAccountId(account.accountId);
+    if (!accountId)
+        return false;
+    let matchCount = 0;
+    for (const candidate of accounts) {
+        if (normalizeQuotaAccountId(candidate.accountId) !== accountId)
+            continue;
+        matchCount += 1;
+        if (matchCount > 1)
+            return false;
+    }
+    return matchCount === 1;
+}
 function quotaCacheEntryToSnapshot(entry) {
     return {
         status: entry.status,
@@ -389,17 +409,20 @@ function formatAccountQuotaSummary(entry) {
     }
     return formatQuotaSnapshotLine(quotaCacheEntryToSnapshot(entry));
 }
-function getQuotaCacheEntryForAccount(cache, account) {
-    if (account.accountId && cache.byAccountId[account.accountId]) {
-        return cache.byAccountId[account.accountId] ?? null;
-    }
+function getQuotaCacheEntryForAccount(cache, account, accounts) {
     const email = normalizeQuotaEmail(account.email);
     if (email && cache.byEmail[email]) {
         return cache.byEmail[email] ?? null;
     }
+    const accountId = normalizeQuotaAccountId(account.accountId);
+    if (accountId &&
+        hasUniqueQuotaAccountId(accounts, account) &&
+        cache.byAccountId[accountId]) {
+        return cache.byAccountId[accountId] ?? null;
+    }
     return null;
 }
-function updateQuotaCacheForAccount(cache, account, snapshot) {
+function updateQuotaCacheForAccount(cache, account, snapshot, accounts) {
     const nextEntry = {
         updatedAt: Date.now(),
         status: snapshot.status,
@@ -417,25 +440,27 @@ function updateQuotaCacheForAccount(cache, account, snapshot) {
         },
     };
     let changed = false;
-    if (account.accountId) {
-        cache.byAccountId[account.accountId] = nextEntry;
-        changed = true;
-    }
     const email = normalizeQuotaEmail(account.email);
     if (email) {
         cache.byEmail[email] = nextEntry;
         changed = true;
+        return changed;
+    }
+    const accountId = normalizeQuotaAccountId(account.accountId);
+    if (accountId && hasUniqueQuotaAccountId(accounts, account)) {
+        cache.byAccountId[accountId] = nextEntry;
+        changed = true;
     }
     return changed;
 }
 const DEFAULT_MENU_QUOTA_REFRESH_TTL_MS = 5 * 60_000;
 const MENU_QUOTA_REFRESH_MODEL = "gpt-5-codex";
-function resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now) {
+function resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now, accounts) {
     if (account.enabled === false)
         return null;
     if (!hasUsableAccessToken(account, now))
         return null;
-    const existing = getQuotaCacheEntryForAccount(cache, account);
+    const existing = getQuotaCacheEntryForAccount(cache, account, accounts);
     if (existing &&
         typeof existing.updatedAt === "number" &&
         Number.isFinite(existing.updatedAt) &&
@@ -453,7 +478,7 @@ function resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now) {
 function collectMenuQuotaRefreshTargets(storage, cache, maxAgeMs, now = Date.now()) {
     const targets = [];
     for (const account of storage.accounts) {
-        const probeInput = resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now);
+        const probeInput = resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now, storage.accounts);
         if (!probeInput)
             continue;
         targets.push({
@@ -467,7 +492,7 @@ function collectMenuQuotaRefreshTargets(storage, cache, maxAgeMs, now = Date.now
 function countMenuQuotaRefreshTargets(storage, cache, maxAgeMs, now = Date.now()) {
     let count = 0;
     for (const account of storage.accounts) {
-        if (resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now)) {
+        if (resolveMenuQuotaProbeInput(account, cache, maxAgeMs, now, storage.accounts)) {
             count += 1;
         }
     }
@@ -492,7 +517,9 @@ async function refreshQuotaCacheForMenu(storage, cache, maxAgeMs, onProgress) {
                 accessToken: target.accessToken,
                 model: MENU_QUOTA_REFRESH_MODEL,
             });
-            changed = updateQuotaCacheForAccount(cache, target.account, snapshot) || changed;
+            changed =
+                updateQuotaCacheForAccount(cache, target.account, snapshot, storage.accounts) ||
+                    changed;
         }
         catch {
             // Keep existing cached values if probing fails.
@@ -615,7 +642,9 @@ function toExistingAccountInfo(storage, quotaCache, displaySettings) {
     const activeIndex = resolveActiveIndex(storage, "codex");
     const layoutMode = resolveMenuLayoutMode(displaySettings);
     const baseAccounts = storage.accounts.map((account, index) => {
-        const entry = quotaCache ? getQuotaCacheEntryForAccount(quotaCache, account) : null;
+        const entry = quotaCache
+            ? getQuotaCacheEntryForAccount(quotaCache, account, storage.accounts)
+            : null;
         return {
             index,
             sourceIndex: index,
@@ -1058,118 +1087,83 @@ async function runOAuthFlow(forceNewLogin) {
 async function persistAccountPool(results, replaceAll) {
     if (results.length === 0)
         return;
-    const loadedStorage = replaceAll
-        ? null
-        : await loadAccounts();
-    const now = Date.now();
-    const accounts = loadedStorage?.accounts ? [...loadedStorage.accounts] : [];
-    const indexByRefreshToken = new Map();
-    const indexByAccountId = new Map();
-    const indexByEmail = new Map();
-    let selectedAccountIndex = null;
-    for (let i = 0; i < accounts.length; i += 1) {
-        const account = accounts[i];
-        if (!account)
-            continue;
-        if (account.refreshToken)
-            indexByRefreshToken.set(account.refreshToken, i);
-        if (account.accountId)
-            indexByAccountId.set(account.accountId, i);
-        if (account.email)
-            indexByEmail.set(account.email, i);
-    }
-    for (const result of results) {
-        const tokenAccountId = extractAccountId(result.access);
-        const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
-        const accountIdSource = accountId
-            ? (result.accountIdSource ?? (result.accountIdOverride ? "manual" : "token"))
-            : undefined;
-        const accountLabel = result.accountLabel;
-        const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-        const existingByEmail = accountEmail && indexByEmail.has(accountEmail)
-            ? indexByEmail.get(accountEmail)
-            : undefined;
-        const existingById = accountId && indexByAccountId.has(accountId)
-            ? indexByAccountId.get(accountId)
-            : undefined;
-        const existingByToken = indexByRefreshToken.get(result.refresh);
-        const existingIndex = existingById ?? existingByEmail ?? existingByToken;
-        if (existingIndex === undefined) {
-            const newIndex = accounts.length;
-            accounts.push({
+    await withAccountStorageTransaction(async (loadedStorage, persist) => {
+        const stored = replaceAll ? null : loadedStorage;
+        const now = Date.now();
+        const accounts = stored?.accounts ? [...stored.accounts] : [];
+        let selectedAccountIndex = null;
+        for (const result of results) {
+            const tokenAccountId = extractAccountId(result.access);
+            const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
+            const accountIdSource = accountId
+                ? (result.accountIdSource ?? (result.accountIdOverride ? "manual" : "token"))
+                : undefined;
+            const accountLabel = result.accountLabel;
+            const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
+            const existingIndex = findMatchingAccountIndex(accounts, {
                 accountId,
-                accountIdSource,
-                accountLabel,
                 email: accountEmail,
                 refreshToken: result.refresh,
+            }, {
+                allowUniqueAccountIdFallbackWithoutEmail: true,
+            });
+            if (existingIndex === undefined) {
+                const newIndex = accounts.length;
+                accounts.push({
+                    accountId,
+                    accountIdSource,
+                    accountLabel,
+                    email: accountEmail,
+                    refreshToken: result.refresh,
+                    accessToken: result.access,
+                    expiresAt: result.expires,
+                    enabled: true,
+                    addedAt: now,
+                    lastUsed: now,
+                });
+                selectedAccountIndex = newIndex;
+                continue;
+            }
+            const existing = accounts[existingIndex];
+            if (!existing)
+                continue;
+            const nextEmail = accountEmail ?? existing.email;
+            const nextAccountId = accountId ?? existing.accountId;
+            const nextAccountIdSource = accountId
+                ? (accountIdSource ?? existing.accountIdSource)
+                : existing.accountIdSource;
+            accounts[existingIndex] = {
+                ...existing,
+                accountId: nextAccountId,
+                accountIdSource: nextAccountIdSource,
+                accountLabel: accountLabel ?? existing.accountLabel,
+                email: nextEmail,
+                refreshToken: result.refresh,
                 accessToken: result.access,
                 expiresAt: result.expires,
                 enabled: true,
-                addedAt: now,
                 lastUsed: now,
-            });
-            indexByRefreshToken.set(result.refresh, newIndex);
-            if (accountId)
-                indexByAccountId.set(accountId, newIndex);
-            if (accountEmail)
-                indexByEmail.set(accountEmail, newIndex);
-            selectedAccountIndex = newIndex;
-            continue;
-        }
-        const existing = accounts[existingIndex];
-        if (!existing)
-            continue;
-        const oldToken = existing.refreshToken;
-        const oldEmail = existing.email;
-        const nextEmail = accountEmail ?? existing.email;
-        const nextAccountId = accountId ?? existing.accountId;
-        const nextAccountIdSource = accountId
-            ? (accountIdSource ?? existing.accountIdSource)
-            : existing.accountIdSource;
-        accounts[existingIndex] = {
-            ...existing,
-            accountId: nextAccountId,
-            accountIdSource: nextAccountIdSource,
-            accountLabel: accountLabel ?? existing.accountLabel,
-            email: nextEmail,
-            refreshToken: result.refresh,
-            accessToken: result.access,
-            expiresAt: result.expires,
-            enabled: true,
-            lastUsed: now,
-        };
-        if (oldToken !== result.refresh) {
-            indexByRefreshToken.delete(oldToken);
-            indexByRefreshToken.set(result.refresh, existingIndex);
-        }
-        if (nextAccountId) {
-            indexByAccountId.set(nextAccountId, existingIndex);
-        }
-        if (oldEmail && oldEmail !== nextEmail) {
-            indexByEmail.delete(oldEmail);
-        }
-        if (nextEmail) {
-            indexByEmail.set(nextEmail, existingIndex);
-        }
-        selectedAccountIndex = existingIndex;
-    }
-    const fallbackActiveIndex = accounts.length === 0
-        ? 0
-        : Math.max(0, Math.min(loadedStorage?.activeIndex ?? 0, accounts.length - 1));
-    const nextActiveIndex = accounts.length === 0
-        ? 0
-        : selectedAccountIndex === null
-            ? fallbackActiveIndex
-            : Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
-    const activeIndexByFamily = {};
-    for (const family of MODEL_FAMILIES) {
-        activeIndexByFamily[family] = nextActiveIndex;
-    }
-    await saveAccounts({
-        version: 3,
-        accounts,
-        activeIndex: nextActiveIndex,
-        activeIndexByFamily,
+            };
+            selectedAccountIndex = existingIndex;
+        }
+        const fallbackActiveIndex = accounts.length === 0
+            ? 0
+            : Math.max(0, Math.min(stored?.activeIndex ?? 0, accounts.length - 1));
+        const nextActiveIndex = accounts.length === 0
+            ? 0
+            : selectedAccountIndex === null
+                ? fallbackActiveIndex
+                : Math.max(0, Math.min(selectedAccountIndex, accounts.length - 1));
+        const activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            activeIndexByFamily[family] = nextActiveIndex;
+        }
+        await persist({
+            version: 3,
+            accounts,
+            activeIndex: nextActiveIndex,
+            activeIndexByFamily,
+        });
     });
 }
 async function syncSelectionToCodex(tokens) {
@@ -1279,7 +1273,7 @@ async function runHealthCheck(options = {}) {
                         });
                         if (quotaCache) {
                             quotaCacheChanged =
-                                updateQuotaCacheForAccount(quotaCache, account, snapshot) || quotaCacheChanged;
+                                updateQuotaCacheForAccount(quotaCache, account, snapshot, storage.accounts) || quotaCacheChanged;
                         }
                         healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
                     }
@@ -1349,7 +1343,7 @@ async function runHealthCheck(options = {}) {
                         });
                         if (quotaCache) {
                             quotaCacheChanged =
-                                updateQuotaCacheForAccount(quotaCache, account, snapshot) || quotaCacheChanged;
+                                updateQuotaCacheForAccount(quotaCache, account, snapshot, storage.accounts) || quotaCacheChanged;
                         }
                         healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
                     }
@@ -1751,7 +1745,7 @@ async function runForecast(args) {
                 const account = storage.accounts[i];
                 if (account) {
                     quotaCacheChanged =
-                        updateQuotaCacheForAccount(quotaCache, account, liveQuota) || quotaCacheChanged;
+                        updateQuotaCacheForAccount(quotaCache, account, liveQuota, storage.accounts) || quotaCacheChanged;
                 }
             }
         }
@@ -2007,24 +2001,24 @@ function findExistingAccountIndexForFlagged(storage, flagged, nextRefreshToken,
     const flaggedEmail = sanitizeEmail(flagged.email);
     const candidateAccountId = nextAccountId ?? flagged.accountId;
     const candidateEmail = sanitizeEmail(nextEmail) ?? flaggedEmail;
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account)
-            continue;
-        if (account.refreshToken === flagged.refreshToken || account.refreshToken === nextRefreshToken) {
-            return i;
-        }
-        if (candidateAccountId &&
-            typeof account.accountId === "string" &&
-            account.accountId === candidateAccountId) {
-            return i;
-        }
-        const existingEmail = sanitizeEmail(account.email);
-        if (candidateEmail && existingEmail && existingEmail === candidateEmail) {
-            return i;
-        }
-    }
-    return -1;
+    const nextMatchIndex = findMatchingAccountIndex(storage.accounts, {
+        accountId: candidateAccountId,
+        email: candidateEmail,
+        refreshToken: nextRefreshToken,
+    }, {
+        allowUniqueAccountIdFallbackWithoutEmail: true,
+    });
+    if (nextMatchIndex !== undefined) {
+        return nextMatchIndex;
+    }
+    const flaggedMatchIndex = findMatchingAccountIndex(storage.accounts, {
+        accountId: candidateAccountId,
+        email: candidateEmail,
+        refreshToken: flagged.refreshToken,
+    }, {
+        allowUniqueAccountIdFallbackWithoutEmail: true,
+    });
+    return flaggedMatchIndex ?? -1;
 }
 function upsertRecoveredFlaggedAccount(storage, flagged, refreshResult, now) {
     const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken)) ?? flagged.email;
@@ -2129,24 +2123,65 @@ async function runVerifyFlagged(args) {
         console.log("No flagged accounts to check.");
         return 0;
     }
-    let storage = await loadAccounts();
-    if (!storage) {
-        storage = createEmptyAccountStorage();
-    }
     let storageChanged = false;
     let flaggedChanged = false;
     const reports = [];
     const nextFlaggedAccounts = [];
     const now = Date.now();
+    const refreshChecks = [];
     for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
         const flagged = flaggedStorage.accounts[i];
         if (!flagged)
             continue;
         const label = formatAccountLabel(flagged, i);
-        const result = await queuedRefresh(flagged.refreshToken);
-        if (result.type === "success") {
-            if (!options.restore) {
-                const nextFlagged = {
+        refreshChecks.push({
+            index: i,
+            flagged,
+            label,
+            result: await queuedRefresh(flagged.refreshToken),
+        });
+    }
+    const applyRefreshChecks = (storage) => {
+        for (const check of refreshChecks) {
+            const { index: i, flagged, label, result } = check;
+            if (result.type === "success") {
+                if (!options.restore) {
+                    const nextFlagged = {
+                        ...flagged,
+                        refreshToken: result.refresh,
+                        accessToken: result.access,
+                        expiresAt: result.expires,
+                        accountId: extractAccountId(result.access) ?? flagged.accountId,
+                        accountIdSource: extractAccountId(result.access) ? "token" : flagged.accountIdSource,
+                        email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)) ?? flagged.email,
+                        lastUsed: now,
+                        lastError: undefined,
+                    };
+                    nextFlaggedAccounts.push(nextFlagged);
+                    if (JSON.stringify(nextFlagged) !== JSON.stringify(flagged)) {
+                        flaggedChanged = true;
+                    }
+                    reports.push({
+                        index: i,
+                        label,
+                        outcome: "healthy-flagged",
+                        message: "session is healthy (left in flagged list due to --no-restore)",
+                    });
+                    continue;
+                }
+                const upsertResult = upsertRecoveredFlaggedAccount(storage, flagged, result, now);
+                if (upsertResult.restored) {
+                    storageChanged = storageChanged || upsertResult.changed;
+                    flaggedChanged = true;
+                    reports.push({
+                        index: i,
+                        label,
+                        outcome: "restored",
+                        message: upsertResult.message,
+                    });
+                    continue;
+                }
+                const updatedFlagged = {
                     ...flagged,
                     refreshToken: result.refresh,
                     accessToken: result.access,
@@ -2155,87 +2190,71 @@ async function runVerifyFlagged(args) {
                     accountIdSource: extractAccountId(result.access) ? "token" : flagged.accountIdSource,
                     email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)) ?? flagged.email,
                     lastUsed: now,
-                    lastError: undefined,
+                    lastError: upsertResult.message,
                 };
-                nextFlaggedAccounts.push(nextFlagged);
-                if (JSON.stringify(nextFlagged) !== JSON.stringify(flagged)) {
+                nextFlaggedAccounts.push(updatedFlagged);
+                if (JSON.stringify(updatedFlagged) !== JSON.stringify(flagged)) {
                     flaggedChanged = true;
                 }
                 reports.push({
                     index: i,
                     label,
-                    outcome: "healthy-flagged",
-                    message: "session is healthy (left in flagged list due to --no-restore)",
-                });
-                continue;
-            }
-            const upsertResult = upsertRecoveredFlaggedAccount(storage, flagged, result, now);
-            if (upsertResult.restored) {
-                storageChanged = storageChanged || upsertResult.changed;
-                flaggedChanged = true;
-                reports.push({
-                    index: i,
-                    label,
-                    outcome: "restored",
+                    outcome: "restore-skipped",
                     message: upsertResult.message,
                 });
                 continue;
             }
-            const updatedFlagged = {
+            const detail = normalizeFailureDetail(result.message, result.reason);
+            const failedFlagged = {
                 ...flagged,
-                refreshToken: result.refresh,
-                accessToken: result.access,
-                expiresAt: result.expires,
-                accountId: extractAccountId(result.access) ?? flagged.accountId,
-                accountIdSource: extractAccountId(result.access) ? "token" : flagged.accountIdSource,
-                email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)) ?? flagged.email,
-                lastUsed: now,
-                lastError: upsertResult.message,
+                lastError: detail,
             };
-            nextFlaggedAccounts.push(updatedFlagged);
-            if (JSON.stringify(updatedFlagged) !== JSON.stringify(flagged)) {
+            nextFlaggedAccounts.push(failedFlagged);
+            if ((flagged.lastError ?? "") !== detail) {
                 flaggedChanged = true;
             }
             reports.push({
                 index: i,
                 label,
-                outcome: "restore-skipped",
-                message: upsertResult.message,
+                outcome: "still-flagged",
+                message: detail,
             });
-            continue;
         }
-        const detail = normalizeFailureDetail(result.message, result.reason);
-        const failedFlagged = {
-            ...flagged,
-            lastError: detail,
-        };
-        nextFlaggedAccounts.push(failedFlagged);
-        if ((flagged.lastError ?? "") !== detail) {
-            flaggedChanged = true;
+    };
+    if (options.restore) {
+        if (options.dryRun) {
+            applyRefreshChecks((await loadAccounts()) ?? createEmptyAccountStorage());
         }
-        reports.push({
-            index: i,
-            label,
-            outcome: "still-flagged",
-            message: detail,
-        });
+        else {
+            await withAccountAndFlaggedStorageTransaction(async (loadedStorage, persist) => {
+                const nextStorage = loadedStorage
+                    ? structuredClone(loadedStorage)
+                    : createEmptyAccountStorage();
+                applyRefreshChecks(nextStorage);
+                if (!storageChanged) {
+                    return;
+                }
+                normalizeDoctorIndexes(nextStorage);
+                await persist(nextStorage, {
+                    version: 1,
+                    accounts: nextFlaggedAccounts,
+                });
+            });
+        }
+    }
+    else {
+        applyRefreshChecks(createEmptyAccountStorage());
     }
     const remainingFlagged = nextFlaggedAccounts.length;
     const restored = reports.filter((report) => report.outcome === "restored").length;
     const healthyFlagged = reports.filter((report) => report.outcome === "healthy-flagged").length;
     const stillFlagged = reports.filter((report) => report.outcome === "still-flagged").length;
     const changed = storageChanged || flaggedChanged;
-    if (!options.dryRun) {
-        if (storageChanged) {
-            normalizeDoctorIndexes(storage);
-            await saveAccounts(storage);
-        }
-        if (flaggedChanged) {
-            await saveFlaggedAccounts({
-                version: 1,
-                accounts: nextFlaggedAccounts,
-            });
-        }
+    if (!options.dryRun && flaggedChanged && (!options.restore || !storageChanged)) {
+        await saveFlaggedAccounts({
+            version: 1,
+            accounts: nextFlaggedAccounts,
+        });
     }
     if (options.json) {
         console.log(JSON.stringify({
@@ -2340,7 +2359,7 @@ async function runFix(args) {
                         });
                         if (quotaCache) {
                             quotaCacheChanged =
-                                updateQuotaCacheForAccount(quotaCache, account, snapshot) || quotaCacheChanged;
+                                updateQuotaCacheForAccount(quotaCache, account, snapshot, storage.accounts) || quotaCacheChanged;
                         }
                         reports.push({
                             index: i,
@@ -2413,7 +2432,7 @@ async function runFix(args) {
                         });
                         if (quotaCache) {
                             quotaCacheChanged =
-                                updateQuotaCacheForAccount(quotaCache, account, snapshot) || quotaCacheChanged;
+                                updateQuotaCacheForAccount(quotaCache, account, snapshot, storage.accounts) || quotaCacheChanged;
                         }
                         reports.push({
                             index: i,
@@ -2615,6 +2634,12 @@ function normalizeDoctorIndexes(storage) {
     }
     return changed;
 }
+function getDoctorRefreshTokenKey(refreshToken) {
+    if (typeof refreshToken !== "string")
+        return undefined;
+    const trimmed = refreshToken.trim();
+    return trimmed || undefined;
+}
 function applyDoctorFixes(storage) {
     let changed = false;
     const actions = [];
@@ -2630,7 +2655,9 @@ function applyDoctorFixes(storage) {
         const account = storage.accounts[i];
         if (!account)
             continue;
-        const refreshToken = account.refreshToken.trim();
+        const refreshToken = getDoctorRefreshTokenKey(account.refreshToken);
+        if (!refreshToken)
+            continue;
         const existingTokenIndex = seenRefreshTokens.get(refreshToken);
         if (typeof existingTokenIndex === "number") {
             if (account.enabled !== false) {
@@ -2879,7 +2906,9 @@ async function runDoctor(args) {
         const seenRefreshTokens = new Set();
         let duplicateTokenCount = 0;
         for (const account of storage.accounts) {
-            const token = account.refreshToken.trim();
+            const token = getDoctorRefreshTokenKey(account.refreshToken);
+            if (!token)
+                continue;
             if (seenRefreshTokens.has(token)) {
                 duplicateTokenCount += 1;
             }