codex-multi-auth 1.1.10 → 1.2.0

package/README.md

@@ -109,6 +109,21 @@ codex auth fix --dry-run
 codex auth doctor --fix
 ```
 
+If the shell should not launch a browser, use the manual callback flow:
+
+```bash
+codex auth login --manual
+CODEX_AUTH_NO_BROWSER=1 codex auth login
+```
+
+In non-TTY/manual shells, provide the full redirect URL on stdin instead of waiting for a browser callback:
+
+```bash
+echo "http://127.0.0.1:1455/auth/callback?code=..." | codex auth login --manual
+```
+
+No new npm scripts or storage migration steps are required for this login-flow update.
+
 ---
 
 ## Command Toolkit
@@ -234,6 +249,7 @@ codex auth login
 - `codex auth` unrecognized: run `where codex`, then follow `docs/troubleshooting.md` for routing fallback commands
 - Switch succeeds but wrong account appears active: run `codex auth switch <index>`, then restart session
 - OAuth callback on port `1455` fails: free the port and re-run `codex auth login`
+- Browser launch is blocked or you are in a headless shell: re-run `codex auth login --manual` or set `CODEX_AUTH_NO_BROWSER=1`
 - `missing field id_token` / `token_expired` / `refresh_token_reused`: re-login affected account
 
 </details>
@@ -275,9 +291,9 @@ codex auth doctor --json
 
 ## Release Notes
 
-- Current stable: [docs/releases/v1.1.10.md](docs/releases/v1.1.10.md)
-- Previous stable: [docs/releases/v0.1.9.md](docs/releases/v0.1.9.md)
-- Earlier stable: [docs/releases/v0.1.8.md](docs/releases/v0.1.8.md)
+- Current stable: [docs/releases/v1.2.0.md](docs/releases/v1.2.0.md)
+- Previous stable: [docs/releases/v1.1.10.md](docs/releases/v1.1.10.md)
+- Earlier stable: [docs/releases/v0.1.9.md](docs/releases/v0.1.9.md)
 - Archived prerelease: [docs/releases/v0.1.0-beta.0.md](docs/releases/v0.1.0-beta.0.md)
 
 ## License

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAmL5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MA60H/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,kBAAkB,CAAC;AAuL5D;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,iBAAiB,EAAE,MAwhI/B,CAAC;AAEF,eAAO,MAAM,gBAAgB,KAAoB,CAAC;AAElD,eAAe,iBAAiB,CAAC"}

package/dist/index.js

@@ -25,7 +25,7 @@
 import { tool } from "@codex-ai/plugin/tool";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./lib/auth/auth.js";
 import { queuedRefresh } from "./lib/refresh-queue.js";
-import { openBrowserUrl } from "./lib/auth/browser.js";
+import { isBrowserLaunchSuppressed, openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
 import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
 import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getLiveAccountSync, getLiveAccountSyncDebounceMs, getLiveAccountSyncPollMs, getSessionAffinity, getSessionAffinityTtlMs, getSessionAffinityMaxEntries, getProactiveRefreshGuardian, getProactiveRefreshIntervalMs, getProactiveRefreshBufferMs, getNetworkErrorCooldownMs, getServerErrorCooldownMs, getStorageBackupEnabled, getPreemptiveQuotaEnabled, getPreemptiveQuotaRemainingPercent5h, getPreemptiveQuotaRemainingPercent7d, getPreemptiveQuotaMaxDeferralMs, loadPluginConfig, } from "./lib/config.js";
@@ -33,9 +33,9 @@ import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PR
 import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
-import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./lib/accounts.js";
+import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, resolveRuntimeRequestIdentity, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./lib/accounts.js";
 import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, findMatchingAccountIndex, StorageError, formatStorageErrorHint, setStorageBackupEnabled, } from "./lib/storage.js";
-import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
+import { applyProxyCompatibleInit, createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, isWorkspaceDisabledError, } from "./lib/request/fetch-helpers.js";
 import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
 import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
 import { isEmptyResponse } from "./lib/request/response-handler.js";
@@ -213,6 +213,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         if (candidates.length === 0) {
             return tokens;
         }
+        // Convert candidates to workspaces
+        const workspaces = candidates.map((c) => ({
+            id: c.accountId,
+            name: c.label,
+            enabled: true,
+            isDefault: c.isDefault,
+        }));
         if (candidates.length === 1) {
             const [candidate] = candidates;
             if (candidate) {
@@ -221,6 +228,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     accountIdOverride: candidate.accountId,
                     accountIdSource: candidate.source,
                     accountLabel: candidate.label,
+                    workspaces,
                 };
             }
         }
@@ -234,6 +242,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             accountIdOverride: choice.accountId,
             accountIdSource: choice.source ?? "token",
             accountLabel: choice.label,
+            workspaces,
         };
     };
     const buildManualOAuthFlow = (pkce, url, expectedState, onSuccess) => ({
@@ -331,6 +340,18 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     allowUniqueAccountIdFallbackWithoutEmail: true,
                 });
                 if (existingIndex === undefined) {
+                    const initialWorkspaceIndex = result.workspaces && result.workspaces.length > 0
+                        ? (() => {
+                            if (accountId) {
+                                const matchingWorkspaceIndex = result.workspaces.findIndex((workspace) => workspace.id === accountId);
+                                if (matchingWorkspaceIndex >= 0) {
+                                    return matchingWorkspaceIndex;
+                                }
+                            }
+                            const firstEnabledWorkspaceIndex = result.workspaces.findIndex((workspace) => workspace.enabled !== false);
+                            return firstEnabledWorkspaceIndex >= 0 ? firstEnabledWorkspaceIndex : 0;
+                        })()
+                        : undefined;
                     accounts.push({
                         accountId,
                         accountIdSource,
@@ -341,6 +362,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         expiresAt: result.expires,
                         addedAt: now,
                         lastUsed: now,
+                        workspaces: result.workspaces,
+                        currentWorkspaceIndex: initialWorkspaceIndex,
                     });
                     continue;
                 }
@@ -351,6 +374,38 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 const nextAccountId = accountId ?? existing.accountId;
                 const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
                 const nextAccountLabel = accountLabel ?? existing.accountLabel;
+                // Preserve tracked workspace state when auth refreshes do not return workspace metadata.
+                const mergedWorkspaces = result.workspaces
+                    ? result.workspaces.map((newWs) => {
+                        const existingWs = existing.workspaces?.find((w) => w.id === newWs.id);
+                        return existingWs
+                            ? {
+                                ...newWs,
+                                enabled: existingWs.enabled,
+                                disabledAt: existingWs.disabledAt,
+                            }
+                            : newWs;
+                    })
+                    : existing.workspaces;
+                const currentWorkspaceId = existing.workspaces?.[typeof existing.currentWorkspaceIndex === "number"
+                    ? existing.currentWorkspaceIndex
+                    : 0]?.id;
+                const nextCurrentWorkspaceIndex = mergedWorkspaces && mergedWorkspaces.length > 0
+                    ? (() => {
+                        if (currentWorkspaceId) {
+                            const matchingWorkspaceIndex = mergedWorkspaces.findIndex((workspace) => workspace.id === currentWorkspaceId);
+                            if (matchingWorkspaceIndex >= 0) {
+                                return matchingWorkspaceIndex;
+                            }
+                        }
+                        const defaultWorkspaceIndex = mergedWorkspaces.findIndex((workspace) => workspace.isDefault === true);
+                        if (defaultWorkspaceIndex >= 0) {
+                            return defaultWorkspaceIndex;
+                        }
+                        const firstEnabledWorkspaceIndex = mergedWorkspaces.findIndex((workspace) => workspace.enabled !== false);
+                        return firstEnabledWorkspaceIndex >= 0 ? firstEnabledWorkspaceIndex : 0;
+                    })()
+                    : existing.currentWorkspaceIndex;
                 accounts[existingIndex] = {
                     ...existing,
                     accountId: nextAccountId,
@@ -361,6 +416,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     accessToken: result.access,
                     expiresAt: result.expires,
                     lastUsed: now,
+                    workspaces: mergedWorkspaces,
+                    currentWorkspaceIndex: nextCurrentWorkspaceIndex,
                 };
             }
             if (accounts.length === 0)
@@ -999,7 +1056,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         const accountKey = resolveEntitlementAccountKey(candidate);
                                         capabilityBoostByAccount[candidate.index] = capabilityPolicyStore.getBoost(accountKey, model ?? modelFamily);
                                     }
-                                    while (attempted.size < Math.max(1, accountCount)) {
+                                    accountAttemptLoop: while (attempted.size < Math.max(1, accountCount)) {
                                         let account = null;
                                         if (!usedPreferredSessionAccount &&
                                             typeof preferredSessionAccountIndex === "number") {
@@ -1065,26 +1122,34 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountManager.saveToDiskDebounced();
                                             continue;
                                         }
-                                        const hadAccountId = !!account.accountId;
-                                        const tokenAccountId = extractAccountId(accountAuth.access);
-                                        const accountId = resolveRequestAccountId(account.accountId, account.accountIdSource, tokenAccountId);
+                                        const currentWorkspace = accountManager.getCurrentWorkspace(account);
+                                        const storedAccountId = currentWorkspace?.id ?? account.accountId;
+                                        const storedAccountIdSource = currentWorkspace
+                                            ? "manual"
+                                            : account.accountIdSource;
+                                        const storedEmail = account.email;
+                                        const hadAccountId = !!storedAccountId;
+                                        const runtimeIdentity = resolveRuntimeRequestIdentity({
+                                            storedAccountId,
+                                            source: storedAccountIdSource,
+                                            storedEmail,
+                                            accessToken: accountAuth.access,
+                                            idToken: accountAuth.idToken,
+                                        });
+                                        const tokenAccountId = runtimeIdentity.tokenAccountId;
+                                        const accountId = runtimeIdentity.accountId;
                                         if (!accountId) {
                                             accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
                                             accountManager.saveToDiskDebounced();
                                             continue;
                                         }
-                                        const resolvedEmail = extractAccountEmail(accountAuth.access) ?? account.email;
+                                        const resolvedEmail = runtimeIdentity.email;
                                         const entitlementAccountKey = resolveEntitlementAccountKey({
-                                            accountId: account.accountId ?? accountId,
+                                            accountId: storedAccountId ?? accountId,
                                             email: resolvedEmail,
                                             refreshToken: account.refreshToken,
                                             index: account.index,
                                         });
-                                        account.accountId = accountId;
-                                        if (!hadAccountId && tokenAccountId && accountId === tokenAccountId) {
-                                            account.accountIdSource = account.accountIdSource ?? "token";
-                                        }
-                                        account.email = resolvedEmail;
                                         const entitlementBlock = entitlementCache.isBlocked(entitlementAccountKey, model ?? modelFamily);
                                         if (entitlementBlock.blocked) {
                                             runtimeMetrics.accountRotations++;
@@ -1092,6 +1157,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             logWarn(`Skipping account ${account.index + 1} due to cached entitlement block (${formatWaitTime(entitlementBlock.waitMs)} remaining).`);
                                             continue;
                                         }
+                                        account.accountId = accountId;
+                                        if (!hadAccountId && tokenAccountId && accountId === tokenAccountId) {
+                                            account.accountIdSource = storedAccountIdSource ?? "token";
+                                        }
+                                        if (resolvedEmail) {
+                                            account.email = resolvedEmail;
+                                        }
                                         if (accountCount > 1 &&
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                             const accountLabel = formatAccountLabel(account, account.index);
@@ -1125,6 +1197,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         }
                                         let sameAccountRetryCount = 0;
                                         let successAccountForResponse = account;
+                                        let successEntitlementAccountKey = entitlementAccountKey;
                                         while (true) {
                                             let response;
                                             const fetchStart = performance.now();
@@ -1149,11 +1222,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             }
                                             try {
                                                 runtimeMetrics.totalRequests++;
-                                                response = await fetch(url, {
+                                                response = await fetch(url, applyProxyCompatibleInit(url, {
                                                     ...requestInit,
                                                     headers,
                                                     signal: fetchController.signal,
-                                                });
+                                                }));
                                             }
                                             catch (networkError) {
                                                 const fetchAbortReason = fetchController.signal.reason;
@@ -1331,7 +1404,54 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     entitlementCache.markBlocked(entitlementAccountKey, blockedModel, "unsupported-model");
                                                     capabilityPolicyStore.recordUnsupported(entitlementAccountKey, blockedModel);
                                                 }
-                                                if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported) {
+                                                const workspaceErrorCode = errorBody?.error?.code ?? "";
+                                                const workspaceErrorMessage = errorBody?.error?.message ?? "";
+                                                const isDisabledWorkspaceError = isWorkspaceDisabledError(errorResponse.status, workspaceErrorCode, workspaceErrorMessage);
+                                                // Handle workspace disabled/expired errors by rotating to the next workspace
+                                                // within the same account before falling back to another account.
+                                                if (isDisabledWorkspaceError) {
+                                                    runtimeMetrics.failedRequests++;
+                                                    runtimeMetrics.lastError = `Workspace disabled for account ${account.index + 1}`;
+                                                    if (!account.workspaces || account.workspaces.length === 0) {
+                                                        logWarn(`Workspace disabled/expired for account ${account.index + 1} without tracked workspaces. Leaving account enabled.`, { errorCode: workspaceErrorCode });
+                                                        if (hasRemainingAccounts) {
+                                                            continue accountAttemptLoop;
+                                                        }
+                                                        return errorResponse;
+                                                    }
+                                                    else {
+                                                        const currentWorkspace = accountManager.getCurrentWorkspace(account);
+                                                        const workspaceName = currentWorkspace?.name ?? currentWorkspace?.id ?? "unknown";
+                                                        logWarn(`Workspace disabled/expired for account ${account.index + 1} - workspace: ${workspaceName}. Rotating to next workspace.`, { errorCode: workspaceErrorCode });
+                                                        const disabledWorkspace = currentWorkspace
+                                                            ? accountManager.disableCurrentWorkspace(account, currentWorkspace.id)
+                                                            : false;
+                                                        let nextWorkspace = disabledWorkspace
+                                                            ? accountManager.rotateToNextWorkspace(account)
+                                                            : accountManager.getCurrentWorkspace(account);
+                                                        if (!disabledWorkspace && (!nextWorkspace || nextWorkspace.enabled === false)) {
+                                                            nextWorkspace = accountManager.rotateToNextWorkspace(account);
+                                                        }
+                                                        if (nextWorkspace) {
+                                                            accountManager.saveToDiskDebounced();
+                                                            const newWorkspaceName = nextWorkspace.name ?? nextWorkspace.id;
+                                                            await showToast(`Workspace ${workspaceName} disabled. Switched to ${newWorkspaceName}.`, "warning", { duration: toastDurationMs });
+                                                            logInfo(`Rotated to workspace ${newWorkspaceName} for account ${account.index + 1}`);
+                                                            // Allow the same account to be selected again with fresh request state.
+                                                            attempted.delete(account.index);
+                                                            continue accountAttemptLoop;
+                                                        }
+                                                        logWarn(`All workspaces disabled for account ${account.index + 1}. Disabling account.`);
+                                                        accountManager.setAccountEnabled(account.index, false);
+                                                        accountManager.saveToDiskDebounced();
+                                                        await showToast(`All workspaces disabled for account ${account.index + 1}. Switching to another account.`, "warning", { duration: toastDurationMs });
+                                                        // Forget session affinity and continue the outer loop so another
+                                                        // enabled account can service the request.
+                                                        sessionAffinityStore?.forgetSession(sessionAffinityKey);
+                                                        continue accountAttemptLoop;
+                                                    }
+                                                }
+                                                if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported && !isDisabledWorkspaceError) {
                                                     entitlementCache.markBlocked(entitlementAccountKey, model ?? modelFamily, "plan-entitlement");
                                                     capabilityPolicyStore.recordFailure(entitlementAccountKey, capabilityModelKey);
                                                 }
@@ -1452,14 +1572,50 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                             });
                                                             continue;
                                                         }
-                                                        const fallbackTokenAccountId = extractAccountId(fallbackAuth.access);
-                                                        const fallbackAccountId = resolveRequestAccountId(fallbackAccount.accountId, fallbackAccount.accountIdSource, fallbackTokenAccountId);
+                                                        const fallbackStoredAccountId = fallbackAccount.accountId;
+                                                        const fallbackStoredAccountIdSource = fallbackAccount.accountIdSource;
+                                                        const fallbackStoredEmail = fallbackAccount.email;
+                                                        const hadFallbackAccountId = !!fallbackStoredAccountId;
+                                                        const fallbackRuntimeIdentity = resolveRuntimeRequestIdentity({
+                                                            storedAccountId: fallbackStoredAccountId,
+                                                            source: fallbackStoredAccountIdSource,
+                                                            storedEmail: fallbackStoredEmail,
+                                                            accessToken: fallbackAuth.access,
+                                                            idToken: fallbackAuth.idToken,
+                                                        });
+                                                        const fallbackTokenAccountId = fallbackRuntimeIdentity.tokenAccountId;
+                                                        const fallbackAccountId = fallbackRuntimeIdentity.accountId;
                                                         if (!fallbackAccountId) {
                                                             continue;
                                                         }
+                                                        const fallbackResolvedEmail = fallbackRuntimeIdentity.email;
+                                                        const fallbackEntitlementAccountKey = resolveEntitlementAccountKey({
+                                                            accountId: fallbackStoredAccountId ?? fallbackAccountId,
+                                                            email: fallbackResolvedEmail,
+                                                            refreshToken: fallbackAccount.refreshToken,
+                                                            index: fallbackAccount.index,
+                                                        });
+                                                        const fallbackEntitlementBlock = entitlementCache.isBlocked(fallbackEntitlementAccountKey, model ?? modelFamily);
+                                                        if (fallbackEntitlementBlock.blocked) {
+                                                            runtimeMetrics.accountRotations++;
+                                                            runtimeMetrics.lastError =
+                                                                `Entitlement cached block for account ${fallbackAccount.index + 1}`;
+                                                            logWarn(`Skipping account ${fallbackAccount.index + 1} due to cached entitlement block (${formatWaitTime(fallbackEntitlementBlock.waitMs)} remaining).`);
+                                                            continue;
+                                                        }
                                                         if (!accountManager.consumeToken(fallbackAccount, modelFamily, model)) {
                                                             continue;
                                                         }
+                                                        fallbackAccount.accountId = fallbackAccountId;
+                                                        if (!hadFallbackAccountId &&
+                                                            fallbackTokenAccountId &&
+                                                            fallbackAccountId === fallbackTokenAccountId) {
+                                                            fallbackAccount.accountIdSource =
+                                                                fallbackStoredAccountIdSource ?? "token";
+                                                        }
+                                                        if (fallbackResolvedEmail) {
+                                                            fallbackAccount.email = fallbackResolvedEmail;
+                                                        }
                                                         const fallbackHeaders = createCodexHeaders(requestInit, fallbackAccountId, fallbackAuth.access, {
                                                             model,
                                                             promptCacheKey: effectivePromptCacheKey,
@@ -1476,14 +1632,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         }
                                                         try {
                                                             runtimeMetrics.totalRequests++;
-                                                            const fallbackResponse = await fetch(url, {
+                                                            const fallbackResponse = await fetch(url, applyProxyCompatibleInit(url, {
                                                                 ...requestInit,
                                                                 headers: fallbackHeaders,
                                                                 signal: fallbackController.signal,
-                                                            });
+                                                            }));
                                                             const fallbackSnapshot = readQuotaSchedulerSnapshot(fallbackResponse.headers, fallbackResponse.status);
                                                             if (fallbackSnapshot) {
-                                                                preemptiveQuotaScheduler.update(`${resolveEntitlementAccountKey(fallbackAccount)}:${model ?? modelFamily}`, fallbackSnapshot);
+                                                                preemptiveQuotaScheduler.update(`${fallbackEntitlementAccountKey}:${model ?? modelFamily}`, fallbackSnapshot);
                                                             }
                                                             if (!fallbackResponse.ok) {
                                                                 try {
@@ -1500,10 +1656,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                                 else {
                                                                     accountManager.recordFailure(fallbackAccount, modelFamily, model);
                                                                 }
-                                                                capabilityPolicyStore.recordFailure(resolveEntitlementAccountKey(fallbackAccount), capabilityModelKey);
+                                                                capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                                 continue;
                                                             }
                                                             successAccountForResponse = fallbackAccount;
+                                                            successEntitlementAccountKey = fallbackEntitlementAccountKey;
                                                             runtimeMetrics.streamFailoverRecoveries += 1;
                                                             if (fallbackAccount.index !== account.index) {
                                                                 runtimeMetrics.streamFailoverCrossAccountRecoveries += 1;
@@ -1516,7 +1673,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         catch (streamFailoverError) {
                                                             accountManager.refundToken(fallbackAccount, modelFamily, model);
                                                             accountManager.recordFailure(fallbackAccount, modelFamily, model);
-                                                            capabilityPolicyStore.recordFailure(resolveEntitlementAccountKey(fallbackAccount), capabilityModelKey);
+                                                            capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                             logWarn(`Stream failover attempt ${failoverAttempt} failed for account ${fallbackAccount.index + 1}.`, {
                                                                 emittedBytes,
                                                                 error: streamFailoverError instanceof Error
@@ -1585,9 +1742,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             if (successAccountForResponse.index !== account.index) {
                                                 accountManager.markSwitched(successAccountForResponse, "rotation", modelFamily);
                                             }
-                                            const successAccountKey = successAccountForResponse.index === account.index
-                                                ? entitlementAccountKey
-                                                : resolveEntitlementAccountKey(successAccountForResponse);
+                                            const successAccountKey = successEntitlementAccountKey;
                                             accountManager.recordSuccess(successAccountForResponse, modelFamily, model);
                                             capabilityPolicyStore.recordSuccess(successAccountKey, capabilityModelKey);
                                             entitlementCache.clear(successAccountKey, capabilityModelKey);
@@ -1660,9 +1815,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         applyUiRuntimeFromConfig(authPluginConfig);
                         applyAccountStorageScope(authPluginConfig);
                         const accounts = [];
-                        const noBrowser = inputs?.noBrowser === "true" ||
+                        const noBrowser = inputs?.manual === "true" ||
+                            inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
-                        const useManualMode = noBrowser;
+                        const useManualMode = noBrowser || isBrowserLaunchSuppressed();
                         const explicitLoginMode = inputs?.loginMode === "fresh" || inputs?.loginMode === "add"
                             ? inputs.loginMode
                             : null;