codex-multi-auth 1.1.11 → 1.2.1

package/dist/index.js

@@ -23,39 +23,68 @@
 
  */
 import { tool } from "@codex-ai/plugin/tool";
+import { AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, getAccountIdCandidates, isCodexCliSyncEnabled, lookupCodexCliTokensByEmail, parseRateLimitReason, resolveRequestAccountId, resolveRuntimeRequestIdentity, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./lib/accounts.js";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, redactOAuthUrlForLog, REDIRECT_URI, } from "./lib/auth/auth.js";
-import { queuedRefresh } from "./lib/refresh-queue.js";
-import { openBrowserUrl } from "./lib/auth/browser.js";
+import { isBrowserLaunchSuppressed, openBrowserUrl } from "./lib/auth/browser.js";
 import { startLocalOAuthServer } from "./lib/auth/server.js";
-import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
-import { getCodexMode, getFastSession, getFastSessionStrategy, getFastSessionMaxInputItems, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getFallbackToGpt52OnUnsupportedGpt53, getUnsupportedCodexPolicy, getUnsupportedCodexFallbackChain, getTokenRefreshSkewMs, getSessionRecovery, getAutoResume, getToastDurationMs, getPerProjectAccounts, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getPidOffsetEnabled, getFetchTimeoutMs, getStreamStallTimeoutMs, getCodexTuiV2, getCodexTuiColorProfile, getCodexTuiGlyphMode, getLiveAccountSync, getLiveAccountSyncDebounceMs, getLiveAccountSyncPollMs, getSessionAffinity, getSessionAffinityTtlMs, getSessionAffinityMaxEntries, getProactiveRefreshGuardian, getProactiveRefreshIntervalMs, getProactiveRefreshBufferMs, getNetworkErrorCooldownMs, getServerErrorCooldownMs, getStorageBackupEnabled, getPreemptiveQuotaEnabled, getPreemptiveQuotaRemainingPercent5h, getPreemptiveQuotaRemainingPercent7d, getPreemptiveQuotaMaxDeferralMs, loadPluginConfig, } from "./lib/config.js";
-import { AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, ACCOUNT_LIMITS, } from "./lib/constants.js";
-import { initLogger, logRequest, logDebug, logInfo, logWarn, logError, setCorrelationId, clearCorrelationId, } from "./lib/logger.js";
 import { checkAndNotify } from "./lib/auto-update-checker.js";
+import { CapabilityPolicyStore } from "./lib/capability-policy.js";
+import { promptAddAnotherAccount, promptLoginMode } from "./lib/cli.js";
+import { getAutoResume, getCodexMode, getEmptyResponseMaxRetries, getEmptyResponseRetryDelayMs, getFallbackToGpt52OnUnsupportedGpt53, getFastSession, getFastSessionMaxInputItems, getFastSessionStrategy, getFetchTimeoutMs, getLiveAccountSync, getLiveAccountSyncDebounceMs, getLiveAccountSyncPollMs, getNetworkErrorCooldownMs, getPerProjectAccounts, getPidOffsetEnabled, getPreemptiveQuotaEnabled, getPreemptiveQuotaMaxDeferralMs, getPreemptiveQuotaRemainingPercent5h, getPreemptiveQuotaRemainingPercent7d, getProactiveRefreshBufferMs, getProactiveRefreshGuardian, getProactiveRefreshIntervalMs, getRateLimitToastDebounceMs, getRetryAllAccountsMaxRetries, getRetryAllAccountsMaxWaitMs, getRetryAllAccountsRateLimited, getBackgroundResponses, getResponseContinuation, getServerErrorCooldownMs, getSessionAffinity, getSessionAffinityMaxEntries, getSessionAffinityTtlMs, getSessionRecovery, getStorageBackupEnabled, getStreamStallTimeoutMs, getToastDurationMs, getTokenRefreshSkewMs, getUnsupportedCodexFallbackChain, getUnsupportedCodexPolicy, loadPluginConfig, } from "./lib/config.js";
+import { ACCOUNT_LIMITS, AUTH_LABELS, CODEX_BASE_URL, DUMMY_API_KEY, LOG_STAGES, PLUGIN_NAME, PROVIDER_ID, } from "./lib/constants.js";
 import { handleContextOverflow } from "./lib/context-overflow.js";
-import { AccountManager, getAccountIdCandidates, extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, resolveRequestAccountId, parseRateLimitReason, lookupCodexCliTokensByEmail, isCodexCliSyncEnabled, } from "./lib/accounts.js";
-import { getStoragePath, loadAccounts, saveAccounts, withAccountStorageTransaction, clearAccounts, setStoragePath, exportAccounts, importAccounts, loadFlaggedAccounts, saveFlaggedAccounts, clearFlaggedAccounts, findMatchingAccountIndex, StorageError, formatStorageErrorHint, setStorageBackupEnabled, } from "./lib/storage.js";
-import { createCodexHeaders, extractRequestUrl, handleErrorResponse, handleSuccessResponse, getUnsupportedCodexModelInfo, resolveUnsupportedCodexFallbackModel, refreshAndUpdateToken, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
-import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
-import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
-import { isEmptyResponse } from "./lib/request/response-handler.js";
-import { addJitter } from "./lib/rotation.js";
-import { SessionAffinityStore } from "./lib/session-affinity.js";
+import { EntitlementCache, resolveEntitlementAccountKey, } from "./lib/entitlement-cache.js";
 import { LiveAccountSync } from "./lib/live-account-sync.js";
+import { clearCorrelationId, initLogger, logDebug, logError, logInfo, logRequest, logWarn, setCorrelationId, } from "./lib/logger.js";
+import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./lib/preemptive-quota-scheduler.js";
+import { getModelFamily, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
+import { prewarmHostCodexPrompt } from "./lib/prompts/host-codex-prompt.js";
+import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./lib/quota-probe.js";
+import { detectErrorType, getRecoveryToastContent, isRecoverableError, } from "./lib/recovery.js";
 import { RefreshGuardian } from "./lib/refresh-guardian.js";
+import { queuedRefresh } from "./lib/refresh-queue.js";
+import { parseEnvInt, parseFailoverMode, } from "./lib/request/failover-config.js";
 import { evaluateFailurePolicy, } from "./lib/request/failure-policy.js";
-import { EntitlementCache, resolveEntitlementAccountKey, } from "./lib/entitlement-cache.js";
-import { PreemptiveQuotaScheduler, readQuotaSchedulerSnapshot, } from "./lib/preemptive-quota-scheduler.js";
-import { CapabilityPolicyStore } from "./lib/capability-policy.js";
+import { applyProxyCompatibleInit, createCodexHeaders, extractRequestUrl, getUnsupportedCodexModelInfo, handleErrorResponse, handleSuccessResponse, isWorkspaceDisabledError, refreshAndUpdateToken, resolveUnsupportedCodexFallbackModel, rewriteUrlForCodex, shouldRefreshToken, transformRequestForCodex, } from "./lib/request/fetch-helpers.js";
+import { getRateLimitBackoff, RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS, resetRateLimitBackoff, } from "./lib/request/rate-limit-backoff.js";
+import { normalizeRequestInit, parseRequestBodyFromInit, } from "./lib/request/request-init.js";
+import { applyFastSessionDefaults } from "./lib/request/request-transformer.js";
+import { applyResponseCompaction } from "./lib/request/response-compaction.js";
+import { isEmptyResponse } from "./lib/request/response-handler.js";
+import { parseRetryAfterHintMs, sanitizeResponseHeadersForLog, } from "./lib/request/response-metadata.js";
 import { withStreamingFailover } from "./lib/request/stream-failover.js";
-import { buildTableHeader, buildTableRow } from "./lib/table-formatter.js";
-import { setUiRuntimeOptions } from "./lib/ui/runtime.js";
-import { paintUiText, formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection } from "./lib/ui/format.js";
-import { getModelFamily, getCodexInstructions, MODEL_FAMILIES, prewarmCodexInstructions, } from "./lib/prompts/codex.js";
-import { prewarmHostCodexPrompt } from "./lib/prompts/host-codex-prompt.js";
-import { createSessionRecoveryHook, isRecoverableError, detectErrorType, getRecoveryToastContent, } from "./lib/recovery.js";
-import { createHashlineEditTool, createHashlineReadTool, } from "./lib/tools/hashline-tools.js";
+import { createAbortableSleep, sleepWithCountdown, } from "./lib/request/wait-utils.js";
+import { addJitter } from "./lib/rotation.js";
+import { clampActiveIndices, isFlaggableFailure, } from "./lib/runtime/account-check-helpers.js";
+import { runRuntimeAccountCheck } from "./lib/runtime/account-check.js";
+import { createAccountCheckWorkingState } from "./lib/runtime/account-check-types.js";
+import { invalidateRuntimeAccountManagerCache, reloadRuntimeAccountManager, } from "./lib/runtime/account-manager-cache.js";
+import { persistAccountPoolResults, } from "./lib/runtime/account-pool.js";
+import { resolveAccountSelection } from "./lib/runtime/account-selection.js";
+import { formatRateLimitEntry, getRateLimitResetTimeForFamily, resolveActiveIndex, } from "./lib/runtime/account-status.js";
+import { createPersistAccounts, runRuntimeOAuthFlow, } from "./lib/runtime/auth-facade.js";
+import { applyAccountStorageScopeEntry } from "./lib/runtime/account-storage-scope-entry.js";
+import { runBrowserOAuthFlow } from "./lib/runtime/browser-oauth-flow.js";
+import { handleRuntimeEvent } from "./lib/runtime/event-handler.js";
+import { hydrateRuntimeEmails } from "./lib/runtime/hydrate-emails.js";
+import { buildLoginMenuAccounts } from "./lib/runtime/login-menu-accounts.js";
+import { ensureLiveAccountSyncEntry } from "./lib/runtime/live-sync-entry.js";
+import { applyLoaderRuntimeSetup } from "./lib/runtime/loader-setup.js";
+import { buildManualOAuthFlow } from "./lib/runtime/manual-oauth-flow.js";
+import { applyPreemptiveQuotaSettingsFromConfig, } from "./lib/runtime/quota-settings.js";
+import { ensureLiveAccountSyncState, ensureRefreshGuardianState, ensureSessionAffinityState, } from "./lib/runtime/runtime-services.js";
+import { applyAccountStorageScopeFromConfig } from "./lib/runtime/storage-scope.js";
+import { showRuntimeToast } from "./lib/runtime/toast.js";
+import { createRuntimeSessionRecoveryHook } from "./lib/runtime/session-recovery.js";
+import { applyUiRuntimeFromConfig, getStatusMarker, } from "./lib/runtime/ui-runtime.js";
+import { verifyRuntimeFlaggedAccounts } from "./lib/runtime/verify-flagged.js";
+import { SessionAffinityStore } from "./lib/session-affinity.js";
 import { registerCleanup } from "./lib/shutdown.js";
+import { clearAccounts, clearFlaggedAccounts, exportAccounts, findMatchingAccountIndex, formatStorageErrorHint, getStoragePath, importAccounts, loadAccounts, loadFlaggedAccounts, StorageError, saveAccounts, saveFlaggedAccounts, setStorageBackupEnabled, setStoragePath, withAccountStorageTransaction, } from "./lib/storage.js";
+import { buildTableHeader, buildTableRow, } from "./lib/table-formatter.js";
+import { createHashlineEditTool, createHashlineReadTool, } from "./lib/tools/hashline-tools.js";
+import { formatUiBadge, formatUiHeader, formatUiItem, formatUiKeyValue, formatUiSection, paintUiText, } from "./lib/ui/format.js";
+import { setUiRuntimeOptions, } from "./lib/ui/runtime.js";
 /**
  * OpenAI Codex OAuth authentication plugin for Codex CLI host runtime
  *
@@ -85,6 +114,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
     let liveAccountSyncPath = null;
     let refreshGuardian = null;
     let refreshGuardianConfigKey = null;
+    let refreshGuardianCleanupRegistered = false;
     let sessionAffinityStore = new SessionAffinityStore();
     let sessionAffinityConfigKey = null;
     const entitlementCache = new EntitlementCache();
@@ -103,80 +133,6 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         balanced: 15_000,
         conservative: 20_000,
     };
-    const parseFailoverMode = (value) => {
-        const normalized = (value ?? "").trim().toLowerCase();
-        if (normalized === "aggressive")
-            return "aggressive";
-        if (normalized === "conservative")
-            return "conservative";
-        return "balanced";
-    };
-    const parseEnvInt = (value) => {
-        if (value === undefined)
-            return undefined;
-        const parsed = Number.parseInt(value, 10);
-        return Number.isFinite(parsed) ? parsed : undefined;
-    };
-    const MAX_RETRY_HINT_MS = 5 * 60 * 1000;
-    const clampRetryHintMs = (value) => {
-        if (!Number.isFinite(value))
-            return null;
-        const normalized = Math.floor(value);
-        if (normalized <= 0)
-            return null;
-        return Math.min(normalized, MAX_RETRY_HINT_MS);
-    };
-    const parseRetryAfterHintMs = (headers) => {
-        const retryAfterMsHeader = headers.get("retry-after-ms")?.trim();
-        if (retryAfterMsHeader && /^\d+$/.test(retryAfterMsHeader)) {
-            return clampRetryHintMs(Number.parseInt(retryAfterMsHeader, 10));
-        }
-        const retryAfterHeader = headers.get("retry-after")?.trim();
-        if (retryAfterHeader && /^\d+$/.test(retryAfterHeader)) {
-            return clampRetryHintMs(Number.parseInt(retryAfterHeader, 10) * 1000);
-        }
-        if (retryAfterHeader) {
-            const retryAtMs = Date.parse(retryAfterHeader);
-            if (Number.isFinite(retryAtMs)) {
-                return clampRetryHintMs(retryAtMs - Date.now());
-            }
-        }
-        const resetAtHeader = headers.get("x-ratelimit-reset")?.trim();
-        if (resetAtHeader && /^\d+$/.test(resetAtHeader)) {
-            const resetRaw = Number.parseInt(resetAtHeader, 10);
-            const resetAtMs = resetRaw < 10_000_000_000 ? resetRaw * 1000 : resetRaw;
-            return clampRetryHintMs(resetAtMs - Date.now());
-        }
-        return null;
-    };
-    const sanitizeResponseHeadersForLog = (headers) => {
-        const allowed = new Set([
-            "content-type",
-            "x-request-id",
-            "x-openai-request-id",
-            "x-codex-plan-type",
-            "x-codex-active-limit",
-            "x-codex-primary-used-percent",
-            "x-codex-primary-window-minutes",
-            "x-codex-primary-reset-at",
-            "x-codex-primary-reset-after-seconds",
-            "x-codex-secondary-used-percent",
-            "x-codex-secondary-window-minutes",
-            "x-codex-secondary-reset-at",
-            "x-codex-secondary-reset-after-seconds",
-            "retry-after",
-            "x-ratelimit-reset",
-            "x-ratelimit-reset-requests",
-        ]);
-        const sanitized = {};
-        for (const [rawName, rawValue] of headers.entries()) {
-            const name = rawName.toLowerCase();
-            if (!allowed.has(name))
-                continue;
-            sanitized[name] = rawValue;
-        }
-        return sanitized;
-    };
     const runtimeMetrics = {
         startedAt: Date.now(),
         totalRequests: 0,
@@ -197,500 +153,145 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
         lastRequestAt: null,
         lastError: null,
     };
-    const resolveAccountSelection = (tokens) => {
-        const override = (process.env.CODEX_AUTH_ACCOUNT_ID ?? "").trim();
-        if (override) {
-            const suffix = override.length > 6 ? override.slice(-6) : override;
-            logInfo(`Using account override from CODEX_AUTH_ACCOUNT_ID (id:${suffix}).`);
-            return {
-                ...tokens,
-                accountIdOverride: override,
-                accountIdSource: "manual",
-                accountLabel: `Override [id:${suffix}]`,
-            };
-        }
-        const candidates = getAccountIdCandidates(tokens.access, tokens.idToken);
-        if (candidates.length === 0) {
-            return tokens;
-        }
-        if (candidates.length === 1) {
-            const [candidate] = candidates;
-            if (candidate) {
-                return {
-                    ...tokens,
-                    accountIdOverride: candidate.accountId,
-                    accountIdSource: candidate.source,
-                    accountLabel: candidate.label,
-                };
-            }
-        }
-        // Auto-select the best workspace candidate without prompting.
-        // This honors org/default/id-token signals and avoids forcing personal token IDs.
-        const choice = selectBestAccountCandidate(candidates);
-        if (!choice)
-            return tokens;
-        return {
-            ...tokens,
-            accountIdOverride: choice.accountId,
-            accountIdSource: choice.source ?? "token",
-            accountLabel: choice.label,
-        };
+    const resolveTokenSuccessAccount = (tokens) => resolveAccountSelection(tokens, {
+        envAccountId: process.env.CODEX_AUTH_ACCOUNT_ID,
+        logInfo,
+        getAccountIdCandidates,
+        selectBestAccountCandidate,
+    });
+    const persistAccountPool = createPersistAccounts({
+        persistAccountPoolResults,
+        withAccountStorageTransaction,
+        extractAccountId,
+        extractAccountEmail,
+        sanitizeEmail,
+        findMatchingAccountIndex,
+        modelFamilies: MODEL_FAMILIES,
+    });
+    const accountManagerCacheInvalidationDeps = {
+        setCachedAccountManager: (value) => {
+            cachedAccountManager = value;
+        },
+        setAccountManagerPromise: (value) => {
+            accountManagerPromise = value;
+        },
     };
-    const buildManualOAuthFlow = (pkce, url, expectedState, onSuccess) => ({
-        url,
-        method: "code",
-        instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
-        validate: (input) => {
-            const parsed = parseAuthorizationInput(input);
-            if (!parsed.code) {
-                return `No authorization code found. Paste the full callback URL (e.g., ${REDIRECT_URI}?code=...)`;
-            }
-            if (!parsed.state) {
-                return "Missing OAuth state. Paste the full callback URL including both code and state parameters.";
-            }
-            if (parsed.state !== expectedState) {
-                return "OAuth state mismatch. Restart login and paste the callback URL generated for this login attempt.";
-            }
-            return undefined;
+    const makeReloadAccountManagerDeps = (authFallback) => ({
+        currentReloadInFlight: accountReloadInFlight,
+        loadFromDisk: (fallback) => AccountManager.loadFromDisk(fallback),
+        setCachedAccountManager: (value) => {
+            cachedAccountManager = value;
         },
-        callback: async (input) => {
-            const parsed = parseAuthorizationInput(input);
-            if (!parsed.code || !parsed.state) {
-                return {
-                    type: "failed",
-                    reason: "invalid_response",
-                    message: "Missing authorization code or OAuth state",
-                };
-            }
-            if (parsed.state !== expectedState) {
-                return {
-                    type: "failed",
-                    reason: "invalid_response",
-                    message: "OAuth state mismatch. Restart login and try again.",
-                };
-            }
-            const tokens = await exchangeAuthorizationCode(parsed.code, pkce.verifier, REDIRECT_URI);
-            if (tokens?.type === "success") {
-                const resolved = resolveAccountSelection(tokens);
-                if (onSuccess) {
-                    await onSuccess(resolved);
-                }
-                return resolved;
-            }
-            return tokens?.type === "failed"
-                ? tokens
-                : { type: "failed" };
+        setAccountManagerPromise: (value) => {
+            accountManagerPromise = value;
         },
+        setReloadInFlight: (value) => {
+            accountReloadInFlight = value;
+        },
+        authFallback,
+    });
+    const reloadAccountManagerFromDisk = async (authFallback) => reloadRuntimeAccountManager(makeReloadAccountManagerDeps(authFallback));
+    const applyAccountStorageScope = (pluginConfig) => applyAccountStorageScopeEntry({
+        pluginConfig,
+        getPerProjectAccounts,
+        getStorageBackupEnabled,
+        setStorageBackupEnabled,
+        isCodexCliSyncEnabled,
+        getWarningShown: () => perProjectStorageWarningShown,
+        setWarningShown: (shown) => {
+            perProjectStorageWarningShown = shown;
+        },
+        logWarn,
+        pluginName: PLUGIN_NAME,
+        setStoragePath,
+        cwd: () => process.cwd(),
+        applyAccountStorageScopeFromConfig,
     });
-    const runOAuthFlow = async (forceNewLogin = false) => {
-        const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
-        logInfo(`OAuth URL: ${redactOAuthUrlForLog(url)}`);
-        let serverInfo = null;
-        try {
-            serverInfo = await startLocalOAuthServer({ state });
-        }
-        catch (err) {
-            logDebug(`[${PLUGIN_NAME}] Failed to start OAuth server: ${err?.message ?? String(err)}`);
-            serverInfo = null;
-        }
-        openBrowserUrl(url);
-        if (!serverInfo || !serverInfo.ready) {
-            serverInfo?.close();
-            const message = `\n[${PLUGIN_NAME}] OAuth callback server failed to start. ` +
-                `Please retry with "${AUTH_LABELS.OAUTH_MANUAL}".\n`;
-            logWarn(message);
-            return { type: "failed" };
-        }
-        const result = await serverInfo.waitForCode(state);
-        serverInfo.close();
-        if (!result) {
-            return { type: "failed", reason: "unknown", message: "OAuth callback timeout or cancelled" };
-        }
-        return await exchangeAuthorizationCode(result.code, pkce.verifier, REDIRECT_URI);
-    };
-    const persistAccountPool = async (results, replaceAll = false) => {
-        if (results.length === 0)
-            return;
-        await withAccountStorageTransaction(async (loadedStorage, persist) => {
-            const now = Date.now();
-            const stored = replaceAll ? null : loadedStorage;
-            const accounts = stored?.accounts ? [...stored.accounts] : [];
-            for (const result of results) {
-                const accountId = result.accountIdOverride ?? extractAccountId(result.access);
-                const accountIdSource = accountId
-                    ? result.accountIdSource ??
-                        (result.accountIdOverride ? "manual" : "token")
-                    : undefined;
-                const accountLabel = result.accountLabel;
-                const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
-                const existingIndex = findMatchingAccountIndex(accounts, {
-                    accountId,
-                    email: accountEmail,
-                    refreshToken: result.refresh,
-                }, {
-                    allowUniqueAccountIdFallbackWithoutEmail: true,
-                });
-                if (existingIndex === undefined) {
-                    accounts.push({
-                        accountId,
-                        accountIdSource,
-                        accountLabel,
-                        email: accountEmail,
-                        refreshToken: result.refresh,
-                        accessToken: result.access,
-                        expiresAt: result.expires,
-                        addedAt: now,
-                        lastUsed: now,
-                    });
-                    continue;
-                }
-                const existing = accounts[existingIndex];
-                if (!existing)
-                    continue;
-                const nextEmail = accountEmail ?? sanitizeEmail(existing.email);
-                const nextAccountId = accountId ?? existing.accountId;
-                const nextAccountIdSource = accountId ? accountIdSource ?? existing.accountIdSource : existing.accountIdSource;
-                const nextAccountLabel = accountLabel ?? existing.accountLabel;
-                accounts[existingIndex] = {
-                    ...existing,
-                    accountId: nextAccountId,
-                    accountIdSource: nextAccountIdSource,
-                    accountLabel: nextAccountLabel,
-                    email: nextEmail,
-                    refreshToken: result.refresh,
-                    accessToken: result.access,
-                    expiresAt: result.expires,
-                    lastUsed: now,
-                };
-            }
-            if (accounts.length === 0)
-                return;
-            const activeIndex = replaceAll
-                ? 0
-                : typeof stored?.activeIndex === "number" && Number.isFinite(stored.activeIndex)
-                    ? stored.activeIndex
-                    : 0;
-            const clampedActiveIndex = Math.max(0, Math.min(activeIndex, accounts.length - 1));
-            const activeIndexByFamily = {};
-            for (const family of MODEL_FAMILIES) {
-                const storedFamilyIndex = stored?.activeIndexByFamily?.[family];
-                const rawFamilyIndex = replaceAll
-                    ? 0
-                    : typeof storedFamilyIndex === "number" && Number.isFinite(storedFamilyIndex)
-                        ? storedFamilyIndex
-                        : clampedActiveIndex;
-                activeIndexByFamily[family] = Math.max(0, Math.min(Math.floor(rawFamilyIndex), accounts.length - 1));
-            }
-            await persist({
-                version: 3,
-                accounts,
-                activeIndex: clampedActiveIndex,
-                activeIndexByFamily,
-            });
-        });
-    };
-    const showToast = async (message, variant = "success", options) => {
-        try {
-            await client.tui.showToast({
-                body: {
-                    message,
-                    variant,
-                    ...(options?.title && { title: options.title }),
-                    ...(options?.duration && { duration: options.duration }),
-                },
-            });
-        }
-        catch {
-            // Ignore when TUI is not available.
-        }
-    };
-    const resolveActiveIndex = (storage, family = "codex") => {
-        const total = storage.accounts.length;
-        if (total === 0)
-            return 0;
-        const rawCandidate = storage.activeIndexByFamily?.[family] ?? storage.activeIndex;
-        const raw = Number.isFinite(rawCandidate) ? rawCandidate : 0;
-        return Math.max(0, Math.min(raw, total - 1));
-    };
-    const hydrateEmails = async (storage) => {
-        if (!storage)
-            return storage;
-        const skipHydrate = process.env.VITEST_WORKER_ID !== undefined ||
-            process.env.NODE_ENV === "test" ||
-            process.env.CODEX_SKIP_EMAIL_HYDRATE === "1";
-        if (skipHydrate)
-            return storage;
-        const accountsCopy = storage.accounts.map((account) => account ? { ...account } : account);
-        const accountsToHydrate = accountsCopy.filter((account) => account && !account.email);
-        if (accountsToHydrate.length === 0)
-            return storage;
-        let changed = false;
-        await Promise.all(accountsToHydrate.map(async (account) => {
-            try {
-                const refreshed = await queuedRefresh(account.refreshToken);
-                if (refreshed.type !== "success")
-                    return;
-                const id = extractAccountId(refreshed.access);
-                const email = sanitizeEmail(extractAccountEmail(refreshed.access, refreshed.idToken));
-                if (id &&
-                    id !== account.accountId &&
-                    shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
-                    account.accountId = id;
-                    account.accountIdSource = "token";
-                    changed = true;
-                }
-                if (email && email !== account.email) {
-                    account.email = email;
-                    changed = true;
-                }
-                if (refreshed.access && refreshed.access !== account.accessToken) {
-                    account.accessToken = refreshed.access;
-                    changed = true;
-                }
-                if (typeof refreshed.expires === "number" && refreshed.expires !== account.expiresAt) {
-                    account.expiresAt = refreshed.expires;
-                    changed = true;
-                }
-                if (refreshed.refresh && refreshed.refresh !== account.refreshToken) {
-                    account.refreshToken = refreshed.refresh;
-                    changed = true;
-                }
-            }
-            catch {
-                logWarn(`[${PLUGIN_NAME}] Failed to hydrate email for account`);
-            }
-        }));
-        if (changed) {
-            storage.accounts = accountsCopy;
-            await saveAccounts(storage);
-        }
-        return storage;
-    };
-    const getRateLimitResetTimeForFamily = (account, now, family) => {
-        const times = account.rateLimitResetTimes;
-        if (!times)
-            return null;
-        let minReset = null;
-        const prefix = `${family}:`;
-        for (const [key, value] of Object.entries(times)) {
-            if (typeof value !== "number")
-                continue;
-            if (value <= now)
-                continue;
-            if (key !== family && !key.startsWith(prefix))
-                continue;
-            if (minReset === null || value < minReset) {
-                minReset = value;
-            }
-        }
-        return minReset;
-    };
-    const formatRateLimitEntry = (account, now, family = "codex") => {
-        const resetAt = getRateLimitResetTimeForFamily(account, now, family);
-        if (typeof resetAt !== "number")
-            return null;
-        const remaining = resetAt - now;
-        if (remaining <= 0)
-            return null;
-        return `resets in ${formatWaitTime(remaining)}`;
-    };
-    const applyUiRuntimeFromConfig = (pluginConfig) => {
-        return setUiRuntimeOptions({
-            v2Enabled: getCodexTuiV2(pluginConfig),
-            colorProfile: getCodexTuiColorProfile(pluginConfig),
-            glyphMode: getCodexTuiGlyphMode(pluginConfig),
-        });
-    };
-    const resolveUiRuntime = () => {
-        return applyUiRuntimeFromConfig(loadPluginConfig());
-    };
-    const getStatusMarker = (ui, status) => {
-        if (!ui.v2Enabled) {
-            if (status === "ok")
-                return "✓";
-            if (status === "warning")
-                return "!";
-            return "✗";
-        }
-        if (status === "ok")
-            return ui.theme.glyphs.check;
-        if (status === "warning")
-            return "!";
-        return ui.theme.glyphs.cross;
-    };
-    const invalidateAccountManagerCache = () => {
-        cachedAccountManager = null;
-        accountManagerPromise = null;
-    };
-    const reloadAccountManagerFromDisk = async (authFallback) => {
-        if (accountReloadInFlight) {
-            return accountReloadInFlight;
-        }
-        accountReloadInFlight = (async () => {
-            const reloaded = await AccountManager.loadFromDisk(authFallback);
-            cachedAccountManager = reloaded;
-            accountManagerPromise = Promise.resolve(reloaded);
-            return reloaded;
-        })();
-        try {
-            return await accountReloadInFlight;
-        }
-        finally {
-            accountReloadInFlight = null;
-        }
-    };
-    const applyAccountStorageScope = (pluginConfig) => {
-        const perProjectAccounts = getPerProjectAccounts(pluginConfig);
-        setStorageBackupEnabled(getStorageBackupEnabled(pluginConfig));
-        if (isCodexCliSyncEnabled()) {
-            if (perProjectAccounts && !perProjectStorageWarningShown) {
-                perProjectStorageWarningShown = true;
-                logWarn(`[${PLUGIN_NAME}] CODEX_AUTH_PER_PROJECT_ACCOUNTS is ignored while Codex CLI sync is enabled. Using global account storage.`);
-            }
-            setStoragePath(null);
-            return;
-        }
-        setStoragePath(perProjectAccounts ? process.cwd() : null);
-    };
     const ensureLiveAccountSync = async (pluginConfig, authFallback) => {
-        if (!getLiveAccountSync(pluginConfig)) {
-            if (liveAccountSync) {
-                liveAccountSync.stop();
-                liveAccountSync = null;
-                liveAccountSyncPath = null;
-            }
-            return;
-        }
-        const targetPath = getStoragePath();
-        if (!liveAccountSync) {
-            liveAccountSync = new LiveAccountSync(async () => {
-                await reloadAccountManagerFromDisk(authFallback);
+        const next = await ensureLiveAccountSyncEntry({
+            pluginConfig,
+            authFallback,
+            currentSync: liveAccountSync,
+            currentPath: liveAccountSyncPath,
+            getLiveAccountSync,
+            getStoragePath,
+            createSync: (oauthFallback) => new LiveAccountSync(async () => {
+                await reloadRuntimeAccountManager(makeReloadAccountManagerDeps(oauthFallback));
             }, {
                 debounceMs: getLiveAccountSyncDebounceMs(pluginConfig),
                 pollIntervalMs: getLiveAccountSyncPollMs(pluginConfig),
-            });
-            registerCleanup(() => {
-                liveAccountSync?.stop();
-            });
-        }
-        if (liveAccountSyncPath !== targetPath) {
-            let switched = false;
-            for (let attempt = 0; attempt < 3; attempt += 1) {
-                try {
-                    await liveAccountSync.syncToPath(targetPath);
-                    liveAccountSyncPath = targetPath;
-                    switched = true;
-                    break;
-                }
-                catch (error) {
-                    const code = error?.code;
-                    if (code !== "EBUSY" && code !== "EPERM") {
-                        throw error;
-                    }
-                    await new Promise((resolve) => setTimeout(resolve, 25 * 2 ** attempt));
-                }
-            }
-            if (!switched) {
-                logWarn(`[${PLUGIN_NAME}] Live account sync path switch failed due to transient filesystem locks; keeping previous watcher.`);
-            }
-        }
+            }),
+            registerCleanup,
+            logWarn,
+            pluginName: PLUGIN_NAME,
+            ensureLiveAccountSyncState,
+        });
+        liveAccountSync = next.liveAccountSync;
+        liveAccountSyncPath = next.liveAccountSyncPath;
     };
     const ensureRefreshGuardian = (pluginConfig) => {
-        if (!getProactiveRefreshGuardian(pluginConfig)) {
-            if (refreshGuardian) {
-                refreshGuardian.stop();
-                refreshGuardian = null;
-                refreshGuardianConfigKey = null;
-            }
-            return;
-        }
-        const intervalMs = getProactiveRefreshIntervalMs(pluginConfig);
-        const bufferMs = getProactiveRefreshBufferMs(pluginConfig);
-        const configKey = `${intervalMs}:${bufferMs}`;
-        if (refreshGuardian && refreshGuardianConfigKey === configKey)
-            return;
-        if (refreshGuardian) {
-            refreshGuardian.stop();
-        }
-        refreshGuardian = new RefreshGuardian(() => cachedAccountManager, { intervalMs, bufferMs });
-        refreshGuardianConfigKey = configKey;
-        refreshGuardian.start();
-        registerCleanup(() => {
-            refreshGuardian?.stop();
+        const next = ensureRefreshGuardianState({
+            enabled: getProactiveRefreshGuardian(pluginConfig),
+            intervalMs: getProactiveRefreshIntervalMs(pluginConfig),
+            bufferMs: getProactiveRefreshBufferMs(pluginConfig),
+            currentGuardian: refreshGuardian,
+            currentConfigKey: refreshGuardianConfigKey,
+            currentCleanupRegistered: refreshGuardianCleanupRegistered,
+            getCurrentGuardian: () => refreshGuardian,
+            createGuardian: ({ intervalMs, bufferMs }) => new RefreshGuardian(() => cachedAccountManager, {
+                intervalMs,
+                bufferMs,
+            }),
+            registerCleanup,
         });
+        refreshGuardian = next.refreshGuardian;
+        refreshGuardianConfigKey = next.refreshGuardianConfigKey;
+        refreshGuardianCleanupRegistered =
+            next.refreshGuardianCleanupRegistered;
     };
     const ensureSessionAffinity = (pluginConfig) => {
-        if (!getSessionAffinity(pluginConfig)) {
-            sessionAffinityStore = null;
-            sessionAffinityConfigKey = null;
-            return;
-        }
-        const ttlMs = getSessionAffinityTtlMs(pluginConfig);
-        const maxEntries = getSessionAffinityMaxEntries(pluginConfig);
-        const configKey = `${ttlMs}:${maxEntries}`;
-        if (sessionAffinityStore && sessionAffinityConfigKey === configKey)
-            return;
-        sessionAffinityStore = new SessionAffinityStore({ ttlMs, maxEntries });
-        sessionAffinityConfigKey = configKey;
-    };
-    const applyPreemptiveQuotaSettings = (pluginConfig) => {
-        preemptiveQuotaScheduler.configure({
-            enabled: getPreemptiveQuotaEnabled(pluginConfig),
-            remainingPercentThresholdPrimary: getPreemptiveQuotaRemainingPercent5h(pluginConfig),
-            remainingPercentThresholdSecondary: getPreemptiveQuotaRemainingPercent7d(pluginConfig),
-            maxDeferralMs: getPreemptiveQuotaMaxDeferralMs(pluginConfig),
+        const next = ensureSessionAffinityState({
+            enabled: getSessionAffinity(pluginConfig) ||
+                getResponseContinuation(pluginConfig),
+            ttlMs: getSessionAffinityTtlMs(pluginConfig),
+            maxEntries: getSessionAffinityMaxEntries(pluginConfig),
+            currentStore: sessionAffinityStore,
+            currentConfigKey: sessionAffinityConfigKey,
+            createStore: ({ ttlMs, maxEntries }) => new SessionAffinityStore({ ttlMs, maxEntries }),
         });
+        sessionAffinityStore = next.sessionAffinityStore;
+        sessionAffinityConfigKey = next.sessionAffinityConfigKey;
     };
+    const applyPreemptiveQuotaSettings = (pluginConfig) => applyPreemptiveQuotaSettingsFromConfig(pluginConfig, {
+        configure: (options) => preemptiveQuotaScheduler.configure(options),
+        getPreemptiveQuotaEnabled,
+        getPreemptiveQuotaRemainingPercent5h,
+        getPreemptiveQuotaRemainingPercent7d,
+        getPreemptiveQuotaMaxDeferralMs,
+    });
     // Event handler for session recovery and account selection
-    const eventHandler = async (input) => {
-        try {
-            const { event } = input;
-            // Handle TUI account selection events
-            // Accepts generic selection events with an index property
-            if (event.type === "account.select" ||
-                event.type === "openai.account.select") {
-                const props = event.properties;
-                // Filter by provider if specified
-                if (props.provider && props.provider !== "openai" && props.provider !== PROVIDER_ID) {
-                    return;
-                }
-                const index = props.index ?? props.accountIndex;
-                if (typeof index === "number") {
-                    const storage = await loadAccounts();
-                    if (!storage || index < 0 || index >= storage.accounts.length) {
-                        return;
-                    }
-                    const now = Date.now();
-                    const account = storage.accounts[index];
-                    if (account) {
-                        account.lastUsed = now;
-                        account.lastSwitchReason = "rotation";
-                    }
-                    storage.activeIndex = index;
-                    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                    for (const family of MODEL_FAMILIES) {
-                        storage.activeIndexByFamily[family] = index;
-                    }
-                    await saveAccounts(storage);
-                    if (cachedAccountManager) {
-                        await cachedAccountManager.syncCodexCliActiveSelectionForIndex(index);
-                    }
-                    lastCodexCliActiveSyncIndex = index;
-                    // Reload manager from disk so we don't overwrite newer rotated
-                    // refresh tokens with stale in-memory state.
-                    if (cachedAccountManager) {
-                        await reloadAccountManagerFromDisk();
-                    }
-                    await showToast(`Switched to account ${index + 1}`, "info");
-                }
-            }
-        }
-        catch (error) {
-            logDebug(`[${PLUGIN_NAME}] Event handler error: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    };
+    const eventHandler = async (input) => handleRuntimeEvent({
+        input,
+        providerId: PROVIDER_ID,
+        modelFamilies: MODEL_FAMILIES,
+        loadAccounts,
+        saveAccounts,
+        hasCachedAccountManager: () => !!cachedAccountManager,
+        syncCodexCliActiveSelectionForIndex: async (index) => {
+            if (!cachedAccountManager)
+                return;
+            await cachedAccountManager.syncCodexCliActiveSelectionForIndex(index);
+        },
+        setLastCodexCliActiveSyncIndex: (index) => {
+            lastCodexCliActiveSyncIndex = index;
+        },
+        reloadAccountManagerFromDisk: () => reloadAccountManagerFromDisk(),
+        showToast: (message, variant) => showRuntimeToast(client, message, variant),
+        logDebug,
+        pluginName: PLUGIN_NAME,
+    });
     // Initialize runtime UI settings once on plugin load; auth/tools refresh this dynamically.
-    resolveUiRuntime();
+    applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
     return {
         event: eventHandler,
         auth: {
@@ -699,11 +300,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
              * Loader function that configures OAuth authentication and request handling
              *
              * This function:
-                         * 1. Validates OAuth authentication
-                         * 2. Loads multi-account pool from disk (fallback to current auth)
-                         * 3. Loads user configuration from runtime model config
-                         * 4. Fetches Codex system instructions from GitHub (cached)
-                         * 5. Returns SDK configuration with custom fetch implementation
+             * 1. Validates OAuth authentication
+             * 2. Loads multi-account pool from disk (fallback to current auth)
+             * 3. Loads user configuration from runtime model config
+             * 4. Fetches Codex system instructions from GitHub (cached)
+             * 5. Returns SDK configuration with custom fetch implementation
              *
              * @param getAuth - Function to retrieve current auth state
              * @param provider - Provider configuration from runtime model config
@@ -712,11 +313,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             async loader(getAuth, provider) {
                 const auth = await getAuth();
                 const pluginConfig = loadPluginConfig();
-                applyUiRuntimeFromConfig(pluginConfig);
-                applyAccountStorageScope(pluginConfig);
-                ensureSessionAffinity(pluginConfig);
-                ensureRefreshGuardian(pluginConfig);
-                applyPreemptiveQuotaSettings(pluginConfig);
+                applyLoaderRuntimeSetup({
+                    pluginConfig,
+                    applyUiRuntimeFromConfig: (config) => applyUiRuntimeFromConfig(config, setUiRuntimeOptions),
+                    applyAccountStorageScope,
+                    ensureSessionAffinity,
+                    ensureRefreshGuardian,
+                    applyPreemptiveQuotaSettings,
+                });
                 // Only handle OAuth auth type, skip API key auth
                 if (auth.type !== "oauth") {
                     return {};
@@ -740,15 +344,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 try {
                     await ensureLiveAccountSync(pluginConfig, auth);
                     if (!accountManagerPromise) {
-                        await reloadAccountManagerFromDisk(auth);
+                        await reloadRuntimeAccountManager(makeReloadAccountManagerDeps(auth));
                     }
                     const managerPromise = accountManagerPromise ??
-                        reloadAccountManagerFromDisk(auth);
+                        reloadRuntimeAccountManager(makeReloadAccountManagerDeps(auth));
                     let accountManager = await managerPromise;
                     cachedAccountManager = accountManager;
                     const refreshToken = auth.type === "oauth" ? auth.refresh : "";
-                    const needsPersist = refreshToken &&
-                        !accountManager.hasRefreshToken(refreshToken);
+                    const needsPersist = refreshToken && !accountManager.hasRefreshToken(refreshToken);
                     if (needsPersist) {
                         await accountManager.saveToDisk();
                     }
@@ -789,7 +392,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         STREAM_FAILOVER_SOFT_TIMEOUT_BY_MODE[failoverMode]);
                     const streamFailoverHardTimeoutMs = Math.max(streamFailoverSoftTimeoutMs, parseEnvInt(process.env.CODEX_AUTH_STREAM_STALL_HARD_TIMEOUT_MS) ??
                         streamStallTimeoutMs);
-                    const maxSameAccountRetries = failoverMode === "conservative" ? 2 : failoverMode === "balanced" ? 1 : 0;
+                    const maxSameAccountRetries = failoverMode === "conservative"
+                        ? 2
+                        : failoverMode === "balanced"
+                            ? 1
+                            : 0;
                     const sessionRecoveryEnabled = getSessionRecovery(pluginConfig);
                     const autoResumeEnabled = getAutoResume(pluginConfig);
                     const emptyResponseMaxRetries = getEmptyResponseMaxRetries(pluginConfig);
@@ -818,11 +425,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                             prewarmHostCodexPrompt();
                         }
                     }
-                    const recoveryHook = sessionRecoveryEnabled
-                        ? createSessionRecoveryHook({ client, directory: process.cwd() }, { sessionRecovery: true, autoResume: autoResumeEnabled })
-                        : null;
+                    const recoveryHook = createRuntimeSessionRecoveryHook({
+                        enabled: sessionRecoveryEnabled,
+                        client,
+                        directory: process.cwd(),
+                        autoResume: autoResumeEnabled,
+                    });
                     checkAndNotify(async (message, variant) => {
-                        await showToast(message, variant);
+                        await showRuntimeToast(client, message, variant);
                     }).catch((err) => {
                         logDebug(`Update check failed: ${err instanceof Error ? err.message : String(err)}`);
                     });
@@ -847,7 +457,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                          */
                         async fetch(input, init) {
                             try {
-                                if (cachedAccountManager && cachedAccountManager !== accountManager) {
+                                if (cachedAccountManager &&
+                                    cachedAccountManager !== accountManager) {
                                     accountManager = cachedAccountManager;
                                 }
                                 // Step 1: Extract and rewrite URL for Codex backend
@@ -857,118 +468,58 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 // Instructions are fetched per model family (codex-max, codex, gpt-5.1)
                                 // Capture original stream value before transformation
                                 // generateText() sends no stream field, streamText() sends stream=true
-                                const normalizeRequestInit = async (requestInput, requestInit) => {
-                                    if (requestInit)
-                                        return requestInit;
-                                    if (!(requestInput instanceof Request))
-                                        return requestInit;
-                                    const method = requestInput.method || "GET";
-                                    const normalized = {
-                                        method,
-                                        headers: new Headers(requestInput.headers),
-                                    };
-                                    if (method !== "GET" && method !== "HEAD") {
-                                        try {
-                                            const bodyText = await requestInput.clone().text();
-                                            if (bodyText) {
-                                                normalized.body = bodyText;
-                                            }
-                                        }
-                                        catch {
-                                            // Body may be unreadable; proceed without it.
-                                        }
-                                    }
-                                    return normalized;
-                                };
-                                const parseRequestBodyFromInit = async (body) => {
-                                    if (!body)
-                                        return {};
-                                    try {
-                                        if (typeof body === "string") {
-                                            return JSON.parse(body);
-                                        }
-                                        if (body instanceof Uint8Array) {
-                                            return JSON.parse(new TextDecoder().decode(body));
-                                        }
-                                        if (body instanceof ArrayBuffer) {
-                                            return JSON.parse(new TextDecoder().decode(new Uint8Array(body)));
-                                        }
-                                        if (ArrayBuffer.isView(body)) {
-                                            const view = new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
-                                            return JSON.parse(new TextDecoder().decode(view));
-                                        }
-                                        if (typeof Blob !== "undefined" && body instanceof Blob) {
-                                            return JSON.parse(await body.text());
-                                        }
-                                    }
-                                    catch {
-                                        logWarn("Failed to parse request body, using empty object");
-                                    }
-                                    return {};
-                                };
                                 const baseInit = await normalizeRequestInit(input, init);
-                                const originalBody = await parseRequestBodyFromInit(baseInit?.body);
+                                const originalBody = await parseRequestBodyFromInit(baseInit?.body, logWarn);
                                 const isStreaming = originalBody.stream === true;
-                                const parsedBody = Object.keys(originalBody).length > 0 ? originalBody : undefined;
+                                const parsedBody = Object.keys(originalBody).length > 0
+                                    ? { ...originalBody }
+                                    : undefined;
                                 const transformation = await transformRequestForCodex(baseInit, url, effectiveUserConfig, codexMode, parsedBody, {
                                     fastSession: fastSessionEnabled,
                                     fastSessionStrategy,
                                     fastSessionMaxInputItems,
+                                    deferFastSessionInputTrimming: fastSessionEnabled,
+                                    allowBackgroundResponses: getBackgroundResponses(pluginConfig),
                                 });
                                 let requestInit = transformation?.updatedInit ?? baseInit;
                                 let transformedBody = transformation?.body;
+                                let pendingFastSessionInputTrim = transformation?.deferredFastSessionInputTrim;
                                 const promptCacheKey = transformedBody?.prompt_cache_key;
                                 let model = transformedBody?.model;
                                 let modelFamily = model ? getModelFamily(model) : "gpt-5.1";
                                 let quotaKey = model ? `${modelFamily}:${model}` : modelFamily;
+                                const responseContinuationEnabled = getResponseContinuation(pluginConfig);
                                 const threadIdCandidate = (process.env.CODEX_THREAD_ID ?? promptCacheKey ?? "")
                                     .toString()
                                     .trim() || undefined;
                                 const sessionAffinityKey = threadIdCandidate ?? promptCacheKey ?? null;
-                                const effectivePromptCacheKey = (sessionAffinityKey ?? promptCacheKey ?? "").toString().trim() || undefined;
+                                const effectivePromptCacheKey = (sessionAffinityKey ?? promptCacheKey ?? "")
+                                    .toString()
+                                    .trim() || undefined;
+                                const shouldUseResponseContinuation = Boolean(transformedBody) &&
+                                    responseContinuationEnabled &&
+                                    !transformedBody?.previous_response_id;
+                                if (shouldUseResponseContinuation && transformedBody) {
+                                    const lastResponseId = sessionAffinityStore?.getLastResponseId(sessionAffinityKey);
+                                    if (lastResponseId) {
+                                        transformedBody = {
+                                            ...transformedBody,
+                                            previous_response_id: lastResponseId,
+                                        };
+                                        requestInit = {
+                                            ...requestInit,
+                                            body: JSON.stringify(transformedBody),
+                                        };
+                                    }
+                                }
                                 const preferredSessionAccountIndex = sessionAffinityStore?.getPreferredAccountIndex(sessionAffinityKey);
                                 sessionAffinityStore?.prune();
-                                const requestCorrelationId = setCorrelationId(threadIdCandidate ? `${threadIdCandidate}:${Date.now()}` : undefined);
+                                const requestCorrelationId = setCorrelationId(threadIdCandidate
+                                    ? `${threadIdCandidate}:${Date.now()}`
+                                    : undefined);
                                 runtimeMetrics.lastRequestAt = Date.now();
                                 const abortSignal = requestInit?.signal ?? init?.signal ?? null;
-                                const sleep = (ms) => new Promise((resolve, reject) => {
-                                    if (abortSignal?.aborted) {
-                                        reject(new Error("Aborted"));
-                                        return;
-                                    }
-                                    const timeout = setTimeout(() => {
-                                        cleanup();
-                                        resolve();
-                                    }, ms);
-                                    const onAbort = () => {
-                                        cleanup();
-                                        reject(new Error("Aborted"));
-                                    };
-                                    const cleanup = () => {
-                                        clearTimeout(timeout);
-                                        abortSignal?.removeEventListener("abort", onAbort);
-                                    };
-                                    abortSignal?.addEventListener("abort", onAbort, { once: true });
-                                });
-                                const sleepWithCountdown = async (totalMs, message, intervalMs = 5000) => {
-                                    const startTime = Date.now();
-                                    const endTime = startTime + totalMs;
-                                    while (Date.now() < endTime) {
-                                        if (abortSignal?.aborted) {
-                                            throw new Error("Aborted");
-                                        }
-                                        const remaining = Math.max(0, endTime - Date.now());
-                                        const waitLabel = formatWaitTime(remaining);
-                                        await showToast(`${message} (${waitLabel} remaining)`, "warning", { duration: Math.min(intervalMs + 1000, toastDurationMs) });
-                                        const sleepTime = Math.min(intervalMs, remaining);
-                                        if (sleepTime > 0) {
-                                            await sleep(sleepTime);
-                                        }
-                                        else {
-                                            break;
-                                        }
-                                    }
-                                };
+                                const sleep = createAbortableSleep(abortSignal);
                                 let allRateLimitedRetries = 0;
                                 let emptyResponseRetries = 0;
                                 const attemptedUnsupportedFallbackModels = new Set();
@@ -983,11 +534,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     let usedPreferredSessionAccount = false;
                                     const capabilityBoostByAccount = {};
                                     const accountSnapshotSource = accountManager;
-                                    const accountSnapshotList = typeof accountSnapshotSource.getAccountsSnapshot === "function"
-                                        ? accountSnapshotSource.getAccountsSnapshot() ?? []
+                                    const accountSnapshotList = typeof accountSnapshotSource.getAccountsSnapshot ===
+                                        "function"
+                                        ? (accountSnapshotSource.getAccountsSnapshot() ?? [])
                                         : [];
                                     if (accountSnapshotList.length === 0 &&
-                                        typeof accountSnapshotSource.getAccountByIndex === "function") {
+                                        typeof accountSnapshotSource.getAccountByIndex ===
+                                            "function") {
                                         for (let accountSnapshotIndex = 0; accountSnapshotIndex < accountCount; accountSnapshotIndex += 1) {
                                             const candidate = accountSnapshotSource.getAccountByIndex(accountSnapshotIndex);
                                             if (candidate) {
@@ -997,9 +550,10 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     }
                                     for (const candidate of accountSnapshotList) {
                                         const accountKey = resolveEntitlementAccountKey(candidate);
-                                        capabilityBoostByAccount[candidate.index] = capabilityPolicyStore.getBoost(accountKey, model ?? modelFamily);
+                                        capabilityBoostByAccount[candidate.index] =
+                                            capabilityPolicyStore.getBoost(accountKey, model ?? modelFamily);
                                     }
-                                    while (attempted.size < Math.max(1, accountCount)) {
+                                    accountAttemptLoop: while (attempted.size < Math.max(1, accountCount)) {
                                         let account = null;
                                         if (!usedPreferredSessionAccount &&
                                             typeof preferredSessionAccountIndex === "number") {
@@ -1041,7 +595,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             runtimeMetrics.authRefreshFailures++;
                                             runtimeMetrics.failedRequests++;
                                             runtimeMetrics.accountRotations++;
-                                            runtimeMetrics.lastError = err?.message ?? String(err);
+                                            runtimeMetrics.lastError =
+                                                err?.message ?? String(err);
                                             const failures = accountManager.incrementAuthFailures(account);
                                             const accountLabel = formatAccountLabel(account, account.index);
                                             const authFailurePolicy = evaluateFailurePolicy({
@@ -1055,7 +610,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 accountManager.removeAccount(account);
                                                 sessionAffinityStore?.reindexAfterRemoval(removedIndex);
                                                 accountManager.saveToDiskDebounced();
-                                                await showToast(`Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'codex login' to re-add.`, "error", { duration: toastDurationMs * 2 });
+                                                await showRuntimeToast(client, `Removed ${accountLabel} after ${failures} consecutive auth failures. Run 'codex login' to re-add.`, "error", { duration: toastDurationMs * 2 });
                                                 continue;
                                             }
                                             if (typeof authFailurePolicy.cooldownMs === "number" &&
@@ -1065,26 +620,34 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             accountManager.saveToDiskDebounced();
                                             continue;
                                         }
-                                        const hadAccountId = !!account.accountId;
-                                        const tokenAccountId = extractAccountId(accountAuth.access);
-                                        const accountId = resolveRequestAccountId(account.accountId, account.accountIdSource, tokenAccountId);
+                                        const currentWorkspace = accountManager.getCurrentWorkspace(account);
+                                        const storedAccountId = currentWorkspace?.id ?? account.accountId;
+                                        const storedAccountIdSource = currentWorkspace
+                                            ? "manual"
+                                            : account.accountIdSource;
+                                        const storedEmail = account.email;
+                                        const hadAccountId = !!storedAccountId;
+                                        const runtimeIdentity = resolveRuntimeRequestIdentity({
+                                            storedAccountId,
+                                            source: storedAccountIdSource,
+                                            storedEmail,
+                                            accessToken: accountAuth.access,
+                                            idToken: accountAuth.idToken,
+                                        });
+                                        const tokenAccountId = runtimeIdentity.tokenAccountId;
+                                        const accountId = runtimeIdentity.accountId;
                                         if (!accountId) {
                                             accountManager.markAccountCoolingDown(account, ACCOUNT_LIMITS.AUTH_FAILURE_COOLDOWN_MS, "auth-failure");
                                             accountManager.saveToDiskDebounced();
                                             continue;
                                         }
-                                        const resolvedEmail = extractAccountEmail(accountAuth.access) ?? account.email;
+                                        const resolvedEmail = runtimeIdentity.email;
                                         const entitlementAccountKey = resolveEntitlementAccountKey({
-                                            accountId: account.accountId ?? accountId,
+                                            accountId: storedAccountId ?? accountId,
                                             email: resolvedEmail,
                                             refreshToken: account.refreshToken,
                                             index: account.index,
                                         });
-                                        account.accountId = accountId;
-                                        if (!hadAccountId && tokenAccountId && accountId === tokenAccountId) {
-                                            account.accountIdSource = account.accountIdSource ?? "token";
-                                        }
-                                        account.email = resolvedEmail;
                                         const entitlementBlock = entitlementCache.isBlocked(entitlementAccountKey, model ?? modelFamily);
                                         if (entitlementBlock.blocked) {
                                             runtimeMetrics.accountRotations++;
@@ -1092,16 +655,51 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             logWarn(`Skipping account ${account.index + 1} due to cached entitlement block (${formatWaitTime(entitlementBlock.waitMs)} remaining).`);
                                             continue;
                                         }
+                                        account.accountId = accountId;
+                                        if (!hadAccountId &&
+                                            tokenAccountId &&
+                                            accountId === tokenAccountId) {
+                                            account.accountIdSource =
+                                                storedAccountIdSource ?? "token";
+                                        }
+                                        if (resolvedEmail) {
+                                            account.email = resolvedEmail;
+                                        }
                                         if (accountCount > 1 &&
                                             accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
                                             const accountLabel = formatAccountLabel(account, account.index);
-                                            await showToast(`Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
+                                            await showRuntimeToast(client, `Using ${accountLabel} (${account.index + 1}/${accountCount})`, "info");
                                             accountManager.markToastShown(account.index);
                                         }
                                         const headers = createCodexHeaders(requestInit, accountId, accountAuth.access, {
                                             model,
                                             promptCacheKey: effectivePromptCacheKey,
                                         });
+                                        if (transformedBody && pendingFastSessionInputTrim) {
+                                            const activeFastSessionInputTrim = pendingFastSessionInputTrim;
+                                            pendingFastSessionInputTrim = undefined;
+                                            const compactionResult = await applyResponseCompaction({
+                                                body: transformedBody,
+                                                requestUrl: url,
+                                                headers,
+                                                trim: activeFastSessionInputTrim,
+                                                fetchImpl: async (requestUrl, requestInit) => {
+                                                    const normalizedCompactionUrl = typeof requestUrl === "string"
+                                                        ? requestUrl
+                                                        : String(requestUrl);
+                                                    return fetch(normalizedCompactionUrl, applyProxyCompatibleInit(normalizedCompactionUrl, requestInit));
+                                                },
+                                                signal: abortSignal,
+                                                timeoutMs: Math.min(fetchTimeoutMs, 4_000),
+                                            });
+                                            if (compactionResult.mode !== "unchanged") {
+                                                transformedBody = compactionResult.body;
+                                                requestInit = {
+                                                    ...(requestInit ?? {}),
+                                                    body: JSON.stringify(transformedBody),
+                                                };
+                                            }
+                                        }
                                         const quotaScheduleKey = `${entitlementAccountKey}:${model ?? modelFamily}`;
                                         const capabilityModelKey = model ?? modelFamily;
                                         const quotaDeferral = preemptiveQuotaScheduler.getDeferral(quotaScheduleKey);
@@ -1118,13 +716,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         if (!tokenConsumed) {
                                             accountManager.recordRateLimit(account, modelFamily, model);
                                             runtimeMetrics.accountRotations++;
-                                            runtimeMetrics.lastError =
-                                                `Local token bucket depleted for account ${account.index + 1} (${modelFamily}${model ? `:${model}` : ""})`;
+                                            runtimeMetrics.lastError = `Local token bucket depleted for account ${account.index + 1} (${modelFamily}${model ? `:${model}` : ""})`;
                                             logWarn(`Skipping account ${account.index + 1}: local token bucket depleted for ${modelFamily}${model ? `:${model}` : ""}`);
                                             continue;
                                         }
                                         let sameAccountRetryCount = 0;
                                         let successAccountForResponse = account;
+                                        let successEntitlementAccountKey = entitlementAccountKey;
                                         while (true) {
                                             let response;
                                             const fetchStart = performance.now();
@@ -1138,22 +736,25 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 fetchController.abort(timeoutReason);
                                             }, requestTimeoutMs);
                                             const onUserAbort = abortSignal
-                                                ? () => fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"))
+                                                ? () => fetchController.abort(abortSignal.reason ??
+                                                    new Error("Aborted by user"))
                                                 : null;
                                             if (abortSignal?.aborted) {
                                                 clearTimeout(fetchTimeoutId);
                                                 fetchController.abort(abortSignal.reason ?? new Error("Aborted by user"));
                                             }
                                             else if (abortSignal && onUserAbort) {
-                                                abortSignal.addEventListener("abort", onUserAbort, { once: true });
+                                                abortSignal.addEventListener("abort", onUserAbort, {
+                                                    once: true,
+                                                });
                                             }
                                             try {
                                                 runtimeMetrics.totalRequests++;
-                                                response = await fetch(url, {
+                                                response = await fetch(url, applyProxyCompatibleInit(url, {
                                                     ...requestInit,
                                                     headers,
                                                     signal: fetchController.signal,
-                                                });
+                                                }));
                                             }
                                             catch (networkError) {
                                                 const fetchAbortReason = fetchController.signal.reason;
@@ -1166,11 +767,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     runtimeMetrics.userAborts++;
                                                     runtimeMetrics.lastError = "request aborted by user";
                                                     sessionAffinityStore?.forgetSession(sessionAffinityKey);
-                                                    throw (fetchAbortReason instanceof Error
+                                                    throw fetchAbortReason instanceof Error
                                                         ? fetchAbortReason
-                                                        : new Error("Aborted by user"));
+                                                        : new Error("Aborted by user");
                                                 }
-                                                const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
+                                                const errorMsg = networkError instanceof Error
+                                                    ? networkError.message
+                                                    : String(networkError);
                                                 logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
                                                 runtimeMetrics.failedRequests++;
                                                 runtimeMetrics.networkErrors++;
@@ -1223,18 +826,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                 if (contextOverflowResult.handled) {
                                                     return contextOverflowResult.response;
                                                 }
-                                                const { response: errorResponse, rateLimit, errorBody } = await handleErrorResponse(response, {
+                                                const { response: errorResponse, rateLimit, errorBody, } = await handleErrorResponse(response, {
                                                     requestCorrelationId,
                                                     threadId: threadIdCandidate,
                                                 });
                                                 const unsupportedModelInfo = getUnsupportedCodexModelInfo(errorBody);
                                                 const hasRemainingAccounts = attempted.size < Math.max(1, accountCount);
-                                                const blockedModel = unsupportedModelInfo.unsupportedModel ?? model ?? "requested model";
+                                                const blockedModel = unsupportedModelInfo.unsupportedModel ??
+                                                    model ??
+                                                    "requested model";
                                                 const blockedModelNormalized = blockedModel.toLowerCase();
                                                 const shouldForceSparkFallback = unsupportedModelInfo.isUnsupported &&
                                                     (blockedModelNormalized === "gpt-5.3-codex-spark" ||
                                                         blockedModelNormalized.includes("gpt-5.3-codex-spark"));
-                                                const allowUnsupportedFallback = fallbackOnUnsupportedCodexModel || shouldForceSparkFallback;
+                                                const allowUnsupportedFallback = fallbackOnUnsupportedCodexModel ||
+                                                    shouldForceSparkFallback;
                                                 // Entitlements can differ by account/workspace, so try remaining
                                                 // accounts before degrading the model via fallback.
                                                 // Spark entitlement is commonly unavailable on non-Pro/Business workspaces;
@@ -1279,12 +885,16 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     model = fallbackModel;
                                                     modelFamily = getModelFamily(model);
                                                     quotaKey = `${modelFamily}:${model}`;
-                                                    if (transformedBody && typeof transformedBody === "object") {
+                                                    if (transformedBody &&
+                                                        typeof transformedBody === "object") {
                                                         transformedBody = { ...transformedBody, model };
                                                     }
                                                     else {
-                                                        let fallbackBody = { model };
-                                                        if (requestInit?.body && typeof requestInit.body === "string") {
+                                                        let fallbackBody = {
+                                                            model,
+                                                        };
+                                                        if (requestInit?.body &&
+                                                            typeof requestInit.body === "string") {
                                                             try {
                                                                 const parsed = JSON.parse(requestInit.body);
                                                                 fallbackBody = { ...parsed, model };
@@ -1307,11 +917,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         fallbackApplied: true,
                                                         fallbackReason: "unsupported-model-entitlement",
                                                     });
-                                                    await showToast(`Model ${previousModel} is not available for this account. Retrying with ${model}.`, "warning", { duration: toastDurationMs });
+                                                    await showRuntimeToast(client, `Model ${previousModel} is not available for this account. Retrying with ${model}.`, "warning", { duration: toastDurationMs });
                                                     restartAccountTraversalWithFallback = true;
                                                     break;
                                                 }
-                                                if (unsupportedModelInfo.isUnsupported && !allowUnsupportedFallback) {
+                                                if (unsupportedModelInfo.isUnsupported &&
+                                                    !allowUnsupportedFallback) {
                                                     entitlementCache.markBlocked(entitlementAccountKey, blockedModel, "unsupported-model");
                                                     capabilityPolicyStore.recordUnsupported(entitlementAccountKey, blockedModel);
                                                     runtimeMetrics.lastError = `Unsupported model (strict): ${blockedModel}`;
@@ -1322,7 +933,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         fallbackApplied: false,
                                                         fallbackReason: "unsupported-model-entitlement",
                                                     });
-                                                    await showToast(`Model ${blockedModel} is not available for this account. Strict policy blocked automatic fallback.`, "warning", { duration: toastDurationMs });
+                                                    await showRuntimeToast(client, `Model ${blockedModel} is not available for this account. Strict policy blocked automatic fallback.`, "warning", { duration: toastDurationMs });
                                                 }
                                                 if (unsupportedModelInfo.isUnsupported &&
                                                     allowUnsupportedFallback &&
@@ -1331,14 +942,71 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     entitlementCache.markBlocked(entitlementAccountKey, blockedModel, "unsupported-model");
                                                     capabilityPolicyStore.recordUnsupported(entitlementAccountKey, blockedModel);
                                                 }
-                                                if (errorResponse.status === 403 && !unsupportedModelInfo.isUnsupported) {
+                                                const workspaceErrorCode = errorBody?.error?.code ?? "";
+                                                const workspaceErrorMessage = errorBody?.error?.message ?? "";
+                                                const isDisabledWorkspaceError = isWorkspaceDisabledError(errorResponse.status, workspaceErrorCode, workspaceErrorMessage);
+                                                // Handle workspace disabled/expired errors by rotating to the next workspace
+                                                // within the same account before falling back to another account.
+                                                if (isDisabledWorkspaceError) {
+                                                    runtimeMetrics.failedRequests++;
+                                                    runtimeMetrics.lastError = `Workspace disabled for account ${account.index + 1}`;
+                                                    if (!account.workspaces ||
+                                                        account.workspaces.length === 0) {
+                                                        logWarn(`Workspace disabled/expired for account ${account.index + 1} without tracked workspaces. Leaving account enabled.`, { errorCode: workspaceErrorCode });
+                                                        if (hasRemainingAccounts) {
+                                                            continue accountAttemptLoop;
+                                                        }
+                                                        return errorResponse;
+                                                    }
+                                                    else {
+                                                        const currentWorkspace = accountManager.getCurrentWorkspace(account);
+                                                        const workspaceName = currentWorkspace?.name ??
+                                                            currentWorkspace?.id ??
+                                                            "unknown";
+                                                        logWarn(`Workspace disabled/expired for account ${account.index + 1} - workspace: ${workspaceName}. Rotating to next workspace.`, { errorCode: workspaceErrorCode });
+                                                        const disabledWorkspace = currentWorkspace
+                                                            ? accountManager.disableCurrentWorkspace(account, currentWorkspace.id)
+                                                            : false;
+                                                        let nextWorkspace = disabledWorkspace
+                                                            ? accountManager.rotateToNextWorkspace(account)
+                                                            : accountManager.getCurrentWorkspace(account);
+                                                        if (!disabledWorkspace &&
+                                                            (!nextWorkspace ||
+                                                                nextWorkspace.enabled === false)) {
+                                                            nextWorkspace =
+                                                                accountManager.rotateToNextWorkspace(account);
+                                                        }
+                                                        if (nextWorkspace) {
+                                                            accountManager.saveToDiskDebounced();
+                                                            const newWorkspaceName = nextWorkspace.name ?? nextWorkspace.id;
+                                                            await showRuntimeToast(client, `Workspace ${workspaceName} disabled. Switched to ${newWorkspaceName}.`, "warning", { duration: toastDurationMs });
+                                                            logInfo(`Rotated to workspace ${newWorkspaceName} for account ${account.index + 1}`);
+                                                            // Allow the same account to be selected again with fresh request state.
+                                                            attempted.delete(account.index);
+                                                            continue accountAttemptLoop;
+                                                        }
+                                                        logWarn(`All workspaces disabled for account ${account.index + 1}. Disabling account.`);
+                                                        accountManager.setAccountEnabled(account.index, false);
+                                                        accountManager.saveToDiskDebounced();
+                                                        await showRuntimeToast(client, `All workspaces disabled for account ${account.index + 1}. Switching to another account.`, "warning", { duration: toastDurationMs });
+                                                        // Forget session affinity and continue the outer loop so another
+                                                        // enabled account can service the request.
+                                                        sessionAffinityStore?.forgetSession(sessionAffinityKey);
+                                                        continue accountAttemptLoop;
+                                                    }
+                                                }
+                                                if (errorResponse.status === 403 &&
+                                                    !unsupportedModelInfo.isUnsupported &&
+                                                    !isDisabledWorkspaceError) {
                                                     entitlementCache.markBlocked(entitlementAccountKey, model ?? modelFamily, "plan-entitlement");
                                                     capabilityPolicyStore.recordFailure(entitlementAccountKey, capabilityModelKey);
                                                 }
-                                                if (recoveryHook && errorBody && isRecoverableError(errorBody)) {
+                                                if (recoveryHook &&
+                                                    errorBody &&
+                                                    isRecoverableError(errorBody)) {
                                                     const errorType = detectErrorType(errorBody);
                                                     const toastContent = getRecoveryToastContent(errorType);
-                                                    await showToast(`${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
+                                                    await showRuntimeToast(client, `${toastContent.title}: ${toastContent.message}`, "warning", { duration: toastDurationMs });
                                                     logDebug(`[${PLUGIN_NAME}] Recoverable error detected: ${errorType}`);
                                                 }
                                                 // Handle 5xx server errors by rotating to another account
@@ -1349,7 +1017,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     runtimeMetrics.accountRotations++;
                                                     runtimeMetrics.lastError = `HTTP ${response.status}`;
                                                     const serverRetryAfterMs = parseRetryAfterHintMs(response.headers);
-                                                    const policy = evaluateFailurePolicy({ kind: "server", failoverMode, serverRetryAfterMs: serverRetryAfterMs ?? undefined }, { serverCooldownMs: serverErrorCooldownMs });
+                                                    const policy = evaluateFailurePolicy({
+                                                        kind: "server",
+                                                        failoverMode,
+                                                        serverRetryAfterMs: serverRetryAfterMs ?? undefined,
+                                                    }, { serverCooldownMs: serverErrorCooldownMs });
                                                     if (policy.refundToken) {
                                                         accountManager.refundToken(account, modelFamily, model);
                                                     }
@@ -1380,7 +1052,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     const waitLabel = formatWaitTime(delayMs);
                                                     if (delayMs <= RATE_LIMIT_SHORT_RETRY_THRESHOLD_MS) {
                                                         if (accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                            await showToast(`Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
+                                                            await showRuntimeToast(client, `Rate limited. Retrying in ${waitLabel} (attempt ${attempt})...`, "warning", { duration: toastDurationMs });
                                                             accountManager.markToastShown(account.index);
                                                         }
                                                         await sleep(addJitter(Math.max(MIN_BACKOFF_MS, delayMs), 0.2));
@@ -1395,7 +1067,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     logWarn(`Rate limited. Rotating account ${account.index + 1} (${account.email ?? "unknown"}).`);
                                                     if (accountManager.getAccountCount() > 1 &&
                                                         accountManager.shouldShowAccountToast(account.index, rateLimitToastDebounceMs)) {
-                                                        await showToast(`Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
+                                                        await showRuntimeToast(client, `Rate limited. Switching accounts (retry in ${waitLabel}).`, "warning", { duration: toastDurationMs });
                                                         accountManager.markToastShown(account.index);
                                                     }
                                                     break;
@@ -1452,14 +1124,50 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                             });
                                                             continue;
                                                         }
-                                                        const fallbackTokenAccountId = extractAccountId(fallbackAuth.access);
-                                                        const fallbackAccountId = resolveRequestAccountId(fallbackAccount.accountId, fallbackAccount.accountIdSource, fallbackTokenAccountId);
+                                                        const fallbackStoredAccountId = fallbackAccount.accountId;
+                                                        const fallbackStoredAccountIdSource = fallbackAccount.accountIdSource;
+                                                        const fallbackStoredEmail = fallbackAccount.email;
+                                                        const hadFallbackAccountId = !!fallbackStoredAccountId;
+                                                        const fallbackRuntimeIdentity = resolveRuntimeRequestIdentity({
+                                                            storedAccountId: fallbackStoredAccountId,
+                                                            source: fallbackStoredAccountIdSource,
+                                                            storedEmail: fallbackStoredEmail,
+                                                            accessToken: fallbackAuth.access,
+                                                            idToken: fallbackAuth.idToken,
+                                                        });
+                                                        const fallbackTokenAccountId = fallbackRuntimeIdentity.tokenAccountId;
+                                                        const fallbackAccountId = fallbackRuntimeIdentity.accountId;
                                                         if (!fallbackAccountId) {
                                                             continue;
                                                         }
+                                                        const fallbackResolvedEmail = fallbackRuntimeIdentity.email;
+                                                        const fallbackEntitlementAccountKey = resolveEntitlementAccountKey({
+                                                            accountId: fallbackStoredAccountId ??
+                                                                fallbackAccountId,
+                                                            email: fallbackResolvedEmail,
+                                                            refreshToken: fallbackAccount.refreshToken,
+                                                            index: fallbackAccount.index,
+                                                        });
+                                                        const fallbackEntitlementBlock = entitlementCache.isBlocked(fallbackEntitlementAccountKey, model ?? modelFamily);
+                                                        if (fallbackEntitlementBlock.blocked) {
+                                                            runtimeMetrics.accountRotations++;
+                                                            runtimeMetrics.lastError = `Entitlement cached block for account ${fallbackAccount.index + 1}`;
+                                                            logWarn(`Skipping account ${fallbackAccount.index + 1} due to cached entitlement block (${formatWaitTime(fallbackEntitlementBlock.waitMs)} remaining).`);
+                                                            continue;
+                                                        }
                                                         if (!accountManager.consumeToken(fallbackAccount, modelFamily, model)) {
                                                             continue;
                                                         }
+                                                        fallbackAccount.accountId = fallbackAccountId;
+                                                        if (!hadFallbackAccountId &&
+                                                            fallbackTokenAccountId &&
+                                                            fallbackAccountId === fallbackTokenAccountId) {
+                                                            fallbackAccount.accountIdSource =
+                                                                fallbackStoredAccountIdSource ?? "token";
+                                                        }
+                                                        if (fallbackResolvedEmail) {
+                                                            fallbackAccount.email = fallbackResolvedEmail;
+                                                        }
                                                         const fallbackHeaders = createCodexHeaders(requestInit, fallbackAccountId, fallbackAuth.access, {
                                                             model,
                                                             promptCacheKey: effectivePromptCacheKey,
@@ -1467,7 +1175,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         const fallbackController = new AbortController();
                                                         const fallbackTimeoutId = setTimeout(() => fallbackController.abort(new Error("Request timeout")), fetchTimeoutMs);
                                                         const onFallbackAbort = abortSignal
-                                                            ? () => fallbackController.abort(abortSignal.reason ?? new Error("Aborted by user"))
+                                                            ? () => fallbackController.abort(abortSignal.reason ??
+                                                                new Error("Aborted by user"))
                                                             : null;
                                                         if (abortSignal && onFallbackAbort) {
                                                             abortSignal.addEventListener("abort", onFallbackAbort, {
@@ -1476,14 +1185,14 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         }
                                                         try {
                                                             runtimeMetrics.totalRequests++;
-                                                            const fallbackResponse = await fetch(url, {
+                                                            const fallbackResponse = await fetch(url, applyProxyCompatibleInit(url, {
                                                                 ...requestInit,
                                                                 headers: fallbackHeaders,
                                                                 signal: fallbackController.signal,
-                                                            });
+                                                            }));
                                                             const fallbackSnapshot = readQuotaSchedulerSnapshot(fallbackResponse.headers, fallbackResponse.status);
                                                             if (fallbackSnapshot) {
-                                                                preemptiveQuotaScheduler.update(`${resolveEntitlementAccountKey(fallbackAccount)}:${model ?? modelFamily}`, fallbackSnapshot);
+                                                                preemptiveQuotaScheduler.update(`${fallbackEntitlementAccountKey}:${model ?? modelFamily}`, fallbackSnapshot);
                                                             }
                                                             if (!fallbackResponse.ok) {
                                                                 try {
@@ -1500,15 +1209,19 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                                 else {
                                                                     accountManager.recordFailure(fallbackAccount, modelFamily, model);
                                                                 }
-                                                                capabilityPolicyStore.recordFailure(resolveEntitlementAccountKey(fallbackAccount), capabilityModelKey);
+                                                                capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                                 continue;
                                                             }
                                                             successAccountForResponse = fallbackAccount;
+                                                            successEntitlementAccountKey =
+                                                                fallbackEntitlementAccountKey;
                                                             runtimeMetrics.streamFailoverRecoveries += 1;
                                                             if (fallbackAccount.index !== account.index) {
                                                                 runtimeMetrics.streamFailoverCrossAccountRecoveries += 1;
                                                                 runtimeMetrics.accountRotations += 1;
-                                                                sessionAffinityStore?.remember(sessionAffinityKey, fallbackAccount.index);
+                                                                if (!responseContinuationEnabled) {
+                                                                    sessionAffinityStore?.remember(sessionAffinityKey, fallbackAccount.index);
+                                                                }
                                                             }
                                                             logInfo(`Recovered stream via failover attempt ${failoverAttempt} using account ${fallbackAccount.index + 1}.`, { emittedBytes });
                                                             return fallbackResponse;
@@ -1516,14 +1229,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                         catch (streamFailoverError) {
                                                             accountManager.refundToken(fallbackAccount, modelFamily, model);
                                                             accountManager.recordFailure(fallbackAccount, modelFamily, model);
-                                                            capabilityPolicyStore.recordFailure(resolveEntitlementAccountKey(fallbackAccount), capabilityModelKey);
+                                                            capabilityPolicyStore.recordFailure(fallbackEntitlementAccountKey, capabilityModelKey);
                                                             logWarn(`Stream failover attempt ${failoverAttempt} failed for account ${fallbackAccount.index + 1}.`, {
                                                                 emittedBytes,
                                                                 error: streamFailoverError instanceof Error
                                                                     ? streamFailoverError.message
                                                                     : String(streamFailoverError),
                                                             });
-                                                            continue;
                                                         }
                                                         finally {
                                                             clearTimeout(fallbackTimeoutId);
@@ -1540,20 +1252,30 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                     requestInstanceId: requestCorrelationId ?? undefined,
                                                 });
                                             }
+                                            let storedResponseIdForSuccess = false;
                                             const successResponse = await handleSuccessResponse(responseForSuccess, isStreaming, {
+                                                onResponseId: (responseId) => {
+                                                    if (!responseContinuationEnabled)
+                                                        return;
+                                                    sessionAffinityStore?.remember(sessionAffinityKey, successAccountForResponse.index);
+                                                    sessionAffinityStore?.updateLastResponseId(sessionAffinityKey, responseId);
+                                                    storedResponseIdForSuccess = true;
+                                                },
                                                 streamStallTimeoutMs,
                                             });
                                             if (!isStreaming && emptyResponseMaxRetries > 0) {
                                                 const clonedResponse = successResponse.clone();
                                                 try {
                                                     const bodyText = await clonedResponse.text();
-                                                    const parsedBody = bodyText ? JSON.parse(bodyText) : null;
+                                                    const parsedBody = bodyText
+                                                        ? JSON.parse(bodyText)
+                                                        : null;
                                                     if (isEmptyResponse(parsedBody)) {
                                                         if (emptyResponseRetries < emptyResponseMaxRetries) {
                                                             emptyResponseRetries++;
                                                             runtimeMetrics.emptyResponseRetries++;
                                                             logWarn(`Empty response received (attempt ${emptyResponseRetries}/${emptyResponseMaxRetries}). Retrying...`);
-                                                            await showToast(`Empty response. Retrying (${emptyResponseRetries}/${emptyResponseMaxRetries})...`, "warning", { duration: toastDurationMs });
+                                                            await showRuntimeToast(client, `Empty response. Retrying (${emptyResponseRetries}/${emptyResponseMaxRetries})...`, "warning", { duration: toastDurationMs });
                                                             accountManager.refundToken(account, modelFamily, model);
                                                             accountManager.recordFailure(account, modelFamily, model);
                                                             capabilityPolicyStore.recordFailure(entitlementAccountKey, capabilityModelKey);
@@ -1565,7 +1287,8 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                                                 sameAccountRetryCount < maxSameAccountRetries) {
                                                                 sameAccountRetryCount += 1;
                                                                 runtimeMetrics.sameAccountRetries += 1;
-                                                                const retryDelayMs = Math.max(0, Math.floor(emptyPolicy.retryDelayMs ?? emptyResponseRetryDelayMs));
+                                                                const retryDelayMs = Math.max(0, Math.floor(emptyPolicy.retryDelayMs ??
+                                                                    emptyResponseRetryDelayMs));
                                                                 if (retryDelayMs > 0) {
                                                                     await sleep(addJitter(retryDelayMs, 0.2));
                                                                 }
@@ -1585,18 +1308,21 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             if (successAccountForResponse.index !== account.index) {
                                                 accountManager.markSwitched(successAccountForResponse, "rotation", modelFamily);
                                             }
-                                            const successAccountKey = successAccountForResponse.index === account.index
-                                                ? entitlementAccountKey
-                                                : resolveEntitlementAccountKey(successAccountForResponse);
+                                            const successAccountKey = successEntitlementAccountKey;
                                             accountManager.recordSuccess(successAccountForResponse, modelFamily, model);
                                             capabilityPolicyStore.recordSuccess(successAccountKey, capabilityModelKey);
                                             entitlementCache.clear(successAccountKey, capabilityModelKey);
-                                            sessionAffinityStore?.remember(sessionAffinityKey, successAccountForResponse.index);
+                                            if (!responseContinuationEnabled ||
+                                                (!isStreaming && !storedResponseIdForSuccess)) {
+                                                sessionAffinityStore?.remember(sessionAffinityKey, successAccountForResponse.index);
+                                            }
                                             runtimeMetrics.successfulRequests++;
                                             runtimeMetrics.lastError = null;
-                                            if (lastCodexCliActiveSyncIndex !== successAccountForResponse.index) {
+                                            if (lastCodexCliActiveSyncIndex !==
+                                                successAccountForResponse.index) {
                                                 void accountManager.syncCodexCliActiveSelectionForIndex(successAccountForResponse.index);
-                                                lastCodexCliActiveSyncIndex = successAccountForResponse.index;
+                                                lastCodexCliActiveSyncIndex =
+                                                    successAccountForResponse.index;
                                             }
                                             return successResponse;
                                         }
@@ -1620,7 +1346,15 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                             waitMs <= retryAllAccountsMaxWaitMs) &&
                                         allRateLimitedRetries < retryAllAccountsMaxRetries) {
                                         const countdownMessage = `All ${count} account(s) rate-limited. Waiting`;
-                                        await sleepWithCountdown(addJitter(waitMs, 0.2), countdownMessage);
+                                        await sleepWithCountdown({
+                                            totalMs: addJitter(waitMs, 0.2),
+                                            message: countdownMessage,
+                                            sleep,
+                                            showToast: (message, variant, options) => showRuntimeToast(client, message, variant, options),
+                                            formatWaitTime,
+                                            toastDurationMs,
+                                            abortSignal,
+                                        });
                                         allRateLimitedRetries++;
                                         continue;
                                     }
@@ -1657,580 +1391,70 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     type: "oauth",
                     authorize: async (inputs) => {
                         const authPluginConfig = loadPluginConfig();
-                        applyUiRuntimeFromConfig(authPluginConfig);
-                        applyAccountStorageScope(authPluginConfig);
+                        applyUiRuntimeFromConfig(authPluginConfig, setUiRuntimeOptions);
+                        applyAccountStorageScopeFromConfig(authPluginConfig, {
+                            getPerProjectAccounts,
+                            getStorageBackupEnabled,
+                            setStorageBackupEnabled,
+                            isCodexCliSyncEnabled,
+                            getWarningShown: () => perProjectStorageWarningShown,
+                            setWarningShown: (shown) => {
+                                perProjectStorageWarningShown = shown;
+                            },
+                            logWarn,
+                            pluginName: PLUGIN_NAME,
+                            setStoragePath,
+                            cwd: () => process.cwd(),
+                        });
                         const accounts = [];
-                        const noBrowser = inputs?.noBrowser === "true" ||
+                        const noBrowser = inputs?.manual === "true" ||
+                            inputs?.noBrowser === "true" ||
                             inputs?.["no-browser"] === "true";
-                        const useManualMode = noBrowser;
+                        const useManualMode = noBrowser || isBrowserLaunchSuppressed();
                         const explicitLoginMode = inputs?.loginMode === "fresh" || inputs?.loginMode === "add"
                             ? inputs.loginMode
                             : null;
                         let startFresh = explicitLoginMode === "fresh";
                         let refreshAccountIndex;
-                        const clampActiveIndices = (storage) => {
-                            const count = storage.accounts.length;
-                            if (count === 0) {
-                                storage.activeIndex = 0;
-                                storage.activeIndexByFamily = {};
-                                return;
-                            }
-                            storage.activeIndex = Math.max(0, Math.min(storage.activeIndex, count - 1));
-                            storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-                            for (const family of MODEL_FAMILIES) {
-                                const raw = storage.activeIndexByFamily[family];
-                                const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : storage.activeIndex;
-                                storage.activeIndexByFamily[family] = Math.max(0, Math.min(candidate, count - 1));
-                            }
-                        };
-                        const isFlaggableFailure = (failure) => {
-                            if (failure.reason === "missing_refresh")
-                                return true;
-                            if (failure.statusCode === 401)
-                                return true;
-                            if (failure.statusCode !== 400)
-                                return false;
-                            const message = (failure.message ?? "").toLowerCase();
-                            return (message.includes("invalid_grant") ||
-                                message.includes("invalid refresh") ||
-                                message.includes("token has been revoked"));
-                        };
-                        const parseFiniteNumberHeader = (headers, name) => {
-                            const raw = headers.get(name);
-                            if (!raw)
-                                return undefined;
-                            const parsed = Number(raw);
-                            return Number.isFinite(parsed) ? parsed : undefined;
-                        };
-                        const parseFiniteIntHeader = (headers, name) => {
-                            const raw = headers.get(name);
-                            if (!raw)
-                                return undefined;
-                            const parsed = Number.parseInt(raw, 10);
-                            return Number.isFinite(parsed) ? parsed : undefined;
-                        };
-                        const parseResetAtMs = (headers, prefix) => {
-                            const resetAfterSeconds = parseFiniteIntHeader(headers, `${prefix}-reset-after-seconds`);
-                            if (typeof resetAfterSeconds === "number" &&
-                                Number.isFinite(resetAfterSeconds) &&
-                                resetAfterSeconds > 0) {
-                                return Date.now() + resetAfterSeconds * 1000;
-                            }
-                            const resetAtRaw = headers.get(`${prefix}-reset-at`);
-                            if (!resetAtRaw)
-                                return undefined;
-                            const trimmed = resetAtRaw.trim();
-                            if (/^\d+$/.test(trimmed)) {
-                                const parsedNumber = Number.parseInt(trimmed, 10);
-                                if (Number.isFinite(parsedNumber) && parsedNumber > 0) {
-                                    // Upstream sometimes returns seconds since epoch.
-                                    return parsedNumber < 10_000_000_000 ? parsedNumber * 1000 : parsedNumber;
-                                }
-                            }
-                            const parsedDate = Date.parse(trimmed);
-                            return Number.isFinite(parsedDate) ? parsedDate : undefined;
-                        };
-                        const hasCodexQuotaHeaders = (headers) => {
-                            const keys = [
-                                "x-codex-primary-used-percent",
-                                "x-codex-primary-window-minutes",
-                                "x-codex-primary-reset-at",
-                                "x-codex-primary-reset-after-seconds",
-                                "x-codex-secondary-used-percent",
-                                "x-codex-secondary-window-minutes",
-                                "x-codex-secondary-reset-at",
-                                "x-codex-secondary-reset-after-seconds",
-                            ];
-                            return keys.some((key) => headers.get(key) !== null);
-                        };
-                        const parseCodexQuotaSnapshot = (headers, status) => {
-                            if (!hasCodexQuotaHeaders(headers))
-                                return null;
-                            const primaryPrefix = "x-codex-primary";
-                            const secondaryPrefix = "x-codex-secondary";
-                            const primary = {
-                                usedPercent: parseFiniteNumberHeader(headers, `${primaryPrefix}-used-percent`),
-                                windowMinutes: parseFiniteIntHeader(headers, `${primaryPrefix}-window-minutes`),
-                                resetAtMs: parseResetAtMs(headers, primaryPrefix),
-                            };
-                            const secondary = {
-                                usedPercent: parseFiniteNumberHeader(headers, `${secondaryPrefix}-used-percent`),
-                                windowMinutes: parseFiniteIntHeader(headers, `${secondaryPrefix}-window-minutes`),
-                                resetAtMs: parseResetAtMs(headers, secondaryPrefix),
-                            };
-                            const planTypeRaw = headers.get("x-codex-plan-type");
-                            const planType = planTypeRaw && planTypeRaw.trim() ? planTypeRaw.trim() : undefined;
-                            const activeLimit = parseFiniteIntHeader(headers, "x-codex-active-limit");
-                            return { status, planType, activeLimit, primary, secondary };
-                        };
-                        const formatQuotaWindowLabel = (windowMinutes) => {
-                            if (!windowMinutes || !Number.isFinite(windowMinutes) || windowMinutes <= 0) {
-                                return "quota";
-                            }
-                            if (windowMinutes % 1440 === 0)
-                                return `${windowMinutes / 1440}d`;
-                            if (windowMinutes % 60 === 0)
-                                return `${windowMinutes / 60}h`;
-                            return `${windowMinutes}m`;
-                        };
-                        const formatResetAt = (resetAtMs) => {
-                            if (!resetAtMs || !Number.isFinite(resetAtMs) || resetAtMs <= 0)
-                                return undefined;
-                            const date = new Date(resetAtMs);
-                            if (!Number.isFinite(date.getTime()))
-                                return undefined;
-                            const now = new Date();
-                            const sameDay = now.getFullYear() === date.getFullYear() &&
-                                now.getMonth() === date.getMonth() &&
-                                now.getDate() === date.getDate();
-                            const time = date.toLocaleTimeString(undefined, {
-                                hour: "2-digit",
-                                minute: "2-digit",
-                                hour12: false,
-                            });
-                            if (sameDay)
-                                return time;
-                            const day = date.toLocaleDateString(undefined, { month: "short", day: "2-digit" });
-                            return `${time} on ${day}`;
-                        };
-                        const formatCodexQuotaLine = (snapshot) => {
-                            const summarizeWindow = (label, window) => {
-                                const used = window.usedPercent;
-                                const left = typeof used === "number" && Number.isFinite(used)
-                                    ? Math.max(0, Math.min(100, Math.round(100 - used)))
-                                    : undefined;
-                                const reset = formatResetAt(window.resetAtMs);
-                                let summary = label;
-                                if (left !== undefined)
-                                    summary = `${summary} ${left}% left`;
-                                if (reset)
-                                    summary = `${summary} (resets ${reset})`;
-                                return summary;
-                            };
-                            const primaryLabel = formatQuotaWindowLabel(snapshot.primary.windowMinutes);
-                            const secondaryLabel = formatQuotaWindowLabel(snapshot.secondary.windowMinutes);
-                            const parts = [
-                                summarizeWindow(primaryLabel, snapshot.primary),
-                                summarizeWindow(secondaryLabel, snapshot.secondary),
-                            ];
-                            if (snapshot.planType)
-                                parts.push(`plan:${snapshot.planType}`);
-                            if (typeof snapshot.activeLimit === "number" && Number.isFinite(snapshot.activeLimit)) {
-                                parts.push(`active:${snapshot.activeLimit}`);
-                            }
-                            if (snapshot.status === 429)
-                                parts.push("rate-limited");
-                            return parts.join(", ");
-                        };
-                        const fetchCodexQuotaSnapshot = async (params) => {
-                            const QUOTA_PROBE_MODELS = ["gpt-5-codex", "gpt-5.3-codex", "gpt-5.2-codex"];
-                            let lastError = null;
-                            for (const model of QUOTA_PROBE_MODELS) {
-                                try {
-                                    const instructions = await getCodexInstructions(model);
-                                    const probeBody = {
-                                        model,
-                                        stream: true,
-                                        store: false,
-                                        include: ["reasoning.encrypted_content"],
-                                        instructions,
-                                        input: [
-                                            {
-                                                type: "message",
-                                                role: "user",
-                                                content: [{ type: "input_text", text: "quota ping" }],
-                                            },
-                                        ],
-                                        reasoning: { effort: "none", summary: "auto" },
-                                        text: { verbosity: "low" },
-                                    };
-                                    const headers = createCodexHeaders(undefined, params.accountId, params.accessToken, {
-                                        model,
-                                    });
-                                    headers.set("content-type", "application/json; charset=utf-8");
-                                    const controller = new AbortController();
-                                    const timeout = setTimeout(() => controller.abort(), 15_000);
-                                    let response;
-                                    try {
-                                        response = await fetch(`${CODEX_BASE_URL}/codex/responses`, {
-                                            method: "POST",
-                                            headers,
-                                            body: JSON.stringify(probeBody),
-                                            signal: controller.signal,
-                                        });
-                                    }
-                                    finally {
-                                        clearTimeout(timeout);
-                                    }
-                                    const snapshot = parseCodexQuotaSnapshot(response.headers, response.status);
-                                    if (snapshot) {
-                                        // We only need headers; cancel the SSE stream immediately.
-                                        try {
-                                            await response.body?.cancel();
-                                        }
-                                        catch {
-                                            // Ignore cancellation failures.
-                                        }
-                                        return snapshot;
-                                    }
-                                    if (!response.ok) {
-                                        const bodyText = await response.text().catch(() => "");
-                                        let errorBody = undefined;
-                                        try {
-                                            errorBody = bodyText ? JSON.parse(bodyText) : undefined;
-                                        }
-                                        catch {
-                                            errorBody = { error: { message: bodyText } };
-                                        }
-                                        const unsupportedInfo = getUnsupportedCodexModelInfo(errorBody);
-                                        if (unsupportedInfo.isUnsupported) {
-                                            lastError = new Error(unsupportedInfo.message ?? `Model '${model}' unsupported for this account`);
-                                            continue;
-                                        }
-                                        const message = (typeof errorBody?.error?.message === "string"
-                                            ? errorBody.error?.message
-                                            : bodyText) || `HTTP ${response.status}`;
-                                        throw new Error(message);
-                                    }
-                                    lastError = new Error("Codex response did not include quota headers");
-                                }
-                                catch (error) {
-                                    lastError = error instanceof Error ? error : new Error(String(error));
-                                }
-                            }
-                            throw lastError ?? new Error("Failed to fetch quotas");
-                        };
-                        const runAccountCheck = async (deepProbe) => {
-                            const loadedStorage = await hydrateEmails(await loadAccounts());
-                            const workingStorage = loadedStorage
-                                ? {
-                                    ...loadedStorage,
-                                    accounts: loadedStorage.accounts.map((account) => ({ ...account })),
-                                    activeIndexByFamily: loadedStorage.activeIndexByFamily
-                                        ? { ...loadedStorage.activeIndexByFamily }
-                                        : {},
-                                }
-                                : { version: 3, accounts: [], activeIndex: 0, activeIndexByFamily: {} };
-                            if (workingStorage.accounts.length === 0) {
-                                console.log("\nNo accounts to check.\n");
-                                return;
-                            }
-                            const flaggedStorage = await loadFlaggedAccounts();
-                            let storageChanged = false;
-                            let flaggedChanged = false;
-                            const removeFromActive = new Set();
-                            const total = workingStorage.accounts.length;
-                            let ok = 0;
-                            let disabled = 0;
-                            let errors = 0;
-                            console.log(`\nChecking ${deepProbe ? "full account health" : "quotas"} for all accounts...\n`);
-                            for (let i = 0; i < total; i += 1) {
-                                const account = workingStorage.accounts[i];
-                                if (!account)
-                                    continue;
-                                const label = account.email ?? account.accountLabel ?? `Account ${i + 1}`;
-                                if (account.enabled === false) {
-                                    disabled += 1;
-                                    console.log(`[${i + 1}/${total}] ${label}: DISABLED`);
-                                    continue;
-                                }
-                                try {
-                                    // If we already have a valid cached access token, don't force-refresh.
-                                    // This avoids flagging accounts where the refresh token has been burned
-                                    // but the access token is still valid (same behavior as Codex CLI).
-                                    const nowMs = Date.now();
-                                    let accessToken = null;
-                                    let tokenAccountId = undefined;
-                                    let authDetail = "OK";
-                                    if (account.accessToken &&
-                                        (typeof account.expiresAt !== "number" ||
-                                            !Number.isFinite(account.expiresAt) ||
-                                            account.expiresAt > nowMs)) {
-                                        accessToken = account.accessToken;
-                                        authDetail = "OK (cached access)";
-                                        tokenAccountId = extractAccountId(account.accessToken);
-                                        if (tokenAccountId &&
-                                            shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
-                                            tokenAccountId !== account.accountId) {
-                                            account.accountId = tokenAccountId;
-                                            account.accountIdSource = "token";
-                                            storageChanged = true;
-                                        }
-                                    }
-                                    // If Codex CLI has a valid cached access token for this email, use it
-                                    // instead of forcing a refresh.
-                                    if (!accessToken) {
-                                        const cached = await lookupCodexCliTokensByEmail(account.email);
-                                        if (cached &&
-                                            (typeof cached.expiresAt !== "number" ||
-                                                !Number.isFinite(cached.expiresAt) ||
-                                                cached.expiresAt > nowMs)) {
-                                            accessToken = cached.accessToken;
-                                            authDetail = "OK (Codex CLI cache)";
-                                            if (cached.refreshToken && cached.refreshToken !== account.refreshToken) {
-                                                account.refreshToken = cached.refreshToken;
-                                                storageChanged = true;
-                                            }
-                                            if (cached.accessToken && cached.accessToken !== account.accessToken) {
-                                                account.accessToken = cached.accessToken;
-                                                storageChanged = true;
-                                            }
-                                            if (cached.expiresAt !== account.expiresAt) {
-                                                account.expiresAt = cached.expiresAt;
-                                                storageChanged = true;
-                                            }
-                                            const hydratedEmail = sanitizeEmail(extractAccountEmail(cached.accessToken));
-                                            if (hydratedEmail && hydratedEmail !== account.email) {
-                                                account.email = hydratedEmail;
-                                                storageChanged = true;
-                                            }
-                                            tokenAccountId = extractAccountId(cached.accessToken);
-                                            if (tokenAccountId &&
-                                                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
-                                                tokenAccountId !== account.accountId) {
-                                                account.accountId = tokenAccountId;
-                                                account.accountIdSource = "token";
-                                                storageChanged = true;
-                                            }
-                                        }
-                                    }
-                                    if (!accessToken) {
-                                        const refreshResult = await queuedRefresh(account.refreshToken);
-                                        if (refreshResult.type !== "success") {
-                                            errors += 1;
-                                            const message = refreshResult.message ?? refreshResult.reason ?? "refresh failed";
-                                            console.log(`[${i + 1}/${total}] ${label}: ERROR (${message})`);
-                                            if (deepProbe && isFlaggableFailure(refreshResult)) {
-                                                const existingIndex = flaggedStorage.accounts.findIndex((flagged) => flagged.refreshToken === account.refreshToken);
-                                                const flaggedRecord = {
-                                                    ...account,
-                                                    flaggedAt: Date.now(),
-                                                    flaggedReason: "token-invalid",
-                                                    lastError: message,
-                                                };
-                                                if (existingIndex >= 0) {
-                                                    flaggedStorage.accounts[existingIndex] = flaggedRecord;
-                                                }
-                                                else {
-                                                    flaggedStorage.accounts.push(flaggedRecord);
-                                                }
-                                                removeFromActive.add(account.refreshToken);
-                                                flaggedChanged = true;
-                                            }
-                                            continue;
-                                        }
-                                        accessToken = refreshResult.access;
-                                        authDetail = "OK";
-                                        if (refreshResult.refresh !== account.refreshToken) {
-                                            account.refreshToken = refreshResult.refresh;
-                                            storageChanged = true;
-                                        }
-                                        if (refreshResult.access && refreshResult.access !== account.accessToken) {
-                                            account.accessToken = refreshResult.access;
-                                            storageChanged = true;
-                                        }
-                                        if (typeof refreshResult.expires === "number" &&
-                                            refreshResult.expires !== account.expiresAt) {
-                                            account.expiresAt = refreshResult.expires;
-                                            storageChanged = true;
-                                        }
-                                        const hydratedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-                                        if (hydratedEmail && hydratedEmail !== account.email) {
-                                            account.email = hydratedEmail;
-                                            storageChanged = true;
-                                        }
-                                        tokenAccountId = extractAccountId(refreshResult.access);
-                                        if (tokenAccountId &&
-                                            shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId) &&
-                                            tokenAccountId !== account.accountId) {
-                                            account.accountId = tokenAccountId;
-                                            account.accountIdSource = "token";
-                                            storageChanged = true;
-                                        }
-                                    }
-                                    if (!accessToken) {
-                                        throw new Error("Missing access token after refresh");
-                                    }
-                                    if (deepProbe) {
-                                        ok += 1;
-                                        const detail = tokenAccountId
-                                            ? `${authDetail} (id:${tokenAccountId.slice(-6)})`
-                                            : authDetail;
-                                        console.log(`[${i + 1}/${total}] ${label}: ${detail}`);
-                                        continue;
-                                    }
-                                    try {
-                                        const requestAccountId = resolveRequestAccountId(account.accountId, account.accountIdSource, tokenAccountId) ??
-                                            tokenAccountId ??
-                                            account.accountId;
-                                        if (!requestAccountId) {
-                                            throw new Error("Missing accountId for quota probe");
-                                        }
-                                        const snapshot = await fetchCodexQuotaSnapshot({
-                                            accountId: requestAccountId,
-                                            accessToken,
-                                        });
-                                        ok += 1;
-                                        console.log(`[${i + 1}/${total}] ${label}: ${formatCodexQuotaLine(snapshot)}`);
-                                    }
-                                    catch (error) {
-                                        errors += 1;
-                                        const message = error instanceof Error ? error.message : String(error);
-                                        console.log(`[${i + 1}/${total}] ${label}: ERROR (${message.slice(0, 160)})`);
-                                    }
-                                }
-                                catch (error) {
-                                    errors += 1;
-                                    const message = error instanceof Error ? error.message : String(error);
-                                    console.log(`[${i + 1}/${total}] ${label}: ERROR (${message.slice(0, 120)})`);
-                                }
-                            }
-                            if (removeFromActive.size > 0) {
-                                workingStorage.accounts = workingStorage.accounts.filter((account) => !removeFromActive.has(account.refreshToken));
-                                clampActiveIndices(workingStorage);
-                                storageChanged = true;
-                            }
-                            if (storageChanged) {
-                                await saveAccounts(workingStorage);
-                                invalidateAccountManagerCache();
-                            }
-                            if (flaggedChanged) {
-                                await saveFlaggedAccounts(flaggedStorage);
-                            }
-                            console.log("");
-                            console.log(`Results: ${ok} ok, ${errors} error, ${disabled} disabled`);
-                            if (removeFromActive.size > 0) {
-                                console.log(`Moved ${removeFromActive.size} account(s) to flagged pool (invalid refresh token).`);
-                            }
-                            console.log("");
-                        };
-                        const verifyFlaggedAccounts = async () => {
-                            const flaggedStorage = await loadFlaggedAccounts();
-                            if (flaggedStorage.accounts.length === 0) {
-                                console.log("\nNo flagged accounts to verify.\n");
-                                return;
-                            }
-                            console.log("\nVerifying flagged accounts...\n");
-                            const remaining = [];
-                            const restored = [];
-                            for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
-                                const flagged = flaggedStorage.accounts[i];
-                                if (!flagged)
-                                    continue;
-                                const label = flagged.email ?? flagged.accountLabel ?? `Flagged ${i + 1}`;
-                                try {
-                                    const cached = await lookupCodexCliTokensByEmail(flagged.email);
-                                    const now = Date.now();
-                                    if (cached &&
-                                        typeof cached.expiresAt === "number" &&
-                                        Number.isFinite(cached.expiresAt) &&
-                                        cached.expiresAt > now) {
-                                        const refreshToken = typeof cached.refreshToken === "string" && cached.refreshToken.trim()
-                                            ? cached.refreshToken.trim()
-                                            : flagged.refreshToken;
-                                        const resolved = resolveAccountSelection({
-                                            type: "success",
-                                            access: cached.accessToken,
-                                            refresh: refreshToken,
-                                            expires: cached.expiresAt,
-                                            multiAccount: true,
-                                        });
-                                        if (!resolved.accountIdOverride && flagged.accountId) {
-                                            resolved.accountIdOverride = flagged.accountId;
-                                            resolved.accountIdSource = flagged.accountIdSource ?? "manual";
-                                        }
-                                        if (!resolved.accountLabel && flagged.accountLabel) {
-                                            resolved.accountLabel = flagged.accountLabel;
-                                        }
-                                        restored.push(resolved);
-                                        console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED (Codex CLI cache)`);
-                                        continue;
-                                    }
-                                    const refreshResult = await queuedRefresh(flagged.refreshToken);
-                                    if (refreshResult.type !== "success") {
-                                        console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: STILL FLAGGED (${refreshResult.message ?? refreshResult.reason ?? "refresh failed"})`);
-                                        remaining.push(flagged);
-                                        continue;
-                                    }
-                                    const resolved = resolveAccountSelection(refreshResult);
-                                    if (!resolved.accountIdOverride && flagged.accountId) {
-                                        resolved.accountIdOverride = flagged.accountId;
-                                        resolved.accountIdSource = flagged.accountIdSource ?? "manual";
-                                    }
-                                    if (!resolved.accountLabel && flagged.accountLabel) {
-                                        resolved.accountLabel = flagged.accountLabel;
-                                    }
-                                    restored.push(resolved);
-                                    console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: RESTORED`);
-                                }
-                                catch (error) {
-                                    const message = error instanceof Error ? error.message : String(error);
-                                    console.log(`[${i + 1}/${flaggedStorage.accounts.length}] ${label}: ERROR (${message.slice(0, 120)})`);
-                                    remaining.push({
-                                        ...flagged,
-                                        lastError: message,
-                                    });
-                                }
-                            }
-                            if (restored.length > 0) {
-                                await persistAccountPool(restored, false);
-                                invalidateAccountManagerCache();
-                            }
-                            await saveFlaggedAccounts({
-                                version: 1,
-                                accounts: remaining,
-                            });
-                            console.log("");
-                            console.log(`Results: ${restored.length} restored, ${remaining.length} still flagged`);
-                            console.log("");
-                        };
                         if (!explicitLoginMode) {
                             while (true) {
-                                const loadedStorage = await hydrateEmails(await loadAccounts());
+                                const loadedStorage = await hydrateRuntimeEmails(await loadAccounts(), {
+                                    queuedRefresh,
+                                    extractAccountId,
+                                    sanitizeEmail,
+                                    extractAccountEmail,
+                                    shouldUpdateAccountIdFromToken,
+                                    saveAccounts,
+                                    logWarn,
+                                    pluginName: PLUGIN_NAME,
+                                });
                                 const workingStorage = loadedStorage
                                     ? {
                                         ...loadedStorage,
-                                        accounts: loadedStorage.accounts.map((account) => ({ ...account })),
+                                        accounts: loadedStorage.accounts.map((account) => ({
+                                            ...account,
+                                        })),
                                         activeIndexByFamily: loadedStorage.activeIndexByFamily
                                             ? { ...loadedStorage.activeIndexByFamily }
                                             : {},
                                     }
-                                    : { version: 3, accounts: [], activeIndex: 0, activeIndexByFamily: {} };
+                                    : {
+                                        version: 3,
+                                        accounts: [],
+                                        activeIndex: 0,
+                                        activeIndexByFamily: {},
+                                    };
                                 const flaggedStorage = await loadFlaggedAccounts();
-                                if (workingStorage.accounts.length === 0 && flaggedStorage.accounts.length === 0) {
+                                if (workingStorage.accounts.length === 0 &&
+                                    flaggedStorage.accounts.length === 0) {
                                     break;
                                 }
                                 const now = Date.now();
                                 const activeIndex = resolveActiveIndex(workingStorage, "codex");
-                                const existingAccounts = workingStorage.accounts.map((account, index) => {
-                                    let status;
-                                    if (account.enabled === false) {
-                                        status = "disabled";
-                                    }
-                                    else if (typeof account.coolingDownUntil === "number" &&
-                                        account.coolingDownUntil > now) {
-                                        status = "cooldown";
-                                    }
-                                    else if (formatRateLimitEntry(account, now)) {
-                                        status = "rate-limited";
-                                    }
-                                    else if (index === activeIndex) {
-                                        status = "active";
-                                    }
-                                    else {
-                                        status = "ok";
-                                    }
-                                    return {
-                                        accountId: account.accountId,
-                                        accountLabel: account.accountLabel,
-                                        email: account.email,
-                                        index,
-                                        addedAt: account.addedAt,
-                                        lastUsed: account.lastUsed,
-                                        status,
-                                        isCurrentAccount: index === activeIndex,
-                                        enabled: account.enabled !== false,
-                                    };
+                                const existingAccounts = buildLoginMenuAccounts(workingStorage.accounts, {
+                                    now,
+                                    activeIndex,
+                                    formatRateLimitEntry: (account, currentNow) => formatRateLimitEntry(account, currentNow, formatWaitTime),
                                 });
                                 const menuResult = await promptLoginMode(existingAccounts, {
                                     flaggedCount: flaggedStorage.accounts.length,
@@ -2245,16 +1469,62 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         }),
                                     };
                                 }
+                                const accountCheckDeps = {
+                                    hydrateEmails: (storage) => hydrateRuntimeEmails(storage, {
+                                        queuedRefresh,
+                                        extractAccountId,
+                                        sanitizeEmail,
+                                        extractAccountEmail,
+                                        shouldUpdateAccountIdFromToken,
+                                        saveAccounts,
+                                        logWarn,
+                                        pluginName: PLUGIN_NAME,
+                                    }),
+                                    loadAccounts,
+                                    createEmptyStorage: () => ({
+                                        version: 3,
+                                        accounts: [],
+                                        activeIndex: 0,
+                                        activeIndexByFamily: {},
+                                    }),
+                                    loadFlaggedAccounts,
+                                    createAccountCheckWorkingState,
+                                    lookupCodexCliTokensByEmail,
+                                    extractAccountId,
+                                    shouldUpdateAccountIdFromToken,
+                                    sanitizeEmail,
+                                    extractAccountEmail,
+                                    queuedRefresh,
+                                    isRuntimeFlaggableFailure: isFlaggableFailure,
+                                    fetchCodexQuotaSnapshot,
+                                    resolveRequestAccountId,
+                                    formatCodexQuotaLine: formatQuotaSnapshotLine,
+                                    clampRuntimeActiveIndices: clampActiveIndices,
+                                    MODEL_FAMILIES,
+                                    saveAccounts,
+                                    invalidateAccountManagerCache: () => invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps),
+                                    saveFlaggedAccounts,
+                                    showLine: (message) => console.log(message),
+                                };
                                 if (menuResult.mode === "check") {
-                                    await runAccountCheck(false);
+                                    await runRuntimeAccountCheck(false, accountCheckDeps);
                                     continue;
                                 }
                                 if (menuResult.mode === "deep-check") {
-                                    await runAccountCheck(true);
+                                    await runRuntimeAccountCheck(true, accountCheckDeps);
                                     continue;
                                 }
                                 if (menuResult.mode === "verify-flagged") {
-                                    await verifyFlaggedAccounts();
+                                    await verifyRuntimeFlaggedAccounts({
+                                        loadFlaggedAccounts,
+                                        lookupCodexCliTokensByEmail,
+                                        queuedRefresh,
+                                        resolveTokenSuccessAccount,
+                                        persistAccounts: persistAccountPool,
+                                        invalidateAccountManagerCache: () => invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps),
+                                        saveFlaggedAccounts,
+                                        showLine: (message) => console.log(message),
+                                    });
                                     continue;
                                 }
                                 if (menuResult.mode === "manage") {
@@ -2262,13 +1532,13 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         const target = workingStorage.accounts[menuResult.deleteAccountIndex];
                                         if (target) {
                                             workingStorage.accounts.splice(menuResult.deleteAccountIndex, 1);
-                                            clampActiveIndices(workingStorage);
+                                            clampActiveIndices(workingStorage, MODEL_FAMILIES);
                                             await saveAccounts(workingStorage);
                                             await saveFlaggedAccounts({
                                                 version: 1,
                                                 accounts: flaggedStorage.accounts.filter((flagged) => flagged.refreshToken !== target.refreshToken),
                                             });
-                                            invalidateAccountManagerCache();
+                                            invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
                                             console.log(`\nDeleted ${target.email ?? `Account ${menuResult.deleteAccountIndex + 1}`}.\n`);
                                         }
                                         continue;
@@ -2278,7 +1548,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                         if (target) {
                                             target.enabled = target.enabled === false ? true : false;
                                             await saveAccounts(workingStorage);
-                                            invalidateAccountManagerCache();
+                                            invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
                                             console.log(`\n${target.email ?? `Account ${menuResult.toggleAccountIndex + 1}`} ${target.enabled === false ? "disabled" : "enabled"}.\n`);
                                         }
                                         continue;
@@ -2295,7 +1565,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     if (menuResult.deleteAll) {
                                         await clearAccounts();
                                         await clearFlaggedAccounts();
-                                        invalidateAccountManagerCache();
+                                        invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
                                         console.log("\nCleared saved accounts from active storage. Recovery snapshots remain available. Starting fresh.\n");
                                     }
                                     break;
@@ -2307,7 +1577,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         const latestStorage = await loadAccounts();
                         const existingCount = latestStorage?.accounts.length ?? 0;
                         const requestedCount = Number.parseInt(inputs?.accountCount ?? "1", 10);
-                        const normalizedRequested = Number.isFinite(requestedCount) ? requestedCount : 1;
+                        const normalizedRequested = Number.isFinite(requestedCount)
+                            ? requestedCount
+                            : 1;
                         const availableSlots = refreshAccountIndex !== undefined
                             ? 1
                             : startFresh
@@ -2332,39 +1604,72 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         }
                         if (useManualMode) {
                             const { pkce, state, url } = await createAuthorizationFlow();
-                            return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
-                                try {
-                                    await persistAccountPool([tokens], startFresh);
-                                    invalidateAccountManagerCache();
-                                }
-                                catch (err) {
-                                    const storagePath = getStoragePath();
-                                    const errorCode = err?.code || "UNKNOWN";
-                                    const hint = err instanceof StorageError
-                                        ? err.hint
-                                        : formatStorageErrorHint(err, storagePath);
-                                    logError(`[${PLUGIN_NAME}] Failed to persist account: [${errorCode}] ${err?.message ?? String(err)}`);
-                                    await showToast(hint, "error", {
-                                        title: "Account Persistence Failed",
-                                        duration: 10000,
-                                    });
-                                }
+                            return buildManualOAuthFlow({
+                                pkce,
+                                url,
+                                expectedState: state,
+                                redirectUri: REDIRECT_URI,
+                                parseAuthorizationInput,
+                                exchangeAuthorizationCode,
+                                resolveTokenSuccess: resolveTokenSuccessAccount,
+                                instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
+                                onSuccess: async (tokens) => {
+                                    try {
+                                        await persistAccountPool([tokens], startFresh);
+                                        invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
+                                    }
+                                    catch (err) {
+                                        const storagePath = getStoragePath();
+                                        const errorCode = err?.code || "UNKNOWN";
+                                        const hint = err instanceof StorageError
+                                            ? err.hint
+                                            : formatStorageErrorHint(err, storagePath);
+                                        logError(`[${PLUGIN_NAME}] Failed to persist account: [${errorCode}] ${err?.message ?? String(err)}`);
+                                        await showRuntimeToast(client, hint, "error", {
+                                            title: "Account Persistence Failed",
+                                            duration: 10000,
+                                        });
+                                    }
+                                },
                             });
                         }
-                        const explicitCountProvided = typeof inputs?.accountCount === "string" && inputs.accountCount.trim().length > 0;
+                        const explicitCountProvided = typeof inputs?.accountCount === "string" &&
+                            inputs.accountCount.trim().length > 0;
                         while (accounts.length < targetCount) {
                             logInfo(`=== OpenAI OAuth (Account ${accounts.length + 1}) ===`);
                             const forceNewLogin = accounts.length > 0 || refreshAccountIndex !== undefined;
-                            const result = await runOAuthFlow(forceNewLogin);
+                            const result = await runRuntimeOAuthFlow(forceNewLogin, {
+                                runBrowserOAuthFlow: (input) => runBrowserOAuthFlow({
+                                    ...input,
+                                    createAuthorizationFlow,
+                                    redactOAuthUrlForLog,
+                                    startLocalOAuthServer,
+                                    openBrowserUrl,
+                                    pluginName: PLUGIN_NAME,
+                                    authManualLabel: AUTH_LABELS.OAUTH_MANUAL,
+                                    exchangeAuthorizationCode,
+                                    redirectUri: REDIRECT_URI,
+                                }),
+                                manualModeLabel: AUTH_LABELS.OAUTH_MANUAL,
+                                logInfo,
+                                logDebug,
+                                logWarn,
+                                pluginName: PLUGIN_NAME,
+                            });
                             let resolved = null;
                             if (result.type === "success") {
-                                resolved = resolveAccountSelection(result);
+                                resolved = resolveTokenSuccessAccount(result);
                                 const email = extractAccountEmail(resolved.access, resolved.idToken);
-                                const accountId = resolved.accountIdOverride ?? extractAccountId(resolved.access);
-                                const label = resolved.accountLabel ?? email ?? accountId ?? "Unknown account";
+                                const accountId = resolved.accountIdOverride ??
+                                    extractAccountId(resolved.access);
+                                const label = resolved.accountLabel ??
+                                    email ??
+                                    accountId ??
+                                    "Unknown account";
                                 logInfo(`Authenticated as: ${label}`);
                                 const isDuplicate = findMatchingAccountIndex(accounts.map((account) => ({
-                                    accountId: account.accountIdOverride ?? extractAccountId(account.access),
+                                    accountId: account.accountIdOverride ??
+                                        extractAccountId(account.access),
                                     email: sanitizeEmail(extractAccountEmail(account.access, account.idToken)),
                                     refreshToken: account.refresh,
                                 })), {
@@ -2394,11 +1699,11 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 continue;
                             }
                             accounts.push(resolved);
-                            await showToast(`Account ${accounts.length} authenticated`, "success");
+                            await showRuntimeToast(client, `Account ${accounts.length} authenticated`, "success");
                             try {
                                 const isFirstAccount = accounts.length === 1;
                                 await persistAccountPool([resolved], isFirstAccount && startFresh);
-                                invalidateAccountManagerCache();
+                                invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
                             }
                             catch (err) {
                                 const storagePath = getStoragePath();
@@ -2407,7 +1712,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                     ? err.hint
                                     : formatStorageErrorHint(err, storagePath);
                                 logError(`[${PLUGIN_NAME}] Failed to persist account: [${errorCode}] ${err?.message ?? String(err)}`);
-                                await showToast(hint, "error", {
+                                await showRuntimeToast(client, hint, "error", {
                                     title: "Account Persistence Failed",
                                     duration: 10000,
                                 });
@@ -2463,20 +1768,48 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         // Initialize storage path for manual OAuth flow
                         // Must happen BEFORE persistAccountPool to ensure correct storage location
                         const manualPluginConfig = loadPluginConfig();
-                        applyUiRuntimeFromConfig(manualPluginConfig);
-                        applyAccountStorageScope(manualPluginConfig);
+                        applyUiRuntimeFromConfig(manualPluginConfig, setUiRuntimeOptions);
+                        applyAccountStorageScopeFromConfig(manualPluginConfig, {
+                            getPerProjectAccounts,
+                            getStorageBackupEnabled,
+                            setStorageBackupEnabled,
+                            isCodexCliSyncEnabled,
+                            getWarningShown: () => perProjectStorageWarningShown,
+                            setWarningShown: (shown) => {
+                                perProjectStorageWarningShown = shown;
+                            },
+                            logWarn,
+                            pluginName: PLUGIN_NAME,
+                            setStoragePath,
+                            cwd: () => process.cwd(),
+                        });
                         const { pkce, state, url } = await createAuthorizationFlow();
-                        return buildManualOAuthFlow(pkce, url, state, async (tokens) => {
-                            try {
-                                await persistAccountPool([tokens], false);
-                            }
-                            catch (err) {
-                                const storagePath = getStoragePath();
-                                const errorCode = err?.code || "UNKNOWN";
-                                const hint = err instanceof StorageError ? err.hint : formatStorageErrorHint(err, storagePath);
-                                logError(`[${PLUGIN_NAME}] Failed to persist account: [${errorCode}] ${err?.message ?? String(err)}`);
-                                await showToast(hint, "error", { title: "Account Persistence Failed", duration: 10000 });
-                            }
+                        return buildManualOAuthFlow({
+                            pkce,
+                            url,
+                            expectedState: state,
+                            redirectUri: REDIRECT_URI,
+                            parseAuthorizationInput,
+                            exchangeAuthorizationCode,
+                            resolveTokenSuccess: resolveTokenSuccessAccount,
+                            instructions: AUTH_LABELS.INSTRUCTIONS_MANUAL,
+                            onSuccess: async (tokens) => {
+                                try {
+                                    await persistAccountPool([tokens], false);
+                                }
+                                catch (err) {
+                                    const storagePath = getStoragePath();
+                                    const errorCode = err?.code || "UNKNOWN";
+                                    const hint = err instanceof StorageError
+                                        ? err.hint
+                                        : formatStorageErrorHint(err, storagePath);
+                                    logError(`[${PLUGIN_NAME}] Failed to persist account: [${errorCode}] ${err?.message ?? String(err)}`);
+                                    await showRuntimeToast(client, hint, "error", {
+                                        title: "Account Persistence Failed",
+                                        duration: 10000,
+                                    });
+                                }
+                            },
                         });
                     },
                 },
@@ -2492,7 +1825,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 description: "List all Codex OAuth accounts and the current active index.",
                 args: {},
                 async execute() {
-                    const ui = resolveUiRuntime();
+                    const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
                     const storage = await loadAccounts();
                     const storePath = getStoragePath();
                     if (!storage || storage.accounts.length === 0) {
@@ -2531,7 +1864,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 badges.push(formatUiBadge(ui, "current", "accent"));
                             if (account.enabled === false)
                                 badges.push(formatUiBadge(ui, "disabled", "danger"));
-                            const rateLimit = formatRateLimitEntry(account, now);
+                            const rateLimit = formatRateLimitEntry(account, now, formatWaitTime);
                             if (rateLimit)
                                 badges.push(formatUiBadge(ui, "rate-limited", "warning"));
                             if (typeof account.coolingDownUntil === "number" &&
@@ -2569,13 +1902,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     storage.accounts.forEach((account, index) => {
                         const label = formatAccountLabel(account, index);
                         const statuses = [];
-                        const rateLimit = formatRateLimitEntry(account, now);
+                        const rateLimit = formatRateLimitEntry(account, now, formatWaitTime);
                         if (index === activeIndex)
                             statuses.push("active");
                         if (rateLimit)
                             statuses.push("rate-limited");
-                        if (typeof account.coolingDownUntil ===
-                            "number" &&
+                        if (typeof account.coolingDownUntil === "number" &&
                             account.coolingDownUntil > now) {
                             statuses.push("cooldown");
                         }
@@ -2596,10 +1928,12 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
             "codex-switch": tool({
                 description: "Switch active Codex account by index (1-based).",
                 args: {
-                    index: tool.schema.number().describe("Account number to switch to (1-based, e.g., 1 for first account)"),
+                    index: tool.schema
+                        .number()
+                        .describe("Account number to switch to (1-based, e.g., 1 for first account)"),
                 },
                 async execute({ index }) {
-                    const ui = resolveUiRuntime();
+                    const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
                     const storage = await loadAccounts();
                     if (!storage || storage.accounts.length === 0) {
                         if (ui.v2Enabled) {
@@ -2641,7 +1975,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         await saveAccounts(storage);
                     }
                     catch (saveError) {
-                        logWarn("Failed to save account switch", { error: String(saveError) });
+                        logWarn("Failed to save account switch", {
+                            error: String(saveError),
+                        });
                         if (ui.v2Enabled) {
                             return [
                                 ...formatUiHeader(ui, "Switch account"),
@@ -2653,7 +1989,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         return `Switched to ${formatAccountLabel(account, targetIndex)} but failed to persist. Changes may be lost on restart.`;
                     }
                     if (cachedAccountManager) {
-                        await reloadAccountManagerFromDisk();
+                        await reloadRuntimeAccountManager(makeReloadAccountManagerDeps());
                     }
                     const label = formatAccountLabel(account, targetIndex);
                     if (ui.v2Enabled) {
@@ -2670,7 +2006,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                 description: "Show detailed status of Codex accounts and rate limits.",
                 args: {},
                 async execute() {
-                    const ui = resolveUiRuntime();
+                    const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
                     const storage = await loadAccounts();
                     if (!storage || storage.accounts.length === 0) {
                         if (ui.v2Enabled) {
@@ -2699,7 +2035,7 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                                 badges.push(formatUiBadge(ui, "active", "accent"));
                             if (account.enabled === false)
                                 badges.push(formatUiBadge(ui, "disabled", "danger"));
-                            const rateLimit = formatRateLimitEntry(account, now) ?? "none";
+                            const rateLimit = formatRateLimitEntry(account, now, formatWaitTime) ?? "none";
                             const cooldown = formatCooldown(account, now) ?? "none";
                             if (rateLimit !== "none")
                                 badges.push(formatUiBadge(ui, "rate-limited", "warning"));
@@ -2715,7 +2051,9 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                         lines.push(...formatUiSection(ui, "Active index by model family"));
                         for (const family of MODEL_FAMILIES) {
                             const idx = storage.activeIndexByFamily?.[family];
-                            const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
+                            const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx)
+                                ? String(idx + 1)
+                                : "-";
                             lines.push(formatUiItem(ui, `${family}: ${familyIndexLabel}`));
                         }
                         lines.push("");
@@ -2749,18 +2087,27 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     storage.accounts.forEach((account, index) => {
                         const label = formatAccountLabel(account, index);
                         const active = index === activeIndex ? "Yes" : "No";
-                        const rateLimit = formatRateLimitEntry(account, now) ?? "None";
+                        const rateLimit = formatRateLimitEntry(account, now, formatWaitTime) ?? "None";
                         const cooldown = formatCooldown(account, now) ?? "No";
                         const lastUsed = typeof account.lastUsed === "number" && account.lastUsed > 0
                             ? `${formatWaitTime(now - account.lastUsed)} ago`
                             : "-";
-                        lines.push(buildTableRow([String(index + 1), label, active, rateLimit, cooldown, lastUsed], statusTableOptions));
+                        lines.push(buildTableRow([
+                            String(index + 1),
+                            label,
+                            active,
+                            rateLimit,
+                            cooldown,
+                            lastUsed,
+                        ], statusTableOptions));
                     });
                     lines.push("");
                     lines.push("Active index by model family:");
                     for (const family of MODEL_FAMILIES) {
                         const idx = storage.activeIndexByFamily?.[family];
-                        const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx) ? String(idx + 1) : "-";
+                        const familyIndexLabel = typeof idx === "number" && Number.isFinite(idx)
+                            ? String(idx + 1)
+                            : "-";
                         lines.push(`  ${family}: ${familyIndexLabel}`);
                     }
                     lines.push("");
@@ -2777,95 +2124,97 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     return lines.join("\n");
                 },
             }),
-            ...(exposeAdvancedCodexTools ? {
-                "codex-metrics": tool({
-                    description: "Show runtime request metrics for this plugin process.",
-                    args: {},
-                    execute() {
-                        const ui = resolveUiRuntime();
-                        const now = Date.now();
-                        const uptimeMs = Math.max(0, now - runtimeMetrics.startedAt);
-                        const total = runtimeMetrics.totalRequests;
-                        const successful = runtimeMetrics.successfulRequests;
-                        const successRate = total > 0 ? ((successful / total) * 100).toFixed(1) : "0.0";
-                        const avgLatencyMs = successful > 0
-                            ? Math.round(runtimeMetrics.cumulativeLatencyMs / successful)
-                            : 0;
-                        const liveSyncSnapshot = liveAccountSync?.getSnapshot();
-                        const guardianStats = refreshGuardian?.getStats();
-                        const sessionAffinityEntries = sessionAffinityStore?.size() ?? 0;
-                        const lastRequest = runtimeMetrics.lastRequestAt !== null
-                            ? `${formatWaitTime(now - runtimeMetrics.lastRequestAt)} ago`
-                            : "never";
-                        const lines = [
-                            "Codex Plugin Metrics:",
-                            "",
-                            `Uptime: ${formatWaitTime(uptimeMs)}`,
-                            `Total upstream requests: ${total}`,
-                            `Successful responses: ${successful}`,
-                            `Failed responses: ${runtimeMetrics.failedRequests}`,
-                            `Success rate: ${successRate}%`,
-                            `Average successful latency: ${avgLatencyMs}ms`,
-                            `Rate-limited responses: ${runtimeMetrics.rateLimitedResponses}`,
-                            `Server errors (5xx): ${runtimeMetrics.serverErrors}`,
-                            `Network errors: ${runtimeMetrics.networkErrors}`,
-                            `User aborts: ${runtimeMetrics.userAborts}`,
-                            `Auth refresh failures: ${runtimeMetrics.authRefreshFailures}`,
-                            `Account rotations: ${runtimeMetrics.accountRotations}`,
-                            `Same-account retries: ${runtimeMetrics.sameAccountRetries}`,
-                            `Stream failover attempts: ${runtimeMetrics.streamFailoverAttempts}`,
-                            `Stream failover recoveries: ${runtimeMetrics.streamFailoverRecoveries}`,
-                            `Stream failover cross-account recoveries: ${runtimeMetrics.streamFailoverCrossAccountRecoveries}`,
-                            `Empty-response retries: ${runtimeMetrics.emptyResponseRetries}`,
-                            `Session affinity entries: ${sessionAffinityEntries}`,
-                            `Live sync: ${liveSyncSnapshot?.running ? "on" : "off"} (${liveSyncSnapshot?.reloadCount ?? 0} reloads)`,
-                            `Refresh guardian: ${guardianStats ? "on" : "off"} (${guardianStats?.refreshed ?? 0} refreshed, ${guardianStats?.failed ?? 0} failed)`,
-                            `Last upstream request: ${lastRequest}`,
-                        ];
-                        if (runtimeMetrics.lastError) {
-                            lines.push(`Last error: ${runtimeMetrics.lastError}`);
-                        }
-                        if (ui.v2Enabled) {
-                            const styled = [
-                                ...formatUiHeader(ui, "Codex plugin metrics"),
-                                formatUiKeyValue(ui, "Uptime", formatWaitTime(uptimeMs)),
-                                formatUiKeyValue(ui, "Total upstream requests", String(total)),
-                                formatUiKeyValue(ui, "Successful responses", String(successful), "success"),
-                                formatUiKeyValue(ui, "Failed responses", String(runtimeMetrics.failedRequests), "danger"),
-                                formatUiKeyValue(ui, "Success rate", `${successRate}%`, "accent"),
-                                formatUiKeyValue(ui, "Average successful latency", `${avgLatencyMs}ms`),
-                                formatUiKeyValue(ui, "Rate-limited responses", String(runtimeMetrics.rateLimitedResponses), "warning"),
-                                formatUiKeyValue(ui, "Server errors (5xx)", String(runtimeMetrics.serverErrors), "danger"),
-                                formatUiKeyValue(ui, "Network errors", String(runtimeMetrics.networkErrors), "danger"),
-                                formatUiKeyValue(ui, "User aborts", String(runtimeMetrics.userAborts), "muted"),
-                                formatUiKeyValue(ui, "Auth refresh failures", String(runtimeMetrics.authRefreshFailures), "warning"),
-                                formatUiKeyValue(ui, "Account rotations", String(runtimeMetrics.accountRotations), "accent"),
-                                formatUiKeyValue(ui, "Same-account retries", String(runtimeMetrics.sameAccountRetries), "warning"),
-                                formatUiKeyValue(ui, "Stream failover attempts", String(runtimeMetrics.streamFailoverAttempts), "muted"),
-                                formatUiKeyValue(ui, "Stream failover recoveries", String(runtimeMetrics.streamFailoverRecoveries), "success"),
-                                formatUiKeyValue(ui, "Stream failover cross-account recoveries", String(runtimeMetrics.streamFailoverCrossAccountRecoveries), "accent"),
-                                formatUiKeyValue(ui, "Empty-response retries", String(runtimeMetrics.emptyResponseRetries), "warning"),
-                                formatUiKeyValue(ui, "Session affinity entries", String(sessionAffinityEntries), "muted"),
-                                formatUiKeyValue(ui, "Live sync", `${liveSyncSnapshot?.running ? "on" : "off"} (${liveSyncSnapshot?.reloadCount ?? 0} reloads)`, liveSyncSnapshot?.running ? "success" : "muted"),
-                                formatUiKeyValue(ui, "Refresh guardian", guardianStats
-                                    ? `on (${guardianStats.refreshed} refreshed, ${guardianStats.failed} failed)`
-                                    : "off", guardianStats ? "success" : "muted"),
-                                formatUiKeyValue(ui, "Last upstream request", lastRequest, "muted"),
+            ...(exposeAdvancedCodexTools
+                ? {
+                    "codex-metrics": tool({
+                        description: "Show runtime request metrics for this plugin process.",
+                        args: {},
+                        execute() {
+                            const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
+                            const now = Date.now();
+                            const uptimeMs = Math.max(0, now - runtimeMetrics.startedAt);
+                            const total = runtimeMetrics.totalRequests;
+                            const successful = runtimeMetrics.successfulRequests;
+                            const successRate = total > 0 ? ((successful / total) * 100).toFixed(1) : "0.0";
+                            const avgLatencyMs = successful > 0
+                                ? Math.round(runtimeMetrics.cumulativeLatencyMs / successful)
+                                : 0;
+                            const liveSyncSnapshot = liveAccountSync?.getSnapshot();
+                            const guardianStats = refreshGuardian?.getStats();
+                            const sessionAffinityEntries = sessionAffinityStore?.size() ?? 0;
+                            const lastRequest = runtimeMetrics.lastRequestAt !== null
+                                ? `${formatWaitTime(now - runtimeMetrics.lastRequestAt)} ago`
+                                : "never";
+                            const lines = [
+                                "Codex Plugin Metrics:",
+                                "",
+                                `Uptime: ${formatWaitTime(uptimeMs)}`,
+                                `Total upstream requests: ${total}`,
+                                `Successful responses: ${successful}`,
+                                `Failed responses: ${runtimeMetrics.failedRequests}`,
+                                `Success rate: ${successRate}%`,
+                                `Average successful latency: ${avgLatencyMs}ms`,
+                                `Rate-limited responses: ${runtimeMetrics.rateLimitedResponses}`,
+                                `Server errors (5xx): ${runtimeMetrics.serverErrors}`,
+                                `Network errors: ${runtimeMetrics.networkErrors}`,
+                                `User aborts: ${runtimeMetrics.userAborts}`,
+                                `Auth refresh failures: ${runtimeMetrics.authRefreshFailures}`,
+                                `Account rotations: ${runtimeMetrics.accountRotations}`,
+                                `Same-account retries: ${runtimeMetrics.sameAccountRetries}`,
+                                `Stream failover attempts: ${runtimeMetrics.streamFailoverAttempts}`,
+                                `Stream failover recoveries: ${runtimeMetrics.streamFailoverRecoveries}`,
+                                `Stream failover cross-account recoveries: ${runtimeMetrics.streamFailoverCrossAccountRecoveries}`,
+                                `Empty-response retries: ${runtimeMetrics.emptyResponseRetries}`,
+                                `Session affinity entries: ${sessionAffinityEntries}`,
+                                `Live sync: ${liveSyncSnapshot?.running ? "on" : "off"} (${liveSyncSnapshot?.reloadCount ?? 0} reloads)`,
+                                `Refresh guardian: ${guardianStats ? "on" : "off"} (${guardianStats?.refreshed ?? 0} refreshed, ${guardianStats?.failed ?? 0} failed)`,
+                                `Last upstream request: ${lastRequest}`,
                             ];
                             if (runtimeMetrics.lastError) {
-                                styled.push(formatUiKeyValue(ui, "Last error", runtimeMetrics.lastError, "danger"));
+                                lines.push(`Last error: ${runtimeMetrics.lastError}`);
                             }
-                            return Promise.resolve(styled.join("\n"));
-                        }
-                        return Promise.resolve(lines.join("\n"));
-                    },
-                }),
-            } : {}),
+                            if (ui.v2Enabled) {
+                                const styled = [
+                                    ...formatUiHeader(ui, "Codex plugin metrics"),
+                                    formatUiKeyValue(ui, "Uptime", formatWaitTime(uptimeMs)),
+                                    formatUiKeyValue(ui, "Total upstream requests", String(total)),
+                                    formatUiKeyValue(ui, "Successful responses", String(successful), "success"),
+                                    formatUiKeyValue(ui, "Failed responses", String(runtimeMetrics.failedRequests), "danger"),
+                                    formatUiKeyValue(ui, "Success rate", `${successRate}%`, "accent"),
+                                    formatUiKeyValue(ui, "Average successful latency", `${avgLatencyMs}ms`),
+                                    formatUiKeyValue(ui, "Rate-limited responses", String(runtimeMetrics.rateLimitedResponses), "warning"),
+                                    formatUiKeyValue(ui, "Server errors (5xx)", String(runtimeMetrics.serverErrors), "danger"),
+                                    formatUiKeyValue(ui, "Network errors", String(runtimeMetrics.networkErrors), "danger"),
+                                    formatUiKeyValue(ui, "User aborts", String(runtimeMetrics.userAborts), "muted"),
+                                    formatUiKeyValue(ui, "Auth refresh failures", String(runtimeMetrics.authRefreshFailures), "warning"),
+                                    formatUiKeyValue(ui, "Account rotations", String(runtimeMetrics.accountRotations), "accent"),
+                                    formatUiKeyValue(ui, "Same-account retries", String(runtimeMetrics.sameAccountRetries), "warning"),
+                                    formatUiKeyValue(ui, "Stream failover attempts", String(runtimeMetrics.streamFailoverAttempts), "muted"),
+                                    formatUiKeyValue(ui, "Stream failover recoveries", String(runtimeMetrics.streamFailoverRecoveries), "success"),
+                                    formatUiKeyValue(ui, "Stream failover cross-account recoveries", String(runtimeMetrics.streamFailoverCrossAccountRecoveries), "accent"),
+                                    formatUiKeyValue(ui, "Empty-response retries", String(runtimeMetrics.emptyResponseRetries), "warning"),
+                                    formatUiKeyValue(ui, "Session affinity entries", String(sessionAffinityEntries), "muted"),
+                                    formatUiKeyValue(ui, "Live sync", `${liveSyncSnapshot?.running ? "on" : "off"} (${liveSyncSnapshot?.reloadCount ?? 0} reloads)`, liveSyncSnapshot?.running ? "success" : "muted"),
+                                    formatUiKeyValue(ui, "Refresh guardian", guardianStats
+                                        ? `on (${guardianStats.refreshed} refreshed, ${guardianStats.failed} failed)`
+                                        : "off", guardianStats ? "success" : "muted"),
+                                    formatUiKeyValue(ui, "Last upstream request", lastRequest, "muted"),
+                                ];
+                                if (runtimeMetrics.lastError) {
+                                    styled.push(formatUiKeyValue(ui, "Last error", runtimeMetrics.lastError, "danger"));
+                                }
+                                return Promise.resolve(styled.join("\n"));
+                            }
+                            return Promise.resolve(lines.join("\n"));
+                        },
+                    }),
+                }
+                : {}),
             "codex-health": tool({
                 description: "Check health of all Codex accounts by validating refresh tokens.",
                 args: {},
                 async execute() {
-                    const ui = resolveUiRuntime();
+                    const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
                     const storage = await loadAccounts();
                     if (!storage || storage.accounts.length === 0) {
                         if (ui.v2Enabled) {
@@ -2917,255 +2266,268 @@ export const OpenAIOAuthPlugin = async ({ client }) => {
                     return results.join("\n");
                 },
             }),
-            ...(exposeAdvancedCodexTools ? {
-                "codex-remove": tool({
-                    description: "Remove a Codex account by index (1-based). Use codex-list to list accounts first.",
-                    args: {
-                        index: tool.schema.number().describe("Account number to remove (1-based, e.g., 1 for first account)"),
-                    },
-                    async execute({ index }) {
-                        const ui = resolveUiRuntime();
-                        const storage = await loadAccounts();
-                        if (!storage || storage.accounts.length === 0) {
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Remove account"),
-                                    "",
-                                    formatUiItem(ui, "No accounts configured.", "warning"),
-                                ].join("\n");
+            ...(exposeAdvancedCodexTools
+                ? {
+                    "codex-remove": tool({
+                        description: "Remove a Codex account by index (1-based). Use codex-list to list accounts first.",
+                        args: {
+                            index: tool.schema
+                                .number()
+                                .describe("Account number to remove (1-based, e.g., 1 for first account)"),
+                        },
+                        async execute({ index }) {
+                            const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
+                            const storage = await loadAccounts();
+                            if (!storage || storage.accounts.length === 0) {
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Remove account"),
+                                        "",
+                                        formatUiItem(ui, "No accounts configured.", "warning"),
+                                    ].join("\n");
+                                }
+                                return "No Codex accounts configured. Nothing to remove.";
                             }
-                            return "No Codex accounts configured. Nothing to remove.";
-                        }
-                        const targetIndex = Math.floor((index ?? 0) - 1);
-                        if (!Number.isFinite(targetIndex) ||
-                            targetIndex < 0 ||
-                            targetIndex >= storage.accounts.length) {
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Remove account"),
-                                    "",
-                                    formatUiItem(ui, `Invalid account number: ${index}`, "danger"),
-                                    formatUiKeyValue(ui, "Valid range", `1-${storage.accounts.length}`, "muted"),
-                                    formatUiItem(ui, "Use codex-list to list all accounts.", "accent"),
-                                ].join("\n");
+                            const targetIndex = Math.floor((index ?? 0) - 1);
+                            if (!Number.isFinite(targetIndex) ||
+                                targetIndex < 0 ||
+                                targetIndex >= storage.accounts.length) {
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Remove account"),
+                                        "",
+                                        formatUiItem(ui, `Invalid account number: ${index}`, "danger"),
+                                        formatUiKeyValue(ui, "Valid range", `1-${storage.accounts.length}`, "muted"),
+                                        formatUiItem(ui, "Use codex-list to list all accounts.", "accent"),
+                                    ].join("\n");
+                                }
+                                return `Invalid account number: ${index}\n\nValid range: 1-${storage.accounts.length}\n\nUse codex-list to list all accounts.`;
                             }
-                            return `Invalid account number: ${index}\n\nValid range: 1-${storage.accounts.length}\n\nUse codex-list to list all accounts.`;
-                        }
-                        const account = storage.accounts[targetIndex];
-                        if (!account) {
-                            return `Account ${index} not found.`;
-                        }
-                        const label = formatAccountLabel(account, targetIndex);
-                        storage.accounts.splice(targetIndex, 1);
-                        if (storage.accounts.length === 0) {
-                            storage.activeIndex = 0;
-                            storage.activeIndexByFamily = {};
-                        }
-                        else {
-                            if (storage.activeIndex >= storage.accounts.length) {
-                                storage.activeIndex = 0;
+                            const account = storage.accounts[targetIndex];
+                            if (!account) {
+                                return `Account ${index} not found.`;
                             }
-                            else if (storage.activeIndex > targetIndex) {
-                                storage.activeIndex -= 1;
+                            const label = formatAccountLabel(account, targetIndex);
+                            storage.accounts.splice(targetIndex, 1);
+                            if (storage.accounts.length === 0) {
+                                storage.activeIndex = 0;
+                                storage.activeIndexByFamily = {};
                             }
-                            if (storage.activeIndexByFamily) {
-                                for (const family of MODEL_FAMILIES) {
-                                    const idx = storage.activeIndexByFamily[family];
-                                    if (typeof idx === "number") {
-                                        if (idx >= storage.accounts.length) {
-                                            storage.activeIndexByFamily[family] = 0;
-                                        }
-                                        else if (idx > targetIndex) {
-                                            storage.activeIndexByFamily[family] = idx - 1;
+                            else {
+                                if (storage.activeIndex >= storage.accounts.length) {
+                                    storage.activeIndex = 0;
+                                }
+                                else if (storage.activeIndex > targetIndex) {
+                                    storage.activeIndex -= 1;
+                                }
+                                if (storage.activeIndexByFamily) {
+                                    for (const family of MODEL_FAMILIES) {
+                                        const idx = storage.activeIndexByFamily[family];
+                                        if (typeof idx === "number") {
+                                            if (idx >= storage.accounts.length) {
+                                                storage.activeIndexByFamily[family] = 0;
+                                            }
+                                            else if (idx > targetIndex) {
+                                                storage.activeIndexByFamily[family] = idx - 1;
+                                            }
                                         }
                                     }
                                 }
                             }
-                        }
-                        try {
-                            await saveAccounts(storage);
-                        }
-                        catch (saveError) {
-                            logWarn("Failed to save account removal", { error: String(saveError) });
+                            try {
+                                await saveAccounts(storage);
+                            }
+                            catch (saveError) {
+                                logWarn("Failed to save account removal", {
+                                    error: String(saveError),
+                                });
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Remove account"),
+                                        "",
+                                        formatUiItem(ui, `Removed ${formatAccountLabel(account, targetIndex)} from memory`, "warning"),
+                                        formatUiItem(ui, "Failed to persist. Change may be lost on restart.", "danger"),
+                                    ].join("\n");
+                                }
+                                return `Removed ${formatAccountLabel(account, targetIndex)} from memory but failed to persist. Changes may be lost on restart.`;
+                            }
+                            if (cachedAccountManager) {
+                                await reloadRuntimeAccountManager(makeReloadAccountManagerDeps());
+                            }
+                            const remaining = storage.accounts.length;
                             if (ui.v2Enabled) {
                                 return [
                                     ...formatUiHeader(ui, "Remove account"),
                                     "",
-                                    formatUiItem(ui, `Removed ${formatAccountLabel(account, targetIndex)} from memory`, "warning"),
-                                    formatUiItem(ui, "Failed to persist. Change may be lost on restart.", "danger"),
+                                    formatUiItem(ui, `${getStatusMarker(ui, "ok")} Removed: ${label}`, "success"),
+                                    remaining > 0
+                                        ? formatUiKeyValue(ui, "Remaining accounts", String(remaining))
+                                        : formatUiItem(ui, "No accounts remaining. Run: codex login", "warning"),
                                 ].join("\n");
                             }
-                            return `Removed ${formatAccountLabel(account, targetIndex)} from memory but failed to persist. Changes may be lost on restart.`;
-                        }
-                        if (cachedAccountManager) {
-                            await reloadAccountManagerFromDisk();
-                        }
-                        const remaining = storage.accounts.length;
-                        if (ui.v2Enabled) {
                             return [
-                                ...formatUiHeader(ui, "Remove account"),
+                                `Removed: ${label}`,
                                 "",
-                                formatUiItem(ui, `${getStatusMarker(ui, "ok")} Removed: ${label}`, "success"),
                                 remaining > 0
-                                    ? formatUiKeyValue(ui, "Remaining accounts", String(remaining))
-                                    : formatUiItem(ui, "No accounts remaining. Run: codex login", "warning"),
+                                    ? `Remaining accounts: ${remaining}`
+                                    : "No accounts remaining. Run: codex login",
                             ].join("\n");
-                        }
-                        return [
-                            `Removed: ${label}`,
-                            "",
-                            remaining > 0
-                                ? `Remaining accounts: ${remaining}`
-                                : "No accounts remaining. Run: codex login",
-                        ].join("\n");
-                    },
-                }),
-                "codex-refresh": tool({
-                    description: "Manually refresh OAuth tokens for all accounts to verify they're still valid.",
-                    args: {},
-                    async execute() {
-                        const ui = resolveUiRuntime();
-                        const storage = await loadAccounts();
-                        if (!storage || storage.accounts.length === 0) {
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Refresh accounts"),
-                                    "",
-                                    formatUiItem(ui, "No accounts configured.", "warning"),
-                                    formatUiItem(ui, "Run: codex login", "accent"),
-                                ].join("\n");
+                        },
+                    }),
+                    "codex-refresh": tool({
+                        description: "Manually refresh OAuth tokens for all accounts to verify they're still valid.",
+                        args: {},
+                        async execute() {
+                            const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
+                            const storage = await loadAccounts();
+                            if (!storage || storage.accounts.length === 0) {
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Refresh accounts"),
+                                        "",
+                                        formatUiItem(ui, "No accounts configured.", "warning"),
+                                        formatUiItem(ui, "Run: codex login", "accent"),
+                                    ].join("\n");
+                                }
+                                return "No Codex accounts configured. Run: codex login";
                             }
-                            return "No Codex accounts configured. Run: codex login";
-                        }
-                        const results = ui.v2Enabled
-                            ? []
-                            : [`Refreshing ${storage.accounts.length} account(s):`, ""];
-                        let refreshedCount = 0;
-                        let failedCount = 0;
-                        for (let i = 0; i < storage.accounts.length; i++) {
-                            const account = storage.accounts[i];
-                            if (!account)
-                                continue;
-                            const label = formatAccountLabel(account, i);
-                            try {
-                                const refreshResult = await queuedRefresh(account.refreshToken);
-                                if (refreshResult.type === "success") {
-                                    account.refreshToken = refreshResult.refresh;
-                                    account.accessToken = refreshResult.access;
-                                    account.expiresAt = refreshResult.expires;
-                                    results.push(`  ${getStatusMarker(ui, "ok")} ${label}: Refreshed`);
-                                    refreshedCount++;
+                            const results = ui.v2Enabled
+                                ? []
+                                : [`Refreshing ${storage.accounts.length} account(s):`, ""];
+                            let refreshedCount = 0;
+                            let failedCount = 0;
+                            for (let i = 0; i < storage.accounts.length; i++) {
+                                const account = storage.accounts[i];
+                                if (!account)
+                                    continue;
+                                const label = formatAccountLabel(account, i);
+                                try {
+                                    const refreshResult = await queuedRefresh(account.refreshToken);
+                                    if (refreshResult.type === "success") {
+                                        account.refreshToken = refreshResult.refresh;
+                                        account.accessToken = refreshResult.access;
+                                        account.expiresAt = refreshResult.expires;
+                                        results.push(`  ${getStatusMarker(ui, "ok")} ${label}: Refreshed`);
+                                        refreshedCount++;
+                                    }
+                                    else {
+                                        results.push(`  ${getStatusMarker(ui, "error")} ${label}: Failed - ${refreshResult.message ?? refreshResult.reason}`);
+                                        failedCount++;
+                                    }
                                 }
-                                else {
-                                    results.push(`  ${getStatusMarker(ui, "error")} ${label}: Failed - ${refreshResult.message ?? refreshResult.reason}`);
+                                catch (error) {
+                                    const errorMsg = error instanceof Error ? error.message : String(error);
+                                    results.push(`  ${getStatusMarker(ui, "error")} ${label}: Error - ${errorMsg.slice(0, 120)}`);
                                     failedCount++;
                                 }
                             }
-                            catch (error) {
-                                const errorMsg = error instanceof Error ? error.message : String(error);
-                                results.push(`  ${getStatusMarker(ui, "error")} ${label}: Error - ${errorMsg.slice(0, 120)}`);
-                                failedCount++;
-                            }
-                        }
-                        await saveAccounts(storage);
-                        if (cachedAccountManager) {
-                            await reloadAccountManagerFromDisk();
-                        }
-                        results.push("");
-                        results.push(`Summary: ${refreshedCount} refreshed, ${failedCount} failed`);
-                        if (ui.v2Enabled) {
-                            return [
-                                ...formatUiHeader(ui, "Refresh accounts"),
-                                "",
-                                ...results.map((line) => paintUiText(ui, line, "normal")),
-                            ].join("\n");
-                        }
-                        return results.join("\n");
-                    },
-                }),
-                "codex-export": tool({
-                    description: "Export accounts to a JSON file for backup or migration to another machine.",
-                    args: {
-                        path: tool.schema.string().describe("File path to export to (e.g., ~/codex-backup.json)"),
-                        force: tool.schema.boolean().optional().describe("Overwrite existing file (default: true)"),
-                    },
-                    async execute({ path: filePath, force }) {
-                        const ui = resolveUiRuntime();
-                        try {
-                            await exportAccounts(filePath, force ?? true);
-                            const storage = await loadAccounts();
-                            const count = storage?.accounts.length ?? 0;
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Export accounts"),
-                                    "",
-                                    formatUiItem(ui, `${getStatusMarker(ui, "ok")} Exported ${count} account(s)`, "success"),
-                                    formatUiKeyValue(ui, "Path", filePath, "muted"),
-                                ].join("\n");
+                            await saveAccounts(storage);
+                            if (cachedAccountManager) {
+                                await reloadRuntimeAccountManager(makeReloadAccountManagerDeps());
                             }
-                            return `Exported ${count} account(s) to: ${filePath}`;
-                        }
-                        catch (error) {
-                            const msg = error instanceof Error ? error.message : String(error);
+                            results.push("");
+                            results.push(`Summary: ${refreshedCount} refreshed, ${failedCount} failed`);
                             if (ui.v2Enabled) {
                                 return [
-                                    ...formatUiHeader(ui, "Export accounts"),
+                                    ...formatUiHeader(ui, "Refresh accounts"),
                                     "",
-                                    formatUiItem(ui, `${getStatusMarker(ui, "error")} Export failed`, "danger"),
-                                    formatUiKeyValue(ui, "Error", msg, "danger"),
+                                    ...results.map((line) => paintUiText(ui, line, "normal")),
                                 ].join("\n");
                             }
-                            return `Export failed: ${msg}`;
-                        }
-                    },
-                }),
-                "codex-import": tool({
-                    description: "Import accounts from a JSON file, merging with existing accounts.",
-                    args: {
-                        path: tool.schema.string().describe("File path to import from (e.g., ~/codex-backup.json)"),
-                    },
-                    async execute({ path: filePath }) {
-                        const ui = resolveUiRuntime();
-                        try {
-                            const result = await importAccounts(filePath);
-                            invalidateAccountManagerCache();
-                            const lines = [`Import complete.`, ``];
-                            if (result.imported > 0) {
-                                lines.push(`New accounts: ${result.imported}`);
+                            return results.join("\n");
+                        },
+                    }),
+                    "codex-export": tool({
+                        description: "Export accounts to a JSON file for backup or migration to another machine.",
+                        args: {
+                            path: tool.schema
+                                .string()
+                                .describe("File path to export to (e.g., ~/codex-backup.json)"),
+                            force: tool.schema
+                                .boolean()
+                                .optional()
+                                .describe("Overwrite existing file (default: true)"),
+                        },
+                        async execute({ path: filePath, force }) {
+                            const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
+                            try {
+                                await exportAccounts(filePath, force ?? true);
+                                const storage = await loadAccounts();
+                                const count = storage?.accounts.length ?? 0;
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Export accounts"),
+                                        "",
+                                        formatUiItem(ui, `${getStatusMarker(ui, "ok")} Exported ${count} account(s)`, "success"),
+                                        formatUiKeyValue(ui, "Path", filePath, "muted"),
+                                    ].join("\n");
+                                }
+                                return `Exported ${count} account(s) to: ${filePath}`;
                             }
-                            if (result.skipped > 0) {
-                                lines.push(`Duplicates skipped: ${result.skipped}`);
+                            catch (error) {
+                                const msg = error instanceof Error ? error.message : String(error);
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Export accounts"),
+                                        "",
+                                        formatUiItem(ui, `${getStatusMarker(ui, "error")} Export failed`, "danger"),
+                                        formatUiKeyValue(ui, "Error", msg, "danger"),
+                                    ].join("\n");
+                                }
+                                return `Export failed: ${msg}`;
                             }
-                            lines.push(`Total accounts: ${result.total}`);
-                            if (ui.v2Enabled) {
-                                const styled = [
-                                    ...formatUiHeader(ui, "Import accounts"),
-                                    "",
-                                    formatUiItem(ui, `${getStatusMarker(ui, "ok")} Import complete`, "success"),
-                                    formatUiKeyValue(ui, "Path", filePath, "muted"),
-                                    formatUiKeyValue(ui, "New accounts", String(result.imported), result.imported > 0 ? "success" : "muted"),
-                                    formatUiKeyValue(ui, "Duplicates skipped", String(result.skipped), result.skipped > 0 ? "warning" : "muted"),
-                                    formatUiKeyValue(ui, "Total accounts", String(result.total), "accent"),
-                                ];
-                                return styled.join("\n");
+                        },
+                    }),
+                    "codex-import": tool({
+                        description: "Import accounts from a JSON file, merging with existing accounts.",
+                        args: {
+                            path: tool.schema
+                                .string()
+                                .describe("File path to import from (e.g., ~/codex-backup.json)"),
+                        },
+                        async execute({ path: filePath }) {
+                            const ui = applyUiRuntimeFromConfig(loadPluginConfig(), setUiRuntimeOptions);
+                            try {
+                                const result = await importAccounts(filePath);
+                                invalidateRuntimeAccountManagerCache(accountManagerCacheInvalidationDeps);
+                                const lines = [`Import complete.`, ``];
+                                if (result.imported > 0) {
+                                    lines.push(`New accounts: ${result.imported}`);
+                                }
+                                if (result.skipped > 0) {
+                                    lines.push(`Duplicates skipped: ${result.skipped}`);
+                                }
+                                lines.push(`Total accounts: ${result.total}`);
+                                if (ui.v2Enabled) {
+                                    const styled = [
+                                        ...formatUiHeader(ui, "Import accounts"),
+                                        "",
+                                        formatUiItem(ui, `${getStatusMarker(ui, "ok")} Import complete`, "success"),
+                                        formatUiKeyValue(ui, "Path", filePath, "muted"),
+                                        formatUiKeyValue(ui, "New accounts", String(result.imported), result.imported > 0 ? "success" : "muted"),
+                                        formatUiKeyValue(ui, "Duplicates skipped", String(result.skipped), result.skipped > 0 ? "warning" : "muted"),
+                                        formatUiKeyValue(ui, "Total accounts", String(result.total), "accent"),
+                                    ];
+                                    return styled.join("\n");
+                                }
+                                return lines.join("\n");
                             }
-                            return lines.join("\n");
-                        }
-                        catch (error) {
-                            const msg = error instanceof Error ? error.message : String(error);
-                            if (ui.v2Enabled) {
-                                return [
-                                    ...formatUiHeader(ui, "Import accounts"),
-                                    "",
-                                    formatUiItem(ui, `${getStatusMarker(ui, "error")} Import failed`, "danger"),
-                                    formatUiKeyValue(ui, "Error", msg, "danger"),
-                                ].join("\n");
+                            catch (error) {
+                                const msg = error instanceof Error ? error.message : String(error);
+                                if (ui.v2Enabled) {
+                                    return [
+                                        ...formatUiHeader(ui, "Import accounts"),
+                                        "",
+                                        formatUiItem(ui, `${getStatusMarker(ui, "error")} Import failed`, "danger"),
+                                        formatUiKeyValue(ui, "Error", msg, "danger"),
+                                    ].join("\n");
+                                }
+                                return `Import failed: ${msg}`;
                             }
-                            return `Import failed: ${msg}`;
-                        }
-                    },
-                }),
-            } : {}),
+                        },
+                    }),
+                }
+                : {}),
         },
     };
 };