codex-multi-auth 1.1.11 → 1.2.1

package/dist/lib/codex-manager.js

@@ -1,28 +1,42 @@
-import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { promises as fs, existsSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
 import { createAuthorizationFlow, exchangeAuthorizationCode, parseAuthorizationInput, REDIRECT_URI, } from "./auth/auth.js";
+import { copyTextToClipboard, isBrowserLaunchSuppressed, openBrowserUrl, } from "./auth/browser.js";
 import { startLocalOAuthServer } from "./auth/server.js";
-import { copyTextToClipboard, openBrowserUrl } from "./auth/browser.js";
-import { promptAddAnotherAccount, promptLoginMode } from "./cli.js";
-import { extractAccountEmail, extractAccountId, formatAccountLabel, formatCooldown, formatWaitTime, getAccountIdCandidates, resolveRequestAccountId, sanitizeEmail, selectBestAccountCandidate, shouldUpdateAccountIdFromToken, } from "./accounts.js";
+import { promptAddAnotherAccount, promptLoginMode, } from "./cli.js";
+import { loadCodexCliState } from "./codex-cli/state.js";
+import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
+import { runBestCommand, } from "./codex-manager/commands/best.js";
+import { runCheckCommand } from "./codex-manager/commands/check.js";
+import { runConfigExplainCommand } from "./codex-manager/commands/config-explain.js";
+import { runDebugBundleCommand } from "./codex-manager/commands/debug-bundle.js";
+import { runDoctor as runRepairDoctor, runFix as runRepairFix, runVerifyFlagged as runRepairVerifyFlagged, } from "./codex-manager/repair-commands.js";
+import { runForecastCommand } from "./codex-manager/commands/forecast.js";
+import { runInitConfigCommand } from "./codex-manager/commands/init-config.js";
+import { runReportCommand } from "./codex-manager/commands/report.js";
+import { runFeaturesCommand, runStatusCommand, } from "./codex-manager/commands/status.js";
+import { runSwitchCommand } from "./codex-manager/commands/switch.js";
+import { parseAuthLoginArgs, printUsage } from "./codex-manager/help.js";
+import { applyUiThemeFromDashboardSettings, configureUnifiedSettings, resolveMenuLayoutMode, } from "./codex-manager/settings-hub.js";
+import { getPluginConfigExplainReport } from "./config.js";
 import { ACCOUNT_LIMITS } from "./constants.js";
-import { loadDashboardDisplaySettings, DEFAULT_DASHBOARD_DISPLAY_SETTINGS, } from "./dashboard-settings.js";
-import { evaluateForecastAccounts, isHardRefreshFailure, recommendForecastAccount, summarizeForecast, } from "./forecast.js";
+import { DEFAULT_DASHBOARD_DISPLAY_SETTINGS, loadDashboardDisplaySettings, } from "./dashboard-settings.js";
+import { evaluateForecastAccounts, recommendForecastAccount, summarizeForecast, } from "./forecast.js";
+import { createLogger } from "./logger.js";
 import { MODEL_FAMILIES } from "./prompts/codex.js";
+import { getModelCapabilities, getModelProfile, resolveNormalizedModel, } from "./request/helpers/model-map.js";
+import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
 import { fetchCodexQuotaSnapshot, formatQuotaSnapshotLine, } from "./quota-probe.js";
 import { queuedRefresh } from "./refresh-queue.js";
-import { loadQuotaCache, saveQuotaCache, } from "./quota-cache.js";
-import { clearAccounts, findMatchingAccountIndex, getStoragePath, loadFlaggedAccounts, loadAccounts, saveFlaggedAccounts, saveAccounts, setStoragePath, withAccountAndFlaggedStorageTransaction, withAccountStorageTransaction, } from "./storage.js";
-import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "./codex-cli/state.js";
-import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
+import { clearAccounts, findMatchingAccountIndex, formatStorageErrorHint, getLastAccountsSaveTimestamp, getNamedBackups, getStoragePath, loadAccounts, loadFlaggedAccounts, restoreAccountsFromBackup, StorageError, saveAccounts, setStoragePath, withAccountStorageTransaction, } from "./storage.js";
 import { ANSI } from "./ui/ansi.js";
+import { confirm } from "./ui/confirm.js";
 import { UI_COPY } from "./ui/copy.js";
 import { paintUiText, quotaToneFromLeftPercent } from "./ui/format.js";
 import { getUiRuntimeOptions } from "./ui/runtime.js";
 import { select } from "./ui/select.js";
-import { applyUiThemeFromDashboardSettings, configureUnifiedSettings, resolveMenuLayoutMode } from "./codex-manager/settings-hub.js";
+const log = createLogger("codex-manager");
 function stylePromptText(text, tone) {
     if (!output.isTTY)
         return text;
@@ -45,6 +59,28 @@ function stylePromptText(text, tone) {
                     : ANSI.dim;
     return `${legacyCode}${text}${ANSI.reset}`;
 }
+function inspectRequestedModel(requestedModel) {
+    const normalized = resolveNormalizedModel(requestedModel);
+    const profile = getModelProfile(normalized);
+    return {
+        requested: requestedModel,
+        normalized,
+        remapped: requestedModel !== normalized,
+        promptFamily: profile.promptFamily,
+        capabilities: getModelCapabilities(normalized),
+    };
+}
+function formatModelInspection(model) {
+    const route = model.remapped
+        ? `${model.requested} -> ${model.normalized}`
+        : model.normalized;
+    return [
+        route,
+        `prompt family ${model.promptFamily}`,
+        `tool search ${model.capabilities.toolSearch ? "yes" : "no"}`,
+        `computer use ${model.capabilities.computerUse ? "yes" : "no"}`,
+    ].join(" | ");
+}
 function collapseWhitespace(value) {
     return value.replace(/\s+/g, " ").trim();
 }
@@ -61,11 +97,10 @@ function extractErrorMessageFromPayload(payload) {
     const directMessage = typeof record.message === "string"
         ? collapseWhitespace(record.message)
         : "";
-    const directCode = typeof record.code === "string"
-        ? collapseWhitespace(record.code)
-        : "";
+    const directCode = typeof record.code === "string" ? collapseWhitespace(record.code) : "";
     if (directMessage) {
-        if (directCode && !directMessage.toLowerCase().includes(directCode.toLowerCase())) {
+        if (directCode &&
+            !directMessage.toLowerCase().includes(directCode.toLowerCase())) {
             return `${directMessage} [${directCode}]`;
         }
         return directMessage;
@@ -117,11 +152,36 @@ function formatResultSummary(segments) {
     const rendered = segments.map((segment) => stylePromptText(segment.text, segment.tone));
     return `${stylePromptText("Result:", "accent")} ${joinStyledSegments(rendered)}`;
 }
+function createRepairCommandDeps() {
+    return {
+        stylePromptText,
+        styleAccountDetailText,
+        formatResultSummary,
+        resolveActiveIndex,
+        hasUsableAccessToken,
+        hasLikelyInvalidRefreshToken,
+        normalizeFailureDetail,
+        buildQuotaEmailFallbackState,
+        updateQuotaCacheForAccount,
+        cloneQuotaCacheData,
+        pruneUnsafeQuotaEmailCacheEntry,
+        formatCompactQuotaSnapshot,
+        resolveStoredAccountIdentity,
+        applyTokenAccountIdentity,
+    };
+}
+function isOAuthCancellation(result) {
+    const message = (result.message ?? result.reason ?? "").trim().toLowerCase();
+    return message.includes("cancelled") || message.includes("canceled");
+}
 function styleQuotaSummary(summary) {
     const normalized = collapseWhitespace(summary);
     if (!normalized)
         return stylePromptText(summary, "muted");
-    const segments = normalized.split("|").map((segment) => segment.trim()).filter(Boolean);
+    const segments = normalized
+        .split("|")
+        .map((segment) => segment.trim())
+        .filter(Boolean);
     if (segments.length === 0)
         return stylePromptText(normalized, "muted");
     const rendered = segments.map((segment) => {
@@ -204,35 +264,6 @@ function isAbortError(error) {
     const maybe = error;
     return maybe.name === "AbortError" || maybe.code === "ABORT_ERR";
 }
-function isUserCancelledOAuth(result) {
-    if (result.type !== "failed")
-        return false;
-    const message = (result.message ?? "").toLowerCase();
-    return message.includes("cancelled");
-}
-function printUsage() {
-    console.log([
-        "Codex Multi-Auth CLI",
-        "",
-        "Usage:",
-        "  codex auth login",
-        "  codex auth list",
-        "  codex auth status",
-        "  codex auth switch <index>",
-        "  codex auth best [--live] [--json] [--model <model>]",
-        "  codex auth check",
-        "  codex auth features",
-        "  codex auth verify-flagged [--dry-run] [--json] [--no-restore]",
-        "  codex auth forecast [--live] [--json] [--model <model>]",
-        "  codex auth report [--live] [--json] [--model <model>] [--out <path>]",
-        "  codex auth fix [--dry-run] [--json] [--live] [--model <model>]",
-        "  codex auth doctor [--json] [--fix] [--dry-run]",
-        "",
-        "Notes:",
-        "  - Uses ~/.codex/multi-auth/openai-codex-accounts.json",
-        "  - Syncs active account into Codex CLI auth state",
-    ].join("\n"));
-}
 const IMPLEMENTED_FEATURES = [
     { id: 1, name: "Multi-account OAuth login dashboard" },
     { id: 2, name: "Account add/update dedupe by token/id/email" },
@@ -276,14 +307,6 @@ const IMPLEMENTED_FEATURES = [
     { id: 40, name: "OAuth browser-first flow with manual callback fallback" },
     { id: 41, name: "Auto-switch to best account command" },
 ];
-function runFeaturesReport() {
-    console.log(`Implemented features (${IMPLEMENTED_FEATURES.length})`);
-    console.log("");
-    for (const feature of IMPLEMENTED_FEATURES) {
-        console.log(`${feature.id}. ${feature.name}`);
-    }
-    return 0;
-}
 function resolveActiveIndex(storage, family = "codex") {
     const total = storage.accounts.length;
     if (total === 0)
@@ -614,7 +637,8 @@ const ACCESS_TOKEN_FRESH_WINDOW_MS = 5 * 60 * 1000;
 function hasUsableAccessToken(account, now) {
     if (!account.accessToken)
         return false;
-    if (typeof account.expiresAt !== "number" || !Number.isFinite(account.expiresAt))
+    if (typeof account.expiresAt !== "number" ||
+        !Number.isFinite(account.expiresAt))
         return false;
     return account.expiresAt - now > ACCESS_TOKEN_FRESH_WINDOW_MS;
 }
@@ -629,7 +653,8 @@ function hasLikelyInvalidRefreshToken(refreshToken) {
 function mapAccountStatus(account, index, activeIndex, now) {
     if (account.enabled === false)
         return "disabled";
-    if (typeof account.coolingDownUntil === "number" && account.coolingDownUntil > now) {
+    if (typeof account.coolingDownUntil === "number" &&
+        account.coolingDownUntil > now) {
         return "cooldown";
     }
     const rateLimit = formatRateLimitEntry(account, now, "codex");
@@ -649,7 +674,9 @@ function parseLeftPercentFromQuotaSummary(summary, windowLabel) {
     return Math.max(0, Math.min(100, value));
 }
 function readQuotaLeftPercent(account, windowLabel) {
-    const direct = windowLabel === "5h" ? account.quota5hLeftPercent : account.quota7dLeftPercent;
+    const direct = windowLabel === "5h"
+        ? account.quota5hLeftPercent
+        : account.quota7dLeftPercent;
     if (typeof direct === "number" && Number.isFinite(direct)) {
         return Math.max(0, Math.min(100, Math.round(direct)));
     }
@@ -682,7 +709,8 @@ function compareReadyFirstAccounts(left, right) {
     const right7d = readQuotaLeftPercent(right, "7d");
     if (left7d !== right7d)
         return right7d - left7d;
-    const bucketDelta = accountStatusSortBucket(left.status) - accountStatusSortBucket(right.status);
+    const bucketDelta = accountStatusSortBucket(left.status) -
+        accountStatusSortBucket(right.status);
     if (bucketDelta !== 0)
         return bucketDelta;
     const leftLastUsed = left.lastUsed ?? 0;
@@ -694,14 +722,19 @@ function compareReadyFirstAccounts(left, right) {
     return leftSource - rightSource;
 }
 function applyAccountMenuOrdering(accounts, displaySettings) {
-    const sortEnabled = displaySettings.menuSortEnabled ?? (DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortEnabled ?? true);
-    const sortMode = displaySettings.menuSortMode ?? (DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortMode ?? "ready-first");
+    const sortEnabled = displaySettings.menuSortEnabled ??
+        DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortEnabled ??
+        true;
+    const sortMode = displaySettings.menuSortMode ??
+        DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortMode ??
+        "ready-first";
     if (!sortEnabled || sortMode !== "ready-first") {
         return [...accounts];
     }
     const sorted = [...accounts].sort(compareReadyFirstAccounts);
     const pinCurrent = displaySettings.menuSortPinCurrent ??
-        (DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortPinCurrent ?? false);
+        DEFAULT_DASHBOARD_DISPLAY_SETTINGS.menuSortPinCurrent ??
+        false;
     if (pinCurrent) {
         const currentIndex = sorted.findIndex((account) => account.isCurrentAccount);
         if (currentIndex > 0) {
@@ -752,7 +785,11 @@ function toExistingAccountInfo(storage, quotaCache, displaySettings) {
             showHintsForUnselectedRows: layoutMode === "expanded-rows",
             highlightCurrentRow: displaySettings.menuHighlightCurrentRow ?? true,
             focusStyle: displaySettings.menuFocusStyle ?? "row-invert",
-            statuslineFields: displaySettings.menuStatuslineFields ?? ["last-used", "limits", "status"],
+            statuslineFields: displaySettings.menuStatuslineFields ?? [
+                "last-used",
+                "limits",
+                "status",
+            ],
         };
     });
     const orderedAccounts = applyAccountMenuOrdering(baseAccounts, displaySettings);
@@ -821,23 +858,72 @@ function applyTokenAccountIdentity(account, tokenAccountId) {
     if (!nextIdentity.accountId) {
         return false;
     }
-    if (nextIdentity.accountId === account.accountId
-        && nextIdentity.accountIdSource === account.accountIdSource) {
+    if (nextIdentity.accountId === account.accountId &&
+        nextIdentity.accountIdSource === account.accountIdSource) {
         return false;
     }
     account.accountId = nextIdentity.accountId;
     account.accountIdSource = nextIdentity.accountIdSource;
     return true;
 }
-async function promptManualCallback(state) {
-    if (!input.isTTY || !output.isTTY) {
+async function promptManualCallback(state, options = {}) {
+    const useInteractivePrompt = input.isTTY && output.isTTY;
+    if (!useInteractivePrompt && !options.allowNonTty) {
         return null;
     }
     const rl = createInterface({ input, output });
     try {
-        console.log("");
-        console.log(stylePromptText(UI_COPY.oauth.pastePrompt, "accent"));
-        const answer = await rl.question("◆  ");
+        if (useInteractivePrompt) {
+            console.log("");
+            console.log(stylePromptText(UI_COPY.oauth.pastePrompt, "accent"));
+        }
+        const answer = useInteractivePrompt
+            ? await rl.question("◆  ")
+            : await new Promise((resolve, reject) => {
+                if (input.readableEnded || input.destroyed) {
+                    resolve(null);
+                    return;
+                }
+                let settled = false;
+                const handleInputClosed = () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(null);
+                };
+                const finish = (value) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    resolve(value);
+                };
+                const fail = (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    input.off("end", handleInputClosed);
+                    input.off("close", handleInputClosed);
+                    reject(error);
+                };
+                rl.question("")
+                    .then((value) => finish(value))
+                    .catch((error) => {
+                    if (isAbortError(error) || isReadlineClosedError(error)) {
+                        handleInputClosed();
+                        return;
+                    }
+                    fail(error);
+                });
+                input.once("end", handleInputClosed);
+                input.once("close", handleInputClosed);
+            });
+        if (answer === null) {
+            return null;
+        }
         if (answer.includes("\u001b")) {
             return null;
         }
@@ -857,7 +943,7 @@ async function promptManualCallback(state) {
         return parsed.code;
     }
     catch (error) {
-        if (isAbortError(error)) {
+        if (isAbortError(error) || isReadlineClosedError(error)) {
             return null;
         }
         throw error;
@@ -866,20 +952,65 @@ async function promptManualCallback(state) {
         rl.close();
     }
 }
-async function promptOAuthSignInMode() {
+function isReadlineClosedError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const errorCode = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code)
+        : "";
+    return (errorCode === "ERR_USE_AFTER_CLOSE" ||
+        /readline was closed/i.test(error.message));
+}
+export function formatBackupSavedAt(mtimeMs) {
+    return new Date(mtimeMs).toLocaleString(undefined, {
+        month: "short",
+        day: "numeric",
+        year: "numeric",
+        hour: "numeric",
+        minute: "2-digit",
+    });
+}
+async function promptOAuthSignInMode(backupOption, backupDiscoveryWarning = null) {
     if (!input.isTTY || !output.isTTY) {
         return "browser";
     }
     const ui = getUiRuntimeOptions();
     const items = [
+        {
+            label: UI_COPY.oauth.signInHeading,
+            value: "cancel",
+            kind: "heading",
+        },
         { label: UI_COPY.oauth.openBrowser, value: "browser", color: "green" },
         { label: UI_COPY.oauth.manualMode, value: "manual", color: "yellow" },
+        ...(backupOption
+            ? [
+                { separator: true, label: "", value: "cancel" },
+                {
+                    label: UI_COPY.oauth.restoreHeading,
+                    value: "cancel",
+                    kind: "heading",
+                },
+                {
+                    label: UI_COPY.oauth.restoreSavedBackup,
+                    value: "restore-backup",
+                    hint: UI_COPY.oauth.loadLastBackupHint(backupOption.fileName, backupOption.accountCount, formatBackupSavedAt(backupOption.mtimeMs)),
+                    color: "cyan",
+                },
+            ]
+            : []),
+        { separator: true, label: "", value: "cancel" },
         { label: UI_COPY.oauth.back, value: "cancel", color: "red" },
     ];
     const selected = await select(items, {
         message: UI_COPY.oauth.chooseModeTitle,
-        subtitle: UI_COPY.oauth.chooseModeSubtitle,
-        help: UI_COPY.oauth.chooseModeHelp,
+        subtitle: backupDiscoveryWarning
+            ? `${UI_COPY.oauth.chooseModeSubtitle} ${backupDiscoveryWarning}`
+            : UI_COPY.oauth.chooseModeSubtitle,
+        help: backupOption
+            ? UI_COPY.oauth.chooseModeHelpWithBackup
+            : UI_COPY.oauth.chooseModeHelp,
         clearScreen: true,
         theme: ui.theme,
         selectedEmphasis: "minimal",
@@ -892,11 +1023,81 @@ async function promptOAuthSignInMode() {
                 return "browser";
             if (lower === "2")
                 return "manual";
+            if (lower === "3" && backupOption)
+                return "restore-backup";
             return undefined;
         },
     });
     return selected ?? "cancel";
 }
+async function promptBackupRestoreMode(latestBackup) {
+    if (!input.isTTY || !output.isTTY) {
+        return "latest";
+    }
+    const ui = getUiRuntimeOptions();
+    const items = [
+        {
+            label: UI_COPY.oauth.loadLastBackup,
+            value: "latest",
+            hint: `${UI_COPY.oauth.restoreBackupLatestHint}\n${UI_COPY.oauth.manualBackupHint(latestBackup.accountCount, formatBackupSavedAt(latestBackup.mtimeMs))}`,
+            color: "cyan",
+        },
+        {
+            label: UI_COPY.oauth.chooseBackupManually,
+            value: "manual",
+            color: "yellow",
+        },
+        { label: UI_COPY.oauth.back, value: "back", color: "red" },
+    ];
+    const selected = await select(items, {
+        message: UI_COPY.oauth.restoreBackupTitle,
+        subtitle: UI_COPY.oauth.restoreBackupSubtitle,
+        help: UI_COPY.oauth.restoreBackupHelp,
+        clearScreen: true,
+        theme: ui.theme,
+        selectedEmphasis: "minimal",
+        allowEscape: false,
+        onInput: (raw) => {
+            const lower = raw.toLowerCase();
+            if (lower === "q")
+                return "back";
+            if (lower === "1")
+                return "latest";
+            if (lower === "2")
+                return "manual";
+            return undefined;
+        },
+    });
+    return selected ?? "back";
+}
+async function promptManualBackupSelection(backups) {
+    if (!input.isTTY || !output.isTTY) {
+        return backups[0] ?? null;
+    }
+    const ui = getUiRuntimeOptions();
+    const items = backups.map((backup) => ({
+        label: backup.fileName,
+        value: backup,
+        hint: UI_COPY.oauth.manualBackupHint(backup.accountCount, formatBackupSavedAt(backup.mtimeMs)),
+        color: "cyan",
+    }));
+    items.push({ label: UI_COPY.oauth.back, value: null, color: "red" });
+    const selected = await select(items, {
+        message: UI_COPY.oauth.manualBackupTitle,
+        subtitle: UI_COPY.oauth.manualBackupSubtitle,
+        help: UI_COPY.oauth.manualBackupHelp,
+        clearScreen: true,
+        theme: ui.theme,
+        selectedEmphasis: "minimal",
+        allowEscape: false,
+        onInput: (raw) => {
+            if (raw.toLowerCase() === "q")
+                return null;
+            return undefined;
+        },
+    });
+    return selected;
+}
 async function waitForMenuReturn(options = {}) {
     if (!input.isTTY || !output.isTTY) {
         return;
@@ -1142,18 +1343,29 @@ async function runActionPanel(title, stage, action, settings) {
         throw failed;
     }
 }
-async function runOAuthFlow(forceNewLogin) {
+async function runOAuthFlow(forceNewLogin, signInMode) {
     const { pkce, state, url } = await createAuthorizationFlow({ forceNewLogin });
-    const oauthServer = await startLocalOAuthServer({ state });
     let code = null;
+    let oauthServer = null;
     try {
-        const signInMode = await promptOAuthSignInMode();
-        if (signInMode === "cancel") {
-            return {
-                type: "failed",
-                reason: "unknown",
-                message: UI_COPY.oauth.cancelled,
-            };
+        if (signInMode === "browser") {
+            try {
+                oauthServer = await startLocalOAuthServer({ state });
+            }
+            catch (serverError) {
+                log.warn("Local OAuth callback server unavailable; falling back to manual callback entry.", serverError instanceof Error
+                    ? {
+                        message: serverError.message,
+                        stack: serverError.stack,
+                        code: typeof serverError === "object" &&
+                            serverError !== null &&
+                            "code" in serverError
+                            ? String(serverError.code)
+                            : undefined,
+                    }
+                    : { error: String(serverError) });
+                oauthServer = null;
+            }
         }
         if (signInMode === "browser") {
             const opened = openBrowserUrl(url);
@@ -1172,18 +1384,25 @@ async function runOAuthFlow(forceNewLogin) {
             const copied = copyTextToClipboard(url);
             console.log(stylePromptText(copied ? UI_COPY.oauth.copyOk : UI_COPY.oauth.copyFail, copied ? "success" : "warning"));
         }
-        if (oauthServer.ready) {
+        const waitingForCallback = signInMode === "browser" && oauthServer?.ready === true;
+        if (waitingForCallback && oauthServer) {
             console.log(stylePromptText(UI_COPY.oauth.waitingCallback, "muted"));
             const callbackResult = await oauthServer.waitForCode(state);
             code = callbackResult?.code ?? null;
         }
         if (!code) {
-            console.log(stylePromptText(UI_COPY.oauth.callbackMissed, "warning"));
-            code = await promptManualCallback(state);
+            console.log(stylePromptText(waitingForCallback
+                ? UI_COPY.oauth.callbackMissed
+                : signInMode === "manual"
+                    ? UI_COPY.oauth.callbackBypassed
+                    : UI_COPY.oauth.callbackUnavailable, "warning"));
+            code = await promptManualCallback(state, {
+                allowNonTty: signInMode === "manual",
+            });
         }
     }
     finally {
-        oauthServer.close();
+        oauthServer?.close();
     }
     if (!code) {
         return {
@@ -1206,7 +1425,8 @@ async function persistAccountPool(results, replaceAll) {
             const tokenAccountId = extractAccountId(result.access);
             const accountId = resolveRequestAccountId(result.accountIdOverride, result.accountIdSource, tokenAccountId);
             const accountIdSource = accountId
-                ? (result.accountIdSource ?? (result.accountIdOverride ? "manual" : "token"))
+                ? (result.accountIdSource ??
+                    (result.accountIdOverride ? "manual" : "token"))
                 : undefined;
             const accountLabel = result.accountLabel;
             const accountEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
@@ -1289,47 +1509,11 @@ async function syncSelectionToCodex(tokens) {
         idToken: tokens.idToken,
     });
 }
-async function showAccountStatus() {
-    setStoragePath(null);
-    const storage = await loadAccounts();
-    const path = getStoragePath();
-    if (!storage || storage.accounts.length === 0) {
-        console.log("No accounts configured.");
-        console.log(`Storage: ${path}`);
-        return;
-    }
-    const now = Date.now();
-    const activeIndex = resolveActiveIndex(storage, "codex");
-    console.log(`Accounts (${storage.accounts.length})`);
-    console.log(`Storage: ${path}`);
-    console.log("");
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account)
-            continue;
-        const label = formatAccountLabel(account, i);
-        const markers = [];
-        if (i === activeIndex)
-            markers.push("current");
-        if (account.enabled === false)
-            markers.push("disabled");
-        const rateLimit = formatRateLimitEntry(account, now, "codex");
-        if (rateLimit)
-            markers.push("rate-limited");
-        const cooldown = formatCooldown(account, now);
-        if (cooldown)
-            markers.push(`cooldown:${cooldown}`);
-        const markerLabel = markers.length > 0 ? ` [${markers.join(", ")}]` : "";
-        const lastUsed = typeof account.lastUsed === "number" && account.lastUsed > 0
-            ? `used ${formatWaitTime(now - account.lastUsed)} ago`
-            : "never used";
-        console.log(`${i + 1}. ${label}${markerLabel} ${lastUsed}`);
-    }
-}
 async function runHealthCheck(options = {}) {
     const forceRefresh = options.forceRefresh === true;
     const liveProbe = options.liveProbe === true;
     const probeModel = options.model?.trim() || "gpt-5-codex";
+    const modelInspection = inspectRequestedModel(probeModel);
     const display = options.display ?? DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
     const quotaCache = liveProbe ? await loadQuotaCache() : null;
     const workingQuotaCache = quotaCache ? cloneQuotaCacheData(quotaCache) : null;
@@ -1353,6 +1537,9 @@ async function runHealthCheck(options = {}) {
     console.log(stylePromptText(forceRefresh
         ? `Checking ${storage.accounts.length} account(s) with full refresh test...`
         : `Checking ${storage.accounts.length} account(s) with quick check${liveProbe ? " + live check" : ""}...`, "accent"));
+    if (liveProbe) {
+        console.log(stylePromptText(`Model probe: ${formatModelInspection(modelInspection)}`, "muted"));
+    }
     for (let i = 0; i < storage.accounts.length; i += 1) {
         const account = storage.accounts[i];
         if (!account)
@@ -1376,14 +1563,15 @@ async function runHealthCheck(options = {}) {
                     : undefined;
                 if (!probeAccountId || !currentAccessToken) {
                     warnings += 1;
-                    healthDetail = "signed in and working (live check skipped: missing account ID)";
+                    healthDetail =
+                        "signed in and working (live check skipped: missing account ID)";
                 }
                 else {
                     try {
                         const snapshot = await fetchCodexQuotaSnapshot({
                             accountId: probeAccountId,
                             accessToken: currentAccessToken,
-                            model: probeModel,
+                            model: modelInspection.normalized,
                         });
                         if (workingQuotaCache) {
                             quotaCacheChanged =
@@ -1453,14 +1641,15 @@ async function runHealthCheck(options = {}) {
                 const probeAccountId = account.accountId ?? tokenAccountId;
                 if (!probeAccountId) {
                     warnings += 1;
-                    healthyMessage = "working now (live check skipped: missing account ID)";
+                    healthyMessage =
+                        "working now (live check skipped: missing account ID)";
                 }
                 else {
                     try {
                         const snapshot = await fetchCodexQuotaSnapshot({
                             accountId: probeAccountId,
                             accessToken: result.access,
-                            model: probeModel,
+                            model: modelInspection.normalized,
                         });
                         if (workingQuotaCache) {
                             quotaCacheChanged =
@@ -1504,7 +1693,9 @@ async function runHealthCheck(options = {}) {
     if (changed) {
         await saveAccounts(storage);
     }
-    if (activeAccountRefreshed && activeIndex >= 0 && activeIndex < storage.accounts.length) {
+    if (activeAccountRefreshed &&
+        activeIndex >= 0 &&
+        activeIndex < storage.accounts.length) {
         const activeAccount = storage.accounts[activeIndex];
         if (activeAccount) {
             await setCodexCliActiveSelection({
@@ -1519,21 +1710,16 @@ async function runHealthCheck(options = {}) {
     console.log("");
     console.log(formatResultSummary([
         { text: `${ok} working`, tone: "success" },
-        { text: `${failed} need re-login`, tone: failed > 0 ? "danger" : "muted" },
-        { text: `${warnings} warning${warnings === 1 ? "" : "s"}`, tone: warnings > 0 ? "warning" : "muted" },
+        {
+            text: `${failed} need re-login`,
+            tone: failed > 0 ? "danger" : "muted",
+        },
+        {
+            text: `${warnings} warning${warnings === 1 ? "" : "s"}`,
+            tone: warnings > 0 ? "warning" : "muted",
+        },
     ]));
 }
-function printForecastUsage() {
-    console.log([
-        "Usage:",
-        "  codex auth forecast [--live] [--json] [--model <model>]",
-        "",
-        "Options:",
-        "  --live, -l         Probe live quota headers via Codex backend",
-        "  --json, -j         Print machine-readable JSON output",
-        "  --model, -m        Probe model for live mode (default: gpt-5-codex)",
-    ].join("\n"));
-}
 function printBestUsage() {
     console.log([
         "Usage:",
@@ -1549,79 +1735,6 @@ function printBestUsage() {
         "  - Switches to the recommended account when it is not already active",
     ].join("\n"));
 }
-function printFixUsage() {
-    console.log([
-        "Usage:",
-        "  codex auth fix [--dry-run] [--json] [--live] [--model <model>]",
-        "",
-        "Options:",
-        "  --dry-run, -n      Preview changes without writing storage",
-        "  --json, -j         Print machine-readable JSON output",
-        "  --live, -l         Run live session probe before deciding health",
-        "  --model, -m        Probe model for live mode (default: gpt-5-codex)",
-        "",
-        "Behavior:",
-        "  - Refreshes tokens for enabled accounts",
-        "  - Disables hard-failed accounts (never deletes)",
-        "  - Recommends a better current account when needed",
-    ].join("\n"));
-}
-function printVerifyFlaggedUsage() {
-    console.log([
-        "Usage:",
-        "  codex auth verify-flagged [--dry-run] [--json] [--no-restore]",
-        "",
-        "Options:",
-        "  --dry-run, -n      Preview changes without writing storage",
-        "  --json, -j         Print machine-readable JSON output",
-        "  --no-restore       Check flagged accounts without restoring healthy ones",
-        "",
-        "Behavior:",
-        "  - Refresh-checks accounts from flagged storage",
-        "  - Restores healthy accounts back to active storage by default",
-    ].join("\n"));
-}
-function parseForecastArgs(args) {
-    const options = {
-        live: false,
-        json: false,
-        model: "gpt-5-codex",
-    };
-    for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (!arg)
-            continue;
-        if (!arg)
-            continue;
-        if (arg === "--live" || arg === "-l") {
-            options.live = true;
-            continue;
-        }
-        if (arg === "--json" || arg === "-j") {
-            options.json = true;
-            continue;
-        }
-        if (arg === "--model" || arg === "-m") {
-            const value = args[i + 1];
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            i += 1;
-            continue;
-        }
-        if (arg.startsWith("--model=")) {
-            const value = arg.slice("--model=".length).trim();
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            continue;
-        }
-        return { ok: false, message: `Unknown option: ${arg}` };
-    }
-    return { ok: true, options };
-}
 function parseBestArgs(args) {
     const options = {
         live: false,
@@ -1664,1703 +1777,173 @@ function parseBestArgs(args) {
     }
     return { ok: true, options };
 }
-function parseFixArgs(args) {
-    const options = {
-        dryRun: false,
-        json: false,
-        live: false,
-        model: "gpt-5-codex",
-    };
-    for (let i = 0; i < args.length; i += 1) {
-        const argValue = args[i];
-        if (typeof argValue !== "string")
-            continue;
-        if (argValue === "--dry-run" || argValue === "-n") {
-            options.dryRun = true;
-            continue;
-        }
-        if (argValue === "--json" || argValue === "-j") {
-            options.json = true;
-            continue;
-        }
-        if (argValue === "--live" || argValue === "-l") {
-            options.live = true;
-            continue;
-        }
-        if (argValue === "--model" || argValue === "-m") {
-            const value = args[i + 1];
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            i += 1;
-            continue;
-        }
-        if (argValue.startsWith("--model=")) {
-            const value = argValue.slice("--model=".length).trim();
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            continue;
-        }
-        return { ok: false, message: `Unknown option: ${argValue}` };
+async function runForecast(args) {
+    return runForecastCommand(args, {
+        setStoragePath,
+        loadAccounts,
+        loadDashboardDisplaySettings,
+        resolveActiveIndex,
+        loadQuotaCache,
+        saveQuotaCache,
+        cloneQuotaCacheData,
+        buildQuotaEmailFallbackState,
+        updateQuotaCacheForAccount,
+        hasUsableAccessToken,
+        queuedRefresh,
+        fetchCodexQuotaSnapshot,
+        normalizeFailureDetail,
+        formatAccountLabel,
+        extractAccountId,
+        evaluateForecastAccounts,
+        summarizeForecast,
+        recommendForecastAccount,
+        stylePromptText,
+        formatResultSummary,
+        styleQuotaSummary,
+        formatCompactQuotaSnapshot,
+        availabilityTone,
+        riskTone,
+        formatWaitTime,
+        defaultDisplay: DEFAULT_DASHBOARD_DISPLAY_SETTINGS,
+        formatQuotaSnapshotLine,
+    });
+}
+async function clearAccountsAndReset() {
+    await clearAccounts();
+}
+function adjustManageActionSelectionIndex(currentIndex, removedIndex, remainingCount) {
+    if (remainingCount <= 0) {
+        return 0;
     }
-    return { ok: true, options };
+    if (typeof currentIndex !== "number" || currentIndex < 0) {
+        return 0;
+    }
+    if (currentIndex < removedIndex) {
+        return Math.min(currentIndex, remainingCount - 1);
+    }
+    if (currentIndex > removedIndex) {
+        return currentIndex - 1;
+    }
+    return Math.min(removedIndex, remainingCount - 1);
 }
-function parseVerifyFlaggedArgs(args) {
-    const options = {
-        dryRun: false,
-        json: false,
-        restore: true,
-    };
-    for (const arg of args) {
-        if (arg === "--dry-run" || arg === "-n") {
-            options.dryRun = true;
-            continue;
-        }
-        if (arg === "--json" || arg === "-j") {
-            options.json = true;
-            continue;
-        }
-        if (arg === "--no-restore") {
-            options.restore = false;
-            continue;
+function resetManageActionSelection(storage, removedIndex) {
+    const remainingCount = storage.accounts.length;
+    if (remainingCount <= 0) {
+        storage.activeIndex = 0;
+        storage.activeIndexByFamily = {};
+        for (const family of MODEL_FAMILIES) {
+            storage.activeIndexByFamily[family] = 0;
         }
-        return { ok: false, message: `Unknown option: ${arg}` };
+        return;
+    }
+    const previousActiveIndex = storage.activeIndex;
+    const previousByFamily = { ...storage.activeIndexByFamily };
+    storage.activeIndex = adjustManageActionSelectionIndex(previousActiveIndex, removedIndex, remainingCount);
+    storage.activeIndexByFamily = {};
+    for (const family of MODEL_FAMILIES) {
+        storage.activeIndexByFamily[family] = adjustManageActionSelectionIndex(previousByFamily[family] ?? previousActiveIndex, removedIndex, remainingCount);
     }
-    return { ok: true, options };
 }
-function printDoctorUsage() {
-    console.log([
-        "Usage:",
-        "  codex auth doctor [--json] [--fix] [--dry-run]",
-        "",
-        "Options:",
-        "  --json, -j         Print machine-readable JSON diagnostics",
-        "  --fix              Apply safe auto-fixes to storage",
-        "  --dry-run, -n      Preview --fix changes without writing storage",
-        "",
-        "Behavior:",
-        "  - Validates account storage readability",
-        "  - Checks active index consistency and account duplication",
-        "  - Flags placeholder/demo accounts and disabled-all scenarios",
-    ].join("\n"));
+function replaceManageActionStorage(target, source) {
+    target.version = source.version;
+    target.accounts = structuredClone(source.accounts);
+    target.activeIndex = source.activeIndex;
+    target.activeIndexByFamily = {
+        ...source.activeIndexByFamily,
+    };
 }
-function parseDoctorArgs(args) {
-    const options = { json: false, fix: false, dryRun: false };
-    for (const arg of args) {
-        if (arg === "--json" || arg === "-j") {
-            options.json = true;
-            continue;
-        }
-        if (arg === "--fix") {
-            options.fix = true;
-            continue;
-        }
-        if (arg === "--dry-run" || arg === "-n") {
-            options.dryRun = true;
-            continue;
+function resolveManageActionAccountIndex(storage, fallbackIndex, account) {
+    if (account) {
+        const matchedIndex = findMatchingAccountIndex(storage.accounts, {
+            accountId: account.accountId,
+            email: account.email,
+            refreshToken: account.refreshToken,
+        }, {
+            allowUniqueAccountIdFallbackWithoutEmail: true,
+        });
+        if (typeof matchedIndex === "number" && matchedIndex >= 0) {
+            return matchedIndex;
         }
-        return { ok: false, message: `Unknown option: ${arg}` };
+        return null;
     }
-    if (options.dryRun && !options.fix) {
-        return { ok: false, message: "--dry-run requires --fix" };
-    }
-    return { ok: true, options };
-}
-function printReportUsage() {
-    console.log([
-        "Usage:",
-        "  codex auth report [--live] [--json] [--model <model>] [--out <path>]",
-        "",
-        "Options:",
-        "  --live, -l         Probe live quota headers via Codex backend",
-        "  --json, -j         Print machine-readable JSON output",
-        "  --model, -m        Probe model for live mode (default: gpt-5-codex)",
-        "  --out              Write JSON report to a file path",
-    ].join("\n"));
-}
-function parseReportArgs(args) {
-    const options = {
-        live: false,
-        json: false,
-        model: "gpt-5-codex",
-    };
-    for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (!arg)
-            continue;
-        if (arg === "--live" || arg === "-l") {
-            options.live = true;
-            continue;
-        }
-        if (arg === "--json" || arg === "-j") {
-            options.json = true;
-            continue;
-        }
-        if (arg === "--model" || arg === "-m") {
-            const value = args[i + 1];
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            i += 1;
-            continue;
-        }
-        if (arg.startsWith("--model=")) {
-            const value = arg.slice("--model=".length).trim();
-            if (!value) {
-                return { ok: false, message: "Missing value for --model" };
-            }
-            options.model = value;
-            continue;
-        }
-        if (arg === "--out") {
-            const value = args[i + 1];
-            if (!value) {
-                return { ok: false, message: "Missing value for --out" };
-            }
-            options.outPath = value;
-            i += 1;
-            continue;
-        }
-        if (arg.startsWith("--out=")) {
-            const value = arg.slice("--out=".length).trim();
-            if (!value) {
-                return { ok: false, message: "Missing value for --out" };
-            }
-            options.outPath = value;
-            continue;
-        }
-        return { ok: false, message: `Unknown option: ${arg}` };
-    }
-    return { ok: true, options };
-}
-function serializeForecastResults(results, liveQuotaByIndex, refreshFailures) {
-    return results.map((result) => {
-        const liveQuota = liveQuotaByIndex.get(result.index);
-        return {
-            index: result.index,
-            label: result.label,
-            isCurrent: result.isCurrent,
-            availability: result.availability,
-            riskScore: result.riskScore,
-            riskLevel: result.riskLevel,
-            waitMs: result.waitMs,
-            reasons: result.reasons,
-            liveQuota: liveQuota
-                ? {
-                    status: liveQuota.status,
-                    planType: liveQuota.planType,
-                    activeLimit: liveQuota.activeLimit,
-                    model: liveQuota.model,
-                    summary: formatQuotaSnapshotLine(liveQuota),
-                }
-                : undefined,
-            refreshFailure: refreshFailures.get(result.index),
-        };
-    });
-}
-async function runForecast(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printForecastUsage();
-        return 0;
-    }
-    const parsedArgs = parseForecastArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printForecastUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    const display = DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
-    const quotaCache = options.live ? await loadQuotaCache() : null;
-    const workingQuotaCache = quotaCache ? cloneQuotaCacheData(quotaCache) : null;
-    let quotaCacheChanged = false;
-    setStoragePath(null);
-    const storage = await loadAccounts();
-    if (!storage || storage.accounts.length === 0) {
-        console.log("No accounts configured.");
-        return 0;
-    }
-    const quotaEmailFallbackState = options.live && quotaCache
-        ? buildQuotaEmailFallbackState(storage.accounts)
-        : null;
-    const now = Date.now();
-    const activeIndex = resolveActiveIndex(storage, "codex");
-    const refreshFailures = new Map();
-    const liveQuotaByIndex = new Map();
-    const probeErrors = [];
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account || !options.live)
-            continue;
-        if (account.enabled === false)
-            continue;
-        let probeAccessToken = account.accessToken;
-        let probeAccountId = account.accountId ?? extractAccountId(account.accessToken);
-        if (!hasUsableAccessToken(account, now)) {
-            const refreshResult = await queuedRefresh(account.refreshToken);
-            if (refreshResult.type !== "success") {
-                refreshFailures.set(i, {
-                    ...refreshResult,
-                    message: normalizeFailureDetail(refreshResult.message, refreshResult.reason),
-                });
-                continue;
-            }
-            probeAccessToken = refreshResult.access;
-            probeAccountId = account.accountId ?? extractAccountId(refreshResult.access);
-        }
-        if (!probeAccessToken || !probeAccountId) {
-            probeErrors.push(`${formatAccountLabel(account, i)}: missing accountId for live probe`);
-            continue;
-        }
-        try {
-            const liveQuota = await fetchCodexQuotaSnapshot({
-                accountId: probeAccountId,
-                accessToken: probeAccessToken,
-                model: options.model,
-            });
-            liveQuotaByIndex.set(i, liveQuota);
-            if (workingQuotaCache) {
-                const account = storage.accounts[i];
-                if (account) {
-                    quotaCacheChanged =
-                        updateQuotaCacheForAccount(workingQuotaCache, account, liveQuota, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
-                }
-            }
-        }
-        catch (error) {
-            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
-            probeErrors.push(`${formatAccountLabel(account, i)}: ${message}`);
-        }
-    }
-    const forecastInputs = storage.accounts.map((account, index) => ({
-        index,
-        account,
-        isCurrent: index === activeIndex,
-        now,
-        refreshFailure: refreshFailures.get(index),
-        liveQuota: liveQuotaByIndex.get(index),
-    }));
-    const forecastResults = evaluateForecastAccounts(forecastInputs);
-    const summary = summarizeForecast(forecastResults);
-    const recommendation = recommendForecastAccount(forecastResults);
-    if (options.json) {
-        if (workingQuotaCache && quotaCacheChanged) {
-            await saveQuotaCache(workingQuotaCache);
-        }
-        console.log(JSON.stringify({
-            command: "forecast",
-            model: options.model,
-            liveProbe: options.live,
-            summary,
-            recommendation,
-            probeErrors,
-            accounts: serializeForecastResults(forecastResults, liveQuotaByIndex, refreshFailures),
-        }, null, 2));
-        return 0;
-    }
-    console.log(stylePromptText(`Best-account preview (${storage.accounts.length} account(s), model ${options.model}, live check ${options.live ? "on" : "off"})`, "accent"));
-    console.log(formatResultSummary([
-        { text: `${summary.ready} ready now`, tone: "success" },
-        { text: `${summary.delayed} waiting`, tone: "warning" },
-        { text: `${summary.unavailable} unavailable`, tone: summary.unavailable > 0 ? "danger" : "muted" },
-        { text: `${summary.highRisk} high risk`, tone: summary.highRisk > 0 ? "danger" : "muted" },
-    ]));
-    console.log("");
-    for (const result of forecastResults) {
-        if (!display.showPerAccountRows) {
-            continue;
-        }
-        const currentTag = result.isCurrent ? " [current]" : "";
-        const waitLabel = result.waitMs > 0 ? stylePromptText(`wait ${formatWaitTime(result.waitMs)}`, "muted") : "";
-        const indexLabel = stylePromptText(`${result.index + 1}.`, "accent");
-        const accountLabel = stylePromptText(`${result.label}${currentTag}`, "accent");
-        const riskLabel = stylePromptText(`${result.riskLevel} risk (${result.riskScore})`, riskTone(result.riskLevel));
-        const availabilityLabel = stylePromptText(result.availability, availabilityTone(result.availability));
-        const rowParts = [availabilityLabel, riskLabel];
-        if (waitLabel)
-            rowParts.push(waitLabel);
-        console.log(`${indexLabel} ${accountLabel} ${stylePromptText("|", "muted")} ${joinStyledSegments(rowParts)}`);
-        if (display.showForecastReasons && result.reasons.length > 0) {
-            console.log(`   ${stylePromptText(result.reasons.slice(0, 3).join("; "), "muted")}`);
-        }
-        const liveQuota = liveQuotaByIndex.get(result.index);
-        if (display.showQuotaDetails && liveQuota) {
-            console.log(`   ${stylePromptText("quota:", "accent")} ${styleQuotaSummary(formatCompactQuotaSnapshot(liveQuota))}`);
-        }
-    }
-    if (!display.showPerAccountRows) {
-        console.log(stylePromptText("Per-account lines are hidden in dashboard settings.", "muted"));
-    }
-    if (display.showRecommendations) {
-        console.log("");
-        if (recommendation.recommendedIndex !== null) {
-            const index = recommendation.recommendedIndex;
-            const account = forecastResults.find((result) => result.index === index);
-            if (account) {
-                console.log(`${stylePromptText("Best next account:", "accent")} ${stylePromptText(`${index + 1} (${account.label})`, "success")}`);
-                console.log(`${stylePromptText("Why:", "accent")} ${stylePromptText(recommendation.reason, "muted")}`);
-                if (index !== activeIndex) {
-                    console.log(`${stylePromptText("Switch now with:", "accent")} codex auth switch ${index + 1}`);
-                }
-            }
-        }
-        else {
-            console.log(`${stylePromptText("Note:", "accent")} ${stylePromptText(recommendation.reason, "muted")}`);
-        }
-    }
-    if (display.showLiveProbeNotes && probeErrors.length > 0) {
-        console.log("");
-        console.log(stylePromptText(`Live check notes (${probeErrors.length}):`, "warning"));
-        for (const error of probeErrors) {
-            console.log(`  ${stylePromptText("-", "warning")} ${stylePromptText(error, "muted")}`);
-        }
-    }
-    if (workingQuotaCache && quotaCacheChanged) {
-        await saveQuotaCache(workingQuotaCache);
-    }
-    return 0;
-}
-async function runReport(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printReportUsage();
-        return 0;
-    }
-    const parsedArgs = parseReportArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printReportUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    setStoragePath(null);
-    const storagePath = getStoragePath();
-    const storage = await loadAccounts();
-    const now = Date.now();
-    const accountCount = storage?.accounts.length ?? 0;
-    const activeIndex = storage ? resolveActiveIndex(storage, "codex") : 0;
-    const refreshFailures = new Map();
-    const liveQuotaByIndex = new Map();
-    const probeErrors = [];
-    if (storage && options.live) {
-        for (let i = 0; i < storage.accounts.length; i += 1) {
-            const account = storage.accounts[i];
-            if (!account || account.enabled === false)
-                continue;
-            const refreshResult = await queuedRefresh(account.refreshToken);
-            if (refreshResult.type !== "success") {
-                refreshFailures.set(i, {
-                    ...refreshResult,
-                    message: normalizeFailureDetail(refreshResult.message, refreshResult.reason),
-                });
-                continue;
-            }
-            const accountId = account.accountId ?? extractAccountId(refreshResult.access);
-            if (!accountId) {
-                probeErrors.push(`${formatAccountLabel(account, i)}: missing accountId for live probe`);
-                continue;
-            }
-            try {
-                const liveQuota = await fetchCodexQuotaSnapshot({
-                    accountId,
-                    accessToken: refreshResult.access,
-                    model: options.model,
-                });
-                liveQuotaByIndex.set(i, liveQuota);
-            }
-            catch (error) {
-                const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
-                probeErrors.push(`${formatAccountLabel(account, i)}: ${message}`);
-            }
-        }
-    }
-    const forecastResults = storage
-        ? evaluateForecastAccounts(storage.accounts.map((account, index) => ({
-            index,
-            account,
-            isCurrent: index === activeIndex,
-            now,
-            refreshFailure: refreshFailures.get(index),
-            liveQuota: liveQuotaByIndex.get(index),
-        })))
-        : [];
-    const forecastSummary = summarizeForecast(forecastResults);
-    const recommendation = recommendForecastAccount(forecastResults);
-    const enabledCount = storage
-        ? storage.accounts.filter((account) => account.enabled !== false).length
-        : 0;
-    const disabledCount = Math.max(0, accountCount - enabledCount);
-    const coolingCount = storage
-        ? storage.accounts.filter((account) => typeof account.coolingDownUntil === "number" && account.coolingDownUntil > now).length
-        : 0;
-    const rateLimitedCount = storage
-        ? storage.accounts.filter((account) => !!formatRateLimitEntry(account, now, "codex")).length
-        : 0;
-    const report = {
-        command: "report",
-        generatedAt: new Date(now).toISOString(),
-        storagePath,
-        model: options.model,
-        liveProbe: options.live,
-        accounts: {
-            total: accountCount,
-            enabled: enabledCount,
-            disabled: disabledCount,
-            coolingDown: coolingCount,
-            rateLimited: rateLimitedCount,
-        },
-        activeIndex: accountCount > 0 ? activeIndex + 1 : null,
-        forecast: {
-            summary: forecastSummary,
-            recommendation,
-            probeErrors,
-            accounts: serializeForecastResults(forecastResults, liveQuotaByIndex, refreshFailures),
-        },
-    };
-    if (options.outPath) {
-        const outputPath = resolve(process.cwd(), options.outPath);
-        await fs.mkdir(dirname(outputPath), { recursive: true });
-        await fs.writeFile(outputPath, `${JSON.stringify(report, null, 2)}\n`, "utf-8");
-    }
-    if (options.json) {
-        console.log(JSON.stringify(report, null, 2));
-        return 0;
-    }
-    console.log(`Report generated at ${report.generatedAt}`);
-    console.log(`Storage: ${report.storagePath}`);
-    console.log(`Accounts: ${report.accounts.total} total (${report.accounts.enabled} enabled, ${report.accounts.disabled} disabled, ${report.accounts.coolingDown} cooling, ${report.accounts.rateLimited} rate-limited)`);
-    if (report.activeIndex !== null) {
-        console.log(`Active account: ${report.activeIndex}`);
-    }
-    console.log(`Forecast: ${report.forecast.summary.ready} ready, ${report.forecast.summary.delayed} delayed, ${report.forecast.summary.unavailable} unavailable`);
-    if (report.forecast.recommendation.recommendedIndex !== null) {
-        console.log(`Recommendation: account ${report.forecast.recommendation.recommendedIndex + 1} (${report.forecast.recommendation.reason})`);
-    }
-    else {
-        console.log(`Recommendation: ${report.forecast.recommendation.reason}`);
-    }
-    if (options.outPath) {
-        console.log(`Report written: ${resolve(process.cwd(), options.outPath)}`);
-    }
-    if (report.forecast.probeErrors.length > 0) {
-        console.log(`Probe notes: ${report.forecast.probeErrors.length}`);
-    }
-    return 0;
-}
-function summarizeFixReports(reports) {
-    let healthy = 0;
-    let disabled = 0;
-    let warnings = 0;
-    let skipped = 0;
-    for (const report of reports) {
-        if (report.outcome === "healthy")
-            healthy += 1;
-        else if (report.outcome === "disabled-hard-failure")
-            disabled += 1;
-        else if (report.outcome === "warning-soft-failure")
-            warnings += 1;
-        else
-            skipped += 1;
-    }
-    return { healthy, disabled, warnings, skipped };
-}
-function createEmptyAccountStorage() {
-    const activeIndexByFamily = {};
-    for (const family of MODEL_FAMILIES) {
-        activeIndexByFamily[family] = 0;
-    }
-    return {
-        version: 3,
-        accounts: [],
-        activeIndex: 0,
-        activeIndexByFamily,
-    };
-}
-function findExistingAccountIndexForFlagged(storage, flagged, nextRefreshToken, nextAccountId, nextEmail) {
-    const flaggedEmail = sanitizeEmail(flagged.email);
-    const candidateAccountId = nextAccountId ?? flagged.accountId;
-    const candidateEmail = sanitizeEmail(nextEmail) ?? flaggedEmail;
-    const nextMatchIndex = findMatchingAccountIndex(storage.accounts, {
-        accountId: candidateAccountId,
-        email: candidateEmail,
-        refreshToken: nextRefreshToken,
-    }, {
-        allowUniqueAccountIdFallbackWithoutEmail: true,
-    });
-    if (nextMatchIndex !== undefined) {
-        return nextMatchIndex;
-    }
-    const flaggedMatchIndex = findMatchingAccountIndex(storage.accounts, {
-        accountId: candidateAccountId,
-        email: candidateEmail,
-        refreshToken: flagged.refreshToken,
-    }, {
-        allowUniqueAccountIdFallbackWithoutEmail: true,
-    });
-    return flaggedMatchIndex ?? -1;
-}
-function upsertRecoveredFlaggedAccount(storage, flagged, refreshResult, now) {
-    const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken)) ?? flagged.email;
-    const tokenAccountId = extractAccountId(refreshResult.access);
-    const { accountId: nextAccountId, accountIdSource: nextAccountIdSource } = resolveStoredAccountIdentity(flagged.accountId, flagged.accountIdSource, tokenAccountId);
-    const existingIndex = findExistingAccountIndexForFlagged(storage, flagged, refreshResult.refresh, nextAccountId, nextEmail);
-    if (existingIndex >= 0) {
-        const existing = storage.accounts[existingIndex];
-        if (!existing) {
-            return { restored: false, changed: false, message: "existing account entry is missing" };
-        }
-        let changed = false;
-        if (existing.refreshToken !== refreshResult.refresh) {
-            existing.refreshToken = refreshResult.refresh;
-            changed = true;
-        }
-        if (existing.accessToken !== refreshResult.access) {
-            existing.accessToken = refreshResult.access;
-            changed = true;
-        }
-        if (existing.expiresAt !== refreshResult.expires) {
-            existing.expiresAt = refreshResult.expires;
-            changed = true;
-        }
-        if (nextEmail && nextEmail !== existing.email) {
-            existing.email = nextEmail;
-            changed = true;
-        }
-        if (nextAccountId !== undefined &&
-            ((nextAccountId !== existing.accountId)
-                || (nextAccountIdSource !== existing.accountIdSource))) {
-            existing.accountId = nextAccountId;
-            existing.accountIdSource = nextAccountIdSource;
-            changed = true;
-        }
-        if (existing.enabled === false) {
-            existing.enabled = true;
-            changed = true;
-        }
-        if (existing.accountLabel !== flagged.accountLabel && flagged.accountLabel) {
-            existing.accountLabel = flagged.accountLabel;
-            changed = true;
-        }
-        existing.lastUsed = now;
-        return {
-            restored: true,
-            changed,
-            message: `restored into existing account ${existingIndex + 1}`,
-        };
-    }
-    if (storage.accounts.length >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
-        return {
-            restored: false,
-            changed: false,
-            message: `cannot restore (max ${ACCOUNT_LIMITS.MAX_ACCOUNTS} accounts reached)`,
-        };
-    }
-    storage.accounts.push({
-        refreshToken: refreshResult.refresh,
-        accessToken: refreshResult.access,
-        expiresAt: refreshResult.expires,
-        accountId: nextAccountId,
-        accountIdSource: nextAccountIdSource,
-        accountLabel: flagged.accountLabel,
-        email: nextEmail,
-        addedAt: flagged.addedAt ?? now,
-        lastUsed: now,
-        enabled: true,
-    });
-    return {
-        restored: true,
-        changed: true,
-        message: `restored as account ${storage.accounts.length}`,
-    };
-}
-async function runVerifyFlagged(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printVerifyFlaggedUsage();
-        return 0;
-    }
-    const parsedArgs = parseVerifyFlaggedArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printVerifyFlaggedUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    setStoragePath(null);
-    const flaggedStorage = await loadFlaggedAccounts();
-    if (flaggedStorage.accounts.length === 0) {
-        if (options.json) {
-            console.log(JSON.stringify({
-                command: "verify-flagged",
-                total: 0,
-                restored: 0,
-                healthyFlagged: 0,
-                stillFlagged: 0,
-                changed: false,
-                dryRun: options.dryRun,
-                restore: options.restore,
-                reports: [],
-            }, null, 2));
-            return 0;
-        }
-        console.log("No flagged accounts to check.");
-        return 0;
-    }
-    let storageChanged = false;
-    let flaggedChanged = false;
-    const reports = [];
-    const nextFlaggedAccounts = [];
-    const now = Date.now();
-    const refreshChecks = [];
-    for (let i = 0; i < flaggedStorage.accounts.length; i += 1) {
-        const flagged = flaggedStorage.accounts[i];
-        if (!flagged)
-            continue;
-        const label = formatAccountLabel(flagged, i);
-        refreshChecks.push({
-            index: i,
-            flagged,
-            label,
-            result: await queuedRefresh(flagged.refreshToken),
-        });
-    }
-    const applyRefreshChecks = (storage) => {
-        for (const check of refreshChecks) {
-            const { index: i, flagged, label, result } = check;
-            if (result.type === "success") {
-                if (!options.restore) {
-                    const tokenAccountId = extractAccountId(result.access);
-                    const nextIdentity = resolveStoredAccountIdentity(flagged.accountId, flagged.accountIdSource, tokenAccountId);
-                    const nextFlagged = {
-                        ...flagged,
-                        refreshToken: result.refresh,
-                        accessToken: result.access,
-                        expiresAt: result.expires,
-                        accountId: nextIdentity.accountId,
-                        accountIdSource: nextIdentity.accountIdSource,
-                        email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)) ?? flagged.email,
-                        lastUsed: now,
-                        lastError: undefined,
-                    };
-                    nextFlaggedAccounts.push(nextFlagged);
-                    if (JSON.stringify(nextFlagged) !== JSON.stringify(flagged)) {
-                        flaggedChanged = true;
-                    }
-                    reports.push({
-                        index: i,
-                        label,
-                        outcome: "healthy-flagged",
-                        message: "session is healthy (left in flagged list due to --no-restore)",
-                    });
-                    continue;
-                }
-                const upsertResult = upsertRecoveredFlaggedAccount(storage, flagged, result, now);
-                if (upsertResult.restored) {
-                    storageChanged = storageChanged || upsertResult.changed;
-                    flaggedChanged = true;
-                    reports.push({
-                        index: i,
-                        label,
-                        outcome: "restored",
-                        message: upsertResult.message,
-                    });
-                    continue;
-                }
-                const tokenAccountId = extractAccountId(result.access);
-                const nextIdentity = resolveStoredAccountIdentity(flagged.accountId, flagged.accountIdSource, tokenAccountId);
-                const updatedFlagged = {
-                    ...flagged,
-                    refreshToken: result.refresh,
-                    accessToken: result.access,
-                    expiresAt: result.expires,
-                    accountId: nextIdentity.accountId,
-                    accountIdSource: nextIdentity.accountIdSource,
-                    email: sanitizeEmail(extractAccountEmail(result.access, result.idToken)) ?? flagged.email,
-                    lastUsed: now,
-                    lastError: upsertResult.message,
-                };
-                nextFlaggedAccounts.push(updatedFlagged);
-                if (JSON.stringify(updatedFlagged) !== JSON.stringify(flagged)) {
-                    flaggedChanged = true;
-                }
-                reports.push({
-                    index: i,
-                    label,
-                    outcome: "restore-skipped",
-                    message: upsertResult.message,
-                });
-                continue;
-            }
-            const detail = normalizeFailureDetail(result.message, result.reason);
-            const failedFlagged = {
-                ...flagged,
-                lastError: detail,
-            };
-            nextFlaggedAccounts.push(failedFlagged);
-            if ((flagged.lastError ?? "") !== detail) {
-                flaggedChanged = true;
-            }
-            reports.push({
-                index: i,
-                label,
-                outcome: "still-flagged",
-                message: detail,
-            });
-        }
-    };
-    if (options.restore) {
-        if (options.dryRun) {
-            applyRefreshChecks((await loadAccounts()) ?? createEmptyAccountStorage());
-        }
-        else {
-            await withAccountAndFlaggedStorageTransaction(async (loadedStorage, persist) => {
-                const nextStorage = loadedStorage
-                    ? structuredClone(loadedStorage)
-                    : createEmptyAccountStorage();
-                applyRefreshChecks(nextStorage);
-                if (!storageChanged) {
-                    return;
-                }
-                normalizeDoctorIndexes(nextStorage);
-                await persist(nextStorage, {
-                    version: 1,
-                    accounts: nextFlaggedAccounts,
-                });
-            });
-        }
-    }
-    else {
-        applyRefreshChecks(createEmptyAccountStorage());
-    }
-    const remainingFlagged = nextFlaggedAccounts.length;
-    const restored = reports.filter((report) => report.outcome === "restored").length;
-    const healthyFlagged = reports.filter((report) => report.outcome === "healthy-flagged").length;
-    const stillFlagged = reports.filter((report) => report.outcome === "still-flagged").length;
-    const changed = storageChanged || flaggedChanged;
-    if (!options.dryRun && flaggedChanged && (!options.restore || !storageChanged)) {
-        await saveFlaggedAccounts({
-            version: 1,
-            accounts: nextFlaggedAccounts,
-        });
-    }
-    if (options.json) {
-        console.log(JSON.stringify({
-            command: "verify-flagged",
-            total: flaggedStorage.accounts.length,
-            restored,
-            healthyFlagged,
-            stillFlagged,
-            remainingFlagged,
-            changed,
-            dryRun: options.dryRun,
-            restore: options.restore,
-            reports,
-        }, null, 2));
-        return 0;
-    }
-    console.log(stylePromptText(`Checking ${flaggedStorage.accounts.length} flagged account(s)...`, "accent"));
-    for (const report of reports) {
-        const tone = report.outcome === "restored"
-            ? "success"
-            : report.outcome === "healthy-flagged"
-                ? "warning"
-                : report.outcome === "restore-skipped"
-                    ? "warning"
-                    : "danger";
-        const marker = report.outcome === "restored"
-            ? "✓"
-            : report.outcome === "healthy-flagged"
-                ? "!"
-                : report.outcome === "restore-skipped"
-                    ? "!"
-                    : "✗";
-        console.log(`${stylePromptText(marker, tone)} ${stylePromptText(`${report.index + 1}. ${report.label}`, "accent")} ${stylePromptText("|", "muted")} ${styleAccountDetailText(report.message, tone)}`);
-    }
-    console.log("");
-    console.log(formatResultSummary([
-        { text: `${restored} restored`, tone: restored > 0 ? "success" : "muted" },
-        { text: `${healthyFlagged} healthy (kept flagged)`, tone: healthyFlagged > 0 ? "warning" : "muted" },
-        { text: `${stillFlagged} still flagged`, tone: stillFlagged > 0 ? "danger" : "muted" },
-    ]));
-    if (options.dryRun) {
-        console.log(stylePromptText("Preview only: no changes were saved.", "warning"));
-    }
-    else if (!changed) {
-        console.log(stylePromptText("No storage changes were needed.", "muted"));
-    }
-    return 0;
-}
-async function runFix(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printFixUsage();
-        return 0;
-    }
-    const parsedArgs = parseFixArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printFixUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    const display = DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
-    const quotaCache = options.live ? await loadQuotaCache() : null;
-    const workingQuotaCache = quotaCache ? cloneQuotaCacheData(quotaCache) : null;
-    let quotaCacheChanged = false;
-    setStoragePath(null);
-    const storage = await loadAccounts();
-    if (!storage || storage.accounts.length === 0) {
-        console.log("No accounts configured.");
-        return 0;
-    }
-    let quotaEmailFallbackState = options.live && quotaCache
-        ? buildQuotaEmailFallbackState(storage.accounts)
-        : null;
-    const now = Date.now();
-    const activeIndex = resolveActiveIndex(storage, "codex");
-    let changed = false;
-    const reports = [];
-    const refreshFailures = new Map();
-    const hardDisabledIndexes = [];
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account)
-            continue;
-        const label = formatAccountLabel(account, i);
-        if (account.enabled === false) {
-            reports.push({
-                index: i,
-                label,
-                outcome: "already-disabled",
-                message: "already disabled",
-            });
-            continue;
-        }
-        if (hasUsableAccessToken(account, now)) {
-            if (options.live) {
-                const currentAccessToken = account.accessToken;
-                const probeAccountId = currentAccessToken
-                    ? (account.accountId ?? extractAccountId(currentAccessToken))
-                    : undefined;
-                if (probeAccountId && currentAccessToken) {
-                    try {
-                        const snapshot = await fetchCodexQuotaSnapshot({
-                            accountId: probeAccountId,
-                            accessToken: currentAccessToken,
-                            model: options.model,
-                        });
-                        if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
-                        }
-                        reports.push({
-                            index: i,
-                            label,
-                            outcome: "healthy",
-                            message: display.showQuotaDetails
-                                ? `live session OK (${formatCompactQuotaSnapshot(snapshot)})`
-                                : "live session OK",
-                        });
-                        continue;
-                    }
-                    catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
-                        reports.push({
-                            index: i,
-                            label,
-                            outcome: "warning-soft-failure",
-                            message: `live probe failed (${message}), trying refresh fallback`,
-                        });
-                    }
-                }
-            }
-            const refreshWarning = hasLikelyInvalidRefreshToken(account.refreshToken)
-                ? " (refresh token looks stale; re-login recommended)"
-                : "";
-            reports.push({
-                index: i,
-                label,
-                outcome: "healthy",
-                message: `access token still valid${refreshWarning}`,
-            });
-            continue;
-        }
-        const refreshResult = await queuedRefresh(account.refreshToken);
-        if (refreshResult.type === "success") {
-            const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-            const nextAccountId = extractAccountId(refreshResult.access);
-            const previousEmail = account.email;
-            let accountChanged = false;
-            let accountIdentityChanged = false;
-            if (account.refreshToken !== refreshResult.refresh) {
-                account.refreshToken = refreshResult.refresh;
-                accountChanged = true;
-            }
-            if (account.accessToken !== refreshResult.access) {
-                account.accessToken = refreshResult.access;
-                accountChanged = true;
-            }
-            if (account.expiresAt !== refreshResult.expires) {
-                account.expiresAt = refreshResult.expires;
-                accountChanged = true;
-            }
-            if (nextEmail && nextEmail !== account.email) {
-                account.email = nextEmail;
-                accountChanged = true;
-                accountIdentityChanged = true;
-            }
-            if (applyTokenAccountIdentity(account, nextAccountId)) {
-                accountChanged = true;
-                accountIdentityChanged = true;
-            }
-            if (accountChanged)
-                changed = true;
-            if (accountIdentityChanged && options.live && workingQuotaCache) {
-                quotaEmailFallbackState = buildQuotaEmailFallbackState(storage.accounts);
-                quotaCacheChanged =
-                    pruneUnsafeQuotaEmailCacheEntry(workingQuotaCache, previousEmail, storage.accounts, quotaEmailFallbackState) || quotaCacheChanged;
-            }
-            if (options.live) {
-                const probeAccountId = account.accountId ?? nextAccountId;
-                if (probeAccountId) {
-                    try {
-                        const snapshot = await fetchCodexQuotaSnapshot({
-                            accountId: probeAccountId,
-                            accessToken: refreshResult.access,
-                            model: options.model,
-                        });
-                        if (workingQuotaCache) {
-                            quotaCacheChanged =
-                                updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
-                        }
-                        reports.push({
-                            index: i,
-                            label,
-                            outcome: "healthy",
-                            message: display.showQuotaDetails
-                                ? `refresh + live probe succeeded (${formatCompactQuotaSnapshot(snapshot)})`
-                                : "refresh + live probe succeeded",
-                        });
-                        continue;
-                    }
-                    catch (error) {
-                        const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
-                        reports.push({
-                            index: i,
-                            label,
-                            outcome: "warning-soft-failure",
-                            message: `refresh succeeded but live probe failed: ${message}`,
-                        });
-                        continue;
-                    }
-                }
-            }
-            reports.push({
-                index: i,
-                label,
-                outcome: "healthy",
-                message: "refresh succeeded",
-            });
-            continue;
-        }
-        const detail = normalizeFailureDetail(refreshResult.message, refreshResult.reason);
-        refreshFailures.set(i, {
-            ...refreshResult,
-            message: detail,
-        });
-        if (isHardRefreshFailure(refreshResult)) {
-            account.enabled = false;
-            changed = true;
-            hardDisabledIndexes.push(i);
-            reports.push({
-                index: i,
-                label,
-                outcome: "disabled-hard-failure",
-                message: detail,
-            });
-        }
-        else {
-            reports.push({
-                index: i,
-                label,
-                outcome: "warning-soft-failure",
-                message: detail,
-            });
-        }
-    }
-    if (hardDisabledIndexes.length > 0) {
-        const enabledCount = storage.accounts.filter((account) => account.enabled !== false).length;
-        if (enabledCount === 0) {
-            const fallbackIndex = hardDisabledIndexes.includes(activeIndex) ? activeIndex : hardDisabledIndexes[0];
-            const fallback = typeof fallbackIndex === "number"
-                ? storage.accounts[fallbackIndex]
-                : undefined;
-            if (fallback && fallback.enabled === false) {
-                fallback.enabled = true;
-                changed = true;
-                const existingReport = reports.find((report) => report.index === fallbackIndex &&
-                    report.outcome === "disabled-hard-failure");
-                if (existingReport) {
-                    existingReport.outcome = "warning-soft-failure";
-                    existingReport.message = `${existingReport.message} (kept enabled to avoid lockout; re-login required)`;
-                }
-            }
-        }
-    }
-    const forecastResults = evaluateForecastAccounts(storage.accounts.map((account, index) => ({
-        index,
-        account,
-        isCurrent: index === activeIndex,
-        now,
-        refreshFailure: refreshFailures.get(index),
-    })));
-    const recommendation = recommendForecastAccount(forecastResults);
-    const reportSummary = summarizeFixReports(reports);
-    if (changed && !options.dryRun) {
-        await saveAccounts(storage);
-    }
-    if (options.json) {
-        if (workingQuotaCache && quotaCacheChanged) {
-            await saveQuotaCache(workingQuotaCache);
-        }
-        console.log(JSON.stringify({
-            command: "fix",
-            dryRun: options.dryRun,
-            liveProbe: options.live,
-            model: options.model,
-            changed,
-            summary: reportSummary,
-            recommendation,
-            recommendedSwitchCommand: recommendation.recommendedIndex !== null &&
-                recommendation.recommendedIndex !== activeIndex
-                ? `codex auth switch ${recommendation.recommendedIndex + 1}`
-                : null,
-            reports,
-        }, null, 2));
-        return 0;
-    }
-    console.log(stylePromptText(`Auto-fix scan (${options.dryRun ? "preview" : "apply"})`, "accent"));
-    console.log(formatResultSummary([
-        { text: `${reportSummary.healthy} working`, tone: "success" },
-        { text: `${reportSummary.disabled} disabled`, tone: reportSummary.disabled > 0 ? "danger" : "muted" },
-        {
-            text: `${reportSummary.warnings} warning${reportSummary.warnings === 1 ? "" : "s"}`,
-            tone: reportSummary.warnings > 0 ? "warning" : "muted",
-        },
-        { text: `${reportSummary.skipped} already disabled`, tone: "muted" },
-    ]));
-    if (display.showPerAccountRows) {
-        console.log("");
-        for (const report of reports) {
-            const prefix = report.outcome === "healthy"
-                ? "✓"
-                : report.outcome === "disabled-hard-failure"
-                    ? "✗"
-                    : report.outcome === "warning-soft-failure"
-                        ? "!"
-                        : "-";
-            const tone = report.outcome === "healthy"
-                ? "success"
-                : report.outcome === "disabled-hard-failure"
-                    ? "danger"
-                    : report.outcome === "warning-soft-failure"
-                        ? "warning"
-                        : "muted";
-            console.log(`${stylePromptText(prefix, tone)} ${stylePromptText(`${report.index + 1}. ${report.label}`, "accent")} ${stylePromptText("|", "muted")} ${styleAccountDetailText(report.message, tone === "success" ? "muted" : tone)}`);
-        }
-    }
-    else {
-        console.log("");
-        console.log(stylePromptText("Per-account lines are hidden in dashboard settings.", "muted"));
-    }
-    if (display.showRecommendations) {
-        console.log("");
-        if (recommendation.recommendedIndex !== null) {
-            const target = recommendation.recommendedIndex + 1;
-            console.log(`${stylePromptText("Best next account:", "accent")} ${stylePromptText(String(target), "success")}`);
-            console.log(`${stylePromptText("Why:", "accent")} ${stylePromptText(recommendation.reason, "muted")}`);
-            if (recommendation.recommendedIndex !== activeIndex) {
-                console.log(`${stylePromptText("Switch now with:", "accent")} codex auth switch ${target}`);
-            }
-        }
-        else {
-            console.log(`${stylePromptText("Note:", "accent")} ${stylePromptText(recommendation.reason, "muted")}`);
-        }
-    }
-    if (workingQuotaCache && quotaCacheChanged) {
-        await saveQuotaCache(workingQuotaCache);
-    }
-    if (changed && options.dryRun) {
-        console.log(`\n${stylePromptText("Preview only: no changes were saved.", "warning")}`);
-    }
-    else if (changed) {
-        console.log(`\n${stylePromptText("Saved updates.", "success")}`);
-    }
-    else {
-        console.log(`\n${stylePromptText("No changes were needed.", "muted")}`);
-    }
-    return 0;
-}
-function hasPlaceholderEmail(value) {
-    if (!value)
-        return false;
-    const email = value.trim().toLowerCase();
-    if (!email)
-        return false;
-    return (email.endsWith("@example.com") ||
-        email.includes("account1@example.com") ||
-        email.includes("account2@example.com") ||
-        email.includes("account3@example.com"));
-}
-function normalizeDoctorIndexes(storage) {
-    const total = storage.accounts.length;
-    const nextActive = total === 0 ? 0 : Math.max(0, Math.min(storage.activeIndex, total - 1));
-    let changed = false;
-    if (storage.activeIndex !== nextActive) {
-        storage.activeIndex = nextActive;
-        changed = true;
-    }
-    storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-    for (const family of MODEL_FAMILIES) {
-        const raw = storage.activeIndexByFamily[family];
-        const fallback = storage.activeIndex;
-        const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : fallback;
-        const clamped = total === 0 ? 0 : Math.max(0, Math.min(candidate, total - 1));
-        if (storage.activeIndexByFamily[family] !== clamped) {
-            storage.activeIndexByFamily[family] = clamped;
-            changed = true;
-        }
-    }
-    return changed;
-}
-function getDoctorRefreshTokenKey(refreshToken) {
-    if (typeof refreshToken !== "string")
-        return undefined;
-    const trimmed = refreshToken.trim();
-    return trimmed || undefined;
-}
-function applyDoctorFixes(storage) {
-    let changed = false;
-    const actions = [];
-    if (normalizeDoctorIndexes(storage)) {
-        changed = true;
-        actions.push({
-            key: "active-index",
-            message: "Normalized active account indexes",
-        });
-    }
-    const seenRefreshTokens = new Map();
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account)
-            continue;
-        const refreshToken = getDoctorRefreshTokenKey(account.refreshToken);
-        if (!refreshToken)
-            continue;
-        const existingTokenIndex = seenRefreshTokens.get(refreshToken);
-        if (typeof existingTokenIndex === "number") {
-            if (account.enabled !== false) {
-                account.enabled = false;
-                changed = true;
-                actions.push({
-                    key: "duplicate-refresh-token",
-                    message: `Disabled duplicate token entry on account ${i + 1} (kept account ${existingTokenIndex + 1})`,
-                });
-            }
-        }
-        else {
-            seenRefreshTokens.set(refreshToken, i);
-        }
-        const tokenEmail = sanitizeEmail(extractAccountEmail(account.accessToken));
-        if (tokenEmail &&
-            (!sanitizeEmail(account.email) || hasPlaceholderEmail(account.email))) {
-            account.email = tokenEmail;
-            changed = true;
-            actions.push({
-                key: "email-from-token",
-                message: `Updated account ${i + 1} email from token claims`,
-            });
-        }
-        const tokenAccountId = extractAccountId(account.accessToken);
-        if (!account.accountId && tokenAccountId) {
-            account.accountId = tokenAccountId;
-            account.accountIdSource = "token";
-            changed = true;
-            actions.push({
-                key: "account-id-from-token",
-                message: `Filled missing accountId for account ${i + 1}`,
-            });
-        }
-    }
-    const enabledCount = storage.accounts.filter((account) => account.enabled !== false).length;
-    if (storage.accounts.length > 0 && enabledCount === 0) {
-        const index = resolveActiveIndex(storage, "codex");
-        const candidate = storage.accounts[index] ?? storage.accounts[0];
-        if (candidate) {
-            candidate.enabled = true;
-            changed = true;
-            actions.push({
-                key: "enabled-accounts",
-                message: `Re-enabled account ${index + 1} to avoid an all-disabled pool`,
-            });
-        }
-    }
-    if (normalizeDoctorIndexes(storage)) {
-        changed = true;
-    }
-    return { changed, actions };
-}
-async function runDoctor(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printDoctorUsage();
-        return 0;
-    }
-    const parsedArgs = parseDoctorArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printDoctorUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    setStoragePath(null);
-    const storagePath = getStoragePath();
-    const checks = [];
-    const addCheck = (check) => {
-        checks.push(check);
-    };
-    addCheck({
-        key: "storage-file",
-        severity: existsSync(storagePath) ? "ok" : "warn",
-        message: existsSync(storagePath)
-            ? "Account storage file found"
-            : "Account storage file does not exist yet (first login pending)",
-        details: storagePath,
-    });
-    if (existsSync(storagePath)) {
-        try {
-            const stat = await fs.stat(storagePath);
-            addCheck({
-                key: "storage-readable",
-                severity: stat.size > 0 ? "ok" : "warn",
-                message: stat.size > 0 ? "Storage file is readable" : "Storage file is empty",
-                details: `${stat.size} bytes`,
-            });
-        }
-        catch (error) {
-            addCheck({
-                key: "storage-readable",
-                severity: "error",
-                message: "Unable to read storage file metadata",
-                details: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    const codexAuthPath = getCodexCliAuthPath();
-    const codexConfigPath = getCodexCliConfigPath();
-    let codexAuthEmail;
-    let codexAuthAccountId;
-    addCheck({
-        key: "codex-auth-file",
-        severity: existsSync(codexAuthPath) ? "ok" : "warn",
-        message: existsSync(codexAuthPath)
-            ? "Codex auth file found"
-            : "Codex auth file does not exist",
-        details: codexAuthPath,
-    });
-    if (existsSync(codexAuthPath)) {
-        try {
-            const raw = await fs.readFile(codexAuthPath, "utf-8");
-            const parsed = JSON.parse(raw);
-            if (parsed && typeof parsed === "object") {
-                const payload = parsed;
-                const tokens = payload.tokens && typeof payload.tokens === "object"
-                    ? payload.tokens
-                    : null;
-                const accessToken = tokens && typeof tokens.access_token === "string"
-                    ? tokens.access_token
-                    : undefined;
-                const idToken = tokens && typeof tokens.id_token === "string"
-                    ? tokens.id_token
-                    : undefined;
-                const accountIdFromFile = tokens && typeof tokens.account_id === "string"
-                    ? tokens.account_id
-                    : undefined;
-                const emailFromFile = typeof payload.email === "string" ? payload.email : undefined;
-                codexAuthEmail = sanitizeEmail(emailFromFile ?? extractAccountEmail(accessToken, idToken));
-                codexAuthAccountId = accountIdFromFile ?? extractAccountId(accessToken);
-            }
-            addCheck({
-                key: "codex-auth-readable",
-                severity: "ok",
-                message: "Codex auth file is readable",
-                details: codexAuthEmail || codexAuthAccountId
-                    ? `email=${codexAuthEmail ?? "unknown"}, accountId=${codexAuthAccountId ?? "unknown"}`
-                    : undefined,
-            });
-        }
-        catch (error) {
-            addCheck({
-                key: "codex-auth-readable",
-                severity: "error",
-                message: "Unable to read Codex auth file",
-                details: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    addCheck({
-        key: "codex-config-file",
-        severity: existsSync(codexConfigPath) ? "ok" : "warn",
-        message: existsSync(codexConfigPath)
-            ? "Codex config file found"
-            : "Codex config file does not exist",
-        details: codexConfigPath,
-    });
-    let codexAuthStoreMode;
-    if (existsSync(codexConfigPath)) {
-        try {
-            const configRaw = await fs.readFile(codexConfigPath, "utf-8");
-            const match = configRaw.match(/^\s*cli_auth_credentials_store\s*=\s*"([^"]+)"\s*$/m);
-            if (match?.[1]) {
-                codexAuthStoreMode = match[1].trim();
-            }
-        }
-        catch (error) {
-            addCheck({
-                key: "codex-auth-store",
-                severity: "warn",
-                message: "Unable to read Codex auth-store config",
-                details: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    if (!checks.some((check) => check.key === "codex-auth-store")) {
-        addCheck({
-            key: "codex-auth-store",
-            severity: codexAuthStoreMode === "file" ? "ok" : "warn",
-            message: codexAuthStoreMode === "file"
-                ? "Codex auth storage is set to file"
-                : "Codex auth storage is not explicitly set to file",
-            details: codexAuthStoreMode ? `mode=${codexAuthStoreMode}` : "mode=unset",
-        });
-    }
-    const codexCliState = await loadCodexCliState({ forceRefresh: true });
-    addCheck({
-        key: "codex-cli-state",
-        severity: codexCliState ? "ok" : "warn",
-        message: codexCliState
-            ? "Codex CLI state loaded"
-            : "Codex CLI state unavailable",
-        details: codexCliState?.path,
-    });
-    const storage = await loadAccounts();
-    let fixChanged = false;
-    let fixActions = [];
-    if (options.fix && storage && storage.accounts.length > 0) {
-        const fixed = applyDoctorFixes(storage);
-        fixChanged = fixed.changed;
-        fixActions = fixed.actions;
-        if (fixChanged && !options.dryRun) {
-            await saveAccounts(storage);
-        }
-        addCheck({
-            key: "auto-fix",
-            severity: fixChanged ? "warn" : "ok",
-            message: fixChanged
-                ? options.dryRun
-                    ? `Prepared ${fixActions.length} fix(es) (dry-run)`
-                    : `Applied ${fixActions.length} fix(es)`
-                : "No safe auto-fixes needed",
-        });
-    }
-    if (!storage || storage.accounts.length === 0) {
-        addCheck({
-            key: "accounts",
-            severity: "warn",
-            message: "No accounts configured",
-        });
-    }
-    else {
-        addCheck({
-            key: "accounts",
-            severity: "ok",
-            message: `Loaded ${storage.accounts.length} account(s)`,
-        });
-        const activeIndex = resolveActiveIndex(storage, "codex");
-        const activeExists = activeIndex >= 0 && activeIndex < storage.accounts.length;
-        addCheck({
-            key: "active-index",
-            severity: activeExists ? "ok" : "error",
-            message: activeExists
-                ? `Active index is valid (${activeIndex + 1})`
-                : "Active index is out of range",
-        });
-        const disabledCount = storage.accounts.filter((a) => a.enabled === false).length;
-        addCheck({
-            key: "enabled-accounts",
-            severity: disabledCount >= storage.accounts.length ? "error" : "ok",
-            message: disabledCount >= storage.accounts.length
-                ? "All accounts are disabled"
-                : `${storage.accounts.length - disabledCount} enabled / ${disabledCount} disabled`,
-        });
-        const seenRefreshTokens = new Set();
-        let duplicateTokenCount = 0;
-        for (const account of storage.accounts) {
-            const token = getDoctorRefreshTokenKey(account.refreshToken);
-            if (!token)
-                continue;
-            if (seenRefreshTokens.has(token)) {
-                duplicateTokenCount += 1;
-            }
-            else {
-                seenRefreshTokens.add(token);
-            }
-        }
-        addCheck({
-            key: "duplicate-refresh-token",
-            severity: duplicateTokenCount > 0 ? "warn" : "ok",
-            message: duplicateTokenCount > 0
-                ? `Detected ${duplicateTokenCount} duplicate refresh token entr${duplicateTokenCount === 1 ? "y" : "ies"}`
-                : "No duplicate refresh tokens detected",
-        });
-        const seenEmails = new Set();
-        let duplicateEmailCount = 0;
-        let placeholderEmailCount = 0;
-        let likelyInvalidRefreshTokenCount = 0;
-        for (const account of storage.accounts) {
-            const email = sanitizeEmail(account.email);
-            if (!email)
-                continue;
-            if (seenEmails.has(email))
-                duplicateEmailCount += 1;
-            seenEmails.add(email);
-            if (hasPlaceholderEmail(email))
-                placeholderEmailCount += 1;
-            if (hasLikelyInvalidRefreshToken(account.refreshToken)) {
-                likelyInvalidRefreshTokenCount += 1;
-            }
-        }
-        addCheck({
-            key: "duplicate-email",
-            severity: duplicateEmailCount > 0 ? "warn" : "ok",
-            message: duplicateEmailCount > 0
-                ? `Detected ${duplicateEmailCount} duplicate email entr${duplicateEmailCount === 1 ? "y" : "ies"}`
-                : "No duplicate emails detected",
-        });
-        addCheck({
-            key: "placeholder-email",
-            severity: placeholderEmailCount > 0 ? "warn" : "ok",
-            message: placeholderEmailCount > 0
-                ? `${placeholderEmailCount} account(s) appear to be placeholder/demo entries`
-                : "No placeholder emails detected",
-        });
-        addCheck({
-            key: "refresh-token-shape",
-            severity: likelyInvalidRefreshTokenCount > 0 ? "warn" : "ok",
-            message: likelyInvalidRefreshTokenCount > 0
-                ? `${likelyInvalidRefreshTokenCount} account(s) have likely invalid refresh token format`
-                : "Refresh token format looks normal",
-        });
-        const now = Date.now();
-        const forecastResults = evaluateForecastAccounts(storage.accounts.map((account, index) => ({
-            index,
-            account,
-            isCurrent: index === activeIndex,
-            now,
-        })));
-        const recommendation = recommendForecastAccount(forecastResults);
-        if (recommendation.recommendedIndex !== null && recommendation.recommendedIndex !== activeIndex) {
-            addCheck({
-                key: "recommended-switch",
-                severity: "warn",
-                message: `A healthier account is available: switch to ${recommendation.recommendedIndex + 1}`,
-                details: recommendation.reason,
-            });
-        }
-        else {
-            addCheck({
-                key: "recommended-switch",
-                severity: "ok",
-                message: "Current account aligns with forecast recommendation",
-            });
-        }
-        if (activeExists) {
-            const activeAccount = storage.accounts[activeIndex];
-            const managerActiveEmail = sanitizeEmail(activeAccount?.email);
-            const managerActiveAccountId = activeAccount?.accountId;
-            const codexActiveEmail = sanitizeEmail(codexCliState?.activeEmail) ?? codexAuthEmail;
-            const codexActiveAccountId = codexCliState?.activeAccountId ?? codexAuthAccountId;
-            const isEmailMismatch = !!managerActiveEmail &&
-                !!codexActiveEmail &&
-                managerActiveEmail !== codexActiveEmail;
-            const isAccountIdMismatch = !!managerActiveAccountId &&
-                !!codexActiveAccountId &&
-                managerActiveAccountId !== codexActiveAccountId;
-            addCheck({
-                key: "active-selection-sync",
-                severity: isEmailMismatch || isAccountIdMismatch ? "warn" : "ok",
-                message: isEmailMismatch || isAccountIdMismatch
-                    ? "Manager active account and Codex active account are not aligned"
-                    : "Manager active account and Codex active account are aligned",
-                details: `manager=${managerActiveEmail ?? managerActiveAccountId ?? "unknown"} | codex=${codexActiveEmail ?? codexActiveAccountId ?? "unknown"}`,
-            });
-            if (options.fix && activeAccount) {
-                let syncAccessToken = activeAccount.accessToken;
-                let syncRefreshToken = activeAccount.refreshToken;
-                let syncExpiresAt = activeAccount.expiresAt;
-                let syncIdToken;
-                let storageChangedFromDoctorSync = false;
-                if (!hasUsableAccessToken(activeAccount, now)) {
-                    if (options.dryRun) {
-                        fixActions.push({
-                            key: "doctor-refresh",
-                            message: `Prepared active-account token refresh for account ${activeIndex + 1} (dry-run)`,
-                        });
-                    }
-                    else {
-                        const refreshResult = await queuedRefresh(activeAccount.refreshToken);
-                        if (refreshResult.type === "success") {
-                            const refreshedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-                            const refreshedAccountId = extractAccountId(refreshResult.access);
-                            activeAccount.accessToken = refreshResult.access;
-                            activeAccount.refreshToken = refreshResult.refresh;
-                            activeAccount.expiresAt = refreshResult.expires;
-                            if (refreshedEmail)
-                                activeAccount.email = refreshedEmail;
-                            applyTokenAccountIdentity(activeAccount, refreshedAccountId);
-                            syncAccessToken = refreshResult.access;
-                            syncRefreshToken = refreshResult.refresh;
-                            syncExpiresAt = refreshResult.expires;
-                            syncIdToken = refreshResult.idToken;
-                            storageChangedFromDoctorSync = true;
-                            fixActions.push({
-                                key: "doctor-refresh",
-                                message: `Refreshed active account tokens for account ${activeIndex + 1}`,
-                            });
-                        }
-                        else {
-                            addCheck({
-                                key: "doctor-refresh",
-                                severity: "warn",
-                                message: "Unable to refresh active account before Codex sync",
-                                details: normalizeFailureDetail(refreshResult.message, refreshResult.reason),
-                            });
-                        }
-                    }
-                }
-                if (storageChangedFromDoctorSync) {
-                    fixChanged = true;
-                    if (!options.dryRun) {
-                        await saveAccounts(storage);
-                    }
-                }
-                if (!options.dryRun) {
-                    const synced = await setCodexCliActiveSelection({
-                        accountId: activeAccount.accountId,
-                        email: activeAccount.email,
-                        accessToken: syncAccessToken,
-                        refreshToken: syncRefreshToken,
-                        expiresAt: syncExpiresAt,
-                        ...(syncIdToken ? { idToken: syncIdToken } : {}),
-                    });
-                    if (synced) {
-                        fixChanged = true;
-                        fixActions.push({
-                            key: "codex-active-sync",
-                            message: "Synced manager active account into Codex auth state",
-                        });
-                    }
-                    else {
-                        addCheck({
-                            key: "codex-active-sync",
-                            severity: "warn",
-                            message: "Failed to sync manager active account into Codex auth state",
-                        });
-                    }
-                }
-                else {
-                    fixActions.push({
-                        key: "codex-active-sync",
-                        message: "Prepared Codex active-account sync (dry-run)",
-                    });
-                }
-            }
-        }
+    return fallbackIndex >= 0 && fallbackIndex < storage.accounts.length
+        ? fallbackIndex
+        : null;
+}
+function matchesManageActionAccount(account, candidate) {
+    if (!account || !candidate) {
+        return false;
     }
-    const summary = checks.reduce((acc, check) => {
-        acc[check.severity] += 1;
-        return acc;
-    }, { ok: 0, warn: 0, error: 0 });
-    if (options.json) {
-        console.log(JSON.stringify({
-            command: "doctor",
-            storagePath,
-            summary,
-            checks,
-            fix: {
-                enabled: options.fix,
-                dryRun: options.dryRun,
-                changed: fixChanged,
-                actions: fixActions,
-            },
-        }, null, 2));
-        return summary.error > 0 ? 1 : 0;
-    }
-    console.log("Doctor diagnostics");
-    console.log(`Storage: ${storagePath}`);
-    console.log(`Summary: ${summary.ok} ok, ${summary.warn} warnings, ${summary.error} errors`);
-    console.log("");
-    for (const check of checks) {
-        const marker = check.severity === "ok" ? "✓" : check.severity === "warn" ? "!" : "✗";
-        console.log(`${marker} ${check.key}: ${check.message}`);
-        if (check.details) {
-            console.log(`  ${check.details}`);
-        }
-    }
-    if (options.fix) {
-        console.log("");
-        if (fixActions.length > 0) {
-            console.log(`Auto-fix actions (${options.dryRun ? "dry-run" : "applied"}):`);
-            for (const action of fixActions) {
-                console.log(`  - ${action.message}`);
-            }
-        }
-        else {
-            console.log("Auto-fix actions: none");
-        }
+    if (account.accountId || candidate.accountId) {
+        return account.accountId === candidate.accountId;
     }
-    return summary.error > 0 ? 1 : 0;
-}
-async function clearAccountsAndReset() {
-    await clearAccounts();
+    return (account.refreshToken === candidate.refreshToken
+        && sanitizeEmail(account.email) === sanitizeEmail(candidate.email));
 }
 async function handleManageAction(storage, menuResult) {
     if (typeof menuResult.switchAccountIndex === "number") {
         const index = menuResult.switchAccountIndex;
-        await runSwitch([String(index + 1)]);
+        await runSwitchCommand([String(index + 1)], {
+            setStoragePath,
+            loadAccounts,
+            persistAndSyncSelectedAccount,
+        });
         return;
     }
     if (typeof menuResult.deleteAccountIndex === "number") {
         const idx = menuResult.deleteAccountIndex;
-        if (idx >= 0 && idx < storage.accounts.length) {
-            storage.accounts.splice(idx, 1);
-            storage.activeIndex = 0;
-            storage.activeIndexByFamily = {};
-            for (const family of MODEL_FAMILIES) {
-                storage.activeIndexByFamily[family] = 0;
-            }
-            await saveAccounts(storage);
+        const selectedAccount = storage.accounts[idx];
+        let deleted = false;
+        if (selectedAccount) {
+            await withAccountStorageTransaction(async (loadedStorage, persist) => {
+                const nextStorage = loadedStorage
+                    ? structuredClone(loadedStorage)
+                    : structuredClone(storage);
+                const nextIndex = resolveManageActionAccountIndex(nextStorage, idx, selectedAccount);
+                if (nextIndex === null) {
+                    return;
+                }
+                const nextAccount = nextStorage.accounts[nextIndex];
+                if (!matchesManageActionAccount(selectedAccount, nextAccount)) {
+                    return;
+                }
+                nextStorage.accounts.splice(nextIndex, 1);
+                resetManageActionSelection(nextStorage, nextIndex);
+                await persist(nextStorage);
+                replaceManageActionStorage(storage, nextStorage);
+                deleted = true;
+            });
+        }
+        if (deleted) {
             console.log(`Deleted account ${idx + 1}.`);
         }
         return;
     }
     if (typeof menuResult.toggleAccountIndex === "number") {
         const idx = menuResult.toggleAccountIndex;
-        const account = storage.accounts[idx];
-        if (account) {
-            account.enabled = account.enabled === false;
-            await saveAccounts(storage);
-            console.log(`${account.enabled === false ? "Disabled" : "Enabled"} account ${idx + 1}.`);
+        const selectedAccount = storage.accounts[idx];
+        let nextEnabledState = null;
+        if (selectedAccount) {
+            await withAccountStorageTransaction(async (loadedStorage, persist) => {
+                const nextStorage = loadedStorage
+                    ? structuredClone(loadedStorage)
+                    : structuredClone(storage);
+                const nextIndex = resolveManageActionAccountIndex(nextStorage, idx, selectedAccount);
+                if (nextIndex === null) {
+                    return;
+                }
+                const nextAccount = nextStorage.accounts[nextIndex];
+                if (!nextAccount || !matchesManageActionAccount(selectedAccount, nextAccount)) {
+                    return;
+                }
+                nextAccount.enabled = nextAccount.enabled === false;
+                await persist(nextStorage);
+                replaceManageActionStorage(storage, nextStorage);
+                nextEnabledState = nextAccount.enabled !== false;
+            });
+        }
+        if (nextEnabledState !== null) {
+            console.log(`${nextEnabledState ? "Enabled" : "Disabled"} account ${idx + 1}.`);
         }
         return;
     }
@@ -3369,7 +1952,15 @@ async function handleManageAction(storage, menuResult) {
         const existing = storage.accounts[idx];
         if (!existing)
             return;
-        const tokenResult = await runOAuthFlow(true);
+        const signInMode = await promptOAuthSignInMode(null);
+        if (signInMode === "cancel") {
+            console.log(stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
+            return;
+        }
+        if (signInMode !== "browser" && signInMode !== "manual") {
+            return;
+        }
+        const tokenResult = await runOAuthFlow(true, signInMode);
         if (tokenResult.type !== "success") {
             console.error(`Refresh failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
             return;
@@ -3380,7 +1971,17 @@ async function handleManageAction(storage, menuResult) {
         console.log(`Refreshed account ${idx + 1}.`);
     }
 }
-async function runAuthLogin() {
+async function runAuthLogin(args) {
+    const parsedArgs = parseAuthLoginArgs(args);
+    if (!parsedArgs.ok) {
+        if (parsedArgs.reason === "error") {
+            console.error(parsedArgs.message);
+            printUsage();
+            return 1;
+        }
+        return 0;
+    }
+    const loginOptions = parsedArgs.options;
     setStoragePath(null);
     let pendingMenuQuotaRefresh = null;
     let menuQuotaRefreshStatus;
@@ -3421,7 +2022,9 @@ async function runAuthLogin() {
                 const flaggedStorage = await loadFlaggedAccounts();
                 const menuResult = await promptLoginMode(toExistingAccountInfo(currentStorage, quotaCache, displaySettings), {
                     flaggedCount: flaggedStorage.accounts.length,
-                    statusMessage: showFetchStatus ? () => menuQuotaRefreshStatus : undefined,
+                    statusMessage: showFetchStatus
+                        ? () => menuQuotaRefreshStatus
+                        : undefined,
                 });
                 if (menuResult.mode === "cancel") {
                     console.log("Cancelled.");
@@ -3447,7 +2050,7 @@ async function runAuthLogin() {
                 }
                 if (menuResult.mode === "fix") {
                     await runActionPanel("Auto-Fix", "Checking and fixing common issues", async () => {
-                        await runFix(["--live"]);
+                        await runRepairFix(["--live"], createRepairCommandDeps());
                     }, displaySettings);
                     continue;
                 }
@@ -3457,7 +2060,7 @@ async function runAuthLogin() {
                 }
                 if (menuResult.mode === "verify-flagged") {
                     await runActionPanel("Problem Account Check", "Checking problem accounts", async () => {
-                        await runVerifyFlagged([]);
+                        await runRepairVerifyFlagged([], createRepairCommandDeps());
                     }, displaySettings);
                     continue;
                 }
@@ -3485,12 +2088,115 @@ async function runAuthLogin() {
             }
         }
         const refreshedStorage = await loadAccounts();
-        const existingCount = refreshedStorage?.accounts.length ?? 0;
+        let existingCount = refreshedStorage?.accounts.length ?? 0;
         let forceNewLogin = existingCount > 0;
+        let onboardingBackupDiscoveryWarning = null;
+        const loadNamedBackupsForOnboarding = async () => {
+            if (existingCount > 0) {
+                onboardingBackupDiscoveryWarning = null;
+                return [];
+            }
+            try {
+                onboardingBackupDiscoveryWarning = null;
+                return await getNamedBackups();
+            }
+            catch (error) {
+                const code = error.code;
+                log.debug("getNamedBackups failed, skipping restore option", {
+                    code,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                if (code && code !== "ENOENT") {
+                    onboardingBackupDiscoveryWarning =
+                        "Named backup discovery failed. Continuing with browser or manual sign-in only.";
+                    console.warn(onboardingBackupDiscoveryWarning);
+                }
+                else {
+                    onboardingBackupDiscoveryWarning = null;
+                }
+                return [];
+            }
+        };
+        let namedBackups = await loadNamedBackupsForOnboarding();
         while (true) {
-            const tokenResult = await runOAuthFlow(forceNewLogin);
+            const latestNamedBackup = namedBackups[0] ?? null;
+            const preferManualMode = loginOptions.manual || isBrowserLaunchSuppressed();
+            const signInMode = preferManualMode
+                ? "manual"
+                : await promptOAuthSignInMode(latestNamedBackup, onboardingBackupDiscoveryWarning);
+            if (signInMode === "cancel") {
+                if (existingCount > 0) {
+                    console.log(stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
+                    continue loginFlow;
+                }
+                console.log("Cancelled.");
+                return 0;
+            }
+            if (signInMode === "restore-backup") {
+                const latestAvailableBackup = namedBackups[0] ?? null;
+                if (!latestAvailableBackup) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const restoreMode = await promptBackupRestoreMode(latestAvailableBackup);
+                if (restoreMode === "back") {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const selectedBackup = restoreMode === "manual"
+                    ? await promptManualBackupSelection(namedBackups)
+                    : latestAvailableBackup;
+                if (!selectedBackup) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const confirmed = await confirm(UI_COPY.oauth.restoreBackupConfirm(selectedBackup.fileName, selectedBackup.accountCount));
+                if (!confirmed) {
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                const displaySettings = await loadDashboardDisplaySettings();
+                applyUiThemeFromDashboardSettings(displaySettings);
+                try {
+                    await runActionPanel("Load Backup", `Loading ${selectedBackup.fileName}`, async () => {
+                        const restoredStorage = await restoreAccountsFromBackup(selectedBackup.path, { persist: false });
+                        const targetIndex = resolveActiveIndex(restoredStorage);
+                        const { synced } = await persistAndSyncSelectedAccount({
+                            storage: restoredStorage,
+                            targetIndex,
+                            parsed: targetIndex + 1,
+                            switchReason: "restore",
+                            preserveActiveIndexByFamily: true,
+                        });
+                        console.log(UI_COPY.oauth.restoreBackupLoaded(selectedBackup.fileName, restoredStorage.accounts.length));
+                        if (!synced) {
+                            console.warn(UI_COPY.oauth.restoreBackupSyncWarning);
+                        }
+                    }, displaySettings);
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    if (error instanceof StorageError) {
+                        console.error(formatStorageErrorHint(error, selectedBackup.path));
+                    }
+                    else {
+                        console.error(`Backup restore failed: ${message}`);
+                    }
+                    const storageAfterRestoreAttempt = await loadAccounts().catch(() => null);
+                    if ((storageAfterRestoreAttempt?.accounts.length ?? 0) > 0) {
+                        continue loginFlow;
+                    }
+                    namedBackups = await loadNamedBackupsForOnboarding();
+                    continue;
+                }
+                continue loginFlow;
+            }
+            if (signInMode !== "browser" && signInMode !== "manual") {
+                continue;
+            }
+            const tokenResult = await runOAuthFlow(forceNewLogin, signInMode);
             if (tokenResult.type !== "success") {
-                if (isUserCancelledOAuth(tokenResult)) {
+                if (isOAuthCancellation(tokenResult)) {
                     if (existingCount > 0) {
                         console.log(stylePromptText(UI_COPY.oauth.cancelledBackToMenu, "muted"));
                         continue loginFlow;
@@ -3506,7 +2212,14 @@ async function runAuthLogin() {
             await syncSelectionToCodex(resolved);
             const latestStorage = await loadAccounts();
             const count = latestStorage?.accounts.length ?? 1;
+            existingCount = count;
+            namedBackups = [];
+            onboardingBackupDiscoveryWarning = null;
             console.log(`Added account. Total: ${count}`);
+            console.log("Next steps:");
+            console.log("  codex auth status  Check that the wrapper is active.");
+            console.log("  codex auth check   Confirm your saved accounts look healthy.");
+            console.log("  codex auth list    Review saved accounts before switching.");
             if (count >= ACCOUNT_LIMITS.MAX_ACCOUNTS) {
                 console.log(`Reached maximum account limit (${ACCOUNT_LIMITS.MAX_ACCOUNTS}).`);
                 break;
@@ -3516,57 +2229,31 @@ async function runAuthLogin() {
                 break;
             forceNewLogin = true;
         }
-        continue loginFlow;
-    }
-}
-async function runSwitch(args) {
-    setStoragePath(null);
-    const indexArg = args[0];
-    if (!indexArg) {
-        console.error("Missing index. Usage: codex auth switch <index>");
-        return 1;
-    }
-    const parsed = Number.parseInt(indexArg, 10);
-    if (!Number.isFinite(parsed) || parsed < 1) {
-        console.error(`Invalid index: ${indexArg}`);
-        return 1;
-    }
-    const targetIndex = parsed - 1;
-    const storage = await loadAccounts();
-    if (!storage || storage.accounts.length === 0) {
-        console.error("No accounts configured.");
-        return 1;
-    }
-    if (targetIndex < 0 || targetIndex >= storage.accounts.length) {
-        console.error(`Index out of range. Valid range: 1-${storage.accounts.length}`);
-        return 1;
-    }
-    const account = storage.accounts[targetIndex];
-    if (!account) {
-        console.error(`Account ${parsed} not found.`);
-        return 1;
-    }
-    const { synced, wasDisabled } = await persistAndSyncSelectedAccount({
-        storage,
-        targetIndex,
-        parsed,
-        switchReason: "rotation",
-    });
-    if (!synced) {
-        console.warn(`Switched account ${parsed} locally, but Codex auth sync did not complete. Multi-auth routing will still use this account.`);
     }
-    console.log(`Switched to account ${parsed}: ${formatAccountLabel(account, targetIndex)}${wasDisabled ? " (re-enabled)" : ""}`);
-    return 0;
 }
-async function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, }) {
+async function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, switchReason, initialSyncIdToken, preserveActiveIndexByFamily = false, }) {
     const account = storage.accounts[targetIndex];
     if (!account) {
         throw new Error(`Account ${parsed} not found.`);
     }
+    const shouldPreserveActiveIndexByFamily = preserveActiveIndexByFamily &&
+        !!storage.activeIndexByFamily &&
+        targetIndex === storage.activeIndex;
     storage.activeIndex = targetIndex;
     storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
-    for (const family of MODEL_FAMILIES) {
-        storage.activeIndexByFamily[family] = targetIndex;
+    if (shouldPreserveActiveIndexByFamily) {
+        const maxIndex = Math.max(0, storage.accounts.length - 1);
+        for (const family of MODEL_FAMILIES) {
+            const raw = storage.activeIndexByFamily[family];
+            const candidate = typeof raw === "number" && Number.isFinite(raw) ? raw : targetIndex;
+            storage.activeIndexByFamily[family] = Math.max(0, Math.min(candidate, maxIndex));
+        }
+    }
+    else {
+        storage.activeIndexByFamily = storage.activeIndexByFamily ?? {};
+        for (const family of MODEL_FAMILIES) {
+            storage.activeIndexByFamily[family] = targetIndex;
+        }
     }
     const wasDisabled = account.enabled === false;
     if (wasDisabled) {
@@ -3618,222 +2305,26 @@ async function persistAndSyncSelectedAccount({ storage, targetIndex, parsed, swi
     return { synced, wasDisabled };
 }
 async function runBest(args) {
-    if (args.includes("--help") || args.includes("-h")) {
-        printBestUsage();
-        return 0;
-    }
-    const parsedArgs = parseBestArgs(args);
-    if (!parsedArgs.ok) {
-        console.error(parsedArgs.message);
-        printBestUsage();
-        return 1;
-    }
-    const options = parsedArgs.options;
-    if (options.modelProvided && !options.live) {
-        console.error("--model requires --live for codex auth best");
-        printBestUsage();
-        return 1;
-    }
-    setStoragePath(null);
-    const storage = await loadAccounts();
-    if (!storage || storage.accounts.length === 0) {
-        if (options.json) {
-            console.log(JSON.stringify({ error: "No accounts configured." }, null, 2));
-        }
-        else {
-            console.log("No accounts configured.");
-        }
-        return 1;
-    }
-    const now = Date.now();
-    const refreshFailures = new Map();
-    const liveQuotaByIndex = new Map();
-    const probeIdTokenByIndex = new Map();
-    const probeRefreshedIndices = new Set();
-    const probeErrors = [];
-    let changed = false;
-    const printProbeNotes = () => {
-        if (probeErrors.length === 0)
-            return;
-        console.log(`Live check notes (${probeErrors.length}):`);
-        for (const error of probeErrors) {
-            console.log(`  - ${error}`);
-        }
-    };
-    const persistProbeChangesIfNeeded = async () => {
-        if (!changed)
-            return;
-        await saveAccounts(storage);
-        changed = false;
-    };
-    for (let i = 0; i < storage.accounts.length; i += 1) {
-        const account = storage.accounts[i];
-        if (!account || !options.live)
-            continue;
-        if (account.enabled === false)
-            continue;
-        let probeAccessToken = account.accessToken;
-        let probeAccountId = account.accountId ?? extractAccountId(account.accessToken);
-        if (!hasUsableAccessToken(account, now)) {
-            const refreshResult = await queuedRefresh(account.refreshToken);
-            if (refreshResult.type !== "success") {
-                refreshFailures.set(i, {
-                    ...refreshResult,
-                    message: normalizeFailureDetail(refreshResult.message, refreshResult.reason),
-                });
-                continue;
-            }
-            const refreshedEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-            const refreshedAccountId = extractAccountId(refreshResult.access);
-            if (account.refreshToken !== refreshResult.refresh) {
-                account.refreshToken = refreshResult.refresh;
-                changed = true;
-            }
-            if (account.accessToken !== refreshResult.access) {
-                account.accessToken = refreshResult.access;
-                changed = true;
-            }
-            if (account.expiresAt !== refreshResult.expires) {
-                account.expiresAt = refreshResult.expires;
-                changed = true;
-            }
-            if (refreshedEmail && refreshedEmail !== account.email) {
-                account.email = refreshedEmail;
-                changed = true;
-            }
-            if (refreshedAccountId && refreshedAccountId !== account.accountId) {
-                account.accountId = refreshedAccountId;
-                account.accountIdSource = "token";
-                changed = true;
-            }
-            if (refreshResult.idToken) {
-                probeIdTokenByIndex.set(i, refreshResult.idToken);
-            }
-            probeRefreshedIndices.add(i);
-            probeAccessToken = account.accessToken;
-            probeAccountId = account.accountId ?? refreshedAccountId;
-        }
-        if (!probeAccessToken || !probeAccountId) {
-            probeErrors.push(`${formatAccountLabel(account, i)}: missing accountId for live probe`);
-            continue;
-        }
-        try {
-            const liveQuota = await fetchCodexQuotaSnapshot({
-                accountId: probeAccountId,
-                accessToken: probeAccessToken,
-                model: options.model,
-            });
-            liveQuotaByIndex.set(i, liveQuota);
-        }
-        catch (error) {
-            const message = normalizeFailureDetail(error instanceof Error ? error.message : String(error), undefined);
-            probeErrors.push(`${formatAccountLabel(account, i)}: ${message}`);
-        }
-    }
-    const forecastInputs = storage.accounts.map((account, index) => ({
-        index,
-        account,
-        isCurrent: index === resolveActiveIndex(storage, "codex"),
-        now,
-        refreshFailure: refreshFailures.get(index),
-        liveQuota: liveQuotaByIndex.get(index),
-    }));
-    const forecastResults = evaluateForecastAccounts(forecastInputs);
-    const recommendation = recommendForecastAccount(forecastResults);
-    if (recommendation.recommendedIndex === null) {
-        await persistProbeChangesIfNeeded();
-        if (options.json) {
-            console.log(JSON.stringify({
-                error: recommendation.reason,
-                ...(probeErrors.length > 0 ? { probeErrors } : {}),
-            }, null, 2));
-        }
-        else {
-            console.log(`No best account available: ${recommendation.reason}`);
-            printProbeNotes();
-        }
-        return 1;
-    }
-    const bestIndex = recommendation.recommendedIndex;
-    const bestAccount = storage.accounts[bestIndex];
-    if (!bestAccount) {
-        await persistProbeChangesIfNeeded();
-        if (options.json) {
-            console.log(JSON.stringify({ error: "Best account not found." }, null, 2));
-        }
-        else {
-            console.log("Best account not found.");
-        }
-        return 1;
-    }
-    // Check if already on best account
-    const currentIndex = resolveActiveIndex(storage, "codex");
-    if (currentIndex === bestIndex) {
-        const shouldSyncCurrentBest = probeRefreshedIndices.has(bestIndex) || probeIdTokenByIndex.has(bestIndex);
-        let alreadyBestSynced;
-        if (changed) {
-            bestAccount.lastUsed = now;
-            await persistProbeChangesIfNeeded();
-        }
-        if (shouldSyncCurrentBest) {
-            alreadyBestSynced = await setCodexCliActiveSelection({
-                accountId: bestAccount.accountId,
-                email: bestAccount.email,
-                accessToken: bestAccount.accessToken,
-                refreshToken: bestAccount.refreshToken,
-                expiresAt: bestAccount.expiresAt,
-                ...(probeIdTokenByIndex.has(bestIndex)
-                    ? { idToken: probeIdTokenByIndex.get(bestIndex) }
-                    : {}),
-            });
-            if (!alreadyBestSynced && !options.json) {
-                console.warn("Codex auth sync did not complete. Multi-auth routing will still use this account.");
-            }
-        }
-        if (options.json) {
-            console.log(JSON.stringify({
-                message: `Already on best account: ${formatAccountLabel(bestAccount, bestIndex)}`,
-                accountIndex: bestIndex + 1,
-                reason: recommendation.reason,
-                ...(alreadyBestSynced !== undefined ? { synced: alreadyBestSynced } : {}),
-                ...(probeErrors.length > 0 ? { probeErrors } : {}),
-            }, null, 2));
-        }
-        else {
-            console.log(`Already on best account ${bestIndex + 1}: ${formatAccountLabel(bestAccount, bestIndex)}`);
-            console.log(`Reason: ${recommendation.reason}`);
-            printProbeNotes();
-        }
-        return 0;
-    }
-    const targetIndex = bestIndex;
-    const parsed = targetIndex + 1;
-    const { synced, wasDisabled } = await persistAndSyncSelectedAccount({
-        storage,
-        targetIndex,
-        parsed,
-        switchReason: "best",
-        initialSyncIdToken: probeIdTokenByIndex.get(bestIndex),
+    return runBestCommand(args, {
+        setStoragePath,
+        loadAccounts,
+        saveAccounts,
+        parseBestArgs,
+        printBestUsage,
+        resolveActiveIndex,
+        hasUsableAccessToken,
+        queuedRefresh,
+        normalizeFailureDetail,
+        extractAccountId,
+        extractAccountEmail,
+        sanitizeEmail,
+        formatAccountLabel,
+        fetchCodexQuotaSnapshot,
+        evaluateForecastAccounts,
+        recommendForecastAccount,
+        persistAndSyncSelectedAccount,
+        setCodexCliActiveSelection,
     });
-    if (options.json) {
-        console.log(JSON.stringify({
-            message: `Switched to best account: ${formatAccountLabel(bestAccount, targetIndex)}`,
-            accountIndex: parsed,
-            reason: recommendation.reason,
-            synced,
-            wasDisabled,
-            ...(probeErrors.length > 0 ? { probeErrors } : {}),
-        }, null, 2));
-    }
-    else {
-        console.log(`Switched to best account ${parsed}: ${formatAccountLabel(bestAccount, targetIndex)}${wasDisabled ? " (re-enabled)" : ""}`);
-        console.log(`Reason: ${recommendation.reason}`);
-        printProbeNotes();
-        if (!synced) {
-            console.warn("Codex auth sync did not complete. Multi-auth routing will still use this account.");
-        }
-    }
-    return 0;
 }
 export async function autoSyncActiveAccountToCodex() {
     setStoragePath(null);
@@ -3849,48 +2340,81 @@ export async function autoSyncActiveAccountToCodex() {
     if (!account) {
         return false;
     }
+    const accountMatch = {
+        accountId: account.accountId,
+        email: account.email,
+        refreshToken: account.refreshToken,
+    };
     const now = Date.now();
     let syncAccessToken = account.accessToken;
     let syncRefreshToken = account.refreshToken;
     let syncExpiresAt = account.expiresAt;
     let syncIdToken;
+    let syncAccountId = account.accountId;
+    let syncEmail = account.email;
     let changed = false;
+    let nextStoredAccount = null;
     if (!hasUsableAccessToken(account, now)) {
         const refreshResult = await queuedRefresh(account.refreshToken);
-        if (refreshResult.type === "success") {
-            const tokenAccountId = extractAccountId(refreshResult.access);
-            const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
-            if (account.refreshToken !== refreshResult.refresh) {
-                account.refreshToken = refreshResult.refresh;
-                changed = true;
-            }
-            if (account.accessToken !== refreshResult.access) {
-                account.accessToken = refreshResult.access;
-                changed = true;
-            }
-            if (account.expiresAt !== refreshResult.expires) {
-                account.expiresAt = refreshResult.expires;
-                changed = true;
-            }
-            if (nextEmail && nextEmail !== account.email) {
-                account.email = nextEmail;
-                changed = true;
+        if (refreshResult.type !== "success") {
+            return false;
+        }
+        nextStoredAccount = structuredClone(account);
+        const tokenAccountId = extractAccountId(refreshResult.access);
+        const nextEmail = sanitizeEmail(extractAccountEmail(refreshResult.access, refreshResult.idToken));
+        if (nextStoredAccount.refreshToken !== refreshResult.refresh) {
+            nextStoredAccount.refreshToken = refreshResult.refresh;
+            changed = true;
+        }
+        if (nextStoredAccount.accessToken !== refreshResult.access) {
+            nextStoredAccount.accessToken = refreshResult.access;
+            changed = true;
+        }
+        if (nextStoredAccount.expiresAt !== refreshResult.expires) {
+            nextStoredAccount.expiresAt = refreshResult.expires;
+            changed = true;
+        }
+        if (nextEmail && nextEmail !== nextStoredAccount.email) {
+            nextStoredAccount.email = nextEmail;
+            changed = true;
+        }
+        if (applyTokenAccountIdentity(nextStoredAccount, tokenAccountId)) {
+            changed = true;
+        }
+        syncAccessToken = refreshResult.access;
+        syncRefreshToken = refreshResult.refresh;
+        syncExpiresAt = refreshResult.expires;
+        syncIdToken = refreshResult.idToken;
+        syncAccountId = nextStoredAccount.accountId;
+        syncEmail = nextStoredAccount.email;
+    }
+    if (changed && nextStoredAccount) {
+        let persisted = false;
+        await withAccountStorageTransaction(async (loadedStorage, persist) => {
+            if (!loadedStorage) {
+                return;
             }
-            if (applyTokenAccountIdentity(account, tokenAccountId)) {
-                changed = true;
+            const nextStorage = structuredClone(loadedStorage);
+            const targetIndex = findMatchingAccountIndex(nextStorage.accounts, accountMatch, {
+                allowUniqueAccountIdFallbackWithoutEmail: true,
+            })
+                ?? findMatchingAccountIndex(nextStorage.accounts, nextStoredAccount, {
+                    allowUniqueAccountIdFallbackWithoutEmail: true,
+                });
+            if (targetIndex === undefined) {
+                return;
             }
-            syncAccessToken = refreshResult.access;
-            syncRefreshToken = refreshResult.refresh;
-            syncExpiresAt = refreshResult.expires;
-            syncIdToken = refreshResult.idToken;
+            nextStorage.accounts[targetIndex] = structuredClone(nextStoredAccount);
+            await persist(nextStorage);
+            persisted = true;
+        });
+        if (!persisted) {
+            return false;
         }
     }
-    if (changed) {
-        await saveAccounts(storage);
-    }
     return setCodexCliActiveSelection({
-        accountId: account.accountId,
-        email: account.email,
+        accountId: syncAccountId,
+        email: syncEmail,
         accessToken: syncAccessToken,
         refreshToken: syncRefreshToken,
         expiresAt: syncExpiresAt,
@@ -3920,24 +2444,32 @@ export async function runCodexMultiAuthCli(rawArgs) {
         return 0;
     }
     if (command === "login") {
-        return runAuthLogin();
+        return runAuthLogin(rest);
     }
     if (command === "list" || command === "status") {
-        await showAccountStatus();
-        return 0;
+        return runStatusCommand({
+            setStoragePath,
+            getStoragePath,
+            loadAccounts,
+            resolveActiveIndex,
+            formatRateLimitEntry,
+        });
     }
     if (command === "switch") {
-        return runSwitch(rest);
+        return runSwitchCommand(rest, {
+            setStoragePath,
+            loadAccounts,
+            persistAndSyncSelectedAccount,
+        });
     }
     if (command === "check") {
-        await runHealthCheck({ liveProbe: true });
-        return 0;
+        return runCheckCommand({ runHealthCheck });
     }
     if (command === "features") {
-        return runFeaturesReport();
+        return runFeaturesCommand({ implementedFeatures: IMPLEMENTED_FEATURES });
     }
     if (command === "verify-flagged") {
-        return runVerifyFlagged(rest);
+        return runRepairVerifyFlagged(rest, createRepairCommandDeps());
     }
     if (command === "forecast") {
         return runForecast(rest);
@@ -3946,13 +2478,53 @@ export async function runCodexMultiAuthCli(rawArgs) {
         return runBest(rest);
     }
     if (command === "report") {
-        return runReport(rest);
+        return runReportCommand(rest, {
+            setStoragePath,
+            getStoragePath,
+            loadAccounts,
+            resolveActiveIndex,
+            queuedRefresh,
+            fetchCodexQuotaSnapshot,
+            formatRateLimitEntry,
+            normalizeFailureDetail,
+        });
     }
     if (command === "fix") {
-        return runFix(rest);
+        return runRepairFix(rest, createRepairCommandDeps());
     }
     if (command === "doctor") {
-        return runDoctor(rest);
+        return runRepairDoctor(rest, createRepairCommandDeps());
+    }
+    if (command === "config") {
+        const [subcommand, ...configArgs] = rest;
+        if (subcommand === "explain") {
+            return runConfigExplainCommand(configArgs, {
+                getReport: getPluginConfigExplainReport,
+            });
+        }
+        if (subcommand === "template") {
+            return runInitConfigCommand(configArgs);
+        }
+        console.error(`Unknown config command: ${subcommand ?? "(missing)"}`);
+        return 1;
+    }
+    if (command === "init-config") {
+        return runInitConfigCommand(rest);
+    }
+    if (command === "debug") {
+        const [subcommand, ...debugArgs] = rest;
+        if (subcommand === "bundle") {
+            return runDebugBundleCommand(debugArgs, {
+                getConfigReport: getPluginConfigExplainReport,
+                getStoragePath,
+                loadAccounts,
+                loadFlaggedAccounts,
+                loadCodexCliState,
+                getLastAccountsSaveTimestamp,
+            });
+        }
+        console.error(`Unknown debug command: ${subcommand ?? "(missing)"}`);
+        return 1;
     }
     console.error(`Unknown command: ${command}`);
     printUsage();