codex-multi-auth 2.15.0 → 2.17.0

package/dist/lib/codex-cli/writer.js

@@ -1,9 +1,13 @@
+import { withNativeBindingLock } from "../runtime/native-binding-lock.js";
+import { hasNativeProviderConfig } from "../runtime-constants.js";
 import { existsSync, promises as fs } from "node:fs";
 import { dirname } from "node:path";
 import { createLogger } from "../logger.js";
 import { clearCodexCliStateCache, getCodexCliAccountsPath, getCodexCliAuthPath, getCodexCliConfigPath, isCodexCliSyncEnabled, } from "./state.js";
 import { incrementCodexCliMetric, makeAccountFingerprint, } from "./observability.js";
 import { tempPathFor } from "../temp-path.js";
+import { decodeJWT } from "../auth/auth.js";
+import { extractAccountId, getAccountIdCandidates, resolveCodexAuthAccountId, } from "../auth/token-utils.js";
 const log = createLogger("codex-cli-writer");
 let lastCodexCliSelectionWriteAt = 0;
 let activeSelectionWriteQueue = Promise.resolve();
@@ -382,12 +386,44 @@ async function writeCodexAuthState(path, selection) {
     }
     nextTokens.access_token = accessToken;
     nextTokens.refresh_token = refreshToken;
-    if (selection.accountId?.trim()) {
-        nextTokens.account_id = selection.accountId.trim();
-    }
     const selectedIdToken = readTrimmedString(selection.idToken);
     const existingIdToken = readTrimmedString(existingTokens.id_token);
-    const fallbackIdToken = selectedTokenPair ? accessToken : (existingIdToken ?? accessToken);
+    // A stale "org-..." id already in auth.json is sanitised too, not only a
+    // selected one. With no chatgpt_account_id claim, drop the field so Codex
+    // derives it from the tokens.
+    const selectedAccountId = selection.accountId?.trim();
+    let rawAccountId = selectedAccountId || readTrimmedString(existingTokens.account_id);
+    if (!selectedAccountId && selectedTokenPair && rawAccountId) {
+        // New tokens without an accountId: the previous file's id may belong to
+        // another account. Keep it only when the new tokens still carry it as a
+        // workspace; otherwise follow the new token's claim.
+        const tokenClaim = extractAccountId(accessToken) ?? extractAccountId(selectedIdToken);
+        const tokenWorkspaces = getAccountIdCandidates(accessToken, selectedIdToken).map((candidate) => candidate.accountId);
+        if (tokenClaim && !tokenWorkspaces.includes(rawAccountId)) {
+            rawAccountId = tokenClaim;
+        }
+    }
+    if (rawAccountId) {
+        const accountId = resolveCodexAuthAccountId(rawAccountId, accessToken, selectedIdToken);
+        if (accountId) {
+            nextTokens.account_id = accountId;
+        }
+        else {
+            delete nextTokens.account_id;
+        }
+    }
+    // Without a selected id_token, keep the existing one when it belongs to the
+    // same user and workspace as the new access token (a same-account resync);
+    // only another account's id_token is replaced by the access-token fallback.
+    const existingIdClaims = existingIdToken ? decodeJWT(existingIdToken) : null;
+    const accessClaims = decodeJWT(accessToken);
+    const existingIdTokenMatches = typeof existingIdClaims?.sub === "string" &&
+        existingIdClaims.sub === accessClaims?.sub &&
+        !!extractAccountId(existingIdToken) &&
+        extractAccountId(existingIdToken) === extractAccountId(accessToken);
+    const fallbackIdToken = selectedTokenPair && !existingIdTokenMatches
+        ? accessToken
+        : (existingIdToken ?? accessToken);
     if (selectedIdToken) {
         nextTokens.id_token = selectedIdToken;
     }
@@ -423,9 +459,18 @@ async function enqueueActiveSelectionWrite(task) {
     }
 }
 export async function setCodexCliActiveSelection(selection) {
-    return enqueueActiveSelectionWrite(async () => {
-        if (!isCodexCliSyncEnabled())
-            return false;
+    if (!isCodexCliSyncEnabled())
+        return false;
+    return enqueueActiveSelectionWrite(() => withNativeBindingLock(getCodexCliConfigPath(), async () => {
+        // Native app binding deliberately separates desktop identity from inference selection.
+        try {
+            if (hasNativeProviderConfig(await fs.readFile(getCodexCliConfigPath(), "utf8")))
+                return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
         incrementCodexCliMetric("writeAttempts");
         const accountsPath = getCodexCliAccountsPath();
         const authPath = getCodexCliAuthPath();
@@ -611,7 +656,14 @@ export async function setCodexCliActiveSelection(selection) {
             });
             return false;
         }
-    });
+    }).catch((error) => {
+        incrementCodexCliMetric("writeFailures");
+        log.warn("Failed to persist Codex CLI active selection", {
+            operation: "write-active-selection", outcome: "native-bind-lock-unavailable",
+            code: error?.code ?? "unknown",
+        });
+        return false;
+    }));
 }
 export function getLastCodexCliSelectionWriteTimestamp() {
     return lastCodexCliSelectionWriteAt;

package/dist/lib/codex-manager/account-manager-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-manager-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-manager-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,aA+BnC,CAAC"}
+{"version":3,"file":"account-manager-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-manager-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,aAgCnC,CAAC"}

package/dist/lib/codex-manager/account-manager-commands.js

@@ -22,6 +22,7 @@ export const ACCOUNT_MANAGER_COMMANDS = new Set([
     "check",
     "features",
     "usage",
+    "resets",
     "verify-flagged",
     "verify",
     "forecast",

package/dist/lib/codex-manager/account-pool-write.d.ts

@@ -1,5 +1,5 @@
 import type { Workspace } from "../accounts.js";
-import type { AccountMetadataV3 } from "../storage/public-types.js";
+import type { AccountMetadataV3, CodexCliMirror } from "../storage/public-types.js";
 /**
  * Outcome of folding a single login result into the saved account pool.
  *
@@ -30,6 +30,8 @@ export interface ResolvedAccountWrite {
     accessToken?: string;
     expiresAt?: number;
     workspaces?: Workspace[];
+    /** Set, keep (undefined) or clear (null) the saved CodexCliMirror. */
+    codexCliMirror?: CodexCliMirror | null;
     /**
      * Keep the saved row's `enabled` flag instead of re-enabling it. A targeted
      * re-authentication only tops up credentials for a row the user named, so it

package/dist/lib/codex-manager/account-pool-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAwBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}
+{"version":3,"file":"account-pool-write.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/account-pool-write.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EACX,iBAAiB,EACjB,cAAc,EACd,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,sEAAsE;IACtE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,SAAS,EAAE,EACvB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CAWR;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAC/C,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,GAC/B,SAAS,EAAE,GAAG,SAAS,CAYzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,uBAAuB,CAAC,EACzE,gBAAgB,EAAE,SAAS,EAAE,GAAG,SAAS,GACvC,MAAM,GAAG,SAAS,CAwBpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAyBrD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,oBAAoB,GACzB;IAAE,OAAO,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAmDhE;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC/C,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,CACzB,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,QAAQ,EAAE;QACT,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,OAAO,EAAE;QAAE,wCAAwC,EAAE,OAAO,CAAA;KAAE,KAC1D,MAAM,GAAG,SAAS,CAAC;CACxB,GAAG;IACH,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACxC,CA6CA"}

package/dist/lib/codex-manager/account-pool-write.js

@@ -80,6 +80,7 @@ export function buildInsertedAccount(write) {
             lastUsed: write.now,
             workspaces: write.workspaces,
             currentWorkspaceIndex: initialWorkspaceIndex,
+            ...(write.codexCliMirror ? { codexCliMirror: write.codexCliMirror } : {}),
         },
     };
 }
@@ -121,6 +122,9 @@ export function buildUpdatedAccount(existing, write) {
             lastUsed: write.now,
             workspaces: mergedWorkspaces,
             currentWorkspaceIndex: nextCurrentWorkspaceIndex,
+            codexCliMirror: write.codexCliMirror === null
+                ? undefined
+                : (write.codexCliMirror ?? existing.codexCliMirror),
         },
     };
 }

package/dist/lib/codex-manager/api-login-menu.d.ts

@@ -0,0 +1,14 @@
+import { type ApiRouteCredential } from "../api-route-store.js";
+import { type MenuItem } from "../ui/select.js";
+interface MenuDeps {
+    load: () => Promise<ApiRouteCredential[]>;
+    save: (routes: ApiRouteCredential[], expected: ApiRouteCredential[]) => Promise<void>;
+    select: (items: MenuItem<string>[], message: string) => Promise<string | null>;
+    text: (message: string) => Promise<string>;
+    secret: () => Promise<string>;
+    discover: (route: ApiRouteCredential) => Promise<string[]>;
+    log: (message: string) => void;
+}
+export declare function runApiLoginMenu(overrides?: Partial<MenuDeps>): Promise<number>;
+export {};
+//# sourceMappingURL=api-login-menu.d.ts.map

package/dist/lib/codex-manager/api-login-menu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-login-menu.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/api-login-menu.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,kBAAkB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAExD,UAAU,QAAQ;IACjB,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC1C,IAAI,EAAE,CACL,MAAM,EAAE,kBAAkB,EAAE,EAC5B,QAAQ,EAAE,kBAAkB,EAAE,KAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,EAAE,CACP,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EACzB,OAAO,EAAE,MAAM,KACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AA0FD,wBAAsB,eAAe,CACpC,SAAS,GAAE,OAAO,CAAC,QAAQ,CAAM,GAC/B,OAAO,CAAC,MAAM,CAAC,CAgIjB"}

package/dist/lib/codex-manager/api-login-menu.js

@@ -0,0 +1,224 @@
+import { randomUUID } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+import { loadApiRoutes, saveApiRoutes, } from "../api-route-store.js";
+import { ApiModelRuntime } from "../runtime/api-model-runtime.js";
+import { select } from "../ui/select.js";
+async function ask(message, secret = false) {
+    if (!process.stdin.isTTY)
+        throw Error("API setup requires an interactive terminal.");
+    // The secret never reaches the output stream, command arguments, or shell history.
+    const sink = new Writable({
+        write(_chunk, _encoding, done) {
+            done();
+        },
+    });
+    if (secret)
+        process.stdout.write(message);
+    const rl = createInterface({
+        input: process.stdin,
+        output: secret ? sink : process.stdout,
+        terminal: true,
+    });
+    const cancel = () => rl.close();
+    rl.on("SIGINT", cancel);
+    try {
+        return (await rl.question(secret ? "" : message)).trim();
+    }
+    finally {
+        rl.off("SIGINT", cancel);
+        rl.close();
+        sink.destroy();
+        if (secret)
+            process.stdout.write("\n");
+    }
+}
+const defaults = {
+    load: loadApiRoutes,
+    save: (routes, expected) => saveApiRoutes(routes, undefined, expected),
+    select: (items, message) => select(items, { message, allowEscape: true }),
+    text: (message) => ask(message),
+    secret: () => ask("API key (hidden): ", true),
+    discover: async (route) => {
+        const runtime = new ApiModelRuntime();
+        const catalogs = await runtime.catalogs([route], true);
+        if (runtime.statuses([route])[0]?.error)
+            throw Error("Model discovery failed. Check the credential and its API permissions.");
+        return catalogs[0]?.models.map((m) => m.slug) ?? [];
+    },
+    log: console.log,
+};
+async function chooseModels(route, d) {
+    const available = await d.discover(route);
+    const selected = new Set(route.visibleModels.filter((id) => available.includes(id)));
+    let query = "";
+    for (;;) {
+        const visible = available.filter((m) => m.toLowerCase().includes(query));
+        const choice = await d.select([
+            { label: `Save ${selected.size} selected model(s)`, value: "save" },
+            { label: "Search models", value: "search" },
+            { label: "Clear selection", value: "clear" },
+            ...visible.map((model) => ({
+                label: `${selected.has(model) ? "[x]" : "[ ]"} ${model}`,
+                value: `toggle:${model}`,
+            })),
+            { label: "Cancel without saving", value: "cancel" },
+        ], "Choose models visible in Codex (future GPT text models appear automatically)");
+        if (!choice || choice === "cancel")
+            return null;
+        if (choice === "save")
+            return {
+                visibleModels: [...selected].sort(),
+                knownModels: [...new Set([...(route.knownModels ?? []), ...available])],
+            };
+        if (choice === "search") {
+            query = (await d.text("Search: ")).toLowerCase();
+            continue;
+        }
+        if (choice === "clear") {
+            selected.clear();
+            continue;
+        }
+        if (choice.startsWith("toggle:")) {
+            const id = choice.slice(7);
+            if (!available.includes(id))
+                continue;
+            if (selected.has(id))
+                selected.delete(id);
+            else
+                selected.add(id);
+        }
+    }
+}
+export async function runApiLoginMenu(overrides = {}) {
+    const merged = { ...defaults, ...overrides };
+    // Treat any value the menu did not offer (e.g. a reserved tier 0) as a cancel.
+    const d = {
+        ...merged,
+        select: async (items, message) => {
+            const choice = await merged.select(items, message);
+            return choice !== null && items.some((item) => item.value === choice) ? choice : null;
+        },
+    };
+    if (!overrides.select && !process.stdin.isTTY) {
+        d.log("Run login --api in an interactive terminal.");
+        return 1;
+    }
+    let routes;
+    try {
+        routes = await d.load();
+    }
+    catch {
+        d.log("API route configuration could not be read. Check api-routes.json and retry.");
+        return 1;
+    }
+    for (;;) {
+        const choice = await d.select([
+            { label: "Add API credential", value: "add" },
+            ...routes.map((r) => ({
+                label: `${r.label} · ${r.kind.toUpperCase()} · priority ${r.priority} · ${r.visibleModels.length} models${r.enabled ? "" : " · disabled"}`,
+                value: r.id,
+            })),
+            { label: "Back", value: "back" },
+        ], "API credentials and model routes");
+        if (!choice || choice === "back")
+            return 0;
+        try {
+            let route = routes.find((r) => r.id === choice);
+            if (choice === "add") {
+                const label = (await d.text("Credential label: ")).trim();
+                if (!label)
+                    continue;
+                // Match the stored schema here, so a bad label is not reported as a key problem after discovery.
+                if (label.length > 80 || /[\x00-\x1f\x7f]/.test(label)) {
+                    d.log("Credential label must be 1-80 printable characters. Nothing was saved.");
+                    continue;
+                }
+                const kind = await d.select([
+                    { label: "API", value: "api" },
+                    { label: "ZDR (operator-confirmed approval; not detected from the key)", value: "zdr" },
+                ], "Choose the routing pool (ZDR is operator-declared)");
+                if (kind !== "api" && kind !== "zdr")
+                    continue;
+                const apiKey = await d.secret();
+                if (!apiKey)
+                    continue;
+                const priority = await d.select(Array.from({ length: 9 }, (_, offset) => {
+                    const tier = 9 - offset;
+                    return { label: `Priority ${tier}${tier === 9 ? " (recommended; late tier)" : ""}`, value: String(tier) };
+                }), "Failover priority");
+                if (priority === null)
+                    continue;
+                route = {
+                    id: randomUUID(),
+                    label,
+                    kind,
+                    apiKey,
+                    priority: Number(priority),
+                    enabled: true,
+                    visibleModels: [],
+                };
+            }
+            else if (route) {
+                const action = await d.select([
+                    { label: "Choose visible models", value: "models" },
+                    { label: "Change priority", value: "priority" },
+                    {
+                        label: route.probeCapabilities
+                            ? "Disable billable capability probes"
+                            : "Enable small billable capability probes (15-minute cache)",
+                        value: "probes",
+                    },
+                    { label: route.enabled ? "Disable" : "Enable", value: "toggle" },
+                    { label: "Back", value: "back" },
+                ], route.label);
+                if (!action || action === "back")
+                    continue;
+                if (action === "probes")
+                    route = { ...route, probeCapabilities: !route.probeCapabilities };
+                if (action === "toggle")
+                    route = { ...route, enabled: !route.enabled };
+                if (action === "priority") {
+                    const value = await d.select(Array.from({ length: 9 }, (_, offset) => {
+                        const tier = 9 - offset;
+                        return { label: `Priority ${tier}${tier === 9 ? " (recommended; late tier)" : ""}`, value: String(tier) };
+                    }), "Failover priority");
+                    if (value === null)
+                        continue;
+                    route = { ...route, priority: Number(value) };
+                }
+                if (action !== "models") {
+                    const next = routes.map((r) => (r.id === route?.id ? route : r));
+                    await d.save(next, routes);
+                    routes = next;
+                    continue;
+                }
+            }
+            if (!route)
+                continue;
+            const selection = await chooseModels({ ...route, enabled: true }, d);
+            if (selection === null)
+                continue;
+            const edited = { ...route, ...selection };
+            const next = routes.some((r) => r.id === edited.id)
+                ? routes.map((r) => (r.id === edited.id ? edited : r))
+                : [...routes, edited];
+            await d.save(next, routes);
+            routes = next;
+            d.log("Saved. Choose an API or ZDR model explicitly in Codex. Desktop login is unchanged.");
+        }
+        catch (error) {
+            const changed = error instanceof Error && error.message.startsWith("API route configuration changed");
+            let reloaded = false;
+            try {
+                routes = await d.load();
+                reloaded = true;
+            }
+            catch { /* Keep the last readable configuration. */ }
+            d.log(changed ? (reloaded
+                ? "API routes changed in another process; the latest configuration was reloaded. Repeat the edit."
+                : "API routes changed in another process and could not be reloaded. Reopen the menu before editing.") :
+                "API setup did not complete. No partial credential was saved; check the key, permissions, and configuration.");
+        }
+    }
+}

package/dist/lib/codex-manager/commands/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,sBAAsB,EAEtB,sBAAsB,EAGtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAkDD,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,CA2HjB"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/account.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,sBAAsB,EAEtB,sBAAsB,EAGtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IAClC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAsDD,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,MAAM,CAAC,CAkJjB"}

package/dist/lib/codex-manager/commands/account.js

@@ -5,6 +5,8 @@ function printAccountUsage(logInfo) {
         "  codex-multi-auth account tag <index> <tag>",
         "  codex-multi-auth account untag <index> <tag>",
         "  codex-multi-auth account weight <index> <0..10>",
+        "  codex-multi-auth account priority <index> <0..9>",
+        "  codex-multi-auth account auto-prime <index> on|off",
         "  codex-multi-auth account pause|unpause|drain|undrain <index>",
         "  codex-multi-auth account note <index> <text>",
         "  codex-multi-auth account policy list [--json]",
@@ -33,6 +35,8 @@ function policySummary(store, storage) {
             accountKey,
             tags: policy?.tags ?? [],
             weight: policy?.weight ?? 1,
+            priority: policy?.priority ?? 1,
+            autoPrime: policy?.autoPrime ?? false,
             paused: policy?.paused ?? false,
             drained: policy?.drained ?? false,
             note: policy?.note ?? null,
@@ -78,6 +82,8 @@ export async function runAccountCommand(args, deps) {
         for (const entry of payload.accounts) {
             const markers = [
                 `weight=${entry.weight}`,
+                `priority=${entry.priority}`,
+                `auto-prime=${entry.autoPrime ? "on" : "off"}`,
                 entry.paused ? "paused" : null,
                 entry.drained ? "drained" : null,
                 entry.tags.length > 0 ? `tags=${entry.tags.join(",")}` : null,
@@ -112,6 +118,27 @@ export async function runAccountCommand(args, deps) {
         logInfo(`${command === "tag" ? "Tagged" : "Removed tag from"} account ${resolved.index + 1}: ${policy.tags.join(",") || "none"}`);
         return 0;
     }
+    if (command === "auto-prime") {
+        if (rest.length !== 2 || !["on", "off"].includes(rest[1] ?? "")) {
+            logError("auto-prime requires on or off.");
+            return 1;
+        }
+        upsertAccountPolicy(store, accountKey, next => { next.autoPrime = rest[1] === "on"; }, now);
+        await saveStore(store);
+        logInfo(`Automatic priming ${rest[1]} for account ${resolved.index + 1}. ${rest[1] === "on" ? "The running router checks every 15 minutes; first-use completion consumes subscription quota." : "Future automatic checks are disabled."}`);
+        return 0;
+    }
+    if (command === "priority") {
+        if (!/^[0-9]$/.test(rest[1] ?? "") || rest.length !== 2) {
+            logError("priority requires an integer from 0 to 9 (0 first).");
+            return 1;
+        }
+        const priority = Number(rest[1]);
+        upsertAccountPolicy(store, accountKey, next => { next.priority = priority; }, now);
+        await saveStore(store);
+        logInfo(`Set account ${resolved.index + 1} priority to ${priority}.`);
+        return 0;
+    }
     if (command === "weight") {
         const weight = rest[1] === undefined ? Number.NaN : Number.parseFloat(rest[1]);
         if (!Number.isFinite(weight) || weight < 0 || weight > 10) {

package/dist/lib/codex-manager/commands/best.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"best.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/best.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,kBAAkB,EAA6B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAEN,KAAK,WAAW,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,KAAK,gBAAgB,CAAC,CAAC,IACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GACxB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,cAAc,CAAC,CA0C9E;AAED,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpE,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,oBAAoB,EAAE,CACrB,OAAO,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,KACvB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,kBAAkB,EAAE,CACnB,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACtE,KAAK,EAAE,MAAM,KACT,MAAM,CAAC;IACZ,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,wBAAwB,EAAE,CACzB,MAAM,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,SAAS,EAAE,OAAO,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,cAAc,CAAC,EAAE,YAAY,CAAC;QAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;QAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC,KACE,qBAAqB,EAAE,CAAC;IAC7B,wBAAwB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;KACf,CAAC;IACF,6BAA6B,EAAE,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;KACjC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzD,0BAA0B,EAAE,CAAC,MAAM,EAAE;QACpC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,wBAAsB,cAAc,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CAsRjB"}
+{"version":3,"file":"best.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/best.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,KAAK,kBAAkB,EAA6B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAEN,KAAK,WAAW,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGhE,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,KAAK,gBAAgB,CAAC,CAAC,IACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GACxB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,cAAc,CAAC,CA0C9E;AAED,MAAM,WAAW,eAAe;IAC/B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACpE,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,oBAAoB,EAAE,CACrB,OAAO,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,mBAAmB,EAAE,CACpB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,GAAG,SAAS,KACvB,MAAM,GAAG,SAAS,CAAC;IACxB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACjE,kBAAkB,EAAE,CACnB,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EACtE,KAAK,EAAE,MAAM,KACT,MAAM,CAAC;IACZ,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,wBAAwB,EAAE,CACzB,MAAM,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9C,SAAS,EAAE,OAAO,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,cAAc,CAAC,EAAE,YAAY,CAAC;QAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;QAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC,KACE,qBAAqB,EAAE,CAAC;IAC7B,wBAAwB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;KACf,CAAC;IACF,6BAA6B,EAAE,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,gBAAgB,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;KACjC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzD,0BAA0B,EAAE,CAAC,MAAM,EAAE;QACpC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,wBAAsB,cAAc,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,eAAe,GACnB,OAAO,CAAC,MAAM,CAAC,CA+RjB"}

package/dist/lib/codex-manager/commands/best.js

@@ -1,3 +1,4 @@
+import { codexCliAccountIdFor, shouldUpdateAccountIdFromToken, } from "../../auth/token-utils.js";
 import { describeCodexProbeFailure } from "../../quota-probe.js";
 import { getModelProfile, resolveNormalizedModel, } from "../../request/helpers/model-map.js";
 import { DEFAULT_LIVE_PROBE_MODEL } from "../quota-cache-helpers.js";
@@ -138,7 +139,10 @@ export async function runBestCommand(args, deps) {
             account.expiresAt = refreshResult.expires;
             if (refreshedEmail)
                 account.email = refreshedEmail;
-            if (refreshedAccountId) {
+            // Same rule as every other refresh path: only a token-derived id
+            // follows the new token; an explicit (manual) or org binding stays.
+            if (refreshedAccountId &&
+                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
                 account.accountId = refreshedAccountId;
                 account.accountIdSource = "token";
             }
@@ -235,7 +239,7 @@ export async function runBestCommand(args, deps) {
         });
         if (shouldSyncCurrentBest) {
             alreadyBestSynced = await deps.setCodexCliActiveSelection({
-                accountId: bestAccount.accountId,
+                accountId: codexCliAccountIdFor(bestAccount, bestAccount.accessToken, probeIdTokenByIndex.get(bestIndex)),
                 email: bestAccount.email,
                 accessToken: bestAccount.accessToken,
                 refreshToken: bestAccount.refreshToken,

package/dist/lib/codex-manager/commands/check.d.ts

@@ -1,7 +1,13 @@
 export interface CheckCommandDeps {
     runHealthCheck: (options: {
         liveProbe: boolean;
+        discoverModels: boolean;
+        primeUnusedSubscription: boolean;
     }) => Promise<void>;
+    runResetCheck: () => Promise<number>;
+    runCapabilityCheck: () => Promise<boolean>;
+    logInfo?: (message: string) => void;
+    logError?: (message: string) => void;
 }
-export declare function runCheckCommand(deps: CheckCommandDeps): Promise<number>;
+export declare function runCheckCommand(deps: CheckCommandDeps, args?: string[]): Promise<number>;
 //# sourceMappingURL=check.d.ts.map

package/dist/lib/codex-manager/commands/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/check.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/check.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,uBAAuB,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9H,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,kBAAkB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBlG"}

package/dist/lib/codex-manager/commands/check.js

@@ -1,4 +1,25 @@
-export async function runCheckCommand(deps) {
-    await deps.runHealthCheck({ liveProbe: true });
-    return 0;
+import { runWithGlobalStoragePath } from "../../storage/path-state.js";
+const usage = "Usage: codex-multi-auth check [accounts|resets|capabilities] [--prime]";
+export async function runCheckCommand(deps, args = []) {
+    if (args.length === 1 && (args[0] === "--help" || args[0] === "-h")) {
+        (deps.logInfo ?? console.log)(usage);
+        return 0;
+    }
+    // Priming starts an unused subscription's 5h/weekly windows, so it is never implicit.
+    const prime = args.includes("--prime");
+    const rest = args.filter((arg) => arg !== "--prime");
+    const [scope] = rest;
+    if (rest.length > 1 || args.length - rest.length > 1 || (scope !== undefined && !["accounts", "resets", "capabilities"].includes(scope)) || (prime && scope !== undefined && scope !== "accounts")) {
+        (deps.logError ?? console.error)(usage);
+        return 1;
+    }
+    return runWithGlobalStoragePath(async () => {
+        if (scope === "resets")
+            return await deps.runResetCheck();
+        if (scope === "capabilities")
+            return await deps.runCapabilityCheck() ? 0 : 1;
+        else
+            await deps.runHealthCheck({ liveProbe: true, discoverModels: scope === undefined, primeUnusedSubscription: prime });
+        return 0;
+    });
 }

package/dist/lib/codex-manager/commands/forecast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forecast.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/forecast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,KAAK,kBAAkB,EAA6B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAGN,KAAK,WAAW,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAmBhE,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AACxE,KAAK,uBAAuB,GAAG,WAAW,CACzC,MAAM,EACN;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAC1D,CAAC;AAEF,MAAM,WAAW,mBAAmB;IACnC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,4BAA4B,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,cAAc,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,KAC/D,uBAAuB,CAAC;IAC7B,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,CAAC,EAAE,uBAAuB,KACxC,OAAO,CAAC;IACb,oBAAoB,EAAE,CACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,WAAW,CAAC,EAC7D,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,cAAc,GAAG,WAAW,CAAC,EACxE,KAAK,EAAE,MAAM,KACT,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,wBAAwB,EAAE,CACzB,MAAM,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,iBAAiB,CAAC;QAC3B,SAAS,EAAE,OAAO,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,cAAc,CAAC,EAAE,YAAY,CAAC;QAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;QAC/B,UAAU,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;QACnC,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;QAC3C,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;QAC/C,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC,KACE,qBAAqB,EAAE,CAAC;IAC7B,iBAAiB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QACxD,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,wBAAwB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;KACf,CAAC;IACF,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,0BAA0B,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IACrE,gBAAgB,EAAE,CACjB,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC,KAC/C,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtC,QAAQ,EAAE,CACT,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,KACrC,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IACvC,cAAc,EAAE,wBAAwB,CAAC;IACzC,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAChF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAkFD,wBAAsB,kBAAkB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,mBAAmB,GAAG;IAC3B,uBAAuB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;CAClE,GACC,OAAO,CAAC,MAAM,CAAC,CAyXjB"}
+{"version":3,"file":"forecast.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/forecast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAG5E,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,KAAK,kBAAkB,EAA6B,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAGN,KAAK,WAAW,EAEhB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAmBhE,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AACxE,KAAK,uBAAuB,GAAG,WAAW,CACzC,MAAM,EACN;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAC1D,CAAC;AAEF,MAAM,WAAW,mBAAmB;IACnC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,4BAA4B,CAAC,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,cAAc,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrD,cAAc,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,KAC/D,uBAAuB,CAAC;IAC7B,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,CAAC,EAAE,uBAAuB,KACxC,OAAO,CAAC;IACb,oBAAoB,EAAE,CACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,WAAW,CAAC,EAC7D,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,cAAc,GAAG,WAAW,CAAC,EACxE,KAAK,EAAE,MAAM,KACT,MAAM,CAAC;IACZ,gBAAgB,EAAE,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,wBAAwB,EAAE,CACzB,MAAM,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,iBAAiB,CAAC;QAC3B,SAAS,EAAE,OAAO,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,cAAc,CAAC,EAAE,YAAY,CAAC;QAC9B,SAAS,CAAC,EAAE,kBAAkB,CAAC;QAC/B,UAAU,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;QACnC,WAAW,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;QAC3C,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;QAC/C,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACtB,CAAC,KACE,qBAAqB,EAAE,CAAC;IAC7B,iBAAiB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QACxD,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,wBAAwB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK;QAC/D,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,MAAM,EAAE,MAAM,CAAC;KACf,CAAC;IACF,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,0BAA0B,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;IACrE,gBAAgB,EAAE,CACjB,YAAY,EAAE,qBAAqB,CAAC,cAAc,CAAC,KAC/C,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtC,QAAQ,EAAE,CACT,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,KACrC,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtC,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;IACvC,cAAc,EAAE,wBAAwB,CAAC;IACzC,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAChF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAkFD,wBAAsB,kBAAkB,CACvC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,mBAAmB,GAAG;IAC3B,uBAAuB,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,MAAM,CAAC;CAClE,GACC,OAAO,CAAC,MAAM,CAAC,CA8XjB"}

package/dist/lib/codex-manager/commands/forecast.js

@@ -1,4 +1,5 @@
 import { extractAccountEmail, sanitizeEmail } from "../../accounts.js";
+import { shouldUpdateAccountIdFromToken } from "../../auth/token-utils.js";
 import { buildForecastExplanation, } from "../../forecast.js";
 import { applyRefreshedAccountPatch, persistRefreshedAccountPatch, serializeForecastResults, } from "../forecast-report-shared.js";
 import { describeCodexProbeFailure } from "../../quota-probe.js";
@@ -147,7 +148,10 @@ export async function runForecastCommand(args, deps) {
             if (refreshedEmail) {
                 refreshPatch.email = refreshedEmail;
             }
-            if (refreshedAccountId) {
+            // Only a token-derived id follows the new token (as on every other
+            // refresh path); an explicit (manual) or org binding stays.
+            if (refreshedAccountId &&
+                shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
                 refreshPatch.accountId = refreshedAccountId;
                 refreshPatch.accountIdSource = "token";
             }

package/dist/lib/codex-manager/commands/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/report.ts"],"names":[],"mappings":"AAoBA,OAAO,EACN,KAAK,kBAAkB,EAGvB,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA6ChE,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,oBAAoB,EAAE,CACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,WAAW,CAAC,EAC7D,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,oBAAoB,EAAE,CACrB,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3D,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACtD;AAuLD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA8VjB"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../../lib/codex-manager/commands/report.ts"],"names":[],"mappings":"AAoBA,OAAO,EACN,KAAK,kBAAkB,EAGvB,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA8ChE,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC9C,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,YAAY,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC;IAC5E,oBAAoB,EAAE,CACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,WAAW,CAAC,EAC7D,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,aAAa,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9D,uBAAuB,EAAE,CAAC,KAAK,EAAE;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClC,oBAAoB,EAAE,CACrB,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAC7C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,CAAC;IACnB,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3D,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,gCAAgC,CAAC,EAAE,MAAM,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;CACtD;AAuLD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAmWjB"}

package/dist/lib/codex-manager/commands/report.js

@@ -6,6 +6,7 @@ import { applyRefreshedAccountPatch, persistRefreshedAccountPatch, serializeFore
 import { formatQuotaSnapshotLine, describeCodexProbeFailure, } from "../../quota-probe.js";
 import { DEFAULT_PROBE_MODEL, getModelCapabilities, getModelProfile, resolveNormalizedModel, } from "../../request/helpers/model-map.js";
 import { sleep } from "../../utils.js";
+import { shouldUpdateAccountIdFromToken } from "../../auth/token-utils.js";
 import { tempPathFor } from "../../temp-path.js";
 function parsePositiveIntegerOption(rawValue) {
     const normalized = rawValue.trim();
@@ -279,7 +280,10 @@ export async function runReportCommand(args, deps) {
                 if (refreshedEmail) {
                     refreshPatch.email = refreshedEmail;
                 }
-                if (tokenDerivedAccountId) {
+                // Only a token-derived id follows the new token (as on every other
+                // refresh path); an explicit (manual) or org binding stays.
+                if (tokenDerivedAccountId &&
+                    shouldUpdateAccountIdFromToken(account.accountIdSource, account.accountId)) {
                     refreshPatch.accountId = tokenDerivedAccountId;
                     refreshPatch.accountIdSource = "token";
                 }