codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/codex-manager/health-check.d.ts

@@ -6,7 +6,10 @@ import { type DashboardDisplaySettings } from "../dashboard-settings.js";
  */
 export interface HealthCheckOptions {
     forceRefresh?: boolean;
+    discoverModels?: boolean;
     liveProbe?: boolean;
+    /** Explicit `check --prime` only: may start an unused subscription's quota windows. */
+    primeUnusedSubscription?: boolean;
     model?: string;
     display?: DashboardDisplaySettings;
 }

package/dist/lib/codex-manager/health-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-check.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/health-check.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AA2ClC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAED,wBAAsB,cAAc,CACnC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA4Uf"}
+{"version":3,"file":"health-check.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/health-check.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AA2ClC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uFAAuF;IACvF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAED,wBAAsB,cAAc,CACnC,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA6Wf"}

package/dist/lib/codex-manager/health-check.js

@@ -1,4 +1,9 @@
+import { refreshAndPrintResetCredits } from "../runtime/account-reset-credits.js";
+import { mapWithConcurrency } from "../concurrency.js";
+import { withCheckProgress } from "../ui/check-progress.js";
+import { refreshAndPrintModelInventory } from "../runtime/model-discovery-status.js";
 import { AUTH_INVALIDATION_MARKER, extractAccountEmail, extractAccountId, formatAccountLabel, sanitizeEmail, } from "../accounts.js";
+import { codexCliAccountIdFor } from "../auth/token-utils.js";
 import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { DEFAULT_DASHBOARD_DISPLAY_SETTINGS, } from "../dashboard-settings.js";
 import { isCodexUnavailableError } from "../errors.js";
@@ -21,6 +26,7 @@ function appendAuthInvalidationMarker(account, detail) {
 export async function runHealthCheck(options = {}) {
     const forceRefresh = options.forceRefresh === true;
     const liveProbe = options.liveProbe === true;
+    const primeUnusedSubscription = options.primeUnusedSubscription === true;
     const probeModel = options.model?.trim() || DEFAULT_LIVE_PROBE_MODEL;
     const modelInspection = inspectRequestedModel(probeModel);
     const display = options.display ?? DEFAULT_DASHBOARD_DISPLAY_SETTINGS;
@@ -31,6 +37,8 @@ export async function runHealthCheck(options = {}) {
     const storage = await loadAccounts();
     if (!storage || storage.accounts.length === 0) {
         console.log("No accounts configured.");
+        if (options.discoverModels)
+            await refreshAndPrintModelInventory(console.log);
         return;
     }
     let quotaEmailFallbackState = liveProbe && quotaCache
@@ -51,6 +59,31 @@ export async function runHealthCheck(options = {}) {
     if (liveProbe) {
         console.log(stylePromptText(`Model probe: ${formatModelInspection(modelInspection)}`, "muted"));
     }
+    const quickProbes = new Map();
+    if (liveProbe && !forceRefresh) {
+        const candidates = storage.accounts.flatMap((account, index) => {
+            const accountId = account.accountId ?? extractAccountId(account.accessToken);
+            return hasUsableAccessToken(account, now) && account.accessToken && accountId
+                ? [{ index, accountId, accessToken: account.accessToken }] : [];
+        });
+        if (candidates.length) {
+            let completed = 0;
+            await withCheckProgress(() => `Checking account probes: ${completed}/${candidates.length}`, async () => {
+                await mapWithConcurrency(candidates, 3, async (candidate) => {
+                    try {
+                        const value = await fetchCodexQuotaSnapshot({ primeUnusedSubscription, accountId: candidate.accountId, accessToken: candidate.accessToken, model: modelInspection.normalized });
+                        quickProbes.set(candidate.index, { ok: true, value });
+                    }
+                    catch (error) {
+                        quickProbes.set(candidate.index, { ok: false, error });
+                    }
+                    finally {
+                        completed++;
+                    }
+                });
+            }, console.log);
+        }
+    }
     for (let i = 0; i < storage.accounts.length; i += 1) {
         const account = storage.accounts[i];
         if (!account)
@@ -82,16 +115,23 @@ export async function runHealthCheck(options = {}) {
                 }
                 else {
                     try {
-                        const snapshot = await fetchCodexQuotaSnapshot({
+                        const priorProbe = quickProbes.get(i);
+                        if (priorProbe && !priorProbe.ok)
+                            throw priorProbe.error;
+                        const snapshot = priorProbe?.ok ? priorProbe.value : await withCheckProgress(`Account ${i + 1}/${storage.accounts.length}: live probe`, () => fetchCodexQuotaSnapshot({ primeUnusedSubscription,
                             accountId: probeAccountId,
                             accessToken: currentAccessToken,
                             model: modelInspection.normalized,
-                        });
+                        }), console.log);
                         if (workingQuotaCache) {
                             quotaCacheChanged =
                                 updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
                         }
                         healthDetail = formatQuotaSnapshotForDashboard(snapshot, display);
+                        if (snapshot.primingFailure) {
+                            healthTone = "warning";
+                            warnings += 1;
+                        }
                         codexAvailable += 1;
                     }
                     catch (error) {
@@ -120,7 +160,7 @@ export async function runHealthCheck(options = {}) {
             }
             continue;
         }
-        const result = await queuedRefresh(account.refreshToken);
+        const result = await withCheckProgress(`Account ${i + 1}/${storage.accounts.length}: refreshing sign-in`, () => queuedRefresh(account.refreshToken), console.log);
         if (result.type === "success") {
             const tokenAccountId = extractAccountId(result.access);
             const nextEmail = sanitizeEmail(extractAccountEmail(result.access, result.idToken));
@@ -180,16 +220,20 @@ export async function runHealthCheck(options = {}) {
                 }
                 else {
                     try {
-                        const snapshot = await fetchCodexQuotaSnapshot({
+                        const snapshot = await withCheckProgress(`Account ${i + 1}/${storage.accounts.length}: live probe`, () => fetchCodexQuotaSnapshot({ primeUnusedSubscription,
                             accountId: probeAccountId,
                             accessToken: result.access,
                             model: modelInspection.normalized,
-                        });
+                        }), console.log);
                         if (workingQuotaCache) {
                             quotaCacheChanged =
                                 updateQuotaCacheForAccount(workingQuotaCache, account, snapshot, storage.accounts, quotaEmailFallbackState ?? undefined) || quotaCacheChanged;
                         }
                         healthyMessage = formatQuotaSnapshotForDashboard(snapshot, display);
+                        if (snapshot.primingFailure) {
+                            healthyTone = "warning";
+                            warnings += 1;
+                        }
                         codexAvailable += 1;
                     }
                     catch (error) {
@@ -239,7 +283,7 @@ export async function runHealthCheck(options = {}) {
     }
     if (workingQuotaCache && quotaCacheChanged) {
         try {
-            await saveQuotaCache(workingQuotaCache);
+            await saveQuotaCache(workingQuotaCache, quotaCache ?? undefined);
         }
         catch (error) {
             // Quota cache is a derived artifact; a transient Windows EBUSY/EPERM
@@ -256,7 +300,7 @@ export async function runHealthCheck(options = {}) {
         const activeAccount = storage.accounts[activeIndex];
         if (activeAccount) {
             await setCodexCliActiveSelection({
-                accountId: activeAccount.accountId,
+                accountId: codexCliAccountIdFor(activeAccount, activeAccount.accessToken),
                 email: activeAccount.email,
                 accessToken: activeAccount.accessToken,
                 refreshToken: activeAccount.refreshToken,
@@ -291,4 +335,10 @@ export async function runHealthCheck(options = {}) {
                 tone: warnings > 0 ? "warning" : "muted",
             },
         ]));
+    if (options.discoverModels) {
+        await refreshAndPrintResetCredits(console.log).catch(() => {
+            console.log("Reset-credit availability could not be refreshed; cached counts may be stale.");
+        });
+        await refreshAndPrintModelInventory(console.log);
+    }
 }

package/dist/lib/codex-manager/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAuDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAuGtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/help.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,IAAI,IAAI,CAyDjC;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAuGtE;AAED,UAAU,cAAc;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,cAAc,IAAI,IAAI,CAgBrC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,cAAc,CAyD5D"}

package/dist/lib/codex-manager/help.js

@@ -6,18 +6,20 @@ export function printUsage() {
         "",
         "Start here:",
         "  codex-multi-auth login [--device-auth|--manual|--no-browser] [--org <org_id>] [--preserve-selection] [--account <index|email|account_id>]",
+        "  codex-multi-auth login --api      (API credentials and visible models)",
         "  codex-multi-auth status [--json]   (list is the same command)",
-        "  codex-multi-auth check            (always live-probes)",
+        "  codex-multi-auth check [accounts|resets|capabilities] [--prime]   (default: all checks)",
         "  codex-multi-auth limits --json [--refresh]   (structured quota windows; refresh is age-gated)",
         "",
         "Daily use:",
         "  codex-multi-auth list [--json]",
         "  codex-multi-auth switch <index>   (pins the account for runtime routing)",
+        "  codex-multi-auth resets list [--refresh] | redeem <account> | auto manual|last-resort",
         "  codex-multi-auth unpin            (clears the manual pin set by switch)",
         "  codex-multi-auth workspace <account> [workspace]   (list or switch an account's workspaces)",
         "  codex-multi-auth best [--live] [--json] [--model <model>]   (clears any manual pin set by switch)",
         "  codex-multi-auth forecast [--live] [--json] [--explain] [--model <model>] [--no-runtime-overlay]",
-        "  codex-multi-auth account tag|untag|weight|pause|unpause|drain|undrain|note|policy list ...",
+        "  codex-multi-auth account tag|untag|weight|priority|auto-prime|pause|unpause|drain|undrain|note|policy list ...",
         "",
         "Repair:",
         "  codex-multi-auth uninstall [--dry-run] [--json] [--clear-accounts]",

package/dist/lib/codex-manager/login-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAUrB,MAAM,eAAe,CAAC;AAmCvB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,GAChB,iBAAiB,GAAG,IAAI,CAkB1B;AAED,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAqBjB"}
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-flow.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAUrB,MAAM,eAAe,CAAC;AAwCvB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,sBAAsB,CAAC;AAM9B;;;;;;;GAOG;AAEH,gBAAgB;AAChB,MAAM,WAAW,aAAa;IAC7B,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,uBAAuB,IAAI,iBAAiB,CAAC;CAC7C;AAkCD,gBAAgB;AAChB,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,GAChB,iBAAiB,GAAG,IAAI,CAkB1B;AAED,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}

package/dist/lib/codex-manager/login-flow.js

@@ -1,4 +1,7 @@
-import { sanitizeEmail } from "../accounts.js";
+import { runApiLoginMenu } from "./api-login-menu.js";
+import { sanitizeEmail, getAccountIdCandidates } from "../accounts.js";
+import { resolveOrgOverride } from "../auth/org-override.js";
+import { chooseLoginWorkspace } from "./login-workspace-choice.js";
 import { isBrowserLaunchSuppressed } from "../auth/browser.js";
 import { promptAddAnotherAccount, promptLoginMode } from "../cli.js";
 import { ACCOUNT_LIMITS } from "../constants.js";
@@ -14,9 +17,11 @@ import { stylePromptText } from "./formatters/index.js";
 import { runHealthCheck } from "./health-check.js";
 import { parseAuthLoginArgs, printUsage, } from "./help.js";
 import { runActionPanel } from "./login-action-panel.js";
+import { clearAccountsAndCredentialSidecars } from "../storage/credential-sidecars.js";
 import { handleManageAction, promptBackupRestoreMode, promptManualBackupSelection, promptOAuthSignInMode, } from "./login-menu-actions.js";
 import { countMenuQuotaRefreshTargets, DEFAULT_MENU_QUOTA_REFRESH_TTL_MS, loadRuntimeCurrentSelectionForStorage, refreshQuotaCacheForMenu, syncCodexCliActiveSelectionIfDrifted, toExistingAccountInfo, } from "./login-menu-data.js";
 import { isOAuthCancellation, persistAccountPool, resolveAccountSelection, runSignInFlow, syncSelectionToCodex, } from "./login-oauth.js";
+import { applyAuthorizedAccountConstraint, fetchAuthorizedAccounts, } from "../auth/account-access.js";
 import { persistAndSyncSelectedAccount } from "./persist-selected-account.js";
 import { runFix as runRepairFix, runVerifyFlagged as runRepairVerifyFlagged, } from "./repair-commands.js";
 import { applyUiThemeFromDashboardSettings, configureUnifiedSettings, } from "./settings-hub.js";
@@ -37,7 +42,7 @@ async function drainPendingMenuQuotaRefresh(state) {
 }
 const log = createLogger("codex-manager");
 async function clearAccountsAndReset() {
-    await clearAccounts();
+    await clearAccountsAndCredentialSidecars(clearAccounts);
 }
 /** @internal */
 export function resolveLoginAccountTarget(storage, identifier) {
@@ -58,6 +63,8 @@ export function resolveLoginAccountTarget(storage, identifier) {
 }
 /** @internal */
 export async function runAuthLogin(args, deps) {
+    if (args.length === 1 && args[0] === "--api")
+        return runApiLoginMenu();
     const parsedArgs = parseAuthLoginArgs(args);
     if (!parsedArgs.ok) {
         if (parsedArgs.reason === "error") {
@@ -141,14 +148,14 @@ async function runLoginDashboardLoop(menuState, deps) {
         if (menuResult.mode === "check") {
             clearMenuQuotaAutoRefreshSkip(menuState);
             await runActionPanel("Quick Check", "Checking local session + live status", async () => {
-                await runHealthCheck({ forceRefresh: false, liveProbe: true });
+                await runHealthCheck({ forceRefresh: false, liveProbe: true, discoverModels: true });
             }, displaySettings);
             continue;
         }
         if (menuResult.mode === "deep-check") {
             clearMenuQuotaAutoRefreshSkip(menuState);
             await runActionPanel("Deep Check", "Refreshing and testing all accounts", async () => {
-                await runHealthCheck({ forceRefresh: true, liveProbe: true });
+                await runHealthCheck({ forceRefresh: true, liveProbe: true, discoverModels: true });
             }, displaySettings);
             continue;
         }
@@ -166,6 +173,11 @@ async function runLoginDashboardLoop(menuState, deps) {
             }, displaySettings);
             continue;
         }
+        if (menuResult.mode === "api-models") {
+            await drainPendingMenuQuotaRefresh(menuState);
+            await runApiLoginMenu();
+            continue;
+        }
         if (menuResult.mode === "settings") {
             clearMenuQuotaAutoRefreshSkip(menuState);
             await configureUnifiedSettings(displaySettings);
@@ -182,7 +194,7 @@ async function runLoginDashboardLoop(menuState, deps) {
             clearMenuQuotaAutoRefreshSkip(menuState);
             await runActionPanel("Reset Accounts", "Deleting all saved accounts", async () => {
                 await clearAccountsAndReset();
-                console.log("Cleared saved accounts from active storage. Recovery snapshots remain available.");
+                console.log("Cleared saved accounts and API credentials. Account recovery snapshots remain available.");
             }, displaySettings);
             continue;
         }
@@ -385,9 +397,59 @@ async function runAuthLoginFlow(loginOptions, deps) {
                 console.error(`Login failed: ${tokenResult.message ?? tokenResult.reason ?? "unknown error"}`);
                 return 1;
             }
-            const resolved = resolveAccountSelection(tokenResult, loginOptions.org, expectedAccount?.accountId);
+            let resolved;
             let persistResult;
             try {
+                const workspaceOverride = expectedAccount || resolveOrgOverride(loginOptions.org)
+                    ? loginOptions.org
+                    : await chooseLoginWorkspace(getAccountIdCandidates(tokenResult.access, tokenResult.idToken));
+                if (workspaceOverride === null) {
+                    // Same as an OAuth cancel: back to the dashboard when it launched
+                    // this sign-in, otherwise exit.
+                    if (!explicitSignInMode && existingCount > 0) {
+                        console.log(stylePromptText("Cancelled. Account was not saved.", "muted"));
+                        continue loginFlow;
+                    }
+                    console.log("Cancelled. Account was not saved.");
+                    return 0;
+                }
+                resolved = resolveAccountSelection(tokenResult, workspaceOverride, expectedAccount?.accountId);
+                // The workspace list comes from token claims, which can name an
+                // organization these credentials hold no live authorization for. Codex
+                // CLI >= 0.156.0 checks that against wham/accounts/check and refuses
+                // every request with "selected workspace missing from routing
+                // discovery", so ask the same question before persisting the id.
+                // A targeted re-auth is skipped: persistAccountPool identity-checks it
+                // and would reject a rewritten id.
+                if (!expectedAccount && resolved.accountIdOverride) {
+                    const authorized = await fetchAuthorizedAccounts(tokenResult.access);
+                    const constrained = applyAuthorizedAccountConstraint(resolved, authorized);
+                    if (constrained.result?.changed) {
+                        if (resolved.accountIdSource === "manual") {
+                            // `--org` / CODEX_AUTH_ACCOUNT_ID is explicit intent, so the saved
+                            // binding is kept as chosen. Codex CLI would refuse it though, so
+                            // every ~/.codex/auth.json writer gets the authorized id through
+                            // the saved CodexCliMirror instead.
+                            resolved = {
+                                ...resolved,
+                                codexCliMirror: {
+                                    forAccountId: resolved.accountIdOverride,
+                                    accountId: constrained.result.accountId,
+                                },
+                            };
+                            console.warn("Warning: the workspace you selected is not authorized for these credentials. It is saved as chosen, but the Codex CLI auth file gets the backend's default account instead, because Codex CLI 0.156+ refuses unauthorized workspaces.");
+                        }
+                        else {
+                            resolved = { ...constrained.selection, codexCliMirror: null };
+                            console.warn("Warning: the automatically selected workspace is not authorized for these credentials; using the account the backend reports as default instead. Re-authenticate while that workspace is active in ChatGPT to bind it.");
+                        }
+                    }
+                    else if (authorized?.accountIds.includes(resolved.accountIdOverride.trim())) {
+                        // The id is authorized now: drop a mirror left by an earlier login.
+                        // Without an answer (fail open) the saved mirror is kept.
+                        resolved = { ...resolved, codexCliMirror: null };
+                    }
+                }
                 persistResult = await persistAccountPool([resolved], false, {
                     preserveSelection: loginOptions.preserveSelection,
                     expectedAccount: expectedAccount ?? undefined,
@@ -396,7 +458,7 @@ async function runAuthLoginFlow(loginOptions, deps) {
             }
             catch (error) {
                 if (error instanceof CodexValidationError) {
-                    console.error(`Re-authentication failed: ${error.message}`);
+                    console.error(`${expectedAccount ? "Re-authentication" : "Login"} failed: ${error.message}`);
                     return 1;
                 }
                 throw error;

package/dist/lib/codex-manager/login-menu-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-menu-data.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-data.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAEN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,cAAc,EAGnB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAKN,KAAK,8BAA8B,EACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAezE;;;;;;GAMG;AAEH,eAAO,MAAM,iCAAiC,QAAa,CAAC;AA+E5D,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,GACd,MAAM,CAkBR;AAED,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AAoKD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,cAAc,GAAG,IAAI,EACjC,eAAe,EAAE,wBAAwB,EACzC,cAAc,GAAE,8BAA8B,GAAG,IAAW,GAC1D,mBAAmB,EAAE,CA+EvB;AAED,wBAAsB,qCAAqC,CAC1D,OAAO,EAAE,gBAAgB,EACzB,GAAG,SAAa,GACd,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAgBhD;AAsBD,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}
+{"version":3,"file":"login-menu-data.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-menu-data.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAEN,KAAK,wBAAwB,EAE7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,cAAc,EAGnB,MAAM,mBAAmB,CAAC;AAe3B,OAAO,EAKN,KAAK,8BAA8B,EACnC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAezE;;;;;;GAMG;AAEH,eAAO,MAAM,iCAAiC,QAAa,CAAC;AA+E5D,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,SAAa,GACd,MAAM,CAkBR;AAED,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACnD,OAAO,CAAC,cAAc,CAAC,CAqGzB;AAoKD,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,cAAc,GAAG,IAAI,EACjC,eAAe,EAAE,wBAAwB,EACzC,cAAc,GAAE,8BAA8B,GAAG,IAAW,GAC1D,mBAAmB,EAAE,CA+EvB;AAED,wBAAsB,qCAAqC,CAC1D,OAAO,EAAE,gBAAgB,EACzB,GAAG,SAAa,GACd,OAAO,CAAC,8BAA8B,GAAG,IAAI,CAAC,CAgBhD;AAgCD,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/lib/codex-manager/login-menu-data.js

@@ -1,4 +1,5 @@
 import { extractAccountId, sanitizeEmail } from "../accounts.js";
+import { codexAuthAccountIdsMatch, codexCliAccountIdFor, codexCliActiveIdentity, isOpenAiOrgId, } from "../auth/token-utils.js";
 import { loadCodexCliState } from "../codex-cli/state.js";
 import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { DEFAULT_DASHBOARD_DISPLAY_SETTINGS, } from "../dashboard-settings.js";
@@ -110,7 +111,8 @@ export async function refreshQuotaCacheForMenu(storage, cache, maxAgeMs, onProgr
         // loaded; another writer (a deep check, a second session) may have saved
         // entries meanwhile, and writing the stale clone back whole-file would
         // silently discard them (last write wins). Re-apply this run's results
-        // onto the freshest persisted cache instead.
+        // onto a fresh snapshot for the returned menu view. saveQuotaCache then
+        // reloads under its file lock and applies only changes since saveBaseline.
         //
         // loadQuotaCache() is documented to never throw — on any read failure it
         // returns empty maps. We also guard the empty-maps case explicitly: if the
@@ -118,11 +120,14 @@ export async function refreshQuotaCacheForMenu(storage, cache, maxAgeMs, onProgr
         // nextCache so non-probed entries are not wiped. The try/catch handles any
         // mocked or future implementation that does throw.
         let cacheToSave = nextCache;
+        let saveBaseline = cache;
         try {
             const persisted = await loadQuotaCache();
             const persistedHasData = Object.keys(persisted.byAccountId).length > 0 ||
-                Object.keys(persisted.byEmail).length > 0;
+                Object.keys(persisted.byEmail).length > 0 ||
+                Object.keys(persisted.byWorkspace ?? {}).length > 0;
             if (persistedHasData) {
+                saveBaseline = cloneQuotaCacheData(persisted);
                 for (const { account, snapshot } of appliedSnapshots) {
                     updateQuotaCacheForAccount(persisted, account, snapshot, storage.accounts, emailFallbackState);
                 }
@@ -135,7 +140,7 @@ export async function refreshQuotaCacheForMenu(storage, cache, maxAgeMs, onProgr
             // so non-probed entries survive.
         }
         try {
-            await saveQuotaCache(cacheToSave);
+            await saveQuotaCache(cacheToSave, saveBaseline);
         }
         catch (error) {
             // Quota cache is a derived artifact; a transient Windows EBUSY/EPERM
@@ -349,10 +354,18 @@ export async function loadRuntimeCurrentSelectionForStorage(storage, now = Date.
 function activeAccountMatchesCodexCliState(account, state) {
     if (!state)
         return true;
-    const accountId = account.accountId?.trim();
-    const activeAccountId = state.activeAccountId?.trim();
-    if (accountId && activeAccountId) {
-        return accountId === activeAccountId;
+    // An org account_id in auth.json (written before #700) makes Codex CLI
+    // 0.156+ fail; resync so the writer replaces it with the workspace id.
+    if (isOpenAiOrgId(state.authFileAccountId))
+        return false;
+    // A stored "org-..." id is written to auth.json as the token's workspace
+    // id, while the legacy accounts.json keeps the raw id (#700); match either.
+    // Compared as the writer would write it: through the account's
+    // CodexCliMirror, or an explicit id the backend refused comes back here.
+    const accountId = codexCliAccountIdFor(account, account.accessToken)?.trim();
+    const activeIdentity = codexCliActiveIdentity(state);
+    if (accountId && activeIdentity.accountId) {
+        return codexAuthAccountIdsMatch({ accountId, accessToken: account.accessToken }, activeIdentity);
     }
     const email = sanitizeEmail(account.email);
     const activeEmail = sanitizeEmail(state.activeEmail);
@@ -376,7 +389,7 @@ export async function syncCodexCliActiveSelectionIfDrifted(storage) {
             return false;
         }
         return setCodexCliActiveSelection({
-            accountId: account.accountId,
+            accountId: codexCliAccountIdFor(account, account.accessToken),
             email: account.email,
             accessToken: account.accessToken,
             refreshToken: account.refreshToken,

package/dist/lib/codex-manager/login-oauth.d.ts

@@ -1,5 +1,6 @@
 import { type Workspace } from "../accounts.js";
 import { type AccountMetadataV3 } from "../storage.js";
+import type { CodexCliMirror } from "../storage/public-types.js";
 import type { AccountIdSource, TokenResult } from "../types.js";
 import { type AccountPoolWriteOutcome } from "./account-pool-write.js";
 /**
@@ -18,6 +19,8 @@ export type TokenSuccessWithAccount = TokenSuccess & {
     accountIdSource?: AccountIdSource;
     accountLabel?: string;
     workspaces?: Workspace[];
+    /** Set, keep (undefined) or clear (null) the saved CodexCliMirror. */
+    codexCliMirror?: CodexCliMirror | null;
 };
 /** @internal */
 export declare function isOAuthCancellation(result: Exclude<TokenResult, {

package/dist/lib/codex-manager/login-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CACzB,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,GACtB,uBAAuB,CAiGzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,MAAM,WAAW,wBAAwB;IACxC,0EAA0E;IAC1E,OAAO,EAAE,yBAAyB,CAAC;IACnC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,gBAAgB;AAChB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACtC,iBAAiB,EACjB,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CACnD,CAAC;AAEF,gBAAgB;AAChB,MAAM,WAAW,yBAAyB;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAuGD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAuJ1C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkBf"}
+{"version":3,"file":"login-oauth.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-oauth.ts"],"names":[],"mappings":"AAEA,OAAO,EAON,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAmBxB,OAAO,EACN,KAAK,iBAAiB,EAGtB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACN,KAAK,uBAAuB,EAG5B,MAAM,yBAAyB,CAAC;AAOjC;;;;;GAKG;AAEH,gBAAgB;AAChB,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC;AACrE,gBAAgB;AAChB,MAAM,MAAM,uBAAuB,GAAG,YAAY,GAAG;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,sEAAsE;IACtE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC,CAAC;AAIF,gBAAgB;AAChB,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAC/C,OAAO,CAGT;AAED,gBAAgB;AAChB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,YAAY,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,CAAC,EAAE,MAAM,GACtB,uBAAuB,CAiGzB;AA0FD,gBAAgB;AAChB,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,gBAAgB,GAChB,QAAQ,CAAC;AACZ,gBAAgB;AAChB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,gBAAgB;AAChB,wBAAsB,YAAY,CACjC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,CAAC,GACxD,OAAO,CAAC,WAAW,CAAC,CA6ItB;AAED,gBAAgB;AAChB,wBAAsB,aAAa,CAClC,aAAa,EAAE,OAAO,EACtB,UAAU,EAAE,OAAO,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,EACrE,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,WAAW,CAAC,CAetB;AAED,gBAAgB;AAChB,MAAM,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEhE,gBAAgB;AAChB,MAAM,WAAW,wBAAwB;IACxC,0EAA0E;IAC1E,OAAO,EAAE,yBAAyB,CAAC;IACnC,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,uEAAuE;IACvE,cAAc,EAAE,OAAO,CAAC;CACxB;AAED,gBAAgB;AAChB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CACtC,iBAAiB,EACjB,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,cAAc,CACnD,CAAC;AAEF,gBAAgB;AAChB,MAAM,WAAW,yBAAyB;IACzC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAuGD,gBAAgB;AAChB,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,uBAAuB,EAAE,EAClC,UAAU,EAAE,OAAO,EACnB,OAAO,GAAE,yBAA8B,GACrC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAwJ1C;AAED,gBAAgB;AAChB,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/lib/codex-manager/login-oauth.js

@@ -7,6 +7,7 @@ import { runDeviceAuthFlow } from "../auth/device-auth.js";
 import { resolveOrgOverride } from "../auth/org-override.js";
 import { startLocalOAuthServer } from "../auth/server.js";
 import { describeCallbackFailure } from "../auth/callback-guidance.js";
+import { codexCliAccountIdFor } from "../auth/token-utils.js";
 import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { createLogger } from "../logger.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
@@ -431,6 +432,7 @@ export async function persistAccountPool(results, replaceAll, options = {}) {
                 accessToken: result.access,
                 expiresAt: result.expires,
                 workspaces: result.workspaces,
+                codexCliMirror: result.codexCliMirror,
                 // A targeted re-auth only tops up credentials for the row the user
                 // named; it must not silently re-enable an account they disabled.
                 preserveEnabledState: Boolean(options.expectedAccount),
@@ -531,7 +533,10 @@ export async function persistAccountPool(results, replaceAll, options = {}) {
 /** @internal */
 export async function syncSelectionToCodex(tokens) {
     const tokenAccountId = extractAccountId(tokens.access);
-    const accountId = resolveRequestAccountId(tokens.accountIdOverride, tokens.accountIdSource, tokenAccountId);
+    const accountId = codexCliAccountIdFor({
+        accountId: resolveRequestAccountId(tokens.accountIdOverride, tokens.accountIdSource, tokenAccountId),
+        codexCliMirror: tokens.codexCliMirror ?? undefined,
+    }, tokens.access, tokens.idToken);
     const email = sanitizeEmail(extractAccountEmail(tokens.access, tokens.idToken));
     await setCodexCliActiveSelection({
         accountId,

package/dist/lib/codex-manager/login-workspace-choice.d.ts

@@ -0,0 +1,11 @@
+import { type AccountIdCandidate } from "../auth/token-utils.js";
+import { type MenuItem } from "../ui/select.js";
+interface WorkspaceChoiceDeps {
+    interactive: boolean;
+    select: (items: MenuItem<string>[]) => Promise<string | null>;
+    warn?: (message: string) => void;
+}
+/** Undefined delegates to the unambiguous default; null means cancel without saving. */
+export declare function chooseLoginWorkspace(candidates: AccountIdCandidate[], deps?: WorkspaceChoiceDeps): Promise<string | undefined | null>;
+export {};
+//# sourceMappingURL=login-workspace-choice.d.ts.map

package/dist/lib/codex-manager/login-workspace-choice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-workspace-choice.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/login-workspace-choice.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,kBAAkB,EACvB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAU,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAExD,UAAU,mBAAmB;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,wFAAwF;AACxF,wBAAsB,oBAAoB,CACzC,UAAU,EAAE,kBAAkB,EAAE,EAChC,IAAI,GAAE,mBAOL,GACC,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,CAyBpC"}

package/dist/lib/codex-manager/login-workspace-choice.js

@@ -0,0 +1,37 @@
+import { isPersonalAccountCandidate, } from "../auth/token-utils.js";
+import { CodexValidationError } from "../errors.js";
+import { stylePromptText } from "./formatters/index.js";
+import { select } from "../ui/select.js";
+/** Undefined delegates to the unambiguous default; null means cancel without saving. */
+export async function chooseLoginWorkspace(candidates, deps = {
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    select: (items) => select(items, {
+        message: "Choose the workspace for this account",
+        subtitle: "No unique Personal workspace was identified. Choose explicitly before saving.",
+        allowEscape: true,
+    }),
+}) {
+    // An org- id is an API organization alias of a workspace (normalized to the
+    // token's workspace when saved), so it never adds a real choice on its own.
+    const workspaces = candidates.filter((candidate) => !candidate.accountId.startsWith("org-"));
+    if (workspaces.length <= 1 || candidates.filter(isPersonalAccountCandidate).length === 1) {
+        return undefined;
+    }
+    if (!deps.interactive) {
+        // Scripted logins keep the 2.16.0 automatic choice rather than discarding
+        // a completed OAuth exchange.
+        (deps.warn ?? ((message) => console.warn(stylePromptText(message, "warning"))))("Multiple workspaces found without a unique Personal workspace; saving the automatic choice. Re-run login with --org <workspace-id> to bind a specific workspace.");
+        return undefined;
+    }
+    // An interactive pick is explicit intent and is saved like --org.
+    const choice = await deps.select(workspaces.map((candidate) => ({
+        label: candidate.label,
+        value: candidate.accountId,
+    })));
+    if (choice === null)
+        return null;
+    if (!workspaces.some((candidate) => candidate.accountId === choice)) {
+        throw new CodexValidationError("Invalid workspace selection. Account was not saved.");
+    }
+    return choice;
+}

package/dist/lib/codex-manager/persist-selected-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persist-selected-account.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/persist-selected-account.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,eAAe,CAAC;AAQvB;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,EACnD,OAAO,EACP,WAAW,EACX,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,2BAAmC,EACnC,MAAc,EACd,QAAgB,EAChB,sBAA8B,GAC9B,EAAE;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,qBAAqB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAmHrD"}
+{"version":3,"file":"persist-selected-account.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/persist-selected-account.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACN,KAAK,gBAAgB,EAIrB,MAAM,eAAe,CAAC;AAQvB;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,EACnD,OAAO,EACP,WAAW,EACX,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,2BAAmC,EACnC,MAAc,EACd,QAAgB,EAChB,sBAA8B,GAC9B,EAAE;IACF,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,qBAAqB,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CAmHrD"}

package/dist/lib/codex-manager/persist-selected-account.js

@@ -1,4 +1,5 @@
 import { extractAccountEmail, extractAccountId, sanitizeEmail, } from "../accounts.js";
+import { codexCliAccountIdFor } from "../auth/token-utils.js";
 import { setCodexCliActiveSelection } from "../codex-cli/writer.js";
 import { MODEL_FAMILIES } from "../prompts/codex.js";
 import { queuedRefresh } from "../refresh-queue.js";
@@ -110,7 +111,7 @@ export async function persistAndSyncSelectedAccount({ storage, targetIndex, pars
     }
     await saveAccountsWithRetry(storage, saveAccounts);
     const synced = await setCodexCliActiveSelection({
-        accountId: account.accountId,
+        accountId: codexCliAccountIdFor(account, syncAccessToken, syncIdToken),
         email: account.email,
         accessToken: syncAccessToken,
         refreshToken: syncRefreshToken,

package/dist/lib/codex-manager/quota-cache-helpers.d.ts

@@ -1,3 +1,4 @@
+import { type QuotaCacheAccountRef } from "../quota-readiness.js";
 import { type QuotaCacheData, type QuotaCacheEntry } from "../quota-cache.js";
 import type { CodexQuotaSnapshot } from "../quota-probe.js";
 import type { AccountMetadataV3 } from "../storage.js";
@@ -11,8 +12,13 @@ import type { AccountMetadataV3 } from "../storage.js";
  */
 /** Default model used for live quota probes across manager commands. */
 export declare const DEFAULT_LIVE_PROBE_MODEL = "gpt-5.6-sol";
-export declare function getPersistedQuotaViewForAccount(cache: QuotaCacheData | null, account: Pick<AccountMetadataV3, "accountId" | "email" | "rateLimitResetTimes">, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], now: number, emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): QuotaCacheEntry | null;
+/** Combine selected-workspace observations with persisted account-level rate-limit blockers. */
+export declare function getPersistedQuotaViewForAccount(cache: QuotaCacheData | null, account: QuotaCacheAccountRef & Pick<AccountMetadataV3, "rateLimitResetTimes">, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], now: number, emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): QuotaCacheEntry | null;
+/** Update legacy stored-binding quota with a unique ID or safe email fallback. */
 export declare function updateQuotaCacheForAccount(cache: QuotaCacheData, account: Pick<AccountMetadataV3, "accountId" | "email">, snapshot: CodexQuotaSnapshot, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
+/** Persist the observed workspace without attributing sibling quota to a stored binding. */
+export declare function updateQuotaCacheForWorkspace(cache: QuotaCacheData, account: AccountMetadataV3, workspaceId: string, snapshot: CodexQuotaSnapshot, accounts: readonly AccountMetadataV3[]): void;
+/** Clone every cache namespace; immutable entries may safely remain shared. */
 export declare function cloneQuotaCacheData(cache: QuotaCacheData): QuotaCacheData;
 export declare function pruneUnsafeQuotaEmailCacheEntry(cache: QuotaCacheData, email: string | undefined, accounts: readonly Pick<AccountMetadataV3, "accountId" | "email">[], emailFallbackState?: ReadonlyMap<string, import("../quota-readiness.js").QuotaEmailFallbackState>): boolean;
 //# sourceMappingURL=quota-cache-helpers.d.ts.map

package/dist/lib/codex-manager/quota-cache-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quota-cache-helpers.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/quota-cache-helpers.ts"],"names":[],"mappings":"AAOA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;GAOG;AAEH,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,gBAAsB,CAAC;AA2B5D,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,EAAE,IAAI,CACZ,iBAAiB,EACjB,WAAW,GAAG,OAAO,GAAG,qBAAqB,CAC7C,EACD,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,GAAG,EAAE,MAAM,EACX,kBAAkB,+EAAyC,GACzD,eAAe,GAAG,IAAI,CA+BxB;AAED,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAuCT;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAOzE;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAeT"}
+{"version":3,"file":"quota-cache-helpers.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/quota-cache-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,oBAAoB,EAKzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAM5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;;GAOG;AAEH,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,gBAAsB,CAAC;AAE5D,gGAAgG;AAChG,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,EAC9E,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,GAAG,EAAE,MAAM,EACX,kBAAkB,+EAAyC,GACzD,eAAe,GAAG,IAAI,CA+BxB;AAsBD,kFAAkF;AAClF,wBAAgB,0BAA0B,CACzC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EACvD,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAwBT;AAED,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,IAAI,CAgB/L;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAQzE;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,SAAS,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,OAAO,CAAC,EAAE,EACnE,kBAAkB,+EAAyC,GACzD,OAAO,CAeT"}