codex-multi-auth 2.16.0 → 2.17.2

package/dist/lib/codex-manager/quota-cache-helpers.js

@@ -1,4 +1,4 @@
-import { buildQuotaEmailFallbackState, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, normalizeQuotaAccountId, normalizeQuotaEmail, } from "../quota-readiness.js";
+import { buildQuotaEmailFallbackState, findQuotaCacheEntryForAccount, quotaWorkspaceKey, hasSafeQuotaEmailFallback, hasUniqueQuotaAccountId, normalizeQuotaAccountId, normalizeQuotaEmail, } from "../quota-readiness.js";
 import { DEFAULT_MODEL, DEFAULT_PROBE_MODEL, } from "../request/helpers/model-map.js";
 import { getRateLimitResetTimeForFamily } from "../runtime/account-status.js";
 /**
@@ -11,24 +11,10 @@ import { getRateLimitResetTimeForFamily } from "../runtime/account-status.js";
  */
 /** Default model used for live quota probes across manager commands. */
 export const DEFAULT_LIVE_PROBE_MODEL = DEFAULT_PROBE_MODEL;
-function getQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
-    const accountId = normalizeQuotaAccountId(account.accountId);
-    if (accountId &&
-        hasUniqueQuotaAccountId(accounts, account) &&
-        cache.byAccountId[accountId]) {
-        return cache.byAccountId[accountId] ?? null;
-    }
-    const email = normalizeQuotaEmail(account.email);
-    if (email &&
-        hasSafeQuotaEmailFallback(emailFallbackState, account) &&
-        cache.byEmail[email]) {
-        return cache.byEmail[email] ?? null;
-    }
-    return null;
-}
+/** Combine selected-workspace observations with persisted account-level rate-limit blockers. */
 export function getPersistedQuotaViewForAccount(cache, account, accounts, now, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
     const cachedEntry = cache
-        ? getQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState)
+        ? findQuotaCacheEntryForAccount(cache, account, accounts, emailFallbackState)
         : null;
     const persistedResetAt = getRateLimitResetTimeForFamily(account, now, "codex");
     if (typeof persistedResetAt !== "number") {
@@ -52,8 +38,9 @@ export function getPersistedQuotaViewForAccount(cache, account, accounts, now, e
         secondary: cachedEntry?.secondary ?? {},
     };
 }
-export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
-    const nextEntry = {
+/** Retain only quota fields from a probe, never its credentials or response body. */
+function quotaEntryFromSnapshot(snapshot) {
+    return {
         updatedAt: Date.now(),
         status: snapshot.status,
         model: snapshot.model,
@@ -69,6 +56,10 @@ export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, e
             resetAtMs: snapshot.secondary.resetAtMs,
         },
     };
+}
+/** Update legacy stored-binding quota with a unique ID or safe email fallback. */
+export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {
+    const nextEntry = quotaEntryFromSnapshot(snapshot);
     let changed = false;
     const accountId = normalizeQuotaAccountId(account.accountId);
     const hasUniqueAccountId = accountId !== null && hasUniqueQuotaAccountId(accounts, account);
@@ -89,12 +80,36 @@ export function updateQuotaCacheForAccount(cache, account, snapshot, accounts, e
     }
     return changed;
 }
+/** Persist the observed workspace without attributing sibling quota to a stored binding. */
+export function updateQuotaCacheForWorkspace(cache, account, workspaceId, snapshot, accounts) {
+    const key = quotaWorkspaceKey(account, workspaceId);
+    if (!key)
+        return;
+    cache.byWorkspace ??= {};
+    cache.byWorkspace[key] = quotaEntryFromSnapshot(snapshot);
+    if (workspaceId === normalizeQuotaAccountId(account.accountId)) {
+        updateQuotaCacheForAccount(cache, account, snapshot, accounts);
+    }
+    else {
+        // Retire the ambiguous fallback only after retaining its binding observation.
+        const boundId = normalizeQuotaAccountId(account.accountId);
+        const binding = boundId ? findQuotaCacheEntryForAccount(cache, account, accounts, undefined, boundId) : null;
+        const boundKey = boundId && quotaWorkspaceKey(account, boundId);
+        if (binding && boundKey)
+            cache.byWorkspace[boundKey] = binding;
+        const email = normalizeQuotaEmail(account.email);
+        if (email)
+            delete cache.byEmail[email];
+    }
+}
+/** Clone every cache namespace; immutable entries may safely remain shared. */
 export function cloneQuotaCacheData(cache) {
     // Shallow spreading is safe because quota cache entries are always replaced,
     // never mutated in-place.
     return {
         byAccountId: { ...cache.byAccountId },
         byEmail: { ...cache.byEmail },
+        ...(cache.byWorkspace ? { byWorkspace: { ...cache.byWorkspace } } : {}),
     };
 }
 export function pruneUnsafeQuotaEmailCacheEntry(cache, email, accounts, emailFallbackState = buildQuotaEmailFallbackState(accounts)) {

package/dist/lib/codex-manager/repair-commands.d.ts

@@ -1,5 +1,6 @@
 import { type QuotaCacheData } from "../quota-cache.js";
 import { fetchCodexQuotaSnapshot } from "../quota-probe.js";
+import type { CodexCliMirrorUpdate, ConstrainedSelection } from "../auth/account-access.js";
 import { type AccountMetadataV3, type AccountStorageV3 } from "../storage.js";
 import { type ModelFamily } from "../prompts/codex.js";
 import type { AccountIdSource } from "../types.js";
@@ -46,6 +47,18 @@ export interface RepairCommandDeps {
     formatCompactQuotaSnapshot: (snapshot: Awaited<ReturnType<typeof fetchCodexQuotaSnapshot>>) => string;
     resolveStoredAccountIdentity: (storedAccountId: string | undefined, storedAccountIdSource: AccountIdSource | undefined, refreshedAccountId: string | undefined) => AccountIdentityResolution;
     applyTokenAccountIdentity: (account: AccountMetadataV3, refreshedAccountId: string | undefined) => boolean;
+    /**
+     * Migrates an org-sourced account id the backend no longer authorizes
+     * (Codex CLI >= 0.156.0's `wham/accounts/check`); see
+     * lib/auth/account-access.ts for the full contract. Live-only: called from
+     * `fix --live`, where a network round trip already happens per account.
+     */
+    reboundUnauthorizedAccountIdentity: (account: AccountMetadataV3, accessToken: string) => Promise<ConstrainedSelection | null>;
+    /**
+     * Keeps an explicit (`manual`) account's CodexCliMirror in step with the
+     * backend's authorization; see lib/auth/account-access.ts. Live-only.
+     */
+    refreshCodexCliMirror: (account: AccountMetadataV3, accessToken: string) => Promise<CodexCliMirrorUpdate | null>;
 }
 export declare function parseFixArgs(args: string[]): ParsedArgsResult<FixCliOptions>;
 export declare function runVerifyFlagged(args: string[], deps: RepairCommandDeps): Promise<number>;

package/dist/lib/codex-manager/repair-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;CACb;AA2DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AAkjBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA2cjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA0qBjB"}
+{"version":3,"file":"repair-commands.d.ts","sourceRoot":"","sources":["../../../lib/codex-manager/repair-commands.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxF,OAAO,EACN,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EACX,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EASN,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAGrB,MAAM,eAAe,CAAC;AAYvB,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,KAAK,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AAG9E,KAAK,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAExE,KAAK,uBAAuB,GAAG;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,KAAK,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,gBAAgB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,KAAK,yBAAyB,GAAG;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAcD,MAAM,WAAW,iBAAiB;IACjC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,sBAAsB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,UAAU,KAAK,MAAM,CAAC;IAC9E,mBAAmB,EAAE,CACpB,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,KACvD,MAAM,CAAC;IACZ,kBAAkB,EAAE,CACnB,OAAO,EAAE,gBAAgB,EACzB,MAAM,CAAC,EAAE,WAAW,KAChB,MAAM,CAAC;IACZ,oBAAoB,EAAE,CACrB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,KACP,OAAO,CAAC;IACb,4BAA4B,EAAE,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC5E,sBAAsB,EAAE,CACvB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,KACtB,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,KACrC,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAClD,0BAA0B,EAAE,CAC3B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,EAC7D,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC7D,OAAO,CAAC;IACb,mBAAmB,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,cAAc,CAAC;IAC/D,+BAA+B,EAAE,CAChC,KAAK,EAAE,cAAc,EACrB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,KAC5D,OAAO,CAAC;IACb,0BAA0B,EAAE,CAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,KACzD,MAAM,CAAC;IACZ,4BAA4B,EAAE,CAC7B,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,qBAAqB,EAAE,eAAe,GAAG,SAAS,EAClD,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,yBAAyB,CAAC;IAC/B,yBAAyB,EAAE,CAC1B,OAAO,EAAE,iBAAiB,EAC1B,kBAAkB,EAAE,MAAM,GAAG,SAAS,KAClC,OAAO,CAAC;IACb;;;;;OAKG;IACH,kCAAkC,EAAE,CACnC,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,EAAE,CACtB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,MAAM,KACf,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CAC1C;AA4DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,aAAa,CAAC,CA4C5E;AA8lBD,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CA6XjB;AAED,wBAAsB,MAAM,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAkjBjB;AAED,wBAAsB,SAAS,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAisBjB"}

package/dist/lib/codex-manager/repair-commands.js

@@ -6,6 +6,7 @@ import { extractAccountEmail, extractAccountId, formatAccountLabel, sanitizeEmai
 import { loadQuotaCache, saveQuotaCache } from "../quota-cache.js";
 import { fetchCodexQuotaSnapshot, CODEX_UNAVAILABLE_PROBE_NOTE, } from "../quota-probe.js";
 import { isCodexUnavailableError } from "../errors.js";
+import { codexAuthAccountIdsMatch, codexCliAccountIdFor, codexCliActiveIdentity, isOpenAiOrgId, } from "../auth/token-utils.js";
 import { queuedRefresh } from "../refresh-queue.js";
 import { findMatchingAccountIndex, getStoragePath, loadAccounts, loadFlaggedAccounts, setStoragePath, withAccountStorageTransaction, withAccountAndFlaggedStorageTransaction, withFlaggedStorageTransaction, } from "../storage.js";
 import { getCodexCliAuthPath, getCodexCliConfigPath, loadCodexCliState, } from "../codex-cli/state.js";
@@ -28,6 +29,7 @@ function printFixUsage() {
         "  - Refreshes tokens for enabled accounts",
         "  - Disables hard-failed accounts (never deletes)",
         "  - Recommends a better current account when needed",
+        "  - With --live, rebinds an org workspace id the backend no longer authorizes",
     ].join("\n"));
 }
 function printVerifyFlaggedUsage() {
@@ -160,7 +162,8 @@ function summarizeFixReports(reports) {
             healthy += 1;
         else if (report.outcome === "disabled-hard-failure")
             disabled += 1;
-        else if (report.outcome === "warning-soft-failure")
+        else if (report.outcome === "warning-soft-failure" ||
+            report.outcome === "rebound-unauthorized-workspace")
             warnings += 1;
         else
             skipped += 1;
@@ -186,7 +189,11 @@ function hasAccountStorageMutation(before, after) {
         || before.email !== after.email
         || before.accountId !== after.accountId
         || before.accountIdSource !== after.accountIdSource
-        || before.enabled !== after.enabled);
+        || before.enabled !== after.enabled
+        || before.accountLabel !== after.accountLabel
+        || before.currentWorkspaceIndex !== after.currentWorkspaceIndex
+        || JSON.stringify(before.workspaces) !== JSON.stringify(after.workspaces)
+        || JSON.stringify(before.codexCliMirror) !== JSON.stringify(after.codexCliMirror));
 }
 function collectAccountStorageMutations(beforeAccounts, afterAccounts) {
     const mutations = [];
@@ -224,6 +231,33 @@ function applyAccountStorageMutations(storage, mutations) {
         target.accountId = mutation.after.accountId;
         target.accountIdSource = mutation.after.accountIdSource;
         target.enabled = mutation.after.enabled;
+        // Only the workspace rebind in `fix --live` moves these; copying them
+        // unconditionally would clobber a label/workspace change made on disk
+        // since this run loaded storage.
+        if (mutation.before.accountLabel !== mutation.after.accountLabel) {
+            target.accountLabel = mutation.after.accountLabel;
+        }
+        if (JSON.stringify(mutation.before.codexCliMirror) !==
+            JSON.stringify(mutation.after.codexCliMirror)) {
+            target.codexCliMirror = mutation.after.codexCliMirror;
+            if (!target.codexCliMirror)
+                delete target.codexCliMirror;
+        }
+        // The pointer indexes the list, so the two move together: copying only
+        // the list would keep a pointer moved on disk meanwhile, possibly out
+        // of range of the new list.
+        if (mutation.before.currentWorkspaceIndex !== mutation.after.currentWorkspaceIndex ||
+            JSON.stringify(mutation.before.workspaces) !==
+                JSON.stringify(mutation.after.workspaces)) {
+            const workspaces = mutation.after.workspaces;
+            const pointer = mutation.after.currentWorkspaceIndex;
+            target.workspaces = workspaces;
+            target.currentWorkspaceIndex =
+                !workspaces ||
+                    (typeof pointer === "number" && pointer >= 0 && pointer < workspaces.length)
+                    ? pointer
+                    : Math.max(0, workspaces.findIndex((workspace) => workspace.id === mutation.after.accountId));
+        }
     }
 }
 function findExistingAccountIndexForFlagged(storage, flagged, nextRefreshToken, nextAccountId, nextEmail) {
@@ -866,6 +900,29 @@ export async function runFix(args, deps) {
     const reports = [];
     const refreshFailures = new Map();
     const hardDisabledIndexes = [];
+    // A rebind mutates the account before its live probe, so a later rebind
+    // attempt on the refresh path sees a `token` source and reports nothing.
+    // Tracking it per index keeps the note on whichever report ends up final.
+    const reboundIndexes = new Set();
+    // Explicit accounts whose CodexCliMirror this run set or cleared. Checked
+    // once per account even when the refresh path runs after a failed probe.
+    const mirrorUpdates = new Map();
+    const checkMirror = async (index, accessToken) => {
+        const account = storage.accounts[index];
+        if (!account || mirrorUpdates.has(index))
+            return;
+        const update = await deps.refreshCodexCliMirror(account, accessToken);
+        mirrorUpdates.set(index, update);
+        if (update)
+            accountStorageChanged = true;
+    };
+    const noteRebound = (index) => {
+        reboundIndexes.add(index);
+        accountStorageChanged = true;
+        if (workingQuotaCache) {
+            quotaEmailFallbackState = deps.buildQuotaEmailFallbackState(storage.accounts);
+        }
+    };
     for (let i = 0; i < storage.accounts.length; i += 1) {
         const account = storage.accounts[i];
         if (!account)
@@ -884,6 +941,12 @@ export async function runFix(args, deps) {
             let refreshAfterLiveProbeFailure = false;
             if (options.live) {
                 const currentAccessToken = account.accessToken;
+                if (currentAccessToken &&
+                    (await deps.reboundUnauthorizedAccountIdentity(account, currentAccessToken))) {
+                    noteRebound(i);
+                }
+                if (currentAccessToken)
+                    await checkMirror(i, currentAccessToken);
                 const probeAccountId = currentAccessToken
                     ? account.accountId ?? extractAccountId(currentAccessToken)
                     : undefined;
@@ -962,6 +1025,10 @@ export async function runFix(args, deps) {
                     deps.pruneUnsafeQuotaEmailCacheEntry(workingQuotaCache, previousEmail, storage.accounts, quotaEmailFallbackState) || quotaCacheChanged;
             }
             if (options.live) {
+                if (await deps.reboundUnauthorizedAccountIdentity(account, refreshResult.access)) {
+                    noteRebound(i);
+                }
+                await checkMirror(i, refreshResult.access);
                 const probeAccountId = account.accountId ?? nextAccountId;
                 if (probeAccountId) {
                     try {
@@ -1068,8 +1135,32 @@ export async function runFix(args, deps) {
         refreshFailure: refreshFailures.get(index),
     })));
     const recommendation = recommendForecastAccount(forecastResults);
+    for (const report of reports) {
+        const mirrorUpdate = mirrorUpdates.get(report.index);
+        if (mirrorUpdate === "set") {
+            report.message = `explicit workspace is not authorized for these credentials; Codex CLI auth uses the backend default. ${report.message}`;
+        }
+        else if (mirrorUpdate === "cleared") {
+            report.message = `explicit workspace is authorized again; Codex CLI auth uses it. ${report.message}`;
+        }
+        if (!reboundIndexes.has(report.index))
+            continue;
+        report.label = formatAccountLabel(storage.accounts[report.index], report.index);
+        report.message = `workspace was not authorized for these credentials; rebound to the account's default identity. ${report.message}`;
+        if (report.outcome === "healthy") {
+            report.outcome = "rebound-unauthorized-workspace";
+        }
+    }
     const reportSummary = summarizeFixReports(reports);
     const accountMutations = collectAccountStorageMutations(originalAccounts, storage.accounts);
+    // ~/.codex/auth.json still carries the rejected id for the active account,
+    // and Codex CLI keeps refusing it until something rewrites that file. The
+    // mirror is taken from the committed snapshot, not this run's in-memory
+    // view, and written while the storage lock is still held: another process
+    // may switch the active account around this run, and a sync outside the
+    // lock could put the old selection back into auth.json.
+    let codexActiveSynced = null;
+    let committedActiveIndex = activeIndex;
     if (accountStorageChanged && !options.dryRun) {
         await withAccountStorageTransaction(async (loadedStorage, persist) => {
             const nextStorage = loadedStorage
@@ -1077,12 +1168,34 @@ export async function runFix(args, deps) {
                 : createEmptyAccountStorage();
             applyAccountStorageMutations(nextStorage, accountMutations);
             await persist(nextStorage);
+            committedActiveIndex = deps.resolveActiveIndex(nextStorage, "codex");
+            const committedActive = nextStorage.accounts[committedActiveIndex];
+            const syncIndexes = [
+                ...reboundIndexes,
+                ...[...mirrorUpdates].filter(([, update]) => update).map(([index]) => index),
+            ];
+            const isRebound = committedActive !== undefined &&
+                syncIndexes.some((index) => {
+                    const rebound = storage.accounts[index];
+                    return (rebound !== undefined &&
+                        rebound.accountId === committedActive.accountId &&
+                        rebound.refreshToken === committedActive.refreshToken);
+                });
+            if (isRebound && committedActive.enabled !== false) {
+                codexActiveSynced = await setCodexCliActiveSelection({
+                    accountId: codexCliAccountIdFor(committedActive, committedActive.accessToken),
+                    email: committedActive.email,
+                    accessToken: committedActive.accessToken,
+                    refreshToken: committedActive.refreshToken,
+                    expiresAt: committedActive.expiresAt,
+                });
+            }
         });
     }
     let quotaCacheSaveError = null;
     if (!options.dryRun && workingQuotaCache && quotaCacheChanged) {
         try {
-            await saveQuotaCache(workingQuotaCache);
+            await saveQuotaCache(workingQuotaCache, quotaCache ?? undefined);
         }
         catch (error) {
             // Account storage was already persisted above. Surface the quota-cache
@@ -1103,6 +1216,7 @@ export async function runFix(args, deps) {
             changed,
             quotaCacheChanged,
             quotaCacheSaveError,
+            codexActiveSynced,
             summary: reportSummary,
             recommendation,
             recommendedSwitchCommand: recommendation.recommendedIndex !== null
@@ -1129,6 +1243,9 @@ export async function runFix(args, deps) {
     if (quotaCacheSaveError) {
         console.log(deps.stylePromptText(`Warning: quota cache save failed (${quotaCacheSaveError}); account fixes were saved.`, "warning"));
     }
+    if (codexActiveSynced === false) {
+        console.log(deps.stylePromptText(`Warning: the rebound active account could not be synced into Codex auth state; run \`codex-multi-auth switch ${committedActiveIndex + 1}\` to retry.`, "warning"));
+    }
     if (display.showPerAccountRows) {
         console.log("");
         for (const report of reports) {
@@ -1136,14 +1253,16 @@ export async function runFix(args, deps) {
                 ? "✓"
                 : report.outcome === "disabled-hard-failure"
                     ? "✗"
-                    : report.outcome === "warning-soft-failure"
+                    : report.outcome === "warning-soft-failure" ||
+                        report.outcome === "rebound-unauthorized-workspace"
                         ? "!"
                         : "-";
             const tone = report.outcome === "healthy"
                 ? "success"
                 : report.outcome === "disabled-hard-failure"
                     ? "danger"
-                    : report.outcome === "warning-soft-failure"
+                    : report.outcome === "warning-soft-failure" ||
+                        report.outcome === "rebound-unauthorized-workspace"
                         ? "warning"
                         : "muted";
             console.log(`${deps.stylePromptText(prefix, tone)} ${deps.stylePromptText(`${report.index + 1}. ${report.label}`, "accent")} ${deps.stylePromptText("|", "muted")} ${deps.styleAccountDetailText(report.message, tone === "success" ? "muted" : tone)}`);
@@ -1233,6 +1352,7 @@ export async function runDoctor(args, deps) {
     const codexConfigFileExists = existsSync(codexConfigPath);
     let codexAuthEmail;
     let codexAuthAccountId;
+    let codexAuthFileAccountId;
     addCheck({
         key: "codex-auth-file",
         severity: codexAuthFileExists ? "ok" : "warn",
@@ -1269,6 +1389,7 @@ export async function runDoctor(args, deps) {
                     : undefined;
                 const emailFromFile = typeof payload.email === "string" ? payload.email : undefined;
                 codexAuthEmail = sanitizeEmail(emailFromFile ?? extractAccountEmail(accessToken, idToken));
+                codexAuthFileAccountId = accountIdFromFile;
                 codexAuthAccountId = accountIdFromFile ?? extractAccountId(accessToken);
                 addCheck({
                     key: "codex-auth-readable",
@@ -1553,9 +1674,23 @@ export async function runDoctor(args, deps) {
             const isEmailMismatch = !!managerActiveEmail
                 && !!codexActiveEmail
                 && managerActiveEmail !== codexActiveEmail;
-            const isAccountIdMismatch = !!managerActiveAccountId
-                && !!codexActiveAccountId
-                && managerActiveAccountId !== codexActiveAccountId;
+            // A stored "org-..." id is written to auth.json as the token's
+            // workspace id, while the legacy accounts.json keeps the raw id (#700).
+            const codexActiveIdentity = codexCliState?.activeAccountId
+                ? codexCliActiveIdentity(codexCliState)
+                : { accountId: codexActiveAccountId };
+            // An org account_id in auth.json itself (written before #700) is
+            // rejected by Codex CLI 0.156+, so it is never aligned.
+            const isAccountIdMismatch = isOpenAiOrgId(codexAuthFileAccountId)
+                || (!!managerActiveAccountId
+                    && !!codexActiveAccountId
+                    && !codexAuthAccountIdsMatch({
+                        // As the writer would write it (CodexCliMirror applied).
+                        accountId: activeAccount
+                            ? codexCliAccountIdFor(activeAccount, activeAccount.accessToken)
+                            : managerActiveAccountId,
+                        accessToken: activeAccount?.accessToken,
+                    }, codexActiveIdentity));
             addCheck({
                 key: "active-selection-sync",
                 severity: isEmailMismatch || isAccountIdMismatch ? "warn" : "ok",
@@ -1627,7 +1762,7 @@ export async function runDoctor(args, deps) {
                 }
                 if (!options.dryRun && canSyncActiveAccount) {
                     pendingCodexActiveSync = {
-                        accountId: activeAccount.accountId,
+                        accountId: codexCliAccountIdFor(activeAccount, syncAccessToken, syncIdToken),
                         email: activeAccount.email,
                         accessToken: syncAccessToken,
                         refreshToken: syncRefreshToken,

package/dist/lib/codex-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AA4DA,OAAO,EAIN,yBAAyB,EACzB,MAAM,eAAe,CAAC;AA6BvB,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AA+B7C,OAAO,EAEN,KAAK,gBAAgB,EAWrB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA4IvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAuGrE;AACD,mFAAmF;AACnF,wBAAgB,wBAAwB,IAAI,CAC3C,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAwEzD;AA8PD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}
+{"version":3,"file":"codex-manager.d.ts","sourceRoot":"","sources":["../../lib/codex-manager.ts"],"names":[],"mappings":"AAsEA,OAAO,EAIN,yBAAyB,EACzB,MAAM,eAAe,CAAC;AA8BvB,OAAO,EAEN,mBAAmB,EAMnB,sBAAsB,EAGtB,MAAM,qCAAqC,CAAC;AA+B7C,OAAO,EAEN,KAAK,gBAAgB,EAWrB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;AA8IvD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAyGrE;AACD,mFAAmF;AACnF,wBAAgB,wBAAwB,IAAI,CAC3C,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAwEzD;AAyQD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C7E"}

package/dist/lib/codex-manager.js

@@ -1,4 +1,11 @@
+import { runResetsCommand } from "./codex-manager/commands/resets.js";
+import { loadResetCreditState } from "./runtime/account-reset-credits.js";
+import { loadApiRoutes } from "./api-route-store.js";
+import { loadInferenceRequestTimes } from "./runtime/inference-activity.js";
+import { loadModelInventory, refreshAndPrintModelInventory } from "./runtime/model-discovery-status.js";
 import { AUTH_INVALIDATION_MARKER, AccountManager, extractAccountEmail, extractAccountId, formatAccountLabel, formatWaitTime, sanitizeEmail, } from "./accounts.js";
+import { reboundUnauthorizedAccountIdentity, refreshCodexCliMirror, } from "./auth/account-access.js";
+import { codexCliAccountIdFor } from "./auth/token-utils.js";
 import { loadCodexCliState } from "./codex-cli/state.js";
 import { setCodexCliActiveSelection } from "./codex-cli/writer.js";
 import { parseBestArgs, printBestUsage, runBestCommand, } from "./codex-manager/commands/best.js";
@@ -27,6 +34,7 @@ import { evaluateRuntimePolicy, loadRuntimePolicyState, } from "./policy/runtime
 import { CURRENT_CODEX_MODEL } from "./request/helpers/model-map.js";
 import { runDoctor as runRepairDoctor, runFix as runRepairFix, runVerifyFlagged as runRepairVerifyFlagged, } from "./codex-manager/repair-commands.js";
 import { runUninstallCommand } from "./codex-manager/commands/uninstall.js";
+import { clearAccountsAndCredentialSidecars } from "./storage/credential-sidecars.js";
 import { runForecastCommand } from "./codex-manager/commands/forecast.js";
 import { runInitConfigCommand } from "./codex-manager/commands/init-config.js";
 import { runReportCommand } from "./codex-manager/commands/report.js";
@@ -73,6 +81,8 @@ function createRepairCommandDeps() {
         formatCompactQuotaSnapshot,
         resolveStoredAccountIdentity,
         applyTokenAccountIdentity,
+        reboundUnauthorizedAccountIdentity,
+        refreshCodexCliMirror,
     };
 }
 const IMPLEMENTED_FEATURES = [
@@ -210,7 +220,6 @@ export async function autoSyncActiveAccountToCodex() {
     let syncRefreshToken = account.refreshToken;
     let syncExpiresAt = account.expiresAt;
     let syncIdToken;
-    let syncAccountId = account.accountId;
     let syncEmail = account.email;
     let changed = false;
     let nextStoredAccount = null;
@@ -245,7 +254,6 @@ export async function autoSyncActiveAccountToCodex() {
         syncRefreshToken = refreshResult.refresh;
         syncExpiresAt = refreshResult.expires;
         syncIdToken = refreshResult.idToken;
-        syncAccountId = nextStoredAccount.accountId;
         syncEmail = nextStoredAccount.email;
     }
     if (changed && nextStoredAccount) {
@@ -273,7 +281,7 @@ export async function autoSyncActiveAccountToCodex() {
         }
     }
     return setCodexCliActiveSelection({
-        accountId: syncAccountId,
+        accountId: codexCliAccountIdFor(nextStoredAccount ?? account, syncAccessToken, syncIdToken),
         email: syncEmail,
         accessToken: syncAccessToken,
         refreshToken: syncRefreshToken,
@@ -349,6 +357,10 @@ export function buildSelectAccountTraced() {
  * Shared handler for `list` and `status` (aliases of the same view).
  */
 const runListOrStatusCommand = (rest) => runStatusCommand({
+    loadApiRoutes,
+    loadResetCreditState,
+    loadInferenceRequestTimes,
+    loadModelInventory,
     setStoragePath,
     getStoragePath,
     loadAccounts,
@@ -357,7 +369,7 @@ const runListOrStatusCommand = (rest) => runStatusCommand({
     formatRateLimitEntry,
     loadRuntimeObservabilitySnapshot: loadPersistedRuntimeObservabilitySnapshot,
     loadAppBindStatus: async () => getAppBindStatus()
-        .then((status) => (status.running ? status.router : null))
+        .then((status) => (status.running && status.router ? { ...status.router, nativeOpenai: status.state?.nativeOpenai === true } : null))
         .catch(() => null),
     loadAppHelperStatus: readAppRuntimeHelperAccountSignal,
     loadQuotaCache,
@@ -413,7 +425,11 @@ const CLI_COMMAND_HANDLERS = new Map([
             saveAccounts,
         }),
     ],
-    ["check", () => runCheckCommand({ runHealthCheck })],
+    ["check", (rest) => runCheckCommand({
+            runHealthCheck,
+            runResetCheck: () => runResetsCommand(["list", "--refresh"]),
+            runCapabilityCheck: () => refreshAndPrintModelInventory(console.log, { forceProbes: true }),
+        }, rest)],
     [
         "features",
         () => runFeaturesCommand({ implementedFeatures: IMPLEMENTED_FEATURES }),
@@ -468,6 +484,7 @@ const CLI_COMMAND_HANDLERS = new Map([
         }),
     ],
     ["usage", (rest) => runUsageCommand(rest)],
+    ["resets", (rest) => runResetsCommand(rest)],
     [
         "rotation",
         (rest) => runRotationCommand(rest, {
@@ -531,7 +548,9 @@ const CLI_COMMAND_HANDLERS = new Map([
     ],
     ["fix", (rest) => runRepairFix(rest, createRepairCommandDeps())],
     ["doctor", (rest) => runRepairDoctor(rest, createRepairCommandDeps())],
-    ["uninstall", (rest) => runUninstallCommand(rest, { clearAccounts })],
+    ["uninstall", (rest) => runUninstallCommand(rest, {
+            clearAccounts: () => clearAccountsAndCredentialSidecars(clearAccounts),
+        })],
     [
         "config",
         (rest) => {

package/dist/lib/concurrency.d.ts

@@ -0,0 +1,3 @@
+/** Bounded independent work, refilling free slots immediately and preserving result order. */
+export declare function mapWithConcurrency<T, R>(items: readonly T[], limit: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/lib/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../../lib/concurrency.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CA6B/I"}

package/dist/lib/concurrency.js

@@ -0,0 +1,31 @@
+/** Bounded independent work, refilling free slots immediately and preserving result order. */
+export async function mapWithConcurrency(items, limit, worker) {
+    if (!Number.isInteger(limit) || limit < 1)
+        throw new RangeError("Concurrency must be a positive integer");
+    const results = new Array(items.length);
+    let next = 0;
+    let failed = false;
+    let failure;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (!failed) {
+            const index = next++;
+            if (index >= items.length)
+                return;
+            const item = items[index];
+            if (item === undefined)
+                continue;
+            try {
+                results[index] = await worker(item, index);
+            }
+            catch (error) {
+                if (!failed)
+                    failure = error;
+                failed = true;
+            }
+        }
+    }));
+    // Drain active work before returning an error, so no detached writes survive the caller.
+    if (failed)
+        throw failure;
+    return results;
+}

package/dist/lib/context-budget-response.js

@@ -17,14 +17,14 @@ function buildPauseMessage(advisory) {
     const windowNote = advisory.windowSource === "override"
         ? "your configured window size"
         : "an estimated window size (unverified — set `contextBudgetGuardModelWindowOverrides` if you know the real limit)";
-    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
+    return `[Plugin Notice] Context budget guard paused this session at ${formatPercent(advisory.percent)}% of ${windowNote} for \`${advisory.model}\`, before hitting the model's actual limit.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
 Then retry your request. This pause clears itself automatically once your context usage drops back below the threshold.`;
 }
 /**

package/dist/lib/context-overflow.js

@@ -33,16 +33,16 @@ export function isContextOverflowError(status, bodyText) {
 /**
  * The message shown to users when context overflow occurs
  */
-const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
-
-Please use one of these commands to reduce context size:
-
-• **/compact** - Compress conversation history (recommended)
-• **/clear** - Start fresh with empty context
-• **/undo** - Remove recent messages
-
-Then retry your request.
-
+const CONTEXT_OVERFLOW_MESSAGE = `[Plugin Notice] Context is too long for this model.
+
+Please use one of these commands to reduce context size:
+
+• **/compact** - Compress conversation history (recommended)
+• **/clear** - Start fresh with empty context
+• **/undo** - Remove recent messages
+
+Then retry your request.
+
 Alternatively, you can switch to a model with a larger context window.`;
 /**
  * Creates a synthetic SSE response for context overflow errors.